ci: fix protected branch error in release workflow

[matejchalk]

Possible fix for #1114. Follow-up to #1117.

Turns out the default github-actions[bot] can't push to main (see CI error):

NX Pushing to git remote "origin"

NX Unexpected git push error: remote: error: GH006: Protected branch update failed for refs/heads/main.

remote:
remote: - Changes must be made through a pull request.
To https://github.com/code-pushup/cli
! [remote rejected] main -> main (protected branch hook declined)
! [remote rejected] v0.80.0 -> v0.80.0 (atomic transaction failed)
error: failed to push some refs to 'https://github.com/code-pushup/cli'

This is probably why the code-pushup-bot was used before, because unlike the built-in GitHub bot, we can configure exceptions for GitHub Apps.

The Git user configuration is taken from an example in create-github-app-token docs.

I've tested the authentication here. I can't really test the rest until this is merged into main 🤞

[nx-cloud]

View your CI Pipeline Execution ↗ for commit 37341a7

Command	Status	Duration	Result
nx code-pushup --nx-bail -- compare	✅ Succeeded	54s	View ↗
nx code-pushup --nx-bail --	✅ Succeeded	1m 11s	View ↗
nx code-pushup --nx-bail -- print-config --outp...	✅ Succeeded	1m 27s	View ↗

---

☁️ Nx Cloud last updated this comment at 2025-09-24 12:15:34 UTC

[nx-cloud]

View your CI Pipeline Execution ↗ for commit 37341a7

Command	Status	Duration	Result
nx affected -t int-test --parallel=3	✅ Succeeded	<1s	View ↗
nx affected -t e2e-test --parallel=1	✅ Succeeded	<1s	View ↗
nx affected -t unit-test --parallel=3	✅ Succeeded	<1s	View ↗

---

☁️ Nx Cloud last updated this comment at 2025-09-24 12:06:11 UTC

[pkg-pr-new]

Open in StackBlitz

@code-pushup/ci

npm i https://pkg.pr.new/code-pushup/cli/@code-pushup/ci@1120

@code-pushup/cli

npm i https://pkg.pr.new/code-pushup/cli/@code-pushup/cli@1120

@code-pushup/core

npm i https://pkg.pr.new/code-pushup/cli/@code-pushup/core@1120

@code-pushup/create-cli

npm i https://pkg.pr.new/code-pushup/cli/@code-pushup/create-cli@1120

@code-pushup/models

npm i https://pkg.pr.new/code-pushup/cli/@code-pushup/models@1120

@code-pushup/nx-plugin

npm i https://pkg.pr.new/code-pushup/cli/@code-pushup/nx-plugin@1120

@code-pushup/coverage-plugin

npm i https://pkg.pr.new/code-pushup/cli/@code-pushup/coverage-plugin@1120

@code-pushup/eslint-plugin

npm i https://pkg.pr.new/code-pushup/cli/@code-pushup/eslint-plugin@1120

@code-pushup/js-packages-plugin

npm i https://pkg.pr.new/code-pushup/cli/@code-pushup/js-packages-plugin@1120

@code-pushup/jsdocs-plugin

npm i https://pkg.pr.new/code-pushup/cli/@code-pushup/jsdocs-plugin@1120

@code-pushup/lighthouse-plugin

npm i https://pkg.pr.new/code-pushup/cli/@code-pushup/lighthouse-plugin@1120

@code-pushup/typescript-plugin

npm i https://pkg.pr.new/code-pushup/cli/@code-pushup/typescript-plugin@1120

@code-pushup/utils

npm i https://pkg.pr.new/code-pushup/cli/@code-pushup/utils@1120

@code-pushup/models-transformers

npm i https://pkg.pr.new/code-pushup/cli/@code-pushup/models-transformers@1120

commit: 37341a7

[github-actions]

Code PushUp

🤨 Code PushUp report has both improvements and regressions – compared current commit 89d0227 with previous commit 53336e8.

🕵️ See full comparison in Code PushUp portal 🔍

🏷️ Categories

🏷️ Category	⭐ Previous score	⭐ Current score	🔄 Score change
Performance	🔴 43	🔴 42
Code coverage	🟡 90	🟡 90
Security	🟡 56	🟡 56	–
Updates	🟡 85	🟡 85	–
Accessibility	🟢 92	🟢 92	–
Best Practices	🟢 100	🟢 100	–
SEO	🟡 61	🟡 61	–
Type Safety	🟢 100	🟢 100	–
Bug prevention	🟢 100	🟢 100	–
Miscellaneous	🟢 100	🟢 100	–
Code style	🟢 100	🟢 100	–
Documentation	🔴 24	🔴 24	–

👍 1 group improved, 👎 1 group regressed, 👍 3 audits improved, 👎 4 audits regressed, 12 audits changed without impacting score

🗃️ Groups

🔌 Plugin	🗃️ Group	⭐ Previous score	⭐ Current score	🔄 Score change
Lighthouse	Performance	🔴 43	🔴 42
Code coverage	Code coverage metrics	🟡 90	🟡 90

19 other groups are unchanged.

🛡️ Audits

🔌 Plugin	🛡️ Audit	📏 Previous value	📏 Current value	🔄 Value change
Lighthouse	Total Blocking Time	🟥 1,010 ms	🟥 1,080 ms
Lighthouse	First Contentful Paint	🟥 3.1 s	🟥 3.0 s
Lighthouse	Speed Index	🟥 5.9 s	🟥 5.9 s
Lighthouse	Time to Interactive	🟥 12.3 s	🟥 12.4 s
Code coverage	Branch coverage	🟨 86.4 %	🟨 85.5 %
Code coverage	Function coverage	🟩 91.9 %	🟩 92.5 %
Code coverage	Line coverage	🟨 86.5 %	🟨 86.3 %
Lighthouse	Avoids enormous network payloads	🟩 Total size was 2,037 KiB	🟩 Total size was 2,032 KiB
Lighthouse	Minimizes main-thread work	🟥 8.7 s	🟥 9.3 s
Lighthouse	Uses efficient cache policy on static assets	🟨 30 resources found	🟨 30 resources found
Lighthouse	JavaScript execution time	🟥 3.1 s	🟥 3.4 s
Lighthouse	Largest Contentful Paint	🟥 10.7 s	🟥 10.9 s
Lighthouse	Reduce unused JavaScript	🟥 Potential savings of 156 KiB	🟥 Potential savings of 178 KiB
Lighthouse	Reduce unused CSS	🟥 Potential savings of 102 KiB	🟥 Potential savings of 81 KiB
Lighthouse	Metrics	🟩 100%	🟩 100%
Lighthouse	Initial server response time was short	🟩 Root document took 420 ms	🟩 Root document took 520 ms
Lighthouse	Server Backend Latencies	🟩 1,660 ms	🟩 1,740 ms
Lighthouse	Max Potential First Input Delay	🟥 770 ms	🟥 820 ms
Lighthouse	Network Round Trip Times	🟩 20 ms	🟩 20 ms

591 other audits are unchanged.