From bce1304c863d80c54d390c5b4a910ddd2a9df162 Mon Sep 17 00:00:00 2001
From: Musa Misto <64855513+MusaMisto@users.noreply.github.com>
Date: Tue, 29 Sep 2026 15:02:24 +0300
Subject: [PATCH] ci: tag with the built-in GITHUB_TOKEN instead of
 S9_GITHUB_TOKEN

S9_GITHUB_TOKEN is an org PAT, last rotated 2025-09-15. It now returns HTTP
401 (it tagged successfully until late August). The reusable pipeline's tag
job would fail on the next release, leaving the version untagged, and every
later run would recompute the same version.

The tag job needs only contents: write on this repository. This workflow
already grants that, and GITHUB_TOKEN never expires. No workflow here is
triggered by tags, so it doesn't matter that GITHUB_TOKEN-created tags start
no other runs. Bitween-api uses the same reusable tag job with GITHUB_TOKEN,
and its tag job succeeds.
---
 .github/workflows/ci-cd.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/ci-cd.yml b/.github/workflows/ci-cd.yml
index e90a2bf..6f11ddb 100644
--- a/.github/workflows/ci-cd.yml
+++ b/.github/workflows/ci-cd.yml
@@ -78,9 +78,9 @@ jobs:
       # Gateway-API cluster kubeconfig (V2)
       kubeconfig-gateway: ${{ secrets.S9DEV_KUBECONFIG_V2 }}
 
-      # Custom PAT used for git tagging only (the GHCR chart push/pull use the
-      # built-in GITHUB_TOKEN, so this PAT does not need write:packages).
-      github-token: ${{ secrets.S9_GITHUB_TOKEN }}
+      # Tagging uses the job's built-in GITHUB_TOKEN (contents: write is granted
+      # above). The org PAT used here before expired (HTTP 401).
+      github-token: ${{ secrets.GITHUB_TOKEN }}
 
       # App configuration passed to helm --set-string during deploy (masked)
       helm-set-secret-values: 'db=${{ secrets.DBCS }}'