diff --git a/.github/actions/commit-and-tag/action.yml b/.github/actions/commit-and-tag/action.yml
index f85e02bfa2..a50e9d2c85 100644
--- a/.github/actions/commit-and-tag/action.yml
+++ b/.github/actions/commit-and-tag/action.yml
@@ -1,16 +1,28 @@
 name: 'commit-and-tag'
-description: 'Commits and tags the current changes.'
+description: Commits and tags the current changes.
 inputs:
   version:
-    description: 'Version to use for the tag and commit message'
+    required: true
+    description: Version to use for the tag and commit message
+  user-email:
+    description: user e-mail address to use for the commit
+    default: sap-cloud-sdk@github.com
+  user-name:
+    description: User name to use for the commit
+    default: sap-cloud-sdk
 runs:
   using: 'composite'
   steps:
     - run: |
+        git config --global user.email "$USER_EMAIL"
+        git config --global user.name "$USER_NAME"
         git add -A
         git commit -m "v$VERSION"
         git tag "v$VERSION" -m "v$VERSION"
         git push --follow-tags
       shell: bash
+      # map inputs to environment variables to avoid shell injection
       env:
         VERSION: ${{ inputs.version }}
+        USER_EMAIL: ${{ inputs.user-email }}
+        USER_NAME: ${{ inputs.user-name }}
diff --git a/.github/workflows/bump.yml b/.github/workflows/bump.yml
index ba09f52060..62c048aeb1 100644
--- a/.github/workflows/bump.yml
+++ b/.github/workflows/bump.yml
@@ -43,11 +43,6 @@ jobs:
         env:
           CHANGELOG: ${{ steps.merge-changelogs.outputs.changelog }}
 
-      # TODO: commit-and-tag does not need to rely on changesets, should be a composite action
-      - name: Setup git
-        run: |
-          git config --global user.email "sap-cloud-sdk@sap.com"
-          git config --global user.name "bot-sdk-js"
       - name: Commit and tag
         uses: ./.github/actions/commit-and-tag
         with: