fix(release): omit --dist-tag when empty so latest isn't moved

Instead of requiring a tag, when dist_tag is empty run lerna publish
without --dist-tag. Modern npm won't move the 'latest' tag when publishing
a lower version, so 4.x maintenance releases don't hijack latest.

Author: Lucas McDonald

.github/workflows/prod-release.yml

@@ -11,8 +11,9 @@ on:
         description: '[Optional] Override semantic versioning with explict version (allowed values: "patch", "minor", "major", or explicit version)'
         default: ''
       dist_tag:
-        description: 'NPM distribution tag (required; this is a 4.x maintenance line, so do not use "latest")'
-        required: true
+        description: 'NPM dist-tag. Leave empty to publish without moving the "latest" tag (use for 4.x maintenance releases).'
+        required: false
+        default: ''
 
 env:
   NODE_OPTIONS: "--max-old-space-size=4096"
@@ -33,12 +34,6 @@ jobs:
           echo "::error::Dispatch this workflow from a branch (got ${{ github.ref_type }} '${{ github.ref_name }}'). To release a specific commit, point a branch at it first."
           exit 1
 
-      - name: Require a dist-tag
-        if: github.event.inputs.dist_tag == ''
-        run: |
-          echo "::error::Specify an npm dist-tag. This is the 4.x maintenance line; do not publish to 'latest'."
-          exit 1
-
       - name: Checkout code
         uses: actions/checkout@v4
         with:
@@ -114,10 +109,18 @@ jobs:
         run: npm install -g npm@latest
       - run: npm ci
       - run: npm run build --if-present
-      - run: npx lerna publish from-package --yes --dist-tag "$DIST_TAG"
+      # If no dist-tag is given, omit --dist-tag entirely so npm doesn't move
+      # `latest` (modern npm won't set `latest` when publishing a lower version).
+      - name: Publish
         env:
           NPM_CONFIG_PROVENANCE: true
           DIST_TAG: ${{ github.event.inputs.dist_tag }}
+        run: |
+          if [ -n "$DIST_TAG" ]; then
+            npx lerna publish from-package --yes --dist-tag "$DIST_TAG"
+          else
+            npx lerna publish from-package --yes
+          fi
 
   # Once publishing is complete, validate that the published packages are useable
   validate: