ci: add OIDC canary publish to release.yml via workflow_dispatch (#1352)

* ci: publish PR canaries via OIDC by folding them into release.yml

npm trusted publishing allows exactly one trusted publisher per package (one
repo + one workflow file), and checkly's slot is release.yml — which is why the
normal release publishes via OIDC + --provenance.

release-canary.yml was a separate workflow using a classic NODE_AUTH_TOKEN. That
token was retired when the package moved to OIDC, so a separate workflow could no
longer authenticate and the canary has failed on every PR since.

Fold the canary job into release.yml so it inherits the trusted publisher:
- add a `pull_request: [labeled]` trigger; the release-event jobs now gate on
  `github.event_name == 'release'` (PR events cascade-skip via needs: validate-tag).
- the canary job publishes 0.0.0-pr.<N>.<sha> with id-token + --provenance (no
  token), tagged `experimental` — or a `canary:<tag>` label's tag, applied at
  publish time (trusted publishing authenticates `npm publish`, not a separate
  `npm dist-tag add`).
- remove release-canary.yml.

* ci: name canary vs release runs distinctly in the Actions list

Add a run-name expression so PR-label canary runs render as
'Canary build - PR #<n> (<branch>)' and release-event runs as 'Release <tag>',
instead of the default commit-subject run name.

* ci: trigger canary via workflow_dispatch instead of a PR label

A pull_request:labeled trigger fired release.yml on every label on every PR
(jobs skipped, but the release workflow was still invoked). Drop it: the canary
is now a manual workflow_dispatch (`gh workflow run release.yml --ref <branch>`,
optional `-f tag=`), publishing 0.0.0-canary.<sha> via the same OIDC trusted
publisher. release.yml now triggers only on a real release or an explicit
dispatch — never on labels. The build-label mechanism / release-canary.yml are
gone.

Author: kiroushi

.github/workflows/release-canary.yml

@@ -1,9 +1,25 @@
 name: Publish Package to npmjs
+# Name each run for its trigger, so manual canary builds are distinguishable
+# from real releases in the Actions list.
+run-name: "${{ github.event_name == 'workflow_dispatch' && format('Canary build - {0}', github.ref_name) || format('Release {0}', github.event.release.tag_name) }}"
 on:
   release:
     types: [published]
+  # Manual canary builds: dispatch this workflow on a branch to publish an
+  # experimental build of that branch. It lives here (not a separate workflow) so
+  # it authenticates via the npm OIDC trusted publisher — npm allows only ONE
+  # trusted publisher (repo + workflow file) per package, and that slot is release.yml.
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: npm dist-tag for the canary build
+        required: false
+        default: experimental
 jobs:
   validate-tag:
+    # Release-event path only. A manual dispatch runs the `canary` job below; the
+    # other release jobs cascade-skip on dispatch via their `needs: validate-tag`.
+    if: ${{ github.event_name == 'release' }}
     runs-on: ubuntu-latest
     steps:
       - uses: actions-ecosystem/action-regex-match@v2
@@ -183,3 +199,42 @@ jobs:
           else
             echo "Skipping: $NEW_TAG is not newer than current latest $CURRENT_LATEST"
           fi
+
+  # Manual canary: dispatch this workflow on a branch to publish an experimental
+  # build of that branch. Authenticates via the SAME npm OIDC trusted publisher as
+  # the release jobs above (id-token + --provenance, no token). Trigger with
+  # `gh workflow run release.yml --ref <branch>` (optionally `-f tag=<dist-tag>`).
+  # Replaces the old build-label release-canary.yml, whose classic NPM_TOKEN was
+  # retired when the package moved to OIDC.
+  canary:
+    if: ${{ github.event_name == 'workflow_dispatch' }}
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+    steps:
+      - uses: actions/checkout@v3
+      - uses: pnpm/action-setup@v5
+        with:
+          version: 10
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '24.x'
+          cache: "pnpm"
+      # Ensure that the README is published with the package
+      - run: rm -f packages/cli/README.md && cp README.md packages/cli
+      - run: echo "CANARY_VERSION=0.0.0-canary.$(git rev-parse --short HEAD)" >> $GITHUB_ENV
+      - run: pnpm install --frozen-lockfile
+      - name: Set version, pack, and publish (OIDC trusted publishing)
+        run: |
+          pnpm version ${{ env.CANARY_VERSION }} --no-git-tag-version
+          pnpm pack
+          npm publish checkly-*.tgz --provenance --tag '${{ inputs.tag }}'
+        working-directory: packages/cli
+      - name: Publish summary
+        run: |
+          {
+            echo "Published \`checkly@${{ env.CANARY_VERSION }}\` (dist-tag: \`${{ inputs.tag }}\`)"
+            echo '```'
+            echo "npm install checkly@${{ env.CANARY_VERSION }}"
+            echo '```'
+          } >> "$GITHUB_STEP_SUMMARY"