ci: properly derive npm tag from git tag

Only the latest git tag should be published as latest to npm. Other tags
will be published with either pre-vX.Y or lts-vX.Y as their npm tagname.
# Please enter the commit message for your changes. Lines starting
# with '#' will be ignored, and an empty message aborts the commit.
#
# On branch master
# Your branch is up to date with 'origin/master'.
#
# Changes to be committed:
#	modified:   .github/workflows/publish.yml
#

Author: BurningEnlightenment

.github/workflows/publish.yml

@@ -9,8 +9,14 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
-        with:
-          filter: blob:limit=2m
+      - name: Ensure tag and package version match
+        run: |
+          TAG_VERSION=${GITHUB_REF_NAME#v}
+          NPM_VERSION=$(jq -r .version package.json)
+          if [[ "$TAG_VERSION" != "$NPM_VERSION" ]]; then
+            echo "Tag $TAG_VERSION does not match package.json#.version $NPM_VERSION; aborting."
+            exit 1
+          fi
       - uses: actions/setup-node@v6
         with:
           node-version: "20"
@@ -33,6 +39,10 @@ jobs:
     runs-on: ubuntu-latest
     needs: [build-package]
     steps:
+      - uses: actions/checkout@v6
+        with:
+          fetch-tags: true
+          filter: "blob:none"
       - uses: actions/setup-node@v6
         with:
           node-version: "24"
@@ -41,7 +51,18 @@ jobs:
         uses: actions/download-artifact@v5
         with:
           name: node-package
-      - run: npm publish "${{ github.workspace }}/package.tgz" --access public --provenance
+      - name: Publish pre-release to npm registry
+        if: ${{ contains(github.ref_name, '-') }}
+        run: npm publish "${{ github.workspace }}/package.tgz" --tag "pre-${GITHUB_REF_NAME%.*-*}" --access public --provenance
+      - name: Publish release to npm registry
+        if: ${{ !contains(github.ref_name, '-') }}
+        run: |
+          if [[ "${{ github.ref_name }}" == "$(git tag | grep -v - - | sort -V -r | head -n 1)" ]]; then
+            TAG_NAME="latest"
+          else
+            TAG_NAME="lts-${GITHUB_REF_NAME%.*}"
+          fi
+          npm publish "${{ github.workspace }}/package.tgz" --tag "$TAG_NAME" --access public --provenance
 
   create-release:
     name: Create the GitHub Release