Pass GITHUB_TOKEN (github.token) into the composite step for the Gitea release API

action.yml

@@ -11,8 +11,9 @@ description: "Package and publish a WordPress plugin/theme release to a Gitea re
 #     with:
 #       channel_deploy_key: ${{ secrets.CHANNEL_DEPLOY_KEY }}
 #
-# GITHUB_REPOSITORY / GITHUB_REF_NAME / GITHUB_SERVER_URL / GITHUB_TOKEN are provided
-# automatically by the Actions runner and consumed by release.sh directly.
+# GITHUB_REPOSITORY / GITHUB_REF_NAME / GITHUB_SERVER_URL are provided automatically by the
+# runner; GITHUB_TOKEN is passed through below via github.token (a composite step's env does
+# NOT inherit it automatically), and release.sh consumes all of them directly.
 
 inputs:
   channel_deploy_key:
@@ -37,6 +38,7 @@ runs:
     - name: Release via wp-release-ci
       shell: bash
       env:
+        GITHUB_TOKEN: ${{ github.token }}
         CHANNEL_DEPLOY_KEY: ${{ inputs.channel_deploy_key }}
         CHANNEL_SSH_PORT: ${{ inputs.channel_ssh_port }}
         CHANNEL_BRANCH: ${{ inputs.channel_branch }}