GeezerVison

Pre-releases publish to npm under their own tag (rc), so npm install @dbdiff/cli kept resolving to an older version until latest was moved by hand.

New: npm-dist-tag.yml (Actions → Move npm dist-tag → Run workflow)

• Inputs: a published version and a tag (default latest).
• Moves the tag on @dbdiff/cli and all eight platform packages together. Platform packages go first and the root last, since the root is what people install.
• The move itself runs scripts/npm-promote-latest.sh, the script already used to move tags locally. Before touching anything it checks every package has that version on npmjs.org. If any is missing, nothing moves.
• Before a stable release: latest can point at any pre-release.
• After a stable release: latest only follows stable releases. It refuses a pre-release, and refuses a stable version older than the current latest (e.g. a 3.0.x patch after 3.1.0).
• Other tags (rc, beta, …) can be moved freely.

Release integration

• release.yml gains an npm-latest job that calls the same workflow after publish-npm.
• When the guard refuses, it skips with a notice rather than failing the release. Run by hand, a refusal is an error.

Verified

• actionlint passes on both files.
• The guard was run locally against the live registry and a stubbed one. Each case gave the expected result:

It needs the existing NPM_TOKEN secret, which already has write access to all nine packages.

🤖 Generated with Claude Code