ci: configure pre-release workflow via pkg.pr.new

[serhalp]

Summary

In preparation for enabling/requiring Trusted Publishing and revoking folks' ability to publish manually, this configures pkg.pr.new to craete pre-releases automatically on all PRs.

[coderabbitai]

📝 Walkthrough

Summary by CodeRabbit

• New Features

  • Pull requests and pushes to main now automatically publish installable prerelease packages.
  • Workflow runs provide the generated package version and installation details.

• Documentation

  • Updated prerelease instructions to explain the automated publishing process and how to access generated packages.

Walkthrough

The prerelease workflow now runs for pushes to main and selected pull request events. It uses read-only contents access, pinned actions, ubuntu-slim, and non-persistent checkout credentials. The workflow removes release tagging, versioning, Git push, and authenticated npm publishing. It adds pkg-pr-new and uses pkg-pr-new publish. Contribution instructions now describe the automated prerelease process.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Suggested reviewers: eduardoboucas

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main change: configuring the pre-release workflow to use pkg.pr.new.
Description check	✅ Passed	The description explains that pkg.pr.new will create prereleases automatically for pull requests, which matches the changeset.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch serhalp/ci/pkg-pr-new

---

_{Comment @coderabbitai help to get the list of available commands.}

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/netlify-cli@8392

commit: dc5cc2d

[github-actions]

📊 Benchmark results

Comparing with 05db4ef

• Dependency count: 1,165 (no change)
• Package size: 455 MB ⬆️ 0.00% increase vs. 05db4ef
• Number of ts-expect-error directives: 346 (no change)

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@CONTRIBUTING.md`:
- Around line 208-209: Update the documentation text describing automatically
published installable prereleases to use the linter-approved spelling
“pre-releases,” while leaving the surrounding pkg.pr.new workflow instructions
unchanged.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: ee51ab12-528c-47d8-88a9-3329ee2289af

📥 Commits

Reviewing files that changed from the base of the PR and between 05db4ef and dc5cc2d.

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (3)

• .github/workflows/pre-release.yml
• CONTRIBUTING.md
• package.json

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• netlify/blueprints (manual)

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: dc5cc2d3e0

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Add previewVersion to prerelease publishes

Because this replaces the old flow that ran npm version <version>-<tag> before publishing, invoking pkg-pr-new publish without --previewVersion packs previews with the unchanged source version from package.json (currently 27.1.0). When someone installs a PR/main preview into a project, the lockfile and netlify --version/telemetry identify it as the real release version, and lockfiles can keep resolving that same-version preview tarball even after the actual npm release; pass --previewVersion so each preview gets a distinct preview version.

Useful? React with 👍 / 👎.