ci: make prerelease publishing reliable on hosted runners

Author: freezy

.github/workflows/publish.yml

@@ -8,9 +8,24 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v5
+      - uses: actions/setup-node@v7
+        with:
+          node-version: '24'
+          package-manager-cache: false
       - name: Install Unity Package Manager CLI
         run: |
-          curl -fsSL https://cdn.packages.unity.com/upm-cli/install.sh | bash
+          installer="$RUNNER_TEMP/install-upm.sh"
+          curl --retry 3 --retry-all-errors --retry-delay 2 -fsSL \
+            https://cdn.packages.unity.com/upm-cli/install.sh -o "$installer"
+          for attempt in 1 2 3; do
+            if bash "$installer"; then
+              break
+            fi
+            if [ "$attempt" -eq 3 ]; then
+              exit 1
+            fi
+            sleep 5
+          done
           echo "$HOME/.upm/bin" >> "$GITHUB_PATH"
           "$HOME/.upm/bin/upm" --version
       - name: Pack and sign
@@ -29,7 +44,7 @@ jobs:
           echo "//registry.visualpinball.org/:_authToken=${NPM_TOKEN}" > ~/.npmrc
           package_tgz="$(find "$RUNNER_TEMP/signed-package" -maxdepth 1 -name '*.tgz' -print -quit)"
           test -n "$package_tgz"
-          npm publish "$package_tgz" --registry=https://registry.visualpinball.org/
+          npm publish "$package_tgz" --registry=https://registry.visualpinball.org/ --tag latest
         env:
           NPM_TOKEN: ${{ secrets.NPM_TOKEN }}