chore: simplify CI environment setup

.github/actions/setup/action.yml

@@ -0,0 +1,33 @@
+name: Setup
+description: Install frozen JavaScript dependencies and optionally the pinned Rust toolchain and cache.
+
+inputs:
+  rust-workspace:
+    description: Rust cache workspace mapping; leave empty to skip Rust setup.
+    required: false
+    default: ""
+  save-rust-cache:
+    description: Whether to save the Rust cache after a successful job.
+    required: false
+    default: "true"
+
+runs:
+  using: composite
+  steps:
+    - name: Set up pnpm, Node.js, and frozen dependencies
+      uses: pnpm/setup@v3
+      with:
+        cache: true
+        require-lockfile: true
+
+    - name: Setup Rust
+      if: ${{ inputs.rust-workspace != '' }}
+      shell: bash
+      run: rustup toolchain install
+
+    - name: Cache Rust
+      if: ${{ inputs.rust-workspace != '' }}
+      uses: Swatinem/rust-cache@v2
+      with:
+        workspaces: ${{ inputs.rust-workspace }}
+        save-if: ${{ inputs.save-rust-cache }}

.github/workflows/ci.yml

@@ -28,18 +28,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v7
 
-      - name: Setup pnpm
-        uses: pnpm/action-setup@v6
-
-      - name: Setup Node
-        uses: actions/setup-node@v7
-        with:
-          node-version-file: package.json
-          cache: pnpm
-          cache-dependency-path: pnpm-lock.yaml
-
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
+      - uses: ./.github/actions/setup
 
       - name: Run frontend checks
         run: pnpm check:frontend
@@ -55,27 +44,10 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v7
 
-      - name: Setup pnpm
-        uses: pnpm/action-setup@v6
-
-      - name: Setup Node
-        uses: actions/setup-node@v7
-        with:
-          node-version-file: package.json
-          cache: pnpm
-          cache-dependency-path: pnpm-lock.yaml
-
-      - name: Setup Rust
-        run: rustup toolchain install
-
-      - name: Cache Rust
-        uses: Swatinem/rust-cache@v2
+      - uses: ./.github/actions/setup
         with:
-          workspaces: "./src-tauri -> target"
-          save-if: ${{ github.ref == 'refs/heads/main' }}
-
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
+          rust-workspace: "./src-tauri -> target"
+          save-rust-cache: ${{ github.ref == 'refs/heads/main' }}
 
       - name: Run backend checks
         run: pnpm check:backend
@@ -99,27 +71,10 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v7
 
-      - name: Setup pnpm
-        uses: pnpm/action-setup@v6
-
-      - name: Setup Node
-        uses: actions/setup-node@v7
-        with:
-          node-version-file: package.json
-          cache: pnpm
-          cache-dependency-path: pnpm-lock.yaml
-
-      - name: Setup Rust
-        run: rustup toolchain install
-
-      - name: Cache Rust
-        uses: Swatinem/rust-cache@v2
+      - uses: ./.github/actions/setup
         with:
-          workspaces: "./src-tauri -> target/desktop-e2e"
-          save-if: ${{ github.ref == 'refs/heads/main' }}
-
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
+          rust-workspace: "./src-tauri -> target/desktop-e2e"
+          save-rust-cache: ${{ github.ref == 'refs/heads/main' }}
 
       - name: Build desktop E2E binary
         run: pnpm build:e2e:desktop

.github/workflows/release.yml

@@ -21,26 +21,9 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v7
 
-      - name: Setup pnpm
-        uses: pnpm/action-setup@v6
-
-      - name: Setup Node
-        uses: actions/setup-node@v7
+      - uses: ./.github/actions/setup
         with:
-          node-version-file: package.json
-          cache: pnpm
-          cache-dependency-path: pnpm-lock.yaml
-
-      - name: Setup Rust
-        run: rustup toolchain install
-
-      - name: Cache Rust
-        uses: Swatinem/rust-cache@v2
-        with:
-          workspaces: "./src-tauri -> target"
-
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
+          rust-workspace: "./src-tauri -> target"
 
       - name: Run checks
         run: pnpm check

CONTRIBUTING.md

@@ -187,6 +187,8 @@ Frontend checks enforce a coverage floor. It is a ratchet set just below the mea
 
 ### CI Enforcement
 
+CI and release jobs share [the setup action](./.github/actions/setup/action.yml), which uses `pnpm/setup` to install manifest-selected pnpm and Node.js, cache the package store, and require a frozen lockfile. Rust jobs provide a cache workspace mapping to also install the pinned toolchain and restore the appropriate target directory; CI saves Rust caches only on `main`.
+
 The `CI Gate` job in [the CI workflow](./.github/workflows/ci.yml) waits for `Frontend Checks`, `Backend Checks`, and `Desktop E2E`. It runs even when a prerequisite fails or is skipped, and passes only when every prerequisite succeeds.
 
 To change the required validation, update `ci-gate.needs` with the relevant job IDs. If a job becomes conditional, update the gate's result policy in the same pull request so intentional skips are explicit and unexpected skips still fail. Keep the `CI Gate` display name stable because GitHub branch protection uses it. When migrating branch protection, retain the existing required checks until the gate passes on a pull request and is merged, then require `CI Gate` from GitHub Actions.