feat: promote npm edge tag to latest when prerelease is promoted

[AaronFeledy]

Problem

When a release is published as a prerelease, it gets tagged as edge on npm. Later, when the release is promoted to a full release in GitHub, the npm latest tag doesn't update because the workflow only triggered on published.

Solution

• Added released to the release workflow trigger types
• New lightweight promote job that only runs npm dist-tag add latest — no install, no lint, no tests, no re-publish
• Only fires on the released event (when a prerelease is promoted to full release)
• Existing deploy job is now explicitly gated to published events only (no behavior change)
• Uses TAG_NAME env var instead of direct interpolation to prevent script injection

Flow

1. Publish as prerelease → full pipeline runs, publishes with edge tag (unchanged)
2. Promote release → uncheck prerelease → promote job runs, points latest to that version (~15s)

The dist-tag add command is idempotent, so if both published and released fire on a fresh non-prerelease publish, the redundant promote is harmless.

---

Note

Low Risk
CI-only change that adjusts when npm dist-tags are updated; main risk is mis-tagging latest or missing credentials during promotion events.

Overview
Updates the release workflow to also trigger on GitHub release events of type released, and adds a lightweight promote job that runs npm dist-tag add ... latest to point npm’s latest tag at the promoted version.

The existing deploy publish pipeline is now explicitly gated to only run on published events, preventing it from running during promotion events.

^{Written by Cursor Bugbot for commit df58f96. This will update automatically on new commits. Configure here.}

[netlify]

❌ Deploy Preview for lando-phpmyadmin failed. Why did it fail? →

Name	Link
🔨 Latest commit	df58f96
🔍 Latest deploy log	https://app.netlify.com/projects/lando-phpmyadmin/deploys/6997db9b5b241f00089e6767

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is ON. A Cloud Agent has been kicked off to fix the reported issue.}

[cursor]

Promote job fails on fresh non-prerelease publish

Medium Severity

When a non-prerelease is published directly, GitHub fires both published and released events simultaneously as two separate workflow runs. The promote job (~15 seconds) will almost always finish before the deploy job (install, lint, test, publish — several minutes), causing npm dist-tag add to fail because the version hasn't been published to the registry yet. The PR description claims this is "idempotent" and "harmless," but dist-tag add on a non-existent version is an error, not a no-op — it will produce a consistently failing red workflow run for every fresh non-prerelease publish.

 

[cursor]

Bugbot Autofix prepared fixes for 1 of the 1 bugs found in the latest run.

• ✅ Fixed: Promote job fails on fresh non-prerelease publish
  • Added npm version existence check before dist-tag operation to gracefully skip when version hasn't been published yet.

Or push these changes by commenting:

@cursor push b60241fc79

Preview (b60241fc79)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -22,8 +22,12 @@
         run: |
           VERSION=$(echo "$TAG_NAME" | sed 's/^v//')
           PACKAGE=$(node -p "require('./package.json').name")
-          npm dist-tag add "$PACKAGE@$VERSION" latest
-          echo "::notice title=Promoted $VERSION to latest::The latest tag now points to $VERSION (was edge-only)"
+          if npm view "$PACKAGE@$VERSION" version &>/dev/null; then
+            npm dist-tag add "$PACKAGE@$VERSION" latest
+            echo "::notice title=Promoted $VERSION to latest::The latest tag now points to $VERSION (was edge-only)"
+          else
+            echo "::notice title=Skipping promotion::Version $VERSION not yet published to npm, skipping dist-tag operation"
+          fi
         env:
           TAG_NAME: ${{ github.event.release.tag_name }}
           NODE_AUTH_TOKEN: ${{secrets.NPM_DEPLOY_TOKEN}}