release.yml's "Run semantic release" step uses .github/actions/semantic-release-pinned/ instead of python-semantic-release/python-semantic-release@39dd2052 (v10.6.1) directly. That vendored copy exists only to pin gitpython==3.1.59 in its requirements.txt — GitPython 3.1.60 removed Actor.name_email_regex, which python-semantic-release reads unconditionally on every config load, and PSR's own gitpython ~= 3.0 pin is loose enough to resolve to the broken version. See #351 for the fix and python-semantic-release/python-semantic-release#1476 for the upstream bug.

The fix is already open upstream as python-semantic-release/python-semantic-release#1477. Once that merges and ships in a release:

1. Delete .github/actions/semantic-release-pinned/ entirely.
2. In .github/workflows/release.yml, change the "Run semantic release" step's uses: back to python-semantic-release/python-semantic-release@<new-sha> (whatever SHA corresponds to the release containing #1477), keeping the same with: block (github_token, no_operation_mode).
3. Confirm a push to main runs the release job clean (or a workflow_dispatch with dry_run: true) before relying on it for a real release.

Until then this issue tracks the debt; the vendored files carry the same pointer back to this issue and to #1477 in their own comments.