ci: adopt reusable-actions shared workflows

.github/workflows/codeql-analysis.yml

@@ -1,74 +1,19 @@
-# For most projects, this workflow file will not need changing; you simply need
-# to commit it to your repository.
-#
-# You may wish to alter this file to override the set of languages analyzed,
-# or to provide custom queries or build logic.
-#
-# ******** NOTE ********
-# We have attempted to detect the languages in your repository. Please check
-# the `language` matrix defined below to confirm you have the correct set of
-# supported CodeQL languages.
-#
 name: "CodeQL"
 
+# Thin caller of decaf-ts/reusable-actions/.github/workflows/codeql-analysis.yml.
+
 on:
   push:
     tags:
       - 'v?[0-9]+.[0-9]+.[0-9]+'
       - '!*-no-ci'
   pull_request:
-    # The branches below must be a subset of the branches above
     branches: [ master, main ]
   schedule:
     - cron: '41 0 * * 4'
   workflow_dispatch:
 
 jobs:
   analyze:
-    name: Analyze
-    runs-on: ubuntu-latest
-    permissions:
-      actions: read
-      contents: read
-      security-events: write
-
-    strategy:
-      fail-fast: false
-      matrix:
-        language: [ 'javascript' ]
-        # CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python' ]
-        # Learn more:
-        # https://docs.github.com/en/free-pro-team@latest/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning#changing-the-languages-that-are-analyzed
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      # Initializes the CodeQL tools for scanning.
-      - name: Initialize CodeQL
-        uses: github/codeql-action/init@v3
-        with:
-          languages: ${{ matrix.language }}
-          # If you wish to specify custom queries, you can do so here or in a config file.
-          # By default, queries listed here will override any specified in a config file.
-          # Prefix the list here with "+" to use these queries and those in the config file.
-          # queries: ./path/to/local/query, your-org/your-repo/queries@main
-
-      # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
-      # If this step fails, then you should remove it and run the build manually (see below)
-      - name: Autobuild
-        uses: github/codeql-action/autobuild@v3
-
-      # ℹ️ Command-line programs to run using the OS shell.
-      # 📚 https://git.io/JvXDl
-
-      # ✏️ If the Autobuild fails above, remove it and uncomment the following three lines
-      #    and modify them (or add more) to build your code if your project
-      #    uses a compiled language
-
-      #- run: |
-      #   make bootstrap
-      #   make release
-
-      - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v3
+    uses: decaf-ts/reusable-actions/.github/workflows/codeql-analysis.yml@master
+    secrets: inherit

.github/workflows/jest-coverage.yaml

@@ -1,76 +1,17 @@
 name: 'Test Coverage'
 
+# Thin caller of decaf-ts/reusable-actions/.github/workflows/jest-coverage.yaml.
+# Boots integration-test infra via 'npm run prepare-it-tests' before testing.
+
 on:
   pull_request:
-    # The branches below must be a subset of the branches above
     branches: [ master, main ]
   workflow_dispatch:
 
 jobs:
   coverage:
-    runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        node-version: [ 22 ]
-    if: ${{ !contains(github.event.head_commit.message, '[skip ci]') }}
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-      - name: Use Node.js ${{ matrix.node-version }}
-        uses: actions/setup-node@v4
-        with:
-          node-version: ${{ matrix.node-version }}
-
-      # Cache dependencies (npm)
-      - name: Cache dependencies
-        id: cache-npm
-        uses: actions/cache@v4
-        with:
-          path: |
-            ~/.npm
-            node_modules
-          key: deps-${{ runner.os }}-${{ matrix.node-version }}-${{ hashFiles('**/package-lock.json') }}
-          restore-keys: |
-            deps-${{ runner.os }}-${{ matrix.node-version }}-
-
-      # Install dependencies only if cache missed
-      - run: npm ci
-
-      - name: Cache Build
-        id: cache-build
-        uses: actions/cache@v4
-        with:
-          path: | 
-            lib
-            dist
-          key: build-${{ runner.os }}-${{ matrix.node-version }}-${{ hashFiles('**/package-lock.json') }}
-          restore-keys: |
-            build-${{ runner.os }}-${{ matrix.node-version }}-
-
-      - if: ${{ steps.cache-build.outputs.cache-hit != 'true' }}
-        run: npm run build:prod  # Replace with your build command  
-
-      - run: npm run coverage
-      - name: Tests ✅
-        if: ${{ success() }}
-        run: |
-          curl --request POST --url https://api.github.com/repos/${{ github.repository }}/statuses/${{ github.sha }} --header 'authorization: Bearer ${{ secrets.GITHUB_TOKEN }}' --header 'content-type: application/json' --data '{
-            "context": "tests",
-            "state": "success",
-            "description": "Tests passed",
-            "target_url": "https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}"
-          }'
-      - name: Tests 🚨
-        if: ${{ failure() }}
-        run: |
-          curl --request POST --url https://api.github.com/repos/${{ github.repository }}/statuses/${{ github.sha }} --header 'authorization: Bearer ${{ secrets.GITHUB_TOKEN }}' --header 'content-type: application/json' --data '{
-            "context": "tests",
-            "state": "failure",
-            "description": "Tests failed",
-            "target_url": "https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}"
-          }'
-
-      - uses: artiomtr/jest-coverage-report-action@v2.0-rc.1
-        with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-          threshold: 80 # optional parameter
+    uses: decaf-ts/reusable-actions/.github/workflows/jest-coverage.yaml@master
+    with:
+      # mirrors the repo's own jest coverageThreshold (statements), with slack
+      coverage-threshold: 24
+    secrets: inherit

.github/workflows/nodejs-build-prod.yaml

@@ -1,47 +1,12 @@
 name: "Build & Test"
 
+# Thin caller of decaf-ts/reusable-actions/.github/workflows/nodejs-build-prod.yaml.
+# Boots integration-test infra via 'npm run prepare-it-tests' before testing.
+
 on:
   workflow_dispatch: # on button click
 
 jobs:
   test:
-    strategy:
-      matrix:
-        node-version: [22]  # Add your desired versions
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: actions/setup-node@v4
-        with:
-          node-version: ${{ matrix.node-version }}
-
-      - name: Cache dependencies
-        id: cache-npm
-        uses: actions/cache@v4
-        with:
-          path: |
-            ~/.npm
-            node_modules
-          key: deps-${{ runner.os }}-${{ matrix.node-version }}-${{ hashFiles('**/package-lock.json') }}
-          restore-keys: |
-            deps-${{ runner.os }}-${{ matrix.node-version }}-
-
-      # Install dependencies only
-      - run: npm ci
-
-      - name: Cache Build
-        id: cache-build
-        uses: actions/cache@v4
-        with:
-          path: | 
-            lib
-            dist
-          key: build-${{ runner.os }}-${{ matrix.node-version }}-${{ hashFiles('**/package-lock.json') }}
-          restore-keys: |
-            build-${{ runner.os }}-${{ matrix.node-version }}-
-
-      - if: ${{ steps.cache-build.outputs.cache-hit != 'true' }}
-        run: npm run build:prod  # Replace with your build command      
-
-      - run: npm run test:all
+    uses: decaf-ts/reusable-actions/.github/workflows/nodejs-build-prod.yaml@master
+    secrets: inherit

.github/workflows/pages.yaml

@@ -1,58 +1,16 @@
 name: "Pages Builder"
 
+# Docs deploy exactly once per release: every merge to master produces a
+# release (release-on-merge-pr), whose tag push triggers this deployment.
+# Thin caller of decaf-ts/reusable-actions/.github/workflows/pages.yaml.
+
 on:
   workflow_dispatch: # on button click
   push:
     tags:
       - 'v?[0-9]+.[0-9]+.[0-9]+'
-    branches: [ master, main ]
-    paths:
-      - workdocs/**
-      - .github/workflows/pages.yaml
 
 jobs:
-  # Single deploy job no building
   deploy:
-    permissions:
-      contents: read
-      pages: write
-      id-token: write
-    strategy:
-      matrix:
-        node-version: [ 22 ]
-    environment:
-      name: github-pages
-    #      url: ${{steps.deployment.outputs.page_url}}
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-      - name: Use Node.js ${{ matrix.node-version }}
-        uses: actions/setup-node@v4
-        with:
-          node-version: ${{ matrix.node-version }}
-      # Cache dependencies (npm)
-      - name: Cache dependencies
-        id: cache-npm
-        uses: actions/cache@v4
-        with:
-          path: ~/.npm
-          key: deps-${{ runner.os }}-${{ matrix.node-version }}-${{ hashFiles('**/package-lock.json') }}
-          restore-keys: |
-            deps-${{ runner.os }}-${{ matrix.node-version }}-
-
-      # Install dependencies only if cache missed
-      - run: npm ci
-      - run: npm run build:prod  # Replace with your build command  
-      - run: npm run coverage
-      - run: npm run docs
-      - name: Setup Pages
-        uses: actions/upload-pages-artifact@v3
-        with:
-          name: docs
-          path: docs
-      - name: Deploy to GitHub Pages
-        id: deployment
-        uses: actions/deploy-pages@v4
-        with:
-          artifact_name: docs
+    uses: decaf-ts/reusable-actions/.github/workflows/pages.yaml@master
+    secrets: inherit

.github/workflows/publish-on-release.yaml

@@ -1,5 +1,10 @@
 name: "Publish on Release"
 
+# Triggered by the GitHub Release created in release-on-tag.yaml. Thin caller of
+# decaf-ts/reusable-actions/.github/workflows/publish-on-release.yaml
+# (build, test, publish to npm). Boots integration-test infra via
+# 'npm run prepare-it-tests' before testing.
+
 on:
   release:
     types:
@@ -8,45 +13,5 @@ on:
 
 jobs:
   build:
-    strategy:
-      matrix:
-        node-version: [ 22 ]
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-      - name: Use Node.js ${{ matrix.node-version }}
-        uses: actions/setup-node@v4
-        with:
-          node-version: ${{ matrix.node-version }}
-          registry-url: https://registry.npmjs.org/
-          # Cache dependencies (npm)
-      - name: Cache dependencies
-        id: cache-npm
-        uses: actions/cache@v4
-        with:
-          path: |
-            ~/.npm
-            node_modules
-          key: deps-${{ runner.os }}-${{ matrix.node-version }}-${{ hashFiles('**/package-lock.json') }}
-          restore-keys: |
-            deps-${{ runner.os }}-${{ matrix.node-version }}-
-      - run: npm ci
-      - name: Cache Build
-        id: cache-build
-        uses: actions/cache@v4
-        with:
-          path: | 
-            lib
-            dist
-          key: build-${{ runner.os }}-${{ matrix.node-version }}-${{ hashFiles('**/package-lock.json') }}
-          restore-keys: |
-            build-${{ runner.os }}-${{ matrix.node-version }}-
-
-      - if: ${{ steps.cache-build.outputs.cache-hit != 'true' }}
-        run: npm run build:prod  # Replace with your build command 
-      - run: npm run test:all
-      - run: npm publish --access public
-        env:
-          GITHUB_TOKEN: ${{ secrets.CONSECUTIVE_ACTION_TRIGGER }}
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+    uses: decaf-ts/reusable-actions/.github/workflows/publish-on-release.yaml@master
+    secrets: inherit