From 52c9e6a6577ca85ca37a18b1f85573d18af2f752 Mon Sep 17 00:00:00 2001
From: StellarWayne <45438363+StellarWayne@users.noreply.github.com>
Date: Wed, 23 Sep 2026 16:16:17 -0700
Subject: [PATCH 1/6] ci: route Linux jobs to disposable AWS workers

---
 .github/workflows/ci.yml      | 2 +-
 .github/workflows/publish.yml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index be37c67..415f744 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -14,7 +14,7 @@ on:
 jobs:
   test:
     name: Node.js v16
-    runs-on: ubuntu-latest
+    runs-on: codebuild-stellaraf-actions-public-${{ github.run_id }}-${{ github.run_attempt }}
     steps:
       - uses: actions/checkout@v2
       - uses: actions/setup-node@v2
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 127a457..b2f00e4 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -6,7 +6,7 @@ on:
 jobs:
   publish:
     name: Node.js v16
-    runs-on: ubuntu-latest
+    runs-on: codebuild-stellaraf-actions-public-${{ github.run_id }}-${{ github.run_attempt }}
     steps:
       - uses: actions/checkout@v2
       - uses: actions/setup-node@v2

From 36abe072efa313720f8a75c9ef66da9eff3b437e Mon Sep 17 00:00:00 2001
From: StellarWayne <45438363+StellarWayne@users.noreply.github.com>
Date: Wed, 23 Sep 2026 17:30:57 -0700
Subject: [PATCH 2/6] ci: pin compatible pnpm and cache dependencies in S3

---
 .github/workflows/ci.yml      | 45 ++++++++++++++++++++++++++---------
 .github/workflows/publish.yml | 40 +++++++++++++++++++++++++++----
 2 files changed, 69 insertions(+), 16 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 415f744..d69cbc2 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -16,21 +16,44 @@ jobs:
     name: Node.js v16
     runs-on: codebuild-stellaraf-actions-public-${{ github.run_id }}-${{ github.run_attempt }}
     steps:
-      - uses: actions/checkout@v2
-      - uses: actions/setup-node@v2
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
         with:
           node-version: 16
 
-      - name: (env) pnpm
-        run: curl -L https://pnpm.js.org/pnpm.js | node - add --global pnpm
-
-      - name: (env) cache
-        uses: actions/cache@v2
+      - name: Setup pinned pnpm
+        uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1
         with:
-          path: ~/.pnpm-store
-          key: ${{ runner.os }}-${{ matrix.nodejs }}-${{ hashFiles('**/package.json') }}
-          restore-keys: ${{ runner.os }}-${{ matrix.nodejs }}-
-
+          version: 6.35.1
+      - name: Resolve dependency cache
+        id: ci-pnpm-cache
+        shell: bash
+        run: |
+          echo "path=$(pnpm store path --silent)" >> "$GITHUB_OUTPUT"
+          echo "node=$(node --version)" >> "$GITHUB_OUTPUT"
+      - name: Export temporary AWS cache credentials
+        shell: bash
+        run: |
+          python3 - <<'PYTHON'
+          import json, os, subprocess
+          credentials = json.loads(subprocess.check_output(['aws', 'configure', 'export-credentials', '--format', 'process']))
+          with open(os.environ['GITHUB_ENV'], 'a') as output:
+              for source, target in [('AccessKeyId', 'AWS_ACCESS_KEY_ID'), ('SecretAccessKey', 'AWS_SECRET_ACCESS_KEY'), ('SessionToken', 'AWS_SESSION_TOKEN')]:
+                  value = credentials[source]
+                  if not value or '\n' in value or '\r' in value:
+                      raise RuntimeError('Invalid temporary credential value')
+                  print('::add-mask::' + value)
+                  output.write(target + '=' + value + '\n')
+          PYTHON
+      - name: Restore pnpm download store from S3
+        uses: tespkg/actions-cache@e07e2d4953dc8c020d447363e5064e36d04f3cf9
+        with:
+          region: us-west-1
+          bucket: stellaraf-public-ci-961341522852-us-west-1
+          path: ${{ steps.ci-pnpm-cache.outputs.path }}
+          key: cache/${{ github.repository }}/${{ github.ref }}/pnpm-6.35.1/${{ runner.os }}/${{ runner.arch }}/${{ steps.ci-pnpm-cache.outputs.node }}/${{ 
+            hashFiles('pnpm-lock.yaml') }}
+          use-fallback: false
       - name: Install
         run: pnpm install
 
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index b2f00e4..425fbe6 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -8,14 +8,44 @@ jobs:
     name: Node.js v16
     runs-on: codebuild-stellaraf-actions-public-${{ github.run_id }}-${{ github.run_attempt }}
     steps:
-      - uses: actions/checkout@v2
-      - uses: actions/setup-node@v2
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
         with:
           node-version: 16
 
-      - name: (env) pnpm
-        run: curl -L https://pnpm.js.org/pnpm.js | node - add --global pnpm
-
+      - name: Setup pinned pnpm
+        uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1
+        with:
+          version: 6.35.1
+      - name: Resolve dependency cache
+        id: ci-pnpm-cache
+        shell: bash
+        run: |
+          echo "path=$(pnpm store path --silent)" >> "$GITHUB_OUTPUT"
+          echo "node=$(node --version)" >> "$GITHUB_OUTPUT"
+      - name: Export temporary AWS cache credentials
+        shell: bash
+        run: |
+          python3 - <<'PYTHON'
+          import json, os, subprocess
+          credentials = json.loads(subprocess.check_output(['aws', 'configure', 'export-credentials', '--format', 'process']))
+          with open(os.environ['GITHUB_ENV'], 'a') as output:
+              for source, target in [('AccessKeyId', 'AWS_ACCESS_KEY_ID'), ('SecretAccessKey', 'AWS_SECRET_ACCESS_KEY'), ('SessionToken', 'AWS_SESSION_TOKEN')]:
+                  value = credentials[source]
+                  if not value or '\n' in value or '\r' in value:
+                      raise RuntimeError('Invalid temporary credential value')
+                  print('::add-mask::' + value)
+                  output.write(target + '=' + value + '\n')
+          PYTHON
+      - name: Restore pnpm download store from S3
+        uses: tespkg/actions-cache@e07e2d4953dc8c020d447363e5064e36d04f3cf9
+        with:
+          region: us-west-1
+          bucket: stellaraf-public-ci-961341522852-us-west-1
+          path: ${{ steps.ci-pnpm-cache.outputs.path }}
+          key: cache/${{ github.repository }}/${{ github.ref }}/pnpm-6.35.1/${{ runner.os }}/${{ runner.arch }}/${{ steps.ci-pnpm-cache.outputs.node }}/${{ 
+            hashFiles('pnpm-lock.yaml') }}
+          use-fallback: false
       - name: Install
         run: pnpm install
 

From be96cc428a6a2a19870e071f97087b8e44a1bb5f Mon Sep 17 00:00:00 2001
From: StellarWayne <45438363+StellarWayne@users.noreply.github.com>
Date: Wed, 23 Sep 2026 17:37:39 -0700
Subject: [PATCH 3/6] ci: pin compatible pnpm and cache dependencies in S3

---
 .github/workflows/ci.yml      | 4 ++--
 .github/workflows/publish.yml | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d69cbc2..f6b368a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -13,13 +13,13 @@ on:
 
 jobs:
   test:
-    name: Node.js v16
+    name: Node.js v22
     runs-on: codebuild-stellaraf-actions-public-${{ github.run_id }}-${{ github.run_attempt }}
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
         with:
-          node-version: 16
+          node-version: 22
 
       - name: Setup pinned pnpm
         uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 425fbe6..4c63495 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -5,13 +5,13 @@ on:
 
 jobs:
   publish:
-    name: Node.js v16
+    name: Node.js v22
     runs-on: codebuild-stellaraf-actions-public-${{ github.run_id }}-${{ github.run_attempt }}
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
         with:
-          node-version: 16
+          node-version: 22
 
       - name: Setup pinned pnpm
         uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1

From 953e8444d3c0c623750b0e3f38f0f60c392a78d7 Mon Sep 17 00:00:00 2001
From: StellarWayne <45438363+StellarWayne@users.noreply.github.com>
Date: Wed, 23 Sep 2026 17:44:17 -0700
Subject: [PATCH 4/6] ci: pin compatible pnpm and cache dependencies in S3

---
 .github/workflows/ci.yml      | 6 +++---
 .github/workflows/publish.yml | 6 +++---
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index f6b368a..1ab9ffa 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -24,7 +24,7 @@ jobs:
       - name: Setup pinned pnpm
         uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1
         with:
-          version: 6.35.1
+          version: 7.33.7
       - name: Resolve dependency cache
         id: ci-pnpm-cache
         shell: bash
@@ -51,11 +51,11 @@ jobs:
           region: us-west-1
           bucket: stellaraf-public-ci-961341522852-us-west-1
           path: ${{ steps.ci-pnpm-cache.outputs.path }}
-          key: cache/${{ github.repository }}/${{ github.ref }}/pnpm-6.35.1/${{ runner.os }}/${{ runner.arch }}/${{ steps.ci-pnpm-cache.outputs.node }}/${{ 
+          key: cache/${{ github.repository }}/${{ github.ref }}/pnpm-7.33.7/${{ runner.os }}/${{ runner.arch }}/${{ steps.ci-pnpm-cache.outputs.node }}/${{ 
             hashFiles('pnpm-lock.yaml') }}
           use-fallback: false
       - name: Install
-        run: pnpm install
+        run: pnpm install --frozen-lockfile
 
       - name: Compiles
         run: pnpm run build
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 4c63495..63d73da 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -16,7 +16,7 @@ jobs:
       - name: Setup pinned pnpm
         uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1
         with:
-          version: 6.35.1
+          version: 7.33.7
       - name: Resolve dependency cache
         id: ci-pnpm-cache
         shell: bash
@@ -43,11 +43,11 @@ jobs:
           region: us-west-1
           bucket: stellaraf-public-ci-961341522852-us-west-1
           path: ${{ steps.ci-pnpm-cache.outputs.path }}
-          key: cache/${{ github.repository }}/${{ github.ref }}/pnpm-6.35.1/${{ runner.os }}/${{ runner.arch }}/${{ steps.ci-pnpm-cache.outputs.node }}/${{ 
+          key: cache/${{ github.repository }}/${{ github.ref }}/pnpm-7.33.7/${{ runner.os }}/${{ runner.arch }}/${{ steps.ci-pnpm-cache.outputs.node }}/${{ 
             hashFiles('pnpm-lock.yaml') }}
           use-fallback: false
       - name: Install
-        run: pnpm install
+        run: pnpm install --frozen-lockfile
 
       - name: Build
         run: pnpm build

From 405fe885af371e52bc39b9c44ec7618b7513647d Mon Sep 17 00:00:00 2001
From: StellarWayne <45438363+StellarWayne@users.noreply.github.com>
Date: Wed, 23 Sep 2026 17:50:43 -0700
Subject: [PATCH 5/6] ci: pin compatible pnpm and cache dependencies in S3

---
 .github/workflows/ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 1ab9ffa..4ca5ebd 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -64,4 +64,4 @@ jobs:
         run: pnpm run typecheck
 
       - name: Run Tests
-        run: pnpm test
+        run: pnpm test --runInBand

From 0f4529ec9e9c17c31ab0bea73427f66b23752722 Mon Sep 17 00:00:00 2001
From: StellarWayne <45438363+StellarWayne@users.noreply.github.com>
Date: Wed, 23 Sep 2026 17:55:23 -0700
Subject: [PATCH 6/6] ci: pin compatible pnpm and cache dependencies in S3

---
 .github/workflows/ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 4ca5ebd..4996ae2 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -64,4 +64,4 @@ jobs:
         run: pnpm run typecheck
 
       - name: Run Tests
-        run: pnpm test --runInBand
+        run: pnpm exec jest --runInBand