fix: use RELEASE_TOKEN in auto-tag workflow

.github/workflows/auto-tag.yml

@@ -10,9 +10,16 @@ jobs:
   tag:
     runs-on: ubuntu-latest
     steps:
+      - name: Verify RELEASE_TOKEN is configured
+        run: |
+          if [ -z "${{ secrets.RELEASE_TOKEN }}" ]; then
+            echo "::error::RELEASE_TOKEN secret is not configured. Tags pushed with the default GITHUB_TOKEN cannot trigger the Release workflow."
+            exit 1
+          fi
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
+          token: ${{ secrets.RELEASE_TOKEN }}
       - name: Check for version bump
         id: version
         run: |
@@ -51,5 +58,3 @@ jobs:
             echo "Failed to push tag $TAG"
             exit 1
           fi
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

CHANGELOG.md

@@ -10,6 +10,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Changed
 - Docker dependency cache now survives version-only bumps by normalizing the root package version in a preparatory build stage.
 
+### Fixed
+- Auto Tag workflow now uses `RELEASE_TOKEN` instead of `GITHUB_TOKEN` so the pushed tag triggers the Release workflow. Tags pushed by the default `GITHUB_TOKEN` do not trigger other workflows (GitHub Actions security feature).
+
 ## [1.3.0] - 2026-03-12
 
 ### Added

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "initium"
-version = "1.3.0"
+version = "1.3.1"
 edition = "2021"
 rust-version = "1.88"
 authors = ["Kitstream <opensource@kitstream.io>"]