.github/workflows/create-major-tag.yml (1)

18-28: ⚠️ Potential issue | 🔴 Critical | ⚡ Quick win

git push will fail without credentials.

Setting persist-credentials: false removes the GITHUB_TOKEN from git config after checkout. The git push at line 28 will fail with an authentication error since no credentials are configured.

Options:

1. Remove persist-credentials: false for this workflow (it needs write access for tagging)
2. Explicitly configure credentials before push

🐛 Option 2: Explicitly configure credentials

       - uses: actions/checkout@v6
-        with:
-          persist-credentials: false
       - name: Get major version
         run: |
           MAJOR_VERSION=$(echo "${GITHUB_REF#refs/tags/}" | awk -F. '{print $1}')
           echo "MAJOR_VERSION=${MAJOR_VERSION}" >> "${GITHUB_ENV}"
       - name: Create major tag
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]`@users.noreply.github.com`"
+          git remote set-url origin "https://x-access-token:${GITHUB_TOKEN}`@github.com/`${{ github.repository }}.git"
           git tag "v${MAJOR_VERSION}"
           git push -f origin "refs/tags/v${MAJOR_VERSION}"

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/create-major-tag.yml around lines 18 - 28, The workflow
currently disables credentials in the checkout step (persist-credentials: false)
but later runs the "Create major tag" step which runs git push using
MAJOR_VERSION; restore or provide credentials so git push succeeds: either
remove or set persist-credentials to true on the actions/checkout@v6 step, or
add a step before the "Create major tag" step to configure git credentials using
the GITHUB_TOKEN (e.g., set git remote auth or run actions/setup-auth) so the
git tag "v${MAJOR_VERSION}" push can authenticate successfully.