Alternative preview release flow

[emmatown]

Example run: https://github.com/emmatown/changesets-action/actions/runs/25488677177

Note I've done this from a fork of this repo, not on changesets/action itself, this is partly because GitHub won't let you trigger the workflow dispatch unless the workflow exists on main and partly to demonstrate how it works on a fork.

[changeset-bot]

⚠️ No Changeset found

Latest commit: cedecbb

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[Andarist]

With this approach - I wouldnt be able to trigger the preview release on a fork, right?

[Andarist]

nit, the "base" workflow is caled publish - perhaps we should rename this one to match the base one more closely?

[Andarist]

git stores branches as directories, perhaps we should use a pattern like this:

Suggested change

	const releaseLine = `built-${process.env.GITHUB_REF_NAME}`;
	const releaseLine = `built-pr/${process.env.GITHUB_REF_NAME}`;

this way they would be "grouped"

[Andarist]

how strong guarantees do we have here when it comes to what commit gets actually built and released? a workflow could get queued and also retried later - I feel this might be risky-ish because, I'd assume, it might run against the "current" version of a branch

a security researcher emailed me with a description of an atack like this:

1. the maintainer schedules a job on a PR
2. the attacker polls the github API against the triggering action (like a PR comment, or maybe a new workflow run)
3. the attacker quickly pushes malicious stuff to that PR

It feels like this workflow would be prone to this attack. I know none of those preview builds can truly be trusted - but we should minimize the risks when we can.