ci: restore release branch guard

Author: johnhuang316

.github/workflows/publish-to-pypi.yml

@@ -20,19 +20,17 @@ jobs:
     env:
       RELEASE_REF: ${{ github.event_name == 'workflow_dispatch' && format('refs/tags/{0}', github.event.inputs.tag) || github.ref }}
       RELEASE_TAG: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.tag || github.ref_name }}
-      DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
     steps:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
           ref: ${{ env.RELEASE_REF }}
 
-      - name: Ensure tag points to default branch
+      - name: Ensure tag is published from main
         run: |
-          TARGET_BRANCH=${DEFAULT_BRANCH:-master}
-          git fetch origin "${TARGET_BRANCH}"
-          if ! git merge-base --is-ancestor "$(git rev-parse HEAD)" "origin/${TARGET_BRANCH}"; then
-            echo "::error::Release tag must point to a commit reachable from ${TARGET_BRANCH}"
+          git fetch origin main
+          if ! git merge-base --is-ancestor "$(git rev-parse HEAD)" origin/main; then
+            echo "::error::Release tag must point to a commit reachable from main"
             exit 1
           fi