fix callers

.github/workflows/publish.yaml

diff --git a/.github/workflows/publish.yaml b/.github/workflows/publish.yaml
index 998b76b..9cc4281 100644
--- a/.github/workflows/publish.yaml
+++ b/.github/workflows/publish.yaml
@@ -11,6 +11,8 @@
         secrets:
             BCR_PUBLISH_TOKEN:
                 required: true
+            ASPECT_DOCS_REPO_ACCESS_TOKEN:
+                required: true
     # In case of problems, let release engineers retry by manually dispatching
     # the workflow from the GitHub UI
     workflow_dispatch:

.github/workflows/release.yaml

diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 57dec07..e6def29 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -10,6 +10,8 @@
         secrets:
             BCR_PUBLISH_TOKEN:
                 required: true
+            ASPECT_DOCS_REPO_ACCESS_TOKEN:
+                required: true
     # Or, developers can manually push a tag from their clone
     push:
         tags:
@@ -32,3 +34,4 @@
             tag_name: ${{ inputs.tag_name || github.ref_name }}
         secrets:
             BCR_PUBLISH_TOKEN: ${{ secrets.BCR_PUBLISH_TOKEN }}
+            ASPECT_DOCS_REPO_ACCESS_TOKEN: ${{ secrets.ASPECT_DOCS_REPO_ACCESS_TOKEN }}

.github/workflows/tag.yaml

diff --git a/.github/workflows/tag.yaml b/.github/workflows/tag.yaml
index 2af41a6..56fea05 100644
--- a/.github/workflows/tag.yaml
+++ b/.github/workflows/tag.yaml
@@ -36,8 +36,7 @@
         uses: ./.github/workflows/release.yaml
         with:
             tag_name: ${{ needs.tag.outputs.new-tag-version }}
-        secrets:
-            BCR_PUBLISH_TOKEN: ${{ secrets.BCR_PUBLISH_TOKEN }}
+        secrets: inherit
         if: needs.tag.outputs.new-tag == 'true' && needs.tag.outputs.new-tag-version-type != 'major'
         permissions:
             id-token: write