From ef17e0517c227a40122d5373391bdc1a96e798d8 Mon Sep 17 00:00:00 2001
From: whowes <whowes@google.com>
Date: Thu, 30 Jul 2026 23:44:54 +0000
Subject: [PATCH] ci: use GitHub token in create_additional_release_tag push

---
 .github/workflows/create_additional_release_tag.yaml | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/create_additional_release_tag.yaml b/.github/workflows/create_additional_release_tag.yaml
index adb579e2bbd1..2dbacf3adf13 100644
--- a/.github/workflows/create_additional_release_tag.yaml
+++ b/.github/workflows/create_additional_release_tag.yaml
@@ -7,6 +7,11 @@ on:
   release:
     types: [published]
   workflow_dispatch:
+    inputs:
+      target_ref:
+        description: 'Git ref (tag or SHA) to check out and tag. Defaults to branch HEAD if empty.'
+        required: false
+        default: ''
 jobs:
   build:
     runs-on: ubuntu-latest
@@ -18,6 +23,7 @@ jobs:
     - name: Checkout code
       uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
       with:
+        ref: ${{ inputs.target_ref || github.ref }}
         token: ${{ secrets.CLOUD_JAVA_BOT_GITHUB_TOKEN }}
         persist-credentials: false
     - name: Set up Git
@@ -38,7 +44,7 @@ jobs:
             continue
           fi
           git tag $TAG_NAME
-          git push origin $TAG_NAME
+          git push https://x-access-token:${GH_TOKEN}@github.com/${GITHUB_REPOSITORY}.git $TAG_NAME
           if [ "${ARTIFACT_ID}" = "libraries-bom" ]; then
             echo "Creating GitHub Release for ${TAG_NAME}"
             gh release create "${TAG_NAME}" --title "GCP Libraries BOM ${VERSION}" --notes "libraries-bom release."