From 4efa5c66134b003aaf077d621b2904a1b3d9347f Mon Sep 17 00:00:00 2001
From: ShifZhan <252984256+MioYuuIH@users.noreply.github.com>
Date: Thu, 9 Jul 2026 17:30:39 +0800
Subject: [PATCH] ci: harden release automation workflows

---
 .github/workflows/promote-develop-to-main.yml | 10 +++++++---
 .github/workflows/release-please.yml          | 20 ++++++++++++++-----
 2 files changed, 22 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/promote-develop-to-main.yml b/.github/workflows/promote-develop-to-main.yml
index 13bbc6de..4e99c690 100644
--- a/.github/workflows/promote-develop-to-main.yml
+++ b/.github/workflows/promote-develop-to-main.yml
@@ -26,12 +26,16 @@ on:
         description: 'Integration branch to promote'
         required: true
         default: develop
-        type: string
+        type: choice
+        options:
+          - develop
       base_branch:
         description: 'Release branch that receives the promotion PR'
         required: true
         default: main
-        type: string
+        type: choice
+        options:
+          - main
       enable_auto_merge:
         description: 'Enable auto-merge for the promotion PR after checks pass'
         required: true
@@ -52,7 +56,7 @@ jobs:
     name: Open promotion PR
     runs-on: ubuntu-latest
     env:
-      GH_TOKEN: ${{ secrets.RELEASE_AUTOMATION_TOKEN || github.token }}
+      GH_TOKEN: ${{ github.token }}
       BASE_BRANCH: ${{ inputs.base_branch }}
       HEAD_BRANCH: ${{ inputs.head_branch }}
     steps:
diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
index 02451ad6..f9e83772 100644
--- a/.github/workflows/release-please.yml
+++ b/.github/workflows/release-please.yml
@@ -42,11 +42,22 @@ jobs:
       tag_name: ${{ steps.release.outputs.tag_name }}
       version: ${{ steps.release.outputs.version }}
     steps:
+      - name: Verify release automation token
+        env:
+          RELEASE_AUTOMATION_TOKEN: ${{ secrets.RELEASE_AUTOMATION_TOKEN }}
+        run: |
+          if [[ -z "${RELEASE_AUTOMATION_TOKEN}" ]]; then
+            echo "RELEASE_AUTOMATION_TOKEN is required for release automation." >&2
+            echo "Use a repository-scoped GitHub App token or fine-grained PAT." >&2
+            echo "The token must create release tags that trigger downstream workflows." >&2
+            exit 1
+          fi
+
       - name: Run release-please
         id: release
-        uses: googleapis/release-please-action@v4
+        uses: googleapis/release-please-action@8b8fd2cc23b2e18957157a9d923d75aa0c6f6ad5 # v4
         with:
-          token: ${{ secrets.RELEASE_AUTOMATION_TOKEN || github.token }}
+          token: ${{ secrets.RELEASE_AUTOMATION_TOKEN }}
           target-branch: main
           release-type: simple
 
@@ -59,7 +70,6 @@ jobs:
             echo "- Tag: \`${{ steps.release.outputs.tag_name || 'not created' }}\`"
             echo "- Version: \`${{ steps.release.outputs.version || 'not created' }}\`"
             echo
-            echo "Use a repository secret named \`RELEASE_AUTOMATION_TOKEN\` from a"
-            echo "GitHub App or fine-grained PAT if tag or release events must"
-            echo "trigger downstream workflows."
+            echo "\`RELEASE_AUTOMATION_TOKEN\` is required so release-created tags"
+            echo "can trigger downstream Docker image and bundle workflows."
           } >> "${GITHUB_STEP_SUMMARY}"