From 083c54785bd41604cefe6be8f5818aa0c9ffc745 Mon Sep 17 00:00:00 2001
From: Joas Schilling <coding@schilljs.com>
Date: Tue, 27 Jan 2026 15:28:54 +0100
Subject: [PATCH] ci(actions): Satisfy zizmor

Code change is copied from command-compile.yml

Signed-off-by: Joas Schilling <coding@schilljs.com>
---
 .github/workflows/update-node-dist.yml | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/update-node-dist.yml b/.github/workflows/update-node-dist.yml
index df42f9cb612..4837b29ef6e 100644
--- a/.github/workflows/update-node-dist.yml
+++ b/.github/workflows/update-node-dist.yml
@@ -27,6 +27,8 @@ jobs:
       - name: Checkout
         uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
         with:
+          # Needed to allow force push later
+          persist-credentials: true
           token: ${{ secrets.BOT_GITHUB_TOKEN }}
 
       - name: Read package.json node and npm engines version
@@ -78,7 +80,9 @@ jobs:
 
       - name: Add and commit
         if: steps.changes.outputs.CHANGED != ''
+        env:
+          HEAD_REF: ${{ needs.init.outputs.head_ref }}
         run: |
           git add --force js/ css/
           git commit --signoff -m 'chore(assets): recompile assets'
-          git push origin ${{ github.head_ref }}
+          git push origin "$HEAD_REF"