Cut the pull-request check to about 3 minutes and move slow suites to schedules

Quality now runs five parallel jobs with cached node_modules. Unit tests use
Vitest's vmThreads pool (95s to 43s on 2 CPUs), and the @smoke set keeps boot,
sign-in, every page render and the first-run tour; tool journeys stay nightly.

The full-stack database gate, live providers, the agentic suite and the model
matrix no longer run on pull requests. Schema PRs run pgTAP on Postgres alone.
Staging E2E, the production canary and the preview note stop starting runs
that only skip, and docs.yml folds into Quality.

npm run verify runs in two lanes (231s to 98s locally). Prerender gets its own
Vite cache so a build no longer breaks a running dev server's lazy routes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Author: Programcode

.github/actions/node-deps/action.yml

@@ -0,0 +1,24 @@
+name: Node and dependencies
+description: >-
+  Node 22 with node_modules restored from the cache for this lockfile. npm ci
+  runs only on a cache miss, so most jobs skip its 40 seconds.
+
+runs:
+  using: composite
+  steps:
+    - name: Set up Node
+      uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      with:
+        node-version: 22
+
+    - name: Restore node_modules
+      id: cache
+      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+      with:
+        path: node_modules
+        key: node-modules-${{ runner.os }}-node22-${{ hashFiles('package-lock.json') }}
+
+    - name: Install dependencies
+      if: steps.cache.outputs.cache-hit != 'true'
+      shell: bash
+      run: npm ci

.github/workflows/agentic-e2e.yml

@@ -3,26 +3,13 @@ name: Agentic E2E
 # The e2e suite in agentic/ against the local stack in fake mode: an AI agent
 # drives goal-level flows and judges screens. Recorded flows replay from
 # agentic/replay without model calls; judgments always call the model.
-# It runs nightly and on pull requests that touch the app or the suite. A
-# weekly bug bash sends each persona exploring, and on demand one exploration
-# runs instead of the suite.
+# It runs nightly, not on pull requests: it takes far longer than the
+# pull-request check and each judgment is a paid model call. Run it on a
+# branch with `gh workflow run agentic-e2e.yml --ref <branch>`. A weekly bug
+# bash sends each persona exploring, and on demand one exploration runs
+# instead of the suite.
 # Not a required check. See docs/testing.md#agentic-browser-tests.
 on:
-  pull_request:
-    paths:
-      - "src/**"
-      - "packages/**"
-      - "public/**"
-      - "index.html"
-      - "supabase/functions/**"
-      - "supabase/migrations/**"
-      - "package-lock.json"
-      - "agentic/**"
-      - "e2e.config.ts"
-      - "e2e/full-stack/stack-core.ts"
-      - "e2e/full-stack/fake-openrouter.mjs"
-      - ".claude/skills/verify-debatelab/bin/verify.sh"
-      - ".github/workflows/agentic-e2e.yml"
   schedule:
     - cron: "47 3 * * *" # the suite
     - cron: "13 5 * * 0" # the weekly bug bash
@@ -89,7 +76,7 @@ jobs:
         run: npx playwright install --with-deps chromium
 
       # Without the key every agent test skips, which would read as a pass.
-      # Same accepted risk as live-e2e.yml: pull-request code runs with it.
+      # Same accepted risk as live-e2e.yml: a dispatch can run branch code with it.
       - name: Require the testing agent's model key
         env:
           LIVE_OPENROUTER_API_KEY: ${{ secrets.LIVE_OPENROUTER_API_KEY }}

.github/workflows/browser-nightly.yml

@@ -1,8 +1,10 @@
 name: Browser nightly
 
-# The full credential-free browser suite on desktop and mobile Chromium. Pull
-# requests run only the @smoke subset (deploy.yml), so this catches what the
-# subset skips, at most a day late.
+# The full credential-free browser suite on desktop and mobile Chromium, and
+# the service worker's offline test against a production build. Pull requests
+# run only the @smoke subset (deploy.yml), so this catches what the subset
+# skips, at most a day late. Run it on a branch with
+# `gh workflow run browser-nightly.yml --ref <branch>`.
 on:
   schedule:
     - cron: "47 2 * * *"
@@ -25,14 +27,7 @@ jobs:
         with:
           persist-credentials: false
 
-      - name: Set up Node
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        with:
-          node-version: 22
-          cache: npm
-
-      - name: Install dependencies
-        run: npm ci
+      - uses: ./.github/actions/node-deps
 
       - name: Cache Playwright browsers
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
@@ -50,6 +45,10 @@ jobs:
           PLAYWRIGHT_BASE_URL: http://127.0.0.1:18080
         run: npm run test:e2e
 
+      - name: Service worker offline test
+        if: ${{ !cancelled() }}
+        run: npm run build && npm run test:sw
+
       - name: Upload browser failure artifacts
         if: failure()
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1

.github/workflows/database.yml

@@ -1,51 +1,22 @@
 name: Database
 
-# Local Supabase, pgTAP, and the full-stack browser journeys. About 20 minutes,
-# so pull requests run it only when they touch the backend, the stores and
-# clients that talk to it, or the gate itself. Pushes to main use the same
-# filter, and the weekly run catches frontend-only regressions.
+# Pull requests that change the schema, its tests, or the gate run pgTAP and
+# the database scripts against Postgres alone, about 2 minutes. The full gate
+# (local Supabase, pgTAP, and the full-stack browser journeys on desktop and
+# mobile, about 20 minutes) runs nightly and on demand.
 on:
   pull_request:
     paths:
-      - "supabase/**"
-      - "services/collaboration/**"
-      - "src/lib/supabase/**"
-      - "src/lib/stores/**"
-      - "src/lib/ai/**"
-      - "packages/**"
-      - "e2e/full-stack/**"
-      - "e2e/workspace-collaboration.spec.ts"
-      - "playwright.workspace.config.ts"
-      - ".superset/db-gate.sh"
-      - ".superset/lib/**"
-      - ".superset/workspace-test.env"
+      - "supabase/migrations/**"
+      - "supabase/tests/**"
+      - "supabase/seed.sql"
+      - "supabase/config.toml"
       - "scripts/test-*.sh"
-      - "scripts/workspace-test-env.mjs"
-      - "package.json"
-      - "package-lock.json"
-      - ".github/workflows/database.yml"
-  push:
-    branches: [ "main" ]
-    paths:
-      - "supabase/**"
-      - "services/collaboration/**"
-      - "src/lib/supabase/**"
-      - "src/lib/stores/**"
-      - "src/lib/ai/**"
-      - "packages/**"
-      - "e2e/full-stack/**"
-      - "e2e/workspace-collaboration.spec.ts"
-      - "playwright.workspace.config.ts"
       - ".superset/db-gate.sh"
       - ".superset/lib/**"
-      - ".superset/workspace-test.env"
-      - "scripts/test-*.sh"
-      - "scripts/workspace-test-env.mjs"
-      - "package.json"
-      - "package-lock.json"
       - ".github/workflows/database.yml"
   schedule:
-    - cron: "23 5 * * 0"
+    - cron: "23 5 * * *"
   workflow_dispatch:
 
 permissions:
@@ -55,27 +26,38 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+env:
+  # ghcr.io rate-limits shared runners; the same images are on ECR.
+  SUPABASE_INTERNAL_IMAGE_REGISTRY: public.ecr.aws
+
 jobs:
-  database-tests:
+  pgtap:
+    if: github.event_name == 'pull_request'
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - name: Checkout code
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
-      - name: Set up Node
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        with:
-          node-version: 22
+      # The gate runs the repo-pinned Supabase CLI from node_modules.
+      - uses: ./.github/actions/node-deps
 
-      - name: Set up Supabase CLI
-        uses: supabase/setup-cli@46f7f98c7f948ad727d22c1e67fab04c223a0520 # v3.0.0
+      - name: pgTAP and database scripts
+        run: ./.superset/db-gate.sh --db-only
+
+  full-gate:
+    if: github.event_name != 'pull_request'
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
-          version: 2.121.0
+          persist-credentials: false
 
-      - name: Install dependencies
-        run: npm ci
+      - uses: ./.github/actions/node-deps
 
       - name: Cache Playwright browsers
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
@@ -88,8 +70,6 @@ jobs:
 
       - name: Database and real workspace journey
         env:
-          # ghcr.io rate-limits shared runners; the same images are on ECR.
-          SUPABASE_INTERNAL_IMAGE_REGISTRY: public.ecr.aws
           WORKSPACE_GATE_ARTIFACT_ROOT: ${{ runner.temp }}/workspace-gate
         run: ./.superset/db-gate.sh
 

.github/workflows/deploy.yml

@@ -1,14 +1,12 @@
 name: Quality
 
+# The pull-request check. Five jobs run side by side so the check takes as long
+# as the slowest one, about 2.5 minutes. Slow, paid, and full-stack suites run
+# on a schedule instead; docs/operations.md lists them.
 on:
   push:
     branches: [ "main" ]
   pull_request:
-    # Docs-only pull requests run docs.yml instead.
-    paths-ignore:
-      - "docs/**"
-      - "plans/**"
-      - "**/*.md"
   workflow_dispatch:
 
 permissions:
@@ -19,69 +17,91 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
-  quality:
+  lint:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - name: Checkout code
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
-      - name: Set up Node
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        with:
-          node-version: 22
-          cache: npm
-
-      - name: Install dependencies
-        run: npm ci
-
-      - name: Set up Deno
-        uses: denoland/setup-deno@22d081ff2d3a40755e97629de92e3bcbfa7cf2ed # v2.0.5
-        with:
-          deno-version: 2.9.6
-          cache: true
+      - uses: ./.github/actions/node-deps
 
       - name: Documentation
         run: npm run docs:check
 
       - name: Lint
         run: npm run lint
 
+  typecheck-build:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - uses: ./.github/actions/node-deps
+
       - name: Typecheck
         run: npm run typecheck
 
+      - name: Build
+        run: npm run build
+
+  unit:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - uses: ./.github/actions/node-deps
+
       - name: Test
         run: npm test
 
       - name: Collaboration service tests
         run: npm run test:collaboration
 
+  # Edge Function tests import only jsr:, npm: and https: modules, so this job
+  # needs Deno and no npm install.
+  edge:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Set up Deno
+        uses: denoland/setup-deno@22d081ff2d3a40755e97629de92e3bcbfa7cf2ed # v2.0.5
+        with:
+          deno-version: 2.9.6
+          cache: true
+
       - name: Edge function tests
         run: npm run test:edge
 
-      - name: Build
-        run: npm run build
-
-  # Runs beside quality so the pull-request check takes as long as the slower
-  # of the two. The full desktop and mobile suite runs in browser-nightly.yml.
+  # The @smoke set: the app boots, sign-in works, every public and signed-in
+  # page renders without errors, and the first-run tour starts a debate. The
+  # full desktop and mobile suite runs in browser-nightly.yml.
   browser-smoke:
     if: github.event_name == 'pull_request'
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - name: Checkout code
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
-      - name: Set up Node
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        with:
-          node-version: 22
-          cache: npm
-
-      - name: Install dependencies
-        run: npm ci
+      - uses: ./.github/actions/node-deps
 
       - name: Cache Playwright browsers
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0