ci(cli): publish pkg.pr.new previews on pull requests (#5427)

## Summary

Simplifies preview publishing to match the pkg.pr.new pull_request
model. The preview workflow now runs directly on non-draft PRs to
develop, builds the legacy release-shaped CLI artifacts, publishes all
platform wrapper packages plus apps/cli to pkg.pr.new with comments
disabled, and logs/verifies the PR-scoped npx command.

This removes the workflow_run dependency on Test, the same-repo-only
fork guard, and the custom github-actions PR comment. Fork PRs can now
get previews through GitHub's normal fork workflow approval model
without granting issue/comment write permissions to the preview
workflow.

Author: jgoux

.github/workflows/publish-preview-cli-packages.yml

@@ -1,142 +1,44 @@
 name: Publish Preview CLI Packages
 
 on:
-  workflow_run:
-    workflows:
-      - Test
+  pull_request:
     types:
-      - completed
+      - opened
+      - synchronize
+      - reopened
+      - ready_for_review
+    branches:
+      - develop
 
 permissions:
   actions: read
   contents: read
-  pull-requests: read
 
 concurrency:
-  group: ${{ github.workflow }}-${{ github.event.workflow_run.head_sha || github.run_id }}
+  group: ${{ github.workflow }}-${{ github.head_ref }}
   cancel-in-progress: true
 
 jobs:
-  resolve:
-    if: >-
-      github.event.workflow_run.event == 'pull_request' &&
-      github.event.workflow_run.conclusion == 'success'
-    name: Resolve preview build context
-    runs-on: ubuntu-latest
-    env:
-      GH_TOKEN: ${{ github.token }}
-      REPOSITORY: ${{ github.repository }}
-    outputs:
-      should_build: ${{ steps.context.outputs.should_build }}
-      pr_number: ${{ steps.context.outputs.pr_number }}
-      pr_head_sha: ${{ steps.context.outputs.pr_head_sha }}
-      preview_version: ${{ steps.context.outputs.preview_version }}
-    steps:
-      - name: Resolve PR context
-        id: context
-        run: |
-          set -euo pipefail
-
-          should_build=false
-          pr_number="$(jq -r '.workflow_run.pull_requests[0].number // ""' "$GITHUB_EVENT_PATH")"
-          pr_head_sha="$(jq -r '.workflow_run.head_sha // ""' "$GITHUB_EVENT_PATH")"
-          pr_head_branch="$(jq -r '.workflow_run.head_branch // ""' "$GITHUB_EVENT_PATH")"
-
-          if [[ -z "${pr_head_sha}" ]]; then
-            echo "Workflow run has no head SHA; skipping."
-            echo "should_build=false" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-
-          if [[ -z "${pr_number}" && -n "${pr_head_branch}" ]]; then
-            pr_number="$(
-              gh pr list \
-                --repo "${REPOSITORY}" \
-                --head "${pr_head_branch}" \
-                --state open \
-                --json number,headRefOid \
-                --jq 'map(select(.headRefOid == "'"${pr_head_sha}"'")) | .[0].number // ""'
-            )"
-          fi
-
-          if [[ -z "${pr_number}" ]]; then
-            echo "Test run is not associated with an open pull request; skipping."
-            echo "should_build=false" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-
-          pr_json="$(gh api "repos/${REPOSITORY}/pulls/${pr_number}")"
-          current_head_sha="$(jq -r '.head.sha' <<< "${pr_json}")"
-          state="$(jq -r '.state' <<< "${pr_json}")"
-          draft="$(jq -r '.draft' <<< "${pr_json}")"
-          head_repo="$(jq -r '.head.repo.full_name' <<< "${pr_json}")"
-          base_repo="$(jq -r '.base.repo.full_name' <<< "${pr_json}")"
-
-          if [[ "${state}" != "open" ]]; then
-            echo "PR #${pr_number} is ${state}; skipping."
-            echo "should_build=false" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-
-          if [[ "${draft}" == "true" ]]; then
-            echo "PR #${pr_number} is draft; skipping."
-            echo "should_build=false" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-
-          if [[ "${head_repo}" != "${base_repo}" ]]; then
-            echo "PR #${pr_number} comes from fork ${head_repo}; skipping."
-            echo "should_build=false" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-
-          if [[ "${pr_head_sha}" != "${current_head_sha}" ]]; then
-            echo "Test SHA ${pr_head_sha} is stale; current PR head is ${current_head_sha}. Skipping."
-            echo "should_build=false" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-
-          preview_version="0.0.0-pr.${pr_number}"
-          should_build=true
-
-          {
-            echo "should_build=${should_build}"
-            echo "pr_number=${pr_number}"
-            echo "pr_head_sha=${pr_head_sha}"
-            echo "preview_version=${preview_version}"
-          } >> "$GITHUB_OUTPUT"
-
   build:
-    needs: resolve
-    if: needs.resolve.outputs.should_build == 'true'
+    if: github.event.pull_request.draft == false
     name: Build preview CLI packages
     uses: ./.github/workflows/build-cli-artifacts.yml
     with:
-      version: ${{ needs.resolve.outputs.preview_version }}
+      version: 0.0.0-pr.${{ github.event.pull_request.number }}
       shell: legacy
-      ref: ${{ needs.resolve.outputs.pr_head_sha }}
 
   publish:
-    needs: [resolve, build]
-    if: needs.resolve.outputs.should_build == 'true' && needs.build.result == 'success'
+    needs: build
+    if: github.event.pull_request.draft == false && needs.build.result == 'success'
     name: Publish preview package
     runs-on: ubuntu-latest
-    permissions:
-      actions: read
-      contents: read
-      issues: write
-      pull-requests: read
     env:
-      GH_TOKEN: ${{ github.token }}
-      PREVIEW_VERSION: ${{ needs.resolve.outputs.preview_version }}
-      PR_HEAD_SHA: ${{ needs.resolve.outputs.pr_head_sha }}
-      PR_NUMBER: ${{ needs.resolve.outputs.pr_number }}
-      REPOSITORY: ${{ github.repository }}
+      PREVIEW_VERSION: 0.0.0-pr.${{ github.event.pull_request.number }}
+      PR_NUMBER: ${{ github.event.pull_request.number }}
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
-          ref: ${{ needs.resolve.outputs.pr_head_sha }}
           persist-credentials: false
 
       - name: Setup
@@ -145,7 +47,7 @@ jobs:
       - name: Download preview build artifacts
         uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
         with:
-          name: cli-build-legacy-${{ needs.resolve.outputs.preview_version }}
+          name: cli-build-legacy-${{ env.PREVIEW_VERSION }}
 
       - name: Prepare package files
         run: |
@@ -176,39 +78,5 @@ jobs:
         run: |
           set -euo pipefail
           preview_url="https://pkg.pr.new/supabase@${PR_NUMBER}"
+          echo "Preview command: npx ${preview_url}"
           npx --yes "${preview_url}" --version
-
-      - name: Update PR comment
-        run: |
-          set -euo pipefail
-          preview_url="https://pkg.pr.new/supabase@${PR_NUMBER}"
-          short_sha="${PR_HEAD_SHA:0:7}"
-          marker="<!-- pkg-pr-new-preview -->"
-          cat > comment.md <<EOF
-          ${marker}
-          ## pkg.pr.new preview
-
-          Published version \`${PREVIEW_VERSION}\` from commit [\`${short_sha}\`](https://github.com/${REPOSITORY}/commit/${PR_HEAD_SHA}) after tests passed.
-
-          \`\`\`sh
-          npx ${preview_url}
-          \`\`\`
-
-          \`\`\`sh
-          npx ${preview_url} --version
-          \`\`\`
-          EOF
-
-          jq -n --rawfile body comment.md '{ body: $body }' > comment.json
-          comment_id="$(
-            gh api "repos/${REPOSITORY}/issues/${PR_NUMBER}/comments" \
-              --paginate \
-              --jq '.[] | select(.body | contains("'"${marker}"'")) | .id' \
-              | head -n1
-          )"
-
-          if [[ -n "${comment_id}" ]]; then
-            gh api --method PATCH "repos/${REPOSITORY}/issues/comments/${comment_id}" --input comment.json >/dev/null
-          else
-            gh api --method POST "repos/${REPOSITORY}/issues/${PR_NUMBER}/comments" --input comment.json >/dev/null
-          fi