ci: Run GitHub Actions jobs on Namespace runners

Move all jobs to the Namespace profiles namespace-profile-sentry-javascript-small,
namespace-profile-sentry-javascript and namespace-profile-sentry-javascript-large,
by the CPU and memory that each job needs. The build.yml jobs share one cache
volume through the cache tag sentry-javascript. Pull request jobs use
sentry-javascript-pr, so a pull request cannot change the node_modules that
develop and release builds install from.

Keep node_modules, the pnpm store, the Playwright browsers and their apt
packages on Namespace cache volumes instead of the GitHub cache. Every job
runs pnpm install, which is a no-op when the volume matches pnpm-lock.yaml,
so the dependency cache key is no longer needed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Author: JPeer264

.github/actions/install-dependencies/action.yml

@@ -1,30 +1,31 @@
 name: 'Install pnpm dependencies'
-description: 'Installs pnpm dependencies and caches them.'
-
-outputs:
-  cache_key:
-    description: 'The dependency cache key'
-    value: ${{ steps.compute_lockfile_hash.outputs.hash }}
+description: 'Installs pnpm dependencies into node_modules folders on the Namespace cache volume.'
 
 runs:
   using: 'composite'
   steps:
     - name: Install pnpm
       uses: ./.github/actions/install-pnpm
 
-    - name: Compute dependency cache key
-      id: compute_lockfile_hash
-      run: node ./scripts/dependency-hash-key.js >> "$GITHUB_OUTPUT"
+    - name: List dependency paths
+      id: paths
+      run: |
+        {
+          echo 'paths<<EOF'
+          node -e 'const { workspaces } = require("./package.json"); for (const dir of [".", ...workspaces]) console.log(require("path").resolve(dir, "node_modules"))'
+          echo '~/.cache/mongodb-binaries'
+          echo 'EOF'
+        } >> "$GITHUB_OUTPUT"
       shell: bash
 
-    - name: Check dependency cache
-      uses: actions/cache@v6.1.0
-      id: cache_dependencies
+    - name: Mount dependency cache
+      uses: namespacelabs/nscloud-cache-action@1124a6f3ce44e5cf84cc22111530961f4d2a15f9 # v1.7.0
       with:
-        path: ${{ env.CACHED_DEPENDENCY_PATHS }}
-        key: ${{ steps.compute_lockfile_hash.outputs.hash }}
+        cache: pnpm
+        path: ${{ steps.paths.outputs.paths }}
 
+    # The cache volume can hold node_modules of another commit or branch. This is a no-op when they match
+    # pnpm-lock.yaml.
     - name: Install dependencies
-      if: steps.cache_dependencies.outputs.cache-hit != 'true'
       run: pnpm install --frozen-lockfile
       shell: bash

.github/actions/install-playwright/action.yml

@@ -1,5 +1,5 @@
 name: 'Install Playwright dependencies'
-description: 'Installs Playwright dependencies and caches them.'
+description: 'Installs Playwright browsers and system dependencies, keeping both on the Namespace cache volume.'
 inputs:
   browsers:
     description: 'What browsers to install.'
@@ -26,43 +26,21 @@ runs:
       shell: bash
       working-directory: ${{ inputs.cwd }}
 
-    - name: Restore cached playwright binaries
-      uses: actions/cache/restore@v6.1.0
-      id: playwright-cache
+    - name: Mount Playwright cache
+      uses: namespacelabs/nscloud-cache-action@1124a6f3ce44e5cf84cc22111530961f4d2a15f9 # v1.7.0
       if: steps.playwright-version.outputs.version != ''
       with:
-        path: |
-          ~/.cache/ms-playwright
-        # Bump the iteration when bumping runner images to use a new cache
-        key: playwright-${{ runner.os }}-iteration-1-${{ steps.playwright-version.outputs.version }}
+        cache: |
+          playwright
+          apt
 
-    # We always install all browsers, if uncached
-    # `npx` runs outside the repo, so it can't pick up a `playwright` that a parallel `pnpm install` is still linking.
-    - name: Install Playwright dependencies (uncached)
-      env:
-        PLAYWRIGHT_VERSION: ${{ steps.playwright-version.outputs.version }}
-      run: npx -y "playwright@$PLAYWRIGHT_VERSION" install chromium webkit firefox --with-deps
-      if: steps.playwright-version.outputs.version != '' && steps.playwright-cache.outputs.cache-hit != 'true'
-      shell: bash
-      working-directory: ${{ runner.temp }}
-
-    - name: Install Playwright system dependencies only (cached)
+    # Downloads only the browsers and apt packages that are not on the cache volume yet. `npx` runs outside the repo,
+    # so it can't pick up a `playwright` that a parallel `pnpm install` is still linking.
+    - name: Install Playwright
+      if: steps.playwright-version.outputs.version != ''
       env:
         PLAYWRIGHT_BROWSERS: ${{ inputs.browsers || 'chromium webkit firefox' }}
         PLAYWRIGHT_VERSION: ${{ steps.playwright-version.outputs.version }}
-      run: npx -y "playwright@$PLAYWRIGHT_VERSION" install-deps $PLAYWRIGHT_BROWSERS
-      if: steps.playwright-version.outputs.version != '' && steps.playwright-cache.outputs.cache-hit == 'true'
+      run: npx -y "playwright@$PLAYWRIGHT_VERSION" install --with-deps $PLAYWRIGHT_BROWSERS
       shell: bash
       working-directory: ${{ runner.temp }}
-
-    # Only store cache on develop branch
-    - name: Store cached playwright binaries
-      uses: actions/cache/save@v6.1.0
-      if:
-        steps.playwright-version.outputs.version != '' && github.event_name == 'push' && github.ref ==
-        'refs/heads/develop'
-      with:
-        path: |
-          ~/.cache/ms-playwright
-        # Bump the iteration when bumping runner images to use a new cache
-        key: playwright-${{ runner.os }}-iteration-1-${{ steps.playwright-version.outputs.version }}

.github/actions/restore-cache/action.yml

@@ -1,30 +1,13 @@
 name: 'Restore dependency & build cache'
-description: 'Restore the dependency & build cache.'
-
-inputs:
-  dependency_cache_key:
-    description: 'The dependency cache key'
-    required: true
+description: 'Installs dependencies from the Namespace cache volume and restores the build output.'
 
 runs:
   using: 'composite'
   steps:
-    - name: Install pnpm
-      uses: ./.github/actions/install-pnpm
-
-    - name: Check dependency cache
-      id: dep-cache
-      uses: actions/cache/restore@v6.1.0
-      with:
-        path: ${{ env.CACHED_DEPENDENCY_PATHS }}
-        key: ${{ inputs.dependency_cache_key }}
-
     - name: Restore build artifacts
       uses: actions/download-artifact@v7
       with:
         name: build-output
 
     - name: Install dependencies
-      if: steps.dep-cache.outputs.cache-hit != 'true'
-      run: pnpm install --frozen-lockfile
-      shell: bash
+      uses: ./.github/actions/install-dependencies

.github/workflows/auto-fix-issue.yml

@@ -23,7 +23,7 @@ concurrency:
 
 jobs:
   auto-fix-issue:
-    runs-on: ubuntu-latest
+    runs-on: namespace-profile-sentry-javascript
     environment: ci-triage
     permissions:
       # Required to create a new branch and commit the fix

.github/workflows/auto-release.yml

@@ -13,7 +13,7 @@ permissions:
 
 jobs:
   release:
-    runs-on: ubuntu-24.04
+    runs-on: namespace-profile-sentry-javascript-small
     name: 'Prepare a new version'
 
     steps: