feat: promote npm edge tag to latest when prerelease is promoted

[AaronFeledy]

Problem

When a release is published as a prerelease, it gets tagged as edge on npm. Later, when the release is promoted to a full release in GitHub, the npm latest tag doesn't update because the workflow only triggered on published.

Solution

• Added released to the release workflow trigger types
• New lightweight promote job that only runs npm dist-tag add latest — no install, no lint, no tests, no re-publish
• Only fires on the released event (when a prerelease is promoted to full release)
• Existing deploy job is now explicitly gated to published events only (no behavior change)
• Uses TAG_NAME env var instead of direct interpolation to prevent script injection

Flow

1. Publish as prerelease → full pipeline runs, publishes with edge tag (unchanged)
2. Promote release → uncheck prerelease → promote job runs, points latest to that version (~15s)

The dist-tag add command is idempotent, so if both published and released fire on a fresh non-prerelease publish, the redundant promote is harmless.

---

Note

Low Risk
Workflow-only change affecting npm dist-tag management; risk is limited to potentially mis-tagging latest if the release tag/version is incorrect or the token permissions are misconfigured.

Overview
Updates the release workflow to also trigger on GitHub release.released events and adds a new promote job that runs npm dist-tag add ... latest based on the release tag, allowing prereleases previously published under edge to be promoted to latest without re-publishing.

The existing deploy publish pipeline is now explicitly gated to only run on release.published, reducing the chance of duplicate publish runs when a release is later promoted.

^{Written by Cursor Bugbot for commit c5d59ca. This will update automatically on new commits. Configure here.}

[netlify]

✅ Deploy Preview for lando-joomla ready!

Name	Link
🔨 Latest commit	c5d59ca
🔍 Latest deploy log	https://app.netlify.com/projects/lando-joomla/deploys/6997dc351cd6b30008cb81b7
😎 Deploy Preview	https://deploy-preview-70--lando-joomla.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
Lighthouse	1 paths audited Performance: 93 (🔴 down 2 from production) Accessibility: 96 (no change from production) Best Practices: 100 (no change from production) SEO: 100 (no change from production) PWA: - View the detailed breakdown and full score reports

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is ON. A Cloud Agent has been kicked off to fix the reported issue.}

[cursor]

Race condition: promote fails before deploy publishes package

Medium Severity

When a non-prerelease is published directly (not promoted from prerelease), GitHub fires both published and released events simultaneously. The promote job (~15s) will reach npm dist-tag add long before deploy finishes its full install/lint/test/publish pipeline. Since the version doesn't exist on npm yet, npm dist-tag add will fail. The PR description claims this redundant promote is "harmless," but the race condition causes a guaranteed workflow failure for every direct non-prerelease publish.

Additional Locations (1)

• .github/workflows/release.yml#L5-L7