chore(ci): run the PR gate through pnpm pipeline task cache

.github/workflows/test.yml

@@ -26,10 +26,11 @@ jobs:
       # repository is private; a self-hosted runner on a public repository would
       # let a fork pull request run code on that host.
       runs-on: '["self-hosted", "linux", "x64", "harlan-desktop-ci"]'
-      # vitest resolves aliases through `.nuxt/tsconfig.json`, and every suite
-      # fails to transform without it. `prepare-command` rather than dropping
-      # `--ignore-scripts`, so lint still skips the prepare it has no use for.
-      prepare-command: pnpm nuxt prepare
+      # Each check runs through `pnpm pipeline`, so an unchanged task restores
+      # from the pool's shared cache volume instead of re-running. The graph
+      # lives in pnpm-workspace.yaml: vitest still gets its `.nuxt/tsconfig.json`
+      # because every pipeline runs `dev:prepare` as a cacheable task.
+      task-cache: true
       timeout-minutes: 30
 
   # The only gate between a merge and production. `Deploy to Cloudflare` fires on

package.json

@@ -2,7 +2,7 @@
   "name": "skilld-dev",
   "type": "module",
   "private": true,
-  "packageManager": "pnpm@11.21.0",
+  "packageManager": "pnpm@12.4.2",
   "description": "Agent skills written by real maintainers in their own GitHub repos, with links to source",
   "author": {
     "name": "Harlan Wilton",
@@ -17,6 +17,7 @@
     "dev": "nuxi dev",
     "build": "nuxi prepare && nuxi build",
     "preview": "nuxi preview",
+    "dev:prepare": "nuxt prepare",
     "perf:cold-start": "node scripts/tools/measure-nitro-cold-start.mjs",
     "postinstall": "nuxt prepare",
     "lint": "eslint .",

pnpm-workspace.yaml

@@ -72,6 +72,86 @@ trustPolicy: no-downgrade
 packages:
   - workers/*
 
+# The site root is a workspace project too, so `pnpm pipeline` can run its
+# tasks. Every task that names no inputs hashes every tracked file, which is
+# why lint carries no inputs: `eslint .` reads the whole repository. The
+# narrowed inputs below exclude only trees those tasks never read, so a
+# docs-only push leaves typecheck and test as cache hits. `scripts/**` and
+# `checks/**` count even where a task does not read them today: suites import
+# both, and the generated tsconfig that sets typecheck's reach can drift.
+#
+# The artifact-signer worker's suite is `test:worker`, outside the `test`
+# pipeline on purpose. Its transform reaches files above the worker directory,
+# whose tsconfig chain resolves through the root `.nuxt`, and a task in one
+# project cannot wait on another project's `dev:prepare` without a dependency
+# edge between them.
+includeWorkspaceRoot: true
+tasks:
+  dev:prepare:
+    dependsOn: []
+    inputs:
+      - nuxt.config.ts
+      - app/**
+      - modules/**
+      - layers/**
+      - server/**
+      - shared/**
+      - workers/**
+      - package.json
+      - pnpm-workspace.yaml
+      - tsconfig.json
+    outputs: ['.nuxt/**']
+  lint:
+    dependsOn: []
+    outputs: []
+  test:
+    dependsOn: [dev:prepare]
+    inputs:
+      - app/**
+      - server/**
+      - shared/**
+      - workers/**
+      - modules/**
+      - layers/**
+      - test/**
+      - scripts/**
+      - checks/**
+      - skills/**
+      - migrations/**
+      - schema.sql
+      - vitest.config.ts
+      - nuxt.config.ts
+      - tsconfig.json
+      - .dev.vars.example
+      - package.json
+      - pnpm-workspace.yaml
+    outputs: []
+  typecheck:
+    dependsOn: [dev:prepare]
+    env: [NODE_OPTIONS]
+    inputs:
+      - app/**
+      - server/**
+      - shared/**
+      - workers/**
+      - modules/**
+      - layers/**
+      - test/**
+      - scripts/**
+      - checks/**
+      - '*.ts'
+      - '*.jsonc'
+      - '*.toml'
+      - tsconfig.json
+      - .dev.vars.example
+      - package.json
+      - pnpm-workspace.yaml
+    outputs: []
+pipelines:
+  lint: [lint]
+  test: [dev:prepare, test]
+
+  typecheck: [dev:prepare, typecheck]
 patchedDependencies:
   hookable@5.5.3: patches/hookable@5.5.3.patch
   hookable@6.1.1: patches/hookable@6.1.1.patch

workers/artifact-signer/package.json

@@ -6,10 +6,10 @@
     "build": "wrangler deploy --dry-run --config wrangler.jsonc --outdir dist",
     "deploy:production": "wrangler deploy --config wrangler.jsonc",
     "lint": "eslint src test",
-    "test": "vitest run --config vitest.config.ts",
     "typecheck": "tsc --noEmit",
     "types": "wrangler types worker-configuration.d.ts --config wrangler.jsonc --env-file .dev.vars.example --env-interface ArtifactSignerEnv",
-    "types:check": "wrangler types worker-configuration.d.ts --config wrangler.jsonc --env-file .dev.vars.example --env-interface ArtifactSignerEnv --check"
+    "types:check": "wrangler types worker-configuration.d.ts --config wrangler.jsonc --env-file .dev.vars.example --env-interface ArtifactSignerEnv --check",
+    "test:worker": "vitest run --config vitest.config.ts"
   },
   "dependencies": {
     "zod": "catalog:"