name: pkg-pr-new

on: pull_request

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions: {}

jobs:
  publish:
    name: Publish
    runs-on: ubuntu-latest

    steps:
      - name: Check out repo
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - uses: ./.github/actions/ci-setup
        with:
          skip-cache: true # avoid cache poisoning attacks

      - name: Build
        run: pnpm build

      - run:
          | # zizmor: ignore[use-trusted-publishing] we're not publishing to npm here
          pnpm exec pkg-pr-new publish --pnpm --packageManager=pnpm --commentWithDev --commentWithSha --no-compact --no-template