fix(ci): Perform release verification in a separate working dir. (#9234)

Co-authored-by: matt korwel <matt.korwel@gmail.com>

.github/actions/publish-release/action.yml

@@ -151,12 +151,6 @@ runs:
         wombat-token-core: '${{ inputs.wombat-token-core }}'
         wombat-token-cli: '${{ inputs.wombat-token-cli }}'
 
-    - name: 'Install deps'
-      working-directory: '${{ inputs.working-directory }}'
-      shell: 'bash'
-      run: |
-        npm install
-
     - name: '🎁 Bundle'
       working-directory: '${{ inputs.working-directory }}'
       shell: 'bash'

.github/actions/verify-release/action.yml

@@ -25,6 +25,7 @@ runs:
     - name: 'Checkout'
       uses: 'actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955' # ratchet:actions/checkout@v4
       with:
+        path: 'verify'
         ref: '${{ github.event.inputs.ref }}'
         fetch-depth: 0
 
@@ -34,13 +35,13 @@ runs:
         timeout_seconds: 900
         retry_wait_seconds: 30
         max_attempts: 10
-        command: |-
+        command: 'cd ./verify && pkg="${{ inputs.npm-package }}" && npm install --prefer-online --no-cache -g "$pkg"'
-          npm install --prefer-online --no-cache -g ${{ inputs.npm-package }}
 
     # This provides a very basic smoke test for Gemini CLI
     - name: 'Run Gemini CLI'
       id: 'gemini_cli'
       shell: 'bash'
+      working-directory: './verify'
       run: |-
         echo "gemini_version=$(gemini --version)" >> $GITHUB_OUTPUT
 
@@ -48,6 +49,7 @@ runs:
     - name: 'Fail workflow if version does not match'
       if: '${{ steps.gemini_cli.outputs.gemini_version != inputs.expected-version }}'
       shell: 'bash'
+      working-directory: './verify'
       run: |-
         echo '❌ Got ${{ steps.gemini_cli.outputs.gemini_version }} from ${{ inputs.npm-package }}'
         echo '❌ Expected Version ${{ inputs.expected-version }}'

.github/workflows/verify-release.yml

@@ -26,6 +26,6 @@ jobs:
       - name: 'Verify release'
         uses: './.github/actions/verify-release'
         with:
-          npm-package: '${github.event.inputs.npm-package}'
+          npm-package: '${{github.event.inputs.npm-package}}'
-          expected-version: '${github.event.inputs.version}'
+          expected-version: '${{github.event.inputs.version}}'
-          ref: '${github.event.inputs.ref}'
+          ref: '${{github.event.inputs.ref}}'