chore(repo): overhaul the CI and turbo configuration

.changeset/client-log-error-instance.md

@@ -0,0 +1,5 @@
+---
+"evlog": patch
+---
+
+fix(core): serialize Error instances passed to the client `log.error()` — `name`, `message` and `stack` are non-enumerable, so an `Error` spread into a wide event contributed nothing and the call emitted an event with no error at all. The docs teach `log.error(new Error(...))` for Next.js client components, and the type only accepted a tag pair or a plain object, so the pattern failed to type check as well. Errors now land under `error` with the same shape the server logger stores, including `code`, `status`, `cause` and friends

.github/actions/setup/action.yml

@@ -0,0 +1,47 @@
+name: Setup
+description: Sets up pnpm and Node, then installs workspace dependencies.
+
+inputs:
+  install:
+    description: Set to 'false' to skip the install step entirely.
+    required: false
+    default: 'true'
+  filters:
+    description: >
+      pnpm filters restricting what gets installed, e.g. "--filter=evlog...".
+      Empty installs the whole workspace.
+    required: false
+    default: ''
+  node-version:
+    description: Overrides the version in .node-version.
+    required: false
+    default: ''
+  registry-url:
+    description: npm registry to authenticate against, for publishing jobs.
+    required: false
+    default: ''
+
+runs:
+  using: composite
+  steps:
+    - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+
+    - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
+      with:
+        node-version-file: .node-version
+        node-version: ${{ inputs.node-version }}
+        registry-url: ${{ inputs.registry-url }}
+        cache: pnpm
+
+    - name: Install dependencies
+      id: install
+      if: inputs.install == 'true'
+      # The registry flakes often enough to be worth one retry
+      continue-on-error: true
+      shell: bash
+      run: pnpm install --frozen-lockfile ${{ inputs.filters }}
+
+    - name: Install dependencies (retry)
+      if: inputs.install == 'true' && steps.install.outcome == 'failure'
+      shell: bash
+      run: pnpm install --frozen-lockfile ${{ inputs.filters }}

.github/workflows/autofix.yml

@@ -7,23 +7,22 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.number }}
+  cancel-in-progress: true
+
 jobs:
   autofix:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
 
     steps:
-      - uses: actions/checkout@v6
-
-      - name: Install pnpm
-        uses: pnpm/action-setup@v6
-
-      - uses: actions/setup-node@v6
+      # autofix.ci pushes through its own GitHub App, not the checkout token
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
-          node-version: 22
-          cache: 'pnpm'
+          persist-credentials: false
 
-      - name: 📦 Install dependencies
-        run: pnpm install --frozen-lockfile
+      - uses: ./.github/actions/setup
 
       - name: 💅 Lint code
         run: pnpm run lint:fix

.github/workflows/ci.yml

@@ -12,166 +12,147 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.event.number || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 env:
-  TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
-  TURBO_TEAM: ${{ secrets.TURBO_TEAM }}
+  TURBO_TELEMETRY_DISABLED: 1
+  # Fork PRs get no OIDC token, so they fall back to the local cache
+  IS_INTERNAL: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
+  TURBO_CACHE: ${{ (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) && 'remote:rw' || 'local:rw' }}
+  # Without this, turbo silently treats every package as affected
+  TURBO_SCM_BASE: ${{ github.event.pull_request.base.sha || github.event.before }}
 
 jobs:
-  changeset:
-    name: Changeset
-    if: |
-      github.event_name == 'pull_request'
-      && github.actor != 'renovate[bot]'
-      && !contains(github.event.pull_request.labels.*.name, 'skip-changeset')
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v6
-        with:
-          fetch-depth: 0
-      - uses: pnpm/action-setup@v6
-      - uses: actions/setup-node@v6
-        with:
-          node-version: 22
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Fetch base branch
-        run: git fetch --no-tags origin ${{ github.base_ref }}:refs/remotes/origin/${{ github.base_ref }}
-      # Only the four published packages are considered — apps/* and examples/* carry no `version`
-      # field, so changesets never sees them and a docs-only PR passes with no changeset. The
-      # privatePackages: false in .changeset/config.json keeps that true if one ever gains a
-      # version. Label a PR `skip-changeset` to bypass.
-      - name: Require a changeset
-        run: pnpm exec changeset status --since=origin/${{ github.base_ref }}
-
-  lint:
+  quality:
+    name: Lint & typecheck
     runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      contents: read
+      id-token: write # remote cache OIDC
     steps:
-      - uses: actions/checkout@v6
-      - uses: pnpm/action-setup@v6
-      - uses: actions/setup-node@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
-          node-version: 22
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
+          fetch-depth: 0 # --affected needs history
+          persist-credentials: false
+
+      - parallel:
+          - name: Set up Turborepo remote cache
+            if: env.IS_INTERNAL == 'true'
+            uses: vercel/setup-turborepo-remote-cache-action@135046f5efcadb17337d9b29b8d5b4035ae64b10 # v1.0.0
+            with:
+              team: ${{ vars.TURBO_TEAM }}
+
+          - name: Set up pnpm and Node
+            uses: ./.github/actions/setup
+
+      # apps/telemetry is left out of typecheck: its drizzle results resolve to
+      # any on a cold CI checkout, so vue-tsc reports implicit-any on every
+      # query callback. It never ran here before either. Tracked separately.
       - name: Lint
-        run: |
-          if [ "${{ github.event_name }}" = "pull_request" ]; then
-            pnpm exec turbo run lint --affected
-          else
-            pnpm run lint
-          fi
-
-  typecheck:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v6
-      - uses: pnpm/action-setup@v6
-      - uses: actions/setup-node@v6
-        with:
-          node-version: 22
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
+        run: pnpm exec turbo run lint --affected
+
       - name: Typecheck
-        run: |
-          if [ "${{ github.event_name }}" = "pull_request" ]; then
-            pnpm exec turbo run typecheck --affected
-          else
-            pnpm run typecheck
-          fi
+        run: pnpm exec turbo run typecheck --affected --filter='!evlog-telemetry'
 
   test:
+    name: Test
     runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-      matrix:
-        shard: [1, 2, 3, 4]
+    timeout-minutes: 20
+    permissions:
+      contents: read
+      id-token: write # remote cache OIDC
     steps:
-      - uses: actions/checkout@v6
-      - uses: pnpm/action-setup@v6
-      - uses: actions/setup-node@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
-          node-version: 22
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Prepare
-        run: pnpm run dev:prepare
-      - name: Build package
-        run: pnpm run build:package
-      - name: Test (shard ${{ matrix.shard }}/4)
-        working-directory: packages/evlog
-        run: pnpm exec vitest run --shard=${{ matrix.shard }}/4
+          fetch-depth: 0
+          persist-credentials: false
 
-  telemetry:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v6
-      - uses: pnpm/action-setup@v6
-      - uses: actions/setup-node@v6
-        with:
-          node-version: 22
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Test + build (apps/telemetry)
-        run: pnpm exec turbo run test build --filter=evlog-telemetry
-
-  cli:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v6
-      - uses: pnpm/action-setup@v6
-      - uses: actions/setup-node@v6
-        with:
-          node-version: 22
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Test (packages/cli)
-        run: pnpm exec turbo run test --filter=@evlog/cli
-
-  coverage:
+      - parallel:
+          - name: Set up Turborepo remote cache
+            if: env.IS_INTERNAL == 'true'
+            uses: vercel/setup-turborepo-remote-cache-action@135046f5efcadb17337d9b29b8d5b4035ae64b10 # v1.0.0
+            with:
+              team: ${{ vars.TURBO_TEAM }}
+
+          - name: Set up pnpm and Node
+            uses: ./.github/actions/setup
+
+      # evlog runs once below, under coverage, which enforces its thresholds
+      - name: Test workspace
+        run: pnpm exec turbo run test --affected --filter='!evlog'
+
+      - name: Test evlog with coverage
+        run: pnpm --filter evlog run test:coverage
+
+  examples:
+    name: Build examples
     runs-on: ubuntu-latest
+    timeout-minutes: 30
+    permissions:
+      contents: read
+      id-token: write # remote cache OIDC
     steps:
-      - uses: actions/checkout@v6
-      - uses: pnpm/action-setup@v6
-      - uses: actions/setup-node@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
-          node-version: 22
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Prepare
-        run: pnpm run dev:prepare
-      - name: Build package
-        run: pnpm run build:package
-      - name: Coverage
-        run: pnpm --filter evlog run test:coverage
+          fetch-depth: 0
+          persist-credentials: false
+
+      - parallel:
+          - name: Set up Turborepo remote cache
+            if: env.IS_INTERNAL == 'true'
+            uses: vercel/setup-turborepo-remote-cache-action@135046f5efcadb17337d9b29b8d5b4035ae64b10 # v1.0.0
+            with:
+              team: ${{ vars.TURBO_TEAM }}
+
+          - name: Set up pnpm and Node
+            uses: ./.github/actions/setup
+
+      # --continue: one broken example must not cancel the others
+      - name: Build affected examples
+        run: pnpm exec turbo run build --affected --continue --filter='./examples/*'
 
   publish:
+    name: Publish preview package
     runs-on: ubuntu-latest
-    if: github.event_name == 'pull_request' || github.event_name == 'workflow_dispatch' || (github.event_name == 'push' && github.ref == 'refs/heads/main')
-    needs: [lint, typecheck, test, telemetry, coverage, cli]
+    timeout-minutes: 15
+    # Not gated on the other jobs: a preview is most useful while the PR is red
+    if: github.event_name != 'push' || github.ref == 'refs/heads/main'
     permissions:
       contents: read
-      pull-requests: write
+      id-token: write # remote cache OIDC
+      pull-requests: write # pkg-pr-new comments the preview install command
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           fetch-depth: 0
-      - uses: pnpm/action-setup@v6
-      - uses: actions/setup-node@v6
-        with:
-          node-version: 22
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Prepare
-        run: pnpm run dev:prepare
-      - name: Build package
+          persist-credentials: false
+
+      - parallel:
+          - name: Set up Turborepo remote cache
+            if: env.IS_INTERNAL == 'true'
+            uses: vercel/setup-turborepo-remote-cache-action@135046f5efcadb17337d9b29b8d5b4035ae64b10 # v1.0.0
+            with:
+              team: ${{ vars.TURBO_TEAM }}
+
+          - name: Set up pnpm and Node
+            uses: ./.github/actions/setup
+
+      - name: Build packages
         run: pnpm run build:package
+
       - name: Publish
         run: pnpx pkg-pr-new publish --compact --no-template --pnpm './packages/evlog' './packages/nuxthub' './packages/telemetry' './packages/cli'
+
+  # Single required check, so branch protection survives job renames
+  ci:
+    name: ci
+    runs-on: ubuntu-slim
+    needs: [quality, test, examples]
+    if: always()
+    steps:
+      - name: Verify every required job succeeded
+        if: contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled')
+        run: exit 1