ci: plan every lane from one table and merge the gate workflows into ci.yml

.codecov.yml

@@ -1,7 +1,8 @@
-# Coverage arrives in exactly two uploads: `unit` (jsdom lane) and `browser`
-# (Chromium-WebGL2 lane). Both jobs in `_ci-checks.yml` are gated on the same
-# `changes.outputs.engine == 'true'`, so they either both run or neither does —
-# there is no case where one upload arrives alone and the second never comes.
+# Coverage arrives in exactly two uploads: `unit` (jsdom lane) and `webgl`
+# (Chromium-WebGL2 lane), both from a push to a long-lived branch. Both lanes
+# are enabled by the same `engine` area, so they either both upload or neither
+# does — there is no case where one upload arrives alone and the second never
+# comes.
 #
 # Without this, Codecov judges the first upload it receives and posts a verdict
 # on jsdom-only coverage: every line the browser lane covers counts as a miss,
@@ -57,7 +58,7 @@ bundle_analysis:
   status: informational
   warning_threshold: '5%'
 
-# Upload flags — one per CI lane that uploads (see _ci-checks.yml).
+# Upload flags — one per test lane that uploads coverage (see scripts/ci/lanes.ts).
 flags:
   unit:
     paths:
@@ -69,15 +70,15 @@ flags:
   # webgpu bootstrap, browser-only branches). Merged with `unit` into the
   # overall number; carryforward keeps it for commits whose CI run skips the
   # browser lane.
-  browser:
+  webgl:
     paths:
       - src/
       - packages/
     carryforward: true
 
 # Per-package coverage breakdown in the PR comment and dashboard.
 # Components are pure reporting slices over the merged uploads (`unit` +
-# `browser`) — no extra uploads needed.
+# `webgl`) — no extra uploads needed.
 component_management:
   default_rules:
     statuses: [] # informational only — no per-component commit statuses

.github/actions/setup/action.yml

@@ -0,0 +1,69 @@
+name: Set up the workspace
+description: pnpm, Node, dependencies, and optionally a Playwright browser, the Naga validator and the built dist.
+
+inputs:
+  node-version:
+    description: Node version for setup-node
+    default: '24.x'
+  browser:
+    description: Playwright browser to install (chromium or firefox); empty installs none
+    default: ''
+  apt:
+    description: Space-separated apt packages to install; empty installs none
+    default: ''
+  naga:
+    description: Install the Naga WGSL validator (pinned by NAGA_VERSION in the workflow env)
+    default: 'false'
+  dist:
+    description: Download the dist artifact the build job uploaded
+    default: 'false'
+
+runs:
+  using: composite
+  steps:
+    # The pnpm version comes from `packageManager` in package.json.
+    - uses: pnpm/action-setup@v6
+      with:
+        run_install: false
+
+    - uses: actions/setup-node@v6
+      with:
+        node-version: ${{ inputs.node-version }}
+        check-latest: true
+        cache: pnpm
+        cache-dependency-path: pnpm-lock.yaml
+
+    - shell: bash
+      run: pnpm bootstrap
+
+    - if: inputs.apt != ''
+      shell: bash
+      run: sudo apt-get update && sudo apt-get install -y ${{ inputs.apt }}
+
+    - if: inputs.browser != ''
+      uses: actions/cache@v5
+      with:
+        path: ~/.cache/ms-playwright
+        key: ${{ runner.os }}-playwright-${{ hashFiles('pnpm-lock.yaml') }}
+        restore-keys: |
+          ${{ runner.os }}-playwright-
+
+    - if: inputs.browser != ''
+      shell: bash
+      run: pnpm exec playwright install --with-deps ${{ inputs.browser }}
+
+    - if: inputs.naga == 'true'
+      id: naga-cache
+      uses: actions/cache@v5
+      with:
+        path: ~/.cargo/bin/naga
+        key: naga-cli-${{ env.NAGA_VERSION }}-${{ runner.os }}
+
+    - if: inputs.naga == 'true' && steps.naga-cache.outputs.cache-hit != 'true'
+      shell: bash
+      run: cargo install naga-cli --version "$NAGA_VERSION" --locked
+
+    - if: inputs.dist == 'true'
+      uses: actions/download-artifact@v4
+      with:
+        name: dist