From f55c7bdc521ac6720b5a741fd54d2cd57ec20395 Mon Sep 17 00:00:00 2001
From: chendelian <116870791@qq.com>
Date: Wed, 6 May 2026 18:07:10 +0800
Subject: [PATCH] ci(publish): use auto-injected github.token with explicit
 permissions

---
 .github/workflows/publish.yml | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 11160a9..fc8fd80 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -6,6 +6,10 @@ on:
       - 'v*'
   workflow_dispatch:
 
+permissions:
+  contents: read
+  packages: write
+
 jobs:
   publish:
     runs-on: ubuntu-latest
@@ -14,9 +18,7 @@ jobs:
         shell: bash
     env:
       PIP_BREAK_SYSTEM_PACKAGES: "1"
-      # 显式 PATH,匹配宿主机自建的 python3.12
       PATH: /usr/local/bin:/usr/local/python3.12/bin:/usr/bin:/bin:/usr/local/sbin:/usr/sbin
-      # 国内镜像,避免 pypi.org 超时
       PIP_INDEX_URL: https://pypi.tuna.tsinghua.edu.cn/simple
       PIP_EXTRA_INDEX_URL: https://mirrors.aliyun.com/pypi/simple https://mirrors.cloud.tencent.com/pypi/simple https://mirrors.huaweicloud.com/repository/pypi/simple
       PIP_DEFAULT_TIMEOUT: "180"
@@ -33,8 +35,8 @@ jobs:
 
       - name: Publish to Gitea Package Registry
         env:
-          TWINE_USERNAME: ${{ secrets.GITEA_USERNAME }}
-          TWINE_PASSWORD: ${{ secrets.GITEA_TOKEN }}
+          TWINE_USERNAME: __token__
+          TWINE_PASSWORD: ${{ github.token }}
         run: |
           python3.12 -m twine upload \
             --repository-url https://git.jc2009.com/api/packages/client-jiangchang/pypi \