ci: adopt shared build checks and guarded updates

.github/workflows/automerge-dependabot.yml

@@ -1,28 +1,20 @@
 name: Auto-merge Dependabot
 
+# Auto-merge stable patch/minor GitHub Actions updates once Test passes.
+# Application dependencies, major, 0.x, prerelease and unknown updates stay manual.
+
 on:
-  pull_request:
-    types: [opened, synchronize]
+  workflow_run:
+    workflows: ["Test"]
+    types: [completed]
 
 permissions:
-  pull-requests: write
+  actions: read
   contents: write
+  pull-requests: write
 
 jobs:
   auto-merge:
-    if: github.actor == 'dependabot[bot]'
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Fetch Dependabot metadata
-        id: metadata
-        uses: dependabot/fetch-metadata@v2
-        with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-
-      # Only auto-merge patch and minor updates (not major)
-      - name: Auto-merge safe updates
-        if: steps.metadata.outputs.update-type != 'version-update:semver-major'
-        run: gh pr merge ${{ github.event.pull_request.number }} --squash --admin
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+    uses: darkroomengineering/.github/.github/workflows/dependabot-merge.yml@a75b42e03f56b5ca5b2808ac4f1b06c81998fbc6
+    with:
+      update-policy: actions-only

.github/workflows/lighthouse-to-slack.yml

@@ -3,8 +3,9 @@
 # Runs Lighthouse on Vercel deployments and posts results as commit comments.
 # Our GitHub → Slack integration forwards these to Slack automatically.
 #
-# Required GitHub Secrets:
-#   VERCEL_TOKEN - Vercel API token (Settings → Tokens)
+# Optional GitHub Secrets:
+#   VERCEL_TOKEN - Vercel API token (Settings → Tokens). Missing configuration
+#                  skips the audit with a warning and no scores or comment.
 
 name: Lighthouse
 
@@ -30,24 +31,40 @@ jobs:
         env:
           VERCEL_TOKEN: ${{ secrets.VERCEL_TOKEN }}
         run: |
+          if [ -z "$VERCEL_TOKEN" ]; then
+            echo "::warning title=Lighthouse skipped::VERCEL_TOKEN secret is not set. Add it in Settings → Secrets → Actions to enable Lighthouse reports."
+            echo "skip=true" >> "$GITHUB_OUTPUT"
+            echo "Lighthouse audit skipped: VERCEL_TOKEN is not configured. No audit or scores were produced." >> "$GITHUB_STEP_SUMMARY"
+            exit 0
+          fi
+
           project_name="${GITHUB_REPOSITORY##*/}"
           echo "Looking for Vercel project: $project_name"
 
           # Get team ID for darkroom-engineering
           teams=$(curl -s -H "Authorization: Bearer $VERCEL_TOKEN" "https://api.vercel.com/v2/teams")
-          team_id=$(echo "$teams" | jq -r '.teams[] | select(.slug=="darkroom-engineering") | .id')
-          echo "Team ID: $team_id"
+          team_id=$(echo "$teams" | jq -r '.teams[]? | select(.slug=="darkroom-engineering") | .id // empty')
 
           # Get project ID by matching repo name
           projects=$(curl -s -H "Authorization: Bearer $VERCEL_TOKEN" "https://api.vercel.com/v9/projects?teamId=$team_id")
-          project_id=$(echo "$projects" | jq -r ".projects[] | select(.name==\"$project_name\") | .id")
+          project_id=$(echo "$projects" | jq -r ".projects[]? | select(.name==\"$project_name\") | .id // empty")
+
+          if [ -z "$team_id" ] || [ -z "$project_id" ]; then
+            echo "::warning title=Lighthouse skipped::Could not resolve Vercel team/project (token invalid or lacks access). Skipping Lighthouse report."
+            echo "skip=true" >> "$GITHUB_OUTPUT"
+            echo "Lighthouse audit skipped: Vercel team/project could not be resolved. No audit or scores were produced." >> "$GITHUB_STEP_SUMMARY"
+            exit 0
+          fi
+
+          echo "Team ID: $team_id"
           echo "Project ID: $project_id"
 
-          echo "team_id=$team_id" >> $GITHUB_OUTPUT
-          echo "project_id=$project_id" >> $GITHUB_OUTPUT
+          echo "team_id=$team_id" >> "$GITHUB_OUTPUT"
+          echo "project_id=$project_id" >> "$GITHUB_OUTPUT"
 
       - name: Get Vercel Preview URL
         id: vercel_url
+        if: steps.vercel_info.outputs.skip != 'true'
         uses: zentered/vercel-preview-url@v1.4.0
         env:
           VERCEL_TOKEN: ${{ secrets.VERCEL_TOKEN }}
@@ -57,6 +74,7 @@ jobs:
 
       - name: Wait for Deployment
         id: await
+        if: steps.vercel_info.outputs.skip != 'true'
         uses: UnlyEd/github-action-await-vercel@v2.0.0
         env:
           VERCEL_TOKEN: ${{ secrets.VERCEL_TOKEN }}
@@ -67,7 +85,7 @@ jobs:
         continue-on-error: true
 
       - name: Run Lighthouse
-        if: steps.await.outcome == 'success'
+        if: steps.vercel_info.outputs.skip != 'true' && steps.await.outcome == 'success'
         id: lighthouse
         uses: treosh/lighthouse-ci-action@v12
         env:
@@ -79,6 +97,7 @@ jobs:
 
       - name: Format Results
         id: format
+        if: steps.vercel_info.outputs.skip != 'true'
         uses: actions/github-script@v8
         env:
           DEPLOYMENT_FAILED: ${{ steps.await.outcome != 'success' }}
@@ -121,6 +140,7 @@ jobs:
             }
 
       - name: Post Commit Comment
+        if: steps.vercel_info.outputs.skip != 'true'
         uses: peter-evans/commit-comment@v4
         with:
           body: ${{ steps.format.outputs.comment }}

.github/workflows/test.yml

@@ -8,19 +8,19 @@ on:
   pull_request:
     branches: [main]
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   test:
     runs-on: ubuntu-latest
+    timeout-minutes: 20
 
     steps:
       - uses: actions/checkout@v6
 
-      - uses: oven-sh/setup-bun@v2
+      - name: Build and check
+        uses: darkroomengineering/.github/actions/bun-web-ci@a75b42e03f56b5ca5b2808ac4f1b06c81998fbc6
         with:
-          bun-version: latest
-
-      - name: Install dependencies
-        run: bun install --frozen-lockfile
-
-      - name: Run checks
-        run: bun run check
+          node-version-file: .node-version

package.json

@@ -12,7 +12,7 @@
     "dev": "react-router dev",
     "build": "react-router build",
     "preview": "bun run build && vercel dev",
-    "check": "bun run lint && bun run format && bun run typecheck",
+    "check": "bun run typecheck && bun run lint && oxfmt --check .",
     "lint": "oxlint",
     "format": "oxfmt --write .",
     "typecheck": "react-router typegen && tsc --noEmit",