chore: migrate open work to GitHub issues

.github/workflows/ci.yml

@@ -1,9 +1,5 @@
 name: CI
 
-# Thin orchestrator: owns the triggers and the order, nothing else.
-# The work lives in qa.yml / deploy-dev.yml / deploy-prod.yml, called as reusable workflows so
-# `needs:` still gates them and the pull-request context (PR number, comments) is preserved.
-
 on:
   pull_request:
     branches:
@@ -21,13 +17,108 @@ concurrency:
 
 jobs:
   qa:
-    uses: ./.github/workflows/qa.yml
+    name: qa
+    runs-on: ubuntu-latest
+    env:
+      PUBLIC_DEPLOY_CONTEXT: ${{ github.event_name == 'pull_request' && 'preview' || 'production' }}
+      PUBLIC_PR_NUMBER: ${{ github.event.pull_request.number || '' }}
+      PUBLIC_COMMIT_SHA: ${{ github.sha }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v6
+
+      - name: Setup Node
+        uses: actions/setup-node@v7
+        with:
+          node-version-file: .nvmrc
+          cache: pnpm
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Types, lint and format
+        run: pnpm check
+
+      - name: Unit tests
+        shell: bash
+        run: |
+          set -o pipefail
+          NO_COLOR=1 pnpm test:coverage | tee coverage-output.txt
+          {
+            echo "## Coverage"
+            echo
+            echo '```text'
+            awk '
+              /^ % Coverage report/ { printing=1; next }
+              /^=============================== Coverage summary/ { exit }
+              printing { print }
+            ' coverage-output.txt
+            echo '```'
+            echo
+            echo '```text'
+            awk '/^=============================== Coverage summary/ { printing=1 } printing { print }' coverage-output.txt
+            echo '```'
+          } >> "$GITHUB_STEP_SUMMARY"
+
+      - name: Dependency patch drift
+        run: pnpm check:dependencies
 
-  deploy-dev:
+      - name: Security audit
+        run: pnpm check:audit
+
+      - name: Upload coverage
+        uses: actions/upload-artifact@v7
+        with:
+          name: coverage
+          path: coverage
+          if-no-files-found: ignore
+
+      - name: Build
+        run: pnpm build
+
+      - name: Upload build
+        uses: actions/upload-artifact@v7
+        with:
+          name: dist
+          path: dist
+
+  deploy:
+    name: deploy-dev
     needs: qa
-    if: github.event_name == 'pull_request'
-    uses: ./.github/workflows/deploy-dev.yml
+    if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository
+    runs-on: ubuntu-latest
     permissions:
       contents: read
       pull-requests: write
-    secrets: inherit
+    steps:
+      - name: Download build
+        uses: actions/download-artifact@v8
+        with:
+          name: dist
+          path: dist
+
+      - name: Deploy preview to Netlify
+        id: netlify
+        run: |
+          url=$(npx netlify-cli deploy \
+            --dir=dist \
+            --no-build \
+            --alias="pr-${{ github.event.number }}" \
+            --site="$NETLIFY_SITE_ID" \
+            --auth="$NETLIFY_AUTH_TOKEN" \
+            --json | jq -r '.deploy_url')
+          echo "url=$url" >> "$GITHUB_OUTPUT"
+          echo "Preview: $url" >> "$GITHUB_STEP_SUMMARY"
+        env:
+          NETLIFY_AUTH_TOKEN: ${{ secrets.NETLIFY_AUTH_TOKEN }}
+          NETLIFY_SITE_ID: ${{ vars.NETLIFY_SITE_ID }}
+
+      - name: Comment the preview URL
+        uses: marocchino/sticky-pull-request-comment@v3
+        with:
+          header: netlify-preview
+          message: |
+            🚀 Preview deploy: ${{ steps.netlify.outputs.url }}

.github/workflows/deploy-production.yml

@@ -9,14 +9,99 @@ permissions:
   contents: read
 
 concurrency:
-  group: deploy-production
+  group: deploy
   cancel-in-progress: false
 
 jobs:
   qa:
-    uses: ./.github/workflows/qa.yml
+    name: qa
+    runs-on: ubuntu-latest
+    env:
+      PUBLIC_DEPLOY_CONTEXT: production
+      PUBLIC_PR_NUMBER: ""
+      PUBLIC_COMMIT_SHA: ${{ github.sha }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
 
-  deploy-prod:
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v6
+
+      - name: Setup Node
+        uses: actions/setup-node@v7
+        with:
+          node-version-file: .nvmrc
+          cache: pnpm
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Types, lint and format
+        run: pnpm check
+
+      - name: Unit tests
+        shell: bash
+        run: |
+          set -o pipefail
+          NO_COLOR=1 pnpm test:coverage | tee coverage-output.txt
+          {
+            echo "## Coverage"
+            echo
+            echo '```text'
+            awk '
+              /^ % Coverage report/ { printing=1; next }
+              /^=============================== Coverage summary/ { exit }
+              printing { print }
+            ' coverage-output.txt
+            echo '```'
+            echo
+            echo '```text'
+            awk '/^=============================== Coverage summary/ { printing=1 } printing { print }' coverage-output.txt
+            echo '```'
+          } >> "$GITHUB_STEP_SUMMARY"
+
+      - name: Dependency patch drift
+        run: pnpm check:dependencies
+
+      - name: Security audit
+        run: pnpm check:audit
+
+      - name: Upload coverage
+        uses: actions/upload-artifact@v7
+        with:
+          name: coverage
+          path: coverage
+          if-no-files-found: ignore
+
+      - name: Build
+        run: pnpm build
+
+      - name: Upload build
+        uses: actions/upload-artifact@v7
+        with:
+          name: dist
+          path: dist
+
+  deploy:
+    name: deploy-prod
     needs: qa
-    uses: ./.github/workflows/deploy-prod.yml
-    secrets: inherit
+    runs-on: ubuntu-latest
+    steps:
+      - name: Download build
+        uses: actions/download-artifact@v8
+        with:
+          name: dist
+          path: dist
+
+      - name: Deploy to Netlify
+        run: |
+          npx netlify-cli deploy \
+            --dir=dist \
+            --no-build \
+            --prod \
+            --site="$NETLIFY_SITE_ID" \
+            --auth="$NETLIFY_AUTH_TOKEN"
+          echo "Production: https://timer.marcosgilf.com" >> "$GITHUB_STEP_SUMMARY"
+        env:
+          NETLIFY_AUTH_TOKEN: ${{ secrets.NETLIFY_AUTH_TOKEN }}
+          NETLIFY_SITE_ID: ${{ vars.NETLIFY_SITE_ID }}