@joshuafolkken/kit 1.1050.0 → 1.1128.0

package/.claude/skills/workflow-commands/split-assessment.md

@@ -33,27 +33,13 @@ does. **There is no second criterion.** §2i's observation, the review round cap
 prerequisite each route a second filing through it, delivered by `pnpm josh rule:guard` at the run's
 second `pnpm josh issue:file` call, never the first.
 
-## Why the default is not to split
-
-**The rules were manufacturing Issues faster than runs could close them.** Execution was never the
-bottleneck; arrival was, and this assessment was one of the routes producing it: `route:split`
-accounted for **28 of the 119 open Issues (24%)**.
-
-**Separability is not scarce, which is why a test made only of it splits nearly everything.** Almost
-any request can be described as several deliverables that could each ship alone, so the old test bit on
-requests worth a handful of lines. The second question is what makes the test bite only where one Issue
-would genuinely be unverifiable in one pass. The review round cap's default and the WIP cap changed
-alongside it, in one commit.
-
 ## Diff size is not a reason to split, and that is measured
 
 **Size is a bar a split has to clear; it is never a reason to split.** Question 2 is a *minimum* — below
-it the work stays whole — and nothing makes a large diff a reason to divide one. Splitting an Issue in
-two to shorten review round 1 lengthens it, because each Issue pays round 1's fixed cost again while
-the size-dependent part is merely divided between the halves (measured in joshuafolkken/kit#1436:
-round 1's cost is dominated by a fixed part that two Issues pay twice, so there is no diff size at
-which splitting to cut it pays). **A proposal to add a size threshold that splits more is required to
-say why that data does not reach it.**
+it the work stays whole — and nothing makes a large diff a reason to divide one. **A proposal to add a
+size threshold that splits more is required to say why the round-1 measurement does not reach it.**
+Rationale: `docs/maintainers/split-assessment-rationale.md` → "Why the default is not to split" and
+`docs/maintainers/split-assessment-rationale.md` → "Why diff size is not a reason to split".
 
 **The size half is measured, not eyeballed — `pnpm josh split:assess`.** It counts the branch's
 changed files and changed lines with test files excluded and answers `split` / `single` on size

package/.claude/skills/workflow-commands/working-tree-hold.md

@@ -63,12 +63,13 @@ or release once the work is done; only an expired record over a clean tree is re
 **The batch entry points claim per child, not per batch.** `backlogrun` never
 call it themselves; each child runs the `fullrun` procedure, so it claims on entry and `pnpm josh
 followup` releases it at that child's merge. The command's behavior and the answer table are
-`docs/josh-commands.md` → "`josh run:hold` / `josh run:release`"; this file is the single source of
+`docs/josh-commands-automation.md` → "`josh run:hold` / `josh run:release`"; this file is the single source of
 the procedure.
 
 ## The halfrun resume
 
-**`fullrun #<N>` after a `halfrun` stop resumes it instead of claiming** (joshuafolkken/kit#2796). The
+**`fullrun #<N>` or `prrun #<N>` after a `halfrun` stop resumes it instead of claiming**
+(joshuafolkken/kit#2796, #3042). The
 stop is **recorded, never inferred**: the `halfrun` ends with `pnpm josh run:hold <N> --halfrun-stop`,
 which marks its own record (re-keying a `halfrun new`'s unnumbered one to the filed issue) — a
 `halfrun` still implementing or a `backlogrun` child leaves the same hold over the same dirty tree, and
@@ -79,3 +80,22 @@ halfrun`. **Skip the title, the plan, the split assessment, `git switch main &&
 issue (`pnpm josh issue:read <N>`), then run the gate **in full** from the refactor (`chain-rule.md` →
 "Run the review-to-merge chain") — a fix made during the manual check has had no gate — and ship as
 any `fullrun` does.
+
+## The prrun resume
+
+**`fullrun #<N>` after a `prrun` stop resumes it the same way** (joshuafolkken/kit#3023). The `prrun`
+ends with `pnpm josh run:hold <N> --prrun-stop`, which writes the commit its pull request is on into its
+own record; only a record carrying that commit is adopted. `run:entry` asks the session budget, adopts
+the hold with the `fullrun` mark and prints one of three tokens — read, never inferred:
+
+- **`resume: prrun-merged`** — a person merged the pull request. Run `pnpm josh followup "<title>
+  #<N>"` alone: it detects the merge and runs only the post-merge tail.
+- **`resume: prrun-merge`** — the branch is still on the stop's commit, both here and on the pull
+  request, and the tree is clean, so what was verified is what would merge. Skip the gate and the
+  review; run `pnpm josh followup` to merge.
+- **`resume: prrun-gate`** — the branch moved (locally, or by a push made on GitHub), its pull request
+  could not be read, or the tree is dirty: a person changed something. Run the
+  gate **in full** and the review (`chain-rule.md` → "Run the review-to-merge chain"), then ship as any
+  `fullrun` does.
+
+All three skip the title, the plan, the split assessment and the implementation.

package/.codex/hooks.json

@@ -1,52 +1,48 @@
 {
 	"hooks": {
-		"PreToolUse": [
+		"SessionStart": [
 			{
-				"matcher": "Bash|Edit|Read|Write|AskUserQuestion|apply_patch",
+				"matcher": "",
 				"hooks": [
 					{
 						"type": "command",
-						"command": "if [ -f dist/hooks/codex-hook-adapter.js ]; then node dist/hooks/codex-hook-adapter.js pretool; else pnpm exec tsx scripts/hooks/codex-hook-adapter.ts pretool; fi",
-						"timeout": 20
+						"command": "pnpm josh audit:provision",
+						"timeout": 180
 					}
 				]
 			}
 		],
-		"PostToolUse": [
+		"UserPromptSubmit": [
 			{
-				"matcher": "Edit|Write|apply_patch",
 				"hooks": [
 					{
 						"type": "command",
-						"command": "if [ -f dist/hooks/codex-hook-adapter.js ]; then node dist/hooks/codex-hook-adapter.js posttool; else pnpm exec tsx scripts/hooks/codex-hook-adapter.ts posttool; fi",
-						"timeout": 90
+						"command": "if project_root=\"$(env -u GIT_ALTERNATE_OBJECT_DIRECTORIES -u GIT_COMMON_DIR -u GIT_DIR -u GIT_INDEX_FILE -u GIT_NAMESPACE -u GIT_OBJECT_DIRECTORY -u GIT_WORK_TREE git rev-parse --show-toplevel 2>/dev/null)\"; then unset GIT_ALTERNATE_OBJECT_DIRECTORIES GIT_COMMON_DIR GIT_DIR GIT_INDEX_FILE GIT_NAMESPACE GIT_OBJECT_DIRECTORY GIT_WORK_TREE; else project_root=\"$(git rev-parse --show-toplevel)\" || exit 1; fi; cd \"$project_root\" && if node --disable-warning=ExperimentalWarning scripts/hooks/hook-bundle-ready.ts; then node dist/hooks/session-lang.js; else pnpm josh session:lang; fi",
+						"timeout": 10
 					}
 				]
 			}
 		],
-		"SessionStart": [
+		"PreToolUse": [
 			{
-				"matcher": "",
+				"matcher": "Bash|Edit|Read|Write|AskUserQuestion|apply_patch",
 				"hooks": [
 					{
 						"type": "command",
-						"command": "pnpm josh audit:provision",
-						"timeout": 180
+						"command": "if project_root=\"$(env -u GIT_ALTERNATE_OBJECT_DIRECTORIES -u GIT_COMMON_DIR -u GIT_DIR -u GIT_INDEX_FILE -u GIT_NAMESPACE -u GIT_OBJECT_DIRECTORY -u GIT_WORK_TREE git rev-parse --show-toplevel 2>/dev/null)\"; then unset GIT_ALTERNATE_OBJECT_DIRECTORIES GIT_COMMON_DIR GIT_DIR GIT_INDEX_FILE GIT_NAMESPACE GIT_OBJECT_DIRECTORY GIT_WORK_TREE; else project_root=\"$(git rev-parse --show-toplevel)\" || exit 1; fi; cd \"$project_root\" && if node --disable-warning=ExperimentalWarning scripts/hooks/hook-bundle-ready.ts; then node dist/hooks/codex-hook-adapter.js pretool; else pnpm exec tsx scripts/hooks/codex-hook-adapter.ts pretool; fi",
+						"timeout": 20
 					}
 				]
 			}
 		],
-		"UserPromptSubmit": [
+		"PostToolUse": [
 			{
+				"matcher": "Edit|Write|apply_patch",
 				"hooks": [
 					{
 						"type": "command",
-						"command": "echo 'MANDATORY before writing any implementation code: present the two-layer work summary (Now / Change / Check, then every change with its test). Full rule: Code Change Rules Step 0 in CLAUDE.md.'"
-					},
-					{
-						"type": "command",
-						"command": "if [ -f dist/hooks/session-lang.js ]; then node dist/hooks/session-lang.js; else pnpm josh session:lang; fi",
-						"timeout": 10
+						"command": "if project_root=\"$(env -u GIT_ALTERNATE_OBJECT_DIRECTORIES -u GIT_COMMON_DIR -u GIT_DIR -u GIT_INDEX_FILE -u GIT_NAMESPACE -u GIT_OBJECT_DIRECTORY -u GIT_WORK_TREE git rev-parse --show-toplevel 2>/dev/null)\"; then unset GIT_ALTERNATE_OBJECT_DIRECTORIES GIT_COMMON_DIR GIT_DIR GIT_INDEX_FILE GIT_NAMESPACE GIT_OBJECT_DIRECTORY GIT_WORK_TREE; else project_root=\"$(git rev-parse --show-toplevel)\" || exit 1; fi; cd \"$project_root\" && if node --disable-warning=ExperimentalWarning scripts/hooks/hook-bundle-ready.ts; then node dist/hooks/codex-hook-adapter.js posttool; else pnpm exec tsx scripts/hooks/codex-hook-adapter.ts posttool; fi",
+						"timeout": 90
 					}
 				]
 			}
@@ -57,7 +53,7 @@
 				"hooks": [
 					{
 						"type": "command",
-						"command": "if [ -f dist/hooks/stop-guard.js ]; then node dist/hooks/stop-guard.js; else pnpm josh stop:guard; fi",
+						"command": "if project_root=\"$(env -u GIT_ALTERNATE_OBJECT_DIRECTORIES -u GIT_COMMON_DIR -u GIT_DIR -u GIT_INDEX_FILE -u GIT_NAMESPACE -u GIT_OBJECT_DIRECTORY -u GIT_WORK_TREE git rev-parse --show-toplevel 2>/dev/null)\"; then unset GIT_ALTERNATE_OBJECT_DIRECTORIES GIT_COMMON_DIR GIT_DIR GIT_INDEX_FILE GIT_NAMESPACE GIT_OBJECT_DIRECTORY GIT_WORK_TREE; else project_root=\"$(git rev-parse --show-toplevel)\" || exit 1; fi; cd \"$project_root\" && if node --disable-warning=ExperimentalWarning scripts/hooks/hook-bundle-ready.ts; then node dist/hooks/stop-guard.js; else pnpm josh stop:guard; fi",
 						"timeout": 20
 					}
 				]

package/.github/actions/setup-node/action.yml

@@ -0,0 +1,33 @@
+name: Setup Node.js
+description: >
+  Set Node.js up at the version every kit workflow runs on, optionally pointed at a package
+  registry.
+
+# The one place the Node.js version of kit's workflows is written (joshuafolkken/kit#3084). Every
+# job used to call actions/setup-node with its own `node-version` literal, so a version move had to
+# find all of them. A job that needs a different runtime says so explicitly — `node-26-pnpm` in
+# `ci.yml` passes its own runtime to `.github/actions/setup-pnpm` instead of calling this.
+#
+# Distributed: `josh sync` writes this file into a consumer beside the workflows that call it, the
+# same way as `.github/actions/setup-pnpm`. `workflow_pin_logic` reads this file as a source of
+# canonical action pins.
+
+inputs:
+  registry-url:
+    description: Passed to actions/setup-node's `registry-url`; empty writes no `.npmrc`.
+    required: false
+    default: ''
+  scope:
+    description: Passed to actions/setup-node's `scope`, for a scoped registry.
+    required: false
+    default: ''
+
+runs:
+  using: composite
+  steps:
+    - name: Setup Node.js
+      uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      with:
+        node-version: '24'
+        registry-url: ${{ inputs.registry-url }}
+        scope: ${{ inputs.scope }}

package/.github/actions/setup-pnpm/action.yml

@@ -0,0 +1,93 @@
+name: Setup pnpm
+description: >
+  Resolve the project's pnpm version, set pnpm up, and — unless `install` is false — restore the
+  pnpm store, install safe-chain from its hash-verified release installer and install the
+  dependencies through it.
+
+# The one place kit's own workflows prepare pnpm (joshuafolkken/kit#2982). Every job that installed
+# dependencies used to carry these steps itself, and `publish.yml` — the workflow holding the npm
+# and GitHub Packages publish rights — had been left without safe-chain while `ci.yml` had it. A
+# job that calls this action cannot install without the scan.
+#
+# Distributed: `josh sync` writes this file into a consumer beside the workflows that call it
+# (`ci.yml` and `pr-classification.yml`), stamped as managed like they are (joshuafolkken/kit#3013).
+# The distributed `ci.yml` calls it exactly as kit's own does, so a consumer's CI prepares pnpm on
+# the path kit's CI runs (joshuafolkken/kit#3095). `workflow_pin_logic` reads this file as a source
+# of canonical action pins.
+
+inputs:
+  install:
+    description: Install the dependencies. False sets pnpm up alone, for a job that only runs pnpm.
+    required: false
+    default: 'true'
+  cache:
+    description: >
+      Restore and save the pnpm store. A release job passes false, so nothing another run saved
+      reaches a job that holds publish credentials.
+    required: false
+    default: 'true'
+  runtime:
+    description: Passed to pnpm/setup's `runtime` input; empty leaves the runtime to setup-node.
+    required: false
+    default: ''
+  node-auth-token:
+    description: >
+      NODE_AUTH_TOKEN for the install, for a job whose `.npmrc` authenticates to GitHub Packages.
+      Empty keeps whatever the job already has.
+    required: false
+    default: ''
+
+runs:
+  using: composite
+  steps:
+    - name: Resolve pnpm version
+      id: pnpm-version
+      shell: bash
+      run: |
+        version=$(node -p "const m = require('./package.json'); m.packageManager?.match(/^pnpm@([^+]+)/)?.[1] ?? (m.devEngines?.packageManager?.name === 'pnpm' ? m.devEngines.packageManager.version?.split('+')[0] : 'latest') ?? 'latest'")
+        test -n "$version"
+        echo "version=$version" >> "$GITHUB_OUTPUT"
+
+    - name: Setup pnpm
+      uses: pnpm/setup@fbda4c85fc2e1e08721cd8763afea8f48d60f024 # v3.0.0
+      with:
+        version: ${{ steps.pnpm-version.outputs.version }}
+        runtime: ${{ inputs.runtime }}
+        install: false
+
+    - name: Resolve pnpm store path
+      if: inputs.install == 'true' && inputs.cache == 'true'
+      shell: bash
+      run: echo "PNPM_STORE_PATH=$(pnpm store path)" >> "$GITHUB_ENV"
+
+    - name: Setup pnpm store cache
+      if: inputs.install == 'true' && inputs.cache == 'true'
+      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+      with:
+        path: ${{ env.PNPM_STORE_PATH }}
+        key: ${{ runner.os }}-pnpm-store-${{ hashFiles('pnpm-lock.yaml') }}
+        restore-keys: |
+          ${{ runner.os }}-pnpm-store-
+
+    # The safe-chain release and the SHA-256 of that release's install-safe-chain.sh. The installer
+    # puts the safe-chain binary under ~/.safe-chain/bin and adds it to PATH beside the shims;
+    # `pnpm dlx … setup-ci` left only the shims, which then let every install through without a scan
+    # (joshuafolkken/kit#2711). `josh latest` moves both together.
+    - name: Setup safe-chain
+      if: inputs.install == 'true'
+      shell: bash
+      env:
+        SAFE_CHAIN_INSTALLER_VERSION: 1.5.20
+        SAFE_CHAIN_INSTALLER_SHA256: 0ad25efe15d1fa56105157a454d647223e78eb0c53d1f85e3d10afcd722e7bfd
+      run: |
+        installer="$RUNNER_TEMP/install-safe-chain.sh"
+        curl --proto '=https' -fsSL "https://github.com/AikidoSec/safe-chain/releases/download/$SAFE_CHAIN_INSTALLER_VERSION/install-safe-chain.sh" -o "$installer"
+        echo "$SAFE_CHAIN_INSTALLER_SHA256  $installer" | sha256sum -c -
+        sh "$installer" --ci
+
+    - name: Install dependencies
+      if: inputs.install == 'true'
+      shell: bash
+      env:
+        NODE_AUTH_TOKEN: ${{ inputs.node-auth-token || env.NODE_AUTH_TOKEN }}
+      run: pnpm install --frozen-lockfile --ignore-scripts

package/.github/dependabot.yml

@@ -1,7 +1,11 @@
 version: 2
 updates:
+  # The local composite actions pin actions of their own, and Dependabot reads only the directories
+  # it is given — `/` covers `.github/workflows` and no `.github/actions/*/action.yml`.
   - package-ecosystem: 'github-actions'
-    directory: '/'
+    directories:
+      - '/'
+      - '/.github/actions/*'
     schedule:
       interval: 'weekly'
   # Version updates are disabled: `josh latest` runs at the start of every fullrun / halfrun /

package/.github/workflows/auto-tag.yml

@@ -8,6 +8,7 @@ jobs:
   create-tag:
     name: Create Git Tag if Version Changed
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     permissions:
       actions: write
       contents: write
@@ -19,9 +20,7 @@ jobs:
           fetch-depth: 2
 
       - name: Setup Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        with:
-          node-version: '24'
+        uses: ./.github/actions/setup-node
 
       - name: Check if package.json changed
         id: pkg_changed

package/.github/workflows/ci.yml

@@ -27,13 +27,10 @@ concurrency:
 # set the JOSH_PLAYWRIGHT_BROWSERS repository variable to a space-separated list to widen it.
 env:
   JOSH_PLAYWRIGHT_BROWSERS: ${{ vars.JOSH_PLAYWRIGHT_BROWSERS || 'chromium' }}
-  # The safe-chain release every "Setup safe-chain" step installs, and the SHA-256 of that release's
-  # install-safe-chain.sh. The installer puts the safe-chain binary under ~/.safe-chain/bin and
-  # adds it to PATH beside the shims; `pnpm dlx … setup-ci` left only the shims, which then let
-  # every install through without a scan (joshuafolkken/kit#2711). `josh latest` moves both together.
-  SAFE_CHAIN_INSTALLER_VERSION: 1.5.20
-  SAFE_CHAIN_INSTALLER_SHA256: 0ad25efe15d1fa56105157a454d647223e78eb0c53d1f85e3d10afcd722e7bfd
 
+# Every job that needs pnpm prepares it through `.github/actions/setup-pnpm`, which carries the
+# pnpm version resolution, the store cache, the safe-chain installer pin and the install
+# (joshuafolkken/kit#2982).
 jobs:
   node-26-pnpm:
     name: Node 26 pnpm
@@ -43,17 +40,10 @@ jobs:
       contents: read
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: Resolve pnpm version
-        id: pnpm-version
-        run: |
-          version=$(node -p "const m = require('./package.json'); m.packageManager?.match(/^pnpm@([^+]+)/)?.[1] ?? (m.devEngines?.packageManager?.name === 'pnpm' ? m.devEngines.packageManager.version?.split('+')[0] : 'latest') ?? 'latest'")
-          test -n "$version"
-          echo "version=$version" >> "$GITHUB_OUTPUT"
-      - uses: pnpm/setup@fbda4c85fc2e1e08721cd8763afea8f48d60f024 # v3.0.0
+      - uses: ./.github/actions/setup-pnpm
         with:
-          version: ${{ steps.pnpm-version.outputs.version }}
           runtime: node@26
-          install: false
+          install: 'false'
       - run: node --version && pnpm --version
 
   playwright-image:
@@ -223,7 +213,7 @@ jobs:
   static-checks:
     name: Static Checks
     needs: reuse-pr-checks
-    if: ${{ always() && needs.reuse-pr-checks.outputs.reuse != 'true' }}
+    if: ${{ !cancelled() && needs.reuse-pr-checks.outputs.reuse != 'true' }}
     runs-on: ubuntu-latest
     timeout-minutes: 8
     permissions:
@@ -234,35 +224,10 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: ./.github/actions/setup-node
         with:
-          node-version: '24'
           registry-url: 'https://npm.pkg.github.com'
 
-      - name: Resolve pnpm version
-        id: pnpm-version
-        run: |
-          version=$(node -p "const m = require('./package.json'); m.packageManager?.match(/^pnpm@([^+]+)/)?.[1] ?? (m.devEngines?.packageManager?.name === 'pnpm' ? m.devEngines.packageManager.version?.split('+')[0] : 'latest') ?? 'latest'")
-          test -n "$version"
-          echo "version=$version" >> "$GITHUB_OUTPUT"
-
-      - name: Setup pnpm
-        uses: pnpm/setup@fbda4c85fc2e1e08721cd8763afea8f48d60f024 # v3.0.0
-        with:
-          version: ${{ steps.pnpm-version.outputs.version }}
-          install: false
-
-      - name: Resolve pnpm store path
-        run: echo "PNPM_STORE_PATH=$(pnpm store path)" >> "$GITHUB_ENV"
-
-      - name: Setup pnpm store cache
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: ${{ env.PNPM_STORE_PATH }}
-          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('pnpm-lock.yaml') }}
-          restore-keys: |
-            ${{ runner.os }}-pnpm-store-
-
       - name: Setup ESLint cache
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         id: eslint-cache
@@ -317,17 +282,10 @@ jobs:
             ${{ runner.os }}-cspell-cache-${{ hashFiles('pnpm-lock.yaml') }}-
             ${{ runner.os }}-cspell-cache-
 
-      - name: Setup safe-chain
-        run: |
-          installer="$RUNNER_TEMP/install-safe-chain.sh"
-          curl --proto '=https' -fsSL "https://github.com/AikidoSec/safe-chain/releases/download/$SAFE_CHAIN_INSTALLER_VERSION/install-safe-chain.sh" -o "$installer"
-          echo "$SAFE_CHAIN_INSTALLER_SHA256  $installer" | sha256sum -c -
-          sh "$installer" --ci
-
-      - name: Install dependencies
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: pnpm install --frozen-lockfile --ignore-scripts
+      - name: Setup pnpm and install dependencies
+        uses: ./.github/actions/setup-pnpm
+        with:
+          node-auth-token: ${{ secrets.GITHUB_TOKEN }}
 
       # One step rather than five, and concurrent rather than serial (joshuafolkken/kit#1216).
       # `josh gate` is the command a developer runs before committing; it fans out to the same
@@ -366,13 +324,11 @@ jobs:
       - name: Run verification gate
         run: pnpm josh gate --verbose --no-unit
 
-  # The other half of the gate, on a runner of its own. It carries the same setup steps as
-  # `static-checks` rather than sharing them: a GitHub job is its own machine, so every job that
-  # needs Node sets Node up, and this workflow already writes that preamble once per job. The
-  # single-source alternative — a local composite action under `.github/actions/` — is ruled out by
-  # `scripts/ci/ci-yml-action-parity.test.ts`, which pins the set of action names in this file to the
-  # set in `templates/workflows/ci.yml`; a local action cannot appear in a distributed template,
-  # because the template travels to consumers without it.
+  # The other half of the gate, on a runner of its own. A GitHub job is its own machine, so this job
+  # sets Node up again; the pnpm preamble is the shared `.github/actions/setup-pnpm` action
+  # (joshuafolkken/kit#2982), which `templates/workflows/ci.yml` calls the same way, so
+  # `scripts/ci/ci-yml-action-parity.test.ts` compares the two files without the action's own pins
+  # (joshuafolkken/kit#3095).
   #
   # No ESLint cache here — nothing in this job lints — and no `--maxWorkers`: `gate-plan.ts` leaves
   # any machine below its measured 11 cores uncapped, so vitest sizes its own pool from the runner
@@ -380,7 +336,7 @@ jobs:
   unit:
     name: Unit Tests
     needs: reuse-pr-checks
-    if: ${{ always() && needs.reuse-pr-checks.outputs.reuse != 'true' }}
+    if: ${{ !cancelled() && needs.reuse-pr-checks.outputs.reuse != 'true' }}
     runs-on: ubuntu-latest
     timeout-minutes: 8
     permissions:
@@ -391,46 +347,14 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: ./.github/actions/setup-node
         with:
-          node-version: '24'
           registry-url: 'https://npm.pkg.github.com'
 
-      - name: Resolve pnpm version
-        id: pnpm-version
-        run: |
-          version=$(node -p "const m = require('./package.json'); m.packageManager?.match(/^pnpm@([^+]+)/)?.[1] ?? (m.devEngines?.packageManager?.name === 'pnpm' ? m.devEngines.packageManager.version?.split('+')[0] : 'latest') ?? 'latest'")
-          test -n "$version"
-          echo "version=$version" >> "$GITHUB_OUTPUT"
-
-      - name: Setup pnpm
-        uses: pnpm/setup@fbda4c85fc2e1e08721cd8763afea8f48d60f024 # v3.0.0
+      - name: Setup pnpm and install dependencies
+        uses: ./.github/actions/setup-pnpm
         with:
-          version: ${{ steps.pnpm-version.outputs.version }}
-          install: false
-
-      - name: Resolve pnpm store path
-        run: echo "PNPM_STORE_PATH=$(pnpm store path)" >> "$GITHUB_ENV"
-
-      - name: Setup pnpm store cache
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: ${{ env.PNPM_STORE_PATH }}
-          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('pnpm-lock.yaml') }}
-          restore-keys: |
-            ${{ runner.os }}-pnpm-store-
-
-      - name: Setup safe-chain
-        run: |
-          installer="$RUNNER_TEMP/install-safe-chain.sh"
-          curl --proto '=https' -fsSL "https://github.com/AikidoSec/safe-chain/releases/download/$SAFE_CHAIN_INSTALLER_VERSION/install-safe-chain.sh" -o "$installer"
-          echo "$SAFE_CHAIN_INSTALLER_SHA256  $installer" | sha256sum -c -
-          sh "$installer" --ci
-
-      - name: Install dependencies
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: pnpm install --frozen-lockfile --ignore-scripts
+          node-auth-token: ${{ secrets.GITHUB_TOKEN }}
 
       # **Through `josh test:unit`, never `vitest run` directly, and that is what makes a job split
       # safe rather than a hole.** The guard decides between a skip and a failure, and
@@ -457,6 +381,10 @@ jobs:
   # through with an E2E suite that never ran (see the `Detect E2E` job below, and
   # https://github.com/joshuafolkken/kit/issues/991). A skipped aggregator would have reproduced that
   # defect on the unit suite. Running always and failing explicitly is the only shape that cannot.
+  # That is also why this job alone keeps `always()` while the two halves use `!cancelled()`
+  # (joshuafolkken/kit#2980): a cancelled run must stop the minutes-long halves, but a skipped
+  # `Checks` on a cancelled head-SHA run would read as passing, so this seconds-long job still runs
+  # and fails on the halves' `cancelled` results.
   #
   # The results are read from the environment rather than interpolated into the script. `needs.*.result`
   # is a GitHub-controlled enum and not attacker-controlled, but a `${{ }}` expression spliced into a
@@ -596,35 +524,10 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: ./.github/actions/setup-node
         with:
-          node-version: '24'
           registry-url: 'https://npm.pkg.github.com'
 
-      - name: Resolve pnpm version
-        id: pnpm-version
-        run: |
-          version=$(node -p "const m = require('./package.json'); m.packageManager?.match(/^pnpm@([^+]+)/)?.[1] ?? (m.devEngines?.packageManager?.name === 'pnpm' ? m.devEngines.packageManager.version?.split('+')[0] : 'latest') ?? 'latest'")
-          test -n "$version"
-          echo "version=$version" >> "$GITHUB_OUTPUT"
-
-      - name: Setup pnpm
-        uses: pnpm/setup@fbda4c85fc2e1e08721cd8763afea8f48d60f024 # v3.0.0
-        with:
-          version: ${{ steps.pnpm-version.outputs.version }}
-          install: false
-
-      - name: Resolve pnpm store path
-        run: echo "PNPM_STORE_PATH=$(pnpm store path)" >> "$GITHUB_ENV"
-
-      - name: Setup pnpm store cache
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: ${{ env.PNPM_STORE_PATH }}
-          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('pnpm-lock.yaml') }}
-          restore-keys: |
-            ${{ runner.os }}-pnpm-store-
-
       - name: Setup build cache
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         id: build-cache
@@ -636,17 +539,10 @@ jobs:
             ${{ runner.os }}-build-cache-e2e-${{ hashFiles('pnpm-lock.yaml') }}-
             ${{ runner.os }}-build-cache-e2e-
 
-      - name: Setup safe-chain
-        run: |
-          installer="$RUNNER_TEMP/install-safe-chain.sh"
-          curl --proto '=https' -fsSL "https://github.com/AikidoSec/safe-chain/releases/download/$SAFE_CHAIN_INSTALLER_VERSION/install-safe-chain.sh" -o "$installer"
-          echo "$SAFE_CHAIN_INSTALLER_SHA256  $installer" | sha256sum -c -
-          sh "$installer" --ci
-
-      - name: Install dependencies
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: pnpm install --frozen-lockfile --ignore-scripts
+      - name: Setup pnpm and install dependencies
+        uses: ./.github/actions/setup-pnpm
+        with:
+          node-auth-token: ${{ secrets.GITHUB_TOKEN }}
 
       # Only needed on the fallback path: the container image already ships browsers
       # matching its own Playwright version. Invoked through the local bin rather than
@@ -697,6 +593,7 @@ jobs:
       needs.e2e-detect.result == 'success' &&
       (needs.e2e.result == 'success' || needs.e2e.result == 'skipped')
     runs-on: ubuntu-latest
+    timeout-minutes: 5
     permissions:
       contents: write
     steps:

package/.github/workflows/dependabot-auto-merge.yml

@@ -18,6 +18,7 @@ permissions:
 jobs:
   auto-merge:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     if: github.actor == 'dependabot[bot]'
     steps:
       - name: Fetch Dependabot metadata

package/.github/workflows/pr-classification.yml

@@ -15,13 +15,6 @@ on:
 # nothing here needs it: every run reads the pull request's labels as they stand when it runs, not as
 # its event carried them, so whichever suite GitHub counts as newest holds a current verdict.
 
-# The same safe-chain installer pin as ci.yml — the release and its install-safe-chain.sh SHA-256.
-# `pnpm dlx … setup-ci` left only shims, so the install below ran without a scan (joshuafolkken/kit#2765).
-# `josh latest` moves both together, in this file and in ci.yml.
-env:
-  SAFE_CHAIN_INSTALLER_VERSION: 1.5.20
-  SAFE_CHAIN_INSTALLER_SHA256: 0ad25efe15d1fa56105157a454d647223e78eb0c53d1f85e3d10afcd722e7bfd
-
 jobs:
   classification:
     name: Release classification
@@ -38,48 +31,17 @@ jobs:
           persist-credentials: false
 
       - name: Setup Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        with:
-          node-version: '24'
+        uses: ./.github/actions/setup-node
 
       - name: Configure GitHub Packages authentication for existing projects
         run: printf '//npm.pkg.github.com/:_authToken=${NODE_AUTH_TOKEN}\n' >> "$HOME/.npmrc"
 
-      - name: Resolve pnpm version
-        id: pnpm-version
-        run: |
-          version=$(node -p "const m = require('./package.json'); m.packageManager?.match(/^pnpm@([^+]+)/)?.[1] ?? (m.devEngines?.packageManager?.name === 'pnpm' ? m.devEngines.packageManager.version?.split('+')[0] : 'latest') ?? 'latest'")
-          test -n "$version"
-          echo "version=$version" >> "$GITHUB_OUTPUT"
-
-      - name: Setup pnpm
-        uses: pnpm/setup@fbda4c85fc2e1e08721cd8763afea8f48d60f024 # v3.0.0
+      # The shared pnpm preamble — version, store cache, the safe-chain installer pin and the install
+      # (joshuafolkken/kit#2765, joshuafolkken/kit#2982).
+      - name: Setup pnpm and install dependencies
+        uses: ./.github/actions/setup-pnpm
         with:
-          version: ${{ steps.pnpm-version.outputs.version }}
-          install: false
-
-      - name: Resolve pnpm store path
-        run: echo "PNPM_STORE_PATH=$(pnpm store path)" >> "$GITHUB_ENV"
-
-      - name: Setup pnpm store cache
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: ${{ env.PNPM_STORE_PATH }}
-          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('pnpm-lock.yaml') }}
-          restore-keys: |
-            ${{ runner.os }}-pnpm-store-
-
-      - name: Setup safe-chain
-        run: |
-          installer="$RUNNER_TEMP/install-safe-chain.sh"
-          curl --proto '=https' -fsSL "https://github.com/AikidoSec/safe-chain/releases/download/$SAFE_CHAIN_INSTALLER_VERSION/install-safe-chain.sh" -o "$installer"
-          echo "$SAFE_CHAIN_INSTALLER_SHA256  $installer" | sha256sum -c -
-          sh "$installer" --ci
-
-      - name: Install dependencies
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: pnpm install --frozen-lockfile --ignore-scripts
+          node-auth-token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Check release classification
         env: