Add deno based web module runner

.github/workflows/check.yml

@@ -37,6 +37,18 @@ jobs:
         if: runner.os == 'Windows'
         run: python -m pip install pipx
 
+      # Optional npm backend, installed before the main `mise install`.
+      # See [tasks.setup-aube] in .mise.toml for the full rationale.
+      - name: Install aube (optional npm backend, allowed to fail)
+        continue-on-error: true
+        run: |
+          mise settings experimental=true
+          mise run setup-aube
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+          MISE_HTTP_TIMEOUT: "120"
+          MISE_TASK_RUN_AUTO_INSTALL: "false"
+
       - name: Install mise tools
         run: |
           mise settings add idiomatic_version_file_enable_tools "[]"

.github/workflows/dependencies.yml

@@ -30,7 +30,7 @@ defaults:
 jobs:
   dependencies:
     runs-on: ubuntu-latest
-    timeout-minutes: 15
+    timeout-minutes: 25
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -46,6 +46,21 @@ jobs:
       - name: osv-scanner
         run: osv-scanner --lockfile Cargo.lock
 
+      # `cargo unmaintained` persists per-repository archival/last-commit
+      # lookups under `$XDG_CACHE_HOME/cargo-unmaintained` (default
+      # `~/.cache/cargo-unmaintained`, with a versioned `v2/` subdir). On a
+      # cold runner the per-dependency GitHub round-trips take ~12 min, which
+      # nearly blew the old 15-min timeout; restoring this cache keeps reruns
+      # fast. Key on Cargo.lock so a dependency change refreshes; the prefix
+      # restore-key reuses the previous cache for crates that didn't change.
+      - name: Cache cargo-unmaintained lookups
+        uses: actions/cache@v4
+        with:
+          path: ~/.cache/cargo-unmaintained
+          key: cargo-unmaintained-${{ hashFiles('**/Cargo.lock') }}
+          restore-keys: |
+            cargo-unmaintained-
+
       # `cargo unmaintained` queries the GitHub API to check whether each
       # declared upstream repository is archived. Without a token the
       # archival check is skipped with a warning, leaving an unmaintained

.github/workflows/test.yml

@@ -44,29 +44,38 @@ jobs:
           github.event_name == 'workflow_dispatch' && (
           github.event.inputs.os == 'all' && format(
           '[{0},{1},{2},{3},{4}]',
-          '{"os":"ubuntu-latest","timeout":25}',
+          '{"os":"ubuntu-latest","timeout":30}',
           '{"os":"ubuntu-24.04-arm","timeout":25}',
-          '{"os":"macos-latest","timeout":35}',
+          '{"os":"macos-latest","timeout":45}',
           '{"os":"macos-26-intel","timeout":60}',
-          '{"os":"windows-latest","timeout":40}'
+          '{"os":"windows-latest","timeout":60}'
           )
-          || github.event.inputs.os == 'ubuntu-latest' && '[{"os":"ubuntu-latest","timeout":25}]'
+          || github.event.inputs.os == 'ubuntu-latest' && '[{"os":"ubuntu-latest","timeout":30}]'
           || github.event.inputs.os == 'ubuntu-24.04-arm' && '[{"os":"ubuntu-24.04-arm","timeout":25}]'
-          || github.event.inputs.os == 'macos-latest' && '[{"os":"macos-latest","timeout":35}]'
+          || github.event.inputs.os == 'macos-latest' && '[{"os":"macos-latest","timeout":45}]'
           || github.event.inputs.os == 'macos-26-intel' && '[{"os":"macos-26-intel","timeout":60}]'
-          || github.event.inputs.os == 'windows-latest' && '[{"os":"windows-latest","timeout":40}]'
+          || github.event.inputs.os == 'windows-latest' && '[{"os":"windows-latest","timeout":60}]'
           )
           || format(
           '[{0},{1},{2}]',
-          '{"os":"ubuntu-latest","timeout":25}',
+          '{"os":"ubuntu-latest","timeout":30}',
           '{"os":"ubuntu-24.04-arm","timeout":25}',
-          '{"os":"macos-latest","timeout":35}'
+          '{"os":"macos-latest","timeout":45}'
           )
           ) }}
     steps:
       - name: Checkout
         uses: actions/checkout@v4
 
+      # Reclaim the large preinstalled toolchains we never use (~30 GB).
+      # `|| true` so a missing dir (e.g. on the arm image) is not fatal.
+      - name: Free up disk space (Linux)
+        if: runner.os == 'Linux'
+        run: |
+          sudo rm -rf /usr/local/lib/android /opt/ghc /opt/hostedtoolcache/CodeQL /usr/share/swift || true
+          sudo docker image prune --all --force || true
+          df -h /
+
       - name: Install Mesa Vulkan drivers (lavapipe)
         if: runner.os == 'Linux'
         run: |
@@ -82,6 +91,18 @@ jobs:
         if: runner.os == 'Windows'
         run: python -m pip install pipx
 
+      # Optional npm backend, installed before the main `mise install`.
+      # See [tasks.setup-aube] in .mise.toml for the full rationale.
+      - name: Install aube (optional npm backend, allowed to fail)
+        continue-on-error: true
+        run: |
+          mise settings experimental=true
+          mise run setup-aube
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+          MISE_HTTP_TIMEOUT: "120"
+          MISE_TASK_RUN_AUTO_INSTALL: "false"
+
       - name: Install mise tools
         run: |
           mise settings add idiomatic_version_file_enable_tools "[]"