fix(ci): publish the try-bindgen preview from the PR's branch, not the reset worktree

[jagguji]

Follow-up to #135. publish_preview=true would have published a preview containing the old bindings.

The bug

The publish step ran immediately after peter-evans/create-pull-request:

- uses: peter-evans/create-pull-request@v8   # commits regenerated src/ to its own branch, pushes,
                                             # then RESTORES the local repo to its pre-action state
- name: Publish preview to pkg.pr.new
  run: npx pkg-pr-new publish                # ...so this packs the BASE bindings

The action leaves the working tree back at the base state, so the published tarball would carry the pre-regeneration src/ while the draft PR right next to it showed the new one. You'd install the link, see no change, and have no signal why — the same "looks convincing, is wrong" class the fingerprint step was added to eliminate.

The fix

Fetch and check out the PR's branch before publishing:

env:
  BRANCH: ${{ steps.slug.outputs.branch }}
run: |
  git fetch origin "$BRANCH"
  git checkout "$BRANCH"
  echo "Publishing from $BRANCH @ $(git rev-parse --short HEAD)"
  npx pkg-pr-new publish

This also pins the pkg.pr.new URL to a commit that actually contains the content, rather than to the dispatched ref's SHA — so the preview's provenance is checkable, which is the whole point of the workflow.

node_modules is gitignored and survives the checkout, so no reinstall is needed.

Also

The full branch name is now emitted once as a step output and consumed by both the PR step and the publish step. It was previously written out twice as the same inline expression — two chances to drift, and a drifted publish step would git fetch a branch that doesn't exist.

Why it wasn't caught before merge

The publish path can only be exercised on Actions. Everything testable locally was tested — YAML parse, step-reference resolution, the slugify sed against all three input forms, the bucket-delta script against this repo's real _bindgen-summary.json, and the fingerprint snippet against an actually-installed pkg.pr.new build. #135 said as much: "Not exercised end-to-end on Actions — that needs it on the default branch first." This is that gap closing.

Still not end-to-end verified — publish_preview needs a real run with the input on. The non-publish path (the diff PR, which is the main use) is unaffected either way.

🤖 Generated with Claude Code