feat: add PR tarball workflow with direct download link (#576)

* feat: add PR tarball workflow with direct download link

On every PR, the build workflow now also runs `npm pack` and uploads
the resulting tarball as a GitHub Release asset. A sticky comment is
posted on the PR with a direct download link and a one-liner npm
install command. The temporary release is automatically cleaned up
when the PR is closed or merged.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fix: remove cleanup job to preserve tarballs for old PRs

Removes the cleanup-pr-tarball job so tarball releases persist after
PR close. This allows testing packages from old/closed PRs.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* chore: upgrade sticky-pull-request-comment to v3

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* feat: add scheduled cleanup for old PR tarball releases

Runs daily at midnight UTC. Deletes PR tarball releases (and their
tags) older than 7 days. Can also be triggered manually.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

Author: jesseturner21

.github/workflows/build-and-test.yml

@@ -47,6 +47,15 @@ jobs:
         with:
           name: coverage-report
           path: coverage/
+      - name: Pack tarball
+        if: matrix.node-version == '20.x'
+        run: npm pack
+      - name: Upload tarball artifact
+        if: matrix.node-version == '20.x'
+        uses: actions/upload-artifact@v7
+        with:
+          name: tarball
+          path: '*.tgz'
 
   coverage:
     needs: build
@@ -71,3 +80,60 @@ jobs:
           vite-config-path: vitest.unit.config.ts
           file-coverage-mode: none
           coverage-thresholds: '{ "lines": 50, "branches": 50, "functions": 50, "statements": 50 }'
+
+  pr-tarball:
+    needs: build
+    runs-on: ubuntu-latest
+    if: github.event_name == 'pull_request'
+    permissions:
+      contents: write
+      pull-requests: write
+
+    steps:
+      - uses: actions/checkout@v6
+      - name: Download tarball artifact
+        uses: actions/download-artifact@v8
+        with:
+          name: tarball
+          path: tarball/
+      - name: Get tarball info
+        id: tarball
+        run: |
+          TARBALL_NAME=$(ls tarball/*.tgz | head -1 | xargs basename)
+          echo "name=$TARBALL_NAME" >> $GITHUB_OUTPUT
+      - name: Create or update PR release
+        id: release
+        env:
+          GH_TOKEN: ${{ github.token }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          TARBALL_NAME: ${{ steps.tarball.outputs.name }}
+        run: |
+          TAG="pr-${PR_NUMBER}-tarball"
+
+          # Delete existing release if it exists (to update the tarball)
+          gh release delete "$TAG" --yes --cleanup-tag 2>/dev/null || true
+
+          # Create a new pre-release with the tarball
+          gh release create "$TAG" \
+            "tarball/${TARBALL_NAME}" \
+            --title "PR #${PR_NUMBER} Tarball" \
+            --notes "Auto-generated tarball for PR #${PR_NUMBER}." \
+            --prerelease \
+            --target "${{ github.event.pull_request.head.sha }}"
+
+          DOWNLOAD_URL="https://github.com/${{ github.repository }}/releases/download/${TAG}/${TARBALL_NAME}"
+          echo "url=$DOWNLOAD_URL" >> $GITHUB_OUTPUT
+      - name: Comment on PR
+        uses: marocchino/sticky-pull-request-comment@v3
+        with:
+          header: tarball
+          message: |
+            ## Package Tarball
+
+            **[${{ steps.tarball.outputs.name }}](${{ steps.release.outputs.url }})**
+
+            ### How to install
+
+            ```bash
+            npm install ${{ steps.release.outputs.url }}
+            ```

.github/workflows/cleanup-pr-tarballs.yml

@@ -0,0 +1,30 @@
+name: Cleanup PR Tarballs
+
+on:
+  schedule:
+    # Run daily at midnight UTC
+    - cron: '0 0 * * *'
+  workflow_dispatch:
+
+permissions:
+  contents: write
+
+jobs:
+  cleanup:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v6
+      - name: Delete PR tarball releases older than 7 days
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          CUTOFF=$(date -u -d '7 days ago' +%Y-%m-%dT%H:%M:%SZ 2>/dev/null || date -u -v-7d +%Y-%m-%dT%H:%M:%SZ)
+
+          gh release list --limit 100 --json tagName,createdAt,isPrerelease \
+            --jq '.[] | select(.isPrerelease and (.tagName | startswith("pr-")) and (.tagName | endswith("-tarball")))' \
+          | jq -r --arg cutoff "$CUTOFF" 'select(.createdAt < $cutoff) | .tagName' \
+          | while read -r TAG; do
+              echo "Deleting old tarball release: $TAG"
+              gh release delete "$TAG" --yes --cleanup-tag 2>/dev/null || true
+            done