chore: use the pull-request SHA on publishing for PR (#45)

.github/workflows/publish.yml

@@ -19,6 +19,8 @@ jobs:
     steps:
     - name: Checkout
       uses: actions/checkout@v4
+      with:
+        ref: ${{ github.event.pull_request.head.sha }}
 
     - name: Install NodeJS
       uses: actions/setup-node@v4