ci: pick npm dist-tag and image :latest from the release tag

The release workflow used to hardcode --tag alpha when publishing
@cloudflare/workspace, which would have silently mis-tagged a
stable release as a prerelease (and conversely kept the latest
dist-tag pointing at whatever was last published manually).

Compute the dist-tag from the version itself: a version with a
prerelease suffix (-alpha.N, -beta.N, -rc.N) publishes under the
matching channel (alpha, beta, rc) and leaves the npm latest
pointer alone; a stable version (no suffix) publishes under
latest. The same is_stable flag gates the wsd image's :latest
registry tag so a prerelease push can't displace the last stable
image either. Reword the header comment to match.

Author: aron-cf

.github/workflows/release.yml

@@ -1,12 +1,18 @@
-# Tag-triggered release. Push a `v0.1.0-alpha.N` tag and CI:
+# Tag-triggered release. Push a `v<semver>` tag and CI:
 #
 #   1. Builds every workspace.
 #   2. Runs all package tests.
 #   3. Builds the wsd linux-x64 SEA binary (build-only — proves the
 #      release tag still produces a working binary; not published).
 #   4. Stamps the tag's version into the publishable package.
-#   5. Publishes @cloudflare/workspace with --tag alpha (so plain
-#      `npm i @cloudflare/workspace` doesn't pick up alphas).
+#   5. Publishes @cloudflare/workspace under a dist-tag picked from
+#      the version: prerelease tags (`-alpha.N`, `-beta.N`, `-rc.N`)
+#      publish under the matching suffix (`alpha`, `beta`, `rc`)
+#      so plain `npm i @cloudflare/workspace` doesn't pick them up;
+#      stable tags (no suffix) publish under `latest`.
+#   6. Pushes the wsd binary image to registry.cloudflare.com.
+#      Stable releases also move the `:latest` registry tag;
+#      prereleases only push the version-specific tag.
 #
 # The wsd binary is shipped two ways:
 #   - inside the @cloudflare/workspace npm tarball at dist/bin/
@@ -119,8 +125,30 @@ jobs:
       - name: Sync versions
         run: node scripts/set-versions.mjs "${RELEASE_TAG}"
 
+      # Pick the npm dist-tag and decide whether this release moves
+      # the `:latest` pointers. A stable semver (no `-` suffix)
+      # publishes under `latest` and bumps the image's :latest tag;
+      # a prerelease publishes under its prerelease channel
+      # (`alpha`, `beta`, `rc`) and leaves :latest alone so a stale
+      # alpha can't displace a real release.
+      - name: Compute release metadata
+        id: release-meta
+        run: |
+          version="${RELEASE_TAG#v}"
+          if [[ "$version" == *-* ]]; then
+            suffix="${version#*-}"
+            npm_tag="${suffix%%.*}"
+            is_stable=false
+          else
+            npm_tag=latest
+            is_stable=true
+          fi
+          echo "version=${version}" >> "$GITHUB_OUTPUT"
+          echo "npm_tag=${npm_tag}" >> "$GITHUB_OUTPUT"
+          echo "is_stable=${is_stable}" >> "$GITHUB_OUTPUT"
+
       - name: Publish @cloudflare/workspace
-        run: npm publish --workspace @cloudflare/workspace --tag alpha --provenance --access public
+        run: npm publish --workspace @cloudflare/workspace --tag "${{ steps.release-meta.outputs.npm_tag }}" --provenance --access public
 
       # Stage the SEA binary into the wsd-linux-x64 package's bin/
       # directory — that package's Dockerfile copies from `bin/wsd`
@@ -148,14 +176,9 @@ jobs:
           echo "$CF_REGISTRY_PASSWORD" | docker login registry.cloudflare.com \
             -u "$CF_REGISTRY_USERNAME" --password-stdin
 
-      # Strip the leading `v` from the release tag so the image
-      # tag matches the npm version (e.g. v0.1.0-alpha.1 -> 0.1.0-alpha.1).
-      - name: Compute image version
-        id: image-version
-        run: |
-          version="${RELEASE_TAG#v}"
-          echo "version=${version}" >> "$GITHUB_OUTPUT"
-
+      # The version-specific tag always goes out. The `:latest` tag
+      # only moves on stable releases; an empty trailing line in the
+      # `tags` list is tolerated by build-push-action.
       - name: Build and push wsd-linux-x64 image
         uses: docker/build-push-action@v6
         with:
@@ -164,6 +187,6 @@ jobs:
           platforms: linux/amd64
           push: true
           tags: |
-            registry.cloudflare.com/library/workspace-wsd-linux-x64:${{ steps.image-version.outputs.version }}
-            registry.cloudflare.com/library/workspace-wsd-linux-x64:latest
+            registry.cloudflare.com/library/workspace-wsd-linux-x64:${{ steps.release-meta.outputs.version }}
+            ${{ steps.release-meta.outputs.is_stable == 'true' && 'registry.cloudflare.com/library/workspace-wsd-linux-x64:latest' || '' }}
           provenance: false