Fix the SDK release safety check

[aburkard]

The release workflow uses PRODUCTION_REPO_TOKEN, but the release-doctor check still looked for the retired RELEASE_PLEASE_TOKEN name and never passed the current secret into the script. This makes the release PR fail even when the real release token is configured. Align the check with the release workflow and expose the secret only to that validation step.\n\nVerified with bash -n, a positive dummy-token run, and git diff --check.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[entelligence-ai-pr-reviews]

EntelligenceAI PR Summary

Updated the release-doctor workflow to pass PRODUCTION_REPO_TOKEN only to the release environment validation step. The validation script now checks the current secret name instead of the retired RELEASE_PLEASE_TOKEN, allowing configured release tokens to pass the safety check.

flowchart TD
  classDef newBehavior fill:#dcfce7,stroke:#16a34a,color:#14532d;
  Secret["PRODUCTION_REPO_TOKEN secret"] --> Step["Check release environment step"]
  Step --> Script["bin/check-release-environment"]
  Script --> Result["Release environment validation"]
  class Secret,Step,Script,Result newBehavior;

Loading

🟢 Green = new or changed in this PR

---

Review Scorecard

Dimension	Rating	Basis
Code Quality	●●●●● 5/5 — Excellent	no critical/significant findings — rated Excellent
Blast Radius	Medium	touches infra / deploy / config, 2 file(s) / ~7 line(s) changed (size only — not a blast signal)
Merge Confidence	●●●●● 5/5 — Safe to Merge	code quality 5/5 × Medium blast radius

Safe to merge — this is a clean, narrowly scoped change despite the Medium blast-radius classification from touching deployment configuration. The release-doctor workflow now limits PRODUCTION_REPO_TOKEN to the release-environment validation step, and the validation script checks the current secret name instead of the retired RELEASE_PLEASE_TOKEN; no new correctness, security, or robustness issues are evident.

Key Findings:

• The release-doctor workflow scopes PRODUCTION_REPO_TOKEN to the validation step, avoiding unnecessary exposure to unrelated workflow steps.
• The validation script uses PRODUCTION_REPO_TOKEN, matching the active release-token configuration and eliminating the stale RELEASE_PLEASE_TOKEN check.
• The change is minimal and directly addresses the release safety-check failure without introducing unrelated behavior.

Evaluated against

• 2/2 changed files reviewed
• criteria: correctness, security & access control, robustness & error handling, concurrency & data integrity, repo conventions / steering docs
• steering docs: none found in repo

Files requiring special attention

• .github/workflows/release-doctor.yml
• release environment validation script