Jordan Ritter 25299bc390 fix(ci): separate build from publish to isolate NPM_TOKEN ...

Remove pnpm run build (and pnpm run test) calls from publish-release.ts
and prerelease.ts so that repository build code never executes with
NPM_TOKEN in the environment. The CI build job (contents: read, no
secrets) now handles all building and testing, uploading pre-built
artifacts for the publish job to consume.

For prerelease: extract version bumping into a new bump-prerelease.ts
script that runs in the build job before the build step, ensuring the
built artifacts contain the correct canary version numbers.

Also fix prerelease build job to use persist-credentials: false,
matching the publish-release build job pattern.

2026-05-15 09:13:36 -07:00

1.8 KiB

Raw Permalink Blame History

View Raw