diff --git a/.editorconfig b/.editorconfig
index 8453313..86e3ffe 100644
--- a/.editorconfig
+++ b/.editorconfig
@@ -10,7 +10,7 @@ end_of_line = lf
 insert_final_newline = true
 trim_trailing_whitespace = true
 
-[{*.yml}]
+[*.yml]
 indent_style = space
 indent_size = 2
 end_of_line = lf
diff --git a/.github/workflows/bump.yml b/.github/workflows/bump.yml
index 4454318..6e92bd1 100644
--- a/.github/workflows/bump.yml
+++ b/.github/workflows/bump.yml
@@ -1,4 +1,6 @@
 name: Bump
+permissions:
+  contents: write
 on:
   workflow_run:
     workflows:
@@ -25,15 +27,17 @@ jobs:
         run: |
           git config user.name "github-actions[bot]"
           git config user.email "github-actions[bot]@users.noreply.github.com"
-      - name: Bump alpha version
-        if: github.event.workflow_run.head_branch == 'master-4'
-        run: npm version prerelease --preid=alpha --no-git-tag-version
-      - name: Bump beta version
-        if: github.event.workflow_run.head_branch == 'master'
-        run: npm version prerelease --preid=beta --no-git-tag-version
-      - name: Bump minor version
-        if: github.event.workflow_run.head_branch != 'master' && github.event.workflow_run.head_branch != 'master-4'
-        run: npm version minor --no-git-tag-version
+      - name: Resolve bump command
+        id: bump-command
+        uses: actions/github-script@v7
+        with:
+          result-encoding: string
+          script: |
+            const ref = github.context.payload.workflow_run?.head_branch || process.env.GITHUB_REF_NAME || "";
+            const type = ref == "master" ? "beta" : ref == "master-4" ? "alpha" : "minor";
+            return `npm version ${type == "minor" ? "minor" : "prerelease"} ${type != "minor" ? "--preid=" + type : ""}`;
+      - name: Bump version
+        run: ${{ steps.bump-command.outputs.result }}
       - name: Push bumped version
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -41,3 +45,4 @@ jobs:
           git add package.json package-lock.json
           git commit -m "chore: bump version after publish"
           git push origin HEAD
+          git push --tags
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 1ba42d7..85a55e7 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -25,12 +25,13 @@ jobs:
         run: npm ci
       - name: Build package
         run: npm run build
-      - name: Publish beta
-        if: github.ref_name == 'master'
-        run: npm publish --access public --provenance --tag beta
-      - name: Publish alpha
-        if: github.ref_name == 'master-4'
-        run: npm publish --access public --provenance --tag alpha
-      - name: Publish latest
-        if: github.ref_name != 'master' && github.ref_name != 'master-4'
-        run: npm publish --access public --provenance --tag latest
+      - name: Resolve publish tag
+        id: publish-tag
+        uses: actions/github-script@v7
+        with:
+          result-encoding: string
+          script: |
+            const ref = process.env.GITHUB_REF_NAME;
+            return ref == "master" ? "beta" : ref == "master-4" ? "alpha" : "latest";
+      - name: Publish package
+        run: npm publish --access public --provenance --tag ${{ steps.publish-tag.outputs.result }}