ci: bound and cache Deno setup

.github/actions/setup-deno/action.yml

@@ -14,6 +14,26 @@ inputs:
 runs:
   using: composite
   steps:
+    - name: Configure Deno dependency cache
+      shell: bash
+      run: |
+        set -euo pipefail
+        deno_cache_dir="${RUNNER_TEMP}/veryfront-deno-cache"
+        mkdir -p "${deno_cache_dir}"
+        echo "DENO_DIR=${deno_cache_dir}" >> "${GITHUB_ENV}"
+        echo "DENO_NO_UPDATE_CHECK=1" >> "${GITHUB_ENV}"
+
+    - name: Restore Deno dependency cache
+      id: deno-cache
+      uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+      env:
+        SEGMENT_DOWNLOAD_TIMEOUT_MINS: "2"
+      with:
+        path: ${{ runner.temp }}/veryfront-deno-cache
+        key: veryfront-deno-v2-${{ runner.os }}-${{ runner.arch }}-2.7.7-${{ hashFiles('deno.lock', 'scripts/deno.lock', 'deno.json', '**/deno.json') }}
+        restore-keys: |
+          veryfront-deno-v2-${{ runner.os }}-${{ runner.arch }}-2.7.7-
+
     - name: Install pinned Deno
       shell: bash
       run: |
@@ -40,42 +60,78 @@ runs:
           *) echo "Unsupported Deno install architecture: ${arch}" >&2; exit 1 ;;
         esac
 
+        archive="deno-${arch_target}-${os_target}.zip"
+        case "${arch_target}-${os_target}" in
+          x86_64-unknown-linux-gnu)
+            archive_sha256="0cd918870657ccc3d96ac682290e894dda374e2a742424aae9118b258a6cf7a3"
+            ;;
+          aarch64-unknown-linux-gnu)
+            archive_sha256="e654ef4b41d8f1369dfe7d69374c8f226660153d077e0ac25353d454e03ef798"
+            ;;
+          x86_64-apple-darwin)
+            archive_sha256="2ca88d69c369a2757f17fce7c21d979f04cf56a6990d1f3858bd80b0487d0b74"
+            ;;
+          aarch64-apple-darwin)
+            archive_sha256="5f0ef47e706ecdae5e6248e33bf367340b1d86f87886f60419fe7450f6ffc39a"
+            ;;
+          x86_64-pc-windows-msvc)
+            archive_sha256="dcb4aa0a87a1e0e3a096692d27443bd2496e9204b327150fb01b31984255c3aa"
+            ;;
+          aarch64-pc-windows-msvc)
+            archive_sha256="5693b3107fa22476f007bdb61f0157f16870edd56a636b95eccfdcbec9c82db6"
+            ;;
+          *) echo "Missing Deno archive checksum for ${arch_target}-${os_target}" >&2; exit 1 ;;
+        esac
+
         deno_dir="${RUNNER_TEMP}/deno-${version}-${arch_target}-${os_target}"
         deno_bin="${deno_dir}/${deno_exe}"
-        deno_path="${deno_dir}"
-        deno_cmd="${deno_bin}"
         if [ ! -x "${deno_bin}" ]; then
           mkdir -p "${deno_dir}"
           zip_path="${deno_dir}/deno.zip"
-          if curl --fail --location --show-error --retry 5 --retry-delay 2 \
+          curl --fail --location --show-error --retry 5 --retry-delay 2 \
+            --retry-max-time 120 \
+            --remove-on-error \
             --connect-timeout 20 --max-time 120 \
-            "https://github.com/denoland/deno/releases/download/v${version}/deno-${arch_target}-${os_target}.zip" \
-            --output "${zip_path}"; then
-            unzip -oq "${zip_path}" -d "${deno_dir}"
-            chmod +x "${deno_bin}"
-          else
-            echo "GitHub release download failed; installing pinned deno@${version} from npm." >&2
-            npm_prefix="${deno_dir}/npm"
-            npm --prefix "${npm_prefix}" install --no-audit --no-fund "deno@${version}"
-            deno_path="${npm_prefix}/node_modules/.bin"
-            deno_cmd="${deno_path}/deno"
+            "https://github.com/denoland/deno/releases/download/v${version}/${archive}" \
+            --output "${zip_path}"
+
+          case "${os}" in
+            Darwin) actual_sha256="$(shasum -a 256 "${zip_path}" | awk '{print $1}')" ;;
+            *) actual_sha256="$(sha256sum "${zip_path}" | awk '{print $1}')" ;;
+          esac
+          if [ "${actual_sha256}" != "${archive_sha256}" ]; then
+            echo "Deno archive checksum mismatch for ${archive}" >&2
+            exit 1
           fi
+
+          unzip -oq "${zip_path}" -d "${deno_dir}"
+          chmod +x "${deno_bin}"
         fi
 
-        echo "${deno_path}" >> "${GITHUB_PATH}"
-        "${deno_cmd}" --version
+        echo "${deno_dir}" >> "${GITHUB_PATH}"
+        "${deno_bin}" --version
 
     - name: Generate template manifest
       shell: bash
       run: deno run -A scripts/build/generate-templates-manifest.ts && deno fmt cli/templates/manifest.json
 
     - name: Warm Redis module cache
-      if: inputs.warm-redis-cache == 'true'
+      if: inputs.warm-redis-cache == 'true' && steps.deno-cache.outputs.cache-hit != 'true'
       shell: bash
       run: |
-        deno cache --reload=https://deno.land/x/redis https://deno.land/x/redis@v0.32.1/mod.ts || true
+        timeout --signal=TERM --kill-after=15s 2m \
+          deno cache --frozen https://deno.land/x/redis@v0.32.1/mod.ts
 
     - name: Warm esm.sh cache
-      if: inputs.warm-cache == 'true'
+      if: inputs.warm-cache == 'true' && steps.deno-cache.outputs.cache-hit != 'true'
       shell: bash
-      run: deno cache --reload=https://esm.sh src/index.ts || true
+      run: |
+        timeout --signal=TERM --kill-after=15s 3m \
+          deno cache --frozen src/index.ts
+
+    - name: Save complete Deno dependency cache
+      if: inputs.warm-cache == 'true' && inputs.warm-redis-cache == 'true' && steps.deno-cache.outputs.cache-hit != 'true'
+      uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+      with:
+        path: ${{ runner.temp }}/veryfront-deno-cache
+        key: ${{ steps.deno-cache.outputs.cache-primary-key }}

.github/workflows/cicd.yml

@@ -38,11 +38,12 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
       - uses: ./.github/actions/setup-deno
+        timeout-minutes: 5
       - name: Run ${{ matrix.check }}
         run: |
           case "${{ matrix.check }}" in
             format) deno fmt --check ;;
-            lint) deno task lint && deno task lint:core-deps && deno task lint:dependency-boundaries && deno task lint:module-boundaries && deno task lint:extension-contracts && deno task lint:extension-capabilities && deno task lint:ban-test-only && deno task lint:sanitizer-baseline && deno task lint:skipped-tests && deno task lint:chat-ratchets && deno task lint:esm-sh-codemod && deno task lint:test-typecheck && deno task storybook:check ;;
+            lint) deno task lint && deno task lint:core-deps && deno task lint:dependency-boundaries && deno task lint:module-boundaries && deno task lint:extension-contracts && deno task lint:extension-capabilities && deno task lint:ban-test-only && deno task lint:sanitizer-baseline && deno task lint:skipped-tests && deno task lint:chat-ratchets && deno task lint:esm-sh-codemod && deno task lint:test-typecheck && deno task storybook:check && deno test --frozen --config=scripts/test.deno.json --no-check --allow-read scripts/ci/setup-deno-workflow.test.ts ;;
             typecheck) deno task typecheck ;;
           esac
 
@@ -58,6 +59,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
       - uses: ./.github/actions/setup-deno
+        timeout-minutes: 10
         with:
           warm-cache: "true"
           warm-redis-cache: "true"
@@ -80,9 +82,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
       - uses: ./.github/actions/setup-deno
-        with:
-          warm-cache: "true"
-          warm-redis-cache: "true"
+        timeout-minutes: 5
       - name: Run unit coverage shard
         id: coverage
         run: |
@@ -132,6 +132,7 @@ jobs:
           fi
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
       - uses: ./.github/actions/setup-deno
+        timeout-minutes: 5
       - name: Download unit coverage lcov files
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8
         with:
@@ -154,8 +155,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
       - uses: ./.github/actions/setup-deno
-        with:
-          warm-cache: "true"
+        timeout-minutes: 5
       - name: Configure apt retries and mirrors
         run: |
           sudo sed -i \
@@ -169,30 +169,39 @@ jobs:
             echo 'Acquire::https::Timeout "30";'
           } | sudo tee /etc/apt/apt.conf.d/99veryfront-ci-retries
       - name: Install Chromium
+        timeout-minutes: 15
         run: |
+          readonly install_attempts=2
+          readonly install_timeout_minutes=5
+          readonly install_kill_grace_seconds=15
+          readonly apt_lock_attempts=12
+          readonly apt_lock_sleep_seconds=5
+          readonly retry_backoff_seconds=20
+
           wait_for_apt_locks() {
-            for _ in $(seq 1 60); do
+            for _ in $(seq 1 "${apt_lock_attempts}"); do
               if ! sudo fuser /var/lib/dpkg/lock-frontend /var/lib/dpkg/lock /var/cache/apt/archives/lock >/dev/null 2>&1; then
                 return 0
               fi
-              sleep 5
+              sleep "${apt_lock_sleep_seconds}"
             done
             return 1
           }
 
-          for attempt in 1 2 3; do
-            wait_for_apt_locks
-            timeout 10m deno run -A npm:playwright install --with-deps chromium && exit 0
+          for attempt in $(seq 1 "${install_attempts}"); do
+            if ! wait_for_apt_locks; then
+              echo "::error::Timed out waiting for apt/dpkg locks"
+              exit 1
+            fi
+            timeout --signal=TERM --kill-after="${install_kill_grace_seconds}s" "${install_timeout_minutes}m" \
+              deno run -A npm:playwright install --with-deps chromium && exit 0
             status=$?
 
-            if [ "$attempt" -eq 3 ]; then
+            if [ "$attempt" -eq "${install_attempts}" ]; then
               exit "$status"
             fi
 
-            wait_for_apt_locks || true
-            sudo apt-get clean || true
-            sudo rm -rf /var/lib/apt/lists/* || true
-            sleep $((attempt * 20))
+            sleep "${retry_backoff_seconds}"
           done
       - uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60  # v4.0.0
         with:
@@ -213,8 +222,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
       - uses: ./.github/actions/setup-deno
-        with:
-          warm-cache: "true"
+        timeout-minutes: 5
       - name: Configure apt retries and mirrors
         run: |
           sudo sed -i \
@@ -228,30 +236,39 @@ jobs:
             echo 'Acquire::https::Timeout "30";'
           } | sudo tee /etc/apt/apt.conf.d/99veryfront-ci-retries
       - name: Install Chromium
+        timeout-minutes: 15
         run: |
+          readonly install_attempts=2
+          readonly install_timeout_minutes=5
+          readonly install_kill_grace_seconds=15
+          readonly apt_lock_attempts=12
+          readonly apt_lock_sleep_seconds=5
+          readonly retry_backoff_seconds=20
+
           wait_for_apt_locks() {
-            for _ in $(seq 1 60); do
+            for _ in $(seq 1 "${apt_lock_attempts}"); do
               if ! sudo fuser /var/lib/dpkg/lock-frontend /var/lib/dpkg/lock /var/cache/apt/archives/lock >/dev/null 2>&1; then
                 return 0
               fi
-              sleep 5
+              sleep "${apt_lock_sleep_seconds}"
             done
             return 1
           }
 
-          for attempt in 1 2 3; do
-            wait_for_apt_locks
-            timeout 10m deno run -A npm:playwright install --with-deps chromium && exit 0
+          for attempt in $(seq 1 "${install_attempts}"); do
+            if ! wait_for_apt_locks; then
+              echo "::error::Timed out waiting for apt/dpkg locks"
+              exit 1
+            fi
+            timeout --signal=TERM --kill-after="${install_kill_grace_seconds}s" "${install_timeout_minutes}m" \
+              deno run -A npm:playwright install --with-deps chromium && exit 0
             status=$?
 
-            if [ "$attempt" -eq 3 ]; then
+            if [ "$attempt" -eq "${install_attempts}" ]; then
               exit "$status"
             fi
 
-            wait_for_apt_locks || true
-            sudo apt-get clean || true
-            sudo rm -rf /var/lib/apt/lists/* || true
-            sleep $((attempt * 20))
+            sleep "${retry_backoff_seconds}"
           done
       - uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60  # v4.0.0
         with:
@@ -276,8 +293,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
       - uses: ./.github/actions/setup-deno
-        with:
-          warm-cache: "true"
+        timeout-minutes: 5
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v6
         with:
           node-version: "24"
@@ -297,8 +313,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
       - uses: ./.github/actions/setup-deno
-        with:
-          warm-cache: "true"
+        timeout-minutes: 5
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v6
         with:
           node-version: "24"
@@ -319,6 +334,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
       - uses: ./.github/actions/setup-deno
+        timeout-minutes: 5
 
       - name: Compile binary
         run: deno task build
@@ -432,6 +448,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
       - uses: ./.github/actions/setup-deno
+        timeout-minutes: 5
 
       - run: deno task build:prepare
 
@@ -466,6 +483,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
       - uses: ./.github/actions/setup-deno
+        timeout-minutes: 5
 
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v6
         with:
@@ -626,6 +644,7 @@ jobs:
           fi
 
       - uses: ./.github/actions/setup-deno
+        timeout-minutes: 5
 
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v6
         with:

.github/workflows/security-audit.yml

@@ -36,6 +36,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: ./.github/actions/setup-deno
+        timeout-minutes: 5
 
       - name: Run npm dependency audit
         run: deno task audit
@@ -76,6 +77,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: ./.github/actions/setup-deno
+        timeout-minutes: 5
 
       - name: Submit deno.lock graph to GitHub
         env:

deno.json

@@ -519,7 +519,7 @@
     "lint:ban-test-only": "deno run --allow-read scripts/lint/ban-test-only.ts",
     "lint:sanitizer-baseline": "deno run --allow-read scripts/lint/check-sanitizer-baseline.ts",
     "lint:skipped-tests": "deno run --allow-read scripts/lint/check-skipped-tests-baseline.ts",
-    "test:scripts": "deno test --config=scripts/test.deno.json --no-check --allow-read --allow-write --allow-run scripts/ci/publish-npm-packages.test.ts scripts/build/dnt-polyfill.test.ts scripts/build/generate-sbom.test.ts scripts/build/npm-dependency-sources.test.ts scripts/build/npm-extension-package-metadata.test.ts scripts/build/npm-package-metadata.test.ts scripts/build/npm-react-shims.test.ts scripts/build/prepare-framework-sources.test.ts scripts/docs/docs-coverage.test.ts scripts/docs/generate-api-reference.test.ts scripts/docs/guide-validation.test.ts scripts/lint/audit-core-deps.test.ts scripts/lint/audit-dependency-boundaries.test.ts scripts/lint/audit-extension-capabilities.test.ts scripts/lint/audit-extension-contracts.test.ts scripts/lint/audit-deps.test.ts scripts/lint/check-module-boundaries.test.ts scripts/lint/lint-config.test.ts scripts/lint/ban-test-only.test.ts scripts/lint/check-sanitizer-baseline.test.ts scripts/lint/check-skipped-tests-baseline.test.ts scripts/lint/check-test-typecheck-baseline.test.ts scripts/lint/check-coverage.test.ts scripts/security/audit-npm.test.ts scripts/security/submit-dependency-snapshot.test.ts && deno task test:tool-search-live",
+    "test:scripts": "deno test --config=scripts/test.deno.json --no-check --allow-read --allow-write --allow-run scripts/ci/publish-npm-packages.test.ts scripts/ci/setup-deno-workflow.test.ts scripts/build/dnt-polyfill.test.ts scripts/build/generate-sbom.test.ts scripts/build/npm-dependency-sources.test.ts scripts/build/npm-extension-package-metadata.test.ts scripts/build/npm-package-metadata.test.ts scripts/build/npm-react-shims.test.ts scripts/build/prepare-framework-sources.test.ts scripts/docs/docs-coverage.test.ts scripts/docs/generate-api-reference.test.ts scripts/docs/guide-validation.test.ts scripts/lint/audit-core-deps.test.ts scripts/lint/audit-dependency-boundaries.test.ts scripts/lint/audit-extension-capabilities.test.ts scripts/lint/audit-extension-contracts.test.ts scripts/lint/audit-deps.test.ts scripts/lint/check-module-boundaries.test.ts scripts/lint/lint-config.test.ts scripts/lint/ban-test-only.test.ts scripts/lint/check-sanitizer-baseline.test.ts scripts/lint/check-skipped-tests-baseline.test.ts scripts/lint/check-test-typecheck-baseline.test.ts scripts/lint/check-coverage.test.ts scripts/security/audit-npm.test.ts scripts/security/submit-dependency-snapshot.test.ts && deno task test:tool-search-live",
     "test:sentry-runtime-packages": "deno test --config=scripts/test.deno.json --no-check --no-lock --allow-read --allow-write --allow-run --allow-env=DENO_DIR,HOME,XDG_CACHE_HOME,LOCALAPPDATA,USERPROFILE scripts/build/sentry-runtime-packages.test.ts",
     "test:tool-search-live": "VF_DISABLE_LRU_INTERVAL=1 deno test --no-check -A tests/agent/verify-tool-search-live.test.ts",
     "test:cross-runtime": "deno run --allow-all src/platform/compat/cross-runtime.test.ts",