Why

The one-click Release workflow from #39 pushed the npm version bump commit straight to main, which branch protection rejects:

remote: error: GH006: Protected branch update failed for refs/heads/main.
- Commits must have verified signatures.
- Changes must be made through a pull request.
- 4 of 4 required status checks are expected.

Pushing bump commits to main is fundamentally incompatible with those rules, so this drops that approach.

What

Make the version come from the release tag instead of package.json:

• Publish now reads the tag (v0.3.3 → 0.3.3), writes it into package.json in CI only (npm version --no-git-tag-version), then builds and publishes. Nothing is committed back to main.
• Removes the old tag/version match guard (no longer needed — they can't disagree now).
• Deletes the release.yml workflow added in Add one-click release workflow to prevent tag/version drift #39.
• RELEASING.md rewritten: to release, just gh release create vX.Y.Z --generate-notes.

Result: releasing is a single gh release create (or the UI), it works with branch protection, and tag/version drift is structurally impossible. The committed package.json version becomes a placeholder and no longer needs bumping.

Cleanup done

Deleted the dangling v0.3.3 tag the failed run left behind. npm is still at 0.3.2; no bad release was published.

Note

Still unresolved separately: main has diverged from the pulse-protect-node-waf branch that shipped 0.3.0–0.3.2, so confirm which branch/content 0.3.3 should ship from before cutting it.

🤖 Generated with Claude Code