ci: one setup, one unit run, and stricter scripts

.github/actions/setup/action.yml

@@ -0,0 +1,41 @@
+# The one install every job runs: pnpm, Node and the dependencies, in that
+# order. A local action is read from the workspace, so it cannot bring the
+# checkout that puts it there: each job checks out first, with its own options
+# (the catalog job's depth and credential-free checkout, host-drift's
+# credential-free one, the e2e jobs' full history), and then uses this.
+name: setup
+description: pnpm from packageManager, Node from .node-version (or an input), and a frozen install.
+
+inputs:
+  node-version:
+    description: The Node major to run instead of .node-version's (the engines-floor job passes its floor).
+    required: false
+    default: ""
+  registry-url:
+    description: The registry setup-node writes an .npmrc for (the publish job's).
+    required: false
+    default: ""
+
+runs:
+  using: composite
+  steps:
+    # No `version:` input: pnpm/action-setup refuses to run when it is given
+    # both that and a `packageManager` field, and package.json pins the pnpm
+    # version exactly, in `packageManager`. One source of truth, and the
+    # action reads it.
+    - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
+    # The Node every job runs is named once, in .node-version, which
+    # test/node-engine.test.ts holds at or above `engines.node`. The input is
+    # passed through the environment, never interpolated into the script.
+    - id: node
+      shell: bash
+      env:
+        NODE_VERSION_INPUT: ${{ inputs.node-version }}
+      run: echo "version=${NODE_VERSION_INPUT:-$(cat .node-version)}" >> "$GITHUB_OUTPUT"
+    - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+      with:
+        node-version: ${{ steps.node.outputs.version }}
+        cache: pnpm
+        registry-url: ${{ inputs.registry-url }}
+    - shell: bash
+      run: pnpm install --frozen-lockfile

.github/dependabot.yml

@@ -7,8 +7,12 @@ version: 2
 updates:
   # The release path. A stale action here is how a tag silently stops producing a
   # publish, and the workflow would still be green.
+  # Every directory that pins an action: the workflows (read from `/`) and the
+  # composite setup action every job runs, whose pins nothing else would see.
   - package-ecosystem: github-actions
-    directory: /
+    directories:
+      - /
+      - /.github/actions/setup
     schedule:
       interval: weekly
       day: monday
@@ -54,8 +58,9 @@ updates:
         dependency-type: development
       dependencies:
         dependency-type: production
-      # A toolchain upgrade that fails `scripts/check.ts`'s toolchain guards is
-      # expected; so is one that rewrites the lockfile wholesale.
+      # A toolchain upgrade that fails the toolchain guards in
+      # `test/toolchain.test.ts` is expected; so is one that rewrites the
+      # lockfile wholesale.
       tooling:
         patterns:
           - vite-plus
@@ -72,8 +77,9 @@ updates:
       # resolves, pinned per channel. A pull request from here would move one of
       # them, land red on `test/harness-channel.test.ts`, and take its whole
       # group with it. The nightly `host-drift` job reports when either channel
-      # moves, and P-T3 (a later phase) turns that report into the bump. Every
-      # update type is ignored; `test/harness-channel.test.ts` holds both rules.
+      # moves and proposes the bump itself, as a `chore/host-bump` pull
+      # request. Every update type is ignored; `test/harness-channel.test.ts`
+      # holds both rules.
       - dependency-name: "@deepseek-ai/*"
       - dependency-name: "@earendil-works/pi-ai"
       # React stays at 18: the bundles this plugin ships are host-bound, so a

.github/workflows/release-please.yml

@@ -11,6 +11,9 @@ permissions:
 jobs:
   release-please:
     runs-on: ubuntu-latest
+    # A run takes about a minute; bounded so a hung API call cannot hold a
+    # runner for GitHub's six hours.
+    timeout-minutes: 10
     steps:
       # Scans conventional commits (feat:/fix:) since the last tag, opens a
       # version-bump + changelog PR; merging it creates the tag + GitHub

.github/workflows/release.yml

@@ -24,15 +24,9 @@ jobs:
     timeout-minutes: 25
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      # No `version:` input: pnpm/action-setup refuses to run when it is given
-      # both that and a `packageManager` field, and package.json pins 12.6.0
-      # exactly. One source of truth, and the action reads it.
-      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
-      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
-        with:
-          node-version: 26
-          cache: pnpm
-      - run: pnpm install --frozen-lockfile
+      # pnpm from `packageManager`, Node from .node-version, a frozen install:
+      # the one setup every CI job runs.
+      - uses: ./.github/actions/setup
       # Explicit, not inherited: `lib/` otherwise exists only because the
       # `prepare` lifecycle fired during install, so any `--ignore-scripts`
       # hardening would break the release with an unrelated error.
@@ -54,16 +48,9 @@ jobs:
       packages: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      # No `version:` input: pnpm/action-setup refuses to run when it is given
-      # both that and a `packageManager` field, and package.json pins 12.6.0
-      # exactly. One source of truth, and the action reads it.
-      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
-      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+      - uses: ./.github/actions/setup
         with:
-          node-version: 26
-          cache: pnpm
           registry-url: https://registry.npmjs.org
-      - run: pnpm install --frozen-lockfile
       - name: tag matches package.json version
         run: |
           test "v$(node -p "require('./package.json').version")" = "${GITHUB_REF_NAME}" \
@@ -135,8 +122,8 @@ jobs:
       - name: verify every published target
         run: |
           VER=$(node -p "require('./package.json').version")
-          # One line: scripts/check.ts reads it to prove this list equals what
-          # publish-scoped.ts publishes (scripts/scoped-targets.ts).
+          # One line: test/package-checks.test.ts reads it to prove this list
+          # equals what publish-scoped.ts publishes (scripts/scoped-targets.ts).
           pending="dsh-opencode-patch@$VER @viztor/dsh-opencode-patch@$VER @viztor/dsh-opencode@$VER"
 
           # Polls, because a successful `npm publish` does not mean the version