chore: update release workflow

Author: chenjiahan

.github/workflows/release.yml

@@ -1,38 +1,85 @@
 name: Release
 
 on:
-  # Run `npm run bump` to bump the version and create a git tag.
-  push:
-    tags:
-      - 'v*'
-
   workflow_dispatch:
+    inputs:
+      npm_tag:
+        type: choice
+        description: 'Specify npm tag'
+        required: true
+        default: 'alpha'
+        options:
+          - alpha
+          - beta
+          - rc
+          - canary
+          - latest
+      npm_tag_confirm:
+        type: choice
+        description: 'Confirm npm tag'
+        required: true
+        options:
+          - alpha
+          - beta
+          - rc
+          - canary
+          - latest
+      branch:
+        description: 'Release Branch (confirm release branch)'
+        required: true
+        default: 'main'
 
-permissions:
-  contents: read
-  id-token: write # Required for OIDC
+permissions: {}
 
 jobs:
-  publish:
+  validate_inputs:
+    name: Validate Inputs
+    if: github.repository == 'rstackjs/rstack' && github.event_name == 'workflow_dispatch'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Validate npm tag confirmation
+        env:
+          NPM_TAG: ${{ inputs.npm_tag }}
+          NPM_TAG_CONFIRM: ${{ inputs.npm_tag_confirm }}
+        run: |
+          if [ "$NPM_TAG" != "$NPM_TAG_CONFIRM" ]; then
+            echo "Error: npm_tag and npm_tag_confirm must match"
+            echo "npm_tag: $NPM_TAG"
+            echo "npm_tag_confirm: $NPM_TAG_CONFIRM"
+            exit 1
+          fi
+          echo "npm_tag validation passed: $NPM_TAG"
+
+  release:
+    name: Release
+    if: github.repository == 'rstackjs/rstack' && github.event_name == 'workflow_dispatch'
+    needs: validate_inputs
     runs-on: ubuntu-latest
     environment: npm
+    permissions:
+      # Provenance generation in GitHub Actions requires "write" access to the "id-token"
+      id-token: write
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          fetch-depth: 1
+          ref: ${{ github.event.inputs.branch }}
 
       - name: Setup Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version: 24.15.0
+          node-version: 24.18.0
           package-manager-cache: false
 
-      - name: Install Pnpm
-        uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
+      - name: Setup Pnpm
+        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
         with:
           run_install: true
 
-      - name: Build Packages
+      - name: Build
         run: node --run build
 
-      - name: Publish
-        run: pnpm stage publish --no-git-checks
+      - name: Publish to npm
+        run: |
+          pnpm --filter './packages/*' -r stage publish --tag ${{ github.event.inputs.npm_tag }} --no-git-checks