fix: Workaround branch protection

sr/action.yaml

@@ -9,7 +9,10 @@ inputs:
     default: https://git.oceanbox.io
 
   gitea-token:
-    description: Gitea access token
+    description: >-
+      Gitea access token used to push the release commit and create the
+      release. On branch-protected branches this must be a PAT of a real user
+      on the branch's push whitelist, not the Actions token (uid -2).
     required: true
 
   nix-shell:
@@ -110,6 +113,20 @@ runs:
         }
         EOF
 
+    - name: Pin origin remote to the provided token
+      shell: bash
+      env:
+        GITEA_TOKEN: ${{ inputs.gitea-token }}
+        GITEA_URL: ${{ inputs.gitea-url }}
+      run: |
+        set -o pipefail
+        set -o nounset
+        set -o errexit
+        # Push as the real user behind GITEA_TOKEN, not the checkout's Actions token (uid -2).
+        repo_path="$(git remote get-url origin | sed -E 's#^https?://[^/]+/##')"
+        host="$(echo "$GITEA_URL" | sed -E 's#^https?://##; s#/$##')"
+        git remote set-url origin "https://oauth2:${GITEA_TOKEN}@${host}/${repo_path}"
+
     - name: Run semantic-release
       id: semantic
       shell: bash