chore: update dependencies and CI actions, save caches from dedicated jobs

.devcontainer/Dockerfile

@@ -1,4 +1,4 @@
-FROM mcr.microsoft.com/devcontainers/typescript-node:24-trixie@sha256:cba90c28e53ac2f5a8a5a0388b71b8e98bbe1a4711e0faaa6ef48b137037d4ae
+FROM mcr.microsoft.com/devcontainers/typescript-node:24-trixie@sha256:91dc841966e9b47195a1a6290a8ef9bba5ba43c02aa22f87f8669c16bb6f0f6e
 
 # VS Code/Electron share Chromium's native library requirements; playwright
 # install-deps tracks that list upstream. Electron also requires libgtk-3-0t64

.github/actions/playwright-chromium/action.yml

@@ -0,0 +1,35 @@
+name: Playwright Chromium
+description: Install Playwright's Chromium, restored from the cache when possible.
+
+inputs:
+  save-cache:
+    description: Save Chromium to the cache on a miss.
+    default: "false"
+
+runs:
+  using: composite
+  steps:
+    - name: Get Playwright version
+      id: version
+      shell: bash
+      run: echo "version=$(pnpm exec playwright-core --version | awk '{print $2}')" >> "$GITHUB_OUTPUT"
+
+    # Avoids relying on azure.archive.ubuntu.com, which can be flaky.
+    - name: Restore Chromium cache
+      id: restore
+      uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+      with:
+        path: ~/.cache/ms-playwright
+        key: playwright-chromium-${{ runner.os }}-${{ steps.version.outputs.version }}
+
+    # Composite steps can't set timeout-minutes.
+    - name: Install Chromium
+      shell: bash
+      run: timeout 5m pnpm exec playwright-core install chromium
+
+    - name: Save Chromium cache
+      if: inputs.save-cache == 'true' && steps.restore.outputs.cache-hit != 'true'
+      uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+      with:
+        path: ~/.cache/ms-playwright
+        key: ${{ steps.restore.outputs.cache-primary-key }}

.github/actions/pnpm-setup/action.yml

@@ -0,0 +1,19 @@
+name: pnpm Setup
+description: Install pnpm, Node.js, and project dependencies.
+
+inputs:
+  save-cache:
+    # pnpm/setup prunes the store even when cache-mode blocks the save.
+    description: Save the pnpm store.
+    default: "false"
+
+runs:
+  using: composite
+  steps:
+    - uses: pnpm/setup@fa36a5ef7dcdefc3a7cb25655c122e00cf6e636e # v3.1.2
+      with:
+        runtime: node@22
+        require-lockfile: true
+        # Falls back to the platform's last store, so a bump fetches only the diff.
+        cache: true
+        save-cache: ${{ inputs.save-cache }}

.github/dependabot.yml

@@ -1,7 +1,8 @@
 version: 2
 updates:
   - package-ecosystem: "github-actions"
-    directory: "/"
+    # "/" only covers workflows; composite actions need their own entries.
+    directories: ["/", "/.github/actions/*"]
     schedule:
       interval: "monthly"
     cooldown:

.github/workflows/cache.yaml

@@ -0,0 +1,44 @@
+name: Cache
+
+on:
+  push:
+    branches:
+      - main
+
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+# The only workflow that saves caches.
+cache-mode: write
+
+jobs:
+  cache:
+    name: ${{ matrix.name }}
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 20
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - { os: ubuntu-24.04, name: Linux }
+          - { os: windows-2025-vs2026, name: Windows }
+          - { os: windows-11-arm, name: Windows ARM64 }
+          - { os: macos-15, name: macOS }
+
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Setup pnpm, Node.js, and dependencies
+        uses: ./.github/actions/pnpm-setup
+        with:
+          save-cache: true
+
+      # Pixel runs on Linux only.
+      - name: Install Chromium
+        if: runner.os == 'Linux'
+        uses: ./.github/actions/playwright-chromium
+        with:
+          save-cache: true

.github/workflows/ci.yaml

@@ -12,17 +12,25 @@ on:
 permissions:
   contents: read
 
+cache-mode: read
+
+# Cancel superseded PR runs; main pushes each get their own group.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: true
+
 jobs:
   lint:
     name: Lint
     runs-on: ubuntu-24.04
+    timeout-minutes: 10
 
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: Setup pnpm, Node.js, and dependencies
-        uses: ./.github/actions/setup
+        uses: ./.github/actions/pnpm-setup
 
       - run: pnpm typecheck
 
@@ -33,11 +41,10 @@ jobs:
 
       - run: pnpm lint
 
-      - run: pnpm build
-
   test-unit:
     name: Unit Test (${{ matrix.name }}, Electron ${{ matrix.electron-version }})
     runs-on: ${{ matrix.os }}
+    timeout-minutes: 15
     strategy:
       fail-fast: false
       matrix:
@@ -51,19 +58,14 @@ jobs:
               name: Windows,
               electron-version: "latest",
             }
-          - {
-              os: windows-11-arm,
-              name: Windows ARM64,
-              electron-version: "latest",
-            }
           - { os: macos-15, name: macOS, electron-version: "latest" }
 
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: Setup pnpm, Node.js, and dependencies
-        uses: ./.github/actions/setup
+        uses: ./.github/actions/pnpm-setup
 
       - name: Run tests with Electron ${{ matrix.electron-version }}
         run: ./scripts/test-electron.sh ${{ matrix.electron-version }}
@@ -75,6 +77,7 @@ jobs:
   test-integration:
     name: Integration Test (${{ matrix.name }}, VS Code ${{ matrix.vscode-version }})
     runs-on: ${{ matrix.os }}
+    timeout-minutes: 15
     strategy:
       fail-fast: false
       matrix:
@@ -89,7 +92,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Setup pnpm, Node.js, and dependencies
-        uses: ./.github/actions/setup
+        uses: ./.github/actions/pnpm-setup
 
       - run: pnpm build
 
@@ -101,39 +104,18 @@ jobs:
   pixel:
     name: Pixel
     runs-on: ubuntu-24.04
+    timeout-minutes: 15
     # Forks and Dependabot can't read the PIXEL_KEY secret.
     if: github.repository_owner == 'coder' && github.actor != 'dependabot[bot]'
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: Setup pnpm, Node.js, and dependencies
-        uses: ./.github/actions/setup
-
-      - name: Get Playwright version
-        id: playwright-version
-        run: echo "version=$(pnpm exec playwright-core --version | awk '{print $2}')" >> "$GITHUB_OUTPUT"
-
-      # Cache the browser to avoid relying on azure.archive.ubuntu.com, which
-      # can be flaky. Only the default branch is trusted to write the cache,
-      # so PR runs cannot poison it.
-      - name: Restore Chromium cache
-        id: playwright-chromium-cache
-        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: ~/.cache/ms-playwright
-          key: playwright-chromium-${{ runner.os }}-${{ steps.playwright-version.outputs.version }}
+        uses: ./.github/actions/pnpm-setup
 
       - name: Install Chromium
-        run: pnpm exec playwright-core install chromium
-        timeout-minutes: 5
-
-      - name: Save Chromium cache
-        if: github.ref == 'refs/heads/main' && steps.playwright-chromium-cache.outputs.cache-hit != 'true'
-        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: ~/.cache/ms-playwright
-          key: ${{ steps.playwright-chromium-cache.outputs.cache-primary-key }}
+        uses: ./.github/actions/playwright-chromium
 
       # Builds the Storybook (buildCommand in pixel.jsonc) and snapshots it.
       - name: Snapshot
@@ -148,48 +130,29 @@ jobs:
   package:
     name: Package
     runs-on: ubuntu-24.04
+    timeout-minutes: 10
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: Setup pnpm, Node.js, and dependencies
-        uses: ./.github/actions/setup
-
-      - name: Get version from package.json
-        id: version
-        run: |
-          VERSION=$(node -e "console.log(require('./package.json').version)")
-          echo "version=$VERSION" >> $GITHUB_OUTPUT
-          echo "Version: $VERSION"
-
-      - name: Setup package path
-        id: setup
-        run: |
-          EXTENSION_NAME=$(node -e "console.log(require('./package.json').name)")
-          # Add commit SHA for CI builds
-          SHORT_SHA=$(git rev-parse --short HEAD)
-          PACKAGE_NAME="${EXTENSION_NAME}-${{ steps.version.outputs.version }}-${SHORT_SHA}.vsix"
-          echo "packageName=$PACKAGE_NAME" >> $GITHUB_OUTPUT
+        uses: ./.github/actions/pnpm-setup
 
       - name: Build extension
         run: pnpm build:production
 
       - name: Package extension
-        run: pnpm vsce package --no-dependencies --out "${{ steps.setup.outputs.packageName }}"
-
-      - name: Upload artifact (PR)
-        if: github.event_name == 'pull_request'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          path: ${{ steps.setup.outputs.packageName }}
-          if-no-files-found: error
-          retention-days: 7
-          archive: false
+        id: package
+        run: |
+          VSIX="$(node -p "const p = require('./package.json'); p.name + '-' + p.version")-$(git rev-parse --short HEAD).vsix"
+          pnpm vsce package --no-dependencies --out "$VSIX"
+          echo "vsix=$VSIX" >> "$GITHUB_OUTPUT"
 
-      - name: Upload artifact (main)
-        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      # Builds from main keep the default retention.
+      - name: Upload VSIX
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
-          path: ${{ steps.setup.outputs.packageName }}
+          path: ${{ steps.package.outputs.vsix }}
           if-no-files-found: error
+          retention-days: ${{ github.ref != 'refs/heads/main' && 7 || 0 }}
           archive: false

.github/workflows/pr-auto-assign.yaml

@@ -6,6 +6,8 @@ on:
 
 permissions: {}
 
+cache-mode: none
+
 jobs:
   assign-author:
     permissions:

.github/workflows/pr-title-lint.yaml

@@ -7,6 +7,8 @@ on:
 permissions:
   contents: read
 
+cache-mode: none
+
 jobs:
   title:
     runs-on: ubuntu-24.04