ci: the checkout → setup-node → setup-pnpm → store-cache → install sequence is hand-copied into about 41 jobs (58 hardcoded node "22" literals, 35 identical cache keys), and the pnpm store cache still post-saves on pull_request runs

Filing gate ③: a maintainer-directed task. Maintainer, 2026-10-26, verbatim: 「完整的评估本项目，还有哪些可以优化的地方。包括 ci 和文档」 then 「使用 pm-dispatch 技能创建 issue，需要决策的立为决策卡。」 and 「低优先级的先不考虑」. Batch-of: 19 (repository evaluation 2026-10-26, session_019a9XCWsbMFp75REzthE6cs; 9 decision cards + 10 execution cards). ⛔ Filed bare: grading, domain:* and area:* are triage's. ⛔ Not a claim. Reader: the domain:devx execution seat, dispatch step — one os-dev, one or two PRs, all Tier H (.github/**). Dedupe: REST list (439 issues), grep setup-node|composite|setup-pnpm|setup action → 1 unrelated hit; #25452 (open, dispatched) cites the PR-side pnpm store saves as evidence but its change list is the Turbo seeds — this card takes the setup sequence and leaves the seeds to #25452; #22034 (on hold) owns the fetch-depth: 0 cost and is NOT folded in here. New.

谁付代价（业务筛）: every PR and queue entry pays the same five setup steps in every job (ci.yml median 15 min, p90 21 min over the last 50 completed runs; lint.yml 9 / 16), and every workflow edit has to be made in about 41 places. A PR that touches the lockfile saves multi-GB PR-scoped pnpm store entries into the same 10 GB Actions cache pool that #25452 measured as evicting main's seeds.

Measured (HEAD `0d83ee8`, static read of `.github/`)

.github/actions/ holds only setup-pnpm (Corepack store cache; its header says setup-node is "Deliberately NOT in here") and half-state-patrol.
Repeated by hand across .github/workflows/*.yml: actions/setup-node@v7 with node-version: '22' 57 uses (58 literal '22', while .nvmrc holds 22); setup-pnpm 42; a "Get pnpm store directory" step 37 copies; actions/cache with the identical key pnpm-store-v3-${{ hashFiles('**/pnpm-lock.yaml') }} 35 copies; pnpm install --frozen-lockfile 41 copies. Example block: lint.yml:462-484, repeated in all 12 lint lanes.
The four TURBO_* env lines are copied verbatim into about 10 steps (ci.yml:873-876, lint.yml:5773, 6036, 6111, 6244, 6277).
The pnpm store uses plain actions/cache (restore + post-save) at 35 sites, on pull_request too, although Turbo seeds were moved to restore-only on PRs for exactly this pool-pressure reason (ci.yml:677-684).
One outlier: showcase-smoke.yml:47-48 uses pnpm/action-setup@v6 (tag-pinned) instead of setup-pnpm.

Wanted

A .github/actions/setup-workspace composite action: node from .nvmrc (node-version-file), Corepack, the store path, actions/cache/restore always and actions/cache/save only when github.event_name != 'pull_request', pnpm install --frozen-lockfile; an input for the few jobs that skip install. The existing setup-pnpm either becomes a step inside it or is retired.
Replace the hand-copied sequence everywhere (showcase-smoke.yml included); keep per-job TURBO_* env where it differs, otherwise hoist to the composite's outputs or a job-level env.
dependabot.yml: add directories: ["/", "/.github/actions/*"] so the actions inside composites are tracked.
⛔ Do not change fetch-depth (that is finding(ci): fetch-depth 0 checkouts fetch ~1236 heads and ~7950 tags (main alone is 15–20× faster), and Test Core shards still turn a slow fetch into a cancelled required check — the cost #22020 budgets around #22034's call) and do not change Turbo seed keys (that is ci: Turbo seeds vs the 10 GB Actions cache pool — measure the pool, then shrink or retire the per-sha seeds #25452's).

Acceptance

grep -c "node-version: '22'" .github/workflows/*.yml → 0; one definition of the store cache key; pnpm install --frozen-lockfile appears only inside the composite (plus any job that documents why it differs).
On a pull_request run no step saves a pnpm-store-* cache entry (read the run's cache-save step output); on a push to main it still does.
All required contexts (scripts/check-required-contexts.mjs) unchanged and green on the PR.

Size: M (mechanical, many files). Clause-②: no. Metadata-protocol: none. Tier: H (.github/workflows/**); the dev opens the PR draft and the seat requests the governed review.

Triage: first grade — `tooling` · `priority:p2` · `domain:devx` · `area:devpath` · `pm:queue` · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-26T12:07Z

⛔ Not a claim, ⛔ not a dispatch. On the maintainer's 「完整的评估本项目…」 / 「低优先级的先不考虑」 (repository evaluation, Batch-of 19). Low priorities were excluded at filing, so the execution cards grade p2.

Use one composite setup action, with the Node version from one source (.nvmrc or package.json engines). The pnpm store cache saves on push / schedule only. Tier H. Land it after ci: Test UI always starts 16 shard runners and Test Core 8, even when the affected set is one package, and an empty shard still pays checkout + install + closure build before learning it has nothing to run #26084 and ci: 17 jobs inherit the 360-minute default timeout (four of them run on every push to main), 11 PR-triggered workflows cancel nothing when superseded, and check-links runs on every PR without a paths filter #26085, or with the same holder, to avoid three-way YAML conflicts.

Generated by Claude Code

Claim: PM loop round 9 · 2026-10-27T02:31Z
Session: session_01Q4MDXRbEJCNdPAP4SiXwp9 (devx seat 2) · card thread cmsg_01FdL1XeUyvVNxLreh3F4Qi9HTCCgQfvL4bghGe5pCNu1u
Account: os-steve
Branch: claude/project-thread-x57bin (the harness-pinned branch of the card thread; it names no issue, so this claim is the identity record; amended on spawn)
Worktree: objectstack-issue-26083
Domain: domain:devx
Seat: domain:devx#2 (seat post #20163)
File surface: a new .github/actions/setup-workspace/action.yml composite (node from .nvmrc via node-version-file, Corepack/pnpm, store path, actions/cache/restore always and actions/cache/save only on push and schedule ⛔ never on pull_request or merge_group, pnpm install --frozen-lockfile, an input for jobs that skip install); .github/actions/setup-pnpm folded in or retired; the hand-copied setup sequence replaced in root .github/workflows/*.yml (showcase-smoke.yml included); .github/dependabot.yml gains the composite directories. ⛔ No fetch-depth change (#22034), no Turbo seed key change and no Next.js cache change (#25452), no job rename, no ui/ path (ui/.github/** included). Split into serial PRs if one would pass ~1500 lines. ⛔ Tier H (.github/workflows/**): draft until a GOVERNED_APPROVERS approval; the dev neither readies nor arms auto-merge Amended at the thread's premise read (c51aed4): (i) the five ui jobs in root ci.yml (ui-deps, type-check-ui, test-ui, lint-ui, build-e2e-ui) keep their literal setup sequence because ~10 ui/** tests pin it; there only node-version → node-version-file: .nvmrc, and ui-deps' store save gains the push/schedule condition if no ui/ pin reads that line, else it is listed as an exception too; setup-pnpm stays, as a step inside the composite. (ii) The root gates that read the sequence literally (scripts/check-pnpm-acquisition.mjs, scripts/pm/check-governed-queue-guard.mjs self-test, and any other the gate run names) are taught the composite, with new self-test cases; behaviour otherwise unchanged. The TURBO_* env lines are not hoisted.
Container & model: L, mode:thread, model: default tier (TIER_DEFAULT, from dispatch-gates --tier: no path-derived mandate), effort: medium
Clause-②: no
Metadata-protocol: none
Responsibility: n/a — repository evaluation 2026-10-26, triaged p2 at 6415622667
Thread-read: 6415622667
Premise: on main the setup sequence is still hand-copied (~57 node-version: '22', ~35 identical pnpm-store-v3 cache keys, ~41 pnpm install --frozen-lockfile), and the pnpm store still post-saves on pull_request runs (the dev re-counts on origin/main first and reports the numbers)
Serial constraints cleared: triage asked this to land after #26084 and #26085; both merged (PR #26391 88520997, PR #26376 fa5d72e1). Still in flight on the same files: #26086 PR 2 (this seat, run: lines → pnpm run check:*), different lines; whichever lands second merges main. Overlap with #25452 (assignee os-elon-musk): its directive (c) also makes the pnpm store restore-only on PRs and the queue; here the composite owns the store step, so that half lands with this card and #25452 keeps the Next.js cache and the Turbo seeds (comment on #25452)

Generated by Claude Code

os-dev-report

{
  "issue": 26083,
  "status": "blocked",
  "branch": "claude/project-thread-x57bin",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/26419",
  "session": "session_01ADHkmQLxLez3gFZk5XQ3JX",
  "premise_still_valid": true,
  "summary": "Re-counted on origin/main c51aed4f: node-version '22' 59 steps (+1 comment), store key 40, pnpm install --frozen-lockfile 43 lines; the store post-saved on pull_request via actions/cache. New .github/actions/setup-workspace (Node from .nvmrc, setup-pnpm as a step, store restore, frozen install, save on push/schedule only) is called by 38 jobs; node-only jobs read .nvmrc. Exceptions kept spelled out with reasons: ci.yml's 5 ui jobs (pinned by ui/scripts/__tests__), governed-surface-guard (pinned by the queue-guard self-test; now restore-only), release-integrity, scaffold registry-canary (no checkout). BLOCKED: Test UI (8/16) is red on ui/scripts/__tests__/doc-version-claims.test.ts L2893 and L2917, which count literal node-version lines in .github/workflows (floor 15, now 1); ui/** is outside this card, so a ui-lane card must re-anchor that test on .nvmrc before this PR lands. Seat holds the PR as draft.",
  "tests": "node scripts/check-pnpm-acquisition.mjs --self-test: 14 cases pass; node scripts/pm/check-governed-queue-guard.mjs --self-test: 393 cases pass; ui/scripts/__tests__ files reading the root workflows (77 files): 1 failed (doc-version-claims, 2 assertions) | 76 passed. No ablation: workflow/config diff.",
  "gates": "head 2cb5ee1f: dispatch-gates --ran: 94 derived, 94 run, 0 NOT-MEASURED (derived zero), all exit 0 (4 first exit 3 and type-check-debt exit 124 at the 300s loop cap, all exit 0 after turbo build under os-verify-lock VERDICT command-exit 0); pnpm check:pm-dispatch-gates exit 0 (1901 fast-tier cases). PR check-runs on 2cb5ee1f: 63 success, 11 skipped, 1 failure (Test UI (8/16), ui pin above), 2 in_progress (Nightly tiers 1/2, 2/2). PR-run cache reading: Lint ESLint job 121986251529 runs only actions/cache/restore for the store (exact hit) and no actions/cache/save step and no combined-cache post step; an exact hit would not have saved under the old spelling either, so the event guard is verified statically, not by this run.",
  "dogfood_battery": "n/a — no `!` in the PR title and no (narrowing) arm",
  "mcp_calls": "9 — issue_read x2, list_pull_requests x1, actions_list x3, pull_request_read x1, get_job_logs x2 (all reads)",
  "api_writes": "3 — git push (branch), pr_create via fleet-write relay (draft, assignee os-steve, label skip-changeset), this os-dev-report comment via post-stamped",
  "line_budget": "+335 / -892 = 1227 changed lines over 34 files, under the ~1500 split line; one PR",
  "files_changed": 34,
  "deviations": [
    "File surface widened twice with the seat's agreement (claim amended): scripts/check-pnpm-acquisition.mjs and scripts/pm/check-governed-queue-guard.mjs taught the composite; the five ui jobs keep their steps.",
    "setup-pnpm not retired: it is a step of the composite, because ui pins and two jobs still call it.",
    "TURBO_* env not hoisted (would expose TURBO_TOKEN to every step).",
    "The derived ui suite was not in the dispatch-gates list; my first local ui sweep (41 files using the root-ci helpers) missed doc-version-claims.test.ts, which reads the workflows directly; CI caught it."
  ],
  "open_questions": [],
  "out_of_scope_findings": [
    "carrier: ui lane (seat files) · ui/scripts/__tests__/doc-version-claims.test.ts anchors doc Node claims on literal node-version lines in .github/workflows (floor 15); re-anchor on .nvmrc / node-version-file / .github/actions · dedupe words: doc-version-claims node-version anchor nvmrc",
    "carrier: ui lane (seat files) · move ci.yml's five ui jobs onto setup-workspace together with their pins: ci-setup-pnpm-wiring, turbo-cache-save-bound, and the 8 tests that locate `pnpm install --frozen-lockfile` in a ui job block (list in PR body Acceptance notes)"
  ]
}

Generated by Claude Code

devx seat 2 · released: PR #26419 was merged by a maintainer at 03:41Z as d15f99d7 (squash), and its +/- lines on main match the reviewed head 2cb5ee1f in all 34 files. The card closed on Fixes. pm:dispatched comes off.

⚠️ Known red now on main: ui/scripts/__tests__/doc-version-claims.test.ts (L2893, L2917) counts node-version: lines under .github/workflows and needs at least 15; after this change there is 1. Any Test UI shard that selects that file is red until #26421 (ui lane, p1: re-anchor the test on .nvmrc / node-version-file) lands. Left for later: moving the five ui jobs in ci.yml onto the composite together with their ui/ pins (list in #26419's body).

Generated by Claude Code

Navigation Menu

Repository navigation

ci: the checkout → setup-node → setup-pnpm → store-cache → install sequence is hand-copied into about 41 jobs (58 hardcoded node "22" literals, 35 identical cache keys), and the pnpm store cache still post-saves on pull_request runs #26083

Measured (HEAD `0d83ee8`, static read of `.github/`)

Wanted

Acceptance

Related

Triage: first grade — `tooling` · `priority:p2` · `domain:devx` · `area:devpath` · `pm:queue` · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-26T12:07Z

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

ci: the checkout → setup-node → setup-pnpm → store-cache → install sequence is hand-copied into about 41 jobs (58 hardcoded node "22" literals, 35 identical cache keys), and the pnpm store cache still post-saves on pull_request runs #26083

Description

Measured (HEAD 0d83ee8, static read of .github/)

Wanted

Acceptance

Related

Activity

objectstack-fleet commented on Oct 26, 2026

Triage: first grade — tooling · priority:p2 · domain:devx · area:devpath · pm:queue · triage seat · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-26T12:07Z

objectstack-fleet commented on Oct 27, 2026

objectstack-fleet commented on Oct 27, 2026

objectstack-fleet commented on Oct 27, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Measured (HEAD `0d83ee8`, static read of `.github/`)

Triage: first grade — `tooling` · `priority:p2` · `domain:devx` · `area:devpath` · `pm:queue` · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-26T12:07Z