From 5c29af80ec49d00e8b8f71911c1397ccb2d28a0d Mon Sep 17 00:00:00 2001
From: "github-actions[bot]" <github-actions[bot]@users.noreply.github.com>
Date: Tue, 25 Aug 2026 17:28:14 +0800
Subject: [PATCH] fix(ci): authenticate bot pushes through checkout

---
 .github/workflows/agents-release.yml | 6 +-----
 .github/workflows/mcp-release.yml    | 6 +-----
 .github/workflows/release.yml        | 6 +-----
 3 files changed, 3 insertions(+), 15 deletions(-)

diff --git a/.github/workflows/agents-release.yml b/.github/workflows/agents-release.yml
index 57f28a2b48..b50288c0bb 100644
--- a/.github/workflows/agents-release.yml
+++ b/.github/workflows/agents-release.yml
@@ -83,6 +83,7 @@ jobs:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
+          token: ${{ secrets.MCP_RELEASE_TOKEN }}
 
       - name: Download agent version patch
         uses: actions/download-artifact@v4
@@ -91,15 +92,10 @@ jobs:
 
       - name: Apply and push agent version bump
         shell: bash
-        env:
-          RELEASE_TOKEN: ${{ secrets.MCP_RELEASE_TOKEN }}
         run: |
           set -euo pipefail
           git config user.name "github-actions[bot]"
           git config user.email "github-actions[bot]@users.noreply.github.com"
-          if [ -n "${RELEASE_TOKEN}" ]; then
-            git remote set-url origin "https://x-access-token:${RELEASE_TOKEN}@github.com/${GITHUB_REPOSITORY}.git"
-          fi
           git fetch origin main --no-tags
           git switch --detach origin/main
 
diff --git a/.github/workflows/mcp-release.yml b/.github/workflows/mcp-release.yml
index 2ae4a27d18..aa6fc7da92 100644
--- a/.github/workflows/mcp-release.yml
+++ b/.github/workflows/mcp-release.yml
@@ -193,6 +193,7 @@ jobs:
       - uses: actions/checkout@v5
         with:
           fetch-depth: 0
+          token: ${{ secrets.MCP_RELEASE_TOKEN }}
 
       - name: Download package release patch
         uses: actions/download-artifact@v4
@@ -200,15 +201,10 @@ jobs:
           name: package-release-patch
 
       - name: Apply package release patch and push
-        env:
-          RELEASE_TOKEN: ${{ secrets.MCP_RELEASE_TOKEN }}
         run: |
           set -euo pipefail
           TAG="${{ needs.prepare.outputs.tag }}"
           VERSION="${{ needs.prepare.outputs.version }}"
-          if [ -n "${RELEASE_TOKEN}" ]; then
-            git remote set-url origin "https://x-access-token:${RELEASE_TOKEN}@github.com/${GITHUB_REPOSITORY}.git"
-          fi
           git config user.name "github-actions[bot]"
           git config user.email "github-actions[bot]@users.noreply.github.com"
           git fetch origin main --no-tags
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 73ef4090a2..4589154a74 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -62,6 +62,7 @@ jobs:
       - uses: actions/checkout@v5
         with:
           fetch-depth: 0
+          token: ${{ secrets.MCP_RELEASE_TOKEN }}
 
       - name: Find previous release tag
         id: prev-tag
@@ -85,8 +86,6 @@ jobs:
       - name: Commit JDBC plugin version bump
         if: steps.bump.outputs.changed == 'true'
         shell: bash
-        env:
-          RELEASE_TOKEN: ${{ secrets.MCP_RELEASE_TOKEN }}
         run: |
           TMP_DIR="$(mktemp -d)"
           cp plugins/jdbc/build.gradle "$TMP_DIR/build.gradle"
@@ -94,9 +93,6 @@ jobs:
 
           git config user.name "github-actions[bot]"
           git config user.email "github-actions[bot]@users.noreply.github.com"
-          if [ -n "${RELEASE_TOKEN}" ]; then
-            git remote set-url origin "https://x-access-token:${RELEASE_TOKEN}@github.com/${GITHUB_REPOSITORY}.git"
-          fi
           git fetch origin main
           git switch -C jdbc-plugin-version-bump origin/main
           cp "$TMP_DIR/build.gradle" plugins/jdbc/build.gradle