v1 follows main, not only releases

[usetheodev]

Refs #15. Workflow-only.

The fix for #15 had #13's shape inside it

advance-v1 in release.yml moves the ref after a publish. That covers a change that bumps the package — and most changes here do not bump the package.

The full-depth checkout, the build step, the per-package floor runs, the stable result check: each landed on main with no version bump, and each had to be pushed to v1 by hand or it reached no consumer at all. I did that three times today without noticing the pattern, until a workflow-only merge left the ref stale again.

Shipped, green, not delivered. Exactly what #13 was about.

So v1 follows main

With one condition: the pinned dep-check-version must already be on the registry.

A commit that bumps it lands on main before the tag that publishes it. Moving v1 there would send every consumer to npx @theokit/dep-check@<unpublished> — a failure at the point of use, which is worse than lagging behind. In that state this job holds and release.yml moves the ref once the publish succeeds.

Both states checked:

$ # pinned 0.7.0, published
-> move=true

$ # pinned at an unpublished version
-> move=false   (holds; the release will move it)

The read-back follows the annotated-tag indirection, same as release.yml — .object.sha is the tag object, not the commit.

contents: write on this job only; the rest of CI keeps contents: read.

zizmor: no findings.