ci: Fix semantic release credentials (#1530)

.github/workflows/semantic-release.yml

@@ -5,9 +5,6 @@ permissions:
   contents: read
 
 on:
-  # TODO: Remove once semantic-release is working and before the dry-run flag is
-  # removed.
-  pull_request:
   push:
     branches:
       - main
@@ -18,6 +15,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          # Fetch all tags, so semantic-release can calculate the correct next release.
+          fetch-depth: 0
+
+          # Do not remove credentials after checkout.
+          persist-credentials: false
       - uses: volta-cli/action@v4
       - run: yarn install --immutable
       - run: npx semantic-release --dry-run