Package previews
Give reviewers installable pkg.pr.new builds without weakening the release path.
Use pkg.pr.new for disposable package previews. A preview is not a release and
must not change an npm dist-tag.
Preview every public package
The preview workflow lists every independently consumed package. A monorepo must not preview only its primary package.
Build the exact pull request commit. Publish commit-addressed preview URLs. Record returned URLs and hashes in a short-lived preview manifest.
Do not trust forks
Run automatic previews only for branches inside the lupinum-dev
organization. Do not execute arbitrary fork code with a credential or a
repository-write token.
Check out the exact pull request SHA with persist-credentials: false. Give the
workflow read-only repository permission. A preview must not share the npm
publication environment.
Review the consumer path
Install the preview in a temporary consumer when the package boundary changed. Test the documented import, Nuxt module registration, generated types, server behavior, and browser behavior that the change affects.