ci: cut workflow waste and support local checks

.actrc

@@ -0,0 +1,4 @@
+-P ubuntu-latest=catthehacker/ubuntu:act-latest
+-P ubuntu-slim=catthehacker/ubuntu:act-latest
+--container-architecture linux/arm64
+--env npm_config_store_dir=/root/.local/share/pnpm/store

.github/actions/setup/action.yml

@@ -0,0 +1,31 @@
+name: Setup workspace
+description: Install the project runtime and frozen dependencies with an explicit cache.
+inputs:
+  registry-url:
+    description: Package registry for publishing.
+    required: false
+    default: ''
+runs:
+  using: composite
+  steps:
+    - name: Set up Node.js
+      uses: actions/setup-node@v6
+      with:
+        node-version: 22
+        package-manager-cache: false
+        registry-url: ${{ inputs.registry-url }}
+    - name: Set up pnpm
+      uses: pnpm/action-setup@v6
+    - name: Locate dependency cache
+      id: store
+      shell: bash
+      run: echo "path=$(pnpm store path --silent)" >> "$GITHUB_OUTPUT"
+    - name: Cache dependencies
+      uses: actions/cache@v6
+      with:
+        path: ${{ steps.store.outputs.path }}
+        key: pnpm-store-${{ runner.os }}-${{ runner.arch }}-node22-${{ hashFiles('pnpm-lock.yaml') }}
+        restore-keys: pnpm-store-${{ runner.os }}-${{ runner.arch }}-node22-
+    - name: Install dependencies
+      shell: bash
+      run: pnpm install --frozen-lockfile

.github/workflows/build.yml

@@ -0,0 +1,16 @@
+name: Build
+'on':
+  workflow_call: null
+permissions:
+  contents: read
+jobs:
+  check:
+    name: Build
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@v6
+      - name: Setup workspace
+        uses: ./.github/actions/setup
+      - name: Build
+        run: pnpm build

.github/workflows/ci.yml

@@ -1,41 +1,21 @@
-name: ci
-
-on:
+name: CI
+'on':
   push:
-    branches: [main]
+    branches:
+      - main
   pull_request:
-    branches: [main]
-
+    branches:
+      - main
+  workflow_dispatch: null
+permissions:
+  contents: read
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
 jobs:
-  validate:
-    name: node ${{ matrix.node }}
-    runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-      matrix:
-        node: ['22.x', '24.x']
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v6
-
-      - name: Setup pnpm
-        uses: pnpm/action-setup@v5
-        with:
-          version: 10.14.0
-
-      - name: Setup Node.js ${{ matrix.node }}
-        uses: actions/setup-node@v6
-        with:
-          node-version: ${{ matrix.node }}
-
-      - name: Install dependencies
-        run: pnpm install --no-frozen-lockfile
-
-      - name: Typecheck
-        run: pnpm typecheck
-
-      - name: Test
-        run: pnpm test
-
-      - name: Build
-        run: pnpm build
+  typecheck:
+    uses: ./.github/workflows/typecheck.yml
+  test:
+    uses: ./.github/workflows/test.yml
+  build:
+    uses: ./.github/workflows/build.yml

.github/workflows/test.yml

@@ -0,0 +1,16 @@
+name: Test
+'on':
+  workflow_call: null
+permissions:
+  contents: read
+jobs:
+  check:
+    name: Test
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@v6
+      - name: Setup workspace
+        uses: ./.github/actions/setup
+      - name: Test
+        run: pnpm test

.github/workflows/typecheck.yml

@@ -0,0 +1,16 @@
+name: Typecheck
+'on':
+  workflow_call: null
+permissions:
+  contents: read
+jobs:
+  check:
+    name: Typecheck
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@v6
+      - name: Setup workspace
+        uses: ./.github/actions/setup
+      - name: Typecheck
+        run: pnpm typecheck

AGENTS.md

@@ -0,0 +1,6 @@
+# Agent instructions
+
+## Local CI
+
+Run `act workflow_dispatch -W .github/workflows/ci.yml` before opening a PR.
+The root `.actrc` selects the Docker runner. Dependency caches use `actions/cache`.