Persist checkout credentials and fail on tag auth errors

.github/workflows/tag-if-missing.yml

@@ -33,23 +33,23 @@ jobs:
           token: ${{ steps.generate_token.outputs.token }}
           ref: main
           fetch-depth: 0
-          persist-credentials: false
-
-      - name: Add Toolbox Envy to PATH
-        uses: EarthmanMuons/toolbox-envy/.github/actions/add-to-path@main
-        with:
-          include_bins: ${{ inputs.toolbox_envy_bins }}
+          persist-credentials: true
 
       - name: Configure Git identity
         run: |
           git config user.name "senile-errata[bot]"
           git config user.email "senile-errata@users.noreply.github.com"
 
+      - name: Add Toolbox Envy to PATH
+        uses: EarthmanMuons/toolbox-envy/.github/actions/add-to-path@main
+        with:
+          include_bins: ${{ inputs.toolbox_envy_bins }}
+
       - id: tag
         name: Add any missing tags
         run: |
           set -euo pipefail
-          tag="$(get-project-version | tag-if-missing || true)"
+          tag="$(get-project-version | tag-if-missing)"
           echo "tag=$tag" >>"$GITHUB_OUTPUT"
 
       - name: Annotate workflow run with new tag

.github/workflows/tag-untagged-releases-rust.yml

@@ -34,7 +34,7 @@ jobs:
           ref: main
           token: ${{ steps.generate_token.outputs.token }}
           fetch-depth: 0
-          persist-credentials: false
+          persist-credentials: true
 
       - name: Configure Git identity
         run: |
@@ -69,27 +69,9 @@ jobs:
       - name: Add any missing tags
         run: cargo release tag -v --execute --no-confirm || true
 
-      - name: Mask GitHub App token
-        env:
-          TOKEN: ${{ steps.generate_token.outputs.token }}
-        run: echo "::add-mask::${TOKEN}"
-
-      - name: Configure Git credentials for tag push
-        run: |
-          git config --global url."https://x-access-token:${TOKEN}@github.com/".insteadOf "https://github.com/"
-        env:
-          TOKEN: ${{ steps.generate_token.outputs.token }}
-
       - name: Push any new tags
         run: cargo release push -v --execute --no-confirm
 
-      - name: Remove Git credentials override
-        if: always()
-        env:
-          TOKEN: ${{ steps.generate_token.outputs.token }}
-        run: |
-          git config --global --unset-all url."https://x-access-token:${TOKEN}@github.com/".insteadOf
-
       - name: Capture tags after
         run: |
           EOF=$(dd if=/dev/urandom bs=15 count=1 status=none | base64)