From 4d75e4229d598cd7c513308f487486ce5b632724 Mon Sep 17 00:00:00 2001
From: Guido X Jansen <x@gui.do>
Date: Wed, 4 Mar 2026 17:33:26 +0100
Subject: [PATCH] fix(ci): restore CI optimizations lost during rebase (#166)

PR #153 rebase accidentally reverted ci.yml to pre-optimization state
due to inverted --ours/--theirs semantics during git rebase. This
restores all optimizations from PRs #150-#153:

- Job timeouts on all jobs
- Composite setup action (.github/actions/setup/)
- Lexicons build caching
- Next.js build cache (shared between build and accessibility)
- Job dependency graph (lint/typecheck/test -> build -> accessibility)
- Path filters for PRs (skip CI on docs-only changes)
- --prod flag on security audit
---
 .github/workflows/ci.yml | 174 +++++++++++----------------------------
 1 file changed, 48 insertions(+), 126 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 1480364..4a432e7 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -5,6 +5,20 @@ on:
     branches: [main, develop]
   pull_request:
     branches: [main, develop]
+    paths:
+      - 'src/**'
+      - 'e2e/**'
+      - 'public/**'
+      - 'package.json'
+      - 'pnpm-lock.yaml'
+      - 'tsconfig.json'
+      - 'vitest.config.ts'
+      - 'next.config.ts'
+      - 'tailwind.config.*'
+      - 'playwright.config.ts'
+      - 'lighthouserc.json'
+      - '.github/workflows/ci.yml'
+      - '.github/actions/**'
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -17,152 +31,77 @@ jobs:
   lint:
     name: Lint
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
-      - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-
-      - name: Install pnpm
-        uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4
-
-      - name: Setup Node.js
-        uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
-        with:
-          node-version: '24'
-          cache: 'pnpm'
-
-      - name: Clone and build barazo-lexicons
-        run: |
-          git clone --depth 1 https://github.com/barazo-forum/barazo-lexicons.git ../barazo-lexicons
-          cd ../barazo-lexicons && pnpm install --ignore-scripts && pnpm run build
-
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: ./.github/actions/setup
       - name: Run ESLint
         run: pnpm lint
-
       - name: Check formatting
         run: pnpm format:check
 
   typecheck:
     name: Type Check
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
-      - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-
-      - name: Install pnpm
-        uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4
-
-      - name: Setup Node.js
-        uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
-        with:
-          node-version: '24'
-          cache: 'pnpm'
-
-      - name: Clone and build barazo-lexicons
-        run: |
-          git clone --depth 1 https://github.com/barazo-forum/barazo-lexicons.git ../barazo-lexicons
-          cd ../barazo-lexicons && pnpm install --ignore-scripts && pnpm run build
-
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: ./.github/actions/setup
       - name: Run TypeScript
         run: pnpm typecheck
 
   test:
     name: Test
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
-      - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-
-      - name: Install pnpm
-        uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4
-
-      - name: Setup Node.js
-        uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
-        with:
-          node-version: '24'
-          cache: 'pnpm'
-
-      - name: Clone and build barazo-lexicons
-        run: |
-          git clone --depth 1 https://github.com/barazo-forum/barazo-lexicons.git ../barazo-lexicons
-          cd ../barazo-lexicons && pnpm install --ignore-scripts && pnpm run build
-
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: ./.github/actions/setup
       - name: Run tests
         run: pnpm test
 
   build:
     name: Build
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     needs: [lint, typecheck, test]
     steps:
-      - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-
-      - name: Install pnpm
-        uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: ./.github/actions/setup
 
-      - name: Setup Node.js
-        uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
+      - name: Cache Next.js build
+        uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
         with:
-          node-version: '24'
-          cache: 'pnpm'
-
-      - name: Clone and build barazo-lexicons
-        run: |
-          git clone --depth 1 https://github.com/barazo-forum/barazo-lexicons.git ../barazo-lexicons
-          cd ../barazo-lexicons && pnpm install --ignore-scripts && pnpm run build
-
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
+          path: .next/cache
+          key: nextjs-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml') }}-${{ hashFiles('src/**', 'public/**', 'next.config.ts') }}
+          restore-keys: |
+            nextjs-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml') }}-
+            nextjs-${{ runner.os }}-
 
       - name: Build application
         run: pnpm build
 
-      - name: Upload build artifacts
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
-        with:
-          name: build
-          path: |
-            .next/standalone/
-            .next/static/
-          retention-days: 7
-
   accessibility:
     name: Accessibility Audit
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     needs: build
     steps:
-      - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-
-      - name: Install pnpm
-        uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4
-
-      - name: Setup Node.js
-        uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
-        with:
-          node-version: '24'
-          cache: 'pnpm'
-
-      - name: Clone and build barazo-lexicons
-        run: |
-          git clone --depth 1 https://github.com/barazo-forum/barazo-lexicons.git ../barazo-lexicons
-          cd ../barazo-lexicons && pnpm install --ignore-scripts && pnpm run build
-
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: ./.github/actions/setup
 
       - name: Install Playwright browsers
         run: pnpm exec playwright install --with-deps chromium
 
+      - name: Cache Next.js build
+        uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
+        with:
+          path: .next/cache
+          key: nextjs-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml') }}-${{ hashFiles('src/**', 'public/**', 'next.config.ts') }}
+          restore-keys: |
+            nextjs-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml') }}-
+            nextjs-${{ runner.os }}-
+
       - name: Build application
         run: pnpm build
 
@@ -214,27 +153,10 @@ jobs:
   security:
     name: Security Scan
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
-      - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-
-      - name: Install pnpm
-        uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4
-
-      - name: Setup Node.js
-        uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
-        with:
-          node-version: '24'
-          cache: 'pnpm'
-
-      - name: Clone and build barazo-lexicons
-        run: |
-          git clone --depth 1 https://github.com/barazo-forum/barazo-lexicons.git ../barazo-lexicons
-          cd ../barazo-lexicons && pnpm install --ignore-scripts && pnpm run build
-
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: ./.github/actions/setup
       - name: Security audit with retry
         run: |
           for attempt in 1 2 3; do
-- 
2.51.2