ci: consolidate quality workflows and share setup via composite action

.github/actions/setup/action.yml

@@ -0,0 +1,26 @@
+name: Setup
+description: Install pnpm (version from package.json packageManager), Node.js with the pnpm store cache, and project dependencies.
+
+inputs:
+  node-version:
+    description: Node.js version to install.
+    default: "22"
+  frozen-lockfile:
+    description: Fail the install when pnpm-lock.yaml is out of date with package.json.
+    default: "true"
+
+runs:
+  using: composite
+  steps:
+    - name: Setup pnpm
+      uses: pnpm/action-setup@v4
+
+    - name: Setup Node.js
+      uses: actions/setup-node@v4
+      with:
+        node-version: ${{ inputs.node-version }}
+        cache: pnpm
+
+    - name: Install dependencies
+      shell: bash
+      run: pnpm install ${{ inputs.frozen-lockfile == 'true' && '--frozen-lockfile' || '--no-frozen-lockfile' }}

.github/workflows/bundle-size.yml

@@ -4,6 +4,9 @@ on:
   pull_request:
     branches:
       - "**"
+    paths-ignore:
+      - "**/*.md"
+      - "docs/**"
   push:
     branches:
       - main
@@ -18,19 +21,8 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v4
 
-      - name: Setup pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 10.25.0
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: 22
-          cache: pnpm
-
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
+      - name: Setup
+        uses: ./.github/actions/setup
 
       - name: Build with bundle analyzer
         run: ANALYZE=true pnpm build

.github/workflows/ci.yml

@@ -8,6 +8,9 @@ on:
   pull_request:
     branches:
       - "**"
+    paths-ignore:
+      - "**/*.md"
+      - "docs/**"
 
 jobs: 
   check-lock-files:
@@ -31,6 +34,8 @@ jobs:
           fi
           echo "⌈ Lock file validation passed"
 
+  # The single authoritative unit test run. Lint, formatting and type checks
+  # live in code-quality.yml; Storybook is built in storybook.yml.
   unit-tests:
     name: Unit Tests
     runs-on: ubuntu-latest
@@ -40,19 +45,10 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v4
 
-      - name: Setup pnpm
-        uses: pnpm/action-setup@~4
+      - name: Setup
+        uses: ./.github/actions/setup
         with:
-          version: 9
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: 22
-          cache: pnpm
-
-      - name: Install dependencies
-        run: pnpm install --no-frozen-lockfile
+          frozen-lockfile: "false"
 
       - name: Test with coverage
         run: pnpm test:coverage
@@ -65,69 +61,28 @@ jobs:
           path: coverage/
           retention-days: 30
 
-  build-and-test:
+  build:
+    name: Build
     runs-on: ubuntu-latest
     needs: check-lock-files
 
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
 
-      - name: Setup pnpm
-        uses: pnpm/action-setup@~4
+      - name: Setup
+        uses: ./.github/actions/setup
         with:
-          version: 9
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: 22
-          cache: pnpm
-
-      - name: Install dependencies
-        run: pnpm install --no-frozen-lockfile
+          frozen-lockfile: "false"
 
       - name: Validate environment variables
         run: node scripts/validate-env.js
 
       - name: Validate locale catalogs
         run: pnpm validate:i18n
-
-      - name: Lint
-        run: pnpm lint
-
-      - name: Test
-        run: pnpm test
-
-      - name: Test components
-        run: pnpm test:components
-
-      - name: Type check
-        run: pnpm typecheck
 
       - name: Build
         run: pnpm build
-
-      - name: Build Storybook
-        run: pnpm build-storybook
-
-      - name: Upload Storybook
-        uses: actions/upload-artifact@v4
-        with:
-          name: storybook-${{ github.run_id }}-${{ github.run_attempt }}
-          path: storybook-static
-          retention-days: 30
-
-      - name: Test with coverage
-        run: pnpm test:coverage
-
-      - name: Upload coverage report
-        uses: actions/upload-artifact@v4
-        if: always()
-        with:
-          name: coverage-report-${{ github.run_id }}-${{ github.run_attempt }}
-          path: coverage/
-          retention-days: 30
 
   visual-regression:
     runs-on: ubuntu-latest
@@ -137,19 +92,10 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v4
 
-      - name: Setup pnpm
-        uses: pnpm/action-setup@~4
+      - name: Setup
+        uses: ./.github/actions/setup
         with:
-          version: 9
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: 22
-          cache: pnpm
-
-      - name: Install dependencies
-        run: pnpm install --no-frozen-lockfile
+          frozen-lockfile: "false"
 
       # Pin the rendering environment so font availability matches the
       # committed baselines. Baselines are generated and verified on this

.github/workflows/code-quality.yml

@@ -4,6 +4,9 @@ on:
   pull_request:
     branches:
       - "**"
+    paths-ignore:
+      - "**/*.md"
+      - "docs/**"
   push:
     branches:
       - main
@@ -16,6 +19,8 @@ concurrency:
   group: code-quality-${{ github.ref }}
   cancel-in-progress: true
 
+# The single authoritative lint, formatting and type check. Unit tests run in
+# ci.yml.
 jobs:
   lint-and-typecheck:
     name: ESLint, Prettier & TypeScript
@@ -26,24 +31,11 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v4
 
-      # ── Tool setup ──────────────────────────────────────────────────────────
-      - name: Setup pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          # Pinned to match packageManager in package.json (pnpm@10.25.0).
-          version: 10.25.0
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: 22
-          # Restores the pnpm store cache keyed on the lock file so installs
-          # are fast on subsequent runs.
-          cache: pnpm
-
-      # ── Install ─────────────────────────────────────────────────────────────
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
+      # ── Setup ───────────────────────────────────────────────────────────────
+      # pnpm (pinned by packageManager in package.json), Node.js, the pnpm
+      # store cache and a frozen-lockfile install — see .github/actions/setup.
+      - name: Setup
+        uses: ./.github/actions/setup
 
       # ── ESLint ──────────────────────────────────────────────────────────────
       # Runs the project's configured ESLint rules (eslint.config.mjs).
@@ -66,14 +58,6 @@ jobs:
       - name: Run TypeScript type check
         run: pnpm typecheck
 
-      # ── Unit tests ──────────────────────────────────────────────────────────
-      # Runs the full unit test suite on every pull request.  `pnpm test`
-      # executes both halves of the suite (the two test scripts defined in
-      # package.json), so a failure in either half fails this required check
-      # and blocks the PR from merging.
-      - name: Run unit tests
-        run: pnpm test
-
       # ── ESLint SARIF annotations ─────────────────────────────────────────────
       # Re-run ESLint with SARIF output so findings appear inline on the PR
       # diff in GitHub Code Scanning.  Uses npx to avoid polluting the global

.github/workflows/dependency-audit.yml

@@ -20,19 +20,8 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v4
 
-      - name: Setup pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 10.25.0
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: 22
-          cache: pnpm
-
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
+      - name: Setup
+        uses: ./.github/actions/setup
 
       - name: Run dependency audit
         run: pnpm audit --audit-level=high

.github/workflows/e2e-tests.yml

@@ -4,6 +4,9 @@ on:
   pull_request:
     branches:
       - "**"
+    paths-ignore:
+      - "**/*.md"
+      - "docs/**"
 
 # Avoid running heavy E2E suites in parallel on rapid pushes to the same PR.
 concurrency:
@@ -23,17 +26,10 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v4
 
-      - name: Setup pnpm
-        uses: pnpm/action-setup@v4
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
+      - name: Setup
+        uses: ./.github/actions/setup
         with:
-          node-version: 22
-          cache: pnpm
-
-      - name: Install dependencies
-        run: pnpm install --no-frozen-lockfile
+          frozen-lockfile: "false"
 
       - name: Install Playwright browsers
         run: pnpm exec playwright install --with-deps chromium

.github/workflows/lighthouse.yml

@@ -7,6 +7,9 @@ on:
   pull_request:
     branches:
       - '**'
+    paths-ignore:
+      - "**/*.md"
+      - "docs/**"
 
 # Allow the Lighthouse action to post score comments on pull requests.
 permissions:
@@ -25,19 +28,10 @@ jobs:
         with:
           fetch-depth: 0
 
-      - name: Setup pnpm
-        uses: pnpm/action-setup@v4
+      - name: Setup
+        uses: ./.github/actions/setup
         with:
-          version: 10.25.0
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: pnpm
-
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
+          node-version: "20"
 
       - name: Build Next.js app
         run: pnpm build