Publish tested builds

.github/actions/install-dependencies/action.yml

@@ -36,7 +36,6 @@ runs:
         key: ${{ runner.os }}-npm-${{ hashFiles('.nvmrc', 'package-lock.json') }}
     - if: steps.restore-node-modules-cache.outputs.cache-hit != 'true'
       name: Install NPM dependencies
-      working-directory: .
       shell: bash
       run: NODE_ENV=development npm ci
     - uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 # v4

.github/actions/test-package/action.yml

@@ -11,11 +11,9 @@ runs:
   using: composite
   steps:
     - name: Install Playwright
+      if: ${{ inputs.package_name == 'scratch-render' }}
       shell: bash
-      run: |
-        if [[ ${{ inputs.package_name }} == "scratch-render" ]]; then
-          npx playwright install --with-deps chromium
-        fi
+      run: npx playwright install --with-deps chromium
     - name: Test
       working-directory: ./packages/${{ inputs.package_name }}
       shell: bash

.github/workflows/ci.yml

@@ -5,7 +5,17 @@ on:
   pull_request:
   push: # WARNING: Renovate sometimes automerges without PR, so we MUST build and test renovate/** branches
   workflow_call:
+    inputs:
+      force-full-build:
+        description: 'Build all packages regardless of path filters'
+        type: boolean
+        default: false
   workflow_dispatch:
+    inputs:
+      force-full-build:
+        description: 'Build all packages regardless of path filters'
+        type: boolean
+        default: false
 
 concurrency:
   group: "${{ github.workflow }} @ ${{ github.event.compare || github.head_ref || github.ref }}"
@@ -29,22 +39,40 @@ jobs:
         env:
           # `env:` values are printed to the log even without using them in `run:`
           GH_CONTEXT: ${{ toJson(github) }}
+          SCRATCH_ENV: ${{ vars.SCRATCH_ENV || '<none>' }}
         run: |
           cat <<EOF
           Working directory: $(pwd)
           Node version: $(node --version)
           NPM version: $(npm --version)
-          Scratch environment: ${{ vars.SCRATCH_ENV || '<none>' }}
+          Scratch environment: $SCRATCH_ENV
           EOF
 
       - uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3
-        id: filter
+        id: paths-filter
+        if: ${{ !inputs.force-full-build }}
         with:
           filters: ./.github/path-filters.yml
 
+      - name: Resolve changed packages
+        id: filter
+        run: |
+          if [ "${{ inputs.force-full-build }}" = "true" ]; then
+            echo "any-workspace=true" >> "$GITHUB_OUTPUT"
+            PACKAGES=$(ls -1d packages/*/ | xargs -n1 basename | jq -Rcn '[inputs]')
+            echo "changes=$PACKAGES" >> "$GITHUB_OUTPUT"
+          else
+            echo "any-workspace=${{ steps.paths-filter.outputs.any-workspace }}" >> "$GITHUB_OUTPUT"
+            PACKAGES=$(echo '${{ steps.paths-filter.outputs.changes }}' | jq -c '[.[] | select(. != "global" and . != "any-workspace")]')
+            echo "changes=$PACKAGES" >> "$GITHUB_OUTPUT"
+          fi
+
       - if: ${{ steps.filter.outputs.any-workspace == 'true' }}
         uses: ./.github/actions/install-dependencies
 
+      # IMPORTANT: always build all packages or none - never a subset.
+      # The publish workflow reuses these artifacts, so partial artifacts would cause publish
+      # failures for omitted packages.
       - name: Build packages
         if: ${{ steps.filter.outputs.any-workspace == 'true' }}
         run: npm run build
@@ -54,6 +82,7 @@ jobs:
         uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
         with:
           name: build
+          retention-days: 90
           path: |
             packages/**/build
             packages/**/dist
@@ -62,7 +91,7 @@ jobs:
   test:
     runs-on: ubuntu-latest
     needs: build
-    if: ${{ needs.build.outputs.any-workspace == 'true' }}
+    if: ${{ needs.build.outputs.any-workspace == 'true' && needs.build.outputs.packages != '[]' }}
     permissions:
       checks: write
       pull-requests: write
@@ -72,9 +101,6 @@ jobs:
       fail-fast: false
       matrix:
         package: ${{ fromJSON(needs.build.outputs.packages) }}
-        exclude:
-          - package: global
-          - package: any-workspace
     name: Test ${{ matrix.package }}
     steps:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
@@ -157,21 +183,20 @@ jobs:
     name: Test Results
     runs-on: ubuntu-latest
     needs: test
-    if: ${{ !cancelled() }}
+    if: ${{ !cancelled() && needs.test.result != 'skipped' }}
     steps:
       - run: |
           case "${{ needs.test.result }}" in
             success)
               echo "Tests passed successfully."
               exit 0
               ;;
-            skipped)
-              echo "Tests were unnecessary for these changes, so they were skipped."
-              echo "If this is unexpected, check the path filters."
-              exit 0
+            cancelled)
+              echo "Tests were cancelled."
+              exit 1
               ;;
             *)
-              echo "Tests failed."
+              echo "Tests failed. Result: ${{ needs.test.result }}"
               exit 1
               ;;
           esac

.github/workflows/commitlint.yml

@@ -3,6 +3,7 @@ on: [pull_request]
 
 concurrency:
   group: "${{ github.workflow }} @ ${{ github.event.pull_request.head.label || github.head_ref || github.sha }}"
+  cancel-in-progress: true
 
 jobs:
   commitlint:

.github/workflows/ghpages-cleanup.yml

@@ -5,6 +5,10 @@ on:
     - cron: 0 0 * * 6 # midnight on Saturdays
   workflow_dispatch:
 
+concurrency:
+  group: ghpages-cleanup
+  cancel-in-progress: false # queue rather than cancel: avoid half-cleaned states
+
 jobs:
   cleanup:
     permissions: