[Mrtenz]

Explanation

NPM rejects trusted publishing tokens from issue_comment events, as it already does for pull_request_target. The OIDC variant (publish-preview-oidc.yml) therefore can't publish when a comment triggers it. Publishing needs a permitted event such as workflow_dispatch, and the workflows currently read the pull request number from github.event.issue.number, which doesn't exist there.

This adds a pull-request input. It is optional in publish-preview-oidc.yml, so a workflow_dispatch caller can pass the number as an input. In prepare-preview.yml it falls back to github.event.issue.number, so publish-preview.yml keeps working unchanged for issue_comment callers.

It also adds a branch input for publishing a preview without a pull request. Exactly one of pull-request and branch is required, and prepare-preview.yml fails early otherwise. The branch name is validated with git check-ref-format, resolved to a commit once, and that commit is checked out, so a push during the run can't change what gets built. Only branches in this repository are accepted. Other refs, such as refs/pull/N/head or raw SHAs, could point at fork code and bypass the fork check.

The preview build message is now always appended to $GITHUB_STEP_SUMMARY, and the pull request comment is only posted when pull-request is set. That gives branch runs somewhere to show the output.

---

Note

Medium Risk
Changes CI checkout and fork-gating behavior for preview builds, including branch-only paths that bypass fork checks by design.

Overview
OIDC preview publishing can now be triggered via workflow_dispatch (or similar) by passing either a pull-request number or a repo branch, instead of relying on github.event.issue.number from comment-triggered events.

prepare-preview.yml gains optional pull-request and branch inputs with mutual-exclusion validation (and branch name checks). Branch runs resolve the tip commit once with git ls-remote and check out that SHA detached so mid-run pushes don’t change the build; fork checks are skipped for branch-only runs. The build job no longer waits on comment reactions, and the 👍 reaction step only runs when a comment triggered the workflow.

publish-preview-oidc.yml forwards the new inputs, always writes the preview package list to the job summary, and posts a PR comment only when pull-request is set. Existing issue_comment callers can keep omitting pull-request and still use github.event.issue.number via the fallback.

^{Reviewed by Cursor Bugbot for commit 8d2d060. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 8d2d060. Configure here.}

[mcmire]

LGTM!