Publish the CLI from package-specific tags

.github/workflows/release.yml

@@ -4,6 +4,7 @@ on:
   push:
     tags:
       - 'v*'
+      - 'cli-v*'
   workflow_dispatch:
 
 permissions:
@@ -34,20 +35,35 @@ jobs:
       - run: bun run check
 
       - name: Verify the tag matches the package version
+        id: release
         if: github.event_name == 'push'
         run: |
-          tag="${GITHUB_REF_NAME#v}"
-          version="$(node -p 'require("./package.json").version')"
+          case "$GITHUB_REF_NAME" in
+            cli-v*)
+              tag="${GITHUB_REF_NAME#cli-v}"
+              package_dir="packages/cli"
+              ;;
+            v*)
+              tag="${GITHUB_REF_NAME#v}"
+              package_dir="."
+              ;;
+            *)
+              echo "Unsupported release tag $GITHUB_REF_NAME" >&2
+              exit 1
+              ;;
+          esac
+          version="$(node -p "require('./${package_dir}/package.json').version")"
           if [ "$tag" != "$version" ]; then
-            echo "Tag $GITHUB_REF_NAME does not match package.json version $version" >&2
+            echo "Tag $GITHUB_REF_NAME does not match ${package_dir}/package.json version $version" >&2
             exit 1
           fi
+          echo "package_dir=$package_dir" >> "$GITHUB_OUTPUT"
 
       - name: Publish to npm
         if: github.event_name == 'push'
         # The dist-tag comes from publishConfig in package.json, so alpha
         # releases land on `next` and never move `latest`.
-        run: npm publish --provenance --access public
+        run: npm publish "${{ steps.release.outputs.package_dir }}" --provenance --access public
         env:
           # Ignored when the package uses trusted publishing; kept so the
           # workflow also works with a classic automation token.

RELEASING.md

@@ -28,15 +28,23 @@ publishing should need a second pair of eyes.
 ## Cutting a release
 
 1. Land every change on `main` and confirm CI is green.
-2. Set the version in `package.json`. Pre-releases keep the `next` dist-tag
-   through `publishConfig`, so they never move `latest`.
+2. Set the version in the package being released. Root `miakapi` pre-releases
+   keep the `next` dist-tag through `publishConfig`; `@miakapp/cli` remains the
+   installable agent entry point on `latest`.
 3. Tag and push:
 
    ```sh
    git tag v4.0.0-alpha.1
    git push origin v4.0.0-alpha.1
    ```
 
+   For the CLI, use its package-specific tag:
+
+   ```sh
+   git tag cli-v4.0.0-alpha.1
+   git push origin cli-v4.0.0-alpha.1
+   ```
+
 4. Watch the *Release* workflow. It publishes only on a tag push. A manual
    `workflow_dispatch` run stops after the gate — which ends with
    `npm pack --dry-run` — and is the way to rehearse a release without
@@ -48,6 +56,7 @@ Verify the dist-tags before announcing:
 
 ```sh
 npm view miakapi dist-tags
+npm view @miakapp/cli dist-tags
 ```
 
 `latest` must still point at the MiakAPI 3 line until version 4 is stable.