Standardize CI on the org shape

.github/actions/test/action.yml

@@ -0,0 +1,47 @@
+name: Test
+description: >
+  Is this commit good. Nothing is packaged for release here and nothing is
+  published; a failure means the addon is wrong, not that the pipeline is.
+
+  A composite action rather than a reusable workflow so it runs in the caller's
+  job, under the caller's name -- CI / Test, Release / Test -- rather than as a
+  nested "caller / callee" check.
+
+  ONE definition, called by CI and by Release both. Release did not run any of
+  this before: it read the version, packaged the addon and published it, so the
+  only thing between a broken commit and the registry was whether somebody
+  looked at CI first.
+
+  A per-repo copy, not a shared action. `uses: ./` is repo-local, so the
+  fourteen copies of this file are copies -- the accepted cost of no repo's CI
+  breaking because another repo changed.
+
+runs:
+  using: composite
+  steps:
+    # The addon's own file manifest. Listed rather than globbed: a file dropped
+    # in a refactor is exactly what this catches, and a glob would happily match
+    # whatever was left.
+    - name: Validate addon package
+      shell: bash
+      run: |
+        set -euo pipefail
+        test -f gd/addon/plugin.cfg
+        test -f gd/addon/plugin.gd
+        test -f gd/addon/autoload.gd
+        test -f gd/addon/src/playwright_service.gd
+        test -f gd/addon/src/playwright_tag_node.gd
+        test -f gd/addon/src/playwright_state_publisher.gd
+        test -f gd/addon/src/playwright_event_emitter.gd
+        test -f gd/addon/src/element_map_service.gd
+        test -f gd/addon/examples/app_shell/playwright_example_screen.tscn
+        test -f gd/addon/examples/app_shell/playwright_example_screen.gd
+
+    # No `if: hashFiles(...)` guard. This step used to skip itself when
+    # cli/go.mod was absent, which is indistinguishable from the module being
+    # moved -- a skipped test is a green tick. This addon ships a Go CLI, so the
+    # step runs unconditionally.
+    - name: Go tests
+      shell: bash
+      working-directory: cli
+      run: go test ./...

.github/workflows/ci.yml

@@ -1,62 +1,45 @@
 name: CI
 
+# Every pull request and every merge to main: test, on one runner.
+#
+# There is no build. A Godot addon is GDScript in a directory -- what a release
+# ships is the same files, zipped -- so the only question is whether it is
+# correct, and that is Test's job.
+#
+# The push trigger is not redundant here: this repository has no CD, so nothing
+# else covers a merge to main.
+#
+# The steps are .github/actions/test, the same definition Release runs. There is
+# one of it, and it is the one guarding a publish to the GDAM registry.
+
 on:
   pull_request:
   push:
-    branches:
-      - main
+    branches: [main]
+  workflow_dispatch:
 
 permissions:
   contents: read
 
+concurrency:
+  group: ci-${ github.ref }
+  cancel-in-progress: true
+
 jobs:
-  sanity:
+  ci:
     runs-on: ubuntu-latest
+    # Bounded, so a step that hangs fails here rather than sitting until the
+    # runner's own timeout hours later.
+    timeout-minutes: 20
     steps:
-      - uses: actions/checkout@v4
-
-      - name: Validate addon package
-        run: |
-          set -euo pipefail
-          test -f gd/addon/plugin.cfg
-          test -f gd/addon/plugin.gd
-          test -f gd/addon/autoload.gd
-          test -f gd/addon/src/playwright_service.gd
-          test -f gd/addon/src/playwright_tag_node.gd
-          test -f gd/addon/src/playwright_state_publisher.gd
-          test -f gd/addon/src/playwright_event_emitter.gd
-          test -f gd/addon/src/element_map_service.gd
-          test -f gd/addon/examples/app_shell/playwright_example_screen.tscn
-          test -f gd/addon/examples/app_shell/playwright_example_screen.gd
-
-      - name: Install Godot
-        if: ${{ hashFiles('gd/tests/test.sh') != '' }}
-        run: |
-          set -euo pipefail
-          curl -fsSL -o /tmp/godot.zip https://github.com/godotengine/godot/releases/download/4.4.1-stable/Godot_v4.4.1-stable_linux.x86_64.zip
-          unzip -q /tmp/godot.zip -d /tmp/godot
-          sudo install -m 0755 /tmp/godot/Godot_v4.4.1-stable_linux.x86_64 /usr/local/bin/godot
+      # Third-party actions are pinned by SHA, with the tag in a trailing
+      # comment so the version is still readable. A tag is a moving reference:
+      # whoever can move it can run code in this job.
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
-      - name: Run Godot tests
-        if: ${{ hashFiles('gd/tests/test.sh') != '' }}
-        run: ./gd/tests/test.sh
-
-      - uses: actions/setup-go@v5
-        if: ${{ hashFiles('cli/go.mod') != '' }}
+      - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
         with:
           go-version-file: cli/go.mod
 
-      - name: Run Go tests
-        if: ${{ hashFiles('cli/go.mod') != '' }}
-        working-directory: cli
-        run: go test ./...
-
-      - uses: oven-sh/setup-bun@v2
-        if: ${{ hashFiles('js/package.json') != '' }}
-        with:
-          bun-version: '1.2'
-
-      - name: Run JavaScript helper tests
-        if: ${{ hashFiles('js/package.json') != '' }}
-        working-directory: js
-        run: bun test
+      - name: Test
+        uses: ./.github/actions/test