refactor: improve GitHub Actions workflows structure and maintainability

- Add build-binaries workflow for multi-platform binary releases
- Rename workflows for conciseness:
  - demo-render-deploy.yml → demo-deploy.yml
  - build-and-push-canary-image.yml → build-canary-image.yml
  - build-and-push-stable-image.yml → build-stable-image.yml
- Centralize version config with env variables (GO_VERSION, NODE_VERSION, PNPM_VERSION)
- Standardize step names across all workflows
- Add concurrency controls to prevent redundant runs
- Update Node.js (20→22) and pnpm (9→10) versions to match build-binaries
- Improve job names with descriptive labels
- Add consistent comments and formatting
- Set artifact retention to 60 days for binary builds

.github/workflows/backend-tests.yml

@@ -4,8 +4,7 @@ on:
   push:
     branches: [main]
   pull_request:
-    branches:
-      - main
+    branches: [main]
     paths:
       - "go.mod"
       - "go.sum"
@@ -15,55 +14,58 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+env:
+  GO_VERSION: "1.25"
+
 jobs:
-  go-static-checks:
+  static-checks:
+    name: Static Checks
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - name: Checkout code
+        uses: actions/checkout@v6
       
-      - uses: actions/setup-go@v6
+      - name: Setup Go
+        uses: actions/setup-go@v6
         with:
-          go-version: 1.25
+          go-version: ${{ env.GO_VERSION }}
           cache: true
           cache-dependency-path: go.sum
 
       - name: Verify go.mod is tidy
         run: |
-          go mod tidy -go=1.25
+          go mod tidy -go=${{ env.GO_VERSION }}
           git diff --exit-code
 
-      - name: golangci-lint
+      - name: Run golangci-lint
         uses: golangci/golangci-lint-action@v9
         with:
           version: v2.4.0
           args: --timeout=3m
 
-  go-tests:
+  tests:
+    name: Tests (${{ matrix.test-group }})
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
       matrix:
-        test-group:
-          - store
-          - server
-          - plugin
-          - other
+        test-group: [store, server, plugin, other]
     steps:
-      - uses: actions/checkout@v6
+      - name: Checkout code
+        uses: actions/checkout@v6
       
-      - uses: actions/setup-go@v6
+      - name: Setup Go
+        uses: actions/setup-go@v6
         with:
-          go-version: 1.25
+          go-version: ${{ env.GO_VERSION }}
           cache: true
           cache-dependency-path: go.sum
 
-      - name: Run tests - ${{ matrix.test-group }}
+      - name: Run tests
         run: |
           case "${{ matrix.test-group }}" in
             store)
               # Run store tests for all drivers (sqlite, mysql, postgres)
-              # The TestMain in store/test runs all drivers when DRIVER is not set
-              # Note: We run without -race for container tests due to testcontainers race issues
               go test -v -coverprofile=coverage.out -covermode=atomic ./store/...
               ;;
             server)

.github/workflows/build-and-push-canary-image.yml → .github/workflows/build-canary-image.yml

-name: Build and Push Canary Image
+name: Build Canary Image
 
 on:
   push:

.github/workflows/build-and-push-stable-image.yml → .github/workflows/build-stable-image.yml

-name: Build and Push Stable Image
+name: Build Stable Image
 
 on:
   push:

.github/workflows/demo-render-deploy.yml → .github/workflows/demo-deploy.yml

-name: Demo Render Deploy
+name: Demo Deploy
 
 on:
   workflow_dispatch:

.github/workflows/frontend-tests.yml

@@ -4,44 +4,69 @@ on:
   push:
     branches: [main]
   pull_request:
-    branches:
-      - main
+    branches: [main]
     paths:
       - "web/**"
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  NODE_VERSION: "22"
+  PNPM_VERSION: "10"
+
 jobs:
-  static-checks:
+  lint:
+    name: Lint
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
-      - uses: pnpm/action-setup@v4.2.0
+      - name: Checkout code
+        uses: actions/checkout@v6
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4.2.0
         with:
-          version: 9
-      - uses: actions/setup-node@v6
+          version: ${{ env.PNPM_VERSION }}
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v6
         with:
-          node-version: "20"
+          node-version: ${{ env.NODE_VERSION }}
           cache: pnpm
-          cache-dependency-path: "web/pnpm-lock.yaml"
-      - run: pnpm install
+          cache-dependency-path: web/pnpm-lock.yaml
+
+      - name: Install dependencies
         working-directory: web
-      - name: Run check
-        run: pnpm lint
+        run: pnpm install --frozen-lockfile
+
+      - name: Run lint
         working-directory: web
+        run: pnpm lint
 
-  frontend-build:
+  build:
+    name: Build
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
-      - uses: pnpm/action-setup@v4.2.0
+      - name: Checkout code
+        uses: actions/checkout@v6
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4.2.0
         with:
-          version: 9
-      - uses: actions/setup-node@v6
+          version: ${{ env.PNPM_VERSION }}
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v6
         with:
-          node-version: "20"
+          node-version: ${{ env.NODE_VERSION }}
           cache: pnpm
-          cache-dependency-path: "web/pnpm-lock.yaml"
-      - run: pnpm install
+          cache-dependency-path: web/pnpm-lock.yaml
+
+      - name: Install dependencies
         working-directory: web
-      - name: Run frontend build
-        run: pnpm build
+        run: pnpm install --frozen-lockfile
+
+      - name: Build frontend
         working-directory: web
+        run: pnpm build

.github/workflows/proto-linter.yml

@@ -4,30 +4,37 @@ on:
   push:
     branches: [main]
   pull_request:
-    branches:
-      - main
+    branches: [main]
     paths:
       - "proto/**"
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
-  lint-protos:
+  lint:
+    name: Lint Protos
     runs-on: ubuntu-latest
     steps:
-      - name: Checkout
+      - name: Checkout code
         uses: actions/checkout@v6
         with:
           fetch-depth: 0
+
       - name: Setup buf
         uses: bufbuild/buf-setup-action@v1
         with:
           github_token: ${{ github.token }}
-      - name: buf lint
+
+      - name: Run buf lint
         uses: bufbuild/buf-lint-action@v1
         with:
-          input: "proto"
-      - name: buf format
+          input: proto
+
+      - name: Check buf format
         run: |
           if [[ $(buf format -d) ]]; then
-            echo "Run 'buf format -d'"
+            echo "❌ Proto files are not formatted. Run 'buf format -w' to fix."
             exit 1
           fi

.github/workflows/stale.yml

-name: Stale
+name: Stale Issues
 
 on:
   schedule:
-    - cron: "0 */8 * * *"
+    - cron: "0 */8 * * *"  # Every 8 hours
 
 jobs:
-  stale:
+  close-stale:
+    name: Close Stale Issues
     runs-on: ubuntu-latest
     permissions:
       issues: write
-
     steps:
-      - uses: actions/stale@v10.1.1
+      - name: Close stale issues
+        uses: actions/stale@v10.1.1
         with:
           days-before-issue-stale: 14
           days-before-issue-close: 7