fix: restructure CLI CI workflows for strict checks

Author: binarylogic

.github/workflows/_go-checks.yaml

@@ -0,0 +1,60 @@
+name: Reusable Go Checks
+
+on:
+  workflow_call:
+    inputs:
+      runner:
+        description: Cirrus runner image
+        required: false
+        default: ghcr.io/cirruslabs/ubuntu-runner-amd64:24.04-sm
+        type: string
+
+jobs:
+  quality:
+    runs-on: ${{ inputs.runner }}
+    timeout-minutes: 35
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+
+      - name: Setup Hermit
+        uses: cashapp/activate-hermit@e49f5cb4dd64ff0b0b659d1d8df499595451155a # v1
+        with:
+          cache: "true"
+
+      - name: Run quality gate (fmt, lint, unit tests)
+        run: task do
+
+      - name: Verify generated code is up to date (offline checks)
+        run: |
+          set -euo pipefail
+
+          # Regenerate API client from committed schema snapshot.
+          (cd internal/api/gen && go run github.com/Khan/genqlient)
+
+          # Regenerate SQLite reflection/sqlc artifacts from embedded schema snapshot.
+          go generate ./internal/sqlite
+
+          if [ -n "$(git status --porcelain)" ]; then
+            echo "Generated artifacts are out of date. Run generation locally and commit results."
+            git status --short
+            git diff
+            exit 1
+          fi
+
+  powersync-replay:
+    runs-on: ${{ inputs.runner }}
+    timeout-minutes: 20
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+
+      - name: Setup Hermit
+        uses: cashapp/activate-hermit@e49f5cb4dd64ff0b0b659d1d8df499595451155a # v1
+        with:
+          cache: "true"
+
+      - name: Run PowerSync replay correctness test
+        run: task test:correctness:powersync-replay

.github/workflows/ci.yaml

@@ -1,34 +1,23 @@
----
-name: ci
+name: CI
 
 on:
-  pull_request:
   push:
-    branches:
-      - main
-
-permissions:
-  contents: read
+    branches: [master]
+  workflow_dispatch:
 
 concurrency:
-  group: ci-${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
+  group: ci-${{ github.sha }}
+  cancel-in-progress: false
 
 jobs:
-  test:
-    runs-on: ghcr.io/cirruslabs/ubuntu-runner-amd64:24.04-sm
-    timeout-minutes: 30
-
+  check:
+    uses: ./.github/workflows/_go-checks.yaml
+    secrets: inherit
+
+  gate:
+    needs: [check]
+    if: ${{ !failure() && !cancelled() }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 1
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-
-      - name: Setup Hermit
-        uses: cashapp/activate-hermit@e49f5cb4dd64ff0b0b659d1d8df499595451155a # v1
-        with:
-          cache: "true"
-
-      - name: Run Unit Tests (Task + Hermit)
-        run: task test
-
-      - name: Run PowerSync Replay Correctness Test
-        run: task test:correctness:powersync-replay
+      - run: echo "Push checks passed"

.github/workflows/pr-ci.yaml

@@ -0,0 +1,23 @@
+name: PR CI
+
+on:
+  pull_request:
+    branches: [master]
+  workflow_dispatch:
+
+concurrency:
+  group: pr-ci-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: true
+
+jobs:
+  check:
+    uses: ./.github/workflows/_go-checks.yaml
+    secrets: inherit
+
+  gate:
+    needs: [check]
+    if: ${{ !failure() && !cancelled() }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 1
+    steps:
+      - run: echo "PR checks passed"

.github/workflows/workflow-lint.yaml

@@ -0,0 +1,25 @@
+name: Workflow Lint
+
+on:
+  pull_request:
+    branches: [master]
+    paths:
+      - .github/workflows/**
+      - .github/actions/**
+  workflow_dispatch:
+
+concurrency:
+  group: workflow-lint-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: true
+
+jobs:
+  actionlint:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+
+      - name: Run actionlint
+        uses: reviewdog/action-actionlint@f45e6423f07e6ea6fce879bbdb0d74407c1fbf55 # v1
+        with:
+          fail_level: any