Fold finish release into main release flow (#145)

* Fix npm publish path ambiguity and add one-off release recovery workflow

npm parsed the bare "dist/*.tgz" arg as a GitHub shorthand spec instead
of a local path, breaking the 1.8.0 npm publish. Prefix with ./ to
disambiguate, and add finish-release.yml to retry the npm publish and
GitHub release for 1.8.0 by reusing the already-built artifacts,
without re-triggering the (already successful) PyPI/conda publishes.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* Replace finish-release.yml with a reuse_run_id dispatch on release.yml

npm's trusted publisher for @bokeh/ipywidgets_bokeh is bound to the
release.yml workflow filename, so dispatching a separate workflow file
got a 404 from npm's OIDC check even though the package exists.
Instead, add a workflow_dispatch input on release.yml itself that
skips build/PyPI/conda and reuses artifacts from a prior run, so the
npm publish (and GitHub release) retry runs under the same trusted
workflow.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>

Author: philippjfr

.github/workflows/release.yml

@@ -4,6 +4,15 @@ on:
   push:
     tags:
       - "[0-9]+.[0-9]+.[0-9]+*"
+  workflow_dispatch:
+    inputs:
+      reuse_run_id:
+        description: "Run ID to reuse build artifacts from, skipping build/PyPI/conda (leave empty for a normal release)"
+        required: false
+      prerelease:
+        description: "Mark as a prerelease (only used when reuse_run_id is set)"
+        type: boolean
+        default: false
 
 permissions:
   contents: read
@@ -15,6 +24,7 @@ concurrency:
 jobs:
   build:
     name: Build and verify release artifacts
+    if: inputs.reuse_run_id == ''
     runs-on: ubuntu-latest
     outputs:
       prerelease: ${{ steps.version.outputs.prerelease }}
@@ -117,6 +127,7 @@ jobs:
   publish-pypi:
     name: Publish to PyPI
     needs: build
+    if: inputs.reuse_run_id == '' && always() && !failure() && !cancelled()
     runs-on: ubuntu-latest
     environment: release
     permissions:
@@ -138,11 +149,13 @@ jobs:
   publish-npm:
     name: Publish to npm
     needs: build
+    if: always() && !failure() && !cancelled()
     runs-on: ubuntu-latest
     environment: release
     permissions:
       contents: read
       id-token: write
+      actions: read
 
     steps:
       - name: Set up Node.js for trusted publishing
@@ -157,10 +170,12 @@ jobs:
         with:
           name: npm-package
           path: dist
+          run-id: ${{ inputs.reuse_run_id || github.run_id }}
+          github-token: ${{ github.token }}
 
       - name: Publish npm package
         env:
-          PRERELEASE: ${{ needs.build.outputs.prerelease }}
+          PRERELEASE: ${{ needs.build.outputs.prerelease || inputs.prerelease }}
         run: |
           args=(--access public)
           if [[ "$PRERELEASE" == "true" ]]; then
@@ -171,8 +186,10 @@ jobs:
   publish-conda:
     name: Publish to Anaconda.org
     needs: build
+    if: inputs.reuse_run_id == '' && always() && !failure() && !cancelled()
     runs-on: ubuntu-latest
     environment: release
+
     permissions:
       contents: read
 
@@ -201,7 +218,7 @@ jobs:
       - name: Publish conda package
         env:
           ANACONDA_API_TOKEN: ${{ secrets.ANACONDA_API_TOKEN }}
-          PRERELEASE: ${{ needs.build.outputs.prerelease }}
+          PRERELEASE: ${{ needs.build.outputs.prerelease || inputs.prerelease }}
         run: |
           if [[ -z "$ANACONDA_API_TOKEN" ]]; then
             echo "ANACONDA_API_TOKEN is not configured in the release environment" >&2
@@ -224,40 +241,50 @@ jobs:
   github-release:
     name: Create GitHub Release
     needs: [build, publish-pypi, publish-npm, publish-conda]
+    if: always() && !failure() && !cancelled()
     runs-on: ubuntu-latest
     environment: release
     permissions:
       contents: write
+      actions: read
 
     steps:
       - name: Download Python distributions
         uses: actions/download-artifact@v4
         with:
           name: python-distributions
           path: artifacts/python
+          run-id: ${{ inputs.reuse_run_id || github.run_id }}
+          github-token: ${{ github.token }}
 
       - name: Download npm package
         uses: actions/download-artifact@v4
         with:
           name: npm-package
           path: artifacts/npm
+          run-id: ${{ inputs.reuse_run_id || github.run_id }}
+          github-token: ${{ github.token }}
 
       - name: Download conda package
         uses: actions/download-artifact@v4
         with:
           name: conda-package
           path: artifacts/conda
+          run-id: ${{ inputs.reuse_run_id || github.run_id }}
+          github-token: ${{ github.token }}
 
       - name: Download checksums
         uses: actions/download-artifact@v4
         with:
           name: release-checksums
           path: artifacts/checksums
+          run-id: ${{ inputs.reuse_run_id || github.run_id }}
+          github-token: ${{ github.token }}
 
       - name: Create GitHub Release
         env:
           GH_TOKEN: ${{ github.token }}
-          PRERELEASE: ${{ needs.build.outputs.prerelease }}
+          PRERELEASE: ${{ needs.build.outputs.prerelease || inputs.prerelease }}
         run: |
           args=(--verify-tag --generate-notes --title "$GITHUB_REF_NAME")
           if [[ "$PRERELEASE" == "true" ]]; then