ci: cut unchanged verification to 3.3 seconds

[altaywtf]

Local and CI verification serialized independent monorepo lanes, and a main push repeated the same full verify and scan in the release workflow.

• Fix: one repository-owned Vite Task graph now schedules formatting, linting, design checks, type freshness, 98 tests, and four builds with explicit dependencies.
• Cache: stable Worker test/build inputs now hit; pull requests and main verification restore a 2.2 MB task cache scoped by GitHub cache rules.
• Delivery: main verify and scan now gate both deploy and the reusable release workflow. Secret-bearing deploy/release jobs still install fresh and restore no pull-request task state.
• Measured:

unchanged before                 12.43s
unchanged canonical gate          3.25s
workflow-only change              4.63s
forced exhaustive gate      17.82-20.70s
forced result          98 tests + 4 builds pass

• Static proof: actionlint and zizmor report no findings.

[slopzapper]

⚡ SLOPS ZAPPED: 1

Verdict: Zaps needed

Folding Release into Main changes the OIDC workflow filename npm checks, so Trusted Publishing no longer matches the registered release.yml publisher and CLI publishes fail closed. The Vite task-cache wiring is not a second proved break.

Findings

1. 🧨 MIDSLOP · P1 — Release caller is now main.yml — npm trusted-publisher match is bogus (.github/workflows/main.yml:89)

[Copilot]

Pull request overview

This PR restructures repo verification and delivery around a repository-owned Vite Task graph and reuses that graph across local scripts and CI, aiming to avoid re-running unchanged lanes and to ensure main verification gates deploy/release.

Changes:

• Introduces a top-level Vite Task graph (ready, checks, tests, builds, etc.) with explicit dependencies to parallelize verification work.
• Refactors root and apps/api scripts to route through the new task graph (including Worker build/test tasks with declared inputs/outputs).
• Updates CI workflows to restore the Vite Task cache and makes the release workflow reusable and gated by the main workflow’s verify/scan jobs.

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
vite.config.ts	Adds repo-level Vite Task graph to coordinate checks/tests/builds/types with dependencies.
package.json	Simplifies check/test/build to run the new task graph targets.
CONTRIBUTING.md	Documents the new verification flow and the no-cache “force every lane” option.
apps/api/vite.config.ts	Defines cacheable Worker build/test tasks with explicit inputs/outputs.
apps/api/package.json	Routes API build/test scripts through the new Vite Task tasks.
AGENTS.md	Updates contributor guidance around cached verification and forcing full runs.
.github/workflows/verify.yml	Restores the Vite Task cache before running the canonical ready gate.
.github/workflows/release.yml	Converts release workflow to workflow_call and removes duplicated verify/scan.
.github/workflows/main.yml	Restores the Vite Task cache, gates deploy/release on verify+scan, and calls reusable release workflow.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[slopzapper]

⚡ SLOPS ZAPPED: 1

Verdict: Zaps needed

Calling release.yml via workflow_call makes npm OIDC authenticate as main.yml. The registered trusted publisher is still release.yml, so CLI publishes will fail until that match is restored.

Findings

1. 🧨 MIDSLOP · P1 — npm trusted publisher still release.yml — workflow_call publish auth is broken (.github/workflows/release.yml:9)

[altaywtf]

@slopzapper re-review

[slopzapper]

A review is already running for head 7deb80c09945.

[slopzapper]

✨ CLEAN

The change is clean: the new ready graph keeps the old verify lanes, the deleted suites are already covered in shared tests, and the CI cache path matches Vite Task's documented store.