build: migrate to pnpm and reusable CI

.github/workflows/auto-merge.yml

@@ -7,44 +7,6 @@ permissions:
   contents: write
 
 jobs:
-  review-dependabot-pr:
-    runs-on: ubuntu-latest
-    if: ${{ github.event.pull_request.user.login == 'dependabot[bot]' }}
-    steps:
-      - name: Dependabot metadata
-        id: metadata
-        uses: dependabot/fetch-metadata@v3
-        with:
-          github-token: "${{ secrets.GITHUB_TOKEN }}"
-
-      - name: Enable auto-merge for Dependabot PRs
-        run: gh pr merge --auto --merge "$PR_URL"
-        env:
-          PR_URL: ${{github.event.pull_request.html_url}}
-          GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
-
-      - name: Approve patch and minor updates
-        if: ${{steps.dependabot-metadata.outputs.update-type == 'version-update:semver-patch' || steps.dependabot-metadata.outputs.update-type == 'version-update:semver-minor'}}
-        run: gh pr review $PR_URL --approve -b "I'm **approving** this pull request because **it includes a patch or minor update**"
-        env:
-          PR_URL: ${{github.event.pull_request.html_url}}
-          GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
-
-      - name: Comment on major updates of any dependencies
-        if: ${{steps.dependabot-metadata.outputs.update-type == 'version-update:semver-major'}}
-        run: |
-          gh pr comment $PR_URL --body "I'm **not approving** this PR because **it includes a major update of a dependency**"
-          gh pr edit $PR_URL --add-label "requires-manual-qa"
-        env:
-          PR_URL: ${{github.event.pull_request.html_url}}
-          GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
-
-  review-mod-update-pr:
-    runs-on: ubuntu-latest
-    if: ${{ github.event.pull_request.title == 'Update Hugo module dependencies' }}
-    steps:
-      - name: Enable auto-merge for mod-update PRs
-        run: gh pr merge --auto --merge "$PR_URL"
-        env:
-          PR_URL: ${{github.event.pull_request.html_url}}
-          GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
+  auto-merge:
+    uses: gethinode/.github/.github/workflows/auto-merge.yml@v1
+    secrets: inherit

.github/workflows/release.yml

@@ -7,23 +7,7 @@ on:
 
 jobs:
   release:
-    name: Release
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v7
-        with:
-          fetch-depth: 0
-          # Make sure the release step uses its own credentials
-          persist-credentials: false
-      - name: Setup Node.js
-        uses: actions/setup-node@v6
-        with:
-          node-version: "lts/*"
-      - name: Install dependencies
-        run: npm clean-install
-      - name: Release
-        env:
-          GITHUB_TOKEN: ${{ secrets.SEMANTIC_RELEASE_GIT }}
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
-        run: npx semantic-release
+    uses: gethinode/.github/.github/workflows/release.yml@v1
+    with:
+      package-manager: pnpm
+    secrets: inherit

.github/workflows/test.yml

@@ -9,25 +9,8 @@ on:
     branches: [ main ]
 
 jobs:
-  build:
-    strategy:
-      matrix:
-        os: [macos-latest, windows-latest, ubuntu-latest]
-        node-version: [22.x, 24.x]
-        # See supported Node.js release schedule at https://nodejs.org/en/about/releases/
-
-    runs-on: ${{ matrix.os }}
-
-    steps:
-    - uses: actions/checkout@v7
-    - name: Install Go
-      uses: actions/setup-go@v6
-      with:
-        go-version: ">1.0.0"
-    - name: Use Node.js ${{ matrix.node-version }}
-      uses: actions/setup-node@v6
-      with:
-        node-version: ${{ matrix.node-version }}
-        cache: 'npm'
-    - run: npm ci
-    - run: npm run test
+  test:
+    uses: gethinode/.github/.github/workflows/test.yml@v1
+    with:
+      package-manager: pnpm
+    secrets: inherit

.husky/pre-commit

@@ -1 +1 @@
-npm test
+pnpm test

.npmrc

@@ -0,0 +1,3 @@
+# Reject any version published < 24h ago (typosquat / compromised-account window).
+# Override via pnpm-workspace.yaml#minimumReleaseAgeExclude.
+minimum-release-age=1440