diff --git a/.github/workflows/build-release.yml b/.github/workflows/build-release.yml
index 76969ff5..fbd36293 100644
--- a/.github/workflows/build-release.yml
+++ b/.github/workflows/build-release.yml
@@ -36,6 +36,12 @@ jobs:
             arch: x64
             artifact: EMRG-*-windows-x64.exe
     runs-on: ${{ matrix.os }}
+    env:
+      # secrets 不能在 if: 中直接引用（GitHub Actions 硬限制，否则 workflow 解析失败）。
+      # 先提升为 job 级 env（允许 secrets context）；未配置时求值为空字符串 → 跳过降级。
+      MACOS_SIGNING_P12_BASE64: ${{ secrets.MACOS_SIGNING_P12_BASE64 }}
+      MACOS_SIGNING_P12_PASSWORD: ${{ secrets.MACOS_SIGNING_P12_PASSWORD }}
+      MACOS_SIGNING_IDENTITY: ${{ secrets.MACOS_SIGNING_IDENTITY }}
     steps:
       - uses: actions/checkout@v5
 
@@ -51,11 +57,8 @@ jobs:
 
       # ── macOS 代码签名（rant 2026-08-06T10:06:55 P1/P2；Secret 未配则跳过降级）──
       - name: Import signing certificate (macOS only)
-        if: runner.os == 'macOS' && secrets.MACOS_SIGNING_P12_BASE64 != ''
+        if: runner.os == 'macOS' && env.MACOS_SIGNING_P12_BASE64 != ''
         shell: bash
-        env:
-          MACOS_SIGNING_P12_BASE64: ${{ secrets.MACOS_SIGNING_P12_BASE64 }}
-          MACOS_SIGNING_P12_PASSWORD: ${{ secrets.MACOS_SIGNING_P12_PASSWORD }}
         run: |
           echo "$MACOS_SIGNING_P12_BASE64" | base64 --decode > /tmp/signing.p12
           security create-keychain -p 'ci-temp' /tmp/ci.keychain
@@ -64,6 +67,8 @@ jobs:
           security import /tmp/signing.p12 -k /tmp/ci.keychain -P "$MACOS_SIGNING_P12_PASSWORD" \
             -T /usr/bin/codesign -T /usr/bin/productsign
           security set-key-partition-list -S apple-tool:,apple: -k 'ci-temp' /tmp/ci.keychain
+          # SC2046: -s 需要将每个 keychain 路径作为独立参数传递，词分割是有意的
+          # shellcheck disable=SC2046
           security list-keychains -d user -s /tmp/ci.keychain $(security list-keychains -d user | tr -d '"')
           security find-identity -v -p codesigning /tmp/ci.keychain
 
@@ -101,8 +106,8 @@ jobs:
         env:
           # macOS 签名：CSC_LINK+CSC_KEY_PASSWORD 激活 electron-builder 自动 codesign
           # （含 hardened runtime；Secret 未配时为空 → 不签名，保持现状降级）
-          CSC_LINK: ${{ runner.os == 'macOS' && secrets.MACOS_SIGNING_P12_BASE64 != '' && 'file:///tmp/signing.p12' || '' }}
-          CSC_KEY_PASSWORD: ${{ runner.os == 'macOS' && secrets.MACOS_SIGNING_P12_PASSWORD || '' }}
+          CSC_LINK: ${{ runner.os == 'macOS' && env.MACOS_SIGNING_P12_BASE64 != '' && 'file:///tmp/signing.p12' || '' }}
+          CSC_KEY_PASSWORD: ${{ runner.os == 'macOS' && env.MACOS_SIGNING_P12_PASSWORD || '' }}
         run: |
           npm ci
           npm run dist
@@ -119,12 +124,10 @@ jobs:
 
       # ── pkg 签名（macOS only，P2；Secret 未配则跳过降级）──
       - name: Sign pkg (macOS only)
-        if: runner.os == 'macOS' && secrets.MACOS_SIGNING_IDENTITY != ''
+        if: runner.os == 'macOS' && env.MACOS_SIGNING_IDENTITY != ''
         shell: bash
-        env:
-          MACOS_SIGNING_IDENTITY: ${{ secrets.MACOS_SIGNING_IDENTITY }}
         run: |
-          PKG="$(ls dist/artifacts/EMRG-*-macos-*.pkg | head -1)"
+          PKG="$(find dist/artifacts -maxdepth 1 -name 'EMRG-*-macos-*.pkg' | head -1)"
           if [ -z "$PKG" ]; then echo "no pkg found, skipping"; exit 0; fi
           productsign --sign "$MACOS_SIGNING_IDENTITY" "$PKG" "${PKG}.signed"
           mv "${PKG}.signed" "$PKG"
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index b282a2b5..3f4f499f 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -11,6 +11,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v5
+      # #441 教训：workflow 文件的 if: secrets 等解析错误人工审查易漏
+      # （actionlint 可捕获），push 后才在 build-release 触发时暴露。
+      # → CI 全量校验所有 workflow，解析错误立即失败（R82 固化）。
+      - name: Actionlint (workflow lint)
+        uses: rhysd/actionlint@v1.7.12
       - uses: astral-sh/setup-uv@v5
         with:
           python-version: "3.13"