From c147f13c7121ab95f4f4cd2701c3f2efd948d16d Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Sun, 15 Mar 2026 23:25:29 +0000
Subject: [PATCH] Add pkg.pr.new CI workflow for preview releases on approved
 PRs

Publishes preview packages via pkg.pr.new when a PR receives approval
from a maintainer with write access. Uses the approved commit SHA
(not latest head) to prevent publishing unreviewed code pushed after
approval.

https://claude.ai/code/session_01MNWxC63A6cHavrFFvjDTCq
---
 .github/workflows/preview.yml | 40 +++++++++++++++++++++++++++++++++++
 1 file changed, 40 insertions(+)
 create mode 100644 .github/workflows/preview.yml

diff --git a/.github/workflows/preview.yml b/.github/workflows/preview.yml
new file mode 100644
index 0000000..134494f
--- /dev/null
+++ b/.github/workflows/preview.yml
@@ -0,0 +1,40 @@
+name: Publish Preview Packages
+
+on:
+  pull_request_review:
+    types: [submitted]
+
+permissions: {}
+
+jobs:
+  check:
+    if: github.event.review.state == 'approved'
+    runs-on: ubuntu-latest
+    outputs:
+      has-permissions: ${{ steps.checkPermissions.outputs.require-result }}
+    steps:
+      - name: Check permissions
+        id: checkPermissions
+        uses: actions-cool/check-user-permission@v2
+        with:
+          require: "write"
+
+  publish:
+    needs: check
+    if: needs.check.outputs.has-permissions == 'true'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          # Check out the reviewed commit, not the latest PR head, to prevent
+          # publishing code that was pushed after approval.
+          ref: ${{ github.event.pull_request.head.sha }}
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "20.x"
+
+      - run: npm ci
+      - run: npx vite build
+      - run: npx pkg-pr-new publish