feat(ci): add PR, release, and manual workflows

.github/actions/setup-tangram/action.yml

@@ -0,0 +1,35 @@
+name: Setup Tangram CI Directory
+description: Configure /opt/tangram as the Tangram build directory for CI
+
+runs:
+  using: composite
+  steps:
+    - name: Create /opt/tangram directory
+      shell: bash
+      run: mkdir -p /opt/tangram/bin
+
+    - name: Write config
+      shell: bash
+      run: |
+        cat > /opt/tangram/config.json <<'CONFIG'
+        {
+          "directory": "/opt/tangram",
+          "remotes": [{
+            "name": "default",
+            "url": "https://staging.tangram.dev"
+          }]
+        }
+        CONFIG
+
+    - name: Create tangram wrapper
+      shell: bash
+      run: |
+        cat > /opt/tangram/bin/tangram <<'WRAPPER'
+        #!/bin/sh
+        exec tangram --config /opt/tangram/config.json "$@"
+        WRAPPER
+        chmod +x /opt/tangram/bin/tangram
+
+    - name: Set TG_EXE
+      shell: bash
+      run: echo "TG_EXE=/opt/tangram/bin/tangram" >> "$GITHUB_ENV"

.github/workflows/manual.yaml

@@ -0,0 +1,38 @@
+name: Manual Dispatch
+
+on:
+  workflow_dispatch:
+    inputs:
+      packages:
+        description: Packages to process (space-separated)
+        required: true
+        type: string
+      action:
+        description: Action to run
+        required: true
+        type: choice
+        options:
+          - test
+          - publish
+          - release
+
+jobs:
+  run:
+    name: ${{ inputs.action }} (${{ matrix.platform }})
+    runs-on: ${{ matrix.runner }}
+    environment: release
+    strategy:
+      matrix:
+        include:
+          - platform: aarch64-darwin
+            runner: [self-hosted, macOS, ARM64]
+          - platform: x86_64-linux
+            runner: [self-hosted, Linux, X64]
+          - platform: aarch64-linux
+            runner: [self-hosted, Linux, ARM64]
+    steps:
+      - uses: actions/checkout@v4
+      - uses: oven-sh/setup-bun@v2
+      - uses: ./.github/actions/setup-tangram
+      - run: bun install --frozen-lockfile
+      - run: bun run auto --${{ inputs.action }} ${{ inputs.packages }}

.github/workflows/pr.yaml

@@ -0,0 +1,39 @@
+name: PR Validation
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
+
+jobs:
+  format:
+    name: Format Check
+    runs-on: [self-hosted, macOS, ARM64]
+    steps:
+      - uses: actions/checkout@v4
+      - uses: oven-sh/setup-bun@v2
+      - uses: ./.github/actions/setup-tangram
+      - run: bun install --frozen-lockfile
+      - run: bun run auto --format
+      - name: Verify no formatting changes
+        run: git diff --exit-code
+
+  test:
+    name: Test (${{ matrix.platform }})
+    needs: format
+    runs-on: ${{ matrix.runner }}
+    environment: test
+    strategy:
+      matrix:
+        include:
+          - platform: aarch64-darwin
+            runner: [self-hosted, macOS, ARM64]
+          - platform: x86_64-linux
+            runner: [self-hosted, Linux, X64]
+          - platform: aarch64-linux
+            runner: [self-hosted, Linux, ARM64]
+    steps:
+      - uses: actions/checkout@v4
+      - uses: oven-sh/setup-bun@v2
+      - uses: ./.github/actions/setup-tangram
+      - run: bun install --frozen-lockfile
+      - run: bun run auto --test

.github/workflows/release.yaml

@@ -0,0 +1,26 @@
+name: Release
+
+on:
+  push:
+    branches: [main]
+
+jobs:
+  release:
+    name: Release (${{ matrix.platform }})
+    runs-on: ${{ matrix.runner }}
+    environment: release
+    strategy:
+      matrix:
+        include:
+          - platform: aarch64-darwin
+            runner: [self-hosted, macOS, ARM64]
+          - platform: x86_64-linux
+            runner: [self-hosted, Linux, X64]
+          - platform: aarch64-linux
+            runner: [self-hosted, Linux, ARM64]
+    steps:
+      - uses: actions/checkout@v4
+      - uses: oven-sh/setup-bun@v2
+      - uses: ./.github/actions/setup-tangram
+      - run: bun install --frozen-lockfile
+      - run: bun run auto --release