From dca1a6a5a6285b4c070eaeb9b9a7d56471e13d13 Mon Sep 17 00:00:00 2001
From: Mike Mulligan <mike@belineperspectives.com>
Date: Wed, 15 Jul 2026 17:42:16 -0400
Subject: [PATCH] Pass GITHUB_TOKEN (github.token) into the composite step for
 the Gitea release API

---
 action.yml | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/action.yml b/action.yml
index 76736aa..38a17a6 100644
--- a/action.yml
+++ b/action.yml
@@ -11,8 +11,9 @@ description: "Package and publish a WordPress plugin/theme release to a Gitea re
 #     with:
 #       channel_deploy_key: ${{ secrets.CHANNEL_DEPLOY_KEY }}
 #
-# GITHUB_REPOSITORY / GITHUB_REF_NAME / GITHUB_SERVER_URL / GITHUB_TOKEN are provided
-# automatically by the Actions runner and consumed by release.sh directly.
+# GITHUB_REPOSITORY / GITHUB_REF_NAME / GITHUB_SERVER_URL are provided automatically by the
+# runner; GITHUB_TOKEN is passed through below via github.token (a composite step's env does
+# NOT inherit it automatically), and release.sh consumes all of them directly.
 
 inputs:
   channel_deploy_key:
@@ -37,6 +38,7 @@ runs:
     - name: Release via wp-release-ci
       shell: bash
       env:
+        GITHUB_TOKEN: ${{ github.token }}
         CHANNEL_DEPLOY_KEY: ${{ inputs.channel_deploy_key }}
         CHANNEL_SSH_PORT: ${{ inputs.channel_ssh_port }}
         CHANNEL_BRANCH: ${{ inputs.channel_branch }}