From 692f882052fa7fb943672367edc47ef013430668 Mon Sep 17 00:00:00 2001
From: zeertzjq <zeertzjq@outlook.com>
Date: Thu, 12 Mar 2026 08:54:36 +0800
Subject: [PATCH] ci: fix broken workflows after Zizmor fixes (#38264)

- Backport workflow needs to use the credentials.
- Release workflow can specify the credentials on the command line.
---
 .github/workflows/backport.yml | 2 +-
 .github/workflows/release.yml  | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/backport.yml b/.github/workflows/backport.yml
index 31708b84fe6..d721e552ede 100644
--- a/.github/workflows/backport.yml
+++ b/.github/workflows/backport.yml
@@ -16,7 +16,7 @@ jobs:
     steps:
       - uses: actions/checkout@v6
         with:
-          persist-credentials: false
+          persist-credentials: true
 
       - uses: actions/create-github-app-token@v2
         id: app-token
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 4e8af287073..132bd2e62e7 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -227,14 +227,14 @@ jobs:
           (echo 'SUBJECT=Nvim development (prerelease) build';
            echo 'PRERELEASE=--prerelease') >> $GITHUB_ENV
           gh release delete nightly --yes || true
-          git push origin :nightly || true
+          git push https://${GITHUB_ACTOR}:${GH_TOKEN}@github.com/${GITHUB_REPOSITORY} :nightly || true
 
       - if: env.TAG_NAME != 'nightly'
         run: |
           (echo 'SUBJECT=Nvim release build';
            echo 'PRERELEASE=') >> $GITHUB_ENV
           gh release delete stable --yes || true
-          git push origin :stable || true
+          git push https://${GITHUB_ACTOR}:${GH_TOKEN}@github.com/${GITHUB_REPOSITORY} :stable || true
 
       - name: Publish release
         env: