build: migrate to pnpm and reusable CI

.github/workflows/auto-merge.yml

@@ -7,44 +7,6 @@ permissions:
   contents: write
 
 jobs:
-  review-dependabot-pr:
-    runs-on: ubuntu-latest
-    if: ${{ github.event.pull_request.user.login == 'dependabot[bot]' }}
-    steps:
-      - name: Dependabot metadata
-        id: metadata
-        uses: dependabot/fetch-metadata@v3
-        with:
-          github-token: "${{ secrets.GITHUB_TOKEN }}"
-
-      - name: Enable auto-merge for Dependabot PRs
-        run: gh pr merge --auto --merge "$PR_URL"
-        env:
-          PR_URL: ${{github.event.pull_request.html_url}}
-          GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
-
-      - name: Approve patch and minor updates
-        if: ${{steps.dependabot-metadata.outputs.update-type == 'version-update:semver-patch' || steps.dependabot-metadata.outputs.update-type == 'version-update:semver-minor'}}
-        run: gh pr review $PR_URL --approve -b "I'm **approving** this pull request because **it includes a patch or minor update**"
-        env:
-          PR_URL: ${{github.event.pull_request.html_url}}
-          GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
-
-      - name: Comment on major updates of any dependencies
-        if: ${{steps.dependabot-metadata.outputs.update-type == 'version-update:semver-major'}}
-        run: |
-          gh pr comment $PR_URL --body "I'm **not approving** this PR because **it includes a major update of a dependency**"
-          gh pr edit $PR_URL --add-label "requires-manual-qa"
-        env:
-          PR_URL: ${{github.event.pull_request.html_url}}
-          GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
-
-  review-mod-update-pr:
-    runs-on: ubuntu-latest
-    if: ${{ github.event.pull_request.title == 'Update Hugo module dependencies' }}
-    steps:
-      - name: Enable auto-merge for mod-update PRs
-        run: gh pr merge --auto --merge "$PR_URL"
-        env:
-          PR_URL: ${{github.event.pull_request.html_url}}
-          GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
+  auto-merge:
+    uses: gethinode/.github/.github/workflows/auto-merge.yml@v1
+    secrets: inherit

.github/workflows/mod-update.yml

@@ -9,55 +9,8 @@ permissions:
   pull-requests: write
 
 jobs:
-  update-mod:
-    runs-on: ubuntu-latest
-
-    steps:
-    - name: Checkout repository
-      uses: actions/checkout@v7
-
-    - name: Setup Node.js
-      uses: actions/setup-node@v6
-      with:
-        node-version: lts/*
-        cache: 'npm'
-        cache-dependency-path: '**/package-lock.json'
-
-    - name: Perform clean install of npm
-      run: npm ci
-
-    - name: Update Hugo module dependencies
-      id: mod-updates
-      run: |
-        MOD_OUTPUT=$(npm run mod:update 2>&1)
-        echo "$MOD_OUTPUT"
-        MOD_UPDATES=$(echo "$MOD_OUTPUT" | grep '^go: upgraded' | sed 's/go: / - /' | sort -u)
-        echo 'MOD_UPDATES<<EOF' >> $GITHUB_OUTPUT
-        echo "$MOD_UPDATES" >> "$GITHUB_OUTPUT"
-        echo 'EOF' >> $GITHUB_OUTPUT
-
-    - name: Create Pull Request
-      uses: gethinode/create-pull-request@v8
-      with:
-        token: ${{ secrets.HUGO_MOD_PR }}
-        commit-message: 'fix: update Hugo module dependencies'
-        committer: GitHub <noreply@github.com>
-        branch: hugo-mod-dependencies
-        delete-branch: true
-        title: 'Update Hugo module dependencies'
-        body: |
-          This PR is auto-generated by [create-pull-request][1].
-
-          Changes to go.mod:
-
-          ${{ steps.mod-updates.outputs.MOD_UPDATES }}
-
-          [1]: https://github.com/peter-evans/create-pull-request
-        labels: dependencies
-        # Note: remove **/go.mod and **/go.sum if your repository does not have an exampleSite
-        # or any other subfolder that uses Hugo modules
-        add-paths: |
-          go.mod
-          go.sum
-          **/go.mod
-          **/go.sum
+  mod-update:
+    uses: gethinode/.github/.github/workflows/mod-update.yml@v1
+    with:
+      package-manager: pnpm
+    secrets: inherit

.github/workflows/release.yml

@@ -6,39 +6,9 @@ on:
   #   branches:
   #     - main
 
-env:
-  HUSKY: 0
-
-permissions:
-  contents: read # for checkout
-
 jobs:
   release:
-    name: Create release
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write # to be able to publish a GitHub release
-      issues: write # to be able to comment on released issues
-      pull-requests: write # to be able to comment on released pull requests
-      id-token: write # to enable use of OIDC for npm provenance
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v7
-        with:
-          fetch-depth: 0
-          # Make sure the release step uses its own credentials
-          persist-credentials: false
-
-      - name: Set up Node.js
-        uses: actions/setup-node@v6
-        with:
-          node-version: "lts/*"
-
-      - name: Perform clean install of npm
-        run: npm ci
-
-      - name: Create release
-        env:
-          GITHUB_TOKEN: ${{ secrets.SEMANTIC_RELEASE_GIT }}
-        run: npx semantic-release
+    uses: gethinode/.github/.github/workflows/release.yml@v1
+    with:
+      package-manager: pnpm
+    secrets: inherit

.github/workflows/test.yml

@@ -10,56 +10,8 @@ on:
   #   branches: [ main ]
 
 jobs:
-  build:
-    strategy:
-      matrix:
-        os: [macos-latest, windows-latest, ubuntu-latest]
-        node-version: [22.x, 24.x]
-        # See supported Node.js release schedule at https://nodejs.org/en/about/releases/
-
-    runs-on: ${{ matrix.os }}
-
-    steps:
-    - name: Checkout repository
-      uses: actions/checkout@v7
-
-    - name: Install Go
-      uses: actions/setup-go@v6
-      with:
-        go-version: ">1.0.0"
-
-    - name: Setup Node.js ${{ matrix.node-version }}
-      uses: actions/setup-node@v6
-      with:
-        node-version: ${{ matrix.node-version }}
-        cache: 'npm'
-        cache-dependency-path: '**/package-lock.json'
-
-    - name: Install Dart Sass
-      env:
-        DART_SASS_VERSION: "1.98.0"
-      run: |
-        if [ "$RUNNER_OS" == "Linux" ]; then
-          curl -fsSL "https://github.com/sass/dart-sass/releases/download/${DART_SASS_VERSION}/dart-sass-${DART_SASS_VERSION}-linux-x64.tar.gz" \
-            | tar -xz -C "$HOME"
-          echo "$HOME/dart-sass" >> $GITHUB_PATH
-        elif [ "$RUNNER_OS" == "macOS" ]; then
-          ARCH=$(uname -m)
-          if [ "$ARCH" == "arm64" ]; then
-            SASS_ARCH="macos-arm64"
-          else
-            SASS_ARCH="macos-x64"
-          fi
-          curl -fsSL "https://github.com/sass/dart-sass/releases/download/${DART_SASS_VERSION}/dart-sass-${DART_SASS_VERSION}-${SASS_ARCH}.tar.gz" \
-            | tar -xz -C "$HOME"
-          echo "$HOME/dart-sass" >> $GITHUB_PATH
-        elif [ "$RUNNER_OS" == "Windows" ]; then
-          choco install sass
-        fi
-      shell: bash
-
-    - name: Perform clean install of npm
-      run: npm ci
-
-    - name: Run tests
-      run: npm run test
+  test:
+    uses: gethinode/.github/.github/workflows/test.yml@v1
+    with:
+      package-manager: pnpm
+    secrets: inherit

.husky/pre-commit

@@ -1 +1 @@
-npm test
+pnpm test

.npmrc

@@ -0,0 +1,3 @@
+# Reject any version published < 24h ago (typosquat / compromised-account window).
+# Override via pnpm-workspace.yaml#minimumReleaseAgeExclude.
+minimum-release-age=1440