chore: import upstream snapshot with attribution

.github/actions/check-remote-tests/action.yml

@@ -0,0 +1,33 @@
+name: "Check Remote Tests"
+description: >
+  Determines whether E2E tests should be given Cloudflare API credentials.
+  Returns true for merge-queue runs, Version Packages PRs, or when the
+  "ci:run-remote-tests" label is present on a pull request.
+outputs:
+  run-remote:
+    description: "'true' when remote tests should run, 'false' otherwise"
+    value: ${{ steps.decide.outputs.run_remote }}
+runs:
+  using: "composite"
+  steps:
+    - name: Decide whether to run remote tests
+      id: decide
+      shell: bash
+      env:
+        GH_TOKEN: ${{ github.token }}
+        EVENT_NAME: ${{ github.event_name }}
+        HEAD_REF: ${{ github.head_ref }}
+        PR_NUMBER: ${{ github.event.pull_request.number }}
+        REPO: ${{ github.repository }}
+      run: |
+        if [ "$EVENT_NAME" = "merge_group" ] || \
+           [ "$HEAD_REF" = "changeset-release/main" ]; then
+          echo "run_remote=true" >> "$GITHUB_OUTPUT"
+        elif [ "$EVENT_NAME" = "pull_request" ]; then
+          HAS_LABEL=$(gh pr view "$PR_NUMBER" \
+            --repo "$REPO" --json labels \
+            --jq '[.labels[].name] | any(. == "ci:run-remote-tests")')
+          echo "run_remote=${HAS_LABEL}" >> "$GITHUB_OUTPUT"
+        else
+          echo "run_remote=false" >> "$GITHUB_OUTPUT"
+        fi

.github/actions/expose-actions-variables/action.yml

@@ -0,0 +1,5 @@
+name: "Expose Actions Variables"
+description: "Expose ACTIONS_RUNTIME_TOKEN and ACTIONS_RESULTS_URL on GITHUB_ENV"
+runs:
+  using: "node20"
+  main: "index.mjs"

.github/actions/expose-actions-variables/index.mjs

@@ -0,0 +1,7 @@
+import fs from "node:fs";
+
+fs.appendFileSync(
+	process.env.GITHUB_ENV,
+	`GITHUB_ACTIONS_RUNTIME_TOKEN=${process.env.ACTIONS_RUNTIME_TOKEN}\n` +
+		`GITHUB_ACTIONS_RESULTS_URL=${process.env.ACTIONS_RESULTS_URL}\n`
+);

.github/actions/install-dependencies/action.yml

@@ -0,0 +1,62 @@
+name: "Install Dependencies"
+description: "Install dependencies, fetching from cache when possible"
+inputs:
+  # We run all jobs on Node.js 22 by default, as this is the most stable and supported version right now.
+  #
+  # Pinned to 22.23.1 (rather than floating `22`) until it's safe to float back:
+  # Node 22.23.0 regressed node-fetch@2 keep-alive responses with
+  # ERR_STREAM_PREMATURE_CLOSE (nodejs/node#63989, fixed in 22.23.1).
+  node-version:
+    description: the version of Node.js to install
+    default: 22.23.1
+  turbo-api:
+    description: the api URL for connecting to the turbo remote cache
+  turbo-team:
+    description: the team identifier for connecting to the turbo remote cache
+  turbo-token:
+    description: the api token for connecting to the turbo remote cache
+  turbo-signature:
+    description: the cache signature key for connecting to the turbo remote cache
+  disable-cache:
+    description: when "true", skip the pnpm store cache on setup-node (defense in depth for release builds)
+    default: "false"
+runs:
+  using: "composite"
+  steps:
+    - name: Install pnpm
+      uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+
+    - name: Install Node.js ${{ inputs.node-version }} (with pnpm cache)
+      if: inputs.disable-cache != 'true'
+      uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+      with:
+        node-version: ${{ inputs.node-version }}
+        cache: "pnpm"
+        registry-url: "https://registry.npmjs.org"
+
+    - name: Install Node.js ${{ inputs.node-version }} (without pnpm cache)
+      if: inputs.disable-cache == 'true'
+      uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+      with:
+        node-version: ${{ inputs.node-version }}
+        registry-url: "https://registry.npmjs.org"
+
+    # Enable node compile cache (effective for Node 22+)
+    # See https://nodejs.org/docs/v24.11.1/api/module.html#module-compile-cache
+    - name: Enable Node Compile Cache
+      shell: bash
+      run: echo "NODE_COMPILE_CACHE=$HOME/.node_compile_cache" >> $GITHUB_ENV
+
+    - name: "Configure turbo repo cache environment variables"
+      if: inputs.turbo-api
+      shell: bash
+      run: |
+        echo "TURBO_API=${{ inputs.turbo-api }}" >> $GITHUB_ENV
+        echo "TURBO_TEAM=${{ inputs.turbo-team }}" >> $GITHUB_ENV
+        echo "TURBO_TOKEN=${{ inputs.turbo-token }}" >> $GITHUB_ENV
+        echo "TURBO_REMOTE_CACHE_SIGNATURE_KEY=${{ inputs.turbo-signature }}" >> $GITHUB_ENV
+        echo "TURBO_ENV_MODE=loose" >> $GITHUB_ENV
+
+    - name: Install NPM Dependencies
+      shell: bash
+      run: pnpm install --frozen-lockfile

.github/actions/install-python-uv/action.yml

@@ -0,0 +1,9 @@
+name: "Install Python uv"
+runs:
+  using: "composite"
+  steps:
+    - name: Install uv for Python
+      uses: astral-sh/setup-uv@d0cc045d04ccac9d8b7881df0226f9e82c39688e # v6
+      with:
+        version: "0.9.3"
+        enable-cache: false