Add packed `.tgz` as build artifact to aid in testing PRs

[brian-smith-tcril]

Testing PRs against test-site is pretty straightforward, however, the current "test someone's PR against an app" method is:

• Pull down PR branch
• Pack frontend-base
• Install newly packed frontend-base in the app you're testing it against

It might be cool to be able to grab a .tgz from a PR to save a couple steps and just:

• Download .tgz from CI run
• Install/test against app

[arbrandes]

This does it:

#172

But not without a potentially controversial side-effect: for every PR package, an associated Github (pre-)release is created, along with an associated git tag. It gets deleted when the PR is closed, but still, I can imagine it being distracting if we ever end up using Github releases for actual releases.

An alternative, as suggested by @holaontiveros, would be to use something like https://github.com/stackblitz-labs/pkg.pr.new. There are some obvious downsides, too: the biggest one being having to install a GH app on the org.
There might be some bureaucracy, specially given that it requires some write permissions.

[brian-smith-tcril]

Another alternative I mentioned in openedx/frontend-app-authn#1628 (review) is nightly.link. They recommend installing the app to the org but it's not required.

From their homepage:

If you'll be publishing a link to your own repository's artifacts, please install the GitHub App anyway, so that downloads for your repositories don't share the global API rate limit. The throttling will likely become very bad over time.

edit: even installed it's read-only

nightly.link as an Installed GitHub App

This GitHub App requests these permissions:

• Actions: Workflows, workflow runs and artifacts.
  • Access: Read-only
• Metadata [mandatory]: Search repositories, list collaborators, and access repository metadata.
  • Access: Read-only

[arbrandes]

Talked to Feanil yesterday at standup: there's no objection in principle to adding a Github app such as pkr.pr.new, but there are 3 things we need to clear before making the recommendation:

1. Is the project healthy? In other words, is it likely to continue existing without us having to adopt it?
2. Is the project secure? Try to get at least a vulnerability report, which you can get apparently by just forking it.
3. Does Axim legal approve of the licensing? After clearing the first 2 hurdles, we will want to clear it with Ed and legal.