chore(ui-kit): upgrade design-system dependencies to latest

.github/workflows/ci.yml

@@ -26,7 +26,7 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
 
-      - uses: pnpm/action-setup@f40ffcd9367d9f12939873eb1018b921a783ffaa # v4
+      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
 
       # This enables task distribution via Nx Cloud
       # Run this command as early as possible, before dependencies are installed
@@ -78,6 +78,14 @@ jobs:
           ./node_modules/.bin/nubx --node nx run-many -t typecheck --projects="$projects"
       # Nx Affected runs only tasks affected by the changes in this PR/commit. Learn more: https://nx.dev/ci/features/affected
       - run: ./node_modules/.bin/nubx --node nx affected -t lint test
+      - name: Typecheck affected UI package
+        if: contains(steps.determine_affected.outputs.projects_csv, ',ui-kit,')
+        run: pnpm --dir libs/ui exec tsc --noEmit -p tsconfig.json
+      - name: Test affected UI asset replay
+        if: contains(steps.determine_affected.outputs.projects_csv, ',ui-kit,')
+        run: |
+          timeout 420 pnpm exec playwright install --only-shell chromium
+          pnpm --dir libs/ui test:visual-assets
       - name: Check affected UI package output
         if: contains(steps.determine_affected.outputs.projects_csv, ',ui-kit,')
         run: pnpm --dir libs/ui check:package

.github/workflows/storybook-a11y-baseline.yml

@@ -8,7 +8,7 @@ on:
       - "libs/ui/.storybook/**"
       - "libs/ui/assets/**"
       - "libs/ui/package.json"
-      - "libs/ui/playwright.config.cts"
+      - "libs/ui/playwright.config.mts"
       - "libs/ui/postcss.config.mjs"
       - "libs/ui/project.json"
       - "libs/ui/rslib.config.ts"
@@ -20,119 +20,59 @@ on:
       - ".github/workflows/storybook-a11y-baseline.yml"
       - "package.json"
       - "pnpm-lock.yaml"
+      - "pnpm-workspace.yaml"
   workflow_dispatch:
 
 permissions:
   contents: read
 
 jobs:
-  build-storybook:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
-        with:
-          fetch-depth: 1
-          persist-credentials: false
-
-      - uses: pnpm/action-setup@f40ffcd9367d9f12939873eb1018b921a783ffaa # v4
-
-      - name: Set up Node.js
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
-        with:
-          node-version: 24
-          cache: pnpm
-
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile --prefer-offline --filter=@techsio/ui-kit...
-
-      - name: Build Storybook (UI)
-        run: pnpm -C libs/ui run build:storybook
-
-      - name: Upload Storybook static
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
-        with:
-          name: storybook-static
-          path: libs/ui/storybook-static
-          retention-days: 7
-          compression-level: 6
-
   storybook-a11y-baseline:
     runs-on: ubuntu-latest
-    needs: build-storybook
-    strategy:
-      fail-fast: false
-      matrix:
-        theme: [light, dark]
-    env:
-      A11Y_REPORT_FAIL_ON_VIOLATIONS: "false"
-      A11Y_REPORT_WRITE_JUNIT: "true"
-      A11Y_REPORT_WAIT_MS: "30000"
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 1
           persist-credentials: false
 
-      - uses: pnpm/action-setup@f40ffcd9367d9f12939873eb1018b921a783ffaa # v4
+      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
 
       - name: Set up Node.js
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 24
+          node-version: 26.11.1
           cache: pnpm
 
       - name: Install dependencies
         run: pnpm install --frozen-lockfile --prefer-offline --filter='.' --filter='@techsio/ui-kit...'
 
       - name: Install Playwright browsers
-        # Storybook's test runner can use a different Playwright version than
-        # the workspace root. Install its exact matching browser revision.
-        run: timeout 420 node scripts/install-storybook-playwright.mjs libs/ui install --only-shell chromium
+        # pnpm-workspace.yaml pins the test runner's Playwright to the
+        # workspace version, so the root CLI installs the matching browser.
+        run: timeout 420 pnpm exec playwright install --only-shell chromium
 
-      - name: Download Storybook static
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
-        with:
-          name: storybook-static
-          path: libs/ui/storybook-static
-
-      - name: Normalize Storybook static path
-        run: |
-          if [ -d "libs/ui/storybook-static/libs/ui/storybook-static" ]; then
-            rm -rf libs/ui/storybook-static.tmp
-            mv libs/ui/storybook-static/libs/ui/storybook-static libs/ui/storybook-static.tmp
-            rm -rf libs/ui/storybook-static
-            mv libs/ui/storybook-static.tmp libs/ui/storybook-static
-          fi
-
-      - name: Run a11y tests (${{ matrix.theme }} theme)
+      # Same entry point as local runs: build, serve, then test both themes.
+      - name: Run a11y tests (light and dark themes)
         id: a11y
-        continue-on-error: true
         env:
-          A11Y_REPORT_OUTPUT_DIR: a11y-report/${{ matrix.theme }}
-        run: |
-          mkdir -p "libs/ui/a11y-report/${{ matrix.theme }}"
-          python3 -m http.server 6006 --directory libs/ui/storybook-static &
-          SERVER_PID=$!
-          cleanup() {
-            kill "${SERVER_PID}" >/dev/null 2>&1 || true
-          }
-          trap cleanup EXIT
-          for _ in {1..20}; do
-            if curl -sf http://127.0.0.1:6006/ >/dev/null; then
-              break
-            fi
-            sleep 1
-          done
-          if ! curl -sf http://127.0.0.1:6006/ >/dev/null; then
-            echo "Storybook server failed to start within timeout." >&2
-            exit 1
-          fi
-          pnpm -C libs/ui exec test-storybook --url "http://127.0.0.1:6006/?globals=theme:${{ matrix.theme }}" --config-dir .storybook --maxWorkers 2 --testTimeout 60000
+          A11Y_REPORT_FAIL_ON_VIOLATIONS: "false"
+        run: pnpm -C libs/ui storybook:a11y
+
+      # The PR workflow downloads <prefix>-<theme> and reads report.json at its root.
+      - name: Upload baseline report (light)
+        if: always() && steps.a11y.outputs.report-dir != ''
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: storybook-a11y-baseline-light
+          path: ${{ steps.a11y.outputs.report-dir }}/light/report.json
+          if-no-files-found: ignore
+          retention-days: 30
 
-      - name: Upload baseline report (${{ matrix.theme }})
-        if: always() && hashFiles(format('libs/ui/a11y-report/{0}/report.json', matrix.theme)) != ''
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+      - name: Upload baseline report (dark)
+        if: always() && steps.a11y.outputs.report-dir != ''
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
-          name: storybook-a11y-baseline-${{ matrix.theme }}
-          path: libs/ui/a11y-report/${{ matrix.theme }}/report.json
+          name: storybook-a11y-baseline-dark
+          path: ${{ steps.a11y.outputs.report-dir }}/dark/report.json
+          if-no-files-found: ignore
           retention-days: 30

.github/workflows/storybook-a11y.yml

@@ -8,7 +8,7 @@ on:
       - ".github/workflows/storybook-a11y-baseline.yml"
       - "package.json"
       - "pnpm-lock.yaml"
-      - "scripts/install-storybook-playwright.mjs"
+      - "pnpm-workspace.yaml"
   workflow_dispatch:
     inputs:
       failOnViolations:
@@ -25,7 +25,7 @@ jobs:
     outputs:
       should-run: ${{ steps.changed-paths.outputs.should-run }}
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           persist-credentials: false
@@ -46,11 +46,11 @@ jobs:
               .github/workflows/storybook-a11y-baseline.yml|\
               package.json|\
               pnpm-lock.yaml|\
-              scripts/install-storybook-playwright.mjs|\
+              pnpm-workspace.yaml|\
               libs/ui/.storybook/**|\
               libs/ui/assets/**|\
               libs/ui/package.json|\
-              libs/ui/playwright.config.cts|\
+              libs/ui/playwright.config.mts|\
               libs/ui/postcss.config.mjs|\
               libs/ui/project.json|\
               libs/ui/rslib.config.ts|\
@@ -79,7 +79,7 @@ jobs:
       checks: write
     uses: TechsioCZ/storybook-addons/.github/workflows/storybook-a11y.yml@b52eaf44688051b19eb989fab7b6ab721ce1a2d1 # storybook-a11y-workflow-v0.1.9
     with:
-      node-version: "24"
+      node-version: "26.11.1"
       pnpm-version: ""
       working-directory: libs/ui
       # Install the browser as part of the dependency step. The reusable
@@ -91,20 +91,26 @@ jobs:
       # is all the headless a11y test run needs, and avoids the stuck extract.
       # `timeout` is a safety net so a future regression fails fast instead of
       # hanging. ubuntu-latest already ships Chromium's system libs (no
-      # --with-deps needed). Install through Storybook's own Playwright so the
-      # downloaded browser revision always matches the test-runner runtime.
-      install-command: pnpm install --frozen-lockfile --prefer-offline --filter='.' --filter='@techsio/ui-kit...' && timeout 420 node scripts/install-storybook-playwright.mjs {{workdir}} install --only-shell chromium
+      # --with-deps needed). pnpm-workspace.yaml pins the test runner's
+      # Playwright to the workspace version, so the root CLI installs the
+      # browser revision the test runner launches.
+      install-command: pnpm install --frozen-lockfile --prefer-offline --filter='.' --filter='@techsio/ui-kit...' && timeout 420 pnpm exec playwright install --only-shell chromium
       build-command: pnpm -C {{workdir}} run build:storybook
+      # The reusable workflow evaluates this command inside its theme loop.
+      # The test timeout comes from .storybook/test-runner-jest.config.mjs.
+      test-command: >-
+        A11Y_STORYBOOK_MODE="$theme" pnpm -C {{workdir}} exec test-storybook
+        --index-json --url "{{url}}" --config-dir {{configDir}}
+        --maxWorkers {{maxWorkers}}
       storybook-static-dir: storybook-static
       storybook-config-dir: .storybook
       themes: '["light","dark"]'
-      globals-template: 'theme:{{theme}}'
+      globals-template: ""
       a11y-output-dir: a11y-report
       fail-on-violations: ${{ fromJSON(github.event.inputs.failOnViolations || vars.A11Y_REPORT_FAIL_ON_VIOLATIONS || 'false') }}
       write-junit: true
       wait-ms: 30000 # 30s based on observed Storybook startup time in CI
       test-workers: 2 # keep load stable on GitHub-hosted runners
-      test-timeout: 60000 # 60s to avoid flakes in slower CI
       install-playwright: false # browser installed via install-command (without --with-deps) to avoid the apt hang
       upload-artifacts: true
       post-pr-comment: true

.github/workflows/ui-release.yml

@@ -27,24 +27,24 @@ jobs:
       is_affected: ${{ steps.check.outputs.is_affected }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           persist-credentials: false
 
-      - uses: pnpm/action-setup@f40ffcd9367d9f12939873eb1018b921a783ffaa # v4
+      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
 
       - name: Set up Node.js
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 24
+          node-version: 26.11.1
           cache: 'pnpm'
 
       - name: Install dependencies
         run: pnpm install --frozen-lockfile --prefer-offline
 
       - name: Set Nx SHAs
-        uses: nrwl/nx-set-shas@3e9ad7370203c1e93d109be57f3b72eb0eb511b1 # v4
+        uses: nrwl/nx-set-shas@afb73a62d26e41464e9254689e1fd6122ee683c1 # v5.0.1
         with:
           main-branch-name: master
 
@@ -80,17 +80,17 @@ jobs:
       id-token: write
     steps:
       - name: Checkout repository
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           persist-credentials: false
 
-      - uses: pnpm/action-setup@f40ffcd9367d9f12939873eb1018b921a783ffaa # v4
+      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
 
       - name: Set up Node.js
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 24
+          node-version: 26.11.1
           registry-url: https://registry.npmjs.org
           scope: '@techsio'
 

.gitignore

@@ -19,12 +19,8 @@ node_modules
 .settings/
 *.sublime-workspace
 
-# IDE - VSCode
+# Local editor configuration
 .vscode/*
-!.vscode/settings.json
-!.vscode/tasks.json
-!.vscode/launch.json
-!.vscode/extensions.json
 
 # misc
 /.sass-cache

.mise.toml

@@ -1,7 +1,7 @@
 [tools]
 "aqua:mikefarah/yq" = "4.45.4"
 "aqua:jqlang/jq" = "1.8.1"
-node = "24"
+node = "26.10.0"
 
 [tasks.dev]
 description = "Incremental local startup after `dev:init`: resources -> meili provisioning -> backend phase -> frontend phase"
@@ -67,9 +67,9 @@ run = "bash ./scripts/dev/mise-dev-helpers.sh local-helper up adminer"
 description = "Stop and remove the local Adminer helper"
 run = "bash ./scripts/dev/mise-dev-helpers.sh local-helper down adminer"
 
-[tasks."dev:corepack:update"]
-description = "Update Corepack inside the repo pnpm toolchain container"
-run = "bash ./scripts/dev/run-pnpm-toolchain.sh corepack up"
+[tasks."dev:pnpm:update"]
+description = "Update the workspace's pinned pnpm version inside the toolchain container"
+run = "bash ./scripts/dev/run-pnpm-toolchain.sh pnpm self-update"
 
 [tasks."dev:install"]
 description = "Install workspace dependencies inside the repo pnpm toolchain container"

.prototools

@@ -1,4 +1,4 @@
 bun = "1.3.3"
-node = "~25"
+node = "26.10.0"
 npm = "~11"
-pnpm = "~10"
+pnpm = "12.9.0"