Tag npm prerelease publications

Author: kMutagene

.github/workflows/release-codecs.yml

@@ -109,7 +109,11 @@ jobs:
           if npm view "${package_name}@${package_version}" version >/dev/null 2>&1; then
             echo "${package_name}@${package_version} is already published; skipping."
           else
-            npm publish "${packages[0]}" --access public
+            npm_tag=latest
+            if [[ "$package_version" == *-* ]]; then
+              npm_tag=preview
+            fi
+            npm publish "${packages[0]}" --access public --tag "$npm_tag"
           fi
 
   publish-pypi:

.github/workflows/release-model.yml

@@ -109,7 +109,11 @@ jobs:
           if npm view "${package_name}@${package_version}" version >/dev/null 2>&1; then
             echo "${package_name}@${package_version} is already published; skipping."
           else
-            npm publish "${packages[0]}" --access public
+            npm_tag=latest
+            if [[ "$package_version" == *-* ]]; then
+              npm_tag=preview
+            fi
+            npm publish "${packages[0]}" --access public --tag "$npm_tag"
           fi
 
   publish-pypi:

AGENTS.md

@@ -223,7 +223,7 @@ When adding tests:
 - `release-model.yml` and `release-codecs.yml` each rerun core and portable gates, pack once, preserve that build as a workflow artifact, and publish it through independent NuGet, npm, and PyPI jobs from a protected `release` environment. A failed registry job must be retriable without rebuilding or rerunning successful registry jobs. Release Model before Codecs when both versions change.
 - `release-all.yml` is an orchestration convenience only. It validates release metadata, checks the exact committed versions on NuGet/npm/PyPI, and dispatches the existing package-specific workflows for incomplete versions. It must never publish directly or replace their trusted-publisher identities.
 - Model and Codecs NuGet trusted-publisher policies must name their direct workflow (`release-model.yml` or `release-codecs.yml`). Client and Interop policies must name the called reusable workflow `release-package.yml`, which NuGet observes through `job_workflow_ref`.
-- npm trusted-publisher policies for the scoped Model and Codecs packages must name the corresponding direct package workflow and allow `npm publish`. These workflows use Node 24, npm with trusted-publishing support, and no npm token.
+- npm trusted-publisher policies for the scoped Model and Codecs packages must name the corresponding direct package workflow and allow `npm publish`. These workflows use Node 24, npm with trusted-publishing support, and no npm token. They publish prerelease versions with the `preview` dist-tag and stable versions with `latest`.
 - PyPI trusted-publisher policies for Model and Codecs must name the corresponding direct, top-level package workflow. Do not move PyPI publishing into a reusable workflow.
 - NuGet trusted-publishing policies are owner-wide and cannot be scoped to an
   individual package. The current policy owner and package owner is the

docs/operations/releases.md

@@ -191,6 +191,9 @@ Each npm package can have only one trusted publisher. The values are
 case-sensitive and the workflow filename includes `.yml`. No `NPM_TOKEN`
 secret is used. Keep the packages in the `nfdi4plants` npm scope and grant
 maintainer access through the npm organization rather than a personal scope.
+The workflows explicitly publish prerelease versions with the `preview`
+dist-tag and stable versions with `latest`; npm rejects prerelease publication
+without a non-`latest` tag.
 
 On pypi.org, open each project under **Manage → Publishing**, add a GitHub
 Actions trusted publisher, and enter: