chore: fix release workflow and dependency alerts

Author: alexasomba

.github/workflows/release-please.yml

@@ -4,16 +4,34 @@ on:
   push:
     branches:
       - main
-    tags:
-      - "v*"
+  workflow_dispatch:
 
 permissions:
   contents: write
   pull-requests: write
   id-token: write
 
+concurrency:
+  group: release-please-${{ github.ref }}
+  cancel-in-progress: false
+
 jobs:
   release-please:
+    if: github.ref == 'refs/heads/main'
+    runs-on: ubuntu-latest
+    outputs:
+      release_created: ${{ steps.release.outputs.release_created }}
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: googleapis/release-please-action@v4
+        id: release
+        with:
+          release-type: node
+
+  publish:
+    needs: release-please
+    if: needs.release-please.outputs.release_created == 'true'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -24,19 +42,14 @@ jobs:
 
       - uses: actions/setup-node@v4
         with:
-          node-version: 24
+          node-version: 22
           registry-url: "https://registry.npmjs.org"
+          cache: pnpm
 
       - name: Install dependencies
-        run: pnpm install --no-frozen-lockfile
-
-      - uses: googleapis/release-please-action@v4
-        id: release
-        with:
-          release-type: node
+        run: pnpm install --frozen-lockfile
 
       - name: Publish to NPM
-        if: ${{ steps.release.outputs.release_created || startsWith(github.ref, 'refs/tags/v') }}
-        run: pnpm publish --no-git-checks --access public
+        run: pnpm publish --no-git-checks --access public --provenance
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}