ci: Ensure stable npm packages are tagged as latest after release

[Matsuuu]

Summary

Adds a workflow and supporting scripts to ensure that stable npm packages in the monorepo are correctly tagged as latest on npm after a release.

What this does:

• Adds a new reusable workflow release-set-stable-npm-packages-to-latest.yml that checks out the stable tag, lists all public monorepo packages, and runs npm dist-tag add <pkg>@<version> latest for each.
• Adds a shared pnpm-utils.mjs helper to list monorepo packages via pnpm ls.
• Adds set-latest-for-monorepo-packages.mjs script that performs the actual dist-tag updates.
• Calls the new workflow from release-publish-post-release.yml on minor bumps or stable track releases.

Changes to existing release code:

• Publishing new version of package on stable track doesn't anymore set directly to "latest" but instead uses the track tag like other tracks.

How to test:
Run the release-set-stable-npm-packages-to-latest workflow manually via workflow_dispatch after a stable release, and verify npm packages have the latest dist-tag pointing to the stable version.

Related Linear tickets, Github issues, and Community forum posts

https://linear.app/n8n/issue/CAT-2847

Review / Merge checklist

• I have seen this code, I have run this code, and I take responsibility for this code.
• PR title and summary are descriptive. (conventions)
• Docs updated or follow-up ticket created.
• Tests included.
• PR Labeled with Backport to Beta, Backport to Stable, or Backport to v1 (if the PR is an urgent fix that needs to be backported)

---

🤖 PR Summary generated by AI

[github-actions]

Performance Comparison

Comparing current → latest master → 14-day baseline

PR perf tests not yet enabled. Current = latest master run.

docker-stats

Metric	Current	Latest Master	Baseline (avg)	vs Master	vs Baseline	Status
docker-image-size-n8n	1269.76 MB	1269.76 MB	1273.60 MB (σ 10.49)	+0.0%	-0.3%	✅
docker-image-size-runners	386.00 MB	386.00 MB	392.50 MB (σ 11.06)	+0.0%	-1.7%	✅

Memory consumption baseline with starter plan resources

Metric	Current	Latest Master	Baseline (avg)	vs Master	vs Baseline	Status
memory-heap-used-baseline	114.41 MB	114.41 MB	114.45 MB (σ 0.27)	+0.0%	-0.0%	✅
memory-rss-baseline	278.98 MB	278.98 MB	289.99 MB (σ 41.20)	+0.0%	-3.8%	✅

Idle baseline with Instance AI module loaded

Metric	Current	Latest Master	Baseline (avg)	vs Master	vs Baseline	Status
instance-ai-heap-used-baseline	186.52 MB	186.52 MB	186.43 MB (σ 0.26)	+0.0%	+0.0%	✅
instance-ai-rss-baseline	389.20 MB	389.20 MB	366.52 MB (σ 22.66)	+0.0%	+6.2%	⚠️

How to read this table

• Current: This PR's value (or latest master if PR perf tests haven't run)
• Latest Master: Most recent nightly master measurement
• Baseline: Rolling 14-day average from master
• vs Master: PR impact (current vs latest master)
• vs Baseline: Drift from baseline (current vs rolling avg)
• Status: ✅ within 1σ | ⚠️ 1-2σ | 🔴 >2σ regression

[cubic-dev-ai]

1 issue found across 5 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name=".github/scripts/set-latest-for-monorepo-packages.mjs">

<violation number="1" location=".github/scripts/set-latest-for-monorepo-packages.mjs:17">
P1: Do not swallow `npm dist-tag` failures; this should fail the job when a package cannot be retagged to `latest`. According to linked Linear issue CAT-2847, the workflow must reliably keep `latest` aligned with stable releases.</violation>
</file>

Architecture diagram

sequenceDiagram
    participant GHA as GitHub Actions
    participant Publish as release-publish.yml
    participant PostRelease as release-publish-post-release.yml
    participant Promote as release-set-stable-npm-packages-to-latest.yml
    participant Script as set-latest-for-monorepo-packages.mjs
    participant PNPM as pnpm CLI
    participant NPM as npm Registry

    Note over GHA, NPM: Initial Publication Phase

    GHA->>Publish: Trigger workflow
    Publish->>NPM: CHANGED: npm publish --tag [track]
    Note right of Publish: No longer defaults to 'latest' for stable track

    Note over GHA, NPM: Post-Release Promotion Phase

    GHA->>PostRelease: Trigger post-release tasks
    alt NEW: if bump == 'minor' OR track == 'stable'
        PostRelease->>Promote: Call reusable workflow
        Promote->>GHA: Checkout refs/tags/stable
        Promote->>GHA: Inject NPM_TOKEN into ~/.npmrc
        
        Promote->>Script: Run script
        Script->>PNPM: NEW: pnpm ls --json (via pnpm-utils.mjs)
        PNPM-->>Script: List of monorepo packages
        
        loop For each non-private package
            Script->>NPM: NEW: npm dist-tag add pkg@version latest
            alt Success
                NPM-->>Script: 200 OK
                Script->>GHA: Log success
            else Failure
                NPM-->>Script: Error
                Script->>GHA: Log warning (continue loop)
            end
        end
    end

    PostRelease-->>GHA: Complete

Loading

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review, or fix all with cubic.}

[n8n-assistant]

Successfully created backport PR for release-candidate/2.17.x:

• ci: Ensure stable npm packages are tagged as latest after release (backport to release-candidate/2.17.x) #28765

[n8n-assistant]

Got released with n8n@2.18.0

[n8n-assistant]

Backport failed for release-candidate/2.17.x, because it was unable to cherry-pick the commit(s).

Please cherry-pick the changes locally and resolve any conflicts.

git fetch origin release-candidate/2.17.x
git worktree add -d .worktree/backport-28755-to-release-candidate/2.17.x origin/release-candidate/2.17.x
cd .worktree/backport-28755-to-release-candidate/2.17.x
git switch --create backport-28755-to-release-candidate/2.17.x
git cherry-pick -x 95c155859e97256a0df548e7b93027cb7b0b7057