ci: trunk-based release — publish on version tags, single main branch (#57)

- publish.yml triggers on 'v*' tags instead of pushing to a release branch,
  and verifies the tag matches package.json before publishing
- ci.yml runs on main + PRs only (drop development/production env branches)
- dependabot targets main

For a library, releases are npm versions marked by git tags, not deploy-style
env branches. Companion manual step: rename default branch production -> main
and delete development.

Author: devCluna

.github/dependabot.yml

@@ -9,7 +9,7 @@ updates:
       time: "09:00"
       timezone: "America/Guayaquil"
     open-pull-requests-limit: 10
-    target-branch: "development"
+    target-branch: "main"
     groups:
       strapi:
         patterns:
@@ -37,4 +37,4 @@ updates:
       time: "09:00"
       timezone: "America/Guayaquil"
     open-pull-requests-limit: 5
-    target-branch: "development"
+    target-branch: "main"

.github/workflows/ci.yml

@@ -4,8 +4,6 @@ on:
   push:
     branches:
       - main
-      - development
-      - production
   pull_request:
 
 jobs:

.github/workflows/publish.yml

@@ -2,8 +2,8 @@ name: Publish to npm
 
 on:
   push:
-    branches:
-      - production
+    tags:
+      - 'v*'
 
 jobs:
   publish:
@@ -63,20 +63,22 @@ jobs:
             echo "tag=latest" >> $GITHUB_OUTPUT
           fi
 
+      - name: Verify tag matches package version
+        run: |
+          if [ "${{ github.ref_name }}" != "v${{ steps.pkg.outputs.version }}" ]; then
+            echo "❌ Tag ${{ github.ref_name }} does not match package.json version v${{ steps.pkg.outputs.version }}."
+            exit 1
+          fi
+
       - name: Publish to npm
         run: npm publish --access public --tag ${{ steps.tag.outputs.tag }}
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
 
-      - name: Create git tag
-        run: |
-          git tag v${{ steps.pkg.outputs.version }}
-          git push origin v${{ steps.pkg.outputs.version }}
-
       - name: Create GitHub release
         uses: softprops/action-gh-release@v2
         with:
-          tag_name: v${{ steps.pkg.outputs.version }}
-          name: v${{ steps.pkg.outputs.version }}
+          tag_name: ${{ github.ref_name }}
+          name: ${{ github.ref_name }}
           generate_release_notes: true
           token: ${{ secrets.GITHUB_TOKEN }}