feat: promote npm edge tag to latest when prerelease is promoted

[AaronFeledy]

Problem

When a release is published as a prerelease, it gets tagged as edge on npm. Later, when the release is promoted to a full release in GitHub, the npm latest tag doesn't update because the workflow only triggered on published.

Solution

• Added released to the release workflow trigger types
• New lightweight promote job that only runs npm dist-tag add latest — no install, no lint, no tests, no re-publish
• Only fires on the released event (when a prerelease is promoted to full release)
• Existing deploy job is now explicitly gated to published events only (no behavior change)
• Uses TAG_NAME env var instead of direct interpolation to prevent script injection

Flow

1. Publish as prerelease → full pipeline runs, publishes with edge tag (unchanged)
2. Promote release → uncheck prerelease → promote job runs, points latest to that version (~15s)

The dist-tag add command is idempotent, so if both published and released fire on a fresh non-prerelease publish, the redundant promote is harmless.

---

Note

Low Risk
CI-only change that adjusts GitHub Actions release triggers and npm dist-tagging; risk is limited to incorrect tag promotion if the release tag/version parsing is wrong.

Overview
Extends the release workflow trigger to also run on GitHub Release released events.

Adds a new promote job that runs only on released and uses npm dist-tag add to point npm latest at the promoted version (derived from the release tag). The existing deploy publish pipeline is now explicitly gated to published events to avoid running on promotions.

^{Written by Cursor Bugbot for commit c34219e. This will update automatically on new commits. Configure here.}

[netlify]

✅ Deploy Preview for lando-solr ready!

Name	Link
🔨 Latest commit	c34219e
🔍 Latest deploy log	https://app.netlify.com/projects/lando-solr/deploys/6997dca3e441b30008a1097c
😎 Deploy Preview	https://deploy-preview-66--lando-solr.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
Lighthouse	1 paths audited Performance: 90 (🔴 down 2 from production) Accessibility: 98 (no change from production) Best Practices: 100 (no change from production) SEO: 100 (no change from production) PWA: - View the detailed breakdown and full score reports

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is ON. A Cloud Agent has been kicked off to fix the reported issue.}

[cursor]

Race condition: promote fails on fresh non-prerelease publish

Medium Severity

When a non-prerelease is published directly, GitHub fires both published and released events, triggering two parallel workflow runs. The promote job (~15s) will attempt npm dist-tag add before the deploy job finishes publishing the version to npm. Since npm dist-tag add fails when the version doesn't exist on the registry, the promote run will error out. The PR description claims this is "harmless" due to idempotency, but the command actually fails rather than no-ops, producing a visible red X in the workflow UI and potentially triggering failure notifications.

Additional Locations (1)

• .github/workflows/release.yml#L34-L36