ci: prerelease バージョンの publish 時に --tag を自動付与するように修正

[KinjiKawaguchi]

Why

prerelease バージョン（3.0.0-rc.1 等）を npm publish する際、--tag オプションが未指定のため publish が失敗する。
https://github.com/su-its/core/actions/runs/23796409089/job/69344776248

What

package.json のバージョンにハイフンが含まれる場合、prerelease ID（rc, beta 等）を抽出して --tag に指定する。

• 3.0.0-rc.1 → npm publish --access public --tag rc
• 3.0.0-beta.1 → npm publish --access public --tag beta
• 3.0.0 → npm publish --access public（latest）

🤖 Generated with Claude Code

---

[devin-ai-integration]

Devin Review found 3 potential issues.

[devin-ai-integration]

🟡 Numeric-only prerelease identifiers produce empty --tag argument, breaking npm publish

The sed pattern 's/.*-\([a-zA-Z]*\).*/\1/' only captures alphabetic characters ([a-zA-Z]*). For valid semver prerelease versions with numeric-only identifiers (e.g., 1.0.0-1 or 1.0.0-0.3.7), PRERELEASE_ID will be an empty string. Since the grep -q '-' check still passes (the version contains a hyphen), the output becomes tag=--tag (with an empty tag value). The resulting command npm publish --access public --tag will pass a bare --tag flag with no value, causing npm to error.

While the project currently uses alpha, beta, and rc prerelease IDs (see package.json:45-47), the workflow doesn't validate or restrict to these, so a numeric prerelease version would silently break the publish step.

Suggested change

	PRERELEASE_ID=$(echo "$VERSION" | sed 's/.*-\([a-zA-Z]*\).*/\1/')
	echo "tag=--tag $PRERELEASE_ID" >> "$GITHUB_OUTPUT"
	PRERELEASE_ID=$(echo "$VERSION" | sed 's/.*-\([a-zA-Z]*\).*/\1/')
	if [ -z "$PRERELEASE_ID" ]; then
	echo "tag=--tag prerelease" >> "$GITHUB_OUTPUT"
	else
	echo "tag=--tag $PRERELEASE_ID" >> "$GITHUB_OUTPUT"
	fi

---

Was this helpful? React with 👍 or 👎 to provide feedback.

[devin-ai-integration]

📝 Info: Unquoted ${{ steps.tag.outputs.tag }} is intentional but worth noting

The expression ${{ steps.tag.outputs.tag }} at line 41 is deliberately unquoted so that --tag rc is word-split into two separate arguments (--tag and rc) by the shell. If it were quoted as "${{ steps.tag.outputs.tag }}", npm would receive a single argument --tag rc which would be incorrect. This is safe here because the sed pattern at line 36 restricts PRERELEASE_ID to [a-zA-Z]* only, preventing any shell metacharacter injection. However, this pattern (embedding both flag and value in a single output) is fragile — a future maintainer might quote it for "safety" and break the command. A more robust approach would be to output just the tag name and construct the --tag flag separately in the run step.

---

Was this helpful? React with 👍 or 👎 to provide feedback.

[devin-ai-integration]

📝 Info: Greedy .*- in sed captures the last hyphen-delimited segment only

The sed pattern 's/.*-\([a-zA-Z]*\).*/\1/' uses greedy .*- which matches up to the last hyphen in the version string. For standard semver like 3.0.0-rc.0, there's only one hyphen so this is fine. But for hypothetical versions with multiple hyphens in the prerelease section (e.g., 1.0.0-alpha-beta.2), it would extract beta rather than alpha. This matches how this project uses prerelease IDs (single identifier like alpha, beta, rc as seen in package.json:45-47), so it works correctly in practice, but the behavior is worth documenting.

---

Was this helpful? React with 👍 or 👎 to provide feedback.

[Copilot]

Pull request overview

GitHub Actions の publish ワークフローで、prerelease バージョン（例: 3.0.0-rc.1）を npm publish する際に dist-tag を自動付与し、publish 失敗を防ぐための変更です。

Changes:

• package.json の version に - が含まれる場合、prerelease ID を抽出して npm publish --tag <id> を付与
• stable バージョンの場合は tag を付与せず従来どおり latest 扱いで publish

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

PRERELEASE_ID の抽出が sed 's/.*-\([a-zA-Z]*\).*/\1/' だと、SemVer 上は有効な 1.2.3-1 / 1.2.3-rc1 のような prerelease（先頭が数字 or 英数字混在）で空文字や途中までしか取れず、--tag の値が不正になって publish が失敗する可能性があります。ここは Bash/Node 側で -(?<id>[0-9A-Za-z-]+)(?:\.|$) のように最初の prerelease identifier を厳密に取り、マッチしない場合は tag を付与しない/明示的に失敗させる、のいずれかにした方が安全です。

Suggested change

	if echo "$VERSION" | grep -q '-'; then
	PRERELEASE_ID=$(echo "$VERSION" | sed 's/.*-\([a-zA-Z]*\).*/\1/')
	echo "tag=--tag $PRERELEASE_ID" >> "$GITHUB_OUTPUT"
	else
	echo "tag=" >> "$GITHUB_OUTPUT"
	PRERELEASE_ID=$(node -p "(() => { const v = require('./package.json').version; const m = v.match(/-(?<id>[0-9A-Za-z-]+)(?:\\.|$)/); return m ? m.groups.id : ''; })()")
	if [ -n \"$PRERELEASE_ID\" ]; then
	echo \"tag=--tag $PRERELEASE_ID\" >> \"$GITHUB_OUTPUT\"
	else
	echo \"tag=\" >> \"$GITHUB_OUTPUT\"