From 5f59777037111e54653f79342534739120dcd8dd Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Tue, 18 Aug 2026 16:32:06 +0800
Subject: [PATCH] fix(release): use compatible release-plz version

Refs #166
---
 .github/workflows/release-plz.yml | 8 ++++----
 .github/workflows/release.yml     | 3 ++-
 2 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/release-plz.yml b/.github/workflows/release-plz.yml
index 69803c6..65ce3b3 100644
--- a/.github/workflows/release-plz.yml
+++ b/.github/workflows/release-plz.yml
@@ -39,10 +39,10 @@ jobs:
           MarcoIeni/release-plz-action@476794ede164c5137bfc3a1dc6ed3675275690f9
         with:
           command: release-pr
-          version: "0.3.125"
+          version: "0.3.160"
         env:
+          # Use the per-run Actions token; this is not secrets.GH_TOKEN.
           GITHUB_TOKEN: ${{ github.token }}
-          GH_TOKEN: ${{ github.token }}
 
       - name: Synchronize checked-in release metadata
         env:
@@ -112,10 +112,10 @@ jobs:
           MarcoIeni/release-plz-action@476794ede164c5137bfc3a1dc6ed3675275690f
         with:
           command: release
-          version: "0.3.125"
+          version: "0.3.160"
         env:
+          # Use the per-run Actions token; this is not secrets.GH_TOKEN.
           GITHUB_TOKEN: ${{ github.token }}
-          GH_TOKEN: ${{ github.token }}
 
       - name: Export release identity
         id: release-identity
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 5f9c77f..cac25a3 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -17,7 +17,7 @@ on:
         type: string
     secrets:
       GH_TOKEN:
-        description: Token with write access to wrightkit/homebrew-tap
+        description: Dedicated cross-repository token with write access to wrightkit/homebrew-tap
         required: true
       NPM_TOKEN:
         description: Optional npmjs.org publication token
@@ -324,6 +324,7 @@ jobs:
         with:
           repository: wrightkit/homebrew-tap
           ref: main
+          # Only this cross-repository tap operation uses secrets.GH_TOKEN.
           token: ${{ secrets.GH_TOKEN }}
           path: tap