chore(ci): sign action release commits via API

- Rename release.yml to release-action.yml (Release Action)
- Commit CHANGELOG via GitHub API so it shows as Verified
- Create tag ref via API instead of git push
- Drop persisted credentials from checkout

Author: oniice

.github/workflows/release.yml .github/workflows/release-action.yml.github/workflows/release.yml renamed to .github/workflows/release-action.yml

@@ -1,4 +1,4 @@
-name: Release
+name: Release Action
 
 on:
   workflow_dispatch:
@@ -31,8 +31,7 @@ jobs:
         with:
           ref: main
           fetch-depth: 0
-          token: ${{ secrets.PAT || secrets.GITHUB_TOKEN }}
-          persist-credentials: true
+          persist-credentials: false
 
       - name: Determine version and scheme
         id: version
@@ -67,11 +66,17 @@ jobs:
             fi
           fi
 
-      - name: Create and push tag
+      # Local tag is needed for changelog generation; remote ref is created via the API
+      - name: Create tag
         if: github.event_name == 'workflow_dispatch'
+        env:
+          GH_TOKEN: ${{ secrets.PAT || secrets.GITHUB_TOKEN }}
+          TAG: ${{ steps.version.outputs.tag }}
         run: |
-          git tag "${{ steps.version.outputs.tag }}"
-          git push origin "${{ steps.version.outputs.tag }}"
+          git tag "$TAG"
+          gh api "repos/${GITHUB_REPOSITORY}/git/refs" \
+            -f ref="refs/tags/${TAG}" \
+            -f sha="$(git rev-parse HEAD)"
 
       - name: Get previous tag
         id: previous
@@ -116,10 +121,14 @@ jobs:
           useGitmojis: false
           writeToFile: true
 
+      # Commits via the GitHub API are signed by GitHub and show as Verified
       - name: Commit updated CHANGELOG
         if: steps.previous.outputs.found == 'true'
-        uses: stefanzweifel/git-auto-commit-action@v7
+        uses: planetscale/ghcommit-action@v0.2.22
         with:
-          branch: main
           commit_message: "docs: update CHANGELOG for ${{ steps.version.outputs.tag }}"
+          repo: ${{ github.repository }}
+          branch: main
           file_pattern: CHANGELOG.md
+        env:
+          GITHUB_TOKEN: ${{ secrets.PAT || secrets.GITHUB_TOKEN }}