Standardize CI on the org shape

.github/actions/test/action.yml

@@ -0,0 +1,23 @@
+name: Test
+description: >
+  Is this commit good. Nothing is built for release here and nothing is
+  published; a failure means the code is wrong, not that the pipeline is.
+
+  A composite action rather than a reusable workflow so it runs in the caller's
+  job, under the caller's name -- CI / Test, Release / Test -- rather than as a
+  nested "caller / callee" check.
+
+  ONE definition, called by CI and by Release both. They each carried their own
+  `go test ./...` before, which is a small duplication but the same kind that
+  lets the release-side copy be trimmed for speed until it no longer matches
+  what people trust on a pull request.
+
+  Assumes Go is already set up; the caller does that, because the toolchain
+  version is a property of the job rather than of this step.
+
+runs:
+  using: composite
+  steps:
+    - name: Go tests
+      shell: bash
+      run: go test ./...

.github/workflows/ci.yml

@@ -7,19 +7,30 @@ on:
       - main
 
 jobs:
-  cli:
+  ci:
     runs-on: ubuntu-latest
+    # Bounded, so a step that hangs fails here rather than sitting until the
+    # runner's own timeout hours later.
+    timeout-minutes: 20
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
         with:
           go-version-file: go.mod
 
-      - name: Test CLI
-        run: go test ./...
-
+      # Built first: a compile error should fail before a test suite reaches the
+      # same conclusion more slowly.
+      #
+      # NOTE: this builds through scripts/cli_build.sh, and release.yml
+      # cross-compiles inline with its own loop. Two build paths, and only this
+      # one runs on a pull request -- so a break in the release cross-compile
+      # still surfaces first at release time. Unifying them is a real change and
+      # deserves its own pull request; this one only stops the TEST drifting.
       - name: Build CLI
         run: ./scripts/cli_build.sh
+
+      - name: Test
+        uses: ./.github/actions/test

.github/workflows/release.yml

@@ -20,14 +20,17 @@ concurrency: release-${{ github.repository }}
 jobs:
   release:
     runs-on: ubuntu-latest
+    # Bounded, so a step that hangs fails here rather than sitting until the
+    # runner's own timeout hours later.
+    timeout-minutes: 20
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           fetch-depth: 0
 
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
         with:
           go-version-file: go.mod
 
@@ -63,8 +66,8 @@ jobs:
           echo "version=$VERSION" >> "$GITHUB_OUTPUT"
           echo "tag=$TAG" >> "$GITHUB_OUTPUT"
 
-      - name: Test CLI
-        run: go test ./...
+      - name: Test
+        uses: ./.github/actions/test
 
       - name: Build release artifacts
         env: