ci: resolve pnpm catalog: deps in release + test workflows

[John-David Dalton (jdalton)]

Warning

Do not merge without review. This touches release-critical publishing workflows. No publish, tag, or release was triggered by this PR — it only changes how two workflows install dependencies. John-David Dalton (@jdalton) reviews before merge.

What was broken

The tag-triggered release pipeline was non-functional. .github/workflows/release.yml (publish on v*.*.* tag push) uses .github/workflows/test.yml as its workflow_call pre-release gate (needs: test). Both workflows installed dependencies with a bare bun install, which cannot resolve this repo's pnpm catalog: dependencies — it fails with @<pkg>@catalog: failed to resolve. So the gate could never pass and the release job could never install.

The fix

Both workflows now install the same way the already-working ci.yml does: via the fleet composite action ./.github/actions/fleet/setup-and-install, which provisions node + pnpm and installs through pnpm (resolving catalog:). The existing oven-sh/setup-bun step is kept (same pinned SHA 22457c87…) so bun test, bun add, and the npm-provenance bootstrap still have bun on PATH.

Exact changes (2 files, install step only)

• .github/workflows/test.yml — replaced - run: bun install with - uses: ./.github/actions/fleet/setup-and-install (checkout: false, socket-api-token: ${{ secrets.SOCKET_API_KEY }}). The bun test and "Test blocking on install" (bun add lodahs) steps are unchanged.
• .github/workflows/release.yml — replaced - run: bun install with the same composite (checkout: false, socket-api-token: ${{ secrets.SOCKET_API_TOKEN_FOR_CLI_AND_SFW }}). The checkout, setup-bun, bun install -g npm@latest, and npm publish --provenance steps are unchanged.

checkout: false is passed because each job already has an actions/checkout step that populates the workspace (which is also what lets GitHub resolve the local ./ action), so the composite's own checkout would be redundant.

The workflow_call gate wiring (release.yml → test.yml, needs: test) and all publish/OIDC/tag logic are left untouched, per the task scope. test.yml is not deleted.

How I verified (without triggering a release)

Verification results

• YAML validity — both files pass yaml.safe_load and actionlint. My changes introduce zero new actionlint warnings. (One pre-existing actionlint warning remains on test.yml's "Run tests" env line secrets.SOCKET_API_TOKEN, present on main before this PR and not touched here.)
• Referenced action exists — .github/actions/fleet/setup-and-install/action.yml is present and declares the checkout and socket-api-token inputs I use.
• Pinned SHA matches — oven-sh/setup-bun@22457c87c1b161cf7dde222c3e82b2b5f8d2bed2 is byte-identical across ci.yml, test.yml, and release.yml.
• Install path proven — pnpm-lock.yaml is committed, and ci.yml already installs the same way and is green. The pre-commit hook in this branch also ran a full pnpm install (356 packages, catalog resolved) and bun test (47 pass, 0 fail).
• Trigger/needs graph — release.yml fires on push: tags: v*.*.* → test job runs test.yml via workflow_call → release job has needs: test, so publish still runs only after the gate passes.

Only a real tag push can exercise: the actual v*.*.* trigger on GitHub runners, the composite resolving ./ after actions/checkout on a detached tag ref, and the npm OIDC provenance publish. These were reasoned through but not executed.

⚠️ Residual risk — this fix alone does not make release.yml publish successfully

While fixing the install I found that release.yml has further, independent blockers outside this PR's scope (the task was explicit: fix the install only, do not change publish/OIDC/tag logic). John-David Dalton (@jdalton) should decide the direction before relying on this path:

Details

1. prepublishOnly guard blocks raw npm publish. package.json has "prepublishOnly": "echo 'ERROR: Use GitHub Actions workflow for publishing' && exit 1". release.yml's npm publish --provenance runs prepublishOnly → exit 1 → fails. The fleet publish path (scripts/fleet/npm-publish.mts) is designed to bypass this; raw npm publish is not.
2. No build step + dist/ is gitignored. **/dist/ is not tracked, and release.yml has no build step, so the published main/types/exports target would be missing. ci.yml and the fleet publish both run pnpm run build first.
3. release.yml appears superseded by a full fleet-canonical release system already in the repo: npm-publish.yml (staged OIDC publish), github-release.yml (cuts the GH release — and it also fires on push: tags: v*, overlapping release.yml), and release-reconcile.yml (tag-gap healer). test.yml is referenced only by release.yml.

Recommendation: consider retiring release.yml (and test.yml, if unused elsewhere) in favor of the fleet system rather than repairing the legacy path. That is a larger, publish-touching change and is deliberately left out of this PR.