fix: address release workflow review comments

Author: fforootd

.changeset/README.md

@@ -29,7 +29,7 @@ The repo is currently in changesets **prerelease mode** with the `alpha` tag
 public npm channel for community testing is `preview`. While in this mode:
 
 - `changeset version` cuts versions like `0.1.0-alpha.0`, `0.1.0-alpha.1`, …
-- `changeset publish --tag preview` publishes them under the **`preview`** npm dist-tag, **not** `latest`. So `npm install @zitadel/cli` keeps resolving the last stable release; consumers opt into preview bundles with `@zitadel/cli@preview`.
+- `scripts/publish-changesets.mjs` publishes them under the **`preview`** npm dist-tag, **not** `latest`, while `.changeset/pre.json` exists. So `npm install @zitadel/cli` keeps resolving the last stable release; consumers opt into preview bundles with `@zitadel/cli@preview`.
 - The public packages are configured as a fixed MVP preview group, so the Version Packages PR keeps their versions aligned.
 
 To leave alpha and cut a stable `latest` release:
@@ -41,7 +41,7 @@ corepack pnpm changeset version   # strips the -alpha suffix
 
 ## Publishing (npm trusted publishing / OIDC)
 
-The [`.github/workflows/release-npm.yml`](../.github/workflows/release-npm.yml) workflow runs the [changesets GitHub Action](https://github.com/changesets/action). Pushing changesets to `main` opens a "Version Packages" PR aggregating all pending changesets; merging that PR bumps versions, updates `CHANGELOG.md` files, and publishes to npm (under the `preview` dist-tag while in prerelease mode). Package-level GitHub Releases are disabled; GoReleaser owns the product-level `ZITADEL Preview` releases. For the full product release order, follow the operator runbook in [`docs/operations/releasing.md`](../docs/operations/releasing.md).
+The [`.github/workflows/release-npm.yml`](../.github/workflows/release-npm.yml) workflow runs the [changesets GitHub Action](https://github.com/changesets/action). Pushing changesets to `main` opens a "Version Packages" PR aggregating all pending changesets; merging that PR bumps versions, updates `CHANGELOG.md` files, and publishes to npm. While `.changeset/pre.json` exists, the publish step uses the `preview` dist-tag; after `changeset pre exit`, it uses Changesets' default dist-tag (`latest`). Package-level GitHub Releases are disabled; GoReleaser owns the product-level `ZITADEL Preview` releases. For the full product release order, follow the operator runbook in [`docs/operations/releasing.md`](../docs/operations/releasing.md).
 
 Publishing authenticates with **npm trusted publishing (OIDC)** — there is **no `NPM_TOKEN`** secret. Before the first automated publish, a maintainer must, once per public package:
 

.github/workflows/release-npm.yml

@@ -11,6 +11,8 @@ name: release-npm
 # dist-tag — `npm install @zitadel/cli` keeps resolving the last stable
 # `latest`; consumers opt into preview bundles with `@zitadel/cli@preview`. Run
 # `pnpm changeset pre exit` to leave alpha and cut a stable `latest` release.
+# The publish wrapper checks .changeset/pre.json: prereleases publish with
+# `--tag preview`; stable releases use Changesets' default dist-tag.
 #
 # Authentication uses npm trusted publishing (OIDC) — there is no NPM_TOKEN.
 # A maintainer must configure the trusted publisher for each public package
@@ -92,7 +94,7 @@ jobs:
         uses: changesets/action@v1
         with:
           version: corepack pnpm changeset version
-          publish: corepack pnpm changeset publish --tag preview
+          publish: node scripts/publish-changesets.mjs
           title: "chore: version packages"
           commit: "chore: version packages"
           createGithubReleases: false

scripts/delete-package-github-releases.mjs

@@ -2,8 +2,7 @@
 import { spawnSync } from "node:child_process";
 
 const execute = process.argv.includes("--execute");
-const limitIndex = process.argv.indexOf("--limit");
-const limit = limitIndex >= 0 ? process.argv[limitIndex + 1] : "200";
+const limit = readLimit(process.argv.slice(2));
 
 const releases = JSON.parse(
   run("gh", [
@@ -51,3 +50,25 @@ function run(command, args, options = {}) {
   }
   return result;
 }
+
+function readLimit(args) {
+  const limitIndex = args.indexOf("--limit");
+  if (limitIndex < 0) {
+    return "200";
+  }
+
+  const value = args[limitIndex + 1];
+  if (!value || value.startsWith("-") || !/^[1-9]\d*$/.test(value)) {
+    usage(`--limit must be followed by a positive integer, got ${JSON.stringify(value)}`);
+  }
+
+  return value;
+}
+
+function usage(message) {
+  console.error(message);
+  console.error(
+    "usage: node scripts/delete-package-github-releases.mjs [--execute] [--limit <positive-integer>]",
+  );
+  process.exit(1);
+}

scripts/publish-changesets.mjs

@@ -0,0 +1,25 @@
+#!/usr/bin/env node
+import { spawnSync } from "node:child_process";
+import { existsSync } from "node:fs";
+
+const prereleaseMode = existsSync(".changeset/pre.json");
+const args = ["pnpm", "changeset", "publish"];
+if (prereleaseMode) {
+  args.push("--tag", "preview");
+}
+
+console.log(
+  prereleaseMode
+    ? "Publishing changesets to npm with the preview dist-tag."
+    : "Publishing changesets to npm with the default dist-tag.",
+);
+
+const result = spawnSync("corepack", args, {
+  stdio: "inherit",
+});
+
+if (result.error) {
+  throw new Error(`corepack ${args.join(" ")} failed: ${result.error.message}`);
+}
+
+process.exit(result.status ?? 1);