From 2a66d4fed4c3ede2b5f596e8138f20b0f8269c8a Mon Sep 17 00:00:00 2001
From: Xianpeng Shen <3353385+shenxianpeng@users.noreply.github.com>
Date: Thu, 22 Oct 2026 20:43:33 +0000
Subject: [PATCH] ci: pass the release tag to the publish script through env

The tag name was spliced into the run script with ${{ }}, so a tag
holding shell syntax would have run in the job that holds the MCP
Registry OIDC token. Read it from the environment instead.
---
 .github/workflows/publish.yml | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 3c4ba14..8f471f8 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -89,8 +89,12 @@ jobs:
 
       - name: Extract version from release tag
         id: version
+        env:
+          # Through the environment, not spliced into the script: a tag name
+          # may hold characters the shell would run.
+          RELEASE_TAG: ${{ github.event.release.tag_name }}
         run: |
-          TAG="${{ github.event.release.tag_name }}"
+          TAG="$RELEASE_TAG"
           if [ -z "$TAG" ]; then
             TAG="$(git describe --tags --abbrev=0)"
           fi
@@ -99,8 +103,9 @@ jobs:
           echo "version=$VERSION" >> "$GITHUB_OUTPUT"
 
       - name: Set version in server.json
+        env:
+          VERSION: ${{ steps.version.outputs.version }}
         run: |
-          VERSION="${{ steps.version.outputs.version }}"
           echo "Setting server.json version to $VERSION"
           jq --arg v "$VERSION" '.version = $v | .packages[0].version = $v' server.json > server.json.tmp
           mv server.json.tmp server.json