* feat: publish preview packages to pkg.earendil.com
CI packs every public package after the build, with internal dependencies
pointing at the same commit's builds. A workflow_run job publishes them to
the earendil-pkg worker with the job's GitHub OIDC token, moves main or
pr-<n>, and comments install commands on the PR. Closing a PR deletes its
ref. pi-env is left out because its daemons are only built for releases.
* feat: publish preview packages only for main and same-repo PRs
pkg.earendil.com requires a consumer token, so fork authors could not
install their previews anyway. Fork PRs are no longer packed or
published, which keeps fork code out of the registry and removes the PR
lookup: the PR number now comes from the workflow_run event. The PR
comment is dropped; the job summary lists the install commands.
* fix: pick the PR into main and describe only the workflow in preview-packages.yml
- Read the PR number from the workflow_run pull request list with jq,
selecting the PR into main; a branch can also have PRs into other
branches, and the index expression tripped workflow linters.
- Comments describe what the workflow does and what it needs from
pkg.earendil.com, not how the service works.
* fix: gate preview publishing to main pushes and open PRs into main
- Publish only CI runs for pushes to main and for pull requests. A branch
can make its own copy of CI run on push; those runs are unreviewed and
were uploaded as push builds.
- Move pr-<number> only while the PR is open into main with this commit
as its head, checked live, so a late publish cannot recreate the ref of
a closed PR; otherwise publish without a ref and print a notice.
- Set concurrency per job, so skipped fork runs never wait in a group.
* docs: drop the service rule from the preview-packages.yml header
* docs: name the earendil-works/pkg worker in the preview script