diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 0c5e216..7804a29 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -54,6 +54,13 @@ jobs:
           security set-keychain-settings -lut 21600 "$KC_PATH"
           security unlock-keychain -p "$KC_PASS" "$KC_PATH"
           security import "$CERT_PATH" -P "$P12_PASSWORD" -A -t cert -f pkcs12 -k "$KC_PATH"
+          # 校验私钥真的进来了:p12 只导出证书没带私钥时(常见坑)这里为 0,
+          # 否则后续 set-key-partition-list 只报隐晦的 SecItemCopyMatching
+          COUNT="$(security find-identity -v -p codesigning "$KC_PATH" | awk '/valid identities found/ {print $1}')"
+          if [ "${COUNT:-0}" -eq 0 ]; then
+            echo "::error::keychain 里没有可签名的身份——导出的 p12 大概率没带私钥。请在钥匙串访问「我的证书」里展开证书条目确认有「专用密钥」,连私钥一起导出 .p12 后更新 secret;若私钥不可导出(Xcode 生成于其它机器),在 Xcode → Accounts → Manage Certificates 新建证书后重新导出"
+            exit 1
+          fi
           security set-key-partition-list -S apple-tool:,apple: -k "$KC_PASS" "$KC_PATH"
           security list-keychain -d user -s "$KC_PATH" login.keychain
           echo "CS_IDENTITY=Apple Development" >> "$GITHUB_ENV"
diff --git a/create_release_tag.sh b/create_release_tag.sh
index d7260ba..3db49b1 100644
--- a/create_release_tag.sh
+++ b/create_release_tag.sh
@@ -1,6 +1,40 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
+# 记录原始分支和工作区状态
+ORIGINAL_BRANCH=$(git branch --show-current)
+STASH_CREATED=false
+
+# 保存未提交的修改（包括未跟踪文件）
+if [[ -n "$(git status --porcelain)" ]]; then
+    git stash push --include-untracked -m "temporary-release-stash"
+    STASH_CREATED=true
+fi
+
+# 无论发布成功与否，都恢复原始分支和工作区
+cleanup() {
+    local exit_code=$?
+
+    trap - EXIT
+
+    if [[ -n "$ORIGINAL_BRANCH" ]]; then
+        git switch "$ORIGINAL_BRANCH" || {
+            echo "错误：无法恢复原始分支 $ORIGINAL_BRANCH" >&2
+            exit 1
+        }
+    fi
+
+    if [[ "$STASH_CREATED" == true ]]; then
+        git stash pop || {
+            echo "错误：无法自动恢复工作区修改，请手动执行 git stash list" >&2
+            exit 1
+        }
+    fi
+
+    exit "$exit_code"
+}
+trap cleanup EXIT
+
 # 切换到 main 分支并更新
 git switch main
 git pull --ff-only origin main