chore: speedup ci and typecheck

.github/actions/setup/action.yml

@@ -0,0 +1,29 @@
+name: Setup pnpm and Node.js
+description: Install pnpm and Node.js, then install dependencies
+
+inputs:
+  node-version:
+    description: Node.js version to install
+    default: '24'
+
+runs:
+  using: composite
+  steps:
+    - name: Setup pnpm
+      uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
+      with:
+        # Auto-detect pnpm version from package.json (requires packageManager in package.json)
+        package_json_file: package.json
+        run_install: false
+
+    - name: Use Node.js ${{ inputs.node-version }}
+      uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+      with:
+        node-version: ${{ inputs.node-version }}
+        check-latest: true
+        cache: 'pnpm'
+        cache-dependency-path: pnpm-lock.yaml
+
+    - name: Install dependencies
+      run: pnpm install # postinstall runs prisma generate
+      shell: bash

.github/workflows/ci.yml

@@ -33,35 +33,53 @@ jobs:
 
     steps:
       - name: Check out Git repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - name: Setup pnpm
-        uses: pnpm/action-setup@v6
-        with:
-          # Auto-detect pnpm version from package.json (requires packageManager in package.json)
-          package_json_file: package.json
-          run_install: false
-
-      - name: Use Node.js ${{ matrix.node-version }}
-        uses: actions/setup-node@v7
+      - name: Setup pnpm and Node.js
+        uses: ./.github/actions/setup
         with:
           node-version: ${{ matrix.node-version }}
-          check-latest: true
-          cache: 'pnpm'
-          cache-dependency-path: pnpm-lock.yaml
-
-      - name: Install dependencies
-        run: pnpm install
 
       - name: Build
         run: pnpm build
 
+  # lint, check, and unit-test do not use the build output, so they run in parallel with build
+  lint:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Check out Git repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Setup pnpm and Node.js
+        uses: ./.github/actions/setup
+
       - name: Lint
         run: pnpm lint
 
+  check:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Check out Git repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Setup pnpm and Node.js
+        uses: ./.github/actions/setup
+
       - name: Check
         run: pnpm check
 
+  unit-test:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Check out Git repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Setup pnpm and Node.js
+        uses: ./.github/actions/setup
+
       - name: Unit test
         run: pnpm test:unit
 
@@ -72,7 +90,7 @@ jobs:
   preview:
     if: ${{ github.ref != 'refs/heads/main' }}
 
-    needs: build
+    needs: [build, lint, check, unit-test]
 
     runs-on: ubuntu-latest
 
@@ -82,41 +100,24 @@ jobs:
 
     steps:
       - name: Check out Git repository
-        uses: actions/checkout@v7
-
-      - name: Setup pnpm
-        uses: pnpm/action-setup@v6
-        with:
-          # Auto-detect pnpm version from package.json (requires packageManager in package.json)
-          package_json_file: package.json
-          run_install: false
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - name: Setup Node.js
-        uses: actions/setup-node@v7
-        with:
-          node-version: 24
-          check-latest: true
-          cache: 'pnpm'
-          cache-dependency-path: pnpm-lock.yaml
+      - name: Setup pnpm and Node.js
+        uses: ./.github/actions/setup
 
-      - name: Install dependencies
-        run: pnpm install
+      - name: Pull Vercel Environment Information
+        run: pnpm vercel pull --yes --environment=preview --token=${{ secrets.VERCEL_TOKEN }}
 
-      - name: Build
-        run: pnpm build
+      - name: Build Project Artifacts
+        run: pnpm vercel build --token=${{ secrets.VERCEL_TOKEN }}
 
+      # Migrate only after the build succeeds, so a broken build leaves the DB untouched
       - name: Apply all pending migrations to the database
         run: pnpm exec prisma migrate deploy
         env:
           DATABASE_URL: ${{ secrets.PREVIEW_DATABASE_URL }}
           DIRECT_URL: ${{ secrets.PREVIEW_DIRECT_URL }}
 
-      - name: Pull Vercel Environment Information
-        run: pnpm vercel pull --yes --environment=preview --token=${{ secrets.VERCEL_TOKEN }}
-
-      - name: Build Project Artifacts
-        run: pnpm vercel build --token=${{ secrets.VERCEL_TOKEN }}
-
       - name: Deploy Project Artifacts to Vercel
         id: deploy
         run: echo "url=\"$(pnpm vercel deploy --prebuilt --token=${{ secrets.VERCEL_TOKEN }})\"" >> $GITHUB_OUTPUT
@@ -128,46 +129,29 @@ jobs:
   production:
     if: ${{ github.ref == 'refs/heads/main' }}
 
-    needs: build
+    needs: [build, lint, check, unit-test]
 
     runs-on: ubuntu-latest
 
     steps:
       - name: Check out Git repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - name: Setup pnpm
-        uses: pnpm/action-setup@v6
-        with:
-          # Auto-detect pnpm version from package.json (requires packageManager in package.json)
-          package_json_file: package.json
-          run_install: false
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v7
-        with:
-          node-version: 24
-          check-latest: true
-          cache: 'pnpm'
-          cache-dependency-path: pnpm-lock.yaml
+      - name: Setup pnpm and Node.js
+        uses: ./.github/actions/setup
 
-      - name: Install dependencies
-        run: pnpm install
+      - name: Pull Vercel Environment Information
+        run: pnpm vercel pull --yes --environment=production --token=${{ secrets.VERCEL_TOKEN }}
 
-      - name: Build
-        run: pnpm build
+      - name: Build Project Artifacts
+        run: pnpm vercel build --prod --token=${{ secrets.VERCEL_TOKEN }}
 
+      # Migrate only after the build succeeds, so a broken build leaves the DB untouched
       - name: Apply all pending migrations to the database
         run: pnpm exec prisma migrate deploy
         env:
           DATABASE_URL: ${{ secrets.PRODUCTION_DATABASE_URL }}
           DIRECT_URL: ${{ secrets.PRODUCTION_DIRECT_URL }}
 
-      - name: Pull Vercel Environment Information
-        run: pnpm vercel pull --yes --environment=production --token=${{ secrets.VERCEL_TOKEN }}
-
-      - name: Build Project Artifacts
-        run: pnpm vercel build --prod --token=${{ secrets.VERCEL_TOKEN }}
-
       - name: Deploy Project Artifacts to Vercel
         run: pnpm vercel deploy --prod --prebuilt --token=${{ secrets.VERCEL_TOKEN }}

package.json

@@ -13,7 +13,7 @@
     "test": "npm run test:e2e && npm run test:unit",
     "check": "svelte-kit sync && svelte-check --tsconfig ./tsconfig.json",
     "check:watch": "svelte-kit sync && svelte-check --tsconfig ./tsconfig.json --watch",
-    "lint": "prettier --check . && oxlint . && eslint .",
+    "lint": "prettier --check . --cache && oxlint . && eslint .",
     "format": "prettier --write .",
     "test:e2e": "playwright test",
     "test:unit": "vitest",

renovate.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
-  "extends": ["config:recommended"],
+  "extends": ["config:recommended", "helpers:pinGitHubActionDigestsToSemver"],
   "dependencyDashboard": false,
   "prHourlyLimit": 10,
   "automerge": false,

tsconfig.json

@@ -1,9 +1,6 @@
 {
   "extends": "$app/tsconfig",
   "compilerOptions": {
-    "incremental": true,
-    "outDir": "build",
-    "sourceMap": true,
     "strict": true,
     "types": ["$app/types", "node", "vitest/globals"] // Note: "types" is replaced (not merged) when extending tsconfig, so keep "$app/types" and add "node"
   },