ci: harden workflow release guards

.github/workflows/auto-tag.yml

@@ -6,7 +6,6 @@ on:
     types: [completed]
 
 permissions:
-  actions: write
   contents: write
 
 env:
@@ -36,6 +35,12 @@ jobs:
         id: version
         run: echo "version=$(node -p "require('./packages/core/package.json').version")" >> "$GITHUB_OUTPUT"
 
+      - name: Verify release metadata before tagging
+        if: steps.changed.outputs.changed == 'true'
+        env:
+          TAG: v${{ steps.version.outputs.version }}
+        run: node scripts/verify-release.mjs --tag "$TAG"
+
       - name: Create and push tag if missing
         if: steps.changed.outputs.changed == 'true'
         env:
@@ -49,5 +54,4 @@ jobs:
             git config user.email "github-actions[bot]@users.noreply.github.com"
             git tag -a "$TAG" -m "release $TAG"
             git push origin "$TAG"
-            gh workflow run release.yml --ref "$TAG"
           fi

.github/workflows/ci.yml

@@ -5,6 +5,9 @@ on:
     branches: [main]
   pull_request:
 
+permissions:
+  contents: read
+
 env:
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: 'true'
 

.github/workflows/release.yml

@@ -112,6 +112,7 @@ jobs:
           path: release-assets/*
   github-release:
     needs: build-native
+    if: startsWith(github.ref, 'refs/tags/')
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
@@ -252,6 +253,7 @@ jobs:
 
   publish-npm:
     needs: verify
+    if: startsWith(github.ref, 'refs/tags/')
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
@@ -288,6 +290,7 @@ jobs:
 
   publish-crates:
     needs: verify
+    if: startsWith(github.ref, 'refs/tags/')
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
@@ -323,6 +326,7 @@ jobs:
 
   publish-pypi:
     needs: verify
+    if: startsWith(github.ref, 'refs/tags/')
     runs-on: ubuntu-latest
     environment: pypi
     steps: