feat: promote npm edge tag to latest when prerelease is promoted

[AaronFeledy]

Problem

When a release is published as a prerelease, it gets tagged as edge on npm. Later, when the release is promoted to a full release in GitHub, the npm latest tag doesn't update because the workflow only triggered on published.

Solution

• Added released to the release workflow trigger types
• New lightweight promote job that only runs npm dist-tag add latest — no install, no lint, no tests, no re-publish
• Only fires on the released event (when a prerelease is promoted to full release)
• Existing deploy job is now explicitly gated to published events only (no behavior change)
• Uses TAG_NAME env var instead of direct interpolation to prevent script injection

Flow

1. Publish as prerelease → full pipeline runs, publishes with edge tag (unchanged)
2. Promote release → uncheck prerelease → promote job runs, points latest to that version (~15s)

The dist-tag add command is idempotent, so if both published and released fire on a fresh non-prerelease publish, the redundant promote is harmless.

---

Note

Low Risk
CI-only change that adjusts workflow triggers and npm dist-tagging; main risk is incorrect tagging if the released event fires unexpectedly.

Overview
Updates the NPM release GitHub Action to also trigger on release.released events, enabling actions when a prerelease is promoted to a full release.

Adds a new promote job that runs only on released to retag the published version to npm latest via npm dist-tag add, and gates the existing deploy (publish/test) job to run only on published events.

^{Written by Cursor Bugbot for commit e949389. This will update automatically on new commits. Configure here.}

[netlify]

❌ Deploy Preview for lando-postgres failed. Why did it fail? →

Name	Link
🔨 Latest commit	e949389
🔍 Latest deploy log	https://app.netlify.com/projects/lando-postgres/deploys/6997dc9873135a0008b5a915

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is ON. A Cloud Agent has been kicked off to fix the reported issue.}

[cursor]

Race condition: promote fails before deploy publishes package

Medium Severity

When a fresh non-prerelease is published, GitHub fires both published and released activity types, triggering two concurrent workflow runs. The promote job (~15s) will reach npm dist-tag add well before the heavyweight deploy job (~2min) finishes npm publish, causing promote to fail because the version doesn't exist on npm yet. The PR description claims "the redundant promote is harmless," but npm dist-tag add on a non-existent version is not idempotent—it errors out, producing a spurious workflow failure on every non-prerelease publish.

Additional Locations (1)

• .github/workflows/release.yml#L5-L7