ci: split publish workflow into test and publish jobs with branch triggers

The workflow now runs on both push to main and pull requests targeting main, in addition to version tags. The single `publish` job has been split into separate `test` and `publish` jobs, where `publish` depends on `test` and only runs when a version tag is pushed. Action versions have been updated: `actions/checkout` from v6 to v7 and `pnpm/action-setup` from v4 to v6.

Author: myshkouski

.github/workflows/publish.yml

@@ -2,25 +2,27 @@ name: Test and publish package
 
 on:
   push:
+    branches: [main]
     tags:
       - "v*"
+  pull_request:
+    branches: [main]
 
 permissions:
   id-token: write # Required for OIDC
   contents: write # for semantic-versioning
 
 jobs:
-  publish:
+  test:
     runs-on: ubuntu-latest
-
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@v4
+        uses: pnpm/action-setup@v6
 
       - name: Setup Node.js
         uses: actions/setup-node@v6
@@ -44,6 +46,30 @@ jobs:
       - name: Run tests
         run: pnpm test
 
+  publish:
+    runs-on: ubuntu-latest
+    needs: test
+    if: startsWith(github.ref, 'refs/tags/v')
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v6
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version: lts/*
+          registry-url: https://registry.npmjs.org
+          cache: pnpm
+
+      - name: Install dependencies
+        run: pnpm install
+
       - name: Build module
         run: pnpm -w prepack