From 6a5cc0dac5a31eb286a3e16b21f7cc47eeda8f5c Mon Sep 17 00:00:00 2001
From: Waleed Latif <walif6@gmail.com>
Date: Wed, 7 Oct 2026 10:54:05 -0700
Subject: [PATCH 1/4] ci: shard integration and unit tests, run e2e groups in
 parallel, add a ci gate

The PR critical path was the PostgreSQL integration suite (~15 min), run in full on an
8 vCPU runner once per provisioning path. Its files run one at a time, so the runner sat
mostly idle.

- integration: each provisioning path (push, migrate) is split into 4 Vitest shards on
  4 vCPU runners. Both paths keep the full suite: migrations add triggers, checks and
  NOT VALID constraints that db:push does not, so the schemas differ.
- e2e: the four next-dev groups (scim, cli, stop-after, desktop-inbox) run as a matrix,
  each on its own database. The boot/wait/stop shell lives once in http-e2e.sh.
- lint: lint, audits, type-check and schema sync split off from the tests.
- test: apps/sim unit tests sharded 2 ways; shard 1 also runs root scripts and the other
  workspaces. Each shard has its own Turbo cache disk.
- ci: one aggregate job that fails unless every check passed (skipped is allowed), so a
  ruleset can require a single stable check.

Deploy gating is unchanged: migrate still requires the whole Test and Build workflow.
---
 .agents/skills/ship/SKILL.md     |   2 +-
 .claude/rules/sim-testing.md     |   6 +-
 .cursor/rules/sim-testing.mdc    |   6 +-
 .github/scripts/http-e2e.sh      | 157 ++++++++++++
 .github/workflows/test-build.yml | 411 +++++++++----------------------
 5 files changed, 276 insertions(+), 306 deletions(-)
 create mode 100755 .github/scripts/http-e2e.sh

diff --git a/.agents/skills/ship/SKILL.md b/.agents/skills/ship/SKILL.md
index fdd7e52ad4f..375887fd1b8 100644
--- a/.agents/skills/ship/SKILL.md
+++ b/.agents/skills/ship/SKILL.md
@@ -47,7 +47,7 @@ When the user runs `/ship`:
   - Run `/db-migrate` to review the migration for zero-downtime safety (expand/contract phasing, backward-compatibility with the deployed app version).
   - `(cd packages/db && bunx drizzle-kit generate && git status --porcelain ./migrations)` must print nothing (CI's schema/migration sync step).
   - `bun run check:migrations origin/staging` must pass (staging is the PR base). Do not silence a flagged statement with a `-- migration-safe:` annotation unless `/db-migrate` confirmed the old code no longer depends on it; otherwise split the destructive change into a later deploy.
-6. **Run pre-ship checks** from the repo root before staging. This has two phases: first **regenerate** every committed artifact so generated files never drift into a CI failure (this is what catches things like `agent-stream-docs` going stale after a `models.ts` edit), then run the **full audit suite** CI's `Lint and Test` job enforces. Both phases parallelize — but only across commands that write **disjoint** outputs — and a bare `wait` swallows child exit codes, so both phases below explicitly collect each job's status and abort ship if any failed.
+6. **Run pre-ship checks** from the repo root before staging. This has two phases: first **regenerate** every committed artifact so generated files never drift into a CI failure (this is what catches things like `agent-stream-docs` going stale after a `models.ts` edit), then run the **full audit suite** CI's `lint` job enforces. Both phases parallelize — but only across commands that write **disjoint** outputs — and a bare `wait` swallows child exit codes, so both phases below explicitly collect each job's status and abort ship if any failed.
 
   **Phase A — regenerate the always-in-repo committed artifacts (parallel), then let step 7 stage whatever changed.** Regenerate only the generators whose inputs live entirely in this repo and that any ordinary code change can drift — `agent-stream-docs:generate` (derives from the provider model registry), `docs-manifest:generate` (derives from docs page paths), and `skills:sync` (derives from `.agents/skills/**`). They write disjoint outputs (`apps/docs/…/agent.mdx`, `apps/sim/lib/mothership/generated/docs-manifest.ts`, and `.claude/skills` links), so they parallelize safely, and each is idempotent (a no-op when already in sync):
   ```bash
diff --git a/.claude/rules/sim-testing.md b/.claude/rules/sim-testing.md
index dbbb381daac..95881561a31 100644
--- a/.claude/rules/sim-testing.md
+++ b/.claude/rules/sim-testing.md
@@ -32,11 +32,11 @@ contracts, and demonstrated regressions.
 
 | Suffix | Needs | Run with | In CI |
 |--------|-------|----------|-------|
-| `*.test.ts(x)` | nothing; global mocks from `vitest.setup.ts` | `vitest run` | Lint and Test job |
-| `*.integration.ts` | real PostgreSQL (`TEST_DATABASE_URL`), optionally Redis (`TEST_REDIS_URL`) | `vitest run --mode integration` | `PostgreSQL integration` job, by glob |
+| `*.test.ts(x)` | nothing; global mocks from `vitest.setup.ts` | `vitest run` | `test` jobs (sharded) |
+| `*.integration.ts` | real PostgreSQL (`TEST_DATABASE_URL`), optionally Redis (`TEST_REDIS_URL`) | `vitest run --mode integration` | `integration` jobs, by glob (sharded per provisioning path) |
 | `*.live.test.ts` | provider APIs, hosted sandboxes, local runtimes, or sibling checkouts | `vitest run --mode live <file>` (apps/sim) | never |
 | `apps/desktop/e2e/*.spec.ts` | the packaged Electron app | Playwright | desktop E2E workflow |
-| `apps/sim/scripts/test-*-e2e.ts` | a running app over HTTP | its `package.json` script when one exists (`bun run test:scim:e2e`; `test:workflow-version-compare:e2e` adds `--no-env-file`), else `bun scripts/test-<suite>-e2e.ts` from apps/sim | End-to-end over real HTTP job |
+| `apps/sim/scripts/test-*-e2e.ts` | a running app over HTTP | its `package.json` script when one exists (`bun run test:scim:e2e`; `test:workflow-version-compare:e2e` adds `--no-env-file`), else `bun scripts/test-<suite>-e2e.ts` from apps/sim | `e2e` jobs (`.github/scripts/http-e2e.sh`) |
 
 - A unit test lives next to its source: `feature.ts` → `feature.test.ts`. No network, no database,
   no real timers.
diff --git a/.cursor/rules/sim-testing.mdc b/.cursor/rules/sim-testing.mdc
index e4cc023d9f4..75197fc8a0e 100644
--- a/.cursor/rules/sim-testing.mdc
+++ b/.cursor/rules/sim-testing.mdc
@@ -30,11 +30,11 @@ contracts, and demonstrated regressions.
 
 | Suffix | Needs | Run with | In CI |
 |--------|-------|----------|-------|
-| `*.test.ts(x)` | nothing; global mocks from `vitest.setup.ts` | `vitest run` | Lint and Test job |
-| `*.integration.ts` | real PostgreSQL (`TEST_DATABASE_URL`), optionally Redis (`TEST_REDIS_URL`) | `vitest run --mode integration` | `PostgreSQL integration` job, by glob |
+| `*.test.ts(x)` | nothing; global mocks from `vitest.setup.ts` | `vitest run` | `test` jobs (sharded) |
+| `*.integration.ts` | real PostgreSQL (`TEST_DATABASE_URL`), optionally Redis (`TEST_REDIS_URL`) | `vitest run --mode integration` | `integration` jobs, by glob (sharded per provisioning path) |
 | `*.live.test.ts` | provider APIs, hosted sandboxes, local runtimes, or sibling checkouts | `vitest run --mode live <file>` (apps/sim) | never |
 | `apps/desktop/e2e/*.spec.ts` | the packaged Electron app | Playwright | desktop E2E workflow |
-| `apps/sim/scripts/test-*-e2e.ts` | a running app over HTTP | its `package.json` script when one exists (`bun run test:scim:e2e`; `test:workflow-version-compare:e2e` adds `--no-env-file`), else `bun scripts/test-<suite>-e2e.ts` from apps/sim | End-to-end over real HTTP job |
+| `apps/sim/scripts/test-*-e2e.ts` | a running app over HTTP | its `package.json` script when one exists (`bun run test:scim:e2e`; `test:workflow-version-compare:e2e` adds `--no-env-file`), else `bun scripts/test-<suite>-e2e.ts` from apps/sim | `e2e` jobs (`.github/scripts/http-e2e.sh`) |
 
 - A unit test lives next to its source: `feature.ts` → `feature.test.ts`. No network, no database,
   no real timers.
diff --git a/.github/scripts/http-e2e.sh b/.github/scripts/http-e2e.sh
new file mode 100755
index 00000000000..202a9a2f2a2
--- /dev/null
+++ b/.github/scripts/http-e2e.sh
@@ -0,0 +1,157 @@
+#!/usr/bin/env bash
+# Runs one end-to-end suite group over real HTTP, each against its own `next dev` app.
+#
+# Usage: http-e2e.sh <scim|cli|stop-after|desktop-inbox>   (run from apps/sim)
+#
+# The job provides DATABASE_URL, BETTER_AUTH_SECRET and ENCRYPTION_KEY; each group sets the rest of
+# its app's environment here. Reports and server logs land in $RUNNER_TEMP/e2e.
+#
+# The first request cold-compiles the app under Turbopack, which takes 42-150s on CI runners, so
+# the readiness deadline only has to catch a hung boot: an exited server fails immediately, and
+# either way the server log tail lands in the job log.
+#
+# Each app starts from an empty Turbopack dev cache: a cache written under other NEXT_PUBLIC_*
+# values, by a server that `next dev` SIGKILLs 100ms after SIGTERM, can panic Turbopack or wedge a
+# route compile on restore. It runs in its own session under an E2E_APP tag, and stop-session.sh
+# returns only once every process in that session or carrying that tag has exited (Next's
+# telemetry flush runs detached and still writes .next/dev).
+set -euo pipefail
+
+group=${1:?usage: http-e2e.sh <scim|cli|stop-after|desktop-inbox>}
+report_dir="$RUNNER_TEMP/e2e"
+ready_timeout_seconds=300
+mkdir -p "$report_dir"
+
+server_pid=''
+app_tag=''
+server_log=''
+status_log=''
+
+finish() {
+  local status=$?
+  if [ -n "$server_pid" ]; then
+    bash "$GITHUB_WORKSPACE/.github/scripts/stop-session.sh" "$server_pid" "$app_tag" || status=1
+    wait "$server_pid" 2>/dev/null || true
+    if [ -n "$status_log" ]; then
+      awk '/^ (GET|POST|PUT|PATCH|DELETE|HEAD) \/api\// { print }' "$server_log" > "$status_log"
+    fi
+    if [ "$status" -ne 0 ]; then
+      tail -n 200 "$server_log"
+    fi
+  fi
+  exit "$status"
+}
+trap finish EXIT
+
+# start_app <name> <port> <label> [record-http-status]
+start_app() {
+  local name=$1 port=$2 label=$3
+  server_log="$report_dir/$name-next.log"
+  if [ "${4:-}" = record-http-status ]; then
+    status_log="$report_dir/$name-http-status.log"
+  fi
+  app_tag="$name-$GITHUB_RUN_ID-$GITHUB_RUN_ATTEMPT-$$"
+  export NEXT_PUBLIC_APP_URL="http://127.0.0.1:$port"
+  export BETTER_AUTH_URL="$NEXT_PUBLIC_APP_URL"
+  export DISABLE_TELEMETRY=true NEXT_TELEMETRY_DISABLED=1
+  rm -rf .next/dev
+  E2E_APP="$app_tag" setsid node ../../node_modules/next/dist/bin/next dev --hostname 127.0.0.1 \
+    --port "$port" > "$server_log" 2>&1 &
+  server_pid=$!
+
+  local started=$SECONDS
+  until curl --fail --silent --max-time 10 "$NEXT_PUBLIC_APP_URL/api/health" > /dev/null; do
+    if ! kill -0 "$server_pid" 2>/dev/null; then
+      echo "::error::Local $label app exited during startup."
+      exit 1
+    fi
+    if [ $((SECONDS - started)) -ge "$ready_timeout_seconds" ]; then
+      echo "::error::Local $label app did not become ready within $ready_timeout_seconds seconds."
+      exit 1
+    fi
+    sleep 2
+  done
+  echo "Local $label app ready after $((SECONDS - started))s"
+}
+
+case "$group" in
+  scim)
+    export NEXT_PUBLIC_FORCE_HOSTED=true
+    export BILLING_ENABLED=true NEXT_PUBLIC_BILLING_ENABLED=true
+    export ENTERPRISE_ENABLED=true NEXT_PUBLIC_ENTERPRISE_ENABLED=true
+    export SCIM_ENABLED=true NEXT_PUBLIC_SCIM_ENABLED=true
+    export SSO_ENABLED=true NEXT_PUBLIC_SSO_ENABLED=true
+    export ORGANIZATIONS_ENABLED=true NEXT_PUBLIC_ORGANIZATIONS_ENABLED=true
+    export INTERNAL_API_SECRET=scim-http-ci-local-secret-at-least-32-characters
+    export DB_TX_TRIPWIRE=throw
+    export NEXT_PUBLIC_CHAT_DISABLED=true
+    start_app scim 3017 SCIM record-http-status
+    SCIM_E2E_BASE_URL="$NEXT_PUBLIC_APP_URL" \
+    SCIM_E2E_DATABASE_URL="$DATABASE_URL" \
+    SCIM_E2E_AUTH_SECRET="$BETTER_AUTH_SECRET" \
+    SCIM_E2E_REPORT_PATH="$report_dir/scim-e2e-report.json" \
+      bun run test:scim:e2e
+    VERSION_COMPARE_E2E_BASE_URL="$NEXT_PUBLIC_APP_URL" \
+    VERSION_COMPARE_E2E_DATABASE_URL="$DATABASE_URL" \
+    VERSION_COMPARE_E2E_AUTH_SECRET="$BETTER_AUTH_SECRET" \
+    VERSION_COMPARE_E2E_REPORT_PATH="$report_dir/version-compare-http-report.json" \
+      bun run test:workflow-version-compare:e2e
+    ;;
+
+  # The search suites serve their own fixtures in-process and need no app. They share this group
+  # because they finish in seconds. Self-hosted without billing: hosted billing admits runs through
+  # Redis, which the CLI app is not given.
+  cli)
+    for search in google-content lucid zoom google-meet; do
+      report_var="SEARCH_$(echo "$search" | tr 'a-z-' 'A-Z_')_REPORT_PATH"
+      env NEXT_PUBLIC_APP_URL=http://127.0.0.1:3040 NEXT_PUBLIC_FORCE_HOSTED=false \
+        "$report_var=$report_dir/search-$search.json" \
+        bun "scripts/test-search-$search-e2e.ts"
+    done
+    export NEXT_PUBLIC_FORCE_HOSTED=false
+    export INTERNAL_API_SECRET=cli-http-ci-local-secret-at-least-32-characters
+    start_app cli 3018 CLI
+    CLI_LATENCY_E2E_BASE_URL="$NEXT_PUBLIC_APP_URL" \
+    CLI_LATENCY_E2E_DATABASE_URL="$DATABASE_URL" \
+    CLI_LATENCY_E2E_RUNS=3 \
+    CLI_LATENCY_E2E_WARMUP=1 \
+    CLI_LATENCY_E2E_REPORT_PATH="$report_dir/cli-run-latency-report.json" \
+      bun run test:cli-run-latency:e2e
+    ;;
+
+  # Self-hosted: hosted billing admits a run only through a Redis usage reservation.
+  stop-after)
+    export NEXT_PUBLIC_FORCE_HOSTED=false
+    export INTERNAL_API_SECRET=stop-after-http-ci-local-secret-at-least-32-characters
+    export DB_TX_TRIPWIRE=throw
+    export NEXT_PUBLIC_CHAT_DISABLED=true
+    start_app stop-after 3018 workflow record-http-status
+    STOP_AFTER_E2E_BASE_URL="$NEXT_PUBLIC_APP_URL" \
+    STOP_AFTER_E2E_DATABASE_URL="$DATABASE_URL" \
+    STOP_AFTER_E2E_REPORT_PATH="$report_dir/stop-after-http-report.json" \
+      bun run test:workflow-stop-after:e2e
+    ;;
+
+  # The desktop background executor's protocol: device registration, the SSE doorbell over Redis
+  # pub/sub, presence, leased claims, Stop and isolation. The only group whose app gets Redis.
+  desktop-inbox)
+    export REDIS_URL=redis://127.0.0.1:6379
+    export NEXT_PUBLIC_FORCE_HOSTED=false
+    export MSHIP_DESKTOP_BACKGROUND_EXECUTOR=true
+    export COPILOT_TOOL_PERMISSIONS_ENABLED=true
+    export INTERNAL_API_SECRET=desktop-inbox-http-ci-local-secret-at-least-32-characters
+    export DB_TX_TRIPWIRE=throw
+    start_app desktop-inbox 3019 'desktop executor' record-http-status
+    DESKTOP_INBOX_E2E_BASE_URL="$NEXT_PUBLIC_APP_URL" \
+    DESKTOP_INBOX_E2E_DATABASE_URL="$DATABASE_URL" \
+    DESKTOP_INBOX_E2E_REDIS_URL="$REDIS_URL" \
+    DESKTOP_INBOX_E2E_AUTH_SECRET="$BETTER_AUTH_SECRET" \
+    DESKTOP_INBOX_E2E_REPORT_PATH="$report_dir/desktop-inbox-http-report.json" \
+      bun run test:desktop-inbox:e2e
+    ;;
+
+  *)
+    echo "::error::Unknown end-to-end group: $group" >&2
+    exit 2
+    ;;
+esac
diff --git a/.github/workflows/test-build.yml b/.github/workflows/test-build.yml
index 6309d81b51f..bab48c79dd9 100644
--- a/.github/workflows/test-build.yml
+++ b/.github/workflows/test-build.yml
@@ -12,13 +12,19 @@ jobs:
     # Runs the real-infrastructure test layer: every `*.integration.ts` in packages/db and
     # apps/sim, discovered by glob (`vitest run --mode integration`), against the database each
     # provisioning path produces. A new integration suite needs no workflow change.
-    name: PostgreSQL integration (${{ matrix.provision }})
-    runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-8vcpu-ubuntu-2404' || 'ubuntu-latest' }}
-    timeout-minutes: 25
+    #
+    # The two paths build different schemas (migrations add triggers, checks and NOT VALID
+    # constraints that `db:push` does not), so each runs the whole suite. Vitest splits each
+    # suite's files across four shards; a shard runs its files one at a time against its own
+    # database. Files run serially, so a shard barely uses more than one core: 4 vCPU is enough.
+    name: integration (${{ matrix.provision }}, ${{ matrix.shard }}/4)
+    runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-4vcpu-ubuntu-2404' || 'ubuntu-latest' }}
+    timeout-minutes: 20
     strategy:
       fail-fast: false
       matrix:
         provision: [push, migrate]
+        shard: [1, 2, 3, 4]
     services:
       redis:
         image: redis:8.2-alpine
@@ -79,23 +85,23 @@ jobs:
           bun run db:${{ matrix.provision }}
 
       - name: Verify migration replay is a no-op
-        if: matrix.provision == 'migrate'
+        if: matrix.provision == 'migrate' && matrix.shard == 1
         working-directory: packages/db
         run: bun run db:migrate
 
       - name: Run packages/db integration tests
         working-directory: packages/db
-        run: bun run test --mode integration
+        run: bun run test --mode integration --shard=${{ matrix.shard }}/4
 
       - name: Run apps/sim integration tests
         working-directory: apps/sim
         # A non-UTC process zone keeps timestamp-without-time-zone handling honest.
         env:
           TZ: America/Los_Angeles
-        run: bun run test --mode integration
+        run: bun run test --mode integration --shard=${{ matrix.shard }}/4
 
       - name: Verify cumulative billing timeout recovery on PostgreSQL 16
-        if: matrix.provision == 'push'
+        if: matrix.provision == 'push' && matrix.shard == 1
         working-directory: apps/sim
         env:
           TEST_DATABASE_URL: postgresql://postgres:postgres@127.0.0.1:5433/sim_test
@@ -107,24 +113,37 @@ jobs:
         if: always()
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
-          name: integration-reports-${{ matrix.provision }}
+          name: integration-reports-${{ matrix.provision }}-${{ matrix.shard }}
           path: |
             packages/db/test-results/*.json
             apps/sim/test-results/*.json
           if-no-files-found: warn
           retention-days: 14
 
-  # Acceptance suites that cross a real HTTP boundary. Its own job, off the
-  # integration legs' critical path and on its own database: the SCIM app boots
-  # hosted, which starts background usage replay against DATABASE_URL, so it must
-  # never share a database with suites asserting on billing rows. The suites
-  # exercise HTTP behavior rather than a provisioning path, so they run once,
-  # against the production (migrate) path.
+  # Acceptance suites that cross a real HTTP boundary, one job per app, each on its own database.
+  # Off the integration jobs' path: the SCIM app boots hosted, which starts background usage replay
+  # against DATABASE_URL, so it must never share a database with suites asserting on billing rows.
+  # The suites exercise HTTP behavior rather than a provisioning path, so they run once, against
+  # the production (migrate) path. Each group's app environment lives in http-e2e.sh.
+  #
+  # SCIM runs two suites against a hosted app and is the longest group, so it keeps the 8 vCPU
+  # runner; the others boot a smaller self-hosted app and fit on 4.
   http-e2e:
-    name: End-to-end over real HTTP
-    runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-8vcpu-ubuntu-2404' || 'ubuntu-latest' }}
-    # Four suites, each starting its own dev app, run in sequence.
-    timeout-minutes: 30
+    name: e2e (${{ matrix.group }})
+    runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && matrix.runner || 'ubuntu-latest' }}
+    timeout-minutes: 20
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - group: scim
+            runner: blacksmith-8vcpu-ubuntu-2404
+          - group: cli
+            runner: blacksmith-4vcpu-ubuntu-2404
+          - group: stop-after
+            runner: blacksmith-4vcpu-ubuntu-2404
+          - group: desktop-inbox
+            runner: blacksmith-4vcpu-ubuntu-2404
     services:
       postgres:
         image: pgvector/pgvector:pg17
@@ -168,276 +187,17 @@ jobs:
         working-directory: packages/db
         run: bun run db:migrate
 
-      - name: Verify Google document reads over real HTTP
-        working-directory: apps/sim
-        env:
-          NEXT_PUBLIC_APP_URL: http://127.0.0.1:3040
-          NEXT_PUBLIC_FORCE_HOSTED: 'false'
-          SEARCH_GOOGLE_CONTENT_REPORT_PATH: ${{ runner.temp }}/e2e/search-google-content.json
-        run: bun scripts/test-search-google-content-e2e.ts
-
-      - name: Verify Lucid MCP search and complete diagram reads over real HTTP
-        working-directory: apps/sim
-        env:
-          NEXT_PUBLIC_APP_URL: http://127.0.0.1:3040
-          NEXT_PUBLIC_FORCE_HOSTED: 'false'
-          SEARCH_LUCID_REPORT_PATH: ${{ runner.temp }}/e2e/search-lucid.json
-        run: bun scripts/test-search-lucid-e2e.ts
-
-      - name: Verify Zoom search over real HTTP
-        working-directory: apps/sim
-        env:
-          NEXT_PUBLIC_APP_URL: http://127.0.0.1:3040
-          NEXT_PUBLIC_FORCE_HOSTED: 'false'
-          SEARCH_ZOOM_REPORT_PATH: ${{ runner.temp }}/e2e/search-zoom.json
-        run: bun scripts/test-search-zoom-e2e.ts
-
-      - name: Verify Google Meet search over real HTTP
-        working-directory: apps/sim
-        env:
-          NEXT_PUBLIC_APP_URL: http://127.0.0.1:3040
-          NEXT_PUBLIC_FORCE_HOSTED: 'false'
-          SEARCH_GOOGLE_MEET_REPORT_PATH: ${{ runner.temp }}/e2e/search-google-meet.json
-        run: bun scripts/test-search-google-meet-e2e.ts
-
-      # The first request cold-compiles the app under Turbopack, which took 42-150s
-      # on this runner class: a fixed 120s readiness deadline failed on the slow
-      # tail. The deadline only has to catch a hung boot; an exited server fails
-      # immediately, and either way the server log tail lands in the job log. No
-      # step timeout: the job's bound covers a hang without cutting a slow but
-      # healthy suite short of writing its report.
-      #
-      # Every `next dev` app in this job shares apps/sim/.next, so each one follows the
-      # same lifecycle. It starts from an empty Turbopack dev cache: a cache written under
-      # other NEXT_PUBLIC_* values, by a server that `next dev` SIGKILLs 100ms after
-      # SIGTERM, can panic Turbopack or wedge a route compile on restore. It runs in its
-      # own session under an E2E_APP tag, and stop-session.sh returns only once every
-      # process in that session or carrying that tag has exited (Next's telemetry flush
-      # runs detached and still writes .next/dev), so no app starts beside one still
-      # writing .next/dev.
-      - name: Verify SCIM, administration and workflow comparisons over real HTTP
-        working-directory: apps/sim
-        env:
-          NEXT_PUBLIC_APP_URL: http://127.0.0.1:3017
-          BETTER_AUTH_URL: http://127.0.0.1:3017
-          NEXT_PUBLIC_FORCE_HOSTED: 'true'
-          BILLING_ENABLED: 'true'
-          NEXT_PUBLIC_BILLING_ENABLED: 'true'
-          ENTERPRISE_ENABLED: 'true'
-          NEXT_PUBLIC_ENTERPRISE_ENABLED: 'true'
-          SCIM_ENABLED: 'true'
-          NEXT_PUBLIC_SCIM_ENABLED: 'true'
-          SSO_ENABLED: 'true'
-          NEXT_PUBLIC_SSO_ENABLED: 'true'
-          ORGANIZATIONS_ENABLED: 'true'
-          NEXT_PUBLIC_ORGANIZATIONS_ENABLED: 'true'
-          INTERNAL_API_SECRET: scim-http-ci-local-secret-at-least-32-characters
-          DB_TX_TRIPWIRE: throw
-          DISABLE_TELEMETRY: 'true'
-          NEXT_TELEMETRY_DISABLED: '1'
-          NEXT_PUBLIC_CHAT_DISABLED: 'true'
-          READY_TIMEOUT_SECONDS: 300
-        run: |
-          report_dir="$RUNNER_TEMP/e2e"
-          server_log="$report_dir/scim-next.log"
-          mkdir -p "$report_dir"
-          rm -rf .next/dev
-          app_tag="scim-$GITHUB_RUN_ID-$GITHUB_RUN_ATTEMPT-$$"
-          E2E_APP="$app_tag" setsid node ../../node_modules/next/dist/bin/next dev --hostname 127.0.0.1 --port 3017 > "$server_log" 2>&1 &
-          server_pid=$!
-          finish() {
-            status=$?
-            bash ../../.github/scripts/stop-session.sh "$server_pid" "$app_tag" || status=1
-            wait "$server_pid" 2>/dev/null || true
-            awk '/^ (GET|POST|PUT|PATCH|DELETE|HEAD) \/api\// { print }' "$server_log" > "$report_dir/scim-http-status.log"
-            if [ "$status" -ne 0 ]; then
-              tail -n 200 "$server_log"
-              exit "$status"
-            fi
-          }
-          trap finish EXIT
-          fail_startup() {
-            echo "::error::$1"
-            exit 1
-          }
-          started=$SECONDS
-          until curl --fail --silent --max-time 10 http://127.0.0.1:3017/api/health > /dev/null; do
-            kill -0 "$server_pid" 2>/dev/null || fail_startup 'Local SCIM app exited during startup.'
-            [ $((SECONDS - started)) -lt "$READY_TIMEOUT_SECONDS" ] ||
-              fail_startup "Local SCIM app did not become ready within $READY_TIMEOUT_SECONDS seconds."
-            sleep 2
-          done
-          echo "Local SCIM app ready after $((SECONDS - started))s"
-          SCIM_E2E_BASE_URL="$NEXT_PUBLIC_APP_URL" \
-          SCIM_E2E_DATABASE_URL="$DATABASE_URL" \
-          SCIM_E2E_AUTH_SECRET="$BETTER_AUTH_SECRET" \
-          SCIM_E2E_REPORT_PATH="$report_dir/scim-e2e-report.json" \
-            bun run test:scim:e2e
-          VERSION_COMPARE_E2E_BASE_URL="$NEXT_PUBLIC_APP_URL" \
-          VERSION_COMPARE_E2E_DATABASE_URL="$DATABASE_URL" \
-          VERSION_COMPARE_E2E_AUTH_SECRET="$BETTER_AUTH_SECRET" \
-          VERSION_COMPARE_E2E_REPORT_PATH="$report_dir/version-compare-http-report.json" \
-            bun run test:workflow-version-compare:e2e
-
-      # Self-hosted without billing: hosted billing admits runs through Redis, which
-      # this job does not provision.
-      - name: Verify embedded CLI workflow runs and log reads over real HTTP
-        working-directory: apps/sim
-        env:
-          NEXT_PUBLIC_APP_URL: http://127.0.0.1:3018
-          BETTER_AUTH_URL: http://127.0.0.1:3018
-          NEXT_PUBLIC_FORCE_HOSTED: 'false'
-          INTERNAL_API_SECRET: cli-http-ci-local-secret-at-least-32-characters
-          DISABLE_TELEMETRY: 'true'
-          NEXT_TELEMETRY_DISABLED: '1'
-          READY_TIMEOUT_SECONDS: 300
-        run: |
-          report_dir="$RUNNER_TEMP/e2e"
-          server_log="$report_dir/cli-next.log"
-          mkdir -p "$report_dir"
-          rm -rf .next/dev
-          app_tag="cli-$GITHUB_RUN_ID-$GITHUB_RUN_ATTEMPT-$$"
-          E2E_APP="$app_tag" setsid node ../../node_modules/next/dist/bin/next dev --hostname 127.0.0.1 --port 3018 > "$server_log" 2>&1 &
-          server_pid=$!
-          finish() {
-            status=$?
-            bash ../../.github/scripts/stop-session.sh "$server_pid" "$app_tag" || status=1
-            wait "$server_pid" 2>/dev/null || true
-            if [ "$status" -ne 0 ]; then
-              tail -n 200 "$server_log"
-              exit "$status"
-            fi
-          }
-          trap finish EXIT
-          fail_startup() {
-            echo "::error::$1"
-            exit 1
-          }
-          started=$SECONDS
-          until curl --fail --silent --max-time 10 http://127.0.0.1:3018/api/health > /dev/null; do
-            kill -0 "$server_pid" 2>/dev/null || fail_startup 'Local CLI app exited during startup.'
-            [ $((SECONDS - started)) -lt "$READY_TIMEOUT_SECONDS" ] ||
-              fail_startup "Local CLI app did not become ready within $READY_TIMEOUT_SECONDS seconds."
-            sleep 2
-          done
-          echo "Local CLI app ready after $((SECONDS - started))s"
-          CLI_LATENCY_E2E_BASE_URL="$NEXT_PUBLIC_APP_URL" \
-          CLI_LATENCY_E2E_DATABASE_URL="$DATABASE_URL" \
-          CLI_LATENCY_E2E_RUNS=3 \
-          CLI_LATENCY_E2E_WARMUP=1 \
-          CLI_LATENCY_E2E_REPORT_PATH="$report_dir/cli-run-latency-report.json" \
-            bun run test:cli-run-latency:e2e
-
-      # A self-hosted app: hosted billing admits a run only through a Redis usage
-      # reservation, and the SCIM suite above asserts PostgreSQL rate-limit storage,
-      # so workflow execution gets its own app rather than adding Redis to that one.
-      - name: Verify single-block workflow runs over real HTTP
-        working-directory: apps/sim
-        env:
-          NEXT_PUBLIC_APP_URL: http://127.0.0.1:3018
-          BETTER_AUTH_URL: http://127.0.0.1:3018
-          NEXT_PUBLIC_FORCE_HOSTED: 'false'
-          INTERNAL_API_SECRET: stop-after-http-ci-local-secret-at-least-32-characters
-          DB_TX_TRIPWIRE: throw
-          DISABLE_TELEMETRY: 'true'
-          NEXT_TELEMETRY_DISABLED: '1'
-          NEXT_PUBLIC_CHAT_DISABLED: 'true'
-          READY_TIMEOUT_SECONDS: 300
-        run: |
-          report_dir="$RUNNER_TEMP/e2e"
-          server_log="$report_dir/stop-after-next.log"
-          mkdir -p "$report_dir"
-          rm -rf .next/dev
-          app_tag="stop-after-$GITHUB_RUN_ID-$GITHUB_RUN_ATTEMPT-$$"
-          E2E_APP="$app_tag" setsid node ../../node_modules/next/dist/bin/next dev --hostname 127.0.0.1 --port 3018 > "$server_log" 2>&1 &
-          server_pid=$!
-          finish() {
-            status=$?
-            bash ../../.github/scripts/stop-session.sh "$server_pid" "$app_tag" || status=1
-            wait "$server_pid" 2>/dev/null || true
-            awk '/^ (GET|POST|PUT|PATCH|DELETE|HEAD) \/api\// { print }' "$server_log" > "$report_dir/stop-after-http-status.log"
-            if [ "$status" -ne 0 ]; then
-              tail -n 200 "$server_log"
-              exit "$status"
-            fi
-          }
-          trap finish EXIT
-          fail_startup() {
-            echo "::error::$1"
-            exit 1
-          }
-          started=$SECONDS
-          until curl --fail --silent --max-time 10 http://127.0.0.1:3018/api/health > /dev/null; do
-            kill -0 "$server_pid" 2>/dev/null || fail_startup 'Local workflow app exited during startup.'
-            [ $((SECONDS - started)) -lt "$READY_TIMEOUT_SECONDS" ] ||
-              fail_startup "Local workflow app did not become ready within $READY_TIMEOUT_SECONDS seconds."
-            sleep 2
-          done
-          echo "Local workflow app ready after $((SECONDS - started))s"
-          STOP_AFTER_E2E_BASE_URL="$NEXT_PUBLIC_APP_URL" \
-          STOP_AFTER_E2E_DATABASE_URL="$DATABASE_URL" \
-          STOP_AFTER_E2E_REPORT_PATH="$report_dir/stop-after-http-report.json" \
-            bun run test:workflow-stop-after:e2e
-
-      # The desktop background executor's protocol: device registration, the SSE doorbell over
-      # Redis pub/sub, presence, leased claims, Stop and isolation, against its own app with Redis.
-      - name: Verify the desktop background executor's inbox over real HTTP
+      # No step timeout: the job's bound covers a hang without cutting a slow but healthy suite
+      # short of writing its report.
+      - name: Run end-to-end suites
         working-directory: apps/sim
-        env:
-          NEXT_PUBLIC_APP_URL: http://127.0.0.1:3019
-          BETTER_AUTH_URL: http://127.0.0.1:3019
-          REDIS_URL: redis://127.0.0.1:6379
-          NEXT_PUBLIC_FORCE_HOSTED: 'false'
-          MSHIP_DESKTOP_BACKGROUND_EXECUTOR: 'true'
-          COPILOT_TOOL_PERMISSIONS_ENABLED: 'true'
-          INTERNAL_API_SECRET: desktop-inbox-http-ci-local-secret-at-least-32-characters
-          DB_TX_TRIPWIRE: throw
-          DISABLE_TELEMETRY: 'true'
-          NEXT_TELEMETRY_DISABLED: '1'
-          READY_TIMEOUT_SECONDS: 300
-        run: |
-          report_dir="$RUNNER_TEMP/e2e"
-          server_log="$report_dir/desktop-inbox-next.log"
-          mkdir -p "$report_dir"
-          rm -rf .next/dev
-          app_tag="desktop-inbox-$GITHUB_RUN_ID-$GITHUB_RUN_ATTEMPT-$$"
-          E2E_APP="$app_tag" setsid node ../../node_modules/next/dist/bin/next dev --hostname 127.0.0.1 --port 3019 > "$server_log" 2>&1 &
-          server_pid=$!
-          finish() {
-            status=$?
-            bash ../../.github/scripts/stop-session.sh "$server_pid" "$app_tag" || status=1
-            wait "$server_pid" 2>/dev/null || true
-            awk '/^ (GET|POST|PUT|PATCH|DELETE|HEAD) \/api\// { print }' "$server_log" > "$report_dir/desktop-inbox-http-status.log"
-            if [ "$status" -ne 0 ]; then
-              tail -n 200 "$server_log"
-              exit "$status"
-            fi
-          }
-          trap finish EXIT
-          fail_startup() {
-            echo "::error::$1"
-            exit 1
-          }
-          started=$SECONDS
-          until curl --fail --silent --max-time 10 http://127.0.0.1:3019/api/health > /dev/null; do
-            kill -0 "$server_pid" 2>/dev/null || fail_startup 'Local desktop executor app exited during startup.'
-            [ $((SECONDS - started)) -lt "$READY_TIMEOUT_SECONDS" ] ||
-              fail_startup "Local desktop executor app did not become ready within $READY_TIMEOUT_SECONDS seconds."
-            sleep 2
-          done
-          echo "Local desktop executor app ready after $((SECONDS - started))s"
-          DESKTOP_INBOX_E2E_BASE_URL="$NEXT_PUBLIC_APP_URL" \
-          DESKTOP_INBOX_E2E_DATABASE_URL="$DATABASE_URL" \
-          DESKTOP_INBOX_E2E_REDIS_URL="$REDIS_URL" \
-          DESKTOP_INBOX_E2E_AUTH_SECRET="$BETTER_AUTH_SECRET" \
-          DESKTOP_INBOX_E2E_REPORT_PATH="$report_dir/desktop-inbox-http-report.json" \
-            bun run test:desktop-inbox:e2e
+        run: bash ../../.github/scripts/http-e2e.sh "${{ matrix.group }}"
 
       - name: Upload end-to-end reports and server logs
         if: failure()
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
-          name: http-e2e-reports
+          name: http-e2e-${{ matrix.group }}
           path: ${{ runner.temp }}/e2e/
           if-no-files-found: ignore
           retention-days: 7
@@ -584,9 +344,11 @@ jobs:
           if-no-files-found: ignore
           retention-days: 7
 
-  test-build:
-    name: Lint and Test
-    runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-8vcpu-ubuntu-2404' || 'ubuntu-latest' }}
+  # Lint, audits, type-check and the schema sync check: about two minutes of mostly cached work,
+  # kept off the test shards so neither waits on the other.
+  lint:
+    name: lint
+    runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-4vcpu-ubuntu-2404' || 'ubuntu-latest' }}
     timeout-minutes: 15
 
     steps:
@@ -707,13 +469,49 @@ jobs:
       - name: Type-check all workspaces
         run: bunx turbo run type-check
 
+      - name: Check schema and migrations are in sync
+        working-directory: packages/db
+        run: |
+          bunx drizzle-kit generate --config=./drizzle.config.ts
+          if [ -n "$(git status --porcelain ./migrations)" ]; then
+            echo "❌ Schema and migrations are out of sync!"
+            echo "Run 'cd packages/db && bunx drizzle-kit generate' and commit the new migrations."
+            git status --porcelain ./migrations
+            git diff ./migrations
+            exit 1
+          fi
+          echo "✅ Schema and migrations are in sync"
+
+  # The root scripts and every workspace's Vitest suite (`bun run test`), split in two. apps/sim is
+  # about 98% of the time, so only its files are sharded; shard 1 also runs the root scripts and
+  # the other workspaces. Each shard keeps its own Turbo cache: pass-through args are part of the
+  # task hash, so a shard only ever replays its own result.
+  test:
+    name: test (${{ matrix.shard }}/2)
+    runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-8vcpu-ubuntu-2404' || 'ubuntu-latest' }}
+    timeout-minutes: 15
+    strategy:
+      fail-fast: false
+      matrix:
+        shard: [1, 2]
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        with:
+          fetch-depth: 2
+
+      - name: Setup workspace
+        uses: ./.github/actions/setup-workspace
+        with:
+          provider: ${{ vars.CI_PROVIDER }}
+          turbo-cache-key: turbo-cache-test-${{ matrix.shard }}
+
       # cloud-review-tools.test.ts runs the real helper on the runner, which shells
       # out to rg. Blacksmith's image ships it, GitHub's doesn't.
       - name: Install ripgrep
         run: command -v rg || (sudo apt-get update && sudo apt-get install -y ripgrep)
 
-      # Runs the root scripts and each workspace's Vitest suite,
-      # without `--coverage`.
       - name: Run tests
         env:
           NODE_OPTIONS: '--no-warnings --max-old-space-size=8192'
@@ -721,20 +519,13 @@ jobs:
           DATABASE_URL: 'postgresql://postgres:postgres@localhost:5432/simstudio'
           ENCRYPTION_KEY: '0000000000000000000000000000000000000000000000000000000000000000' # dummy key for CI only
           TURBO_CACHE_DIR: .turbo
-        run: bun run test
-
-      - name: Check schema and migrations are in sync
-        working-directory: packages/db
+          SHARD: ${{ matrix.shard }}
         run: |
-          bunx drizzle-kit generate --config=./drizzle.config.ts
-          if [ -n "$(git status --porcelain ./migrations)" ]; then
-            echo "❌ Schema and migrations are out of sync!"
-            echo "Run 'cd packages/db && bunx drizzle-kit generate' and commit the new migrations."
-            git status --porcelain ./migrations
-            git diff ./migrations
-            exit 1
+          if [ "$SHARD" = 1 ]; then
+            bun run test:scripts
+            bunx turbo run test --filter='!@sim/app'
           fi
-          echo "✅ Schema and migrations are in sync"
+          bunx turbo run test --filter=@sim/app -- --shard="$SHARD/2"
 
   # Next.js production build, in parallel with lint + tests. Sticky disks are
   # cloned from the last committed snapshot per job and committed last-writer-
@@ -802,3 +593,25 @@ jobs:
           ENCRYPTION_KEY: '0000000000000000000000000000000000000000000000000000000000000000' # dummy key for CI only
           TURBO_CACHE_DIR: .turbo
         run: bunx turbo run build --filter=@sim/app
+
+  # One status for every check above: the single check to require on a branch ruleset, so adding,
+  # sharding or renaming a job never means editing the ruleset. Skipped is a pass (the desktop live
+  # suite skips on pull requests that cannot affect it); a failure or a cancellation is not.
+  ci:
+    name: ci
+    needs: [postgres-integration, http-e2e, desktop-live-changes, desktop-live-e2e, lint, test, build]
+    if: ${{ !cancelled() }}
+    runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-2vcpu-ubuntu-2404' || 'ubuntu-latest' }}
+    timeout-minutes: 5
+    steps:
+      - name: Require every check to pass
+        env:
+          RESULTS: ${{ toJSON(needs) }}
+        run: |
+          failed="$(jq -r 'to_entries[] | select(.value.result != "success" and .value.result != "skipped") | "\(.key): \(.value.result)"' <<< "$RESULTS")"
+          if [ -n "$failed" ]; then
+            echo "::error::Checks did not pass:"
+            echo "$failed"
+            exit 1
+          fi
+          echo "All checks passed."

From 8fb80bf6f3c4b7b484077262d8d7ec9f6734fb0b Mon Sep 17 00:00:00 2001
From: Waleed Latif <walif6@gmail.com>
Date: Wed, 7 Oct 2026 11:23:36 -0700
Subject: [PATCH 2/4] ci: short names, one setup action, aligned pins, explicit
 secrets

Naming
- Workflow files: test-build -> checks, migrations -> migrate, deploy-trigger-dev ->
  trigger-dev, docs-embeddings -> docs, companion-pr-check -> companion, stickydisk-gc
  -> disk-gc. ci.yml, helm.yml and codeql.yml keep their paths: they sign or analyze, and
  the path is part of the signer identity and code-scanning key.
- Composite actions: setup-workspace -> setup, cache-mount -> cache, docker-build -> image.
- Every workflow and job display name is a short lowercase id, matching the job id, with
  any matrix value in parentheses: ci / checks / integration (push, 1/4), image-amd64 (app).

Duplicates
- Nine hand-written Setup Bun + actions/cache + bun install blocks use the setup action.
  It gains node-version (empty keeps the runner's Node, as those jobs had) and registry-url
  (npm publishing). This also ends restoring node_modules from another lockfile through the
  `${runner.os}-bun-` prefix restore key.
- The runner expression is anchored once per file and aliased after.

Consistency
- One SHA per action: checkout v6 (helm was on v4, codeql on v5), setup-node v6 (desktop
  on v4), cache v5 (desktop-release on v4), softprops/action-gh-release v3.0.3 (was v1,
  Node 16). Redis 8.2 everywhere.
- secrets: inherit replaced by the secrets each callee reads; the checks workflow reads none.
  The dev migration gets only DEV_DATABASE_URL, and staging/production never see it.
- Timeouts on the three macOS desktop-e2e jobs (none before, so a hang billed 6 hours),
  and a cache for their Electron, electron-builder and Playwright downloads.
- Publish workflows: values moved from ${{ }} in run blocks to env, concurrency on the
  npm/PyPI publishers, persist-credentials: false on checkouts that never push.
- Dependabot for github-actions (one grouped weekly PR), and actionlint in the lint job.

Fixes
- PyPI version check matched substrings (0.1.1 "existed" once 0.1.10 did) and treated a
  PyPI outage as "not published". It now asks PyPI for the exact version and fails on
  anything but 200 or 404.

Job wiring (runner, if, needs, permissions, timeout, outputs) is unchanged: verified by
loading the old and new ci.yml, checks.yml and helm.yml and comparing every job.
---
 .agents/skills/ship/SKILL.md                  |   2 +-
 .../actions/{cache-mount => cache}/action.yml |   2 +-
 .../{docker-build => image}/action.yml        |   4 +-
 .../{setup-workspace => setup}/action.yml     |  22 +-
 .github/dependabot.yml                        |  19 +
 .../workflows/{test-build.yml => checks.yml}  |  66 +--
 .github/workflows/ci.yml                      | 435 +++++++++---------
 .github/workflows/codeql.yml                  |   6 +-
 .../{companion-pr-check.yml => companion.yml} |   3 +-
 .github/workflows/desktop-e2e.yml             |  59 ++-
 .github/workflows/desktop-release.yml         |  25 +-
 .../{stickydisk-gc.yml => disk-gc.yml}        |   8 +-
 .github/workflows/docs-embeddings.yml         |  51 --
 .github/workflows/docs.yml                    |  40 ++
 .github/workflows/helm.yml                    |  30 +-
 .../workflows/{migrations.yml => migrate.yml} |  36 +-
 .github/workflows/publish-cli.yml             |  45 +-
 .github/workflows/publish-python-sdk.yml      |  33 +-
 .github/workflows/publish-sim-cli.yml         |  29 +-
 .github/workflows/publish-sim-setup.yml       |  29 +-
 .github/workflows/publish-ts-sdk.yml          |  46 +-
 ...deploy-trigger-dev.yml => trigger-dev.yml} |  25 +-
 apps/sim/ee/scim/TESTING.md                   |   6 +-
 scripts/desktop-prune-workflow.test.ts        |   4 +-
 scripts/dev-deployment-workflow.test.ts       |  19 +-
 scripts/migrations-workflow.test.ts           |   5 +-
 26 files changed, 554 insertions(+), 495 deletions(-)
 rename .github/actions/{cache-mount => cache}/action.yml (98%)
 rename .github/actions/{docker-build => image}/action.yml (99%)
 rename .github/actions/{setup-workspace => setup}/action.yml (77%)
 create mode 100644 .github/dependabot.yml
 rename .github/workflows/{test-build.yml => checks.yml} (93%)
 rename .github/workflows/{companion-pr-check.yml => companion.yml} (99%)
 rename .github/workflows/{stickydisk-gc.yml => disk-gc.yml} (97%)
 delete mode 100644 .github/workflows/docs-embeddings.yml
 create mode 100644 .github/workflows/docs.yml
 rename .github/workflows/{migrations.yml => migrate.yml} (79%)
 rename .github/workflows/{deploy-trigger-dev.yml => trigger-dev.yml} (77%)

diff --git a/.agents/skills/ship/SKILL.md b/.agents/skills/ship/SKILL.md
index 375887fd1b8..74101b647c5 100644
--- a/.agents/skills/ship/SKILL.md
+++ b/.agents/skills/ship/SKILL.md
@@ -66,7 +66,7 @@ When the user runs `/ship`:
 
   **Do NOT blanket-run the domain generators here.** `mship:generate` (`generate-mship-contracts.ts`) is an **umbrella** that drives all nine mothership contract generators (`mship-contracts`, `billing-protocol-contract`, `mship-tools`, the four `trace-*`, `metrics-contract`, `vfs-snapshot-contract`) and biome-formats `apps/sim/lib/mothership/generated/` — never run it *and* its constituents (they write the same files and corrupt each other in parallel), and never run it on an ordinary ship: it reads an **external** copilot-contract source that isn't checked out in most worktrees, so it hard-fails with `ENOENT` and would abort ship for an unrelated reason. `generate:pi-model-catalog` (under `apps/sim`) likewise regenerates from the installed Pi package, not repo source. `scripts/generate-docs.ts` rewrites the integration docs and client-safe catalog; run it when this PR changes their block/icon/landing-content inputs or when `integration-catalog:check` reports drift, then review its broad generated diff. Only when **this PR's diff actually touches** a domain generator's input do you regenerate it deliberately and run its matching `:check` (`bun run mship:check` / the individual `*:check`) — with the external source present.
 
-  **Phase B — run lint + every audit CI enforces, in parallel, and abort ship if any fails.** Before running the commands, compare this list with `.github/workflows/test-build.yml`; when CI adds an audit, run it and update this skill instead of trusting a stale snapshot. The env-flag audit is currently an inline workflow block rather than a package script: when `apps/sim/lib/core/config/env-flags.ts` changed, run that current workflow block verbatim instead of copying a second version into this skill. Run `bun run lint` first (it autofixes formatting and mutates files, so don't parallelize it with the read-only audits), then run the base-sensitive block-registry check, then fan the independent audits out and collect exit codes:
+  **Phase B — run lint + every audit CI enforces, in parallel, and abort ship if any fails.** Before running the commands, compare this list with `.github/workflows/checks.yml`; when CI adds an audit, run it and update this skill instead of trusting a stale snapshot. The env-flag audit is currently an inline workflow block rather than a package script: when `apps/sim/lib/core/config/env-flags.ts` changed, run that current workflow block verbatim instead of copying a second version into this skill. Run `bun run lint` first (it autofixes formatting and mutates files, so don't parallelize it with the read-only audits), then run the base-sensitive block-registry check, then fan the independent audits out and collect exit codes:
   ```bash
   # autofix formatting first (mutating; not parallel-safe with the audits). Gate its exit too —
   # a non-zero lint (unfixable errors) must abort before the audits run, not be ignored.
diff --git a/.github/actions/cache-mount/action.yml b/.github/actions/cache/action.yml
similarity index 98%
rename from .github/actions/cache-mount/action.yml
rename to .github/actions/cache/action.yml
index df0de0b106c..5d29c00565e 100644
--- a/.github/actions/cache-mount/action.yml
+++ b/.github/actions/cache/action.yml
@@ -1,4 +1,4 @@
-name: Cache Mount
+name: cache
 description: Mount a build cache directory using Blacksmith sticky disks, or the GitHub Actions cache when running on GitHub-hosted runners.
 
 inputs:
diff --git a/.github/actions/docker-build/action.yml b/.github/actions/image/action.yml
similarity index 99%
rename from .github/actions/docker-build/action.yml
rename to .github/actions/image/action.yml
index 7a880bc768c..950623c4b18 100644
--- a/.github/actions/docker-build/action.yml
+++ b/.github/actions/image/action.yml
@@ -1,4 +1,4 @@
-name: Docker Build and Push
+name: image
 description: Set up a buildx builder and build/push an image, using Blacksmith's builder or the upstream Docker actions on GitHub-hosted runners.
 
 inputs:
@@ -35,7 +35,7 @@ inputs:
     required: false
 
 # Registry logins must precede this action. provenance/sbom stay off: attestation
-# manifests break `imagetools create` retagging in promote-images.
+# manifests break `imagetools create` retagging in the `promote` job of ci.yml.
 runs:
   using: composite
   steps:
diff --git a/.github/actions/setup-workspace/action.yml b/.github/actions/setup/action.yml
similarity index 77%
rename from .github/actions/setup-workspace/action.yml
rename to .github/actions/setup/action.yml
index b6e2e48fdf2..889de90d65a 100644
--- a/.github/actions/setup-workspace/action.yml
+++ b/.github/actions/setup/action.yml
@@ -1,15 +1,23 @@
-name: Setup Workspace
+name: setup
 description: Install the pinned Bun and Node toolchain, mount the dependency (and optionally Turbo) caches, and install workspace dependencies.
 
 inputs:
   provider:
-    description: The CI_PROVIDER repo variable, forwarded to cache-mount.
+    description: The CI_PROVIDER repo variable, forwarded to the cache action.
     required: false
     default: ''
   turbo-cache-key:
     description: Suffix for a Turbo cache mounted at ./.turbo. Empty skips the mount. Jobs that write Turbo entries need distinct suffixes, or last-writer-wins commits evict each other's entries.
     required: false
     default: ''
+  node-version:
+    description: Node version to install. Empty keeps the runner's preinstalled Node, for jobs that only ever ran Bun.
+    required: false
+    default: '24'
+  registry-url:
+    description: npm registry to write an .npmrc for, so `npm publish` reads NODE_AUTH_TOKEN. Empty writes none.
+    required: false
+    default: ''
 
 # Cache keys are scoped by event name, and fork PRs get their own namespace on
 # top: untrusted fork runs must never share a cache with push runs (whose caches
@@ -30,19 +38,21 @@ runs:
         bun-version: 1.4.2
 
     - name: Setup Node
+      if: inputs.node-version != ''
       uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
       with:
-        node-version: 24
+        node-version: ${{ inputs.node-version }}
+        registry-url: ${{ inputs.registry-url }}
 
     - name: Mount Bun cache
-      uses: ./.github/actions/cache-mount
+      uses: ./.github/actions/cache
       with:
         provider: ${{ inputs.provider }}
         key: ${{ github.repository }}-bun-cache-${{ github.event_name }}${{ github.event.pull_request.head.repo.fork && '-fork' || '' }}
         path: ~/.bun/install/cache
 
     - name: Mount node_modules
-      uses: ./.github/actions/cache-mount
+      uses: ./.github/actions/cache
       with:
         provider: ${{ inputs.provider }}
         key: ${{ github.repository }}-node-modules-${{ github.event_name }}${{ github.event.pull_request.head.repo.fork && '-fork' || '' }}-${{ hashFiles('bun.lock') }}
@@ -50,7 +60,7 @@ runs:
 
     - name: Mount Turbo cache
       if: inputs.turbo-cache-key != ''
-      uses: ./.github/actions/cache-mount
+      uses: ./.github/actions/cache
       with:
         provider: ${{ inputs.provider }}
         key: ${{ github.repository }}-${{ inputs.turbo-cache-key }}-${{ github.event_name }}${{ github.event.pull_request.head.repo.fork && '-fork' || '' }}
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 00000000000..30fba8a2d88
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,19 @@
+version: 2
+
+# GitHub Actions only: every `uses:` is pinned to a commit SHA, and without this the pins drift
+# apart (checkout had three different SHAs across workflows). One grouped PR a week keeps every
+# workflow and composite action on the same version of each action.
+updates:
+  - package-ecosystem: github-actions
+    directories:
+      - /
+      - /.github/actions/*
+    schedule:
+      interval: weekly
+    target-branch: staging
+    groups:
+      actions:
+        patterns:
+          - '*'
+    commit-message:
+      prefix: ci
diff --git a/.github/workflows/test-build.yml b/.github/workflows/checks.yml
similarity index 93%
rename from .github/workflows/test-build.yml
rename to .github/workflows/checks.yml
index bab48c79dd9..3fef308a30e 100644
--- a/.github/workflows/test-build.yml
+++ b/.github/workflows/checks.yml
@@ -1,4 +1,4 @@
-name: Test and Build
+name: checks
 
 on:
   workflow_call:
@@ -8,7 +8,7 @@ permissions:
   contents: read
 
 jobs:
-  postgres-integration:
+  integration:
     # Runs the real-infrastructure test layer: every `*.integration.ts` in packages/db and
     # apps/sim, discovered by glob (`vitest run --mode integration`), against the database each
     # provisioning path produces. A new integration suite needs no workflow change.
@@ -18,7 +18,7 @@ jobs:
     # suite's files across four shards; a shard runs its files one at a time against its own
     # database. Files run serially, so a shard barely uses more than one core: 4 vCPU is enough.
     name: integration (${{ matrix.provision }}, ${{ matrix.shard }}/4)
-    runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-4vcpu-ubuntu-2404' || 'ubuntu-latest' }}
+    runs-on: &runner-4vcpu ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-4vcpu-ubuntu-2404' || 'ubuntu-latest' }}
     timeout-minutes: 20
     strategy:
       fail-fast: false
@@ -74,7 +74,7 @@ jobs:
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
 
       - name: Setup workspace
-        uses: ./.github/actions/setup-workspace
+        uses: ./.github/actions/setup
         with:
           provider: ${{ vars.CI_PROVIDER }}
 
@@ -128,7 +128,7 @@ jobs:
   #
   # SCIM runs two suites against a hosted app and is the longest group, so it keeps the 8 vCPU
   # runner; the others boot a smaller self-hosted app and fit on 4.
-  http-e2e:
+  e2e:
     name: e2e (${{ matrix.group }})
     runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && matrix.runner || 'ubuntu-latest' }}
     timeout-minutes: 20
@@ -160,7 +160,7 @@ jobs:
           --health-retries 10
       # Only the desktop executor's app is given REDIS_URL: its doorbell and presence live there.
       redis:
-        image: redis:7-alpine
+        image: redis:8.2-alpine
         ports:
           - 6379:6379
         options: >-
@@ -178,7 +178,7 @@ jobs:
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
 
       - name: Setup workspace
-        uses: ./.github/actions/setup-workspace
+        uses: ./.github/actions/setup
         with:
           provider: ${{ vars.CI_PROVIDER }}
 
@@ -205,9 +205,9 @@ jobs:
   # Pull requests skip the live desktop suite only when every change is clearly unrelated to the
   # app it drives (docs, other apps, published content). Anything else, and any failure to work
   # out the diff, runs it: a pull request that skipped it wrongly would first fail on staging.
-  desktop-live-changes:
-    name: Detect desktop tool changes
-    runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-2vcpu-ubuntu-2404' || 'ubuntu-latest' }}
+  desktop-changes:
+    name: desktop-changes
+    runs-on: &runner-2vcpu ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-2vcpu-ubuntu-2404' || 'ubuntu-latest' }}
     timeout-minutes: 5
     outputs:
       changed: ${{ github.event_name != 'pull_request' || steps.diff.outputs.changed != 'false' }}
@@ -224,11 +224,11 @@ jobs:
         run: bash .github/scripts/desktop-live-changes.sh "$BASE" >> "$GITHUB_OUTPUT"
 
   # Desktop tools in the real Electron app against a local app, on its own runner: the
-  # Electron app, the dev app and its realtime server together outgrow the http-e2e runner.
-  desktop-live-e2e:
-    name: Desktop tools against a local app
-    needs: desktop-live-changes
-    if: needs.desktop-live-changes.outputs.changed == 'true'
+  # Electron app, the dev app and its realtime server together outgrow the e2e runner.
+  desktop-live:
+    name: desktop-live
+    needs: desktop-changes
+    if: needs.desktop-changes.outputs.changed == 'true'
     runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-16vcpu-ubuntu-2404' || 'ubuntu-latest' }}
     timeout-minutes: 30
     services:
@@ -246,7 +246,7 @@ jobs:
           --health-timeout 5s
           --health-retries 10
       redis:
-        image: redis:7-alpine
+        image: redis:8.2-alpine
         ports:
           - 6379:6379
         options: >-
@@ -264,7 +264,7 @@ jobs:
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
 
       - name: Setup workspace
-        uses: ./.github/actions/setup-workspace
+        uses: ./.github/actions/setup
         with:
           provider: ${{ vars.CI_PROVIDER }}
 
@@ -348,7 +348,7 @@ jobs:
   # kept off the test shards so neither waits on the other.
   lint:
     name: lint
-    runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-4vcpu-ubuntu-2404' || 'ubuntu-latest' }}
+    runs-on: *runner-4vcpu
     timeout-minutes: 15
 
     steps:
@@ -366,7 +366,7 @@ jobs:
           fetch-depth: 2
 
       - name: Setup workspace
-        uses: ./.github/actions/setup-workspace
+        uses: ./.github/actions/setup
         with:
           provider: ${{ vars.CI_PROVIDER }}
           turbo-cache-key: turbo-cache
@@ -448,6 +448,20 @@ jobs:
       - name: Lint code
         run: bun run lint:check
 
+      # Workflow syntax, expressions, `needs` references and runner labels. ShellCheck stays off
+      # here: the existing run blocks carry info-level findings that are their own cleanup.
+      - name: Lint workflows
+        env:
+          ACTIONLINT_VERSION: 1.7.12
+          ACTIONLINT_SHA256: 8aca8db96f1b94770f1b0d72b6dddcb1ebb8123cb3712530b08cc387b349a3d8
+        run: |
+          archive="$RUNNER_TEMP/actionlint.tar.gz"
+          curl -fsSL -o "$archive" \
+            "https://github.com/rhysd/actionlint/releases/download/v${ACTIONLINT_VERSION}/actionlint_${ACTIONLINT_VERSION}_linux_amd64.tar.gz"
+          echo "${ACTIONLINT_SHA256}  ${archive}" | sha256sum -c -
+          tar -xzf "$archive" -C "$RUNNER_TEMP" actionlint
+          "$RUNNER_TEMP/actionlint" -color -shellcheck= -pyflakes=
+
       # Every zero-argument `check:*` script, run concurrently. The list is derived in
       # scripts/run-audits.ts, which also writes the per-audit timing table to the job
       # summary and annotates failures. Audits needing a base ref stay separate below.
@@ -463,7 +477,7 @@ jobs:
       # Every workspace, not just realtime. packages/emcn, packages/utils,
       # apps/desktop and apps/docs had no type check in CI at all; apps/sim's
       # source was covered only as a side effect of `next build` in the separate
-      # Build App job. Note this does NOT cover apps/sim's tests — its tsconfig
+      # `build` job. Note this does NOT cover apps/sim's tests — its tsconfig
       # excludes *.test.ts(x), and including them today surfaces ~2.2k errors,
       # so that is its own cleanup rather than a gate to switch on here.
       - name: Type-check all workspaces
@@ -502,7 +516,7 @@ jobs:
           fetch-depth: 2
 
       - name: Setup workspace
-        uses: ./.github/actions/setup-workspace
+        uses: ./.github/actions/setup
         with:
           provider: ${{ vars.CI_PROVIDER }}
           turbo-cache-key: turbo-cache-test-${{ matrix.shard }}
@@ -530,7 +544,7 @@ jobs:
   # Next.js production build, in parallel with lint + tests. Sticky disks are
   # cloned from the last committed snapshot per job and committed last-writer-
   # wins, so concurrent mounts are safe. The bun/node_modules disks are shared
-  # with test-build (the lockfile-hashed key means they only ever share when the
+  # with the test jobs (the lockfile-hashed key means they only ever share when the
   # dependency tree really is identical, so LWW loss is harmless), but the Turbo
   # cache gets its own key: with a shared key, only the last committer's new
   # entries survive each run, so the test and build Turbo entries would evict
@@ -541,7 +555,7 @@ jobs:
   # peaked 51 GB. NODE_OPTIONS' --max-old-space-size caps only Node's JS heap,
   # not the native Turbopack workers that dominate, so it cannot prevent this.
   build:
-    name: Build App
+    name: build
     runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-16vcpu-ubuntu-2404' || 'linux-x64-8-core' }}
     # Build durations crossed 15 minutes as the app grew (10m02 on Jul 29 AM,
     # 14m44 after the folders/desktop/library merges, then two straight
@@ -554,7 +568,7 @@ jobs:
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
 
       - name: Setup workspace
-        uses: ./.github/actions/setup-workspace
+        uses: ./.github/actions/setup
         with:
           provider: ${{ vars.CI_PROVIDER }}
           turbo-cache-key: turbo-cache-build
@@ -599,9 +613,9 @@ jobs:
   # suite skips on pull requests that cannot affect it); a failure or a cancellation is not.
   ci:
     name: ci
-    needs: [postgres-integration, http-e2e, desktop-live-changes, desktop-live-e2e, lint, test, build]
+    needs: [integration, e2e, desktop-changes, desktop-live, lint, test, build]
     if: ${{ !cancelled() }}
-    runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-2vcpu-ubuntu-2404' || 'ubuntu-latest' }}
+    runs-on: *runner-2vcpu
     timeout-minutes: 5
     steps:
       - name: Require every check to pass
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 547db6f3459..be203bb1059 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,4 +1,4 @@
-name: CI
+name: ci
 
 # Runner provider toggle, read from the CI_PROVIDER repo variable:
 #
@@ -34,18 +34,17 @@ permissions:
   contents: read
 
 jobs:
-  test-build:
-    name: Test and Build
+  checks:
+    name: checks
     if: github.ref != 'refs/heads/dev' || github.event_name == 'pull_request'
-    uses: ./.github/workflows/test-build.yml
-    secrets: inherit
+    uses: ./.github/workflows/checks.yml
 
   # Detect if this is a version release commit (e.g., "v0.5.24: ...")
   # Smallest runner on purpose: a few seconds of pure shell over the commit
   # message, no checkout and no install.
-  detect-version:
-    name: Detect Version
-    runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-2vcpu-ubuntu-2404' || 'ubuntu-latest' }}
+  version:
+    name: version
+    runs-on: &runner-2vcpu ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-2vcpu-ubuntu-2404' || 'ubuntu-latest' }}
     timeout-minutes: 5
     if: github.event_name == 'push' && (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/staging' || github.ref == 'refs/heads/dev')
     outputs:
@@ -74,9 +73,9 @@ jobs:
   # the Electron app or the bridge packages trigger a per-env prerelease build
   # (dev → dev stream, staging → staging) that the env's update feed
   # (/api/desktop/update) starts offering automatically.
-  detect-desktop-changes:
-    name: Detect Desktop Changes
-    runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-2vcpu-ubuntu-2404' || 'ubuntu-latest' }}
+  desktop-changes:
+    name: desktop-changes
+    runs-on: *runner-2vcpu
     timeout-minutes: 5
     if: github.event_name == 'push' && (github.ref == 'refs/heads/dev' || github.ref == 'refs/heads/staging')
     outputs:
@@ -116,36 +115,41 @@ jobs:
   # in place before the new app version deploys (replaces the removed ECS
   # migration sidecar)
   migrate:
-    name: Migrate DB
-    needs: [test-build]
+    name: migrate
+    needs: [checks]
     # Explicit need results instead of the implicit success(): a skipped job
     # anywhere in the transitive needs chain silently fails implicit success()
-    # and cascade-skips the deploy chain (migrate -> promote-images ->
+    # and cascade-skips the deploy chain (migrate -> promote ->
     # CodeDeploy) — this bit us on 2026-07-23. State requirements explicitly.
     if: >-
       !cancelled() &&
-      needs.test-build.result == 'success' &&
+      needs.checks.result == 'success' &&
       github.event_name == 'push' &&
       (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/staging')
-    uses: ./.github/workflows/migrations.yml
+    uses: ./.github/workflows/migrate.yml
     with:
       environment: ${{ github.ref == 'refs/heads/main' && 'production' || 'staging' }}
-    secrets: inherit
+    secrets:
+      DATABASE_URL: ${{ secrets.DATABASE_URL }}
+      STAGING_DATABASE_URL: ${{ secrets.STAGING_DATABASE_URL }}
+      MIGRATION_DATABASE_URL: ${{ secrets.MIGRATION_DATABASE_URL }}
+      STAGING_MIGRATION_DATABASE_URL: ${{ secrets.STAGING_MIGRATION_DATABASE_URL }}
 
   # Same ordering for dev (schema push before the dev image lands in ECR)
   migrate-dev:
-    name: Migrate Dev DB
+    name: migrate-dev
     if: github.event_name == 'push' && github.ref == 'refs/heads/dev'
-    uses: ./.github/workflows/migrations.yml
+    uses: ./.github/workflows/migrate.yml
     with:
       environment: dev
-    secrets: inherit
+    secrets:
+      DEV_DATABASE_URL: ${{ secrets.DEV_DATABASE_URL }}
 
   # Dev: build immutable images alongside the schema push and Trigger upload.
-  build-dev:
-    name: Build Dev ECR
+  image-dev:
+    name: image-dev (${{ matrix.id }})
     if: github.event_name == 'push' && github.ref == 'refs/heads/dev'
-    runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && matrix.bs_runner || matrix.gh_runner }}
+    runs-on: &runner-matrix ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && matrix.bs_runner || matrix.gh_runner }}
     timeout-minutes: 30
     permissions:
       contents: read
@@ -162,29 +166,33 @@ jobs:
           # deploy — nothing ships until the image is pushed — and its two
           # dominant steps both scale with cores (`bun install` ~300-400s, `next
           # build` ~260s). The same `next build` runs on 16 vCPU in the separate
-          # Build App verification job, which does not gate anything; this one
+          # checks `build` job, which does not gate anything; this one
           # was doing comparable work on half the cores.
           #
           # cache_mb is the layer cache the post-job prune retains, and it is the
-          # only reason the sticky disks stay bounded — see docker-build's
+          # only reason the sticky disks stay bounded — see the image action's
           # action.yml. Rows that omit it take the small-image default there. The
           # app image overrides because it carries ~34 layers plus apt and bun
           # cache mounts for the whole monorepo; 100 GB is several builds' worth
           # of headroom over that working set.
-          - dockerfile: ./docker/app.Dockerfile
+          - id: app
+            dockerfile: ./docker/app.Dockerfile
             cache_mb: '102400'
             ecr_repo_secret: ECR_APP
             gh_runner: linux-x64-8-core
             bs_runner: blacksmith-16vcpu-ubuntu-2404
-          - dockerfile: ./docker/db.Dockerfile
+          - id: db
+            dockerfile: ./docker/db.Dockerfile
             ecr_repo_secret: ECR_MIGRATIONS
             gh_runner: ubuntu-latest
             bs_runner: blacksmith-2vcpu-ubuntu-2404
-          - dockerfile: ./docker/realtime.Dockerfile
+          - id: realtime
+            dockerfile: ./docker/realtime.Dockerfile
             ecr_repo_secret: ECR_REALTIME
             gh_runner: ubuntu-latest
             bs_runner: blacksmith-2vcpu-ubuntu-2404
-          - dockerfile: ./docker/pii.Dockerfile
+          - id: pii
+            dockerfile: ./docker/pii.Dockerfile
             ecr_repo_secret: ECR_PII
             gh_runner: ubuntu-latest
             bs_runner: blacksmith-2vcpu-ubuntu-2404
@@ -215,7 +223,7 @@ jobs:
           ECR_REPO: ${{ matrix.ecr_repo_secret == 'ECR_APP' && secrets.ECR_APP || matrix.ecr_repo_secret == 'ECR_MIGRATIONS' && secrets.ECR_MIGRATIONS || matrix.ecr_repo_secret == 'ECR_REALTIME' && secrets.ECR_REALTIME || matrix.ecr_repo_secret == 'ECR_PII' && secrets.ECR_PII || '' }}
 
       - name: Build and push
-        uses: ./.github/actions/docker-build
+        uses: ./.github/actions/image
         with:
           provider: ${{ vars.CI_PROVIDER }}
           file: ${{ matrix.dockerfile }}
@@ -226,13 +234,13 @@ jobs:
           max-cache-size-mb: ${{ matrix.cache_mb }}
 
   # Staging/production coordinate task releases with app traffic cutover.
-  # Dev tasks deploy independently in deploy-trigger-dev.yml.
-  prepare-trigger:
-    name: Prepare Trigger.dev
+  # Dev tasks deploy independently in trigger-dev.yml.
+  trigger-upload:
+    name: trigger-upload
     if: >-
       github.event_name == 'push' &&
       (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/staging')
-    runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-4vcpu-ubuntu-2404' || 'ubuntu-latest' }}
+    runs-on: &runner-4vcpu ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-4vcpu-ubuntu-2404' || 'ubuntu-latest' }}
     timeout-minutes: 30
     outputs:
       version: ${{ steps.deploy.outputs.deploymentVersion }}
@@ -242,24 +250,11 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
 
-      - name: Setup Bun
-        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+      - name: Setup workspace
+        uses: ./.github/actions/setup
         with:
-          bun-version: 1.4.2
-
-      - name: Cache Bun dependencies
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
-        with:
-          path: |
-            ~/.bun/install/cache
-            node_modules
-            **/node_modules
-          key: ${{ runner.os }}-bun-${{ hashFiles('**/bun.lock') }}
-          restore-keys: |
-            ${{ runner.os }}-bun-
-
-      - name: Install dependencies
-        run: bun install --frozen-lockfile --ignore-scripts
+          provider: ${{ vars.CI_PROVIDER }}
+          node-version: ''
 
       - name: Select Trigger environment
         id: target
@@ -305,13 +300,13 @@ jobs:
   # Runs in parallel with tests — only immutable sha tags are pushed here, and
   # the CodePipeline EventBridge triggers filter on exactly the
   # latest/staging/dev ECR tags, so nothing deploys and no mutable tag moves
-  # until promote-images / create-ghcr-manifests retag after the gate.
-  build-amd64:
-    name: Build AMD64
+  # until promote / ghcr retag after the gate.
+  image-amd64:
+    name: image-amd64 (${{ matrix.id }})
     if: >-
       github.event_name == 'push' &&
       (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/staging')
-    runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && matrix.bs_runner || matrix.gh_runner }}
+    runs-on: *runner-matrix
     timeout-minutes: 30
     permissions:
       contents: read
@@ -321,30 +316,35 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - dockerfile: ./docker/app.Dockerfile
+          - id: app
+            dockerfile: ./docker/app.Dockerfile
             cache_mb: '102400'
             ghcr_image: ghcr.io/simstudioai/simstudio
             ecr_repo_secret: ECR_APP
             gh_runner: linux-x64-8-core
             bs_runner: blacksmith-16vcpu-ubuntu-2404
-          - dockerfile: ./docker/db.Dockerfile
+          - id: db
+            dockerfile: ./docker/db.Dockerfile
             ghcr_image: ghcr.io/simstudioai/migrations
             ecr_repo_secret: ECR_MIGRATIONS
             gh_runner: ubuntu-latest
             bs_runner: blacksmith-2vcpu-ubuntu-2404
-          - dockerfile: ./docker/realtime.Dockerfile
+          - id: realtime
+            dockerfile: ./docker/realtime.Dockerfile
             ghcr_image: ghcr.io/simstudioai/realtime
             ecr_repo_secret: ECR_REALTIME
             gh_runner: ubuntu-latest
             bs_runner: blacksmith-2vcpu-ubuntu-2404
-          - dockerfile: ./docker/pii.Dockerfile
+          - id: pii
+            dockerfile: ./docker/pii.Dockerfile
             ghcr_image: ghcr.io/simstudioai/pii
             ecr_repo_secret: ECR_PII
             gh_runner: ubuntu-latest
             bs_runner: blacksmith-2vcpu-ubuntu-2404
           # No ECR repo is provisioned for cron, so it publishes to GHCR only.
           # The tag step below omits the ECR tag when the repo name is empty.
-          - dockerfile: ./docker/cron.Dockerfile
+          - id: cron
+            dockerfile: ./docker/cron.Dockerfile
             ghcr_image: ghcr.io/simstudioai/cron
             gh_runner: ubuntu-latest
             bs_runner: blacksmith-2vcpu-ubuntu-2404
@@ -383,8 +383,8 @@ jobs:
           ECR_REPO: ${{ matrix.ecr_repo_secret == 'ECR_APP' && secrets.ECR_APP || matrix.ecr_repo_secret == 'ECR_MIGRATIONS' && secrets.ECR_MIGRATIONS || matrix.ecr_repo_secret == 'ECR_REALTIME' && secrets.ECR_REALTIME || matrix.ecr_repo_secret == 'ECR_PII' && secrets.ECR_PII || '' }}
 
       # Only sha tags here — the ECR deploy tags (latest/staging) are applied
-      # by promote-images and the GHCR latest-amd64/version tags by
-      # create-ghcr-manifests, both after tests and migrations pass.
+      # by promote and the GHCR latest-amd64/version tags by
+      # ghcr, both after tests and migrations pass.
       - name: Generate tags
         id: meta
         run: |
@@ -419,7 +419,7 @@ jobs:
 
       - name: Build and push images
         if: steps.meta.outputs.skip != 'true'
-        uses: ./.github/actions/docker-build
+        uses: ./.github/actions/image
         with:
           provider: ${{ vars.CI_PROVIDER }}
           file: ${{ matrix.dockerfile }}
@@ -434,33 +434,33 @@ jobs:
   # the image builds themselves run in parallel with the tests. A single job
   # (not a matrix) so all four sha manifests are verified before any tag
   # moves; a missing image can't produce a partial mixed-version deploy.
-  promote-images:
-    name: Promote Images
-    needs: [migrate, build-amd64, prepare-trigger, migrate-dev, build-dev]
+  promote:
+    name: promote
+    needs: [migrate, image-amd64, trigger-upload, migrate-dev, image-dev]
     # Explicit results: see migrate's comment.
     if: >-
       !cancelled() && github.event_name == 'push' &&
       (
         ((github.ref == 'refs/heads/main' || github.ref == 'refs/heads/staging') &&
-          needs.prepare-trigger.result == 'success' &&
+          needs.trigger-upload.result == 'success' &&
           needs.migrate.result == 'success' &&
-          needs.build-amd64.result == 'success') ||
+          needs.image-amd64.result == 'success') ||
         (github.ref == 'refs/heads/dev' &&
           needs.migrate-dev.result == 'success' &&
-          needs.build-dev.result == 'success')
+          needs.image-dev.result == 'success')
       )
-    runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-2vcpu-ubuntu-2404' || 'ubuntu-latest' }}
+    runs-on: *runner-2vcpu
     timeout-minutes: 10
     permissions:
       contents: read
       id-token: write
     outputs:
       # Whether the deploy tag was actually moved (false on a stale-run guard
-      # skip). promote-trigger keys off this so tasks are never promoted when
+      # skip). trigger-promote keys off this so tasks are never promoted when
       # the app itself wasn't.
       promoted: ${{ steps.guard.outputs.fresh }}
       # Epoch when the deploy tag was retagged (this push's ECS pipeline trigger).
-      # promote-trigger passes it to the poll script so a stale pipeline execution
+      # trigger-promote passes it to the poll script so a stale pipeline execution
       # reusing the same image digest can't satisfy the cutover gate.
       retag_epoch: ${{ steps.promote.outputs.retag_epoch }}
       # Unchanged tags verify the latest execution's cutover without an epoch bound.
@@ -552,21 +552,21 @@ jobs:
   # traffic cutover (CodeDeploy AllowTraffic on every target). The image retag
   # triggers the ECS pipeline; this job correlates it via the digest + retag epoch
   # (rejecting a stale execution reusing the digest) and promotes at cutover.
-  # Skipped when promote-images skipped the tag move (stale run) — tasks then
+  # Skipped when promote skipped the tag move (stale run) — tasks then
   # correctly stay on the old version. If the app deploy fails or never cuts over,
   # promote never fires and this job fails visibly.
-  promote-trigger:
-    name: Promote Trigger.dev
-    needs: [promote-images, prepare-trigger]
+  trigger-promote:
+    name: trigger-promote
+    needs: [promote, trigger-upload]
     # Explicit results also suppress skip propagation from optional ancestors.
     if: >-
       !cancelled() &&
       github.event_name == 'push' &&
       (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/staging') &&
-      needs.promote-images.result == 'success' &&
-      needs.prepare-trigger.result == 'success' &&
-      needs.promote-images.outputs.promoted == 'true'
-    runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-4vcpu-ubuntu-2404' || 'ubuntu-latest' }}
+      needs.promote.result == 'success' &&
+      needs.trigger-upload.result == 'success' &&
+      needs.promote.outputs.promoted == 'true'
+    runs-on: *runner-4vcpu
     # Leave setup/promotion headroom above the 70-minute cutover poll.
     timeout-minutes: 90
     permissions:
@@ -576,24 +576,11 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
 
-      - name: Setup Bun
-        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+      - name: Setup workspace
+        uses: ./.github/actions/setup
         with:
-          bun-version: 1.4.2
-
-      - name: Cache Bun dependencies
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
-        with:
-          path: |
-            ~/.bun/install/cache
-            node_modules
-            **/node_modules
-          key: ${{ runner.os }}-bun-${{ hashFiles('**/bun.lock') }}
-          restore-keys: |
-            ${{ runner.os }}-bun-
-
-      - name: Install dependencies
-        run: bun install --frozen-lockfile --ignore-scripts
+          provider: ${{ vars.CI_PROVIDER }}
+          node-version: ''
 
       - name: Configure AWS credentials
         uses: aws-actions/configure-aws-credentials@e7f100cf4c008499ea8adda475de1042d6975c7b # v6
@@ -607,10 +594,10 @@ jobs:
       - name: Wait for ECS traffic cutover
         env:
           OVERALL_TIMEOUT: 4200
-          APP_IMAGE_CHANGED: ${{ needs.promote-images.outputs.app_image_changed }}
-          DIGEST: ${{ needs.promote-images.outputs.app_image_digest }}
+          APP_IMAGE_CHANGED: ${{ needs.promote.outputs.app_image_changed }}
+          DIGEST: ${{ needs.promote.outputs.app_image_digest }}
           PIPELINE: sim-${{ github.ref == 'refs/heads/main' && 'production' || github.ref == 'refs/heads/dev' && 'dev' || 'staging' }}-us-east-1-app-deployment
-          RETAG_EPOCH: ${{ needs.promote-images.outputs.retag_epoch }}
+          RETAG_EPOCH: ${{ needs.promote.outputs.retag_epoch }}
         run: |
           set -eo pipefail
           case "$APP_IMAGE_CHANGED" in
@@ -625,9 +612,9 @@ jobs:
         env:
           TRIGGER_ACCESS_TOKEN: ${{ secrets.TRIGGER_ACCESS_TOKEN }}
           TRIGGER_PROJECT_ID: ${{ secrets.TRIGGER_PROJECT_ID }}
-          TRIGGER_ENV: ${{ needs.prepare-trigger.outputs.environment }}
-          TRIGGER_BRANCH: ${{ needs.prepare-trigger.outputs.preview_branch }}
-          VERSION: ${{ needs.prepare-trigger.outputs.version }}
+          TRIGGER_ENV: ${{ needs.trigger-upload.outputs.environment }}
+          TRIGGER_BRANCH: ${{ needs.trigger-upload.outputs.preview_branch }}
+          VERSION: ${{ needs.trigger-upload.outputs.version }}
         run: |
           set -eo pipefail
           if [ -z "$TRIGGER_ACCESS_TOKEN" ] || [ -z "$TRIGGER_PROJECT_ID" ]; then
@@ -635,7 +622,7 @@ jobs:
             exit 1
           fi
           if [ -z "$VERSION" ]; then
-            echo "ERROR: no deployed version passed from prepare-trigger" >&2
+            echo "ERROR: no deployed version passed from trigger-upload" >&2
             exit 1
           fi
           echo "Promoting Trigger.dev version $VERSION ($TRIGGER_ENV)"
@@ -647,11 +634,11 @@ jobs:
 
   # Build ARM64 images for GHCR (main branch only, runs in parallel with
   # tests). Pushes only the immutable sha tag — latest-arm64/version-arm64
-  # are applied by create-ghcr-manifests after the gate, so a failing run
+  # are applied by ghcr after the gate, so a failing run
   # never moves a documented tag.
-  build-ghcr-arm64:
-    name: Build ARM64 (GHCR Only)
-    runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && matrix.bs_runner || matrix.gh_runner }}
+  image-arm64:
+    name: image-arm64 (${{ matrix.id }})
+    runs-on: *runner-matrix
     timeout-minutes: 30
     if: github.event_name == 'push' && github.ref == 'refs/heads/main'
     permissions:
@@ -665,24 +652,29 @@ jobs:
         # and this job only runs on push to main — an unprovisioned label would
         # hang a release in `queued` rather than fail a PR.
         include:
-          - dockerfile: ./docker/app.Dockerfile
+          - id: app
+            dockerfile: ./docker/app.Dockerfile
             cache_mb: '102400'
             image: ghcr.io/simstudioai/simstudio
             gh_runner: linux-arm64-8-core
             bs_runner: blacksmith-16vcpu-ubuntu-2404-arm
-          - dockerfile: ./docker/db.Dockerfile
+          - id: db
+            dockerfile: ./docker/db.Dockerfile
             image: ghcr.io/simstudioai/migrations
             gh_runner: ubuntu-24.04-arm
             bs_runner: blacksmith-4vcpu-ubuntu-2404-arm
-          - dockerfile: ./docker/realtime.Dockerfile
+          - id: realtime
+            dockerfile: ./docker/realtime.Dockerfile
             image: ghcr.io/simstudioai/realtime
             gh_runner: ubuntu-24.04-arm
             bs_runner: blacksmith-4vcpu-ubuntu-2404-arm
-          - dockerfile: ./docker/pii.Dockerfile
+          - id: pii
+            dockerfile: ./docker/pii.Dockerfile
             image: ghcr.io/simstudioai/pii
             gh_runner: ubuntu-24.04-arm
             bs_runner: blacksmith-4vcpu-ubuntu-2404-arm
-          - dockerfile: ./docker/cron.Dockerfile
+          - id: cron
+            dockerfile: ./docker/cron.Dockerfile
             image: ghcr.io/simstudioai/cron
             gh_runner: ubuntu-24.04-arm
             bs_runner: blacksmith-4vcpu-ubuntu-2404-arm
@@ -699,7 +691,7 @@ jobs:
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Build and push ARM64 to GHCR
-        uses: ./.github/actions/docker-build
+        uses: ./.github/actions/image
         with:
           provider: ${{ vars.CI_PROVIDER }}
           file: ${{ matrix.dockerfile }}
@@ -709,18 +701,18 @@ jobs:
 
   # Publish all mutable GHCR tags (latest, latest-amd64/arm64, version tags)
   # and the multi-arch manifests from the immutable sha tags — only on main,
-  # after the deploy gate (promote-images) and the ARM64 build both pass.
-  create-ghcr-manifests:
-    name: Create GHCR Manifests
-    runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-2vcpu-ubuntu-2404' || 'ubuntu-latest' }}
+  # after the deploy gate (promote) and the ARM64 build both pass.
+  ghcr:
+    name: ghcr (${{ matrix.id }})
+    runs-on: *runner-2vcpu
     timeout-minutes: 10
-    needs: [promote-images, build-ghcr-arm64, detect-version]
+    needs: [promote, image-arm64, version]
     # Explicit results: see migrate's comment.
     if: >-
       !cancelled() &&
-      needs.promote-images.result == 'success' &&
-      needs.build-ghcr-arm64.result == 'success' &&
-      needs.detect-version.result == 'success' &&
+      needs.promote.result == 'success' &&
+      needs.image-arm64.result == 'success' &&
+      needs.version.result == 'success' &&
       github.event_name == 'push' && github.ref == 'refs/heads/main'
     permissions:
       contents: read
@@ -733,11 +725,16 @@ jobs:
     strategy:
       matrix:
         include:
-          - image: ghcr.io/simstudioai/simstudio
-          - image: ghcr.io/simstudioai/migrations
-          - image: ghcr.io/simstudioai/realtime
-          - image: ghcr.io/simstudioai/pii
-          - image: ghcr.io/simstudioai/cron
+          - id: simstudio
+            image: ghcr.io/simstudioai/simstudio
+          - id: migrations
+            image: ghcr.io/simstudioai/migrations
+          - id: realtime
+            image: ghcr.io/simstudioai/realtime
+          - id: pii
+            image: ghcr.io/simstudioai/pii
+          - id: cron
+            image: ghcr.io/simstudioai/cron
 
     steps:
       - name: Login to GHCR
@@ -747,7 +744,7 @@ jobs:
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
-      # Same monotonic guard as promote-images, applied to the public latest
+      # Same monotonic guard as promote, applied to the public latest
       # tags only — immutable sha and version tags are always published.
       - name: Guard against stale latest tags
         id: guard
@@ -771,8 +768,8 @@ jobs:
           docker buildx imagetools create -t "${IMAGE}:${SHA}" \
             "${IMAGE}:${SHA}-amd64" "${IMAGE}:${SHA}-arm64"
 
-          if [ "${{ needs.detect-version.outputs.is_release }}" = "true" ]; then
-            VERSION="${{ needs.detect-version.outputs.version }}"
+          if [ "${{ needs.version.outputs.is_release }}" = "true" ]; then
+            VERSION="${{ needs.version.outputs.version }}"
             echo "📦 Publishing version tags: ${VERSION}"
             docker buildx imagetools create -t "${IMAGE}:${VERSION}-amd64" "${IMAGE}:${SHA}-amd64"
             docker buildx imagetools create -t "${IMAGE}:${VERSION}-arm64" "${IMAGE}:${SHA}-arm64"
@@ -789,10 +786,10 @@ jobs:
 
   # Sign the published images and attach SLSA provenance and an SBOM to each.
   #
-  # This runs after create-ghcr-manifests rather than inside the build because
+  # This runs after ghcr rather than inside the build because
   # buildx's own provenance/sbom attestations stay off (see the note in
-  # .github/actions/docker-build): the extra manifests they add to an index
-  # break the `imagetools create` retagging that promote-images depends on.
+  # .github/actions/image): the extra manifests they add to an index
+  # break the `imagetools create` retagging that promote depends on.
   # Attaching attestations here instead leaves the index itself untouched — they
   # are stored as separate referrer manifests that point at it.
   #
@@ -804,18 +801,18 @@ jobs:
   # `:<sha>-amd64` manifest it wraps — attesting the manifest leaves the tag
   # people actually pin unverifiable. Which tags exist also varies per run:
   # version tags only on a release, and the latest tags only when the monotonic
-  # guard in create-ghcr-manifests passed. Resolving tag -> digest here and
+  # guard in ghcr passed. Resolving tag -> digest here and
   # de-duplicating is what keeps the two in step without hardcoding that logic
   # twice.
   attest-subjects:
-    name: Resolve Attestation Subjects
-    runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-2vcpu-ubuntu-2404' || 'ubuntu-latest' }}
+    name: attest-subjects
+    runs-on: *runner-2vcpu
     timeout-minutes: 10
-    needs: [create-ghcr-manifests, detect-version]
+    needs: [ghcr, version]
     if: >-
       !cancelled() &&
-      needs.create-ghcr-manifests.result == 'success' &&
-      needs.detect-version.result == 'success' &&
+      needs.ghcr.result == 'success' &&
+      needs.version.result == 'success' &&
       github.event_name == 'push' && github.ref == 'refs/heads/main'
     permissions:
       contents: read
@@ -834,10 +831,10 @@ jobs:
       - name: Resolve published tags to digests
         id: resolve
         env:
-          IS_RELEASE: ${{ needs.detect-version.outputs.is_release }}
-          VERSION: ${{ needs.detect-version.outputs.version }}
+          IS_RELEASE: ${{ needs.version.outputs.is_release }}
+          VERSION: ${{ needs.version.outputs.version }}
           SHA: ${{ github.sha }}
-          LATEST_FRESH: ${{ needs.create-ghcr-manifests.outputs.latest_fresh }}
+          LATEST_FRESH: ${{ needs.ghcr.outputs.latest_fresh }}
         run: |
           set -euo pipefail
 
@@ -911,7 +908,7 @@ jobs:
 
             # A moving alias is only taken when it resolves to the same index
             # digest this run published — content identity, which is what a
-            # digest can prove. create-ghcr-manifests holds the latest tags back when
+            # digest can prove. ghcr holds the latest tags back when
             # its monotonic guard sees a newer commit, and they then still point
             # at an older build — attesting those would put this run's signature
             # and provenance on an image it did not produce. The per-arch
@@ -983,9 +980,9 @@ jobs:
   # One leg per distinct published digest. Attesting each subject separately is
   # also what makes the SBOMs truthful: the amd64 and arm64 images contain
   # different packages, and one SBOM attached to the index cannot describe both.
-  attest-images:
-    name: Attest Images
-    runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-2vcpu-ubuntu-2404' || 'ubuntu-latest' }}
+  attest:
+    name: attest
+    runs-on: *runner-2vcpu
     timeout-minutes: 15
     needs: [attest-subjects]
     if: >-
@@ -1064,9 +1061,9 @@ jobs:
   # Check if docs changed
   # Smallest runner on purpose: a depth-2 checkout plus a path filter, no
   # install and no build.
-  check-docs-changes:
-    name: Check Docs Changes
-    runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-2vcpu-ubuntu-2404' || 'ubuntu-latest' }}
+  docs-changes:
+    name: docs-changes
+    runs-on: *runner-2vcpu
     timeout-minutes: 5
     if: github.event_name == 'push' && github.ref == 'refs/heads/main'
     outputs:
@@ -1085,41 +1082,43 @@ jobs:
               - 'apps/sim/lib/chunkers/**'
 
   # Process docs embeddings (only when docs change, after images are promoted)
-  process-docs:
-    name: Process Docs
-    needs: [promote-images, check-docs-changes]
+  docs:
+    name: docs
+    needs: [promote, docs-changes]
     # Explicit results: see migrate's comment.
     if: >-
       !cancelled() &&
-      needs.promote-images.result == 'success' &&
-      needs.check-docs-changes.result == 'success' &&
-      needs.check-docs-changes.outputs.docs_changed == 'true'
-    uses: ./.github/workflows/docs-embeddings.yml
-    secrets: inherit
+      needs.promote.result == 'success' &&
+      needs.docs-changes.result == 'success' &&
+      needs.docs-changes.outputs.docs_changed == 'true'
+    uses: ./.github/workflows/docs.yml
+    secrets:
+      DATABASE_URL: ${{ secrets.DATABASE_URL }}
+      OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
 
   # Create GitHub Release (only for version commits on main, after all builds complete)
-  create-release:
-    name: Create GitHub Release
-    runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-4vcpu-ubuntu-2404' || 'ubuntu-latest' }}
+  release:
+    name: release
+    runs-on: *runner-4vcpu
     timeout-minutes: 10
-    needs: [create-ghcr-manifests, attest-subjects, attest-images, detect-version]
-    # Explicit results: see migrate's comment. attest-images is a gate, not just
+    needs: [ghcr, attest-subjects, attest, version]
+    # Explicit results: see migrate's comment. attest is a gate, not just
     # an ordering edge — a release must not advertise images whose signature or
     # attestation failed to publish. The count check is belt and braces: today
     # attest-subjects already fails on an empty subject set, so this only bites
     # if that guard is ever removed.
     #
     # Note this gates the GitHub release, not the production deploy: CodePipeline
-    # fires from the ECR tags moved by promote-images, upstream of this job, and
+    # fires from the ECR tags moved by promote, upstream of this job, and
     # only the GHCR mirrors are attested.
     if: >-
       !cancelled() &&
-      needs.create-ghcr-manifests.result == 'success' &&
+      needs.ghcr.result == 'success' &&
       needs.attest-subjects.result == 'success' &&
       needs.attest-subjects.outputs.count != '0' &&
-      needs.attest-images.result == 'success' &&
-      needs.detect-version.result == 'success' &&
-      needs.detect-version.outputs.is_release == 'true'
+      needs.attest.result == 'success' &&
+      needs.version.result == 'success' &&
+      needs.version.outputs.is_release == 'true'
     permissions:
       contents: write
     steps:
@@ -1128,18 +1127,16 @@ jobs:
         with:
           fetch-depth: 0
 
-      - name: Setup Bun
-        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+      - name: Setup workspace
+        uses: ./.github/actions/setup
         with:
-          bun-version: 1.4.2
-
-      - name: Install dependencies
-        run: bun install --frozen-lockfile --ignore-scripts
+          provider: ${{ vars.CI_PROVIDER }}
+          node-version: ''
 
       - name: Create release
         env:
           GH_PAT: ${{ secrets.GITHUB_TOKEN }}
-        run: bun run scripts/create-single-release.ts ${{ needs.detect-version.outputs.version }}
+        run: bun run scripts/create-single-release.ts ${{ needs.version.outputs.version }}
 
   # Desktop release: builds, signs, notarizes, and attaches the macOS app to
   # the GitHub release created above. Gated on the Apple signing secrets so a
@@ -1147,14 +1144,14 @@ jobs:
   # Developer account is provisioned — the moment the six secrets exist, the
   # next vX.Y.Z release ships desktop artifacts with no further changes.
   # Job-level `if:` cannot read the secrets context, hence the probe job.
-  check-desktop-signing:
-    name: Check Desktop Signing Secrets
-    runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-2vcpu-ubuntu-2404' || 'ubuntu-latest' }}
+  desktop-signing:
+    name: desktop-signing
+    runs-on: *runner-2vcpu
     timeout-minutes: 2
-    needs: [detect-version, detect-desktop-changes]
-    # !cancelled(): detect-desktop-changes is skipped on main (and
-    # detect-version tags only on main); either path may need the probe.
-    if: ${{ !cancelled() && (needs.detect-version.outputs.is_release == 'true' || needs.detect-desktop-changes.outputs.changed == 'true') }}
+    needs: [version, desktop-changes]
+    # !cancelled(): desktop-changes is skipped on main (and
+    # version tags only on main); either path may need the probe.
+    if: ${{ !cancelled() && (needs.version.outputs.is_release == 'true' || needs.desktop-changes.outputs.changed == 'true') }}
     outputs:
       configured: ${{ steps.check.outputs.configured }}
     steps:
@@ -1169,24 +1166,31 @@ jobs:
           fi
 
   desktop-release:
-    name: Desktop Release
-    needs: [create-release, check-desktop-signing, detect-version]
-    # Suppress the implicit success() check: check-desktop-signing has an
+    name: desktop-release
+    needs: [release, desktop-signing, version]
+    # Suppress the implicit success() check: desktop-signing has an
     # intentionally skipped transitive dependency on main, which would
     # otherwise cascade-skip this job even when every direct need succeeded.
     if: >-
       !cancelled() &&
-      needs.create-release.result == 'success' &&
-      needs.check-desktop-signing.result == 'success' &&
-      needs.detect-version.result == 'success' &&
-      needs.check-desktop-signing.outputs.configured == 'true'
+      needs.release.result == 'success' &&
+      needs.desktop-signing.result == 'success' &&
+      needs.version.result == 'success' &&
+      needs.desktop-signing.outputs.configured == 'true'
     permissions:
       contents: write
     uses: ./.github/workflows/desktop-release.yml
     with:
-      version: ${{ needs.detect-version.outputs.version }}
+      version: ${{ needs.version.outputs.version }}
       publish: true
-    secrets: inherit
+    secrets:
+      DESKTOP_RELEASE_TOKEN: ${{ secrets.DESKTOP_RELEASE_TOKEN }}
+      CSC_LINK: ${{ secrets.CSC_LINK }}
+      CSC_KEY_PASSWORD: ${{ secrets.CSC_KEY_PASSWORD }}
+      APPLE_API_KEY_P8: ${{ secrets.APPLE_API_KEY_P8 }}
+      APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
+      APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
+      APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
 
   # Per-env desktop prereleases: a dev/staging push that touches shell code
   # publishes an environment-tagged GitHub prerelease to the public,
@@ -1194,19 +1198,19 @@ jobs:
   # builds out of this source repository prevents its followers from receiving
   # every internal shell release. Each environment's /api/desktop/update feed
   # still offers only its own signed stream.
-  create-desktop-prerelease:
-    name: Create Desktop Prerelease
-    runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-2vcpu-ubuntu-2404' || 'ubuntu-latest' }}
+  prerelease-create:
+    name: prerelease-create
+    runs-on: *runner-2vcpu
     timeout-minutes: 5
-    needs: [detect-desktop-changes, check-desktop-signing]
+    needs: [desktop-changes, desktop-signing]
     # Requires the signing probe to have actually succeeded (not just "not
     # cancelled") so a probe failure can't produce a release with no build.
     if: >-
       ${{
         !cancelled() &&
-        needs.detect-desktop-changes.outputs.changed == 'true' &&
-        needs.check-desktop-signing.result == 'success' &&
-        needs.check-desktop-signing.outputs.configured == 'true'
+        needs.desktop-changes.outputs.changed == 'true' &&
+        needs.desktop-signing.result == 'success' &&
+        needs.desktop-signing.outputs.configured == 'true'
       }}
     permissions:
       contents: read
@@ -1265,9 +1269,9 @@ jobs:
           echo "version=$TAG" >> "$GITHUB_OUTPUT"
           echo "✅ Created draft prerelease $TAG"
 
-  desktop-prerelease:
-    name: Desktop Prerelease Build
-    needs: [create-desktop-prerelease, check-desktop-signing]
+  prerelease-build:
+    name: prerelease-build
+    needs: [prerelease-create, desktop-signing]
     # The reusable workflow declares contents: write for its stable-release
     # path. GitHub cannot elevate a caller's token, even though this prerelease
     # path uses the dedicated cross-repository token for its actual upload.
@@ -1275,25 +1279,32 @@ jobs:
       contents: write
     uses: ./.github/workflows/desktop-release.yml
     with:
-      version: ${{ needs.create-desktop-prerelease.outputs.version }}
+      version: ${{ needs.prerelease-create.outputs.version }}
       publish: true
       sign: true
-    secrets: inherit
+    secrets:
+      DESKTOP_RELEASE_TOKEN: ${{ secrets.DESKTOP_RELEASE_TOKEN }}
+      CSC_LINK: ${{ secrets.CSC_LINK }}
+      CSC_KEY_PASSWORD: ${{ secrets.CSC_KEY_PASSWORD }}
+      APPLE_API_KEY_P8: ${{ secrets.APPLE_API_KEY_P8 }}
+      APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
+      APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
+      APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
 
   # The draft only becomes visible to the update feed once its artifacts are
   # attached — this is what makes a dev/staging push atomic from the shell's
   # point of view.
-  publish-desktop-prerelease:
-    name: Publish Desktop Prerelease
-    runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-2vcpu-ubuntu-2404' || 'ubuntu-latest' }}
+  prerelease-publish:
+    name: prerelease-publish
+    runs-on: *runner-2vcpu
     timeout-minutes: 5
-    needs: [create-desktop-prerelease, desktop-prerelease]
+    needs: [prerelease-create, prerelease-build]
     permissions:
       contents: read
     env:
       GH_TOKEN: ${{ secrets.DESKTOP_RELEASE_TOKEN }}
       GH_REPO: simstudioai/sim-desktop-releases
-      TAG: ${{ needs.create-desktop-prerelease.outputs.version }}
+      TAG: ${{ needs.prerelease-create.outputs.version }}
     steps:
       - name: Publish the draft release
         run: |
@@ -1307,17 +1318,17 @@ jobs:
   # and delete the rest (with their tags, so dev force-resets don't strand
   # commits behind stale tags). Leftover drafts (failed or superseded builds)
   # are always garbage by this point — the current run's release is published.
-  prune-desktop-prereleases:
-    name: Prune Desktop Prereleases
-    runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-2vcpu-ubuntu-2404' || 'ubuntu-latest' }}
+  prerelease-prune:
+    name: prerelease-prune
+    runs-on: *runner-2vcpu
     timeout-minutes: 5
-    needs: [create-desktop-prerelease, publish-desktop-prerelease]
+    needs: [prerelease-create, prerelease-publish]
     permissions:
       contents: read
     env:
       GH_TOKEN: ${{ secrets.DESKTOP_RELEASE_TOKEN }}
       GH_REPO: simstudioai/sim-desktop-releases
-      CURRENT_TAG: ${{ needs.create-desktop-prerelease.outputs.version }}
+      CURRENT_TAG: ${{ needs.prerelease-create.outputs.version }}
     steps:
       - name: Delete stale prereleases
         run: |
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index a57f223abb2..d5d91b22e9d 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -1,4 +1,4 @@
-name: CodeQL
+name: codeql
 
 # Advanced setup, replacing the repo-settings "default setup".
 #
@@ -77,7 +77,7 @@ permissions:
 
 jobs:
   analyze:
-    name: Analyze ${{ matrix.language }}
+    name: analyze (${{ matrix.language }})
     # Sized per language, not per workflow. The two analyses are nothing alike:
     # javascript-typescript peaks at 19.5 GB (p95 over 3090 runs), so it needs
     # the 8 vCPU tier's 30.4 GB and would OOM on the 4 vCPU tier's 15.2 GB; the
@@ -108,7 +108,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/companion-pr-check.yml b/.github/workflows/companion.yml
similarity index 99%
rename from .github/workflows/companion-pr-check.yml
rename to .github/workflows/companion.yml
index 38457781467..0ca74d32996 100644
--- a/.github/workflows/companion-pr-check.yml
+++ b/.github/workflows/companion.yml
@@ -1,4 +1,4 @@
-name: companion-pr-check
+name: companion
 
 # Soft, NON-BLOCKING warning: when a PR targeting staging/main declares a
 # cross-repo "Companion:" PR, surface whether that companion is merged yet, so
@@ -40,6 +40,7 @@ permissions:
 
 jobs:
   companion:
+    name: companion
     runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-2vcpu-ubuntu-2404' || 'ubuntu-latest' }}
     timeout-minutes: 5
     steps:
diff --git a/.github/workflows/desktop-e2e.yml b/.github/workflows/desktop-e2e.yml
index ab88c11f150..b449338e47e 100644
--- a/.github/workflows/desktop-e2e.yml
+++ b/.github/workflows/desktop-e2e.yml
@@ -1,4 +1,4 @@
-name: Desktop E2E
+name: desktop-e2e
 
 # Smoke coverage of the real Electron shell on desktop changes, plus a weekly
 # advisory canary against electron@latest so Chromium-cadence breakage surfaces
@@ -57,19 +57,34 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
-  e2e-pinned:
-    name: E2E (pinned)
+  e2e:
+    name: e2e
     if: github.event_name != 'schedule'
     runs-on: macos-26
+    timeout-minutes: 30
     steps:
       - name: Checkout code
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        with:
+          persist-credentials: false
 
       - name: Setup Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
           bun-version: 1.4.2
 
+      # Electron, electron-builder and Playwright download their binaries on every cold install. All
+      # three caches are keyed by version inside, so an older entry restored by prefix is harmless.
+      - name: Cache Electron and Playwright downloads
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
+        with:
+          path: |
+            ~/Library/Caches/electron
+            ~/Library/Caches/electron-builder
+            ~/Library/Caches/ms-playwright
+          key: desktop-downloads-${{ runner.os }}-${{ hashFiles('bun.lock') }}
+          restore-keys: desktop-downloads-${{ runner.os }}-
+
       - name: Install dependencies
         run: bun install --frozen-lockfile
 
@@ -100,20 +115,35 @@ jobs:
           path: apps/desktop/test-results
           retention-days: 7
 
-  e2e-latest-canary:
-    name: E2E (electron@latest canary)
+  e2e-canary:
+    name: e2e-canary
     if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
     runs-on: macos-26
+    timeout-minutes: 30
     continue-on-error: true
     steps:
       - name: Checkout code
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        with:
+          persist-credentials: false
 
       - name: Setup Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
           bun-version: 1.4.2
 
+      # Electron, electron-builder and Playwright download their binaries on every cold install. All
+      # three caches are keyed by version inside, so an older entry restored by prefix is harmless.
+      - name: Cache Electron and Playwright downloads
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
+        with:
+          path: |
+            ~/Library/Caches/electron
+            ~/Library/Caches/electron-builder
+            ~/Library/Caches/ms-playwright
+          key: desktop-downloads-${{ runner.os }}-${{ hashFiles('bun.lock') }}
+          restore-keys: desktop-downloads-${{ runner.os }}-
+
       - name: Install dependencies
         run: bun install --frozen-lockfile
 
@@ -149,12 +179,15 @@ jobs:
           retention-days: 7
 
   package-smoke:
-    name: Unsigned package smoke
+    name: package-smoke
     if: github.event_name != 'schedule'
     runs-on: macos-26
+    timeout-minutes: 20
     steps:
       - name: Checkout code
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        with:
+          persist-credentials: false
 
       - name: Setup Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
@@ -162,10 +195,22 @@ jobs:
           bun-version: 1.4.2
 
       - name: Setup Node
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: 22
 
+      # Electron, electron-builder and Playwright download their binaries on every cold install. All
+      # three caches are keyed by version inside, so an older entry restored by prefix is harmless.
+      - name: Cache Electron and Playwright downloads
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
+        with:
+          path: |
+            ~/Library/Caches/electron
+            ~/Library/Caches/electron-builder
+            ~/Library/Caches/ms-playwright
+          key: desktop-downloads-${{ runner.os }}-${{ hashFiles('bun.lock') }}
+          restore-keys: desktop-downloads-${{ runner.os }}-
+
       - name: Install dependencies
         run: bun install --frozen-lockfile
 
diff --git a/.github/workflows/desktop-release.yml b/.github/workflows/desktop-release.yml
index 0188f97c2bf..7381a406015 100644
--- a/.github/workflows/desktop-release.yml
+++ b/.github/workflows/desktop-release.yml
@@ -1,4 +1,4 @@
-name: Desktop Release (macOS)
+name: desktop-release
 
 # Builds, signs, notarizes, and uploads the desktop app to an existing GitHub
 # release. Stable releases live in this source repository; dev and staging
@@ -24,6 +24,21 @@ on:
         required: false
         type: boolean
         default: true
+    secrets:
+      DESKTOP_RELEASE_TOKEN:
+        required: false
+      CSC_LINK:
+        required: false
+      CSC_KEY_PASSWORD:
+        required: false
+      APPLE_API_KEY_P8:
+        required: false
+      APPLE_API_KEY_ID:
+        required: false
+      APPLE_API_ISSUER:
+        required: false
+      APPLE_TEAM_ID:
+        required: false
   workflow_dispatch:
     inputs:
       version:
@@ -45,8 +60,8 @@ permissions:
   contents: write
 
 jobs:
-  build-sign-notarize:
-    name: Build, Sign, Notarize
+  build:
+    name: build
     runs-on: macos-26
     timeout-minutes: 60
     steps:
@@ -131,12 +146,12 @@ jobs:
           bun-version: 1.4.2
 
       - name: Setup Node
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: 22
 
       - name: Cache Electron binaries
-        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
         with:
           path: |
             ~/Library/Caches/electron
diff --git a/.github/workflows/stickydisk-gc.yml b/.github/workflows/disk-gc.yml
similarity index 97%
rename from .github/workflows/stickydisk-gc.yml
rename to .github/workflows/disk-gc.yml
index 5ac5e54d800..24c5b02af8a 100644
--- a/.github/workflows/stickydisk-gc.yml
+++ b/.github/workflows/disk-gc.yml
@@ -1,7 +1,7 @@
-name: Sticky Disk GC
+name: disk-gc
 
 # node_modules sticky disks are keyed on hashFiles('bun.lock') by design — see the
-# "Mount node_modules" comment in test-build.yml. A sticky disk is a mutable volume
+# cache-key comment in .github/actions/setup/action.yml. A sticky disk is a mutable volume
 # and `bun install --frozen-lockfile` adds what the lockfile needs without pruning
 # what it dropped, so branches on different lockfiles must not share one. That
 # design is correct and is preserved here.
@@ -42,7 +42,7 @@ concurrency:
 
 jobs:
   gc:
-    name: Reclaim idle node_modules sticky disks
+    name: gc
     # GitHub-hosted on purpose, not a Blacksmith runner: the CLI is a pure API
     # client, and collection has to keep working during a Blacksmith outage or a
     # CI_PROVIDER break-glass switch — exactly when disks sit idle and still bill.
@@ -120,7 +120,7 @@ jobs:
           # because the key interpolates ${{ github.event_name }} and a
           # workflow_dispatch disk already exists that an enumerated list would have
           # skipped forever. `-fork` is a separate optional segment rather than part
-          # of that class: test-build.yml appends it after the event name, so a fork
+          # of that class: the setup action appends it after the event name, so a fork
           # key reads `pull_request-fork` and a character class cannot span the
           # hyphen. Without it, fork disks would never be collected.
           #
diff --git a/.github/workflows/docs-embeddings.yml b/.github/workflows/docs-embeddings.yml
deleted file mode 100644
index f20c6491b09..00000000000
--- a/.github/workflows/docs-embeddings.yml
+++ /dev/null
@@ -1,51 +0,0 @@
-name: Process Docs Embeddings
-
-on:
-  workflow_call:
-  workflow_dispatch: # Allow manual triggering
-
-permissions:
-  contents: read
-
-jobs:
-  process-docs-embeddings:
-    name: Process Documentation Embeddings
-    # Network-bound on the embeddings API: ~9% CPU and ~3% peak memory on 8 vCPU.
-    runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-2vcpu-ubuntu-2404' || 'ubuntu-latest' }}
-    timeout-minutes: 30
-    if: github.ref == 'refs/heads/main'
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
-
-      - name: Setup Bun
-        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
-        with:
-          bun-version: 1.4.2
-
-      - name: Setup Node
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
-        with:
-          node-version: 22
-
-      - name: Cache Bun dependencies
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
-        with:
-          path: |
-            ~/.bun/install/cache
-            node_modules
-            **/node_modules
-          key: ${{ runner.os }}-bun-${{ hashFiles('**/bun.lock') }}
-          restore-keys: |
-            ${{ runner.os }}-bun-
-
-      - name: Install dependencies
-        run: bun install --frozen-lockfile --ignore-scripts
-
-      - name: Process docs embeddings
-        working-directory: ./apps/sim
-        env:
-          DATABASE_URL: ${{ secrets.DATABASE_URL }}
-          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
-        run: bun run scripts/process-docs.ts --clear 
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
new file mode 100644
index 00000000000..db99ce6b387
--- /dev/null
+++ b/.github/workflows/docs.yml
@@ -0,0 +1,40 @@
+name: docs
+
+on:
+  workflow_call:
+    secrets:
+      DATABASE_URL:
+        required: false
+      OPENAI_API_KEY:
+        required: false
+  workflow_dispatch: # Allow manual triggering
+
+permissions:
+  contents: read
+
+jobs:
+  embeddings:
+    name: embeddings
+    # Network-bound on the embeddings API: ~9% CPU and ~3% peak memory on 8 vCPU.
+    runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-2vcpu-ubuntu-2404' || 'ubuntu-latest' }}
+    timeout-minutes: 30
+    if: github.ref == 'refs/heads/main'
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        with:
+          persist-credentials: false
+
+      - name: Setup workspace
+        uses: ./.github/actions/setup
+        with:
+          provider: ${{ vars.CI_PROVIDER }}
+          node-version: '22'
+
+      - name: Process docs embeddings
+        working-directory: ./apps/sim
+        env:
+          DATABASE_URL: ${{ secrets.DATABASE_URL }}
+          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
+        run: bun run scripts/process-docs.ts --clear 
diff --git a/.github/workflows/helm.yml b/.github/workflows/helm.yml
index 0ce30eaa4fb..4c925975c5d 100644
--- a/.github/workflows/helm.yml
+++ b/.github/workflows/helm.yml
@@ -1,4 +1,4 @@
-name: Helm Chart
+name: helm
 
 on:
   push:
@@ -33,11 +33,11 @@ permissions:
 
 jobs:
   chart:
-    name: Lint, test, and validate chart
-    runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-2vcpu-ubuntu-2404' || 'ubuntu-latest' }}
+    name: chart
+    runs-on: &runner-2vcpu ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-2vcpu-ubuntu-2404' || 'ubuntu-latest' }}
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           # ct diffs the chart against the PR base to decide whether the version
           # was bumped, so a shallow clone would leave it nothing to compare.
@@ -154,12 +154,12 @@ jobs:
           done
 
   install:
-    name: Install on kind and run helm test
+    name: install
     needs: chart
     runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-4vcpu-ubuntu-2404' || 'ubuntu-latest' }}
     timeout-minutes: 25
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           persist-credentials: false
 
@@ -198,9 +198,9 @@ jobs:
   # and a release becoming public between two independent API calls would be
   # enough to make the OCI artifact and the HTTP repo install different Sims.
   release-version:
-    name: Resolve the app release
+    name: release-version
     if: github.event_name == 'push' && github.ref == 'refs/heads/main' && github.repository == 'simstudioai/sim'
-    runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-2vcpu-ubuntu-2404' || 'ubuntu-latest' }}
+    runs-on: *runner-2vcpu
     timeout-minutes: 5
     permissions:
       contents: read # Read the release list.
@@ -211,7 +211,7 @@ jobs:
       # it -- so the subject is the only source available, and the latest release
       # is the source of truth for every other push.
       #
-      # The subject pattern MUST stay identical to detect-version in ci.yml, which
+      # The subject pattern MUST stay identical to the `version` job in ci.yml, which
       # is what actually creates the tag and builds the images. If this one
       # matched a subject that one rejects, the chart would publish naming a
       # release that was never cut.
@@ -246,10 +246,10 @@ jobs:
   # rendered clean under kubeconform, and actually installed on a kind cluster.
   # A separate workflow would race those instead of waiting for them.
   publish:
-    name: Publish chart to GHCR
+    name: publish
     needs: [chart, install, release-version]
     if: github.event_name == 'push' && github.ref == 'refs/heads/main' && github.repository == 'simstudioai/sim'
-    runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-2vcpu-ubuntu-2404' || 'ubuntu-latest' }}
+    runs-on: *runner-2vcpu
     timeout-minutes: 15
     permissions:
       contents: read # Read the chart source.
@@ -257,7 +257,7 @@ jobs:
       id-token: write # Sigstore signs against the runner's OIDC identity; no key material is stored.
       attestations: write # Let actions/attest-build-provenance record the SLSA provenance.
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           persist-credentials: false
 
@@ -439,15 +439,15 @@ jobs:
   # to cut a release and push the index, and there is no reason to hand that to
   # the job holding the signing identity.
   publish-http:
-    name: Publish chart to the Helm repo
+    name: publish-http
     needs: [chart, install, release-version]
     if: github.event_name == 'push' && github.ref == 'refs/heads/main' && github.repository == 'simstudioai/sim'
-    runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-2vcpu-ubuntu-2404' || 'ubuntu-latest' }}
+    runs-on: *runner-2vcpu
     timeout-minutes: 15
     permissions:
       contents: write # Cut the chart release and push index.yaml to the pages branch.
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           # chart-releaser diffs against the previous tag to decide which charts
           # changed, so it needs the full history rather than a shallow clone.
diff --git a/.github/workflows/migrations.yml b/.github/workflows/migrate.yml
similarity index 79%
rename from .github/workflows/migrations.yml
rename to .github/workflows/migrate.yml
index 724972803be..2fc7164374a 100644
--- a/.github/workflows/migrations.yml
+++ b/.github/workflows/migrate.yml
@@ -1,4 +1,4 @@
-name: Database Migrations
+name: migrate
 
 on:
   workflow_call:
@@ -7,6 +7,17 @@ on:
         description: Target environment (production, staging, or dev)
         required: true
         type: string
+    secrets:
+      DATABASE_URL:
+        required: false
+      STAGING_DATABASE_URL:
+        required: false
+      DEV_DATABASE_URL:
+        required: false
+      MIGRATION_DATABASE_URL:
+        required: false
+      STAGING_MIGRATION_DATABASE_URL:
+        required: false
   workflow_dispatch:
     inputs:
       environment:
@@ -23,7 +34,7 @@ permissions:
 
 jobs:
   migrate:
-    name: Apply Database Migrations
+    name: migrate
     runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-4vcpu-ubuntu-2404' || 'ubuntu-latest' }}
     # Bulk projection loads and concurrent index builds can outlast ordinary schema changes.
     timeout-minutes: 300
@@ -31,25 +42,14 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
-
-      - name: Setup Bun
-        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
-          bun-version: 1.4.2
+          persist-credentials: false
 
-      - name: Cache Bun dependencies
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
+      - name: Setup workspace
+        uses: ./.github/actions/setup
         with:
-          path: |
-            ~/.bun/install/cache
-            node_modules
-            **/node_modules
-          key: ${{ runner.os }}-bun-${{ hashFiles('**/bun.lock') }}
-          restore-keys: |
-            ${{ runner.os }}-bun-
-
-      - name: Install dependencies
-        run: bun install --frozen-lockfile --ignore-scripts
+          provider: ${{ vars.CI_PROVIDER }}
+          node-version: ''
 
       # The expression maps the explicit environment input to exactly one repo
       # secret, so the job never holds another environment's database URL. An
diff --git a/.github/workflows/publish-cli.yml b/.github/workflows/publish-cli.yml
index e8cbcd55120..6e5c12e973c 100644
--- a/.github/workflows/publish-cli.yml
+++ b/.github/workflows/publish-cli.yml
@@ -1,4 +1,4 @@
-name: Publish CLI Package
+name: publish-cli
 
 on:
   push:
@@ -9,39 +9,28 @@ on:
 permissions:
   contents: read
 
+# A newer push waits for the running publish rather than racing its version check.
+concurrency:
+  group: publish-cli-${{ github.ref }}
+  cancel-in-progress: false
+
 jobs:
-  publish-npm:
+  publish:
+    name: publish
     runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-4vcpu-ubuntu-2404' || 'ubuntu-latest' }}
     timeout-minutes: 15
     steps:
       - name: Checkout repository
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
-
-      - name: Setup Bun
-        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
-          bun-version: 1.4.2
+          persist-credentials: false
 
-      - name: Setup Node.js for npm publishing
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+      - name: Setup workspace
+        uses: ./.github/actions/setup
         with:
+          provider: ${{ vars.CI_PROVIDER }}
           node-version: '22'
-          registry-url: 'https://registry.npmjs.org/'
-
-      - name: Cache Bun dependencies
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
-        with:
-          path: |
-            ~/.bun/install/cache
-            node_modules
-            **/node_modules
-          key: ${{ runner.os }}-bun-${{ hashFiles('**/bun.lock') }}
-          restore-keys: |
-            ${{ runner.os }}-bun-
-
-      - name: Install dependencies
-        working-directory: packages/cli
-        run: bun install --frozen-lockfile --ignore-scripts
+          registry-url: https://registry.npmjs.org/
 
       - name: Build package
         working-directory: packages/cli
@@ -54,8 +43,10 @@ jobs:
 
       - name: Check if version already exists
         id: version_check
+        env:
+          VERSION: ${{ steps.package_version.outputs.version }}
         run: |
-          if npm view simstudio@${{ steps.package_version.outputs.version }} version &> /dev/null; then
+          if npm view "simstudio@$VERSION" version &> /dev/null; then
             echo "exists=true" >> $GITHUB_OUTPUT
           else
             echo "exists=false" >> $GITHUB_OUTPUT
@@ -70,4 +61,6 @@ jobs:
 
       - name: Log skipped publish
         if: steps.version_check.outputs.exists == 'true'
-        run: echo "Skipped publishing because version ${{ steps.package_version.outputs.version }} already exists on npm" 
\ No newline at end of file
+        env:
+          VERSION: ${{ steps.package_version.outputs.version }}
+        run: echo "Skipped publishing because version $VERSION already exists on npm" 
\ No newline at end of file
diff --git a/.github/workflows/publish-python-sdk.yml b/.github/workflows/publish-python-sdk.yml
index 98e598b11d8..892c2903518 100644
--- a/.github/workflows/publish-python-sdk.yml
+++ b/.github/workflows/publish-python-sdk.yml
@@ -1,4 +1,4 @@
-name: Publish Python SDK
+name: publish-python-sdk
 
 on:
   push:
@@ -9,13 +9,21 @@ on:
 permissions:
   contents: write
 
+# A newer push waits for the running publish rather than racing its version check.
+concurrency:
+  group: publish-python-sdk-${{ github.ref }}
+  cancel-in-progress: false
+
 jobs:
-  publish-pypi:
+  publish:
+    name: publish
     runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-4vcpu-ubuntu-2404' || 'ubuntu-latest' }}
     timeout-minutes: 15
     steps:
       - name: Checkout repository
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        with:
+          persist-credentials: false
 
       - name: Setup Python
         uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
@@ -40,12 +48,17 @@ jobs:
 
       - name: Check if version already exists
         id: version_check
+        # Exact lookup: PyPI answers 404 only for a version it has never published. Anything other
+        # than 200 or 404 stops the job rather than guessing.
+        env:
+          VERSION: ${{ steps.package_version.outputs.version }}
         run: |
-          if pip index versions simstudio-sdk | grep -q "${{ steps.package_version.outputs.version }}"; then
-            echo "exists=true" >> $GITHUB_OUTPUT
-          else
-            echo "exists=false" >> $GITHUB_OUTPUT
-          fi
+          status="$(curl -sS -o /dev/null -w '%{http_code}' "https://pypi.org/pypi/simstudio-sdk/$VERSION/json")"
+          case "$status" in
+            200) echo "exists=true" >> "$GITHUB_OUTPUT" ;;
+            404) echo "exists=false" >> "$GITHUB_OUTPUT" ;;
+            *) echo "::error::PyPI returned HTTP $status for simstudio-sdk $VERSION" >&2; exit 1 ;;
+          esac
 
       - name: Build package
         if: steps.version_check.outputs.exists == 'false'
@@ -67,11 +80,13 @@ jobs:
 
       - name: Log skipped publish
         if: steps.version_check.outputs.exists == 'true'
-        run: echo "Skipped publishing because version ${{ steps.package_version.outputs.version }} already exists on PyPI"
+        env:
+          VERSION: ${{ steps.package_version.outputs.version }}
+        run: echo "Skipped publishing because version $VERSION already exists on PyPI"
 
       - name: Create GitHub Release
         if: steps.version_check.outputs.exists == 'false'
-        uses: softprops/action-gh-release@de2c0eb89ae2a093876385947365aca7b0e5f844 # v1
+        uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:
diff --git a/.github/workflows/publish-sim-cli.yml b/.github/workflows/publish-sim-cli.yml
index f9d9717fa30..5c9e058acb3 100644
--- a/.github/workflows/publish-sim-cli.yml
+++ b/.github/workflows/publish-sim-cli.yml
@@ -1,4 +1,4 @@
-name: Publish Sim API CLI Package
+name: publish-sim-cli
 
 on:
   push:
@@ -19,39 +19,24 @@ concurrency:
   cancel-in-progress: false
 
 jobs:
-  publish-npm:
+  publish:
+    name: publish
     runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-4vcpu-ubuntu-2404' || 'ubuntu-latest' }}
     timeout-minutes: 15
     steps:
       - name: Checkout repository
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
-
-      - name: Setup Bun
-        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
-          bun-version: 1.4.2
+          persist-credentials: false
 
       # Vitest 5 requires Node 22.12+; the published bundle is still
       # smoke-tested on Node 20 below, its minimum supported runtime.
-      - name: Setup Node
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+      - name: Setup workspace
+        uses: ./.github/actions/setup
         with:
+          provider: ${{ vars.CI_PROVIDER }}
           node-version: '22'
 
-      - name: Cache Bun dependencies
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
-        with:
-          path: |
-            ~/.bun/install/cache
-            node_modules
-            **/node_modules
-          key: ${{ runner.os }}-bun-${{ hashFiles('**/bun.lock') }}
-          restore-keys: |
-            ${{ runner.os }}-bun-
-
-      - name: Install dependencies
-        run: bun install --frozen-lockfile --ignore-scripts
-
       - name: Verify npm authentication
         env:
           NPM_CONFIG_TOKEN: ${{ secrets.NPM_TOKEN }}
diff --git a/.github/workflows/publish-sim-setup.yml b/.github/workflows/publish-sim-setup.yml
index e6284e14392..7b2cca91a20 100644
--- a/.github/workflows/publish-sim-setup.yml
+++ b/.github/workflows/publish-sim-setup.yml
@@ -1,4 +1,4 @@
-name: Publish Sim Setup Package
+name: publish-sim-setup
 
 on:
   push:
@@ -19,39 +19,24 @@ concurrency:
   cancel-in-progress: false
 
 jobs:
-  publish-npm:
+  publish:
+    name: publish
     runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-4vcpu-ubuntu-2404' || 'ubuntu-latest' }}
     timeout-minutes: 15
     steps:
       - name: Checkout repository
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
-
-      - name: Setup Bun
-        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
-          bun-version: 1.4.2
+          persist-credentials: false
 
       # Vitest 5 requires Node 22.12+; the published bundle is still
       # smoke-tested on Node 20 below, its minimum supported runtime.
-      - name: Setup Node
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+      - name: Setup workspace
+        uses: ./.github/actions/setup
         with:
+          provider: ${{ vars.CI_PROVIDER }}
           node-version: '22'
 
-      - name: Cache Bun dependencies
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
-        with:
-          path: |
-            ~/.bun/install/cache
-            node_modules
-            **/node_modules
-          key: ${{ runner.os }}-bun-${{ hashFiles('**/bun.lock') }}
-          restore-keys: |
-            ${{ runner.os }}-bun-
-
-      - name: Install dependencies
-        run: bun install --frozen-lockfile --ignore-scripts
-
       - name: Verify npm authentication
         env:
           NPM_CONFIG_TOKEN: ${{ secrets.NPM_TOKEN }}
diff --git a/.github/workflows/publish-ts-sdk.yml b/.github/workflows/publish-ts-sdk.yml
index ff75d720589..e551375f4c9 100644
--- a/.github/workflows/publish-ts-sdk.yml
+++ b/.github/workflows/publish-ts-sdk.yml
@@ -1,4 +1,4 @@
-name: Publish TypeScript SDK
+name: publish-ts-sdk
 
 on:
   push:
@@ -9,38 +9,28 @@ on:
 permissions:
   contents: write
 
+# A newer push waits for the running publish rather than racing its version check.
+concurrency:
+  group: publish-ts-sdk-${{ github.ref }}
+  cancel-in-progress: false
+
 jobs:
-  publish-npm:
+  publish:
+    name: publish
     runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-4vcpu-ubuntu-2404' || 'ubuntu-latest' }}
     timeout-minutes: 15
     steps:
       - name: Checkout repository
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
-
-      - name: Setup Bun
-        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
-          bun-version: 1.4.2
+          persist-credentials: false
 
-      - name: Setup Node.js for npm publishing
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+      - name: Setup workspace
+        uses: ./.github/actions/setup
         with:
+          provider: ${{ vars.CI_PROVIDER }}
           node-version: '22'
-          registry-url: 'https://registry.npmjs.org/'
-
-      - name: Cache Bun dependencies
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
-        with:
-          path: |
-            ~/.bun/install/cache
-            node_modules
-            **/node_modules
-          key: ${{ runner.os }}-bun-${{ hashFiles('**/bun.lock') }}
-          restore-keys: |
-            ${{ runner.os }}-bun-
-
-      - name: Install dependencies
-        run: bun install --frozen-lockfile --ignore-scripts
+          registry-url: https://registry.npmjs.org/
 
       - name: Run tests
         working-directory: packages/ts-sdk
@@ -57,8 +47,10 @@ jobs:
 
       - name: Check if version already exists
         id: version_check
+        env:
+          VERSION: ${{ steps.package_version.outputs.version }}
         run: |
-          if npm view simstudio-ts-sdk@${{ steps.package_version.outputs.version }} version &> /dev/null; then
+          if npm view "simstudio-ts-sdk@$VERSION" version &> /dev/null; then
             echo "exists=true" >> $GITHUB_OUTPUT
           else
             echo "exists=false" >> $GITHUB_OUTPUT
@@ -73,11 +65,13 @@ jobs:
 
       - name: Log skipped publish
         if: steps.version_check.outputs.exists == 'true'
-        run: echo "Skipped publishing because version ${{ steps.package_version.outputs.version }} already exists on npm"
+        env:
+          VERSION: ${{ steps.package_version.outputs.version }}
+        run: echo "Skipped publishing because version $VERSION already exists on npm"
 
       - name: Create GitHub Release
         if: steps.version_check.outputs.exists == 'false'
-        uses: softprops/action-gh-release@de2c0eb89ae2a093876385947365aca7b0e5f844 # v1
+        uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:
diff --git a/.github/workflows/deploy-trigger-dev.yml b/.github/workflows/trigger-dev.yml
similarity index 77%
rename from .github/workflows/deploy-trigger-dev.yml
rename to .github/workflows/trigger-dev.yml
index 4c43abd0574..d9de9f5f70b 100644
--- a/.github/workflows/deploy-trigger-dev.yml
+++ b/.github/workflows/trigger-dev.yml
@@ -1,4 +1,4 @@
-name: Deploy Dev Tasks
+name: trigger-dev
 
 # Independent of app CI: task packaging and deployment must never delay dev images.
 on:
@@ -16,31 +16,20 @@ concurrency:
 
 jobs:
   deploy:
-    name: Deploy Trigger.dev preview
+    name: deploy
     runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-4vcpu-ubuntu-2404' || 'ubuntu-latest' }}
     timeout-minutes: 30
     steps:
       - name: Checkout code
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
-
-      - name: Setup Bun
-        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
-          bun-version: 1.4.2
+          persist-credentials: false
 
-      - name: Cache Bun dependencies
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
+      - name: Setup workspace
+        uses: ./.github/actions/setup
         with:
-          path: |
-            ~/.bun/install/cache
-            node_modules
-            **/node_modules
-          key: ${{ runner.os }}-bun-${{ hashFiles('**/bun.lock') }}
-          restore-keys: |
-            ${{ runner.os }}-bun-
-
-      - name: Install dependencies
-        run: bun install --frozen-lockfile --ignore-scripts
+          provider: ${{ vars.CI_PROVIDER }}
+          node-version: ''
 
       - name: Upload preview version
         id: deploy
diff --git a/apps/sim/ee/scim/TESTING.md b/apps/sim/ee/scim/TESTING.md
index bb73c2a942f..3a12121a398 100644
--- a/apps/sim/ee/scim/TESTING.md
+++ b/apps/sim/ee/scim/TESTING.md
@@ -76,7 +76,7 @@ timeout.
 
 ## Continuous integration and PostgreSQL regressions
 
-The `End-to-end over real HTTP` job in `.github/workflows/test-build.yml`
+The `e2e (scim)` job in `.github/workflows/checks.yml`
 provisions its own database through `db:migrate`, starts a local Next.js app
 with hosted Enterprise configuration, and runs the HTTP suite above. It has its
 own database because the hosted app runs background usage replay against it.
@@ -102,8 +102,8 @@ transaction. Hosted billing flags are configured for the test; subscription
 and entitlement reads use real PostgreSQL with the transaction tripwire enabled.
 The suite checks an active Enterprise subscription, an ended one, and a real
 billing query failure that must propagate instead of releasing directory locks.
-The `PostgreSQL integration` job, which runs every `*.integration.ts` against
-both `db:push` and `db:migrate`, also runs `lib/auth/sso/application/admit-sso-user.integration.ts`,
+The `integration` jobs, which run every `*.integration.ts` against
+both `db:push` and `db:migrate`, also run `lib/auth/sso/application/admit-sso-user.integration.ts`,
 which verifies that SCIM's `disableJit` setting blocks fresh SSO membership,
 preserves existing membership, and permits JIT when disabled. These checks run
 the admission operation and Enterprise entitlement reads through PostgreSQL.
diff --git a/scripts/desktop-prune-workflow.test.ts b/scripts/desktop-prune-workflow.test.ts
index 03348e7b33d..1deae32d7a8 100644
--- a/scripts/desktop-prune-workflow.test.ts
+++ b/scripts/desktop-prune-workflow.test.ts
@@ -5,7 +5,7 @@ import { join } from 'node:path'
 import { describe, expect, it } from 'vitest'
 
 const workflow = readFileSync(new URL('../.github/workflows/ci.yml', import.meta.url), 'utf8')
-const job = workflow.split('  prune-desktop-prereleases:')[1]
+const job = workflow.split('  prerelease-prune:')[1]
 const step = job?.match(/^ {8}run: \|\r?\n((?: {10}.*(?:\r?\n|$)|\r?\n)+)/m)?.[1]
 if (!step) throw new Error('Desktop pruning shell step is missing')
 const script = step.replace(/^ {10}/gm, '')
@@ -103,7 +103,7 @@ describe('desktop release change detection shell', () => {
     ['apps/desktop/src/main/index.ts', true],
     ['packages/desktop-bridge/src/index.ts', true],
     ['packages/browser-protocol/src/index.ts', true],
-    ['.github/workflows/migrations.yml', false],
+    ['.github/workflows/migrate.yml', false],
     ['.github/workflows/ci.yml.backup', false],
     ['apps/sim/app/page.tsx', false],
   ])('classifies %s as desktop change=%s', (path, changed) => {
diff --git a/scripts/dev-deployment-workflow.test.ts b/scripts/dev-deployment-workflow.test.ts
index c276071304c..a1d5e0c7c4a 100644
--- a/scripts/dev-deployment-workflow.test.ts
+++ b/scripts/dev-deployment-workflow.test.ts
@@ -4,10 +4,7 @@ import { runInNewContext } from 'node:vm'
 import { describe, expect, it } from 'vitest'
 
 const ci = readFileSync(new URL('../.github/workflows/ci.yml', import.meta.url), 'utf8')
-const tasks = readFileSync(
-  new URL('../.github/workflows/deploy-trigger-dev.yml', import.meta.url),
-  'utf8'
-)
+const tasks = readFileSync(new URL('../.github/workflows/trigger-dev.yml', import.meta.url), 'utf8')
 
 /** Evaluate the checked-in job condition for concrete GitHub job outcomes. */
 function eligible(job: string, branch: string, results: Record<string, string> = {}) {
@@ -17,11 +14,11 @@ function eligible(job: string, branch: string, results: Record<string, string> =
   const needs = Object.fromEntries(
     Object.entries({
       migrate: 'success',
-      'build-amd64': 'success',
+      'image-amd64': 'success',
       'migrate-dev': 'success',
-      'build-dev': 'success',
-      'prepare-trigger': 'success',
-      'promote-images': 'success',
+      'image-dev': 'success',
+      'trigger-upload': 'success',
+      promote: 'success',
       ...results,
     }).map(([name, result]) => [name, { result, outputs: { promoted: 'true' } }])
   )
@@ -66,9 +63,9 @@ ${script}`,
 
 describe('dev deployment independence', () => {
   it('promotes dev images with the skipped Trigger jobs and no cutover waiter', () => {
-    expect(eligible('prepare-trigger', 'dev')).toBe(false)
-    expect(eligible('promote-trigger', 'dev')).toBe(false)
-    expect(eligible('promote-images', 'dev', { 'prepare-trigger': 'skipped' })).toBe(true)
+    expect(eligible('trigger-upload', 'dev')).toBe(false)
+    expect(eligible('trigger-promote', 'dev')).toBe(false)
+    expect(eligible('promote', 'dev', { 'trigger-upload': 'skipped' })).toBe(true)
   })
 
   it('does not roll tasks back when an older push is retried', () => {
diff --git a/scripts/migrations-workflow.test.ts b/scripts/migrations-workflow.test.ts
index 2214709fb43..ce25ddd7058 100644
--- a/scripts/migrations-workflow.test.ts
+++ b/scripts/migrations-workflow.test.ts
@@ -2,10 +2,7 @@ import { spawnSync } from 'node:child_process'
 import { readFileSync } from 'node:fs'
 import { describe, expect, it } from 'vitest'
 
-const workflow = readFileSync(
-  new URL('../.github/workflows/migrations.yml', import.meta.url),
-  'utf8'
-)
+const workflow = readFileSync(new URL('../.github/workflows/migrate.yml', import.meta.url), 'utf8')
 const step = workflow.match(/^ {8}run: \|\r?\n((?: {10}.*(?:\r?\n|$)|\r?\n)+)/m)?.[1]
 if (!step) throw new Error('Migration workflow must contain its schema application shell step')
 const script = step.replace(/^ {10}/gm, '')

From 569288f261e4c733939e1010c93d707870a1f972 Mon Sep 17 00:00:00 2001
From: Waleed Latif <walif6@gmail.com>
Date: Wed, 7 Oct 2026 12:27:05 -0700
Subject: [PATCH 3/4] ci: run the ci gate on cancelled runs so a cancelled head
 never passes

---
 .github/workflows/checks.yml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/checks.yml b/.github/workflows/checks.yml
index 3fef308a30e..7d24e084d40 100644
--- a/.github/workflows/checks.yml
+++ b/.github/workflows/checks.yml
@@ -611,10 +611,12 @@ jobs:
   # One status for every check above: the single check to require on a branch ruleset, so adding,
   # sharding or renaming a job never means editing the ruleset. Skipped is a pass (the desktop live
   # suite skips on pull requests that cannot affect it); a failure or a cancellation is not.
+  # `always()`, not `!cancelled()`: a skipped job satisfies a required check, so a gate that skips
+  # on a cancelled run would report a cancelled head commit as passing.
   ci:
     name: ci
     needs: [integration, e2e, desktop-changes, desktop-live, lint, test, build]
-    if: ${{ !cancelled() }}
+    if: ${{ always() }}
     runs-on: *runner-2vcpu
     timeout-minutes: 5
     steps:

From 26c3b191e791c19bc06a4f0a8ebd0b66a977298f Mon Sep 17 00:00:00 2001
From: Waleed Latif <walif6@gmail.com>
Date: Wed, 7 Oct 2026 12:40:31 -0700
Subject: [PATCH 4/4] docs(desktop): point the release notes at the renamed
 workflow and jobs

---
 apps/desktop/README.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/apps/desktop/README.md b/apps/desktop/README.md
index 309160f0339..4d0f879d94b 100644
--- a/apps/desktop/README.md
+++ b/apps/desktop/README.md
@@ -107,8 +107,8 @@ Local unsigned pre-release share: `SIM_DESKTOP_DEFAULT_ORIGIN=https://www.dev.si
 The build also derives the app icon from `SIM_DESKTOP_DEFAULT_ORIGIN`. Every channel uses the exact production icon with its white background and black `sim` mark. Non-production channels add a thin outline using existing platform colors: dev uses orange, staging uses Loop blue, and localhost uses Workflow violet. The macOS menu-bar icon also carries a compact `D`, `S`, or `L` subscript for those environments; production remains unmarked. Native Icon Composer assets live in `build/`; `scripts/build.ts` copies the selected variant to the ignored `build/generated-icon.icon` path consumed by electron-builder. Electron-builder compiles it to `Assets.car` and derives the legacy `.icns` fallback from the same source. Matching 512px PNGs in `static/` provide the Dock icon for unpackaged runs.
 
 CI (`.github/workflows/desktop-release.yml`, wired into `ci.yml`):
-- Stable builds run only after `create-release` on a `vX.Y.Z:` commit to main — **never before**: `scripts/create-single-release.ts` skips creation if the tag exists, so a desktop job publishing first would eat the changelog. Stable assets remain on `simstudioai/sim`; dev/staging assets publish to the public `simstudioai/sim-desktop-releases` repository so source-repository followers are not notified for internal shell builds. The job builds `--publish never`; reruns verify the size and SHA-256 digest of existing release assets instead of overwriting them.
-- **Secrets gate**: `check-desktop-signing` in `ci.yml` probes the six Apple secrets and skips the desktop job with a warning until they exist — releases never fail on a missing Apple account, and the first release after the secrets land ships desktop artifacts automatically. Manual/one-off builds: Actions → "Desktop Release (macOS)" → Run workflow with a `vX.Y.Z` version (`publish: false` uploads artifacts to the run instead of the release).
+- Stable builds run only after `release` on a `vX.Y.Z:` commit to main — **never before**: `scripts/create-single-release.ts` skips creation if the tag exists, so a desktop job publishing first would eat the changelog. Stable assets remain on `simstudioai/sim`; dev/staging assets publish to the public `simstudioai/sim-desktop-releases` repository so source-repository followers are not notified for internal shell builds. The job builds `--publish never`; reruns verify the size and SHA-256 digest of existing release assets instead of overwriting them.
+- **Secrets gate**: `desktop-signing` in `ci.yml` probes the six Apple secrets and skips the desktop job with a warning until they exist — releases never fail on a missing Apple account, and the first release after the secrets land ships desktop artifacts automatically. Manual/one-off builds: Actions → "desktop-release" → Run workflow with a `vX.Y.Z` version (`publish: false` uploads artifacts to the run instead of the release).
 - The product semver is **injected** from the release tag into `apps/desktop/package.json` at build time (repo package versions are placeholders). A mismatch guard fails the build.
 - Fuses are flipped at package time (`electronFuses` in `electron-builder.yml`): runAsNode off, NODE_OPTIONS off, inspect args off, ASAR-only + integrity validation, and cookie encryption on. The packaged smoke test asserts every fuse byte so Electron upgrades fail until new fuses receive an explicit policy.
 - **Cookie-encryption go/no-go**: on every Electron bump, verify a packaged build keeps its session across relaunch (there are historical cookie-persistence bugs with the `EnableCookieEncryption` fuse). If it reproduces, set `enableCookieEncryption: false` and record it here.