Fix beta npm dist-tag

Change-Id: I5e3e201d94cdbe7a239f23a7dbd4d8fd89726b80

Author: heimanba

.github/workflows/release.yml

@@ -33,6 +33,7 @@ jobs:
     outputs:
       channel: ${{ steps.release.outputs.channel }}
       version: ${{ steps.release.outputs.version }}
+      dist-tag: ${{ steps.release.outputs.dist-tag }}
     permissions:
       contents: read
     steps:
@@ -113,7 +114,8 @@ jobs:
       - name: Publish packages with npm Trusted Publishing
         env:
           NPM_CONFIG_PROVENANCE: "true"
-        run: bun run release:publish
+          NPM_DIST_TAG: ${{ needs.preflight.outputs.dist-tag }}
+        run: bun run release:publish -- --tag "$NPM_DIST_TAG"
 
       - name: Create immutable Git tag
         env:

scripts/open-source.test.ts

@@ -145,6 +145,8 @@ describe("open-source repository invariants", () => {
 		expect(workflow).toContain("environment: npm-release");
 		expect(workflow).toContain("vars.NPM_RELEASE_ENABLED == 'true'");
 		expect(workflow).toContain("inputs.confirm == 'PUBLISH'");
+		expect(workflow).toContain(["dist-tag: $", "{{ steps.release.outputs.dist-tag }}"].join(""));
+		expect(workflow).toContain('bun run release:publish -- --tag "$NPM_DIST_TAG"');
 		expect(workflow).toContain("id-token: write");
 		expect(workflow).toContain("cancel-in-progress: false");
 		expect(workflow).toContain("workflow_dispatch:");

scripts/release/publish.test.ts

@@ -28,6 +28,7 @@ describe("release publish recovery", () => {
 
 	test("derives a safe npm dist-tag from prerelease versions", () => {
 		expect(inferDistTag("1.0.1-beta.5")).toBe("beta");
+		expect(inferDistTag("1.0.1-beta-a1b2c3d-20260720")).toBe("beta");
 		expect(inferDistTag("2.0.0-rc.1")).toBe("rc");
 		expect(inferDistTag("1.0.1")).toBeUndefined();
 	});
@@ -44,6 +45,15 @@ describe("release publish recovery", () => {
 			"--tag",
 			"beta",
 		]);
+		expect(publishCommand(false, "1.2.3-beta-a1b2c3d-20260720", "beta")).toEqual([
+			"npm",
+			"publish",
+			"--access",
+			"public",
+			"--provenance",
+			"--tag",
+			"beta",
+		]);
 	});
 
 	test("allows real publishing only inside GitHub Actions", () => {

scripts/release/publish.ts

@@ -53,14 +53,14 @@ export function assertPublishEnvironment(
 }
 
 export function inferDistTag(version: string): string | undefined {
-	const prerelease = version.match(/^[0-9]+\.[0-9]+\.[0-9]+-([0-9A-Za-z-]+)(?:\.|$)/);
+	const prerelease = version.match(/^[0-9]+\.[0-9]+\.[0-9]+-([0-9A-Za-z]+)(?:[.-]|$)/);
 	return prerelease?.[1];
 }
 
-export function publishCommand(dryRun: boolean, version: string): string[] {
+export function publishCommand(dryRun: boolean, version: string, distTag?: string): string[] {
 	if (dryRun) return ["npm", "pack", "--dry-run"];
 	const command = ["npm", "publish", "--access", "public", "--provenance"];
-	const publishTag = inferDistTag(version);
+	const publishTag = distTag ?? inferDistTag(version);
 	if (publishTag) command.push("--tag", publishTag);
 	return command;
 }
@@ -149,6 +149,11 @@ function trackedFileContents(path: string): string | undefined {
 function main(): number {
 	const args = process.argv.slice(2);
 	const dryRun = args.includes("--dry-run");
+	const tagIndex = args.indexOf("--tag");
+	const distTag = tagIndex === -1 ? undefined : args[tagIndex + 1];
+	if (tagIndex !== -1 && (!distTag || !/^[a-z][a-z0-9-]*$/.test(distTag))) {
+		throw new Error("--tag must be a lowercase npm dist-tag");
+	}
 	assertPublishEnvironment(dryRun);
 
 	console.log(`Publishing packages${dryRun ? " (dry-run)" : ""}...\n`);
@@ -166,7 +171,7 @@ function main(): number {
 			continue;
 		}
 
-		const cmd = publishCommand(dryRun, manifest.version);
+		const cmd = publishCommand(dryRun, manifest.version, distTag);
 
 		console.log(`\n--- Publishing ${manifest.name} ---`);
 		let originalLicense: string | undefined;