ci: cut workflow waste and verify locally first

.actrc

@@ -0,0 +1,4 @@
+-P ubuntu-latest=catthehacker/ubuntu:act-latest
+-P ubuntu-slim=catthehacker/ubuntu:act-latest
+--container-architecture linux/arm64
+--env npm_config_store_dir=/root/.local/share/pnpm/store

.github/actions/setup/action.yml

@@ -0,0 +1,31 @@
+name: Setup
+description: Install the project Node version and frozen dependencies with an explicit store cache.
+inputs:
+  registry-url:
+    description: Registry used when publishing a package.
+    required: false
+    default: ''
+runs:
+  using: composite
+  steps:
+    - name: Set up Node.js
+      uses: actions/setup-node@v6
+      with:
+        node-version: 22
+        package-manager-cache: false
+        registry-url: ${{ inputs.registry-url }}
+    - name: Set up pnpm
+      uses: pnpm/action-setup@v6
+    - name: Locate dependency cache
+      id: store
+      shell: bash
+      run: echo "path=$(pnpm store path --silent)" >> "$GITHUB_OUTPUT"
+    - name: Cache dependencies
+      uses: actions/cache@v6
+      with:
+        path: ${{ steps.store.outputs.path }}
+        key: pnpm-store-${{ runner.os }}-${{ runner.arch }}-node22-${{ hashFiles('pnpm-lock.yaml') }}
+        restore-keys: pnpm-store-${{ runner.os }}-${{ runner.arch }}-node22-
+    - name: Install dependencies
+      shell: bash
+      run: pnpm install --frozen-lockfile

.github/workflows/biome.yml

@@ -0,0 +1,15 @@
+name: Biome
+'on':
+  workflow_call: null
+permissions:
+  contents: read
+jobs:
+  biome:
+    name: Biome
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Setup workspace
+        uses: ./.github/actions/setup
+      - run: pnpm check:ci
+    timeout-minutes: 15

.github/workflows/build.yml

@@ -0,0 +1,15 @@
+name: Build
+'on':
+  workflow_call: null
+permissions:
+  contents: read
+jobs:
+  build:
+    name: Build
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Setup workspace
+        uses: ./.github/actions/setup
+      - run: pnpm build
+    timeout-minutes: 15

.github/workflows/ci.yml

@@ -1,84 +1,32 @@
 name: CI
-
-on:
+'on':
   push:
-    branches: [main]
-  pull_request:
-
+    branches:
+      - main
+  pull_request: null
+  workflow_dispatch: null
 permissions:
   contents: read
-
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
 jobs:
   biome:
-    name: Biome
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
-        with:
-          version: 10.12.1
-          run_install: false
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 22
-          cache: pnpm
-      - run: pnpm install --frozen-lockfile
-      - run: pnpm exec biome ci .
-
+    uses: ./.github/workflows/biome.yml
   typecheck:
-    name: Typecheck
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
-        with:
-          version: 10.12.1
-          run_install: false
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 22
-          cache: pnpm
-      - run: pnpm install --frozen-lockfile
-      - run: pnpm typecheck
-
+    uses: ./.github/workflows/typecheck.yml
   test:
-    name: Test
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
-        with:
-          version: 10.12.1
-          run_install: false
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 22
-          cache: pnpm
-      # archiveReader + devinProvider tests need system binaries
-      - run: sudo apt-get update && sudo apt-get install -y zstd sqlite3
-      - run: pnpm install --frozen-lockfile
-      - run: pnpm test
-
+    uses: ./.github/workflows/test.yml
   build:
-    name: Build
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
-        with:
-          version: 10.12.1
-          run_install: false
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 22
-          cache: pnpm
-      - run: pnpm install --frozen-lockfile
-      - run: pnpm build
-
+    uses: ./.github/workflows/build.yml
   ciGate:
     name: CI Gate
-    runs-on: ubuntu-latest
-    needs: [biome, typecheck, test, build]
+    runs-on: ubuntu-slim
+    needs:
+      - biome
+      - typecheck
+      - test
+      - build
     if: always()
     steps:
       - name: Check required jobs
@@ -87,9 +35,10 @@ jobs:
           if [ "${{ needs.typecheck.result }}" != "success" ]; then exit 1; fi
           if [ "${{ needs.test.result }}" != "success" ]; then exit 1; fi
           if [ "${{ needs.build.result }}" != "success" ]; then exit 1; fi
-
+    timeout-minutes: 5
   reportFailure:
-    needs: [ciGate]
+    needs:
+      - ciGate
     if: failure() && github.event_name == 'push' && github.ref == 'refs/heads/main'
     permissions:
       contents: read

.github/workflows/publish.yml

@@ -1,29 +1,25 @@
 name: Publish
-
-on:
-  workflow_dispatch:
+'on':
+  workflow_dispatch: null
   release:
-    types: [published]
-
+    types:
+      - published
 permissions:
   contents: read
   id-token: write
-
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
 jobs:
   publish:
     name: Publish
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
+      - name: Setup workspace
+        uses: ./.github/actions/setup
         with:
-          version: 10.12.1
-          run_install: false
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 22
           registry-url: https://registry.npmjs.org
-          cache: pnpm
-      - run: pnpm install --frozen-lockfile
       - run: pnpm build
       - run: npm publish --provenance --access public
+    timeout-minutes: 15

.github/workflows/reportFailure.yml

@@ -1,16 +1,13 @@
 name: Report Failure
-
-on:
-  workflow_call:
-
+'on':
+  workflow_call: null
 permissions:
   contents: read
   issues: write
-
 jobs:
   reportFailure:
     name: Report Failure
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-slim
     steps:
       - uses: actions/github-script@v7
         with:
@@ -45,3 +42,4 @@ jobs:
               body,
               labels: ['ci-failure'],
             });
+    timeout-minutes: 5

.github/workflows/test.yml

@@ -0,0 +1,16 @@
+name: Test
+'on':
+  workflow_call: null
+permissions:
+  contents: read
+jobs:
+  test:
+    name: Test
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Setup workspace
+        uses: ./.github/actions/setup
+      - run: sudo apt-get update && sudo apt-get install -y zstd sqlite3
+      - run: pnpm test
+    timeout-minutes: 20

.github/workflows/typecheck.yml

@@ -0,0 +1,15 @@
+name: Typecheck
+'on':
+  workflow_call: null
+permissions:
+  contents: read
+jobs:
+  typecheck:
+    name: Typecheck
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Setup workspace
+        uses: ./.github/actions/setup
+      - run: pnpm typecheck
+    timeout-minutes: 15

AGENTS.md

@@ -82,3 +82,8 @@ pnpm typecheck
 pnpm test
 pnpm build
 ```
+
+## Local CI
+
+Run `act workflow_dispatch -W .github/workflows/ci.yml` before opening a PR.
+The root `.actrc` selects the local Docker runner and keeps the pnpm store outside the workspace.

package.json

@@ -80,7 +80,7 @@
     "evidence:local": "tsx src/cli/main.ts savings"
   },
   "engines": {
-    "node": ">=20.0.0"
+    "node": ">=22"
   },
   "devDependencies": {
     "@biomejs/biome": "^2.5.2",