ci: remove PAT from release workflows, use workflow_call instead

Tags pushed with GITHUB_TOKEN don't trigger other workflows (GitHub's
anti-recursion protection), which is why a PAT was needed. Instead,
chain release and docker workflows directly via workflow_call from
bump-version, eliminating the need for a personal access token.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.github/workflows/bump-version.yml

@@ -12,13 +12,14 @@ jobs:
     name: "Bump version and create changelog"
     permissions:
       contents: write
-      packages: write
+    outputs:
+      bumped: ${{ steps.bump.outputs.bumped }}
+      tag: ${{ steps.bump.outputs.tag }}
     steps:
       - name: Check out
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
-          token: "${{ secrets.PERSONAL_ACCESS_TOKEN }}"
 
       - name: Set up Python
         uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
@@ -59,6 +60,8 @@ jobs:
             echo "Bumping version..."
             ./scripts/bump-mcp.sh
             echo "bumped=true" >> $GITHUB_OUTPUT
+            tag=$(git tag --sort=-creatordate | grep -E '^v[0-9]' | head -n 1)
+            echo "tag=$tag" >> $GITHUB_OUTPUT
           else
             echo "No commits found since $last_tag"
             echo "bumped=false" >> $GITHUB_OUTPUT
@@ -69,7 +72,6 @@ jobs:
         run: |
           git push
           git push --tags
-          echo "Pushed version tags"
 
       - name: Summary
         run: |
@@ -85,3 +87,23 @@ jobs:
             echo "" >> $GITHUB_STEP_SUMMARY
             echo "No version bump required - no relevant commits found since last release." >> $GITHUB_STEP_SUMMARY
           fi
+
+  release:
+    needs: bump-version
+    if: needs.bump-version.outputs.bumped == 'true'
+    uses: ./.github/workflows/release.yml
+    with:
+      tag: ${{ needs.bump-version.outputs.tag }}
+    permissions:
+      id-token: write
+      contents: read
+
+  docker:
+    needs: bump-version
+    if: needs.bump-version.outputs.bumped == 'true'
+    uses: ./.github/workflows/docker-build-publish.yml
+    with:
+      tag: ${{ needs.bump-version.outputs.tag }}
+    permissions:
+      contents: read
+      packages: write

.github/workflows/docker-build-publish.yml

@@ -4,6 +4,12 @@ on:
   push:
     tags:
       - "v*"
+  workflow_call:
+    inputs:
+      tag:
+        description: 'The tag to release (e.g. v0.70.2)'
+        required: true
+        type: string
 
 jobs:
   build-and-push:
@@ -12,26 +18,34 @@ jobs:
       contents: read
       packages: write
     steps:
+      - name: Resolve tag
+        id: resolve
+        run: |
+          if [ -n "${{ inputs.tag }}" ]; then
+            TAG="${{ inputs.tag }}"
+          else
+            TAG="${GITHUB_REF#refs/tags/}"
+          fi
+          echo "tag=$TAG" >> $GITHUB_OUTPUT
+          echo "version=${TAG#v}" >> $GITHUB_OUTPUT
+
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          ref: ${{ steps.resolve.outputs.tag }}
 
       - name: Docker meta
         id: meta
         uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
         with:
-          # list of Docker images to use as base name for tags
           images: |
             ghcr.io/cbcoutinho/nextcloud-mcp-server
-          # generate Docker tags based on the following events/attributes
           tags: |
-            type=schedule
-            type=ref,event=branch
-            type=ref,event=pr
-            type=semver,pattern={{version}}
-            type=semver,pattern={{major}}.{{minor}}
-            type=semver,pattern={{major}}
+            type=semver,pattern={{version}},value=${{ steps.resolve.outputs.tag }}
+            type=semver,pattern={{major}}.{{minor}},value=${{ steps.resolve.outputs.tag }}
+            type=semver,pattern={{major}},value=${{ steps.resolve.outputs.tag }}
             type=sha
-            type=raw,value=latest,enable={{is_default_branch}}
+            type=raw,value=latest
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0

.github/workflows/release.yml

@@ -4,6 +4,12 @@ on:
   push:
     tags:
       - v*
+  workflow_call:
+    inputs:
+      tag:
+        description: 'The tag to release (e.g. v0.70.2)'
+        required: true
+        type: string
 
 jobs:
   pypi:
@@ -17,8 +23,21 @@ jobs:
       id-token: write
       contents: read
     steps:
+      - name: Resolve tag
+        id: resolve
+        run: |
+          if [ -n "${{ inputs.tag }}" ]; then
+            TAG="${{ inputs.tag }}"
+          else
+            TAG="${GITHUB_REF#refs/tags/}"
+          fi
+          echo "tag=$TAG" >> $GITHUB_OUTPUT
+
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          ref: ${{ steps.resolve.outputs.tag }}
+
       - name: Install uv
         uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
       - name: Install Python 3.11