ci: add pkg.pr.new previews

[kermanx]

Related Issue

No linked issue. This PR addresses the need for pull-request preview packages for the Kimi Code CLI without touching the existing npm release workflow.

Problem

Reviewers and downstream testers currently need to wait for the normal release flow before trying a built @moonshot-ai/kimi-code package from an unmerged PR. We want a preview package path that is isolated from npm publishing and scoped only to the CLI package.

What changed

• Added a dedicated pkg.pr.new GitHub Actions workflow for non-draft pull requests.
• Scoped preview publishing to apps/kimi-code only.
• Reused the release-style built-in catalog generation before building the CLI so preview artifacts match the expected package shape more closely.
• Added pkg-pr-new as a locked root dev dependency so CI executes it from the lockfile, as recommended by pkg.pr.new.
• Kept the existing release.yml and npm Trusted Publishing path unchanged.

Local validation performed:

• pnpm install --frozen-lockfile
• workflow YAML parse check
• git diff --check
• pnpm run build:packages
• node apps/kimi-code/scripts/update-catalog.mjs --out /tmp/kimi-code-pkg-pr-new-catalog.json
• KIMI_CODE_BUILT_IN_CATALOG_FILE=/tmp/kimi-code-pkg-pr-new-catalog.json pnpm --filter @moonshot-ai/kimi-code run build
• npm pack --json --pack-destination ... ./apps/kimi-code
• local mocked pkg-pr-new publish run that verified /check, package URL probing, /publish, and GitHub Actions outputs without sending anything to the real pkg.pr.new service

Checklist

• I have read the CONTRIBUTING document.
• I have linked a related issue, or explained the problem above.
• This is a CI-only change; package behavior tests are not applicable, and local workflow/package validation is listed above.
• Ran gen-changesets skill, or this PR needs no changeset.
• Ran gen-docs skill, or this PR needs no doc update.

如何配置

1. 在 GitHub 仓库安装 pkg.pr.new GitHub App：打开 https://github.com/apps/pkg-pr-new，选择 MoonshotAI/kimi-code 仓库并授权。
2. 不需要配置 npm token，也不需要改 npm Trusted Publishing；这个 workflow 只上传到 pkg.pr.new，不发布到 npm。
3. PR 变为非 draft 后，.github/workflows/pkg-pr-new.yml 会自动构建并发布 apps/kimi-code 的预览包。
4. pkg.pr.new 会在 PR 中更新评论，提供基于 commit SHA 的预览链接；因为使用了 --bin，评论里会展示适合 CLI 包的执行方式。
5. 如需临时禁用预览发布，可以把 PR 标记为 draft，或暂停/移除 pkg.pr.new workflow。

[changeset-bot]

⚠️ No Changeset found

Latest commit: 77ca13b

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 77ec1a7deb

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".