From 7c22adb0d2c1616e3cfefb2dc6bf01c23c3df768 Mon Sep 17 00:00:00 2001
From: JinYan Su <751080330@qq.com>
Date: Mon, 3 Nov 2025 16:01:22 +0800
Subject: [PATCH] fix(ci): add id-token permission and unify PyPI token for
 release workflows (#1004)

- Add id-token: write permission to both release workflows to support
  PyPI Trusted Publishing (OIDC authentication)
- Unify PyPI API token usage: both CUDA and non-CUDA releases now use
  the same PYPI_API_TOKEN secret instead of separate tokens
- This resolves the "missing or insufficient OIDC token permissions"
  error during PyPI package publishing

Co-authored-by: Claude <noreply@anthropic.com>
---
 .github/workflows/release-non-cuda.yaml | 3 ++-
 .github/workflows/release.yaml          | 1 +
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/release-non-cuda.yaml b/.github/workflows/release-non-cuda.yaml
index c03c77e8..ad08c260 100644
--- a/.github/workflows/release-non-cuda.yaml
+++ b/.github/workflows/release-non-cuda.yaml
@@ -89,6 +89,7 @@ jobs:
     runs-on: ubuntu-22.04
     permissions:
       contents: write
+      id-token: write
     steps:
       - name: Checkout source
         uses: actions/checkout@v4
@@ -119,5 +120,5 @@ jobs:
         uses: pypa/gh-action-pypi-publish@release/v1
         with:
           packages-dir: mooncake-wheel/dist-release/
-          password: ${{ secrets.PYPI_API_TOKEN_NON_CUDA }}
+          password: ${{ secrets.PYPI_API_TOKEN }}
 
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 230168b3..02fec47b 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -108,6 +108,7 @@ jobs:
     runs-on: ubuntu-22.04
     permissions:
       contents: write
+      id-token: write
     steps:
       - name: Checkout source
         uses: actions/checkout@v4