feat: promote npm edge tag to latest when prerelease is promoted

[AaronFeledy]

Problem

When a release is published as a prerelease, it gets tagged as edge on npm. Later, when the release is promoted to a full release in GitHub, the npm latest tag doesn't update because the workflow only triggered on published.

Solution

• Added released to the release workflow trigger types
• New lightweight promote job that only runs npm dist-tag add latest — no install, no lint, no tests, no re-publish
• Only fires on the released event (when a prerelease is promoted to full release)
• Existing deploy job is now explicitly gated to published events only (no behavior change)
• Uses TAG_NAME env var instead of direct interpolation to prevent script injection

Flow

1. Publish as prerelease → full pipeline runs, publishes with edge tag (unchanged)
2. Promote release → uncheck prerelease → promote job runs, points latest to that version (~15s)

The dist-tag add command is idempotent, so if both published and released fire on a fresh non-prerelease publish, the redundant promote is harmless.

---

Note

Low Risk
CI-only change that adjusts workflow triggers and updates npm dist-tags; risk is limited to release automation behavior and requires correct NPM_DEPLOY_TOKEN permissions.

Overview
Updates the release.yml GitHub Actions workflow to also trigger on released events (in addition to published).

Adds a new promote job that runs only on released to retag the just-promoted version as npm latest via npm dist-tag add, while gating the existing publish pipeline (deploy) to run only on published events.

^{Written by Cursor Bugbot for commit c435d20. This will update automatically on new commits. Configure here.}

[netlify]

❌ Deploy Preview for lando-apache failed. Why did it fail? →

Name	Link
🔨 Latest commit	c435d20
🔍 Latest deploy log	https://app.netlify.com/projects/lando-apache/deploys/6997dc2536c7ac00089539a3

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is ON. A Cloud Agent has been kicked off to fix the reported issue.}

[cursor]

Race condition causes promote job to fail on non-prerelease

Medium Severity

When a fresh non-prerelease is published, GitHub fires both published and released as separate workflow runs. The lightweight promote job (~15s) will execute npm dist-tag add well before the deploy job finishes installing, linting, testing, and publishing the package. This causes promote to fail because the version doesn't exist on npm yet. While the deploy job correctly sets latest for non-prereleases, every fresh non-prerelease publish will produce a failed workflow run in the GitHub Actions UI. Since these are separate runs, needs can't create a dependency between them.

Additional Locations (1)

• .github/workflows/release.yml#L5-L7