From c23c32b2b9ef64ad5ce26dd52093b83c9d60918e Mon Sep 17 00:00:00 2001
From: t8y2 <1156263951@qq.com>
Date: Sun, 17 May 2026 10:12:28 +0800
Subject: [PATCH] ci(mcp): require release token for protected main

---
 .github/workflows/mcp-release.yml | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/mcp-release.yml b/.github/workflows/mcp-release.yml
index 78bcaf9ea..232ac6c18 100644
--- a/.github/workflows/mcp-release.yml
+++ b/.github/workflows/mcp-release.yml
@@ -28,7 +28,6 @@ jobs:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
-          token: ${{ secrets.MCP_RELEASE_TOKEN || github.token }}
 
       - name: Setup pnpm
         uses: pnpm/action-setup@v4
@@ -52,6 +51,15 @@ jobs:
             exit 1
           fi
 
+      - name: Check release token
+        env:
+          RELEASE_TOKEN: ${{ secrets.MCP_RELEASE_TOKEN }}
+        run: |
+          if [ -z "${RELEASE_TOKEN}" ]; then
+            echo "::error::MCP_RELEASE_TOKEN secret is required to push the MCP release commit and tag because main is protected."
+            exit 1
+          fi
+
       - name: Install native build dependencies
         run: |
           sudo apt-get update
@@ -141,8 +149,11 @@ jobs:
           git tag "mcp-v${VERSION}"
 
       - name: Push MCP release commit and tag
+        env:
+          RELEASE_TOKEN: ${{ secrets.MCP_RELEASE_TOKEN }}
         run: |
           VERSION="${{ steps.version.outputs.version }}"
+          git remote set-url origin "https://x-access-token:${RELEASE_TOKEN}@github.com/${GITHUB_REPOSITORY}.git"
           git push origin HEAD:main
           git push origin "mcp-v${VERSION}"