ci: Use goreleaser-npm-publisher-action v1.6.0

[khvn26]

goreleaser-npm-publisher-action v1.6.0 now supports inputs for differing package/repo/binary names, and including repository in package metadata.

In this PR, we migrate the release workflow from our fork to the new action version.

We also improve the release workflow_dispatch trigger:

• Configure goreleaser to do a full release on dispatch, and replace existing artifacts.
• Run install script E2E agaisnt scripts from both the dispatched tag, and the main branch.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 19233425-7072-46b9-941f-863ba21e2d04

📥 Commits

Reviewing files that changed from the base of the PR and between 03cbcc1 and e435f81.

📒 Files selected for processing (1)

• .github/workflows/release.yml

💤 Files with no reviewable changes (1)

• .github/workflows/release.yml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The release workflow supports dispatched-tag releases, serialises releases by tag, and enables Docker and GHCR steps for those releases. GoReleaser always runs the release flow, replaces existing artefacts, and supports dispatched-release attestations. npm publishing uses the pinned publisher action. Installer checks use an Ubuntu, macOS, and Windows matrix.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Merge Risk: 🟠 High · up to e435f

The release workflow can publish incorrect package metadata, execute unintended commands when testing a dispatched tag, and report success while npm packages are missing. These concrete correctness, security, and release-integrity risks should be fixed before merging.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 37da0807-bdba-48a1-8b32-fb0e934e2d3e

📥 Commits

Reviewing files that changed from the base of the PR and between 2d55665 and fc09551.

📒 Files selected for processing (1)

• .github/workflows/release.yml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

[coderabbitai]

Actionable comments posted: 2

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: ace69c7b-2123-437b-80b2-c0475dc4637b

📥 Commits

Reviewing files that changed from the base of the PR and between fc09551 and 03cbcc1.

📒 Files selected for processing (2)

• .github/workflows/release.yml
• .goreleaser.yaml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.