ci(release): publish from a tag push instead of a manual dispatch

[openai0229]

Problem

One version release is one event — the tag, the five platform builds, the JDBC worker jar, the GitHub Release and the three npm packages — but it needed two commands:

git push origin v0.1.10
gh workflow run packages.yml --ref v0.1.10 -f publish=true

packages.yml was workflow_dispatch only, so a pushed tag built nothing by itself, and the dispatch could be forgotten or aimed at the wrong ref.

Change

.github/workflows/packages.yml:

• add push: tags: ["v*"], keeping workflow_dispatch for a dry build;
• run the Publish release step and the npm job for github.event_name == 'push' || inputs.publish, so a tag push publishes and a manual run still defaults to publish=false.

The guards are unchanged, so a tag push cannot publish something unintended: GITHUB_REF_NAME must equal the version in all three package.json files, the tag must be annotated and point at the checked-out commit, and ci.yml must have succeeded for that commit.

A tag push can also start while the CI run for the same commit is still in flight; the old one-shot check failed the release in that window. The publish step now polls for that CI run, up to 20 minutes, and stops early when it has already failed.

After this, a release is one command:

git tag -a v0.1.11 <release commit> -m "SQLX 0.1.11"
git push origin v0.1.11

Commands run

python3 -c "import yaml; yaml.safe_load(open('.github/workflows/packages.yml'))"   # parses
sh -n <extracted release step>                                                     # shell syntax ok

Static validation only: the tag-push path itself cannot be exercised without publishing a real version. The guards it depends on (GITHUB_REF_NAME, tag type, CI status) are the same ones the manual path already used, and GitHub parses the workflow file on this PR.

Risk

• A tag matching the version asserts publishes without a confirmation step. Only the exact expected version passes the assertions, and the remaining failure mode is a red run, not a partial release.
• A tag on any CI-green commit publishes; tag the release commit on main.
• workflow_dispatch with publish=false still builds and verifies assets without publishing.

Review entry points

• .github/workflows/packages.yml — the on: block, the Publish release step and the npm job condition.

AI assistance

Prepared with DeepSeek Harness; the two validation commands above were run locally.