Set up CI with Vite+

[kmcginnes]

Summary

CI set up Node, pnpm, and the install as three separate steps. voidzero-dev/setup-vp does all three from the files the repo already pins, so CI follows the same Vite+ toolchain contributors run locally.

       - name: Checkout repository
-      - name: Set up pnpm            # pnpm/action-setup
-      - name: Set up Node.js         # actions/setup-node, .node-version
-      - name: Install package and dependencies
-        run: pnpm install --frozen-lockfile
+      - name: Set up Vite+ and install dependencies
+        uses: voidzero-dev/setup-vp@68f39c78 # v1.21.2
+        with:
+          cache: true
+          run-install: |
+            - args: ['--frozen-lockfile']
       - name: Check for lockfile drift   # unchanged
       - name: Run type, lint, and format checks
       - name: Run package tests
+      - name: Build packages
+        run: pnpm build

With no version inputs, setup-vp resolves:

• Vite+ from the vite-plus catalog entry (1.1.0)
• Node from .node-version
• pnpm from packageManager, including its +sha512 hash

The new build step catches a broken vite build before the Docker workflow does. docs/development.md drops the pnpm/action-setup upgrade notes and now says Vite+ checks the pnpm hash as well.

Evidence

Before: setup-node and pnpm/action-setup installed the toolchain, and CI never ran pnpm build.
After: run 38640754820 passed every step. Its log shows Resolved Vite+ version '1.1.0' from package.json, Node v24.21.0, and Done in 13s using pnpm v12.8.1. It also saved the dependency cache.

I ran two more checks:

• Install refuses a stale lockfile, even without the flag. A throwaway branch with a stale lockfile and run-install left at its default failed with ERR_PNPM_OUTDATED_LOCKFILE. The explicit --frozen-lockfile stays anyway, so the guarantee doesn't depend on that default.
• A wrong pnpm hash fails. Run locally with a corrupted packageManager hash, vp install stops with Hash mismatch for pnpm@12.8.1.

The job took 5m 0s on a cold cache, against 3m 52s for the last main run. Install took 20s, and the new build step took 10s.

Merge Danger

Door: two-way

Impact: CI

The dependency cache key changes once. Dependabot's existing actions group will bump setup-vp.

Related

• Related to Migrate the toolchain to Vite+ #2305

[kmcginnes]

Approved