fixup! ci(release): publish any prerelease tag under its own dist-tag

Author: not-matthias

.github/workflows/release.yml

@@ -73,8 +73,21 @@ jobs:
         run: |
           # Prerelease tags publish under their own identifier (alpha, beta, rc);
           # only a plain vX.Y.Z tag is allowed to move the `latest` dist-tag.
-          PREID=$(sed -n 's/^v[0-9]\+\.[0-9]\+\.[0-9]\+-\([a-z][a-z0-9]*\).*/\1/p' <<<"$GITHUB_REF_NAME")
-          pnpm publish -r --access=public --no-git-checks ${PREID:+--tag="$PREID"}
+          VERSION="${GITHUB_REF_NAME#v}"
+          if [[ "$VERSION" != *-* ]]; then
+            pnpm publish -r --access=public --no-git-checks
+            exit 0
+          fi
+
+          PREID="${VERSION#*-}"
+          PREID="${PREID%%.*}"
+          # npm rejects a dist-tag that parses as a semver range, so a numeric
+          # identifier has no channel to publish under.
+          if [[ ! "$PREID" =~ ^[A-Za-z][A-Za-z0-9-]*$ ]]; then
+            echo "Refusing to publish $GITHUB_REF_NAME: '$PREID' cannot be an npm dist-tag" >&2
+            exit 1
+          fi
+          pnpm publish -r --access=public --no-git-checks --tag="$PREID"
         env:
           NPM_CONFIG_PROVENANCE: true
           # Surfaces npm's OIDC token exchange, which is otherwise silent.

scripts/release.sh

@@ -34,6 +34,10 @@ fi
 # out here.
 PREID=()
 if [ $# -eq 2 ]; then
+  if [[ ! "$2" =~ ^[a-z][a-z0-9-]*$ ]]; then
+    echo "Invalid prerelease identifier: '$2' (expected e.g. alpha, beta, rc)"
+    exit 1
+  fi
   PREID=(--preid "$2")
 fi