Fix the sass_api release

[nex3]

Pub.dev just launched an update that requires GitHub publish actions
to be run from a tag that matches the version number of the published
package.

[ntkme]

If you want to push with the implicit ${{ github.token }} that comes from github actions, you need to add permissions to the job definition:

permissions:
  content: write

[ntkme]

Also, another problem I remember is that pushing with implicit token won't trigger another workflow. So you probably should use ${{ secrets.GH_TOKEN }} in checkout action, that it will trigger the workflow for new tag push.

[nex3]

If you want to push with the implicit ${{ github.token }} that comes from github actions, you need to add permissions to the job definition:

permissions:
  content: write

Isn't that inherited from the invocation in ci.yml? deploy_sass_parser is pushing a tag without explicit local permissions below.

[nex3]

Also, another problem I remember is that pushing with implicit token won't trigger another workflow. So you probably should use ${{ secrets.GH_TOKEN }} in checkout action, that it will trigger the workflow for new tag push.

Done.

[ntkme]

Isn't that inherited

Permission inheritance in reusable workflow is a bit complicated. The permission declared in parent workflow defines the maximum permission child workflows can ask for, but if a child workflow did not explicitly ask for the permission, it won't get inherited from parent automatically.

https://docs.github.com/en/actions/sharing-automations/reusing-workflows#access-and-permissions

Anyways, better to use a PAT so that it guarantee the push event triggers a new workflow.

[nex3]

Well, it's now using the same setup as deploy_sass_parser including the token it uses for checkout so it should work.

[Goodwine]

Are these quotes necessary? IIRC quotes are only needed when the text contains a *

same below

[nex3]

There are a number of active YAML characters. You're right that this doesn't need them, but I prefer to use them for anything with ${{ }} interpolation just to avoid needing readers to remember when { is or isn't an active YAML character.

[ntkme]

Not entirely sure, but another way this might be broken is that git might complain that "user" is not setup. Maybe we need to add these before creating the tag:

git config user.email 
git config user.name 

[nex3]

I believe lightweight tags don't include any author information. (Note that the git user isn't set when tagging sass-parser below.)