Use PAT for cross-repo tag creation in python-sdk workflow

.github/workflows/python-sdk.yml

@@ -8,12 +8,15 @@ on:
         required: true
         type: string
 
+permissions:
+  contents: write
+
 jobs:
   release:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Setup node
         uses: actions/setup-node@v3
@@ -27,3 +30,25 @@ jobs:
           PYPI_TOKEN: ${{ secrets.PYPI_TOKEN }}
         run: |
           fern generate --group python-sdk --version ${{ inputs.version }} --log-level debug
+
+      - name: Checkout python-sdk repo using PAT
+        uses: actions/checkout@v4
+        with:
+          repository: vectara/python-sdk
+          token: ${{ secrets.PERSONAL_ACCESS_TOKEN }}
+          ref: main
+
+      - name: Create/force tag and push
+        env:
+          GIT_AUTHOR_NAME: "github-actions[bot]"
+          GIT_AUTHOR_EMAIL: "github-actions[bot]@users.noreply.github.com"
+        run: |
+          git config user.name "$GIT_AUTHOR_NAME"
+          git config user.email "$GIT_AUTHOR_EMAIL"
+          # Ensure we have the latest remote refs
+          git fetch origin
+          # Use the remote main head (the commit that was just pushed by fern)
+          TARGET_SHA=$(git rev-parse origin/main)
+          echo "Tagging commit $TARGET_SHA"
+          git tag -fa ${{ inputs.version }} "$TARGET_SHA" -m "Release ${{ inputs.version }}"
+          git push --force origin refs/tags/${{ inputs.version }}