CI: 3-minute pull-request check, slow suites on schedules

.github/actions/node-deps/action.yml

@@ -0,0 +1,24 @@
+name: Node and dependencies
+description: >-
+  Node 22 with node_modules restored from the cache for this lockfile. npm ci
+  runs only on a cache miss, so most jobs skip its 40 seconds.
+
+runs:
+  using: composite
+  steps:
+    - name: Set up Node
+      uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      with:
+        node-version: 22
+
+    - name: Restore node_modules
+      id: cache
+      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+      with:
+        path: node_modules
+        key: node-modules-${{ runner.os }}-node22-${{ hashFiles('package-lock.json') }}
+
+    - name: Install dependencies
+      if: steps.cache.outputs.cache-hit != 'true'
+      shell: bash
+      run: npm ci

.github/workflows/agentic-e2e.yml

@@ -3,26 +3,13 @@ name: Agentic E2E
 # The e2e suite in agentic/ against the local stack in fake mode: an AI agent
 # drives goal-level flows and judges screens. Recorded flows replay from
 # agentic/replay without model calls; judgments always call the model.
-# It runs nightly and on pull requests that touch the app or the suite. A
-# weekly bug bash sends each persona exploring, and on demand one exploration
-# runs instead of the suite.
+# It runs nightly, not on pull requests: it takes far longer than the
+# pull-request check and each judgment is a paid model call. Run it on a
+# branch with `gh workflow run agentic-e2e.yml --ref <branch>`. A weekly bug
+# bash sends each persona exploring, and on demand one exploration runs
+# instead of the suite.
 # Not a required check. See docs/testing.md#agentic-browser-tests.
 on:
-  pull_request:
-    paths:
-      - "src/**"
-      - "packages/**"
-      - "public/**"
-      - "index.html"
-      - "supabase/functions/**"
-      - "supabase/migrations/**"
-      - "package-lock.json"
-      - "agentic/**"
-      - "e2e.config.ts"
-      - "e2e/full-stack/stack-core.ts"
-      - "e2e/full-stack/fake-openrouter.mjs"
-      - ".claude/skills/verify-debatelab/bin/verify.sh"
-      - ".github/workflows/agentic-e2e.yml"
   schedule:
     - cron: "47 3 * * *" # the suite
     - cron: "13 5 * * 0" # the weekly bug bash
@@ -89,7 +76,7 @@ jobs:
         run: npx playwright install --with-deps chromium
 
       # Without the key every agent test skips, which would read as a pass.
-      # Same accepted risk as live-e2e.yml: pull-request code runs with it.
+      # Same accepted risk as live-e2e.yml: a dispatch can run branch code with it.
       - name: Require the testing agent's model key
         env:
           LIVE_OPENROUTER_API_KEY: ${{ secrets.LIVE_OPENROUTER_API_KEY }}

.github/workflows/browser-nightly.yml

@@ -1,8 +1,10 @@
 name: Browser nightly
 
-# The full credential-free browser suite on desktop and mobile Chromium. Pull
-# requests run only the @smoke subset (deploy.yml), so this catches what the
-# subset skips, at most a day late.
+# The full credential-free browser suite on desktop and mobile Chromium, and
+# the service worker's offline test against a production build. Pull requests
+# run only the @smoke subset (deploy.yml), so this catches what the subset
+# skips, at most a day late. Run it on a branch with
+# `gh workflow run browser-nightly.yml --ref <branch>`.
 on:
   schedule:
     - cron: "47 2 * * *"
@@ -25,14 +27,7 @@ jobs:
         with:
           persist-credentials: false
 
-      - name: Set up Node
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        with:
-          node-version: 22
-          cache: npm
-
-      - name: Install dependencies
-        run: npm ci
+      - uses: ./.github/actions/node-deps
 
       - name: Cache Playwright browsers
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
@@ -50,6 +45,10 @@ jobs:
           PLAYWRIGHT_BASE_URL: http://127.0.0.1:18080
         run: npm run test:e2e
 
+      - name: Service worker offline test
+        if: ${{ !cancelled() }}
+        run: npm run build && npm run test:sw
+
       - name: Upload browser failure artifacts
         if: failure()
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1

.github/workflows/database.yml

@@ -1,51 +1,22 @@
 name: Database
 
-# Local Supabase, pgTAP, and the full-stack browser journeys. About 20 minutes,
-# so pull requests run it only when they touch the backend, the stores and
-# clients that talk to it, or the gate itself. Pushes to main use the same
-# filter, and the weekly run catches frontend-only regressions.
+# Pull requests that change the schema, its tests, or the gate run pgTAP and
+# the database scripts against Postgres alone, about 2 minutes. The full gate
+# (local Supabase, pgTAP, and the full-stack browser journeys on desktop and
+# mobile, about 20 minutes) runs nightly and on demand.
 on:
   pull_request:
     paths:
-      - "supabase/**"
-      - "services/collaboration/**"
-      - "src/lib/supabase/**"
-      - "src/lib/stores/**"
-      - "src/lib/ai/**"
-      - "packages/**"
-      - "e2e/full-stack/**"
-      - "e2e/workspace-collaboration.spec.ts"
-      - "playwright.workspace.config.ts"
-      - ".superset/db-gate.sh"
-      - ".superset/lib/**"
-      - ".superset/workspace-test.env"
+      - "supabase/migrations/**"
+      - "supabase/tests/**"
+      - "supabase/seed.sql"
+      - "supabase/config.toml"
       - "scripts/test-*.sh"
-      - "scripts/workspace-test-env.mjs"
-      - "package.json"
-      - "package-lock.json"
-      - ".github/workflows/database.yml"
-  push:
-    branches: [ "main" ]
-    paths:
-      - "supabase/**"
-      - "services/collaboration/**"
-      - "src/lib/supabase/**"
-      - "src/lib/stores/**"
-      - "src/lib/ai/**"
-      - "packages/**"
-      - "e2e/full-stack/**"
-      - "e2e/workspace-collaboration.spec.ts"
-      - "playwright.workspace.config.ts"
       - ".superset/db-gate.sh"
       - ".superset/lib/**"
-      - ".superset/workspace-test.env"
-      - "scripts/test-*.sh"
-      - "scripts/workspace-test-env.mjs"
-      - "package.json"
-      - "package-lock.json"
       - ".github/workflows/database.yml"
   schedule:
-    - cron: "23 5 * * 0"
+    - cron: "23 5 * * *"
   workflow_dispatch:
 
 permissions:
@@ -55,27 +26,38 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+env:
+  # ghcr.io rate-limits shared runners; the same images are on ECR.
+  SUPABASE_INTERNAL_IMAGE_REGISTRY: public.ecr.aws
+
 jobs:
-  database-tests:
+  pgtap:
+    if: github.event_name == 'pull_request'
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - name: Checkout code
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
-      - name: Set up Node
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        with:
-          node-version: 22
+      # The gate runs the repo-pinned Supabase CLI from node_modules.
+      - uses: ./.github/actions/node-deps
 
-      - name: Set up Supabase CLI
-        uses: supabase/setup-cli@46f7f98c7f948ad727d22c1e67fab04c223a0520 # v3.0.0
+      - name: pgTAP and database scripts
+        run: ./.superset/db-gate.sh --db-only
+
+  full-gate:
+    if: github.event_name != 'pull_request'
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
-          version: 2.121.0
+          persist-credentials: false
 
-      - name: Install dependencies
-        run: npm ci
+      - uses: ./.github/actions/node-deps
 
       - name: Cache Playwright browsers
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
@@ -88,8 +70,6 @@ jobs:
 
       - name: Database and real workspace journey
         env:
-          # ghcr.io rate-limits shared runners; the same images are on ECR.
-          SUPABASE_INTERNAL_IMAGE_REGISTRY: public.ecr.aws
           WORKSPACE_GATE_ARTIFACT_ROOT: ${{ runner.temp }}/workspace-gate
         run: ./.superset/db-gate.sh
 

.github/workflows/deploy.yml

@@ -1,14 +1,12 @@
 name: Quality
 
+# The pull-request check. Five jobs run side by side so the check takes as long
+# as the slowest one, about 2.5 minutes. Slow, paid, and full-stack suites run
+# on a schedule instead; docs/operations.md lists them.
 on:
   push:
     branches: [ "main" ]
   pull_request:
-    # Docs-only pull requests run docs.yml instead.
-    paths-ignore:
-      - "docs/**"
-      - "plans/**"
-      - "**/*.md"
   workflow_dispatch:
 
 permissions:
@@ -19,69 +17,91 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
-  quality:
+  lint:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - name: Checkout code
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
-      - name: Set up Node
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        with:
-          node-version: 22
-          cache: npm
-
-      - name: Install dependencies
-        run: npm ci
-
-      - name: Set up Deno
-        uses: denoland/setup-deno@22d081ff2d3a40755e97629de92e3bcbfa7cf2ed # v2.0.5
-        with:
-          deno-version: 2.9.6
-          cache: true
+      - uses: ./.github/actions/node-deps
 
       - name: Documentation
         run: npm run docs:check
 
       - name: Lint
         run: npm run lint
 
+  typecheck-build:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - uses: ./.github/actions/node-deps
+
       - name: Typecheck
         run: npm run typecheck
 
+      - name: Build
+        run: npm run build
+
+  unit:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - uses: ./.github/actions/node-deps
+
       - name: Test
         run: npm test
 
       - name: Collaboration service tests
         run: npm run test:collaboration
 
+  # Edge Function tests import only jsr:, npm: and https: modules, so this job
+  # needs Deno and no npm install.
+  edge:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Set up Deno
+        uses: denoland/setup-deno@22d081ff2d3a40755e97629de92e3bcbfa7cf2ed # v2.0.5
+        with:
+          deno-version: 2.9.6
+          cache: true
+
       - name: Edge function tests
         run: npm run test:edge
 
-      - name: Build
-        run: npm run build
-
-  # Runs beside quality so the pull-request check takes as long as the slower
-  # of the two. The full desktop and mobile suite runs in browser-nightly.yml.
+  # The @smoke set: the app boots, sign-in works, every public and signed-in
+  # page renders without errors, and the first-run tour starts a debate. The
+  # full desktop and mobile suite runs in browser-nightly.yml.
   browser-smoke:
     if: github.event_name == 'pull_request'
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - name: Checkout code
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
-      - name: Set up Node
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        with:
-          node-version: 22
-          cache: npm
-
-      - name: Install dependencies
-        run: npm ci
+      - uses: ./.github/actions/node-deps
 
       - name: Cache Playwright browsers
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0