@joshuafolkken/kit 1.1035.0 → 1.1094.0

package/.codex/hooks.json

@@ -1,52 +1,48 @@
 {
 	"hooks": {
-		"PreToolUse": [
+		"SessionStart": [
 			{
-				"matcher": "Bash|Edit|Read|Write|AskUserQuestion|apply_patch",
+				"matcher": "",
 				"hooks": [
 					{
 						"type": "command",
-						"command": "if [ -f dist/hooks/codex-hook-adapter.js ]; then node dist/hooks/codex-hook-adapter.js pretool; else pnpm exec tsx scripts/hooks/codex-hook-adapter.ts pretool; fi",
-						"timeout": 20
+						"command": "pnpm josh audit:provision",
+						"timeout": 180
 					}
 				]
 			}
 		],
-		"PostToolUse": [
+		"UserPromptSubmit": [
 			{
-				"matcher": "Edit|Write|apply_patch",
 				"hooks": [
 					{
 						"type": "command",
-						"command": "if [ -f dist/hooks/codex-hook-adapter.js ]; then node dist/hooks/codex-hook-adapter.js posttool; else pnpm exec tsx scripts/hooks/codex-hook-adapter.ts posttool; fi",
-						"timeout": 90
+						"command": "if project_root=\"$(env -u GIT_ALTERNATE_OBJECT_DIRECTORIES -u GIT_COMMON_DIR -u GIT_DIR -u GIT_INDEX_FILE -u GIT_NAMESPACE -u GIT_OBJECT_DIRECTORY -u GIT_WORK_TREE git rev-parse --show-toplevel 2>/dev/null)\"; then unset GIT_ALTERNATE_OBJECT_DIRECTORIES GIT_COMMON_DIR GIT_DIR GIT_INDEX_FILE GIT_NAMESPACE GIT_OBJECT_DIRECTORY GIT_WORK_TREE; else project_root=\"$(git rev-parse --show-toplevel)\" || exit 1; fi; cd \"$project_root\" && if node --disable-warning=ExperimentalWarning scripts/hooks/hook-bundle-ready.ts; then node dist/hooks/session-lang.js; else pnpm josh session:lang; fi",
+						"timeout": 10
 					}
 				]
 			}
 		],
-		"SessionStart": [
+		"PreToolUse": [
 			{
-				"matcher": "",
+				"matcher": "Bash|Edit|Read|Write|AskUserQuestion|apply_patch",
 				"hooks": [
 					{
 						"type": "command",
-						"command": "pnpm josh audit:provision",
-						"timeout": 180
+						"command": "if project_root=\"$(env -u GIT_ALTERNATE_OBJECT_DIRECTORIES -u GIT_COMMON_DIR -u GIT_DIR -u GIT_INDEX_FILE -u GIT_NAMESPACE -u GIT_OBJECT_DIRECTORY -u GIT_WORK_TREE git rev-parse --show-toplevel 2>/dev/null)\"; then unset GIT_ALTERNATE_OBJECT_DIRECTORIES GIT_COMMON_DIR GIT_DIR GIT_INDEX_FILE GIT_NAMESPACE GIT_OBJECT_DIRECTORY GIT_WORK_TREE; else project_root=\"$(git rev-parse --show-toplevel)\" || exit 1; fi; cd \"$project_root\" && if node --disable-warning=ExperimentalWarning scripts/hooks/hook-bundle-ready.ts; then node dist/hooks/codex-hook-adapter.js pretool; else pnpm exec tsx scripts/hooks/codex-hook-adapter.ts pretool; fi",
+						"timeout": 20
 					}
 				]
 			}
 		],
-		"UserPromptSubmit": [
+		"PostToolUse": [
 			{
+				"matcher": "Edit|Write|apply_patch",
 				"hooks": [
 					{
 						"type": "command",
-						"command": "echo 'MANDATORY before writing any implementation code: present the two-layer work summary (Now / Change / Check, then every change with its test). Full rule: Code Change Rules Step 0 in CLAUDE.md.'"
-					},
-					{
-						"type": "command",
-						"command": "if [ -f dist/hooks/session-lang.js ]; then node dist/hooks/session-lang.js; else pnpm josh session:lang; fi",
-						"timeout": 10
+						"command": "if project_root=\"$(env -u GIT_ALTERNATE_OBJECT_DIRECTORIES -u GIT_COMMON_DIR -u GIT_DIR -u GIT_INDEX_FILE -u GIT_NAMESPACE -u GIT_OBJECT_DIRECTORY -u GIT_WORK_TREE git rev-parse --show-toplevel 2>/dev/null)\"; then unset GIT_ALTERNATE_OBJECT_DIRECTORIES GIT_COMMON_DIR GIT_DIR GIT_INDEX_FILE GIT_NAMESPACE GIT_OBJECT_DIRECTORY GIT_WORK_TREE; else project_root=\"$(git rev-parse --show-toplevel)\" || exit 1; fi; cd \"$project_root\" && if node --disable-warning=ExperimentalWarning scripts/hooks/hook-bundle-ready.ts; then node dist/hooks/codex-hook-adapter.js posttool; else pnpm exec tsx scripts/hooks/codex-hook-adapter.ts posttool; fi",
+						"timeout": 90
 					}
 				]
 			}
@@ -57,7 +53,7 @@
 				"hooks": [
 					{
 						"type": "command",
-						"command": "if [ -f dist/hooks/stop-guard.js ]; then node dist/hooks/stop-guard.js; else pnpm josh stop:guard; fi",
+						"command": "if project_root=\"$(env -u GIT_ALTERNATE_OBJECT_DIRECTORIES -u GIT_COMMON_DIR -u GIT_DIR -u GIT_INDEX_FILE -u GIT_NAMESPACE -u GIT_OBJECT_DIRECTORY -u GIT_WORK_TREE git rev-parse --show-toplevel 2>/dev/null)\"; then unset GIT_ALTERNATE_OBJECT_DIRECTORIES GIT_COMMON_DIR GIT_DIR GIT_INDEX_FILE GIT_NAMESPACE GIT_OBJECT_DIRECTORY GIT_WORK_TREE; else project_root=\"$(git rev-parse --show-toplevel)\" || exit 1; fi; cd \"$project_root\" && if node --disable-warning=ExperimentalWarning scripts/hooks/hook-bundle-ready.ts; then node dist/hooks/stop-guard.js; else pnpm josh stop:guard; fi",
 						"timeout": 20
 					}
 				]

package/.github/actions/setup-pnpm/action.yml

@@ -0,0 +1,93 @@
+name: Setup pnpm
+description: >
+  Resolve the project's pnpm version, set pnpm up, and — unless `install` is false — restore the
+  pnpm store, install safe-chain from its hash-verified release installer and install the
+  dependencies through it.
+
+# The one place kit's own workflows prepare pnpm (joshuafolkken/kit#2982). Every job that installed
+# dependencies used to carry these steps itself, and `publish.yml` — the workflow holding the npm
+# and GitHub Packages publish rights — had been left without safe-chain while `ci.yml` had it. A
+# job that calls this action cannot install without the scan.
+#
+# Distributed: `josh sync` writes this file into a consumer beside the workflows that call it
+# (`pr-classification.yml`), stamped as managed like they are (joshuafolkken/kit#3013).
+# `templates/workflows/ci.yml` still carries the same steps inline — it was written before this file
+# was distributed, and moving it onto the action is a change of its own. `workflow_pin_logic` reads
+# this file as a source of canonical action pins, so the template's refs still resolve from here.
+
+inputs:
+  install:
+    description: Install the dependencies. False sets pnpm up alone, for a job that only runs pnpm.
+    required: false
+    default: 'true'
+  cache:
+    description: >
+      Restore and save the pnpm store. A release job passes false, so nothing another run saved
+      reaches a job that holds publish credentials.
+    required: false
+    default: 'true'
+  runtime:
+    description: Passed to pnpm/setup's `runtime` input; empty leaves the runtime to setup-node.
+    required: false
+    default: ''
+  node-auth-token:
+    description: >
+      NODE_AUTH_TOKEN for the install, for a job whose `.npmrc` authenticates to GitHub Packages.
+      Empty keeps whatever the job already has.
+    required: false
+    default: ''
+
+runs:
+  using: composite
+  steps:
+    - name: Resolve pnpm version
+      id: pnpm-version
+      shell: bash
+      run: |
+        version=$(node -p "const m = require('./package.json'); m.packageManager?.match(/^pnpm@([^+]+)/)?.[1] ?? (m.devEngines?.packageManager?.name === 'pnpm' ? m.devEngines.packageManager.version?.split('+')[0] : 'latest') ?? 'latest'")
+        test -n "$version"
+        echo "version=$version" >> "$GITHUB_OUTPUT"
+
+    - name: Setup pnpm
+      uses: pnpm/setup@fbda4c85fc2e1e08721cd8763afea8f48d60f024 # v3.0.0
+      with:
+        version: ${{ steps.pnpm-version.outputs.version }}
+        runtime: ${{ inputs.runtime }}
+        install: false
+
+    - name: Resolve pnpm store path
+      if: inputs.install == 'true' && inputs.cache == 'true'
+      shell: bash
+      run: echo "PNPM_STORE_PATH=$(pnpm store path)" >> "$GITHUB_ENV"
+
+    - name: Setup pnpm store cache
+      if: inputs.install == 'true' && inputs.cache == 'true'
+      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+      with:
+        path: ${{ env.PNPM_STORE_PATH }}
+        key: ${{ runner.os }}-pnpm-store-${{ hashFiles('pnpm-lock.yaml') }}
+        restore-keys: |
+          ${{ runner.os }}-pnpm-store-
+
+    # The safe-chain release and the SHA-256 of that release's install-safe-chain.sh. The installer
+    # puts the safe-chain binary under ~/.safe-chain/bin and adds it to PATH beside the shims;
+    # `pnpm dlx … setup-ci` left only the shims, which then let every install through without a scan
+    # (joshuafolkken/kit#2711). `josh latest` moves both together.
+    - name: Setup safe-chain
+      if: inputs.install == 'true'
+      shell: bash
+      env:
+        SAFE_CHAIN_INSTALLER_VERSION: 1.5.20
+        SAFE_CHAIN_INSTALLER_SHA256: 0ad25efe15d1fa56105157a454d647223e78eb0c53d1f85e3d10afcd722e7bfd
+      run: |
+        installer="$RUNNER_TEMP/install-safe-chain.sh"
+        curl --proto '=https' -fsSL "https://github.com/AikidoSec/safe-chain/releases/download/$SAFE_CHAIN_INSTALLER_VERSION/install-safe-chain.sh" -o "$installer"
+        echo "$SAFE_CHAIN_INSTALLER_SHA256  $installer" | sha256sum -c -
+        sh "$installer" --ci
+
+    - name: Install dependencies
+      if: inputs.install == 'true'
+      shell: bash
+      env:
+        NODE_AUTH_TOKEN: ${{ inputs.node-auth-token || env.NODE_AUTH_TOKEN }}
+      run: pnpm install --frozen-lockfile --ignore-scripts

package/.github/dependabot.yml

@@ -1,7 +1,11 @@
 version: 2
 updates:
+  # The local composite actions pin actions of their own, and Dependabot reads only the directories
+  # it is given — `/` covers `.github/workflows` and no `.github/actions/*/action.yml`.
   - package-ecosystem: 'github-actions'
-    directory: '/'
+    directories:
+      - '/'
+      - '/.github/actions/*'
     schedule:
       interval: 'weekly'
   # Version updates are disabled: `josh latest` runs at the start of every fullrun / halfrun /

package/.github/workflows/auto-tag.yml

@@ -9,6 +9,7 @@ jobs:
     name: Create Git Tag if Version Changed
     runs-on: ubuntu-latest
     permissions:
+      actions: write
       contents: write
     steps:
       - name: Checkout code
@@ -109,3 +110,23 @@ jobs:
         with:
           event-type: new-tag-created
           client-payload: '{"tag": "${{ steps.create_tag.outputs.tag }}"}'
+
+      # A publish workflow run on the tag ref records the tag's commit in npm provenance; a
+      # repository_dispatch run records the default branch head, which may already be past the tag.
+      # A publish.yml that still listens for new-tag-created is left to the dispatch above, so one
+      # release never starts two publish runs. This step runs after that dispatch so its failure
+      # cannot keep the dispatch from reaching production.yml.
+      - name: Start publish workflow on the tag
+        if: steps.create_tag.outputs.completed == 'true'
+        env:
+          GH_TOKEN: ${{ github.token }}
+          GH_REPO: ${{ github.repository }}
+          TAG: ${{ steps.create_tag.outputs.tag }}
+        run: |
+          WORKFLOW=.github/workflows/publish.yml
+          if [ -f "$WORKFLOW" ] && grep -Eq '^[[:space:]]*workflow_dispatch:' "$WORKFLOW" && ! grep -q 'new-tag-created' "$WORKFLOW"; then
+            gh workflow run publish.yml --ref "$TAG"
+            echo "✅ Started publish.yml on $TAG"
+          else
+            echo "ℹ️ publish.yml is not a workflow_dispatch-only publisher, skipping"
+          fi

package/.github/workflows/ci.yml

@@ -27,13 +27,10 @@ concurrency:
 # set the JOSH_PLAYWRIGHT_BROWSERS repository variable to a space-separated list to widen it.
 env:
   JOSH_PLAYWRIGHT_BROWSERS: ${{ vars.JOSH_PLAYWRIGHT_BROWSERS || 'chromium' }}
-  # The safe-chain release every "Setup safe-chain" step installs, and the SHA-256 of that release's
-  # install-safe-chain.sh. The installer puts the safe-chain binary under ~/.safe-chain/bin and
-  # adds it to PATH beside the shims; `pnpm dlx … setup-ci` left only the shims, which then let
-  # every install through without a scan (joshuafolkken/kit#2711). `josh latest` moves both together.
-  SAFE_CHAIN_INSTALLER_VERSION: 1.5.20
-  SAFE_CHAIN_INSTALLER_SHA256: 0ad25efe15d1fa56105157a454d647223e78eb0c53d1f85e3d10afcd722e7bfd
 
+# Every job that needs pnpm prepares it through `.github/actions/setup-pnpm`, which carries the
+# pnpm version resolution, the store cache, the safe-chain installer pin and the install
+# (joshuafolkken/kit#2982).
 jobs:
   node-26-pnpm:
     name: Node 26 pnpm
@@ -43,17 +40,10 @@ jobs:
       contents: read
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: Resolve pnpm version
-        id: pnpm-version
-        run: |
-          version=$(node -p "const m = require('./package.json'); m.packageManager?.match(/^pnpm@([^+]+)/)?.[1] ?? (m.devEngines?.packageManager?.name === 'pnpm' ? m.devEngines.packageManager.version?.split('+')[0] : 'latest') ?? 'latest'")
-          test -n "$version"
-          echo "version=$version" >> "$GITHUB_OUTPUT"
-      - uses: pnpm/setup@fbda4c85fc2e1e08721cd8763afea8f48d60f024 # v3.0.0
+      - uses: ./.github/actions/setup-pnpm
         with:
-          version: ${{ steps.pnpm-version.outputs.version }}
           runtime: node@26
-          install: false
+          install: 'false'
       - run: node --version && pnpm --version
 
   playwright-image:
@@ -223,7 +213,7 @@ jobs:
   static-checks:
     name: Static Checks
     needs: reuse-pr-checks
-    if: ${{ always() && needs.reuse-pr-checks.outputs.reuse != 'true' }}
+    if: ${{ !cancelled() && needs.reuse-pr-checks.outputs.reuse != 'true' }}
     runs-on: ubuntu-latest
     timeout-minutes: 8
     permissions:
@@ -239,30 +229,6 @@ jobs:
           node-version: '24'
           registry-url: 'https://npm.pkg.github.com'
 
-      - name: Resolve pnpm version
-        id: pnpm-version
-        run: |
-          version=$(node -p "const m = require('./package.json'); m.packageManager?.match(/^pnpm@([^+]+)/)?.[1] ?? (m.devEngines?.packageManager?.name === 'pnpm' ? m.devEngines.packageManager.version?.split('+')[0] : 'latest') ?? 'latest'")
-          test -n "$version"
-          echo "version=$version" >> "$GITHUB_OUTPUT"
-
-      - name: Setup pnpm
-        uses: pnpm/setup@fbda4c85fc2e1e08721cd8763afea8f48d60f024 # v3.0.0
-        with:
-          version: ${{ steps.pnpm-version.outputs.version }}
-          install: false
-
-      - name: Resolve pnpm store path
-        run: echo "PNPM_STORE_PATH=$(pnpm store path)" >> "$GITHUB_ENV"
-
-      - name: Setup pnpm store cache
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: ${{ env.PNPM_STORE_PATH }}
-          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('pnpm-lock.yaml') }}
-          restore-keys: |
-            ${{ runner.os }}-pnpm-store-
-
       - name: Setup ESLint cache
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         id: eslint-cache
@@ -317,17 +283,10 @@ jobs:
             ${{ runner.os }}-cspell-cache-${{ hashFiles('pnpm-lock.yaml') }}-
             ${{ runner.os }}-cspell-cache-
 
-      - name: Setup safe-chain
-        run: |
-          installer="$RUNNER_TEMP/install-safe-chain.sh"
-          curl --proto '=https' -fsSL "https://github.com/AikidoSec/safe-chain/releases/download/$SAFE_CHAIN_INSTALLER_VERSION/install-safe-chain.sh" -o "$installer"
-          echo "$SAFE_CHAIN_INSTALLER_SHA256  $installer" | sha256sum -c -
-          sh "$installer" --ci
-
-      - name: Install dependencies
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: pnpm install --frozen-lockfile --ignore-scripts
+      - name: Setup pnpm and install dependencies
+        uses: ./.github/actions/setup-pnpm
+        with:
+          node-auth-token: ${{ secrets.GITHUB_TOKEN }}
 
       # One step rather than five, and concurrent rather than serial (joshuafolkken/kit#1216).
       # `josh gate` is the command a developer runs before committing; it fans out to the same
@@ -366,13 +325,10 @@ jobs:
       - name: Run verification gate
         run: pnpm josh gate --verbose --no-unit
 
-  # The other half of the gate, on a runner of its own. It carries the same setup steps as
-  # `static-checks` rather than sharing them: a GitHub job is its own machine, so every job that
-  # needs Node sets Node up, and this workflow already writes that preamble once per job. The
-  # single-source alternative — a local composite action under `.github/actions/` — is ruled out by
-  # `scripts/ci/ci-yml-action-parity.test.ts`, which pins the set of action names in this file to the
-  # set in `templates/workflows/ci.yml`; a local action cannot appear in a distributed template,
-  # because the template travels to consumers without it.
+  # The other half of the gate, on a runner of its own. A GitHub job is its own machine, so this job
+  # sets Node up again; the pnpm preamble is the shared `.github/actions/setup-pnpm` action
+  # (joshuafolkken/kit#2982), whose own action pins `scripts/ci/ci-yml-action-parity.test.ts` counts
+  # as this file's when it compares them with `templates/workflows/ci.yml`.
   #
   # No ESLint cache here — nothing in this job lints — and no `--maxWorkers`: `gate-plan.ts` leaves
   # any machine below its measured 11 cores uncapped, so vitest sizes its own pool from the runner
@@ -380,7 +336,7 @@ jobs:
   unit:
     name: Unit Tests
     needs: reuse-pr-checks
-    if: ${{ always() && needs.reuse-pr-checks.outputs.reuse != 'true' }}
+    if: ${{ !cancelled() && needs.reuse-pr-checks.outputs.reuse != 'true' }}
     runs-on: ubuntu-latest
     timeout-minutes: 8
     permissions:
@@ -396,41 +352,10 @@ jobs:
           node-version: '24'
           registry-url: 'https://npm.pkg.github.com'
 
-      - name: Resolve pnpm version
-        id: pnpm-version
-        run: |
-          version=$(node -p "const m = require('./package.json'); m.packageManager?.match(/^pnpm@([^+]+)/)?.[1] ?? (m.devEngines?.packageManager?.name === 'pnpm' ? m.devEngines.packageManager.version?.split('+')[0] : 'latest') ?? 'latest'")
-          test -n "$version"
-          echo "version=$version" >> "$GITHUB_OUTPUT"
-
-      - name: Setup pnpm
-        uses: pnpm/setup@fbda4c85fc2e1e08721cd8763afea8f48d60f024 # v3.0.0
-        with:
-          version: ${{ steps.pnpm-version.outputs.version }}
-          install: false
-
-      - name: Resolve pnpm store path
-        run: echo "PNPM_STORE_PATH=$(pnpm store path)" >> "$GITHUB_ENV"
-
-      - name: Setup pnpm store cache
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+      - name: Setup pnpm and install dependencies
+        uses: ./.github/actions/setup-pnpm
         with:
-          path: ${{ env.PNPM_STORE_PATH }}
-          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('pnpm-lock.yaml') }}
-          restore-keys: |
-            ${{ runner.os }}-pnpm-store-
-
-      - name: Setup safe-chain
-        run: |
-          installer="$RUNNER_TEMP/install-safe-chain.sh"
-          curl --proto '=https' -fsSL "https://github.com/AikidoSec/safe-chain/releases/download/$SAFE_CHAIN_INSTALLER_VERSION/install-safe-chain.sh" -o "$installer"
-          echo "$SAFE_CHAIN_INSTALLER_SHA256  $installer" | sha256sum -c -
-          sh "$installer" --ci
-
-      - name: Install dependencies
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: pnpm install --frozen-lockfile --ignore-scripts
+          node-auth-token: ${{ secrets.GITHUB_TOKEN }}
 
       # **Through `josh test:unit`, never `vitest run` directly, and that is what makes a job split
       # safe rather than a hole.** The guard decides between a skip and a failure, and
@@ -457,6 +382,10 @@ jobs:
   # through with an E2E suite that never ran (see the `Detect E2E` job below, and
   # https://github.com/joshuafolkken/kit/issues/991). A skipped aggregator would have reproduced that
   # defect on the unit suite. Running always and failing explicitly is the only shape that cannot.
+  # That is also why this job alone keeps `always()` while the two halves use `!cancelled()`
+  # (joshuafolkken/kit#2980): a cancelled run must stop the minutes-long halves, but a skipped
+  # `Checks` on a cancelled head-SHA run would read as passing, so this seconds-long job still runs
+  # and fails on the halves' `cancelled` results.
   #
   # The results are read from the environment rather than interpolated into the script. `needs.*.result`
   # is a GitHub-controlled enum and not attacker-controlled, but a `${{ }}` expression spliced into a
@@ -601,30 +530,6 @@ jobs:
           node-version: '24'
           registry-url: 'https://npm.pkg.github.com'
 
-      - name: Resolve pnpm version
-        id: pnpm-version
-        run: |
-          version=$(node -p "const m = require('./package.json'); m.packageManager?.match(/^pnpm@([^+]+)/)?.[1] ?? (m.devEngines?.packageManager?.name === 'pnpm' ? m.devEngines.packageManager.version?.split('+')[0] : 'latest') ?? 'latest'")
-          test -n "$version"
-          echo "version=$version" >> "$GITHUB_OUTPUT"
-
-      - name: Setup pnpm
-        uses: pnpm/setup@fbda4c85fc2e1e08721cd8763afea8f48d60f024 # v3.0.0
-        with:
-          version: ${{ steps.pnpm-version.outputs.version }}
-          install: false
-
-      - name: Resolve pnpm store path
-        run: echo "PNPM_STORE_PATH=$(pnpm store path)" >> "$GITHUB_ENV"
-
-      - name: Setup pnpm store cache
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: ${{ env.PNPM_STORE_PATH }}
-          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('pnpm-lock.yaml') }}
-          restore-keys: |
-            ${{ runner.os }}-pnpm-store-
-
       - name: Setup build cache
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         id: build-cache
@@ -636,17 +541,10 @@ jobs:
             ${{ runner.os }}-build-cache-e2e-${{ hashFiles('pnpm-lock.yaml') }}-
             ${{ runner.os }}-build-cache-e2e-
 
-      - name: Setup safe-chain
-        run: |
-          installer="$RUNNER_TEMP/install-safe-chain.sh"
-          curl --proto '=https' -fsSL "https://github.com/AikidoSec/safe-chain/releases/download/$SAFE_CHAIN_INSTALLER_VERSION/install-safe-chain.sh" -o "$installer"
-          echo "$SAFE_CHAIN_INSTALLER_SHA256  $installer" | sha256sum -c -
-          sh "$installer" --ci
-
-      - name: Install dependencies
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: pnpm install --frozen-lockfile --ignore-scripts
+      - name: Setup pnpm and install dependencies
+        uses: ./.github/actions/setup-pnpm
+        with:
+          node-auth-token: ${{ secrets.GITHUB_TOKEN }}
 
       # Only needed on the fallback path: the container image already ships browsers
       # matching its own Playwright version. Invoked through the local bin rather than

package/.github/workflows/pr-classification.yml

@@ -15,13 +15,6 @@ on:
 # nothing here needs it: every run reads the pull request's labels as they stand when it runs, not as
 # its event carried them, so whichever suite GitHub counts as newest holds a current verdict.
 
-# The same safe-chain installer pin as ci.yml — the release and its install-safe-chain.sh SHA-256.
-# `pnpm dlx … setup-ci` left only shims, so the install below ran without a scan (joshuafolkken/kit#2765).
-# `josh latest` moves both together, in this file and in ci.yml.
-env:
-  SAFE_CHAIN_INSTALLER_VERSION: 1.5.20
-  SAFE_CHAIN_INSTALLER_SHA256: 0ad25efe15d1fa56105157a454d647223e78eb0c53d1f85e3d10afcd722e7bfd
-
 jobs:
   classification:
     name: Release classification
@@ -45,41 +38,12 @@ jobs:
       - name: Configure GitHub Packages authentication for existing projects
         run: printf '//npm.pkg.github.com/:_authToken=${NODE_AUTH_TOKEN}\n' >> "$HOME/.npmrc"
 
-      - name: Resolve pnpm version
-        id: pnpm-version
-        run: |
-          version=$(node -p "const m = require('./package.json'); m.packageManager?.match(/^pnpm@([^+]+)/)?.[1] ?? (m.devEngines?.packageManager?.name === 'pnpm' ? m.devEngines.packageManager.version?.split('+')[0] : 'latest') ?? 'latest'")
-          test -n "$version"
-          echo "version=$version" >> "$GITHUB_OUTPUT"
-
-      - name: Setup pnpm
-        uses: pnpm/setup@fbda4c85fc2e1e08721cd8763afea8f48d60f024 # v3.0.0
-        with:
-          version: ${{ steps.pnpm-version.outputs.version }}
-          install: false
-
-      - name: Resolve pnpm store path
-        run: echo "PNPM_STORE_PATH=$(pnpm store path)" >> "$GITHUB_ENV"
-
-      - name: Setup pnpm store cache
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+      # The shared pnpm preamble — version, store cache, the safe-chain installer pin and the install
+      # (joshuafolkken/kit#2765, joshuafolkken/kit#2982).
+      - name: Setup pnpm and install dependencies
+        uses: ./.github/actions/setup-pnpm
         with:
-          path: ${{ env.PNPM_STORE_PATH }}
-          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('pnpm-lock.yaml') }}
-          restore-keys: |
-            ${{ runner.os }}-pnpm-store-
-
-      - name: Setup safe-chain
-        run: |
-          installer="$RUNNER_TEMP/install-safe-chain.sh"
-          curl --proto '=https' -fsSL "https://github.com/AikidoSec/safe-chain/releases/download/$SAFE_CHAIN_INSTALLER_VERSION/install-safe-chain.sh" -o "$installer"
-          echo "$SAFE_CHAIN_INSTALLER_SHA256  $installer" | sha256sum -c -
-          sh "$installer" --ci
-
-      - name: Install dependencies
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: pnpm install --frozen-lockfile --ignore-scripts
+          node-auth-token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Check release classification
         env: