fix: repair release publishing workflows

.github/workflows/docker-publish.yml

@@ -31,6 +31,9 @@ jobs:
   docker:
     name: Build and push image
     runs-on: ubuntu-latest
+    env:
+      DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
+      DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
     # 拒绝在非 v* ref 上误跑（例如 UI 里对 main 点 Run workflow）
     if: startsWith(github.ref, 'refs/tags/v')
     steps:
@@ -59,11 +62,11 @@ jobs:
         uses: docker/setup-buildx-action@v3
 
       - name: Log in to Docker Hub
-        if: ${{ secrets.DOCKERHUB_USERNAME != '' && secrets.DOCKERHUB_TOKEN != '' }}
+        if: ${{ env.DOCKERHUB_USERNAME != '' && env.DOCKERHUB_TOKEN != '' }}
         uses: docker/login-action@v3
         with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
+          username: ${{ env.DOCKERHUB_USERNAME }}
+          password: ${{ env.DOCKERHUB_TOKEN }}
 
       - name: Log in to GHCR
         uses: docker/login-action@v3
@@ -74,15 +77,13 @@ jobs:
 
       - name: Image names
         id: image
-        env:
-          HUB_USER: ${{ secrets.DOCKERHUB_USERNAME }}
         run: |
           set -euo pipefail
           ghcr="ghcr.io/$(echo '${{ github.repository }}' | tr '[:upper:]' '[:lower:]')"
           echo "ghcr=${ghcr}" >> "$GITHUB_OUTPUT"
           images="${ghcr}"
-          if [ -n "${HUB_USER}" ]; then
-            hub="${HUB_USER}/freeos"
+          if [ -n "${DOCKERHUB_USERNAME}" ]; then
+            hub="${DOCKERHUB_USERNAME}/freeos"
             echo "hub=${hub}" >> "$GITHUB_OUTPUT"
             images="${images}"$'\n'"${hub}"
           else

.github/workflows/release.yml

@@ -18,6 +18,7 @@ on:
 permissions:
   contents: write
   actions: write
+  id-token: write
 
 concurrency:
   group: release-${{ github.ref }}