feat: 优化release方式

.github/workflows/release.yml

@@ -22,7 +22,28 @@ jobs:
         password: ${{ secrets.REGISTRY_PASSWORD }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        shell: sh
+        env:
+          RELEASE_TOKEN: ${{ secrets.RELEASE_TOKEN }}
+        run: |
+          set -eu
+
+          if ! command -v git >/dev/null 2>&1; then
+            echo "git is required in the job container" >&2
+            exit 1
+          fi
+
+          if [ -z "${RELEASE_TOKEN:-}" ]; then
+            echo "RELEASE_TOKEN is required" >&2
+            exit 1
+          fi
+
+          git init .
+          git remote add origin "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git"
+
+          auth_header="$(printf 'x-access-token:%s' "${RELEASE_TOKEN}" | base64 | tr -d '\n')"
+          git -c "http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION: basic ${auth_header}" fetch --force --depth=1 origin "${GITHUB_REF}:refs/remotes/origin/checkout"
+          git checkout --force "${GITHUB_SHA}"
 
       - name: Install dependencies
         run: bun install --frozen-lockfile
@@ -35,6 +56,5 @@ jobs:
 
       - name: Publish release
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           RELEASE_TOKEN: ${{ secrets.RELEASE_TOKEN }}
         run: bun scripts/publish-release.ts