Aggregate per-version metas: packument rebuild is O(1) subrequests (no ref limit) #171

	name: CI

	on:
	push:
	branches: [main]
	pull_request:

	permissions:
	contents: read

	# Cancel superseded runs on the same ref (e.g. rapid pushes to a PR).
	concurrency:
	group: ci-${{ github.workflow }}-${{ github.ref }}
	cancel-in-progress: true

	jobs:
	test:
	name: typecheck + test
	runs-on: ubuntu-latest
	steps:
	# Actions are pinned to a full commit SHA (org policy).
	- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

	- uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
	with:
	version: 11.9.0

	- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
	with:
	node-version: 24
	cache: pnpm

	- name: Install dependencies
	run: pnpm install --frozen-lockfile

	- name: Typecheck
	run: pnpm typecheck

	# The publish action bundles the Worker's own modules; re-bundle and fail
	# if the committed dist drifts (or an import it pulls in broke).
	- name: Verify action bundle is up to date
	run: \|
	pnpm build:action
	git diff --exit-code -- .github/actions/publish-preview/dist

	# vitest runs the Worker in workerd (Miniflare); no network or secrets.
	# The deploy-time checks (warm + bun e2e) need a live deployment and run
	# from `pnpm run deploy`, not here.
	- name: Test
	run: pnpm test

Provide feedback