Cache the pnpm store between CI runs

The lockfile is not committed so the usual lockfile hash key does not work. Instead the store is snapshotted whenever a package.json changes or a week passes, and every run restores the most recent snapshot through a prefix restore key. pnpm still resolves the latest versions within the ranges; the cache only saves the tarball downloads. A composite action holds the setup so the four jobs share it.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

.github/actions/pnpm-install/action.yml

@@ -0,0 +1,36 @@
+name: Install dependencies
+description: Set up pnpm and Node.js, restore the pnpm store from the cache and run pnpm install
+
+inputs:
+  node-version:
+    description: Node.js version passed to actions/setup-node
+    required: true
+
+runs:
+  using: composite
+  steps:
+    - uses: pnpm/action-setup@v6
+    - uses: actions/setup-node@v7
+      with:
+        node-version: ${{ inputs.node-version }}
+
+    # The lockfile is not committed, so the usual lockfile hash key does not
+    # apply. Instead a new store snapshot is saved whenever a package.json
+    # changes or a week passes, and every run restores the most recent one.
+    - id: store
+      shell: bash
+      run: |
+        echo "path=$(pnpm store path --silent)" >> "$GITHUB_OUTPUT"
+        echo "week=$(date -u +%G-%V)" >> "$GITHUB_OUTPUT"
+    - uses: actions/cache@v6
+      with:
+        path: ${{ steps.store.outputs.path }}
+        key: pnpm-store-${{ runner.os }}-${{ steps.store.outputs.week }}-${{ hashFiles('**/package.json', 'pnpm-workspace.yaml') }}
+        restore-keys: pnpm-store-${{ runner.os }}-
+
+    - shell: bash
+      run: pnpm i --no-frozen-lockfile
+    # Drop packages the restored store had but this install did not use, so
+    # the snapshot does not grow with every version bump.
+    - shell: bash
+      run: pnpm store prune