fix(release): allow publishing with no tag; publish one package at a time

[lucasmcdonald3]

Issue #, if available:

Description of changes:

1. When dist_tag is empty, do not publish a tag. (Current behavior is to pass an empty dist_tag to the npm CLI, which the CLI interprets as "set latest tag", which we don't want.)
2. Publish one package at a time. Releasing packages in parallel submits many provenance attestations to Rekor (npm publish signing logbook) at once. Submissions to Rekor can time out and be retried. If the first attempt succeeded, the retry fails, then indicates "failure" to npm, and npm doesn't attempt to publish the package. Setting --concurrency 1 serializes publishes so only one attestation is in flight at a time, (possibly, hopefully) reducing those timeout-induced 409s.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

Check any applicable:

• Were any files moved? Moving files changes their URL, which breaks all hyperlinks to the files.

[Copilot]

Pull request overview

Note

Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.

Updates the production release workflow so that clearing the dist_tag input publishes without passing --dist-tag, avoiding npm interpreting an empty string as latest.

Changes:

• Clarifies the dist_tag workflow input description to document the “delete to omit” behavior.
• Replaces the single lerna publish ... --dist-tag "$DIST_TAG" invocation with conditional logic that omits --dist-tag when empty.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.