Fix release workflow

It turns out that creating a draft release doesn't trigger a `release: created` event. Instead, we need to push a tag, which then fires the `push: tags` event.

For this to work, the push must be performed with a non-default PAT. A BOT_RELEASE_GITHUB_TOKEN secrets has been created with minimal privileges, and scoped to this repository.

Note that tags were previously created implicitly when creating the GitHub release.

Signed-off-by: nscuro <nscuro@protonmail.com>

Author: nscuro

.github/workflows/ci-publish.yaml

@@ -1,9 +1,9 @@
 name: Publish CI
 
 on:
-  release:
-    types:
-      - created
+  push:
+    tags:
+      - '[0-9]*'
   workflow_dispatch:
 
 permissions: {}

.github/workflows/ci-release.yaml

@@ -21,11 +21,11 @@ permissions: {}
 jobs:
   prepare-release:
     runs-on: ubuntu-latest
-    permissions:
-      contents: write # Required to create commits.
     steps:
       - name: Checkout Repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # tag=v6.0.2
+        with:
+          token: ${{ secrets.BOT_RELEASE_GITHUB_TOKEN }}
 
       - name: Set up NodeJs
         uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # tag=v6.3.0
@@ -41,17 +41,18 @@ jobs:
           git config user.name "dependencytrack-bot"
           git config user.email "106437498+dependencytrack-bot@users.noreply.github.com"
 
-          npm version "${VERSION_TO_BUMP}" -m "prepare-release: set version to %s"
+          npm version "${VERSION_TO_BUMP}" --tag-version-prefix="" -m "prepare-release: set version to %s"
 
-          git push origin "HEAD:${GIT_REF}"
+          VERSION=$(jq -r '.version' package.json)
+          git push origin "HEAD:${GIT_REF}" "${VERSION}"
 
       - name: Create GitHub Release
         env:
-          GITHUB_TOKEN: ${{ secrets.BOT_RELEASE_TOKEN }}
+          GITHUB_TOKEN: ${{ secrets.BOT_RELEASE_GITHUB_TOKEN }}
           VERSION_TO_BUMP: ${{ github.event.inputs.version-to-bump }}
           GIT_REF_NAME: ${{ github.ref_name }}
         run: |-
-          VERSION=`jq -r '.version' package.json`
+          VERSION=$(jq -r '.version' package.json)
           GH_OPTS=""
 
           if [[ "${VERSION_TO_BUMP}" == *pre* ]]; then