From 61b820f4bca21246acf8f913f396dd55a71ee8fe Mon Sep 17 00:00:00 2001
From: t8y2 <1156263951@qq.com>
Date: Fri, 24 Jul 2026 08:48:14 +0800
Subject: [PATCH] fix(ci): use DBX bot token for agent releases

---
 .github/workflows/agents-release.yml | 18 +++++++++++++++++-
 1 file changed, 17 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/agents-release.yml b/.github/workflows/agents-release.yml
index 764e477f9c..945d0bcf75 100644
--- a/.github/workflows/agents-release.yml
+++ b/.github/workflows/agents-release.yml
@@ -283,7 +283,22 @@ jobs:
     needs: [bump-versions, build-agents, build-oracle-native, build-xugu-native, build-kingbase-native, build-jre]
     runs-on: ubuntu-latest
     steps:
+      - name: Create DBX bot release token
+        id: release-token
+        uses: actions/create-github-app-token@v3
+        with:
+          app-id: ${{ vars.DBX_BOT_APP_ID }}
+          private-key: ${{ secrets.DBX_BOT_PRIVATE_KEY }}
+          owner: ${{ github.repository_owner }}
+          repositories: dbx
+          permission-contents: write
+          # Moving agents-latest across commits that modify workflow files
+          # requires the GitHub App's dedicated Workflows permission.
+          permission-workflows: write
+
       - uses: actions/checkout@v4
+        with:
+          token: ${{ steps.release-token.outputs.token }}
       - uses: actions/download-artifact@v4
         with:
           path: artifacts
@@ -537,13 +552,14 @@ jobs:
       - name: Create GitHub Release
         uses: softprops/action-gh-release@v2
         with:
+          token: ${{ steps.release-token.outputs.token }}
           files: release/*
           body_path: RELEASE_NOTES.md
           make_latest: false
 
       - name: Update agents-latest GitHub release
         env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_TOKEN: ${{ steps.release-token.outputs.token }}
         run: |
           git tag -f agents-latest "$GITHUB_SHA"
           git push origin refs/tags/agents-latest --force