ci: restrict npm publish tags to main

2026-07-14 12:19:06 +01:00
parent 16df0a56c6
commit e5f054272d
2 changed files with 15 additions and 0 deletions
@@ -15,6 +15,15 @@ jobs:
    steps:
      - name: Checkout
        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Verify tag is on main
+        run: |
+          git merge-base --is-ancestor "$GITHUB_SHA" origin/main || {
+            echo "Tag $GITHUB_REF_NAME ($GITHUB_SHA) is not on main; refusing to publish."
+            exit 1
+          }

      - name: Setup Node.js
        uses: actions/setup-node@v4