ci: use RELEASE_PAT for tag push to allow release-package-helm to tri…

.github/workflows/create-release-tag.yml

@@ -20,11 +20,22 @@ jobs:
   create-tag:
     runs-on: ubuntu-latest
     steps:
+      - name: Check RELEASE_PAT is configured
+        run: |
+          if [[ -z "${{ secrets.RELEASE_PAT }}" ]]; then
+            echo "❌ RELEASE_PAT secret is not set."
+            echo "This workflow requires a PAT with 'repo' scope to push the tag and trigger release-package-helm.yml."
+            echo "Add it under: Settings → Secrets and variables → Actions → New repository secret → RELEASE_PAT"
+            exit 1
+          fi
+          echo "✅ RELEASE_PAT is configured"
+
       - name: Checkout code
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
           ref: main
+          token: ${{ secrets.RELEASE_PAT }}
 
       - name: Validate and normalize version
         id: version

.github/workflows/release-package-helm.yml

@@ -13,6 +13,16 @@ on:
   push:
     tags:
       - 'v*.*.*'
+  workflow_dispatch:
+    inputs:
+      old_operator_version:
+        description: 'OLD OPERATOR VERSION'
+        required: false
+        type: string
+      new_operator_version:
+        description: 'NEW OPERATOR VERSION (e.g. 0.2.0)'
+        required: true
+        type: string
 
 jobs:
   build-and-push-images: