Promote PR bump preview example to a reusable workflow

[bearomorphism]

Background

Following the rollout of the PR bump preview pattern across three repos (issue commitizen-tools/commitizen#1510), the example workflow is currently duplicated:

• commitizen-tools/setup-cz/examples/pr-bump-preview.yaml (this repo, copy-paste source)
• commitizen-tools/commitizen/.github/workflows/pr-bump-preview.yml
• commitizen-tools/commitizen-action/.github/workflows/pr-bump-preview.yml

The recent security fix (same-repo guard + persist-credentials: false) had to be applied to all three copies independently. Future maintenance — new actions/checkout versions, comment-action upgrades, additional flags — will incur the same per-repo cost.

Proposal

Promote the example into a reusable workflow hosted in this repo.

Files

1. New setup-cz/.github/workflows/pr-bump-preview.yml with on: workflow_call and inputs:
   • cz-version (default latest) → forwarded to setup-cz
   • extra-requirements (default empty) → forwarded to setup-cz
   • ref (optional) → checkout ref override
2. examples/pr-bump-preview.yaml shrinks to a thin wrapper showing uses: commitizen-tools/setup-cz/.github/workflows/pr-bump-preview.yml@v1.

Consumer wrapper (~8 lines)

\\yaml
on:
pull_request_target:
types: [opened, reopened, synchronize, ready_for_review]
permissions: { contents: read, pull-requests: write }
jobs:
preview:
uses: commitizen-tools/setup-cz/.github/workflows/pr-bump-preview.yml@v1
\\

Migration

After this lands and a release is cut:

• commitizen-tools/commitizen: replace its 80-line workflow with the 8-line wrapper.
• commitizen-tools/commitizen-action: same.

Why a reusable workflow (not a composite action)?

A composite action would still need every consumer to write the pull_request_target trigger, the same-repo guard, the checkout, and the comment-posting step. Those are the exact bits we want to deduplicate. Reusable workflows encapsulate the whole job.

Why now wasn't the right time

Doing this in the original three PRs was rejected to avoid cross-repo merge coordination and to gather data on what inputs actually matter. Once the workflow has run on a few real PRs, we'll know whether working-directory, cz-version overrides, etc. are actually needed before committing them to a public reusable-workflow contract.

Acceptance

• Reusable workflow at setup-cz/.github/workflows/pr-bump-preview.yml
• Trimmed example at examples/pr-bump-preview-wrapper.yaml
• Tag a setup-cz release containing the new workflow
• Follow-up PR in commitizen-tools/commitizen swapping the workflow for the wrapper
• Follow-up PR in commitizen-tools/commitizen-action swapping the workflow for the wrapper

[bearomorphism]

Tracked in commitizen-tools/commitizen#1959 too for visibility alongside the original feature request (#1510).