From 271fa4d7e3cb428e86a24dc6cac849a23839e0ce Mon Sep 17 00:00:00 2001
From: devcluna <dev.cluna@gmail.com>
Date: Thu, 2 Jul 2026 13:31:53 -0500
Subject: [PATCH] =?UTF-8?q?ci:=20trunk-based=20release=20=E2=80=94=20publi?=
 =?UTF-8?q?sh=20on=20version=20tags,=20single=20main=20branch?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- publish.yml triggers on 'v*' tags instead of pushing to a release branch,
  and verifies the tag matches package.json before publishing
- ci.yml runs on main + PRs only (drop development/production env branches)
- dependabot targets main

For a library, releases are npm versions marked by git tags, not deploy-style
env branches. Companion manual step: rename default branch production -> main
and delete development.
---
 .github/dependabot.yml        |  4 ++--
 .github/workflows/ci.yml      |  2 --
 .github/workflows/publish.yml | 20 +++++++++++---------
 3 files changed, 13 insertions(+), 13 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index ca7866c..0e1a2d0 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -9,7 +9,7 @@ updates:
       time: "09:00"
       timezone: "America/Guayaquil"
     open-pull-requests-limit: 10
-    target-branch: "development"
+    target-branch: "main"
     groups:
       strapi:
         patterns:
@@ -37,4 +37,4 @@ updates:
       time: "09:00"
       timezone: "America/Guayaquil"
     open-pull-requests-limit: 5
-    target-branch: "development"
+    target-branch: "main"
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 29c3339..77b3192 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -4,8 +4,6 @@ on:
   push:
     branches:
       - main
-      - development
-      - production
   pull_request:
 
 jobs:
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 2aa4d66..dd63ef8 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -2,8 +2,8 @@ name: Publish to npm
 
 on:
   push:
-    branches:
-      - production
+    tags:
+      - 'v*'
 
 jobs:
   publish:
@@ -63,20 +63,22 @@ jobs:
             echo "tag=latest" >> $GITHUB_OUTPUT
           fi
 
+      - name: Verify tag matches package version
+        run: |
+          if [ "${{ github.ref_name }}" != "v${{ steps.pkg.outputs.version }}" ]; then
+            echo "❌ Tag ${{ github.ref_name }} does not match package.json version v${{ steps.pkg.outputs.version }}."
+            exit 1
+          fi
+
       - name: Publish to npm
         run: npm publish --access public --tag ${{ steps.tag.outputs.tag }}
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
 
-      - name: Create git tag
-        run: |
-          git tag v${{ steps.pkg.outputs.version }}
-          git push origin v${{ steps.pkg.outputs.version }}
-
       - name: Create GitHub release
         uses: softprops/action-gh-release@v2
         with:
-          tag_name: v${{ steps.pkg.outputs.version }}
-          name: v${{ steps.pkg.outputs.version }}
+          tag_name: ${{ github.ref_name }}
+          name: ${{ github.ref_name }}
           generate_release_notes: true
           token: ${{ secrets.GITHUB_TOKEN }}