ci: short names, one setup action, aligned pins, explicit secrets

Naming
- Workflow files: test-build -> checks, migrations -> migrate, deploy-trigger-dev ->
  trigger-dev, docs-embeddings -> docs, companion-pr-check -> companion, stickydisk-gc
  -> disk-gc. ci.yml, helm.yml and codeql.yml keep their paths: they sign or analyze, and
  the path is part of the signer identity and code-scanning key.
- Composite actions: setup-workspace -> setup, cache-mount -> cache, docker-build -> image.
- Every workflow and job display name is a short lowercase id, matching the job id, with
  any matrix value in parentheses: ci / checks / integration (push, 1/4), image-amd64 (app).

Duplicates
- Nine hand-written Setup Bun + actions/cache + bun install blocks use the setup action.
  It gains node-version (empty keeps the runner's Node, as those jobs had) and registry-url
  (npm publishing). This also ends restoring node_modules from another lockfile through the
  `${runner.os}-bun-` prefix restore key.
- The runner expression is anchored once per file and aliased after.

Consistency
- One SHA per action: checkout v6 (helm was on v4, codeql on v5), setup-node v6 (desktop
  on v4), cache v5 (desktop-release on v4), softprops/action-gh-release v3.0.3 (was v1,
  Node 16). Redis 8.2 everywhere.
- secrets: inherit replaced by the secrets each callee reads; the checks workflow reads none.
  The dev migration gets only DEV_DATABASE_URL, and staging/production never see it.
- Timeouts on the three macOS desktop-e2e jobs (none before, so a hang billed 6 hours),
  and a cache for their Electron, electron-builder and Playwright downloads.
- Publish workflows: values moved from ${{ }} in run blocks to env, concurrency on the
  npm/PyPI publishers, persist-credentials: false on checkouts that never push.
- Dependabot for github-actions (one grouped weekly PR), and actionlint in the lint job.

Fixes
- PyPI version check matched substrings (0.1.1 "existed" once 0.1.10 did) and treated a
  PyPI outage as "not published". It now asks PyPI for the exact version and fails on
  anything but 200 or 404.

Job wiring (runner, if, needs, permissions, timeout, outputs) is unchanged: verified by
loading the old and new ci.yml, checks.yml and helm.yml and comparing every job.

Author: waleedlatif1

.agents/skills/ship/SKILL.md

@@ -66,7 +66,7 @@ When the user runs `/ship`:
 
   **Do NOT blanket-run the domain generators here.** `mship:generate` (`generate-mship-contracts.ts`) is an **umbrella** that drives all nine mothership contract generators (`mship-contracts`, `billing-protocol-contract`, `mship-tools`, the four `trace-*`, `metrics-contract`, `vfs-snapshot-contract`) and biome-formats `apps/sim/lib/mothership/generated/` — never run it *and* its constituents (they write the same files and corrupt each other in parallel), and never run it on an ordinary ship: it reads an **external** copilot-contract source that isn't checked out in most worktrees, so it hard-fails with `ENOENT` and would abort ship for an unrelated reason. `generate:pi-model-catalog` (under `apps/sim`) likewise regenerates from the installed Pi package, not repo source. `scripts/generate-docs.ts` rewrites the integration docs and client-safe catalog; run it when this PR changes their block/icon/landing-content inputs or when `integration-catalog:check` reports drift, then review its broad generated diff. Only when **this PR's diff actually touches** a domain generator's input do you regenerate it deliberately and run its matching `:check` (`bun run mship:check` / the individual `*:check`) — with the external source present.
 
-  **Phase B — run lint + every audit CI enforces, in parallel, and abort ship if any fails.** Before running the commands, compare this list with `.github/workflows/test-build.yml`; when CI adds an audit, run it and update this skill instead of trusting a stale snapshot. The env-flag audit is currently an inline workflow block rather than a package script: when `apps/sim/lib/core/config/env-flags.ts` changed, run that current workflow block verbatim instead of copying a second version into this skill. Run `bun run lint` first (it autofixes formatting and mutates files, so don't parallelize it with the read-only audits), then run the base-sensitive block-registry check, then fan the independent audits out and collect exit codes:
+  **Phase B — run lint + every audit CI enforces, in parallel, and abort ship if any fails.** Before running the commands, compare this list with `.github/workflows/checks.yml`; when CI adds an audit, run it and update this skill instead of trusting a stale snapshot. The env-flag audit is currently an inline workflow block rather than a package script: when `apps/sim/lib/core/config/env-flags.ts` changed, run that current workflow block verbatim instead of copying a second version into this skill. Run `bun run lint` first (it autofixes formatting and mutates files, so don't parallelize it with the read-only audits), then run the base-sensitive block-registry check, then fan the independent audits out and collect exit codes:
   ```bash
   # autofix formatting first (mutating; not parallel-safe with the audits). Gate its exit too —
   # a non-zero lint (unfixable errors) must abort before the audits run, not be ignored.

.github/actions/cache-mount/action.yml .github/actions/cache/action.yml.github/actions/cache-mount/action.yml renamed to .github/actions/cache/action.yml

@@ -1,4 +1,4 @@
-name: Cache Mount
+name: cache
 description: Mount a build cache directory using Blacksmith sticky disks, or the GitHub Actions cache when running on GitHub-hosted runners.
 
 inputs:

.github/actions/docker-build/action.yml .github/actions/image/action.yml.github/actions/docker-build/action.yml renamed to .github/actions/image/action.yml

@@ -1,4 +1,4 @@
-name: Docker Build and Push
+name: image
 description: Set up a buildx builder and build/push an image, using Blacksmith's builder or the upstream Docker actions on GitHub-hosted runners.
 
 inputs:
@@ -35,7 +35,7 @@ inputs:
     required: false
 
 # Registry logins must precede this action. provenance/sbom stay off: attestation
-# manifests break `imagetools create` retagging in promote-images.
+# manifests break `imagetools create` retagging in the `promote` job of ci.yml.
 runs:
   using: composite
   steps:

…ithub/actions/setup-workspace/action.yml .github/actions/setup/action.yml.github/actions/setup-workspace/action.yml renamed to .github/actions/setup/action.yml .github/actions/setup-workspace/action.yml renamed to .github/actions/setup/action.yml

@@ -1,15 +1,23 @@
-name: Setup Workspace
+name: setup
 description: Install the pinned Bun and Node toolchain, mount the dependency (and optionally Turbo) caches, and install workspace dependencies.
 
 inputs:
   provider:
-    description: The CI_PROVIDER repo variable, forwarded to cache-mount.
+    description: The CI_PROVIDER repo variable, forwarded to the cache action.
     required: false
     default: ''
   turbo-cache-key:
     description: Suffix for a Turbo cache mounted at ./.turbo. Empty skips the mount. Jobs that write Turbo entries need distinct suffixes, or last-writer-wins commits evict each other's entries.
     required: false
     default: ''
+  node-version:
+    description: Node version to install. Empty keeps the runner's preinstalled Node, for jobs that only ever ran Bun.
+    required: false
+    default: '24'
+  registry-url:
+    description: npm registry to write an .npmrc for, so `npm publish` reads NODE_AUTH_TOKEN. Empty writes none.
+    required: false
+    default: ''
 
 # Cache keys are scoped by event name, and fork PRs get their own namespace on
 # top: untrusted fork runs must never share a cache with push runs (whose caches
@@ -30,27 +38,29 @@ runs:
         bun-version: 1.4.2
 
     - name: Setup Node
+      if: inputs.node-version != ''
       uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
       with:
-        node-version: 24
+        node-version: ${{ inputs.node-version }}
+        registry-url: ${{ inputs.registry-url }}
 
     - name: Mount Bun cache
-      uses: ./.github/actions/cache-mount
+      uses: ./.github/actions/cache
       with:
         provider: ${{ inputs.provider }}
         key: ${{ github.repository }}-bun-cache-${{ github.event_name }}${{ github.event.pull_request.head.repo.fork && '-fork' || '' }}
         path: ~/.bun/install/cache
 
     - name: Mount node_modules
-      uses: ./.github/actions/cache-mount
+      uses: ./.github/actions/cache
       with:
         provider: ${{ inputs.provider }}
         key: ${{ github.repository }}-node-modules-${{ github.event_name }}${{ github.event.pull_request.head.repo.fork && '-fork' || '' }}-${{ hashFiles('bun.lock') }}
         path: ./node_modules
 
     - name: Mount Turbo cache
       if: inputs.turbo-cache-key != ''
-      uses: ./.github/actions/cache-mount
+      uses: ./.github/actions/cache
       with:
         provider: ${{ inputs.provider }}
         key: ${{ github.repository }}-${{ inputs.turbo-cache-key }}-${{ github.event_name }}${{ github.event.pull_request.head.repo.fork && '-fork' || '' }}

.github/dependabot.yml

@@ -0,0 +1,19 @@
+version: 2
+
+# GitHub Actions only: every `uses:` is pinned to a commit SHA, and without this the pins drift
+# apart (checkout had three different SHAs across workflows). One grouped PR a week keeps every
+# workflow and composite action on the same version of each action.
+updates:
+  - package-ecosystem: github-actions
+    directories:
+      - /
+      - /.github/actions/*
+    schedule:
+      interval: weekly
+    target-branch: staging
+    groups:
+      actions:
+        patterns:
+          - '*'
+    commit-message:
+      prefix: ci

.github/workflows/test-build.yml .github/workflows/checks.yml.github/workflows/test-build.yml renamed to .github/workflows/checks.yml

@@ -1,4 +1,4 @@
-name: Test and Build
+name: checks
 
 on:
   workflow_call:
@@ -8,7 +8,7 @@ permissions:
   contents: read
 
 jobs:
-  postgres-integration:
+  integration:
     # Runs the real-infrastructure test layer: every `*.integration.ts` in packages/db and
     # apps/sim, discovered by glob (`vitest run --mode integration`), against the database each
     # provisioning path produces. A new integration suite needs no workflow change.
@@ -18,7 +18,7 @@ jobs:
     # suite's files across four shards; a shard runs its files one at a time against its own
     # database. Files run serially, so a shard barely uses more than one core: 4 vCPU is enough.
     name: integration (${{ matrix.provision }}, ${{ matrix.shard }}/4)
-    runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-4vcpu-ubuntu-2404' || 'ubuntu-latest' }}
+    runs-on: &runner-4vcpu ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-4vcpu-ubuntu-2404' || 'ubuntu-latest' }}
     timeout-minutes: 20
     strategy:
       fail-fast: false
@@ -74,7 +74,7 @@ jobs:
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
 
       - name: Setup workspace
-        uses: ./.github/actions/setup-workspace
+        uses: ./.github/actions/setup
         with:
           provider: ${{ vars.CI_PROVIDER }}
 
@@ -128,7 +128,7 @@ jobs:
   #
   # SCIM runs two suites against a hosted app and is the longest group, so it keeps the 8 vCPU
   # runner; the others boot a smaller self-hosted app and fit on 4.
-  http-e2e:
+  e2e:
     name: e2e (${{ matrix.group }})
     runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && matrix.runner || 'ubuntu-latest' }}
     timeout-minutes: 20
@@ -160,7 +160,7 @@ jobs:
           --health-retries 10
       # Only the desktop executor's app is given REDIS_URL: its doorbell and presence live there.
       redis:
-        image: redis:7-alpine
+        image: redis:8.2-alpine
         ports:
           - 6379:6379
         options: >-
@@ -178,7 +178,7 @@ jobs:
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
 
       - name: Setup workspace
-        uses: ./.github/actions/setup-workspace
+        uses: ./.github/actions/setup
         with:
           provider: ${{ vars.CI_PROVIDER }}
 
@@ -205,9 +205,9 @@ jobs:
   # Pull requests skip the live desktop suite only when every change is clearly unrelated to the
   # app it drives (docs, other apps, published content). Anything else, and any failure to work
   # out the diff, runs it: a pull request that skipped it wrongly would first fail on staging.
-  desktop-live-changes:
-    name: Detect desktop tool changes
-    runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-2vcpu-ubuntu-2404' || 'ubuntu-latest' }}
+  desktop-changes:
+    name: desktop-changes
+    runs-on: &runner-2vcpu ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-2vcpu-ubuntu-2404' || 'ubuntu-latest' }}
     timeout-minutes: 5
     outputs:
       changed: ${{ github.event_name != 'pull_request' || steps.diff.outputs.changed != 'false' }}
@@ -224,11 +224,11 @@ jobs:
         run: bash .github/scripts/desktop-live-changes.sh "$BASE" >> "$GITHUB_OUTPUT"
 
   # Desktop tools in the real Electron app against a local app, on its own runner: the
-  # Electron app, the dev app and its realtime server together outgrow the http-e2e runner.
-  desktop-live-e2e:
-    name: Desktop tools against a local app
-    needs: desktop-live-changes
-    if: needs.desktop-live-changes.outputs.changed == 'true'
+  # Electron app, the dev app and its realtime server together outgrow the e2e runner.
+  desktop-live:
+    name: desktop-live
+    needs: desktop-changes
+    if: needs.desktop-changes.outputs.changed == 'true'
     runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-16vcpu-ubuntu-2404' || 'ubuntu-latest' }}
     timeout-minutes: 30
     services:
@@ -246,7 +246,7 @@ jobs:
           --health-timeout 5s
           --health-retries 10
       redis:
-        image: redis:7-alpine
+        image: redis:8.2-alpine
         ports:
           - 6379:6379
         options: >-
@@ -264,7 +264,7 @@ jobs:
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
 
       - name: Setup workspace
-        uses: ./.github/actions/setup-workspace
+        uses: ./.github/actions/setup
         with:
           provider: ${{ vars.CI_PROVIDER }}
 
@@ -348,7 +348,7 @@ jobs:
   # kept off the test shards so neither waits on the other.
   lint:
     name: lint
-    runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-4vcpu-ubuntu-2404' || 'ubuntu-latest' }}
+    runs-on: *runner-4vcpu
     timeout-minutes: 15
 
     steps:
@@ -366,7 +366,7 @@ jobs:
           fetch-depth: 2
 
       - name: Setup workspace
-        uses: ./.github/actions/setup-workspace
+        uses: ./.github/actions/setup
         with:
           provider: ${{ vars.CI_PROVIDER }}
           turbo-cache-key: turbo-cache
@@ -448,6 +448,20 @@ jobs:
       - name: Lint code
         run: bun run lint:check
 
+      # Workflow syntax, expressions, `needs` references and runner labels. ShellCheck stays off
+      # here: the existing run blocks carry info-level findings that are their own cleanup.
+      - name: Lint workflows
+        env:
+          ACTIONLINT_VERSION: 1.7.12
+          ACTIONLINT_SHA256: 8aca8db96f1b94770f1b0d72b6dddcb1ebb8123cb3712530b08cc387b349a3d8
+        run: |
+          archive="$RUNNER_TEMP/actionlint.tar.gz"
+          curl -fsSL -o "$archive" \
+            "https://github.com/rhysd/actionlint/releases/download/v${ACTIONLINT_VERSION}/actionlint_${ACTIONLINT_VERSION}_linux_amd64.tar.gz"
+          echo "${ACTIONLINT_SHA256}  ${archive}" | sha256sum -c -
+          tar -xzf "$archive" -C "$RUNNER_TEMP" actionlint
+          "$RUNNER_TEMP/actionlint" -color -shellcheck= -pyflakes=
+
       # Every zero-argument `check:*` script, run concurrently. The list is derived in
       # scripts/run-audits.ts, which also writes the per-audit timing table to the job
       # summary and annotates failures. Audits needing a base ref stay separate below.
@@ -463,7 +477,7 @@ jobs:
       # Every workspace, not just realtime. packages/emcn, packages/utils,
       # apps/desktop and apps/docs had no type check in CI at all; apps/sim's
       # source was covered only as a side effect of `next build` in the separate
-      # Build App job. Note this does NOT cover apps/sim's tests — its tsconfig
+      # `build` job. Note this does NOT cover apps/sim's tests — its tsconfig
       # excludes *.test.ts(x), and including them today surfaces ~2.2k errors,
       # so that is its own cleanup rather than a gate to switch on here.
       - name: Type-check all workspaces
@@ -502,7 +516,7 @@ jobs:
           fetch-depth: 2
 
       - name: Setup workspace
-        uses: ./.github/actions/setup-workspace
+        uses: ./.github/actions/setup
         with:
           provider: ${{ vars.CI_PROVIDER }}
           turbo-cache-key: turbo-cache-test-${{ matrix.shard }}
@@ -530,7 +544,7 @@ jobs:
   # Next.js production build, in parallel with lint + tests. Sticky disks are
   # cloned from the last committed snapshot per job and committed last-writer-
   # wins, so concurrent mounts are safe. The bun/node_modules disks are shared
-  # with test-build (the lockfile-hashed key means they only ever share when the
+  # with the test jobs (the lockfile-hashed key means they only ever share when the
   # dependency tree really is identical, so LWW loss is harmless), but the Turbo
   # cache gets its own key: with a shared key, only the last committer's new
   # entries survive each run, so the test and build Turbo entries would evict
@@ -541,7 +555,7 @@ jobs:
   # peaked 51 GB. NODE_OPTIONS' --max-old-space-size caps only Node's JS heap,
   # not the native Turbopack workers that dominate, so it cannot prevent this.
   build:
-    name: Build App
+    name: build
     runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-16vcpu-ubuntu-2404' || 'linux-x64-8-core' }}
     # Build durations crossed 15 minutes as the app grew (10m02 on Jul 29 AM,
     # 14m44 after the folders/desktop/library merges, then two straight
@@ -554,7 +568,7 @@ jobs:
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
 
       - name: Setup workspace
-        uses: ./.github/actions/setup-workspace
+        uses: ./.github/actions/setup
         with:
           provider: ${{ vars.CI_PROVIDER }}
           turbo-cache-key: turbo-cache-build
@@ -599,9 +613,9 @@ jobs:
   # suite skips on pull requests that cannot affect it); a failure or a cancellation is not.
   ci:
     name: ci
-    needs: [postgres-integration, http-e2e, desktop-live-changes, desktop-live-e2e, lint, test, build]
+    needs: [integration, e2e, desktop-changes, desktop-live, lint, test, build]
     if: ${{ !cancelled() }}
-    runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-2vcpu-ubuntu-2404' || 'ubuntu-latest' }}
+    runs-on: *runner-2vcpu
     timeout-minutes: 5
     steps:
       - name: Require every check to pass