ci: adopt shared @btravstack reusable CI + release workflows

.github/workflows/ci.yml

@@ -16,193 +16,22 @@ env:
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
 
 jobs:
-  format:
-    name: Format
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-
-      - name: Setup
-        uses: ./.github/actions/setup
-
-      - name: Check formatting
-        run: pnpm format --check
-
-  lint:
-    name: Lint
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-
-      - name: Setup
-        uses: ./.github/actions/setup
-
-      - name: Run linter
-        run: pnpm lint
-
-  typecheck:
-    name: Type Check
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-
-      - name: Setup
-        uses: ./.github/actions/setup
-
-      - name: Run type check
-        run: pnpm typecheck
-
-  knip:
-    name: Knip
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-
-      - name: Setup
-        uses: ./.github/actions/setup
-
-      # knip resolves the example's `../generated/prisma/client.ts` import; generate it
-      # explicitly rather than relying on the install-time postinstall hook.
-      - name: Generate the Prisma client
-        run: pnpm --filter @demesne-examples/hono-prisma-api run prisma:generate
-
-      - name: Run knip
-        run: pnpm exec knip --reporter github-actions
-
-  test:
-    name: Tests
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-
-      - name: Setup
-        uses: ./.github/actions/setup
-
-      - name: Run tests
-        run: pnpm test -- --coverage --reporter=default --reporter=github-actions
-
-      - name: Upload Coverage Report
-        if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
-        with:
-          name: coverage-report
-          path: ./**/coverage/
-          retention-days: 30
-
-  build:
-    name: Build
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-
-      - name: Setup
-        uses: ./.github/actions/setup
-
-      - name: Run build
-        run: pnpm build
-
-  node-floor:
-    name: Node 22 (engine floor)
-    runs-on: ubuntu-latest
-    # CI otherwise runs the .node-version (24). Exercise the declared `engines.node`
-    # floor so the published package is verified on the oldest supported Node.
-    steps:
-      - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-
-      - name: Setup pnpm
-        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
-
-      - name: Setup Node 22
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        with:
-          node-version: "22.19"
-          cache: pnpm
-
-      - name: Install
-        run: pnpm install --frozen-lockfile
-
-      - name: Build + test the published package on Node 22
-        run: pnpm --filter demesne build && pnpm --filter demesne test
+  ci:
+    uses: btravstack/config/.github/workflows/ci-reusable.yml@workflows-v1
+    with:
+      changeset: true
+      node-floor: "22.19"
 
   package-check:
     name: Package
+    needs: ci
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-
       - name: Setup
         uses: ./.github/actions/setup
-
       - name: Build the published package
         run: pnpm --filter demesne build
-
       - name: Validate published surface (publint + are-the-types-wrong)
         run: pnpm --filter demesne run check:package
-
-  changeset:
-    name: Changeset
-    runs-on: ubuntu-latest
-    # Only on PRs: fail if a versioned package changed without a changeset (docs/examples,
-    # which are private and unversioned, don't trigger it). `changeset add --empty` opts out.
-    # Skip the auto-generated release PR (`changeset-release/main`): it CONSUMES the changesets
-    # while bumping versions, so `changeset status` would (correctly) find none and fail.
-    if: github.event_name == 'pull_request' && github.head_ref != 'changeset-release/main'
-    steps:
-      - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-        with:
-          fetch-depth: 0
-
-      - name: Setup
-        uses: ./.github/actions/setup
-
-      - name: Require a changeset for package changes
-        run: |
-          git fetch --no-tags origin main
-          pnpm exec changeset status --since=origin/main
-
-  security-audit:
-    name: Security Audit
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-
-      - name: Setup
-        uses: ./.github/actions/setup
-
-      - name: Run security audit
-        run: pnpm audit --audit-level=high
-
-  bundle-size:
-    name: Bundle Size
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-
-      - name: Setup
-        uses: ./.github/actions/setup
-
-      - name: Build the published package
-        run: pnpm --filter demesne build
-
-      - name: Report bundle size (gzipped, shipped entry points)
-        run: |
-          echo "## Bundle size (gzipped)" >> $GITHUB_STEP_SUMMARY
-          echo "" >> $GITHUB_STEP_SUMMARY
-          echo "| File | Raw | Gzip |" >> $GITHUB_STEP_SUMMARY
-          echo "|------|-----|------|" >> $GITHUB_STEP_SUMMARY
-          for f in packages/core/dist/index.mjs packages/core/dist/index.cjs; do
-            raw=$(wc -c < "$f" | tr -d ' ')
-            gz=$(gzip -c "$f" | wc -c | tr -d ' ')
-            echo "| $(basename "$f") | ${raw} B | ${gz} B |" >> $GITHUB_STEP_SUMMARY
-          done

.github/workflows/release.yml

@@ -3,62 +3,18 @@ name: Release
 on:
   workflow_run:
     workflows: ["CI"]
-    types:
-      - completed
-    branches:
-      - main
+    types: [completed]
+    branches: [main]
 
 concurrency: ${{ github.workflow }}-${{ github.ref }}
 
-env:
-  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
-
 jobs:
   release:
-    name: Release
-    runs-on: ubuntu-latest
     if: ${{ github.event.workflow_run.conclusion == 'success' }}
     permissions:
       contents: write
       pull-requests: write
       id-token: write
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-        with:
-          # PAT so the git remote is configured with PAT credentials; the bare
-          # GITHUB_TOKEN push checkout normally sets up is treated as a bot
-          # event and would not fire `pull_request` workflows on the resulting
-          # branch — defeating the point of a PAT release.
-          token: ${{ secrets.RELEASE_PAT }}
-
-      - name: Setup
-        uses: ./.github/actions/setup
-
-      - name: Build
-        run: pnpm build
-
-      - name: Create Release Pull Request or Publish to npm
-        id: changesets
-        uses: changesets/action@a45c4d594aa4e2c509dc14a9f2b3b67ba3780d0d # v1
-        with:
-          # Use `pnpm run …` so we invoke the package.json scripts. Bare
-          # `pnpm version` collides with pnpm's built-in `version` command and
-          # silently prints `process.versions` instead of running the changeset
-          # version script.
-          version: pnpm run version
-          publish: pnpm run release
-          commit: "chore: release packages"
-          title: "chore: release packages"
-        env:
-          # PAT rather than GITHUB_TOKEN: events triggered by GITHUB_TOKEN do
-          # not start new workflow runs (anti-recursion safeguard), so the
-          # "Version Packages" PR would otherwise skip CI. Required repo secret:
-          # RELEASE_PAT (classic PAT with `repo`, or fine-grained with
-          # Contents + Pull requests read/write on this repo).
-          GITHUB_TOKEN: ${{ secrets.RELEASE_PAT }}
-          # NPM_TOKEN intentionally absent — npm Trusted Publishing uses the
-          # OIDC token minted via `id-token: write`. Each package must have a
-          # Trusted Publisher configured on npmjs.com pointing at this repo +
-          # workflow file (.github/workflows/release.yml).
+    uses: btravstack/config/.github/workflows/release-reusable.yml@workflows-v1
+    secrets:
+      RELEASE_PAT: ${{ secrets.RELEASE_PAT }}