feat: add reusable publish-preview workflow

.github/actions/prepare-preview-builds/action.yml

@@ -0,0 +1,56 @@
+name: Prepare Preview Builds
+
+description: >
+  Renames workspace packages to a preview NPM scope and adds a prerelease
+  version tag so they can be published as preview builds.
+
+inputs:
+  npm-scope:
+    description: 'Target NPM scope for preview packages (e.g., @metamask-previews)'
+    required: true
+  commit-hash:
+    description: 'Short commit hash used as the prerelease version tag'
+    required: true
+  source-scope:
+    description: 'Source NPM scope to replace (e.g., @metamask/)'
+    required: false
+    default: '@metamask/'
+  working-directory:
+    description: 'Path to the monorepo root'
+    required: false
+    default: '.'
+  github-tools-repository:
+    description: 'The GitHub repository containing the GitHub tools. Defaults to the GitHub tools action repository, and usually does not need to be changed.'
+    required: false
+    default: ${{ github.action_repository }}
+  github-tools-ref:
+    description: 'The SHA of the action to use. Defaults to the current action ref, and usually does not need to be changed.'
+    required: false
+    default: ${{ github.action_ref }}
+
+runs:
+  using: composite
+  steps:
+    - name: Validate inputs
+      shell: bash
+      run: |
+        if [[ -z "${{ inputs.npm-scope }}" ]]; then
+          echo "::error::npm-scope input is required"
+          exit 1
+        fi
+        if [[ -z "${{ inputs.commit-hash }}" ]]; then
+          echo "::error::commit-hash input is required"
+          exit 1
+        fi
+
+    - name: Checkout GitHub tools repository
+      uses: actions/checkout@v6
+      with:
+        repository: ${{ inputs.github-tools-repository }}
+        ref: ${{ inputs.github-tools-ref }}
+        path: ./.github-tools
+
+    - name: Prepare preview builds
+      shell: bash
+      working-directory: ${{ inputs.working-directory }}
+      run: bash "$GITHUB_WORKSPACE/.github-tools/.github/scripts/prepare-preview-builds.sh" "${{ inputs.npm-scope }}" "${{ inputs.commit-hash }}" "${{ inputs.source-scope }}"

.github/scripts/prepare-preview-builds.sh

@@ -0,0 +1,58 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+# This script prepares workspace packages to be published as preview builds.
+# It renames packages to a preview NPM scope, sets prerelease versions, and
+# reinstalls dependencies so that internal references resolve correctly.
+#
+# Usage: prepare-preview-builds.sh <npm_scope> <commit_hash> [source_scope]
+#   npm_scope    - Target NPM scope (e.g., @metamask-previews)
+#   commit_hash  - Short commit hash for the prerelease tag
+#   source_scope - Source scope to replace (default: @metamask/)
+
+if [[ $# -lt 2 ]]; then
+  echo "::error::Usage: prepare-preview-builds.sh <npm_scope> <commit_hash> [source_scope]"
+  exit 1
+fi
+
+npm_scope="$1"
+commit_hash="$2"
+source_scope="${3:-@metamask/}"
+
+prepare-preview-manifest() {
+  local manifest_file="$1"
+
+  # Inline jq filter: rename scope and set prerelease version.
+  # jq does not support in-place modification, so a temporary file is used.
+  jq --raw-output \
+    --arg npm_scope "$npm_scope" \
+    --arg hash "$commit_hash" \
+    --arg source_scope "$source_scope" \
+    '
+      .name |= sub($source_scope; "\($npm_scope)/") |
+      .version |= (split("-")[0] + "-preview-\($hash)")
+    ' \
+    "$manifest_file" > temp.json
+  mv temp.json "$manifest_file"
+}
+
+# Add resolutions to the root manifest so that imports under the source scope
+# continue to resolve from the local workspace after packages are renamed to
+# the preview scope. Without this, yarn resolves them from the npm registry,
+# which causes build failures when workspace packages contain changes not yet
+# published.
+echo "Adding workspace resolutions to root manifest..."
+resolutions="$(yarn workspaces list --no-private --json \
+  | jq --slurp 'reduce .[] as $pkg ({}; .[$pkg.name] = "portal:./" + $pkg.location)')"
+jq --argjson resolutions "$resolutions" '.resolutions = ((.resolutions // {}) + $resolutions)' package.json > temp.json
+mv temp.json package.json
+
+echo "Preparing manifests..."
+while IFS=$'\t' read -r location name; do
+  echo "- $name"
+  prepare-preview-manifest "$location/package.json"
+done < <(yarn workspaces list --no-private --json | jq --slurp --raw-output 'map([.location, .name]) | map(@tsv) | .[]')
+
+echo "Installing dependencies..."
+yarn install --no-immutable