chore: add pkg-pr-new to preview pkg version before its published

.github/workflows/pkg-pr-new.yml

@@ -0,0 +1,107 @@
+name: Publish Any Commit
+
+# Publishes preview packages via pkg.pr.new. Gated so untrusted/fork PRs can't
+# trigger a build+publish just by opening a PR - only:
+#   - push: pushing to a branch already requires repo write access
+#   - pull_request: only when opened/updated by an author with write access
+#     (e.g. a maintainer's own branch)
+#   - pull_request_review: for everyone else, once a maintainer approves the PR
+# tags/releases are excluded so version-tag pushes don't trigger a duplicate publish.
+on:
+  push:
+    branches: ['**']
+    tags: ['!**']
+  pull_request:
+    types: [opened, synchronize, reopened]
+  pull_request_review:
+    types: [submitted]
+
+permissions: {}
+
+jobs:
+  check:
+    name: Check permissions
+    if: github.event_name == 'push' || github.event_name == 'pull_request' || github.event.review.state == 'approved'
+    runs-on: ubuntu-latest
+    permissions:
+      pull-requests: read
+    outputs:
+      approved: ${{ steps.check.outputs.approved }}
+    steps:
+      - name: Push events are already gated by branch write access
+        if: github.event_name == 'push'
+        id: push-approved
+        run: echo "approved=true" >> "$GITHUB_OUTPUT"
+      - name: Check PR author permission
+        uses: actions-cool/check-user-permission@c21884f3dda18dafc2f8b402fe807ccc9ec1aa5e # v2.4.0
+        if: github.event_name == 'pull_request'
+        id: checkAuthor
+        with:
+          username: ${{ github.event.pull_request.user.login }}
+          require: write
+      - name: Check reviewer permission
+        uses: actions-cool/check-user-permission@c21884f3dda18dafc2f8b402fe807ccc9ec1aa5e # v2.4.0
+        if: github.event_name == 'pull_request_review'
+        id: checkPermissions
+        with:
+          require: write
+      - name: Combine results
+        id: check
+        # Exactly one of the three steps above runs per trigger, the others are
+        # skipped and their outputs are empty strings, so this picks whichever ran.
+        run: echo "approved=${{ steps.push-approved.outputs.approved || steps.checkAuthor.outputs.require-result || steps.checkPermissions.outputs.require-result }}" >> "$GITHUB_OUTPUT"
+
+  build:
+    name: Build
+    needs: check
+    if: needs.check.outputs.approved == 'true'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      # For PR-related events this checks out the PR head commit (not a merge
+      # commit with main), matching the sha pkg-pr-new publishes/comments with.
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+          persist-credentials: false
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 24
+          cache: pnpm
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm run build
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: dist
+          path: dist/
+
+  publish:
+    name: Publish
+    needs: build
+    runs-on: ubuntu-latest
+    # Separate job from `build` so only this one - the one that actually needs
+    # to comment on the PR - carries pull-requests: write.
+    permissions:
+      pull-requests: write
+    steps:
+      # For PR-related events this checks out the PR head commit (not a merge
+      # commit with main), matching the sha pkg-pr-new publishes/comments with.
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+          persist-credentials: false
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 24
+          cache: pnpm
+      - run: pnpm install --frozen-lockfile --ignore-scripts
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: dist
+          path: dist/
+      # --commentWithSha uses the commit sha in install URLs/comments instead
+      # of a PR number, and pnpm exec (not npx/dlx) runs the pinned devDependency.
+      - run: pnpm exec pkg-pr-new publish --commentWithSha

package.json

@@ -95,6 +95,7 @@
 		"knip": "^6.18.0",
 		"oxfmt": "^0.60.0",
 		"oxlint": "^1.71.0",
+		"pkg-pr-new": "^0.0.88",
 		"postcss": "^8.5.15",
 		"publint": "^0.3.21",
 		"tailwindcss": "^2.2.8",