ci: no persist-cred for tagging #test-1

Author: psadi

.github/workflows/ci.yaml

@@ -67,20 +67,21 @@ jobs:
 
   tag:
     name: "👻 Tip Tag"
+    permissions:
+      actions: read
+      security-events: write
+      contents: write
     runs-on: ubuntu-latest
     needs:
       - build_appimage
-    if: ${{ github.event_name == 'schedule' }}
     steps:
-      - uses: actions/checkout@v4
-        with:
-          persist-credentials: false
+      - uses: actions/checkout@v4 # zizmor: ignore[artipacked]
       - name: Tip Tag
         run: |
           git config user.name "github-actions[bot]"
           git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
-          git tag -fa tip -m "Latest Continuous Release" ${GITHUB_SHA}
-          git push --force origin tip
+          git tag -fa test-tip -m "Latest Continuous Release" ${GITHUB_SHA}
+          git push --force origin test-tip
 
   release_stable:
     name: 👻 Release Ghostty AppImage (Stable)
@@ -111,14 +112,14 @@ jobs:
 
   release_nightly:
     name: 👻 Release Ghostty AppImage (Nightly)
+    if: ${{ github.event_name == 'schedule' && github.ref_name == 'main' }}
     needs:
       - build_appimage
       - tag
     permissions:
       actions: read
       contents: write
     runs-on: ubuntu-latest
-    if: ${{ github.event_name == 'schedule' }}
     steps:
       - uses: actions/download-artifact@v4
         with:
@@ -127,13 +128,13 @@ jobs:
       - uses: actions/download-artifact@v4
         with:
           name: ghostty-appimage-x86_64
+
       - name: Ghostty Tip ("Nightly")
-        if: ${{ github.event_name == 'schedule' && github.ref_name == 'main' }}
         uses: softprops/[email protected]
         with:
           name: '👻 Ghostty Tip ("Nightly")'
           prerelease: true
-          tag_name: tip
+          tag_name: test-tip
           target_commitish: ${{ github.sha }}
           files: |
             *.AppImage*