ci(mcp): require release token for protected main

.github/workflows/mcp-release.yml

@@ -28,7 +28,6 @@ jobs:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
-          token: ${{ secrets.MCP_RELEASE_TOKEN || github.token }}
 
       - name: Setup pnpm
         uses: pnpm/action-setup@v4
@@ -52,6 +51,15 @@ jobs:
             exit 1
           fi
 
+      - name: Check release token
+        env:
+          RELEASE_TOKEN: ${{ secrets.MCP_RELEASE_TOKEN }}
+        run: |
+          if [ -z "${RELEASE_TOKEN}" ]; then
+            echo "::error::MCP_RELEASE_TOKEN secret is required to push the MCP release commit and tag because main is protected."
+            exit 1
+          fi
+
       - name: Install native build dependencies
         run: |
           sudo apt-get update
@@ -141,8 +149,11 @@ jobs:
           git tag "mcp-v${VERSION}"
 
       - name: Push MCP release commit and tag
+        env:
+          RELEASE_TOKEN: ${{ secrets.MCP_RELEASE_TOKEN }}
         run: |
           VERSION="${{ steps.version.outputs.version }}"
+          git remote set-url origin "https://x-access-token:${RELEASE_TOKEN}@github.com/${GITHUB_REPOSITORY}.git"
           git push origin HEAD:main
           git push origin "mcp-v${VERSION}"