GITHUB_SHA (github.sha) reflects the workflow trigger commit, which is
the main HEAD before the prepare job ran. The tag itself points to the
release commit created by prepare — a different SHA. Gitea rejects PATCH
and POST with 403 when target_commitish doesn't match the tag's commit.
Use git rev-list -n 1 TAG to resolve the exact SHA the tag points to,
ensuring the target field is always correct regardless of when or how
the release workflow is called.
Stop using GITHUB_TOKEN/GITEA_TOKEN fallbacks in prepare/do-release/publish mutation paths. Require explicit PAT wiring via secrets.RELEASE_PAT for commit/push/tag and release update operations so downstream workflows trigger reliably.
Add two focused subdirectory composite actions:
- prepare/action.yml: downloads the vociferate binary, runs it to update
changelog and release-version, then commits, tags, and pushes — replacing
the boilerplate git steps consumers previously had to write inline.
- publish/action.yml: extracts the matching changelog section and creates or
updates the Gitea/GitHub release. Outputs release-id, tag, and version so
consumers can upload their own assets after it runs.
Simplify the vociferate workflows to use ./prepare and ./publish directly,
validating both actions in the self-release pipeline.
Update README to show the clean two-action usage pattern.
