feat: promote npm edge tag to latest when prerelease is promoted

[AaronFeledy]

Problem

When a release is published as a prerelease, it gets tagged as edge on npm. Later, when the release is promoted to a full release in GitHub, the npm latest tag doesn't update because the workflow only triggered on published.

Solution

• Added released to the release workflow trigger types
• New lightweight promote job that only runs npm dist-tag add latest — no install, no lint, no tests, no re-publish
• Only fires on the released event (when a prerelease is promoted to full release)
• Existing deploy job is now explicitly gated to published events only (no behavior change)
• Uses TAG_NAME env var instead of direct interpolation to prevent script injection

Flow

1. Publish as prerelease → full pipeline runs, publishes with edge tag (unchanged)
2. Promote release → uncheck prerelease → promote job runs, points latest to that version (~15s)

The dist-tag add command is idempotent, so if both published and released fire on a fresh non-prerelease publish, the redundant promote is harmless.

---

Note

Low Risk
CI-only change limited to npm dist-tagging on a specific release event; main risk is incorrect tagging if the workflow triggers unexpectedly.

Overview
Updates the release.yml workflow to also run on the released release action and adds a new promote job that runs npm dist-tag add ... latest to move an already-published version from edge to latest.

Gates the existing deploy publish job to published events only to avoid running the full publish pipeline during release promotion.

^{Written by Cursor Bugbot for commit 2b8c48a. This will update automatically on new commits. Configure here.}

[netlify]

❌ Deploy Preview for lando-platformsh failed. Why did it fail? →

Name	Link
🔨 Latest commit	2b8c48a
🔍 Latest deploy log	https://app.netlify.com/projects/lando-platformsh/deploys/6997dc953441340008426a44

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is ON. A Cloud Agent has been kicked off to fix the reported issue.}

[cursor]

Promote job races deploy and fails on fresh release

Medium Severity

When a fresh non-prerelease is published, GitHub fires both published and released events simultaneously as separate workflow runs. The lightweight promote job (from released) reaches npm dist-tag add in seconds, well before the heavy deploy job (from published) finishes linting, testing, and calling npm publish. Since the version doesn't exist on the registry yet, npm dist-tag add fails with a "no matching version" error rather than being idempotent as the PR description assumes. This causes a visible workflow failure on every fresh non-prerelease publish.

Additional Locations (1)

• .github/workflows/release.yml#L5-L7