fix(ci): run releases from the manual tag workflow

- run GoReleaser in cut-release so manual tags do not rely on a second workflow triggered by GITHUB_TOKEN
- keep the tag-push release workflow for tags created outside GitHub Actions
- remove Dependabot for now and bump actions/setup-go to the current v6.4.0 release

Author: icepuma

.github/dependabot.yml

@@ -18,7 +18,7 @@ jobs:
         uses: actions/checkout@v6.0.2
 
       - name: Set up Go
-        uses: actions/setup-go@v6.1.0
+        uses: actions/setup-go@v6.4.0
         with:
           go-version-file: go.mod
           cache: true

.github/workflows/ci.yml

@@ -90,3 +90,18 @@ jobs:
           git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
           git tag -a "${TAG}" -m "Release ${TAG}"
           git push origin "${TAG}"
+
+      - name: Set up Go
+        uses: actions/setup-go@v6.4.0
+        with:
+          go-version-file: go.mod
+          cache: true
+
+      - name: Run GoReleaser
+        uses: goreleaser/goreleaser-action@v7.0.0
+        with:
+          distribution: goreleaser
+          version: "~> v2"
+          args: release --clean
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/cut-release.yml

@@ -19,7 +19,7 @@ jobs:
           fetch-depth: 0
 
       - name: Set up Go
-        uses: actions/setup-go@v6.1.0
+        uses: actions/setup-go@v6.4.0
         with:
           go-version-file: go.mod
           cache: true