The release job built whatever version package.json held at the tagged
commit — but main always carries a -develop suffix, so a vX.Y.Z bundle
would have reported X.Y.Z-develop. Make the tag the source of truth:
strip the suffix in the ephemeral CI checkout before building (never
committed), and fail fast when the tag base doesn't match package.json's
base (wrong-commit guard). Update CONTRIBUTING with the tag-driven flow.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Dependabot will now open PRs when new versions of actions/checkout and
actions/setup-node are released, keeping the pinned SHAs up to date.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Triggers on v* tags. Builds with wrangler --dry-run, falls back to
dist/worker.js and dist/_worker.js if index.js is not produced.
Uploads as index.js so homelab Tofu can fetch a stable URL.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Julien Herr