Harden split release jobs

Amp-Thread-ID: https://ampcode.com/threads/T-019ff2c4-30ca-7606-baa0-76f1e3839800

Author: ampagent

.github/workflows/release.yaml

@@ -5,6 +5,8 @@ on:
     branches:
       - main
 
+permissions: {}
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
 
@@ -14,11 +16,14 @@ jobs:
     name: Select Changesets Mode
     outputs:
       mode: ${{ steps.select-mode.outputs.mode }}
+      publish-plan-artifact-id: ${{ steps.select-mode.outputs.publish-plan-artifact-id }}
     runs-on: ubuntu-latest
     permissions:
       contents: read
     steps:
       - uses: $/.github/actions/setup
+        with:
+          cache: false
 
       - name: Select Changesets Mode
         id: select-mode
@@ -50,16 +55,40 @@ jobs:
         with:
           github-token: ${{ steps.create_token.outputs.token }}
 
-  publish:
+  pack:
     if: needs.select-mode.outputs.mode == 'publish'
-    name: Publish Packages
+    name: Pack Packages
     needs: select-mode
+    outputs:
+      pack-dir-artifact-id: ${{ steps.pack.outputs.pack-dir-artifact-id }}
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: $/.github/actions/setup
+        with:
+          cache: false
+
+      - name: Build Packages
+        run: pnpm build
+
+      - name: Pack Packages
+        id: pack
+        uses: changesets/action/pack@22ccf9aa43179fe9e27dc62e575971d28cce197c # v2.0.0
+        with:
+          publish-plan-artifact-id: ${{ needs.select-mode.outputs.publish-plan-artifact-id }}
+
+  publish:
+    name: Publish Packages
+    needs: pack
     runs-on: ubuntu-latest
     permissions:
       contents: read
       id-token: write
     steps:
       - uses: $/.github/actions/setup
+        with:
+          cache: false
 
       - name: Create Token
         id: create_token
@@ -73,4 +102,4 @@ jobs:
         uses: changesets/action/publish@198f833dd7d863100ea6e28967bc9a9fdefadb0a # v2.1.0
         with:
           github-token: ${{ steps.create_token.outputs.token }}
-          script: pnpm release
+          pack-dir-artifact-id: ${{ needs.pack.outputs.pack-dir-artifact-id }}