@joshuafolkken/kit 1.1784.0 → 1.2116.0

package/.claude/skills/workflow-commands/kickoff.md

@@ -8,8 +8,8 @@
   3. Analyze requirements → **scope assessment per `split-assessment.md`**.
   4. **Record the plan** — written to a file in the session language (`JOSH_SESSION_LANG`, default
      `ja`), then `pnpm josh issue:plan <N> --body-file <path> --title "<title>" --planned`: it renames
-     the issue, fills a blank body or comments otherwise, and applies `run:planned`, so the next
-     command's `run:entry` starts at the implementation. A target named in front of the reference
+     the issue, writes the plan into the body when it is blank and its author has write access (a
+     comment otherwise), and applies `run:planned`, so the next command's `run:entry` starts at the implementation. A target named in front of the reference
      adds `--repo <owner/name>`. Before writing the plan, run `pnpm josh plan:consumers
      <identifier...>` on what it adds or changes and finish the `### 影響を受ける既存の利用者` draft it
      prints; `issue:plan` refuses a plan without it (`docs/josh-commands-backlog.md` → "`josh issue:plan`").

package/.claude/skills/workflow-commands/observation-filing.md

@@ -23,7 +23,7 @@ report. Drop an observation nobody would act on.
 `pnpm josh run:event --append note "#<N> <text>"`, shown by `pnpm josh run:board`
 (`docs/josh-commands-run.md` → "`josh run:board`").
 
-**The filing ceilings still apply.** It counts toward the per-run cap (`prerequisite.md`); above the target
+**The filing ceilings still apply.** It counts toward the per-origin cap of ten (`prerequisite.md`); above the target
 repository's WIP cap, close one first or do not file (`prompts/collaboration-workflow/wip-cap.md`).
 File with `pnpm josh issue:file` (`issue-scout.md`): it lints the body, applies the classification
 labels, scans for duplicates and runs `epic:bundle` (an `auto-ok` epic adds it to the backlog pool —

package/.claude/skills/workflow-commands/observation-ledger.md

@@ -66,9 +66,11 @@ blocked depth-0 work is filed as before.
   goes ahead.
 - **A review round that passes after the pull request opened is recorded on the Issue, not in the
   ledger** — `pnpm josh review:record --issue <N> --comment` (`pnpm josh ship --review` does this for a
-  passing round 2), so CI does not restart. **A round 2 that blocks records in the tree as before.**
-  Once the Issue closes, the next ledger round carries the comment's lines into
-  `<N>-comment-rounds.md` (`review-comment-round.ts`).
+  passing round 2), so CI does not restart; so does any code round on a pushed, clean tree, a
+  blocking round 2 included.
+  Once the Issue closes, the next ledger round outside a lane carries the comment's lines into
+  `<N>-comment-rounds.md` (`review-comment-round.ts`); a lane child leaves that to
+  `pnpm josh observations:flush`.
 - **`pnpm josh followup` commits any other line appended after the run's commit onto the pull request,
   before the merge** — only when the ledger holds a pending append; a broken line refuses the merge.
 - **A lane carries its own lines, in its own pull request.**
@@ -88,7 +90,7 @@ blocked depth-0 work is filed as before.
 - **On `observation:record` answering `file`, the observation is filed**, at depth 1 or deeper, with
   no depth-0 citation (only when exactly one earlier sighting exists).
 - **The Issue quotes the ledger's own dates — the first sighting's and this one's.**
-- **Both ceilings still apply** (`observation-filing.md`): the per-run filing cap and the WIP cap.
+- **Both ceilings still apply** (`observation-filing.md`): the per-origin filing cap and the WIP cap.
 
 **A third and later sighting appends a line and files nothing more** — `pnpm josh issue:scout` finds
 the open Issue.

package/.claude/skills/workflow-commands/pre-gate-cut.md

@@ -35,12 +35,13 @@ pnpm josh run:cut <N>
 
 - `cut` (0) — record written and handed to the lane's launch owner (OpenAI supervisor starts the
   successor after this process exits; Anthropic relaunches directly). **End the turn immediately.**
-- `under-threshold` (0) — the newest request's billed input is under `CONTEXT_CUT_THRESHOLD`; **continue to the gate.**
+- `under-threshold` (0) — the newest request's billed input is under the `pnpm josh cost --cut` threshold; **continue to the gate.**
 - `not-a-lane` (0) — not a dispatched child. **Continue to the gate.**
 - `unready` (1) — the tree is clean or on the default branch. Continue to the gate.
 - `busy` (1) — a cut is already in flight for this tree. Do not relaunch.
 - `failed` (1) — no live OpenAI supervisor, or the Anthropic relaunch could not start. Continue.
 - `unknown` (1) — the git directory could not be read. Continue to the gate.
+- `split-unresolved` (1) — `split-assessment.md` → "Over the guide before the gate".
 
 **`cut` is the only verdict that ends the turn.**
 
@@ -63,7 +64,8 @@ pnpm josh run:cut --resume <N>
   implementation**; re-read the issue body and comments, then go straight to `pnpm josh gate`.
 - `resume-impl` (0) — the cut was taken **during** implementation. Skip the title, the plan, the
   fresh hold claim and the split assessment, re-read the plan, then **continue implementation** — do
-  **not** go straight to the gate.
+  **not** go straight to the gate. A round 1 the resume prints is continued, not rerun
+  (`scripts/run/cut/run-cut-review.ts`).
 - `handed-off` (0) — a successor already adopted this cut. **End the turn quietly and do nothing**;
   no Telegram owed.
 - `stale` (1) — the record does not match the tree (branch, clean tree, expired, or unknown hand-off).
@@ -99,8 +101,7 @@ The child ends mid-implementation and a fresh one resumes **back into implementa
 ### The measurement is the parent hand-off's, never a second one
 
 Same `cost_verdict.per_request_cost` through `cost_cli.session_verdict` as `backlogrun-progress.md` →
-"The hand-off"; `run_cut.IMPLEMENTATION_CONTEXT_THRESHOLD` aliases the **135_000**
-`CONTEXT_CUT_THRESHOLD`.
+"The hand-off", against the same threshold `pnpm josh cost --cut` prints.
 
 ### It is a guard, fired at the edit that crosses the threshold
 
@@ -112,15 +113,16 @@ record**, so the cut may fire again. **A cut that relaunches its successor owes
 clears. Outside a
 lane, `run:cut --impl` prints the held run's instruction: on `over`, keep the hold, send a
 `confirmation` Telegram naming `fullrun #<N>`, end the turn. **It fires on every threshold crossing,
-not once per run**; **An edit reissued right after a refusal passes**; **An unmeasurable session
+not once per run**; **An edit reissued right after a refusal passes**; **The run's own handoff
+`Write` always passes**; **An unmeasurable session
 warrants the cut**; **It is silent between a cut and its resume** (`scripts/rules/implementation-cut.ts`).
 A child that ended without cutting is detected by
 `pnpm josh run:ending <N> --output <path>`.
 
 ## The threshold
 
-`CONTEXT_CUT_THRESHOLD` and `cost_verdict.per_request_cost` live in
-`scripts/cost-runtime/context-cut-payback.ts`; both cuts and the parent hand-off read the same verdict,
+The threshold is the break-even context `scripts/cost-runtime/context-cut-payback.ts` prices at the
+session's model — `pnpm josh cost --cut` prints it, no fixed figure fits every model; both cuts and the parent hand-off read the same verdict,
 and an unmeasurable session is always cut. Both cuts end the turn **before** the gate, so the push is never a
 turn boundary (`chain-rule.md`).
 

package/.claude/skills/workflow-commands/prerequisite.md

@@ -62,6 +62,7 @@ later steps name its number. **Its duplicate scan is read exactly as it is for a
 — the stash, the comment naming its `stash:pop`, the blocked-by and the release; a failure is rerun as
 is (`docs/josh-commands-run.md` → `josh run:pause`). Name the comment's pop in the Telegram too.
 
-**Automatic filing is capped at 10 Issues per run** at every entry point; the `filing-cap` row of
-`pnpm josh rule:list` refuses the eleventh filing (`prompts/collaboration-workflow/rule-delivery.md`). On reaching it, stop
+**Automatic filing is capped at 10 Issues per originating work item** at every entry point;
+`pnpm josh issue:file` refuses the eleventh, and `--found-during <N>` names an origin the checkout
+does not (`docs/josh-commands-backlog.md` → "`josh issue:file`", step 2). On reaching it, stop
 and report. `kickoff` is exempt — it never implements, so it never discovers one.

package/.claude/skills/workflow-commands/retrospective.md

@@ -35,7 +35,7 @@ every regressed row, and the scout keeps a repeat sighting from filing twice.
 ledger** (drained by `pnpm josh observations:flush`). **File nothing when nothing passes.**
 
 **Exclude what is already filed or already done, through the existing scout** (`issue-scout.md`): file
-with `pnpm josh issue:file`, which scouts first — an **open** candidate covering it means do not file, a
+with `pnpm josh issue:file`, which scouts — an **open** candidate covering it means do not file, a
 `(closed)` one means already merged. It also runs `epic:bundle` on each new Issue.
 
 ## `auto-ok`, and closing the step
@@ -44,7 +44,7 @@ with `pnpm josh issue:file`, which scouts first — an **open** candidate coveri
 `- 人の判断: 不要`, so `issue:file` applies the label (with the run label
 `prompts/collaboration-workflow/issue-template.md` requires). **`backlogrun-steps.md` → "What one
 invocation approves" is that judgement's single source.** Every brake still counts these filings: the
-ten-per-run ceiling, the WIP cap, `--max` and the 135,000-token session budget.
+ten-per-origin ceiling (with no origin, counted with the invocation's other no-origin filings), the WIP cap, `--max` and the `pnpm josh cost --cut` session budget.
 
 **Close with `pnpm josh run:carry --retrospective --summary "<result>" --owner "$PPID"`.** It marks the
 carry record so `run:step` prints `stop` from then on; the mark survives a session cut and is removed at

package/.claude/skills/workflow-commands/split-assessment.md

@@ -40,14 +40,16 @@ a judgement, so its `split` is the size condition met, not a decision to divide.
 ## Over the guide before the gate
 
 **Trigger: `pnpm josh main:merge` prints a `split notice`** — the branch's diff, untracked files
-included, answers `split` on `split:assess`. Take one action before `pnpm josh run:cut <N>`
+included, answers `split` on `split:assess`; the first `pnpm josh lint:related` or `pnpm josh
+test:related` past the guide prints it earlier, once per Issue. Take one action on it, before `pnpm josh run:cut <N>`
 (`chain-rule.md` step 1) — the cut ends the turn, and the resumed run does not see the notice:
 
-- Keep it one Issue — it must land together: record why in one Issue comment, citing the counts.
-- Carve the rest out — the unimplemented part merges separately: `pnpm josh issue:file` it, narrow
-  this Issue's acceptance criteria to this branch, then gate.
+- Keep it one Issue — it must land together: one Issue comment with the line
+  `- 分割しない理由: <理由>`, citing the counts.
+- Carve the rest out — the unimplemented part merges separately: `pnpm josh issue:file --route split --found-during <N>`
+  it, narrow this Issue's acceptance criteria to this branch, then gate.
 
-The notice never stops the run and never creates an epic.
+Neither on record: the pre-gate `run:cut` answers `split-unresolved`. The notice never creates an epic.
 
 ## What each entry point does with the answer
 

package/.codex/hooks.json

@@ -6,7 +6,7 @@
 				"hooks": [
 					{
 						"type": "command",
-						"command": "project_root=\"${CLAUDE_PROJECT_DIR:-$( (unset GIT_ALTERNATE_OBJECT_DIRECTORIES GIT_COMMON_DIR GIT_DIR GIT_INDEX_FILE GIT_NAMESPACE GIT_OBJECT_DIRECTORY GIT_WORK_TREE; git rev-parse --show-toplevel 2>/dev/null) || git rev-parse --show-toplevel)}\" && cd \"$project_root\" && sh scripts/hooks/run-hook.sh audit-provision",
+						"command": "export JOSH_HOOK_CWD=\"$PWD\" && project_root=\"${CLAUDE_PROJECT_DIR:-$( (unset GIT_ALTERNATE_OBJECT_DIRECTORIES GIT_COMMON_DIR GIT_DIR GIT_INDEX_FILE GIT_NAMESPACE GIT_OBJECT_DIRECTORY GIT_WORK_TREE; git rev-parse --show-toplevel 2>/dev/null) || git rev-parse --show-toplevel)}\" && cd \"$project_root\" && sh scripts/hooks/run-hook.sh audit-provision --session-start",
 						"timeout": 180
 					}
 				]
@@ -17,7 +17,7 @@
 				"hooks": [
 					{
 						"type": "command",
-						"command": "project_root=\"${CLAUDE_PROJECT_DIR:-$( (unset GIT_ALTERNATE_OBJECT_DIRECTORIES GIT_COMMON_DIR GIT_DIR GIT_INDEX_FILE GIT_NAMESPACE GIT_OBJECT_DIRECTORY GIT_WORK_TREE; git rev-parse --show-toplevel 2>/dev/null) || git rev-parse --show-toplevel)}\" && cd \"$project_root\" && sh scripts/hooks/run-hook.sh session-lang",
+						"command": "export JOSH_HOOK_CWD=\"$PWD\" && project_root=\"${CLAUDE_PROJECT_DIR:-$( (unset GIT_ALTERNATE_OBJECT_DIRECTORIES GIT_COMMON_DIR GIT_DIR GIT_INDEX_FILE GIT_NAMESPACE GIT_OBJECT_DIRECTORY GIT_WORK_TREE; git rev-parse --show-toplevel 2>/dev/null) || git rev-parse --show-toplevel)}\" && cd \"$project_root\" && sh scripts/hooks/run-hook.sh session-lang",
 						"timeout": 10
 					}
 				]
@@ -29,7 +29,7 @@
 				"hooks": [
 					{
 						"type": "command",
-						"command": "project_root=\"${CLAUDE_PROJECT_DIR:-$( (unset GIT_ALTERNATE_OBJECT_DIRECTORIES GIT_COMMON_DIR GIT_DIR GIT_INDEX_FILE GIT_NAMESPACE GIT_OBJECT_DIRECTORY GIT_WORK_TREE; git rev-parse --show-toplevel 2>/dev/null) || git rev-parse --show-toplevel)}\" && cd \"$project_root\" && sh scripts/hooks/run-hook.sh codex-hook-adapter pretool",
+						"command": "export JOSH_HOOK_CWD=\"$PWD\" && project_root=\"${CLAUDE_PROJECT_DIR:-$( (unset GIT_ALTERNATE_OBJECT_DIRECTORIES GIT_COMMON_DIR GIT_DIR GIT_INDEX_FILE GIT_NAMESPACE GIT_OBJECT_DIRECTORY GIT_WORK_TREE; git rev-parse --show-toplevel 2>/dev/null) || git rev-parse --show-toplevel)}\" && cd \"$project_root\" && sh scripts/hooks/run-hook.sh codex-hook-adapter pretool",
 						"timeout": 20
 					}
 				]
@@ -41,7 +41,7 @@
 				"hooks": [
 					{
 						"type": "command",
-						"command": "project_root=\"${CLAUDE_PROJECT_DIR:-$( (unset GIT_ALTERNATE_OBJECT_DIRECTORIES GIT_COMMON_DIR GIT_DIR GIT_INDEX_FILE GIT_NAMESPACE GIT_OBJECT_DIRECTORY GIT_WORK_TREE; git rev-parse --show-toplevel 2>/dev/null) || git rev-parse --show-toplevel)}\" && cd \"$project_root\" && sh scripts/hooks/run-hook.sh codex-hook-adapter posttool",
+						"command": "export JOSH_HOOK_CWD=\"$PWD\" && project_root=\"${CLAUDE_PROJECT_DIR:-$( (unset GIT_ALTERNATE_OBJECT_DIRECTORIES GIT_COMMON_DIR GIT_DIR GIT_INDEX_FILE GIT_NAMESPACE GIT_OBJECT_DIRECTORY GIT_WORK_TREE; git rev-parse --show-toplevel 2>/dev/null) || git rev-parse --show-toplevel)}\" && cd \"$project_root\" && sh scripts/hooks/run-hook.sh codex-hook-adapter posttool",
 						"timeout": 90
 					}
 				]
@@ -53,7 +53,7 @@
 				"hooks": [
 					{
 						"type": "command",
-						"command": "project_root=\"${CLAUDE_PROJECT_DIR:-$( (unset GIT_ALTERNATE_OBJECT_DIRECTORIES GIT_COMMON_DIR GIT_DIR GIT_INDEX_FILE GIT_NAMESPACE GIT_OBJECT_DIRECTORY GIT_WORK_TREE; git rev-parse --show-toplevel 2>/dev/null) || git rev-parse --show-toplevel)}\" && cd \"$project_root\" && sh scripts/hooks/run-hook.sh stop-guard",
+						"command": "export JOSH_HOOK_CWD=\"$PWD\" && project_root=\"${CLAUDE_PROJECT_DIR:-$( (unset GIT_ALTERNATE_OBJECT_DIRECTORIES GIT_COMMON_DIR GIT_DIR GIT_INDEX_FILE GIT_NAMESPACE GIT_OBJECT_DIRECTORY GIT_WORK_TREE; git rev-parse --show-toplevel 2>/dev/null) || git rev-parse --show-toplevel)}\" && cd \"$project_root\" && sh scripts/hooks/run-hook.sh stop-guard",
 						"timeout": 20
 					}
 				]

package/.github/actions/setup-pnpm/action.yml

@@ -48,27 +48,20 @@ runs:
         test -n "$version"
         echo "version=$version" >> "$GITHUB_OUTPUT"
 
+    # The store is cached by pnpm/setup itself, keyed on the lockfile and the requested runtime and
+    # restored before the runtime is installed. A separate actions/cache step restored the store
+    # only after pnpm/setup had installed the runtime, so the job's runtime came from the registry
+    # every run, and a download that crawled at 100 KB/s timed the job out at 10 minutes
+    # (joshuafolkken/kit#5315). Caching it in pnpm's store, rather than taking Node from setup-node's
+    # tool cache, keeps setup-node the one place the default Node version is written.
     - name: Setup pnpm
       uses: pnpm/setup@a0881977cd8ea73b1ed212236c99ca10dcc80cf4 # v3.1.1
       with:
         version: ${{ steps.pnpm-version.outputs.version }}
         runtime: ${{ inputs.runtime }}
+        cache: ${{ inputs.install == 'true' && inputs.cache == 'true' }}
         install: false
 
-    - name: Resolve pnpm store path
-      if: inputs.install == 'true' && inputs.cache == 'true'
-      shell: bash
-      run: echo "PNPM_STORE_PATH=$(pnpm store path)" >> "$GITHUB_ENV"
-
-    - name: Setup pnpm store cache
-      if: inputs.install == 'true' && inputs.cache == 'true'
-      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-      with:
-        path: ${{ env.PNPM_STORE_PATH }}
-        key: ${{ runner.os }}-pnpm-store-${{ hashFiles('pnpm-lock.yaml') }}
-        restore-keys: |
-          ${{ runner.os }}-pnpm-store-
-
     # The safe-chain release and the SHA-256 of that release's install-safe-chain.sh. The installer
     # puts the safe-chain binary under ~/.safe-chain/bin and adds it to PATH beside the shims;
     # `pnpm dlx … setup-ci` left only the shims, which then let every install through without a scan
@@ -77,8 +70,8 @@ runs:
       if: inputs.install == 'true'
       shell: bash
       env:
-        SAFE_CHAIN_INSTALLER_VERSION: 1.5.20
-        SAFE_CHAIN_INSTALLER_SHA256: 0ad25efe15d1fa56105157a454d647223e78eb0c53d1f85e3d10afcd722e7bfd
+        SAFE_CHAIN_INSTALLER_VERSION: 1.5.26
+        SAFE_CHAIN_INSTALLER_SHA256: 9e4af7107f06d9c0d758cb08fb36804c2af88e24972f3a9d3f8c2bd0ca002adf
       run: |
         installer="$RUNNER_TEMP/install-safe-chain.sh"
         curl --proto '=https' -fsSL "https://github.com/AikidoSec/safe-chain/releases/download/$SAFE_CHAIN_INSTALLER_VERSION/install-safe-chain.sh" -o "$installer"

package/.github/dependabot.yml

@@ -13,7 +13,23 @@ updates:
     # `GITHUB_TOKEN` may not, so GitHub withdraws its auto-merge (joshuafolkken/kit#4148). kit's own
     # file only: the distributed `templates/dependabot.yml` stays ungrouped, because a consumer's
     # auto-merge holds a whole pull request that touches an upstream-managed workflow.
+    #
+    # The actions the publish jobs run with publish credentials, and those of the `pack` job that
+    # builds the tarball they publish, come first, in a pull request of their own:
+    # `.github/workflows/dependabot-auto-merge.yml` merges only the `github-actions` group, so a
+    # person reviews each bump of these (joshuafolkken/kit#4633, joshuafolkken/kit#4654). This list
+    # is the only one.
     groups:
+      publish-actions:
+        patterns:
+          - 'actions/checkout'
+          - 'actions/download-artifact'
+          - 'actions/setup-node'
+          - 'actions/upload-artifact'
+          - 'pnpm/setup'
+        update-types:
+          - 'minor'
+          - 'patch'
       github-actions:
         update-types:
           - 'minor'

package/.github/workflows/auto-tag.yml

@@ -13,11 +13,44 @@ jobs:
       actions: write
       contents: write
     steps:
+      # The dispatch payload is only a claim: any holder of a contents:write token can send
+      # ci-passed-on-main with any sha, including a commit main's branch protection never saw
+      # (joshuafolkken/kit#4651). Only a commit main contains, whose push-event CI run reached its
+      # Notify Auto Tag job, is tagged — that job runs only once every check it needs has passed.
+      - name: Verify the dispatched commit
+        env:
+          GH_TOKEN: ${{ github.token }}
+          GH_REPO: ${{ github.repository }}
+          SHA: ${{ github.event.client_payload.sha }}
+        run: |
+          if ! [[ "$SHA" =~ ^[0-9a-f]{40}$ ]]; then
+            echo "::error::ci-passed-on-main carried no full commit sha: $SHA" >&2
+            exit 1
+          fi
+
+          STATUS=$(gh api "repos/$GH_REPO/compare/main...$SHA" --jq '.status')
+          if [ "$STATUS" != "identical" ] && [ "$STATUS" != "behind" ]; then
+            echo "::error::$SHA is not on main (compare status: $STATUS)" >&2
+            exit 1
+          fi
+
+          RUN_IDS=$(gh api "repos/$GH_REPO/actions/workflows/ci.yml/runs?head_sha=$SHA&event=push&branch=main" --jq '.workflow_runs[].id')
+          for RUN_ID in $RUN_IDS; do
+            if gh api "repos/$GH_REPO/actions/runs/$RUN_ID/jobs?per_page=100" --jq '.jobs[] | select(.name == "Notify Auto Tag") | "\(.status)/\(.conclusion)"' | grep -Eqx 'in_progress/null|completed/success'; then
+              echo "✅ $SHA is on main and passed CI run $RUN_ID"
+              exit 0
+            fi
+          done
+
+          echo "::error::No push-event CI run on main passed for $SHA" >&2
+          exit 1
+
       - name: Checkout code
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ github.event.client_payload.sha }}
           fetch-depth: 2
+          persist-credentials: false
 
       # No Node.js setup: this job installs nothing and reads package.json with jq, which the runner
       # image ships, so a Node.js version step would only add time (joshuafolkken/kit#3326).
@@ -68,10 +101,17 @@ jobs:
         id: tag_check
         if: steps.version_check.outputs.changed == 'true'
         env:
+          GH_TOKEN: ${{ github.token }}
           VERSION: ${{ steps.current_version.outputs.version }}
         run: |
           TAG="v$VERSION"
 
+          # The checkout keeps no credentials, so the token reaches git for this step only, through
+          # the environment rather than .git/config; a private repository needs it to fetch.
+          BASIC=$(printf 'x-access-token:%s' "$GH_TOKEN" | base64 -w0)
+          echo "::add-mask::$BASIC"
+          export GIT_CONFIG_COUNT=1 GIT_CONFIG_KEY_0=http.https://github.com/.extraheader GIT_CONFIG_VALUE_0="AUTHORIZATION: basic $BASIC"
+
           # Shallow checkout (fetch-depth: 2) does not fetch tags, so the existence
           # check would miss tags that already exist on the remote. Fetch them first.
           git fetch origin --tags --force
@@ -88,10 +128,15 @@ jobs:
         id: create_tag
         if: steps.version_check.outputs.changed == 'true' && steps.tag_check.outputs.exists == 'false'
         env:
+          GH_TOKEN: ${{ github.token }}
           VERSION: ${{ steps.current_version.outputs.version }}
         run: |
           TAG="v$VERSION"
 
+          BASIC=$(printf 'x-access-token:%s' "$GH_TOKEN" | base64 -w0)
+          echo "::add-mask::$BASIC"
+          export GIT_CONFIG_COUNT=1 GIT_CONFIG_KEY_0=http.https://github.com/.extraheader GIT_CONFIG_VALUE_0="AUTHORIZATION: basic $BASIC"
+
           git config user.name "github-actions[bot]"
           git config user.email "github-actions[bot]@users.noreply.github.com"