From 705d2e9bbe24051284a80a4de41d62d62233b023 Mon Sep 17 00:00:00 2001
From: liuyi <forehalo@gmail.com>
Date: Mon, 23 Jun 2025 14:39:03 +0800
Subject: [PATCH] ci: fix release workflow

---
 .github/workflows/release.yml | 53 ++++++++++++++++-------------------
 1 file changed, 24 insertions(+), 29 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 2a973ee095..d60ca50891 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -30,6 +30,10 @@ permissions:
   contents: write
   pull-requests: write
   actions: write
+  id-token: write
+  packages: write
+  security-events: write
+  attestations: write
 
 jobs:
   prepare:
@@ -48,20 +52,17 @@ jobs:
   cloud:
     name: Release Cloud
     if: ${{ inputs.web || github.event_name != 'workflow_dispatch' }}
-    runs-on: ubuntu-latest
     needs:
       - prepare
-    steps:
-      - uses: actions/checkout@v4
-      - name: Release Cloud
-        uses: ./.github/workflows/release-cloud.yml
-        with:
-          build-type: ${{ needs.prepare.outputs.BUILD_TYPE }}
-          app-version: ${{ needs.prepare.outputs.APP_VERSION }}
-          git-short-hash: ${{ needs.prepare.outputs.GIT_SHORT_HASH }}
+    uses: ./.github/workflows/release-cloud.yml
+    secrets: inherit
+    with:
+      build-type: ${{ needs.prepare.outputs.BUILD_TYPE }}
+      app-version: ${{ needs.prepare.outputs.APP_VERSION }}
+      git-short-hash: ${{ needs.prepare.outputs.GIT_SHORT_HASH }}
 
-  release-image:
-    name: Release Image
+  image:
+    name: Release Docker Image
     runs-on: ubuntu-latest
     needs:
       - prepare
@@ -100,29 +101,23 @@ jobs:
   desktop:
     name: Release Desktop
     if: ${{ inputs.desktop || github.event_name != 'workflow_dispatch' }}
-    runs-on: ubuntu-latest
     needs:
       - prepare
-    steps:
-      - uses: actions/checkout@v4
-      - name: Release Desktop
-        uses: ./.github/workflows/release-desktop.yml
-        with:
-          build-type: ${{ needs.prepare.outputs.BUILD_TYPE }}
-          app-version: ${{ needs.prepare.outputs.APP_VERSION }}
-          git-short-hash: ${{ needs.prepare.outputs.GIT_SHORT_HASH }}
+    uses: ./.github/workflows/release-desktop.yml
+    secrets: inherit
+    with:
+      build-type: ${{ needs.prepare.outputs.BUILD_TYPE }}
+      app-version: ${{ needs.prepare.outputs.APP_VERSION }}
+      git-short-hash: ${{ needs.prepare.outputs.GIT_SHORT_HASH }}
 
   mobile:
     name: Release Mobile
     if: ${{ inputs.mobile }}
-    runs-on: ubuntu-latest
     needs:
       - prepare
-    steps:
-      - uses: actions/checkout@v4
-      - name: Release Mobile
-        uses: ./.github/workflows/release-mobile.yml
-        with:
-          build-type: ${{ needs.prepare.outputs.BUILD_TYPE }}
-          app-version: ${{ needs.prepare.outputs.APP_VERSION }}
-          git-short-hash: ${{ needs.prepare.outputs.GIT_SHORT_HASH }}
+    uses: ./.github/workflows/release-mobile.yml
+    secrets: inherit
+    with:
+      build-type: ${{ needs.prepare.outputs.BUILD_TYPE }}
+      app-version: ${{ needs.prepare.outputs.APP_VERSION }}
+      git-short-hash: ${{ needs.prepare.outputs.GIT_SHORT_HASH }}