feat: promote npm edge tag to latest when prerelease is promoted

[AaronFeledy]

Problem

When a release is published as a prerelease, it gets tagged as edge on npm. Later, when the release is promoted to a full release in GitHub, the npm latest tag doesn't update because the workflow only triggered on published.

Solution

• Added released to the release workflow trigger types
• New lightweight promote job that only runs npm dist-tag add latest — no install, no lint, no tests, no re-publish
• Only fires on the released event (when a prerelease is promoted to full release)
• Existing deploy job is now explicitly gated to published events only (no behavior change)
• Uses TAG_NAME env var instead of direct interpolation to prevent script injection

Flow

1. Publish as prerelease → full pipeline runs, publishes with edge tag (unchanged)
2. Promote release → uncheck prerelease → promote job runs, points latest to that version (~15s)

The dist-tag add command is idempotent, so if both published and released fire on a fresh non-prerelease publish, the redundant promote is harmless.

---

Note

Low Risk
CI-only changes affecting npm dist-tagging; risk is mainly incorrect tagging if the workflow logic or tokens are misconfigured.

Overview
Updates .github/workflows/release.yml to trigger on both release.published and release.released events.

Adds a new promote job that runs only on released to set the npm latest dist-tag to the promoted version (derived from the GitHub tag), without re-running the full publish pipeline. The existing deploy job is now explicitly gated to published events.

^{Written by Cursor Bugbot for commit ed6b739. This will update automatically on new commits. Configure here.}

[netlify]

✅ Deploy Preview for lando-node ready!

Name	Link
🔨 Latest commit	ed6b739
🔍 Latest deploy log	https://app.netlify.com/projects/lando-node/deploys/6997dc92d81ec700092010c3
😎 Deploy Preview	https://deploy-preview-114--lando-node.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
Lighthouse	1 paths audited Performance: 90 (🔴 down 1 from production) Accessibility: 98 (no change from production) Best Practices: 100 (no change from production) SEO: 100 (no change from production) PWA: - View the detailed breakdown and full score reports

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is ON. A Cloud Agent has been kicked off to fix the reported issue.}

[cursor]

Race condition: promote may fail before deploy publishes

Medium Severity

When a non-prerelease is published directly (not promoted from prerelease), GitHub fires both published and released events as separate workflow runs. The promote job is much lighter than deploy (no dependency install, lint, or tests), so it will likely reach npm dist-tag add before the deploy job has finished npm publish. Since the package version doesn't exist on npm yet, npm dist-tag add will fail, producing a confusing red workflow run. The PR description claims this is "harmless" because dist-tag add is idempotent, but idempotency doesn't help when the version hasn't been published yet.

Additional Locations (1)

• .github/workflows/release.yml#L5-L7