bomb.sh / automation
[READ-ONLY] Mirror of https://github.com/bombshell-dev/automation. GitHub Actions for the Bombshell organization
ci
0
Fork 0

Configure Feed

Select the types of activity you want to include in your feed.

Preview Hardened Permissions And Always `pnpm` (#27)

## What does this PR do?

Working through setting up a repo and ran into these two issues.

- We don't need `write` permissions for publishing a preview package.
- Also we can always use `pnpm pack` as that is the default expectation.
Using `npm` may trigger `devEngines` checks as set in the template.

## Type of change

<!-- Check one. -->

- [x] Bug fix
- [ ] Feature
- [ ] Refactor (no behavior change)
- [ ] Documentation
- [ ] Performance improvement
- [ ] Tests
- [x] Chore (dependencies, CI, tooling)

## Checklist

- [x] All tests pass (`pnpm test`)
- [x] Files are formatted (`pnpm format`)
- [x] I have added/updated tests for my changes (if applicable)
- [ ] I have added a changeset

## AI-generated code disclosure

<!-- If any part of this PR was generated by AI tools (Copilot, Claude,
GPT, Cursor, etc.), check the box. This is fine — we just need to know
so reviewers can pay extra attention to edge cases. -->

- [ ] This PR includes AI-generated code

authored by

Jacob Bolda and committed by
GitHub (Jun 16, 2026, 11:48 PM EDT) 302134a1 7840cf3e

+1 -7
+1 -7
.github/workflows/preview.yml
··· 13 13 required: false 14 14 type: string 15 15 16 - permissions: {} 17 - 18 16 jobs: 19 17 preview: 20 18 if: github.repository_owner == 'bombshell-dev' 21 19 runs-on: ubuntu-latest 22 - permissions: 23 - contents: write 24 - pull-requests: write 25 - id-token: write 26 20 27 21 steps: 28 22 - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 ··· 47 41 env: 48 42 TEMPLATE_GLOB: ${{ inputs.template }} 49 43 PUBLISH_GLOB: ${{ inputs.publish }} 50 - run: pnpx pkg-pr-new publish "$PUBLISH_GLOB" --template "$TEMPLATE_GLOB" 44 + run: pnpx pkg-pr-new publish --pnpm "$PUBLISH_GLOB" --template "$TEMPLATE_GLOB"