From faf4f83a7bd56ab88f9103a6efcd450e6051db5d Mon Sep 17 00:00:00 2001
From: XYAIStudio <XYAIStudio@users.noreply.github.com>
Date: Tue, 29 Sep 2026 18:29:18 +0800
Subject: [PATCH] fix(release): restore PyPI and Docker publishing

---
 .github/workflows/docker-publish.yml | 15 ++++++++-------
 .github/workflows/release.yml        |  1 +
 2 files changed, 9 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml
index 558f2d1f..fba1d5c6 100644
--- a/.github/workflows/docker-publish.yml
+++ b/.github/workflows/docker-publish.yml
@@ -31,6 +31,9 @@ jobs:
   docker:
     name: Build and push image
     runs-on: ubuntu-latest
+    env:
+      DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
+      DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
     # 拒绝在非 v* ref 上误跑（例如 UI 里对 main 点 Run workflow）
     if: startsWith(github.ref, 'refs/tags/v')
     steps:
@@ -59,11 +62,11 @@ jobs:
         uses: docker/setup-buildx-action@v3
 
       - name: Log in to Docker Hub
-        if: ${{ secrets.DOCKERHUB_USERNAME != '' && secrets.DOCKERHUB_TOKEN != '' }}
+        if: ${{ env.DOCKERHUB_USERNAME != '' && env.DOCKERHUB_TOKEN != '' }}
         uses: docker/login-action@v3
         with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
+          username: ${{ env.DOCKERHUB_USERNAME }}
+          password: ${{ env.DOCKERHUB_TOKEN }}
 
       - name: Log in to GHCR
         uses: docker/login-action@v3
@@ -74,15 +77,13 @@ jobs:
 
       - name: Image names
         id: image
-        env:
-          HUB_USER: ${{ secrets.DOCKERHUB_USERNAME }}
         run: |
           set -euo pipefail
           ghcr="ghcr.io/$(echo '${{ github.repository }}' | tr '[:upper:]' '[:lower:]')"
           echo "ghcr=${ghcr}" >> "$GITHUB_OUTPUT"
           images="${ghcr}"
-          if [ -n "${HUB_USER}" ]; then
-            hub="${HUB_USER}/freeos"
+          if [ -n "${DOCKERHUB_USERNAME}" ]; then
+            hub="${DOCKERHUB_USERNAME}/freeos"
             echo "hub=${hub}" >> "$GITHUB_OUTPUT"
             images="${images}"$'\n'"${hub}"
           else
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 673f37ca..cf626dad 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -18,6 +18,7 @@ on:
 permissions:
   contents: write
   actions: write
+  id-token: write
 
 concurrency:
   group: release-${{ github.ref }}