From 344ff428232eabb8c0fa099a73a65573878a4e7d Mon Sep 17 00:00:00 2001
From: eezd <eezd@outlook.com>
Date: Fri, 30 Oct 2026 10:57:52 +0800
Subject: [PATCH] fix(ci): validate release identities and workflow environment

---
 .gitea/workflows/release.yml | 1 -
 scripts/release.py           | 2 ++
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml
index 9465f18..c18dd02 100644
--- a/.gitea/workflows/release.yml
+++ b/.gitea/workflows/release.yml
@@ -31,7 +31,6 @@ jobs:
     if: gitea.ref == 'refs/heads/main'
     runs-on: ubuntu-latest
     timeout-minutes: 55
-    env:
     container:
       image: node:24-bookworm
       volumes:
diff --git a/scripts/release.py b/scripts/release.py
index ed5cea3..766a1e8 100644
--- a/scripts/release.py
+++ b/scripts/release.py
@@ -310,6 +310,8 @@ def preflight(version, commit):
     require(state['version'] == version, 'Reserved version mismatch')
     validate_identity(version, commit)
     gitea, github = clients()
+    require(gitea.request('/user')['login'] == 'eezd', 'Unexpected Gitea release identity')
+    require(github.request('/user')['login'] == 'eezd', 'Unexpected GitHub release identity')
     repository = github.repo()
     require(repository['permissions']['push'], 'GitHub credential cannot publish this repository')
     scopes = {s.strip() for s in github.headers.get('X-OAuth-Scopes', '').split(',')}