chore(ui): migrate vite 6 → 8, plugin-react 4 → 6; cache UI build in CI (#2501)

* chore(ui): migrate vite 6 -> 8 and plugin-react 4 -> 6

Supersedes the auto-generated bump in #2496, which only updated vite and
left @vitejs/plugin-react on a peer range that excludes vite 8, breaking
the UI build (and every Go job that embeds the UI assets) with ERESOLVE.

- vite ^6.0.0 -> ^8.0.13
- @vitejs/plugin-react ^4.3.0 -> ^6.0.2 (peers vite ^8.0.0 only)
- vite-plugin-singlefile ^2.0.0 -> ^2.3.3 (peers already allowed v8)
- engines.node >=20 -> ^20.19.0 || >=22.12.0 (Vite 7+ requirement)

Vite 8 ships Rolldown instead of Rollup, which rejects bundle mutation in
generateBundle. The rename-output plugin was doing exactly that to flatten
the singlefile-inlined HTML from src/apps/<app>/index.html down to
<app>.html. Refactored it to hoist the file in closeBundle (post-write)
and renamed it to flatten-output to reflect what it actually does.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* chore(ui): give flatten-output a clearer error when the HTML is missing

Addresses Copilot review feedback on #2501: if the singlefile-inlined HTML
isn't where we expect it (e.g. because a future Vite/Rolldown change alters
the output path), throw with the app name and expected path instead of
letting renameSync surface a bare ENOENT.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* perf(ui+ci): cache build artifacts and run vite in single process

Introduce a content-addressable cache for the embedded UI HTML and refactor
the build script to invoke vite once per Node process instead of three
times.

* New ui/scripts/build.mjs runs vite build() in a loop within one process,
  removing the cross-env dev dependency and avoiding redundant plugin/JIT
  warm-up. Local build time drops from ~2.4s to ~1.5s.

* New .github/actions/build-ui composite action restores
  pkg/github/ui_dist/{get-me,issue-write,pr-write}.html from cache keyed on
  hashes of ui/ sources and the lockfile. On cache hit it skips Node setup
  and the build entirely; on miss it sets up Node and runs script/build-ui
  as before. Saves ~6s per workflow on Go-only PRs, which is the common
  case across seven workflows.

* Replace the duplicated setup-node + Build UI pair in seven workflows
  (go, lint, docs-check, license-check, goreleaser, mcp-diff, code-scanning)
  with a single uses: ./.github/actions/build-ui line. code-scanning keeps
  a dedicated setup-node for the JavaScript CodeQL path.

Output files are byte-identical to the pre-refactor build.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* perf(ci): share UI artifact cache across runner OSes

The cached HTML output is platform-independent, so set
enableCrossOsArchive on the cache step. With this any OS can restore
the cache populated by any other OS — one shared cache instead of three.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: SamMorrowDrums

.github/actions/build-ui/action.yml

@@ -0,0 +1,38 @@
+name: Build UI
+description: Restore cached UI HTML artifacts, or set up Node and run script/build-ui on cache miss.
+
+runs:
+  using: composite
+  steps:
+    - name: Cache UI artifacts
+      id: cache-ui
+      uses: actions/cache@v5
+      with:
+        path: |
+          pkg/github/ui_dist/get-me.html
+          pkg/github/ui_dist/issue-write.html
+          pkg/github/ui_dist/pr-write.html
+        key: ui-dist-v1-${{ hashFiles('ui/package-lock.json', 'ui/package.json', 'ui/index.html', 'ui/tsconfig*.json', 'ui/vite.config.ts', 'ui/src/**', 'ui/scripts/**') }}
+        enableCrossOsArchive: true
+
+    - name: Set up Node.js
+      if: steps.cache-ui.outputs.cache-hit != 'true'
+      uses: actions/setup-node@v6
+      with:
+        node-version: "20"
+        cache: npm
+        cache-dependency-path: ui/package-lock.json
+
+    - name: Build UI
+      if: steps.cache-ui.outputs.cache-hit != 'true'
+      shell: bash
+      run: script/build-ui
+
+    - name: Report UI cache status
+      shell: bash
+      run: |
+        if [ "${{ steps.cache-ui.outputs.cache-hit }}" = "true" ]; then
+          echo "UI artifacts restored from cache (skipped build)."
+        else
+          echo "UI artifacts rebuilt from source."
+        fi

.github/workflows/code-scanning.yml

@@ -78,8 +78,8 @@ jobs:
           go-version: ${{ fromJSON(steps.resolve-environment.outputs.environment).configuration.go.version }}
           cache: false
 
-      - name: Set up Node.js
-        if: matrix.language == 'go' || matrix.language == 'javascript'
+      - name: Set up Node.js (for JavaScript CodeQL)
+        if: matrix.language == 'javascript'
         uses: actions/setup-node@v6
         with:
           node-version: "20"
@@ -88,7 +88,7 @@ jobs:
 
       - name: Build UI
         if: matrix.language == 'go'
-        run: script/build-ui
+        uses: ./.github/actions/build-ui
 
       - name: Autobuild
         uses: github/codeql-action/autobuild@v4

.github/workflows/docs-check.yml

@@ -16,15 +16,8 @@ jobs:
     - name: Checkout code
       uses: actions/checkout@v6
 
-    - name: Set up Node.js
-      uses: actions/setup-node@v6
-      with:
-        node-version: "20"
-        cache: "npm"
-        cache-dependency-path: ui/package-lock.json
-
     - name: Build UI
-      run: script/build-ui
+      uses: ./.github/actions/build-ui
 
     - name: Set up Go
       uses: actions/setup-go@v6

.github/workflows/go.yml

@@ -25,16 +25,8 @@ jobs:
       - name: Check out code
         uses: actions/checkout@v6
 
-      - name: Set up Node.js
-        uses: actions/setup-node@v6
-        with:
-          node-version: "20"
-          cache: "npm"
-          cache-dependency-path: ui/package-lock.json
-
       - name: Build UI
-        shell: bash
-        run: script/build-ui
+        uses: ./.github/actions/build-ui
 
       - name: Set up Go
         uses: actions/setup-go@v6

.github/workflows/goreleaser.yml

@@ -16,15 +16,8 @@ jobs:
       - name: Check out code
         uses: actions/checkout@v6
 
-      - name: Set up Node.js
-        uses: actions/setup-node@v6
-        with:
-          node-version: "20"
-          cache: "npm"
-          cache-dependency-path: ui/package-lock.json
-
       - name: Build UI
-        run: script/build-ui
+        uses: ./.github/actions/build-ui
 
       - name: Set up Go
         uses: actions/setup-go@v6

.github/workflows/license-check.yml

@@ -32,15 +32,8 @@ jobs:
           GH_TOKEN: ${{ github.token }}
         run: gh pr checkout ${{ github.event.pull_request.number }}
 
-      - name: Set up Node.js
-        uses: actions/setup-node@v6
-        with:
-          node-version: "20"
-          cache: "npm"
-          cache-dependency-path: ui/package-lock.json
-
       - name: Build UI
-        run: script/build-ui
+        uses: ./.github/actions/build-ui
 
       - name: Set up Go
         uses: actions/setup-go@v6

.github/workflows/lint.yml

@@ -14,13 +14,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
-      - uses: actions/setup-node@v6
-        with:
-          node-version: "20"
-          cache: "npm"
-          cache-dependency-path: ui/package-lock.json
       - name: Build UI
-        run: script/build-ui
+        uses: ./.github/actions/build-ui
       - uses: actions/setup-go@v6
         with:
           go-version: '1.25'

.github/workflows/mcp-diff.yml

@@ -19,13 +19,8 @@ jobs:
         with:
           fetch-depth: 0
 
-      - name: Set up Node.js
-        uses: actions/setup-node@v6
-        with:
-          node-version: '20'
-
       - name: Build UI
-        run: script/build-ui
+        uses: ./.github/actions/build-ui
 
       - name: Run MCP Server Diff
         uses: SamMorrowDrums/mcp-server-diff@v2.3.5