Automated release triggered on every push without a tag/release guard

What it is

A release or publish job triggers on every push to a branch, with no tag filter or release-event guard.

Why it matters

Every merge becomes a release, including the half-finished one merged to unblock someone. Published versions cannot be unpublished cleanly, so the cleanup is a new version rather than an undo.

How to fix it

Trigger publishing on tag pushes or on the release: published event, and gate the job on the tag matching your version pattern so an accidental tag does not ship either.