fix(drift-sync): mechanical model-family sync (2026-08-07) #856
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Publish Preview | |
| on: | |
| pull_request: | |
| branches: [main] | |
| permissions: | |
| contents: read | |
| jobs: | |
| preview: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: { persist-credentials: false } | |
| - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10 | |
| - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 | |
| with: { node-version: 24, cache: pnpm } | |
| - run: pnpm install --frozen-lockfile | |
| - run: pnpm build | |
| # `pnpm exec`, NOT `npx`. This step used to be `npx pkg-pr-new publish`, | |
| # and `pkg-pr-new` was in neither package.json nor pnpm-lock.yaml — so npx | |
| # resolved the `latest` dist-tag at run time and executed whatever bytes | |
| # the registry served, with no integrity check of any kind. That is a | |
| # live arbitrary-code-execution seam on every PR: a malicious publish or a | |
| # registry/account compromise lands attacker code inside this job. It is | |
| # also the ONLY `npx` target in this repo that is not already a | |
| # devDependency (`tsx` and `vitest`, the others, resolve from the tree). | |
| # | |
| # `pkg-pr-new` is now an EXACT-pinned devDependency, so the | |
| # `pnpm install --frozen-lockfile` above has already verified its tarball | |
| # against the reviewed sha512 in pnpm-lock.yaml — substituted bytes fail | |
| # the install with ERR_PNPM_TARBALL_INTEGRITY and this step never runs. | |
| # `pnpm exec` then runs THOSE verified bytes out of node_modules and | |
| # fetches nothing. Do not reintroduce `npx` here. | |
| # | |
| # WHEN THIS FAILS: pkg-pr-new cut a new release and you want it. Bump the | |
| # exact version in package.json's devDependencies and regenerate the | |
| # lockfile (`pnpm install`) so a reviewed integrity hash lands in the | |
| # diff. Do not widen the specifier to a range to avoid that review. | |
| - run: pnpm exec pkg-pr-new publish |