Fix: Trigger publish workflow on release published, not created

[RomiC]

GitHub sends a published event when a draft release is published, which is not covered by the created trigger. published covers both draft publishing and direct release creation.

Closes #326

[greptile-apps]

Greptile Summary

This PR changes the npm publication workflow from the release.created event to release.published, allowing draft releases to trigger publication when made public.

• Covers both directly published releases and draft-to-published transitions.
• Also newly exposes draft prereleases to the workflow’s unconditional default npm publication tag.

Confidence Score: 4/5

The prerelease handling should be fixed before merging because publishing a draft prerelease can replace npm’s stable latest version.

The expanded release trigger reaches every published prerelease, while the unchanged unqualified npm publish command assigns the default npm dist-tag without distinguishing stable releases from prereleases.

Files Needing Attention: .github/workflows/npm-publish.yml

Important Files Changed

Filename	Overview
.github/workflows/npm-publish.yml	Changes the release event subtype as intended, but draft prereleases can now be published under npm’s default latest dist-tag.

Prompt To Fix All With AI

### Issue 1
.github/workflows/npm-publish.yml:5
**Prereleases overwrite the latest tag**

When a draft prerelease is published, the new `published` trigger starts this workflow and the unqualified `npm publish` assigns npm’s default `latest` dist-tag, causing normal package installs to resolve to the prerelease instead of the current stable release.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

_{Reviews (1): Last reviewed commit: "Fix: Trigger publish workflow on release..." | Re-trigger Greptile}

[greptile-apps]

Prereleases overwrite the latest tag

When a draft prerelease is published, the new published trigger starts this workflow and the unqualified npm publish assigns npm’s default latest dist-tag, causing normal package installs to resolve to the prerelease instead of the current stable release.

Prompt To Fix With AI

This is a comment left during a code review.
Path: .github/workflows/npm-publish.yml
Line: 5

Comment:
**Prereleases overwrite the latest tag**

When a draft prerelease is published, the new `published` trigger starts this workflow and the unqualified `npm publish` assigns npm’s default `latest` dist-tag, causing normal package installs to resolve to the prerelease instead of the current stable release.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

[RomiC]

The project doesn't have pre-release versions

[greptile-apps]

Fair enough — if the project doesn't use pre-releases, that concern doesn't apply. The change is correct then.

Shall I remember this as a rule: "this repo does not use pre-release versions, so no need to flag npm dist-tag issues related to prereleases"?

Tip: You can customize Greptile's behavior for this repo with .greptile/rules.md and .greptile/config.json.

[coveralls]

Coverage is 100.0% — fix/release-published-trigger into main. No base build found for main.