fix(ci): orchestrate builds & type-checks from the repo root via Turborepo

.github/workflows/ci.yaml

@@ -15,78 +15,64 @@ permissions:
   contents: read
 
 jobs:
-  # ---- Blocking gates (currently green) -------------------------------------
-  typecheck-api:
-    name: Type check (API)
+  # Everything is orchestrated from the repo root with Turborepo. Turbo builds
+  # workspace packages in dependency order (e.g. @lemma/headless -> web) and
+  # caches results, so there are no per-app `--cwd` commands and no chance of an
+  # app building against a stale/missing workspace dependency.
+  verify:
+    name: Build & type-check
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
       - uses: oven-sh/setup-bun@v2
         with:
-          bun-version: 1.2.2
+          bun-version: 1.3.14
       - name: Cache bun
         uses: actions/cache@v4
         with:
           path: ~/.bun/install/cache
           key: bun-${{ runner.os }}-${{ hashFiles('bun.lock') }}
           restore-keys: bun-${{ runner.os }}-
-      - run: bun install
-      - run: bun run --cwd apps/api typecheck
+      - run: bun install --frozen-lockfile
 
-  build-web:
-    name: Build (web)
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: oven-sh/setup-bun@v2
-        with:
-          bun-version: 1.2.2
-      - name: Cache bun
-        uses: actions/cache@v4
-        with:
-          path: ~/.bun/install/cache
-          key: bun-${{ runner.os }}-${{ hashFiles('bun.lock') }}
-          restore-keys: bun-${{ runner.os }}-
-      - run: bun install
-      - run: bun run --cwd apps/web build
+      # Build all deployable artifacts in dependency order.
+      - name: Build
+        run: bun run build
 
-  # ---- Advisory gates (pre-existing debt; not yet blocking) ------------------
-  # TODO: drop `continue-on-error` once the repo-wide Biome violations are fixed,
-  # then mark this a required status check in branch protection.
-  lint:
-    name: Lint & format (advisory)
-    runs-on: ubuntu-latest
-    continue-on-error: true
-    steps:
-      - uses: actions/checkout@v4
-      - uses: oven-sh/setup-bun@v2
-        with:
-          bun-version: 1.2.2
-      - name: Cache bun
-        uses: actions/cache@v4
-        with:
-          path: ~/.bun/install/cache
-          key: bun-${{ runner.os }}-${{ hashFiles('bun.lock') }}
-          restore-keys: bun-${{ runner.os }}-
-      - run: bun install
-      - run: bun run biome:check
+      # Type-check the API and shared packages. `web` is excluded here because it
+      # has known, pre-existing type errors (see the advisory job below). Turbo
+      # reuses the build above, so dependency declarations are already present.
+      - name: Type-check (API + packages)
+        run: bunx turbo typecheck --filter='!web'
 
-  # TODO: the web type-check has pre-existing project-reference issues; make this
-  # blocking once `bun run --cwd apps/web typecheck` is green.
-  typecheck-web:
-    name: Type check (web, advisory)
+  # Advisory checks: pre-existing debt that we surface on every PR but do not
+  # block on yet. Each step is `continue-on-error` so the job stays green while
+  # still showing failures as annotations. Promote to required checks (and drop
+  # `continue-on-error`) once each is clean.
+  quality:
+    name: Lint & web type-check (advisory)
     runs-on: ubuntu-latest
-    continue-on-error: true
     steps:
       - uses: actions/checkout@v4
       - uses: oven-sh/setup-bun@v2
         with:
-          bun-version: 1.2.2
+          bun-version: 1.3.14
       - name: Cache bun
         uses: actions/cache@v4
         with:
           path: ~/.bun/install/cache
           key: bun-${{ runner.os }}-${{ hashFiles('bun.lock') }}
           restore-keys: bun-${{ runner.os }}-
-      - run: bun install
-      - run: bun run --cwd apps/web typecheck
+      - run: bun install --frozen-lockfile
+
+      # TODO: clear repo-wide Biome violations, then make this blocking.
+      - name: Lint & format check
+        run: bun run biome:check
+        continue-on-error: true
+
+      # TODO: fix the react-router import in src/hooks/use-nprogress.ts and the
+      # tsconfig project-reference setup that pulls API source into web, then
+      # fold web back into the blocking type-check above.
+      - name: Type-check (web)
+        run: bunx turbo typecheck --filter=web
+        continue-on-error: true

.github/workflows/deploy-api.yaml

@@ -35,17 +35,17 @@ jobs:
       - uses: actions/checkout@v4
       - uses: oven-sh/setup-bun@v2
         with:
-          bun-version: 1.2.2
+          bun-version: 1.3.14
       - name: Cache bun
         uses: actions/cache@v4
         with:
           path: ~/.bun/install/cache
           key: bun-${{ runner.os }}-${{ hashFiles('bun.lock') }}
           restore-keys: bun-${{ runner.os }}-
-      - run: bun install
+      - run: bun install --frozen-lockfile
 
       - name: Type check
-        run: bun run --cwd apps/api typecheck
+        run: bunx turbo typecheck --filter=@lemma/api
 
       - name: Apply D1 migrations (${{ env.TARGET_ENV }})
         run: bun run --cwd apps/api migrate:${{ env.TARGET_ENV }}

.github/workflows/deploy-web.yaml

@@ -31,15 +31,22 @@ jobs:
       - uses: actions/checkout@v4
       - uses: oven-sh/setup-bun@v2
         with:
-          bun-version: 1.2.2
+          bun-version: 1.3.14
       - name: Cache bun
         uses: actions/cache@v4
         with:
           path: ~/.bun/install/cache
           key: bun-${{ runner.os }}-${{ hashFiles('bun.lock') }}
           restore-keys: bun-${{ runner.os }}-
-      - run: bun install
+      - run: bun install --frozen-lockfile
 
-      # `deploy:<env>` runs the Vite build and then `wrangler deploy --env <env>`.
-      - name: Build & deploy (${{ env.TARGET_ENV }})
-        run: bun run --cwd apps/web deploy:${{ env.TARGET_ENV }}
+      # Build from the repo root so Turbo builds workspace deps in order
+      # (@lemma/headless -> web). A bare `vite build` would not rebuild
+      # @lemma/headless' dist (which is gitignored), so it must go through Turbo.
+      - name: Build (web + workspace deps)
+        run: bunx turbo build --filter=web
+
+      # Deploy the already-built worker. No rebuild here.
+      - name: Deploy (${{ env.TARGET_ENV }})
+        working-directory: apps/web
+        run: bunx wrangler deploy --env ${{ env.TARGET_ENV }}

apps/web/.gitignore

@@ -9,4 +9,6 @@ count.txt
 .tanstack
 .output
 .vinxi
-todos.json
+todos.json
+# Generated by `wrangler types` on every `bun install` (postinstall: cf-typegen).
+worker-configuration.d.ts

apps/web/src/components/copy-input.tsx

@@ -1,5 +1,5 @@
 import { IconCheck, IconCopy } from '@tabler/icons-react'
-import { motion } from 'framer-motion'
+import { motion } from 'motion/react'
 import { useState } from 'react'
 import { useCopyToClipboard } from 'usehooks-ts'
 

apps/web/src/components/ui/animated-size-container.tsx

@@ -1,4 +1,4 @@
-import { motion } from 'framer-motion'
+import { motion } from 'motion/react'
 import { type ComponentPropsWithoutRef, type PropsWithChildren, forwardRef, useRef } from 'react'
 import { useResizeObserver } from '@/hooks/use-resize-observer'
 import { cn } from '@/lib/utils'

apps/web/src/routes/app/settings/route.tsx

@@ -1,5 +1,5 @@
 import { createFileRoute, Link, Outlet, useRouterState } from '@tanstack/react-router'
-import { motion } from 'framer-motion'
+import { motion } from 'motion/react'
 
 export const Route = createFileRoute('/app/settings')({
   component: RouteComponent,