What

Collapse the separate setup cache-warming workflow into a self-contained setup-pnpm composite that installs dependencies, and remove every needs: setup chain.

Why

The old design ran a dedicated setup reusable workflow whose only job was to populate a cache; test, check-dist, update (×3 jobs), and sync-readme-versions all declared needs: setup, so each blocked on a full extra runner spin-up + checkout before doing any real work — then re-checked-out and did a restore-only step (no pnpm install fallback). Two issues:

• Serial latency: a warm-up barrier in front of every run.
• Non-standard caching: actions/setup-node provides built-in, lockfile-keyed caching of the pnpm store — per its docs, "The action does not cache node_modules". The old composite instead cached node_modules directly with no install step, so a cache miss/eviction left a job with no dependencies.

Changes

• .github/actions/setup-pnpm — now: pnpm → Node with cache: pnpm → pnpm install --frozen-lockfile. Self-contained and parallel-safe. (pnpm bumped v6.0.5 → v6.0.8 to match what the old setup.yml used.)
• Delete .github/workflows/setup.yml and drop needs: setup from test, check-dist, update, sync-readme-versions.
• Move the repository guard (github.repository == …) from the removed setup job onto the sync job.
• This also resolves the earlier Bump eslint from 8.39.0 to 8.41.0 #3 — update.yml's schema job (pure curl | jq) no longer carries a pointless needs: setup.

Notes

• Jobs now start in parallel; cache key is pnpm-lock.yaml-derived via setup-node.
• No behavior change to what each job runs; only how dependencies are provisioned.
• Independent of the App-token PRs (ci: pr automation use github app token #769 merged, ci: changesets release uses github app token #770 open) — touches different lines.

🤖 Generated with Claude Code