ci: Use a PAT with tag-new in order to trigger the release workflow.

.github/workflows/release.yml

@@ -5,11 +5,6 @@ on:
   pull_request:
   merge_group:
   push: # testing, unless there's a tag (steps.0.if below)
-  workflow_run:
-    workflows: ["tag new release"]
-    types:
-      - completed
-
 
 env:
   REGISTRY: ghcr.io
@@ -27,14 +22,12 @@ jobs:
     outputs:
       binary_hashes: ${{ steps.binary.outputs.hashes }}
       image_subjects: ${{ steps.image.outputs.subjects }}
-    # https://github.com/orgs/community/discussions/26238
-    if: ${{ !github.event.workflow_run || github.event.workflow_run.conclusion == 'success' }}
     steps:
       - name: print github context
         env:
           GITHUB_CONTEXT: ${{ toJSON(github) }}
         run: echo $GITHUB_CONTEXT
-      - if: ${{ !startsWith(github.ref, 'refs/tags/') && !github.event.workflow_run }}
+      - if: ${{ !startsWith(github.ref, 'refs/tags/') }}
         run: echo "flags=--snapshot" >> $GITHUB_ENV
       - uses: actions/checkout@v4
         with:

.github/workflows/tag-new-release.yml

@@ -15,7 +15,8 @@ jobs:
       - uses: mathieudutour/github-tag-action@v6.2
         continue-on-error: true  # ok to not make a new tag
         with:
-          github_token: ${{ secrets.GITHUB_TOKEN }}
+          # Special PAT so that we trigger new workflows
+          github_token: ${{ secrets.TAG_TOKEN }}
           create_annotated_tag: true
           custom_release_rules: ci:none,chore:none,style:none
           dry_run: ${{ github.event_name != 'workflow_dispatch' && github.event_name != 'schedule' }}