fix(ci): use RELEASE_TOKEN for tag creation to bypass rulesets (#339)

Organization-level tag protection rulesets prevent GITHUB_TOKEN from
creating tags. This adds support for RELEASE_TOKEN secret (PAT or
GitHub App token with bypass permissions) while falling back to
GITHUB_TOKEN for backward compatibility.

To enable:
1. Create a PAT with 'contents: write' from an org admin account
   OR create a GitHub App with bypass permissions
2. Add as RELEASE_TOKEN repository secret

Resolves tag creation failures with error:
'Cannot create ref due to creations being restricted'

Author: julienld

.github/workflows/semver-release.yml

@@ -71,21 +71,23 @@ jobs:
     - uses: actions/checkout@v6
       with:
         fetch-depth: 0
-        token: ${{ secrets.GITHUB_TOKEN }}
+        # Use RELEASE_TOKEN (PAT/App token with bypass permissions) if available, fallback to GITHUB_TOKEN
+        token: ${{ secrets.RELEASE_TOKEN || secrets.GITHUB_TOKEN }}
 
     - name: Python Semantic Release
       id: semantic
       uses: python-semantic-release/python-semantic-release@v10.5.2
       with:
-        github_token: ${{ secrets.GITHUB_TOKEN }}
+        # Use RELEASE_TOKEN to bypass tag creation restrictions
+        github_token: ${{ secrets.RELEASE_TOKEN || secrets.GITHUB_TOKEN }}
         verbosity: "2"
         # Don't create GitHub release here - we'll create a draft below
         vcs_release: "false"
 
     - name: Create draft GitHub release
       if: steps.semantic.outputs.released == 'true'
       env:
-        GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        GH_TOKEN: ${{ secrets.RELEASE_TOKEN || secrets.GITHUB_TOKEN }}
       run: |
         VERSION="${{ steps.semantic.outputs.version }}"
         TAG="v${VERSION}"