ci(publish): update workflow to require release_tag input

.gitea/workflows/publish.yml

@@ -4,6 +4,11 @@ on:
     tags:
       - 'v*'
   workflow_dispatch:
+    inputs:
+      release_tag:
+        description: Existing tag to publish (must match package.json version, e.g. v1.1.0)
+        required: true
+        type: string
 
 jobs:
   publish:
@@ -12,6 +17,8 @@ jobs:
       PACKAGE_REGISTRY: https://git.warky.dev/api/packages/${{ gitea.repository_owner }}/npm/
     steps:
       - uses: https://github.com/actions/checkout@v4
+        with:
+          ref: ${{ inputs.release_tag || gitea.ref }}
       - uses: https://github.com/pnpm/action-setup@v4
       - uses: https://github.com/actions/setup-node@v4
         with:
@@ -21,13 +28,18 @@ jobs:
           cache: pnpm
       - name: Verify release tag
         env:
-          RELEASE_REF: ${{ gitea.ref }}
+          EVENT_NAME: ${{ gitea.event_name }}
+          TRIGGER_REF: ${{ gitea.ref }}
+          RELEASE_TAG: ${{ inputs.release_tag }}
         run: |
           node --input-type=module <<'JS'
           import { readFileSync } from 'node:fs';
           const { version } = JSON.parse(readFileSync('package.json', 'utf8'));
-          if (process.env.RELEASE_REF !== `refs/tags/v${version}`) {
+          const tag = process.env.EVENT_NAME === 'workflow_dispatch'
-            throw new Error(`Release tag must be v${version} to match package.json`);
+            ? process.env.RELEASE_TAG
+            : process.env.TRIGGER_REF.replace(/^refs\/tags\//, '');
+          if (tag !== `v${version}`) {
+            throw new Error(`Release tag must be v${version}; received ${tag || '(empty)'}`);
           }
           JS
       - run: pnpm install --frozen-lockfile

AGENTS.md

@@ -35,11 +35,12 @@ repository's user or organization (not necessarily the npm scope `warkypublic`).
 2. Run `pnpm exec changeset version` to apply pending changesets. Review and commit
    the updated version, changelog, and consumed changesets with the release changes.
 3. Create and push a matching tag to the Gitea remote, for example `v1.1.0` for
-   package version `1.1.0`. To dispatch manually, select that existing matching tag
+   package version `1.1.0`. To publish manually, run the workflow from the Actions
-   as the workflow run ref in the Actions UI; the workflow rejects branch refs and
+   UI and set its required `release_tag` input to the matching tag. Checkout and
-   tags that do not exactly match the package version. It runs the tests and
+   validation use that tag; the workflow rejects tags that do not exactly match the
-   bundle checks, then publishes using pnpm so the `publishConfig` overrides point
+   package version. It then runs tests and bundle checks before publishing with
-   consumers to the built JavaScript and declarations.
+   pnpm, which applies the `publishConfig` entries for built JavaScript and
+   declarations.
 
 Stable versions receive the `latest` dist-tag; prereleases receive `next`.
 Existing package versions cannot be overwritten; release a new version instead.