ci: harden alpha release publishing (#282)

## Summary

- Block alpha train completion when Changesets only creates the Version
Packages PR and npm did not publish.
- Preserve GoReleaser recovery when the release tag already exists.
- Treat npm CLI dist-tag promotion as best-effort so OIDC dist-tag auth
failures do not block GitHub Release/GHCR recovery.

## Validation

- `corepack pnpm nx test @zitadel/cli`
- `corepack pnpm changeset status --output
/tmp/nextgen-changeset-status.json && node
scripts/check-alpha-release-plan.mjs /tmp/nextgen-changeset-status.json`
- `corepack pnpm run check -- --only node`
- `corepack pnpm --filter @zitadel/cli test -- --run
tests/unit/scripts/check-alpha-release-plan.test.ts
tests/unit/scripts/release-alpha-train.test.ts`

## Release notes / changeset

- Empty changesets added for CI-only release workflow fixes.

## Notes

- Existing remote artifacts for `v0.1.0-alpha.4` were not deleted or
modified.
- The npm packages for `0.1.0-alpha.4` published successfully in the
observed run; the failure was the follow-up dist-tag mutation.

Author: fforootd

.changeset/fix-alpha-dist-tag-promotion.md

@@ -0,0 +1,2 @@
+---
+---

.github/workflows/ci.yml

@@ -881,8 +881,8 @@ jobs:
           # so bare `npx @zitadel/cli` must reach the supported local workflow.
           # Keep `alpha` as the canonical prerelease tag, and do not move
           # `latest` for SDKs/components, Docker images, or GitHub Releases.
-          npm dist-tag add "@zitadel/cli@$version" alpha
-          npm dist-tag add "@zitadel/cli@$version" latest
+          npm dist-tag add "@zitadel/cli@$version" alpha || echo "::warning::Unable to refresh @zitadel/cli@$version npm alpha dist-tag"
+          npm dist-tag add "@zitadel/cli@$version" latest || echo "::warning::Unable to promote @zitadel/cli@$version to npm latest dist-tag"
 
       - name: Restore changesets after publish decision
         run: git restore -- .changeset

apps/cli/tests/unit/scripts/check-alpha-release-plan.test.ts

@@ -189,8 +189,8 @@ describe("check-alpha-release-plan script", () => {
           "      - name: Promote CLI alpha to npm latest",
           "        if: ${{ steps.changesets.outputs.published == 'true' }}",
           "        run: |",
-          "          npm dist-tag add \"@zitadel/cli@$version\" alpha",
-          "          npm dist-tag add \"@zitadel/cli@$version\" latest",
+          '          npm dist-tag add "@zitadel/cli@$version" alpha || echo "::warning::Unable to refresh @zitadel/cli@$version npm alpha dist-tag"',
+          '          npm dist-tag add "@zitadel/cli@$version" latest || echo "::warning::Unable to promote @zitadel/cli@$version to npm latest dist-tag"',
           "",
         ].join("\n"),
         "",
@@ -225,6 +225,19 @@ describe("check-alpha-release-plan script", () => {
     ).rejects.toThrow("must keep the CLI alpha dist-tag on the published train");
   });
 
+  it("rejects a workflow that fails the train when npm latest promotion fails", async () => {
+    const { cwd, statusPath } = await fixtureRepo({
+      ciWorkflow: validCiWorkflow().replace(
+        '          npm dist-tag add "@zitadel/cli@$version" latest || echo "::warning::Unable to promote @zitadel/cli@$version to npm latest dist-tag"',
+        '          npm dist-tag add "@zitadel/cli@$version" latest',
+      ),
+    });
+
+    await expect(
+      checkAlphaReleasePlanModule.checkAlphaReleasePlan({ cwd, statusPath }),
+    ).rejects.toThrow("must not fail the alpha train when npm latest dist-tag promotion fails");
+  });
+
   it("rejects a workflow that moves the CLI latest tag outside the release job", async () => {
     const { cwd, statusPath } = await fixtureRepo({
       ciWorkflow: validCiWorkflow()
@@ -382,8 +395,8 @@ function validCiWorkflow(): string {
     "      - name: Promote CLI alpha to npm latest",
     "        if: ${{ steps.changesets.outputs.published == 'true' }}",
     "        run: |",
-    "          npm dist-tag add \"@zitadel/cli@$version\" alpha",
-    "          npm dist-tag add \"@zitadel/cli@$version\" latest",
+    '          npm dist-tag add "@zitadel/cli@$version" alpha || echo "::warning::Unable to refresh @zitadel/cli@$version npm alpha dist-tag"',
+    '          npm dist-tag add "@zitadel/cli@$version" latest || echo "::warning::Unable to promote @zitadel/cli@$version to npm latest dist-tag"',
     "",
     "      - name: Restore changesets after publish decision",
     "        run: git restore -- .changeset",

scripts/check-alpha-release-plan.mjs

@@ -286,6 +286,11 @@ function assertCliLatestPromotion(ciWorkflow) {
       throw new Error("only @zitadel/cli may move the npm latest dist-tag during alpha");
     }
   }
+  assertContains(
+    releaseJob,
+    'npm dist-tag add "@zitadel/cli@$version" latest ||',
+    "release-alpha-train must not fail the alpha train when npm latest dist-tag promotion fails",
+  );
 }
 
 function assertNoUnexpectedPublishOnlyGates(ciWorkflow) {