From 1a3c937f59664d932e54352654b9e8046515e0f1 Mon Sep 17 00:00:00 2001
From: squid-protocol <joe.m.esquibel@gmail.com>
Date: Mon, 13 Jul 2026 16:54:23 -0400
Subject: [PATCH] ci: add main branch guardrail to release CD pipeline upon tag

---
 .github/workflows/publish.yml | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 5cb0b48f..6c4fcf5f 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -25,6 +25,14 @@ jobs:
         with:
           fetch-depth: 0
 
+      - name: Enforce Main Branch Tagging
+        run: |
+          git fetch origin main
+          if ! git branch -r --contains ${{ github.sha }} | grep -q "origin/main"; then
+            echo "🛑 ERROR: Tag was cut from a side branch. Releases are only allowed from main."
+            exit 1
+          fi
+
       - name: Set up Python
         uses: actions/setup-python@v6
         with: