From 99bced8e48908b02ab977801ad2c52eefd0eb768 Mon Sep 17 00:00:00 2001
From: Aaron Bull Schaefer <aaron@elasticdog.com>
Date: Thu, 12 Feb 2026 07:51:55 -0800
Subject: [PATCH] Persist checkout credentials and fail on tag auth errors

---
 .github/workflows/tag-if-missing.yml          | 14 ++++++-------
 .../workflows/tag-untagged-releases-rust.yml  | 20 +------------------
 2 files changed, 8 insertions(+), 26 deletions(-)

diff --git a/.github/workflows/tag-if-missing.yml b/.github/workflows/tag-if-missing.yml
index c75f661..d441670 100644
--- a/.github/workflows/tag-if-missing.yml
+++ b/.github/workflows/tag-if-missing.yml
@@ -33,23 +33,23 @@ jobs:
           token: ${{ steps.generate_token.outputs.token }}
           ref: main
           fetch-depth: 0
-          persist-credentials: false
-
-      - name: Add Toolbox Envy to PATH
-        uses: EarthmanMuons/toolbox-envy/.github/actions/add-to-path@main
-        with:
-          include_bins: ${{ inputs.toolbox_envy_bins }}
+          persist-credentials: true
 
       - name: Configure Git identity
         run: |
           git config user.name "senile-errata[bot]"
           git config user.email "senile-errata@users.noreply.github.com"
 
+      - name: Add Toolbox Envy to PATH
+        uses: EarthmanMuons/toolbox-envy/.github/actions/add-to-path@main
+        with:
+          include_bins: ${{ inputs.toolbox_envy_bins }}
+
       - id: tag
         name: Add any missing tags
         run: |
           set -euo pipefail
-          tag="$(get-project-version | tag-if-missing || true)"
+          tag="$(get-project-version | tag-if-missing)"
           echo "tag=$tag" >>"$GITHUB_OUTPUT"
 
       - name: Annotate workflow run with new tag
diff --git a/.github/workflows/tag-untagged-releases-rust.yml b/.github/workflows/tag-untagged-releases-rust.yml
index 47d7274..f27f4ff 100644
--- a/.github/workflows/tag-untagged-releases-rust.yml
+++ b/.github/workflows/tag-untagged-releases-rust.yml
@@ -34,7 +34,7 @@ jobs:
           ref: main
           token: ${{ steps.generate_token.outputs.token }}
           fetch-depth: 0
-          persist-credentials: false
+          persist-credentials: true
 
       - name: Configure Git identity
         run: |
@@ -69,27 +69,9 @@ jobs:
       - name: Add any missing tags
         run: cargo release tag -v --execute --no-confirm || true
 
-      - name: Mask GitHub App token
-        env:
-          TOKEN: ${{ steps.generate_token.outputs.token }}
-        run: echo "::add-mask::${TOKEN}"
-
-      - name: Configure Git credentials for tag push
-        run: |
-          git config --global url."https://x-access-token:${TOKEN}@github.com/".insteadOf "https://github.com/"
-        env:
-          TOKEN: ${{ steps.generate_token.outputs.token }}
-
       - name: Push any new tags
         run: cargo release push -v --execute --no-confirm
 
-      - name: Remove Git credentials override
-        if: always()
-        env:
-          TOKEN: ${{ steps.generate_token.outputs.token }}
-        run: |
-          git config --global --unset-all url."https://x-access-token:${TOKEN}@github.com/".insteadOf
-
       - name: Capture tags after
         run: |
           EOF=$(dd if=/dev/urandom bs=15 count=1 status=none | base64)