Tangled has no manual pipeline trigger in the UI, so run the bump workflow on every push to trunk — ko exits without a version change when the commits since the last tag don't warrant one (its own 'bump:' release commits included).
Pushes must go over SSH (knot rejects HTTP(S) pushes): decode the BUMP_SSH_KEY_BASE64 secret into a key file and point ko at it via KO_SSH_KEY, and rewrite the push URL from TANGLED_REPO_URL to the SSH form. Pin ko 1.10.0 for the KO_SSH_KEY support and cache the cargo install across runs.