fix: add workflow_dispatch trigger to CD workflow

[ronald-urbina]

Adds workflow_dispatch to the CD workflow so the pipeline can be manually triggered from the GitHub Actions UI.

This unblocks npm publishes when the automated publish step was missed (e.g. castable-video@1.1.15 and peertube-video-element@1.1.0 are currently on GitHub releases but not on npm).

---

Note

Low Risk
Low risk CI-only change; it expands when publish steps can run (manual dispatch), so reviewers should ensure manual runs won’t accidentally publish unintended versions.

Overview
Adds a workflow_dispatch trigger to the CD GitHub Actions workflow so it can be run manually from the Actions UI.

Updates the release job gating so the checkout/build/publish steps run either when release-please creates a release or when the workflow is manually dispatched, enabling manual npm publishes when automation is missed.

^{Reviewed by Cursor Bugbot for commit 1c6879d. Bugbot is set up for automated code reviews on this repo. Configure here.}

[vercel]

@ronald-urbina is attempting to deploy a commit to the Mux Team on Vercel.

A member of the Team first needs to authorize it.

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 1c6879d. Configure here.}

[cursor]

Manual dispatch allows publishing from any branch

Medium Severity

The push trigger is restricted to main, but workflow_dispatch has no branch restriction and doesn't support native branch filtering. Anyone with write access can manually trigger this workflow from any branch, potentially publishing unreleased or broken code to npm. The release job needs a github.ref == 'refs/heads/main' guard (or equivalent) to match the safety of the push trigger.

Additional Locations (1)

• .github/workflows/cd.yml#L33-L35

 

^{Reviewed by Cursor Bugbot for commit 1c6879d. Configure here.}