fix(gitutil): fall back to git CLI for push when no token is set

go-git's HTTPS transport does not use the system credential store,
so pushes to remotes that require credentials fail silently or with
"authentication required" when no token is provided. When token is
empty, delegate to the system git binary so that credential helpers,
SSH agents, and netrc all work as expected.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

cmd/main.go

@@ -33,6 +33,7 @@ func newRootCmd() *cobra.Command {
 	var (
 		dryRun         bool
 		noPush         bool
+		noRelease      bool
 		noCommit       bool
 		tagOnly        bool
 		branchOverride string
@@ -62,6 +63,7 @@ func newRootCmd() *cobra.Command {
 				patternSet:     patternSet,
 				dryRun:         dryRun,
 				noPush:         noPush,
+				noRelease:      noRelease,
 				noCommit:       noCommit,
 				tagOnly:        tagOnly,
 			})
@@ -70,6 +72,7 @@ func newRootCmd() *cobra.Command {
 
 	root.Flags().BoolVar(&dryRun, "dry-run", false, "print next version without making changes")
 	root.Flags().BoolVar(&noPush, "no-push", false, "create commit and tag locally without pushing or creating a GitLab release")
+	root.Flags().BoolVar(&noRelease, "no-release", false, "push commit and tag but skip creating the GitLab release")
 	root.Flags().BoolVar(&noCommit, "no-commit", false, "update pom.xml but do not commit, tag, or push")
 	root.Flags().BoolVar(&tagOnly, "tag-only", false, "tag HEAD without updating pom.xml (assumes version was already committed)")
 	root.Flags().StringVar(&branchOverride, "branch", "", "override branch name detection (required in detached HEAD)")
@@ -101,6 +104,7 @@ type options struct {
 	patternSet     bool
 	dryRun         bool
 	noPush         bool
+	noRelease      bool
 	noCommit       bool
 	tagOnly        bool
 }
@@ -264,6 +268,10 @@ func run(o options) error {
 	fmt.Fprintln(os.Stderr, "info: pushed")
 
 	// --- GitLab release ---
+	if o.noRelease {
+		fmt.Printf("released %s\n", nextTag)
+		return nil
+	}
 	if cfg.GitLab.URL == "" || cfg.GitLab.Project == "" {
 		fmt.Fprintln(os.Stderr, "warning: GitLab URL or project not configured — skipping release creation")
 		fmt.Printf("released %s\n", nextTag)

cmd/main_test.go

@@ -460,6 +460,25 @@ func TestRunSkipGitLab(t *testing.T) {
 	}
 }
 
+func TestRunNoRelease(t *testing.T) {
+	_, dir := setupRepoWithRemote(t)
+	addFile(t, dir, "x.go", "// fix")
+	repo, _ := gogit.PlainOpen(dir)
+	w, _ := repo.Worktree()
+	w.Add("x.go")
+	w.Commit("fix: patch something", &gogit.CommitOptions{Author: testSig()})
+
+	// --no-release skips GitLab release even when credentials are configured
+	t.Setenv("CI_SERVER_URL", "https://gitlab.example.com")
+	t.Setenv("CI_PROJECT_ID", "42")
+	t.Setenv("GITLAB_TOKEN", "test-token")
+
+	err := execCmd(t, "--no-release", "--branch", "release/1.2", "--repo", dir)
+	if err != nil {
+		t.Fatalf("--no-release: unexpected error: %v", err)
+	}
+}
+
 func TestRunMissingToken(t *testing.T) {
 	_, dir := setupRepoWithRemote(t)
 	addFile(t, dir, "x.go", "// fix")

internal/gitutil/gitutil.go

@@ -3,6 +3,8 @@ package gitutil
 import (
 	"errors"
 	"fmt"
+	"os"
+	"os/exec"
 	"sort"
 	"time"
 
@@ -231,9 +233,17 @@ func CreateTag(repo *gogit.Repository, tagName string) error {
 }
 
 // Push pushes the given branch and tag to the "origin" remote.
-// If token is non-empty, HTTPS basic auth (oauth2/token) is used.
-// Passing an empty token lets go-git use the system credential helper or SSH agent.
+// When token is non-empty, go-git is used with HTTPS basic auth (oauth2/token) — suitable for CI.
+// When token is empty, the system git binary is invoked so that credential helpers,
+// SSH agents, and netrc are all available as they would be for a regular git push.
 func Push(repo *gogit.Repository, branchName, tagName, token string) error {
+	if token != "" {
+		return pushWithGoGit(repo, branchName, tagName, token)
+	}
+	return pushWithCLI(repo, branchName, tagName)
+}
+
+func pushWithGoGit(repo *gogit.Repository, branchName, tagName, token string) error {
 	remote, err := repo.Remote("origin")
 	if err != nil {
 		return fmt.Errorf("remote origin not found: %w", err)
@@ -244,13 +254,10 @@ func Push(repo *gogit.Repository, branchName, tagName, token string) error {
 			gitconfig.RefSpec(fmt.Sprintf("refs/heads/%s:refs/heads/%s", branchName, branchName)),
 			gitconfig.RefSpec(fmt.Sprintf("refs/tags/%s:refs/tags/%s", tagName, tagName)),
 		},
-	}
-
-	if token != "" {
-		opts.Auth = &githttp.BasicAuth{
+		Auth: &githttp.BasicAuth{
 			Username: "oauth2",
 			Password: token,
-		}
+		},
 	}
 
 	if err := remote.Push(opts); err != nil && !errors.Is(err, gogit.NoErrAlreadyUpToDate) {
@@ -259,6 +266,24 @@ func Push(repo *gogit.Repository, branchName, tagName, token string) error {
 	return nil
 }
 
+func pushWithCLI(repo *gogit.Repository, branchName, tagName string) error {
+	wt, err := repo.Worktree()
+	if err != nil {
+		return fmt.Errorf("get worktree: %w", err)
+	}
+
+	cmd := exec.Command("git", "-C", wt.Filesystem.Root(), "push", "origin",
+		fmt.Sprintf("HEAD:refs/heads/%s", branchName),
+		fmt.Sprintf("refs/tags/%s:refs/tags/%s", tagName, tagName),
+	)
+	cmd.Stdout = os.Stderr // git push status goes to stderr conventionally
+	cmd.Stderr = os.Stderr
+	if err := cmd.Run(); err != nil {
+		return fmt.Errorf("git push: %w", err)
+	}
+	return nil
+}
+
 // resolveTagToCommit follows tag objects until it reaches a commit.
 // Handles both lightweight tags (ref → commit) and annotated tags (ref → tag object → … → commit).
 func resolveTagToCommit(repo *gogit.Repository, ref *plumbing.Reference) (plumbing.Hash, error) {