feat: add NPM preview release workflow and fix CI permissions (pnpm)

[paulbalaji]

Summary

• Add NPM preview release workflow for publishing snapshot/preview releases (using pnpm)
• Add changeset snapshot configuration
• Fix CI permissions issue where workflows wouldn't trigger on changesets/release PRs (both NPM and Rust)
• Add title override to changesets action so PRs pass PR title lint

Note: This PR is based on the pbio-cursor/investigate-pnpm-package-manager-migration-2193 branch (pnpm migration). There is a parallel PR for the main branch (yarn): #7468

NPM Preview Release Workflow

New workflow that allows publishing preview releases to NPM:

• Trigger: Manual dispatch (workflow_dispatch) from GitHub Actions UI
• Dist-tags: beta, alpha, rc, preview
• Version format: {baseVersion}-{tag}.{gitSha} (e.g., 19.10.0-beta.abc1234)
• Branch policy: Can be triggered from any branch
• Output: Creates GitHub pre-release with installation instructions
• Package Manager: pnpm (vs yarn in the main branch PR)

Usage

1. Go to Actions → "NPM Preview Release"
2. Click "Run workflow"
3. Select the branch and dist-tag
4. The workflow will:
   • Create snapshot versions using changesets
   • Build all packages
   • Publish to NPM with the selected dist-tag
   • Create a GitHub pre-release

Installation

After running, users can install preview packages:

npm install @hyperlane-xyz/sdk@beta
npm install @hyperlane-xyz/cli@beta

CI Permissions Fix

Both NPM and Rust release workflows now use a GitHub App token instead of GITHUB_TOKEN. This fixes the issue where merging/pushing release PRs wouldn't trigger other CI workflows.

Setup Required

1. Create a GitHub App with:

   • Name: hyperlane-release-bot (or similar)
   • Permissions:
     • Contents: Read & Write
     • Pull requests: Read & Write

2. Install the app on this repository

3. Add these repository secrets:

   • HYPERLANE_GITHUB_APP_ID: The App ID from the app's settings
   • HYPERLANE_GITHUB_APP_PRIVATE_KEY: Generate and download a private key

Test plan

• Verify NPM preview release workflow appears in Actions tab
• Create GitHub App and add secrets
• Test preview release workflow on a non-main branch
• Verify the generated GitHub release has correct installation instructions
• Verify changesets PR creation still works
• Verify Rust release PR creation still works
• Verify CI triggers when changesets/release PRs are pushed

🤖 Generated with Claude Code

[changeset-bot]

⚠️ No Changeset found

Latest commit: 9cd5772

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR