preview.yml

name: Preview

# Publishes throwaway preview packages for each PR via pkg.pr.new, installable
# from its CDN (e.g. `npm i https://pkg.pr.new/@zerodev/wallet-react@<sha>`).
#
# SECURITY (public repo): uses `pull_request` — NOT `pull_request_target` — and
# NO secrets. Fork PRs run with a read-only token and cannot access anything
# sensitive. pkg.pr.new publishes to its own CDN (never npm) using the Actions
# OIDC identity; its GitHub App posts the PR comment. No NPM_TOKEN is involved.

on:
  pull_request:
    branches: [main]

permissions:
  contents: read

concurrency:
  group: preview-${{ github.event.pull_request.number }}
  cancel-in-progress: true

jobs:
  preview:
    name: Publish preview packages
    runs-on: ubuntu-latest
    # Previews are advisory — a hiccup (or the pkg.pr.new app not yet installed)
    # must never block a PR from merging.
    continue-on-error: true
    steps:
      - name: Checkout
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1

      - name: Setup pnpm
        uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.3.0

      - name: Setup Node.js
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version: 20
          cache: pnpm

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Build packages
        run: pnpm build

      # Only the four publishable packages (skips react-kit / native-kit / apps).
      - name: Publish previews
        run: >
          pnpm dlx pkg-pr-new publish --pnpm
          './packages/core'
          './packages/react'
          './packages/react-ui'
          './packages/wallet-react-ui'