Pass the publishing app token to the release step (#661)

scripts/release.ts

@@ -1,3 +1,4 @@
+import { Buffer } from "node:buffer";
 import path from "node:path";
 import { exec, getExecOutput } from "@actions/exec";
 import pkgJson from "../package.json" with { type: "json" };
@@ -5,6 +6,17 @@ import pkgJson from "../package.json" with { type: "json" };
 const tag = `v${pkgJson.version}`;
 const releaseLine = `v${pkgJson.version.split(".")[0]}`;
 const isPrerelease = pkgJson.version.includes("-");
+const githubToken = process.env.GITHUB_TOKEN;
+if (!githubToken) {
+  throw new Error("GITHUB_TOKEN is required");
+}
+const basic = Buffer.from(`x-access-token:${githubToken}`).toString("base64");
+const gitEnv = {
+  ...process.env,
+  GIT_CONFIG_COUNT: "1",
+  GIT_CONFIG_KEY_0: "http.https://github.com/.extraheader",
+  GIT_CONFIG_VALUE_0: `AUTHORIZATION: basic ${basic}`,
+};
 
 process.chdir(path.join(import.meta.dirname, ".."));
 
@@ -33,15 +45,23 @@ process.chdir(path.join(import.meta.dirname, ".."));
   await exec("changeset", ["tag"]);
 
   if (isPrerelease) {
-    await exec("git", ["push", "origin", `refs/tags/${tag}`]);
+    await exec("git", ["push", "origin", `refs/tags/${tag}`], {
+      env: gitEnv,
+    });
     return;
   }
 
-  await exec("git", [
-    "push",
-    "--force",
-    "--follow-tags",
-    "origin",
-    `HEAD:refs/heads/${releaseLine}`,
-  ]);
+  await exec(
+    "git",
+    [
+      "push",
+      "--force",
+      "--follow-tags",
+      "origin",
+      `HEAD:refs/heads/${releaseLine}`,
+    ],
+    {
+      env: gitEnv,
+    },
+  );
 })();