fix: harden publish workflow against stale tags and version misdetection

[carlos-alm]

Summary

• Stale tag cleanup: Before bumping, removes local tags newer than package.json version that poison commit-and-tag-version's baseline (caused 1.4.1 instead of 2.0.0)
• --skip.tag for all bump paths: Prevents fatal: tag already exists crashes on re-runs
• Idempotent tagging: Tags created manually with git tag -fa + force-push, safe for re-runs
• Release event fix: Extracts version from the release tag name instead of blindly trusting package.json

Test plan

• Run workflow_dispatch with version-override: 2.0.0 — should succeed despite stale v2.0.0 tag on remote
• Verify stale tag warning appears in workflow logs
• Verify published npm version is 2.0.0
• Re-run the same workflow — should be idempotent (npm check catches already-published version)

[greptile-apps]

Greptile Summary

Improves publish workflow robustness by preventing stale tag interference and version misdetection issues.

Key changes:

• Removes local tags newer than package.json version before bumping to prevent commit-and-tag-version baseline poisoning
• Adds --skip.tag to all bump paths to prevent "tag already exists" failures on re-runs
• Switches to manual idempotent tagging with git tag -fa + force-push for safe re-runs
• Extracts version from release tag name instead of trusting package.json for release events

Critical issue:

• Line 148 uses require('semver') but semver is not installed in the workflow — this will cause runtime failure

Confidence Score: 2/5

• This PR will fail in production due to missing dependency
• The stale tag cleanup logic on line 148 requires the semver package which is not installed in the CI environment. The workflow will crash with "Cannot find module 'semver'" when attempting to compare versions.
• .github/workflows/publish.yml requires fixing the semver dependency issue at line 148

Important Files Changed

Filename	Overview
.github/workflows/publish.yml	Hardens publish workflow against stale tags and version misdetection — critical semver dependency missing (line 148)

_{Last reviewed commit: 56edd76}

[greptile-apps]

_{1 file reviewed, 3 comments}

_{Edit Code Review Agent Settings | Greptile}

[greptile-apps]

semver package not installed — will fail with "Cannot find module 'semver'"

Suggested change

	if node -e "process.exit(require('semver').gt('$TAG_VER','$CURRENT')?0:1)" 2>/dev/null; then
	if node -e "v1='$TAG_VER'; v2='$CURRENT'; [v1Arr, v2Arr] = [v1, v2].map(v => v.split('.').map(Number)); exit = v1Arr[0] > v2Arr[0] || (v1Arr[0] === v2Arr[0] && v1Arr[1] > v2Arr[1]) || (v1Arr[0] === v2Arr[0] && v1Arr[1] === v2Arr[1] && v1Arr[2] > v2Arr[2]) ? 0 : 1; process.exit(exit)" 2>/dev/null; then

[greptile-apps]

Iterates over ALL v* tags — with 100+ tags this could be slow. Consider filtering to recent tags only or adding a limit.

[greptile-apps]

Consider using lightweight tag (-f only) instead of annotated tag (-fa). Annotated tags create separate commit objects with their own SHA and timestamp.

_{Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!}