Repository: denoland/deno
Pull request: ci: move away from a matrix

This moves the CI away from a matrix, which explodes the size of ci.yml, but the generate file is still pretty small.

This is a step towards creating build only and many test jobs because now we'll be able to create dependencies on one job to another.

Changed files:
filename: .github/workflows/ci.generate.ts
patch: @@ -5,11 +5,12 @@ import {
   Condition,
   conditions,
   createWorkflow,
+  defineExprObj,
   defineMatrix,
   type ExpressionValue,
   job,
   step,
-} from "jsr:@david/gagen@0.2.7";
+} from "jsr:@david/gagen@0.2.10";
 
 // Bump this number when you want to purge the cache.
 // Note: the tools/release/01_bump_crate_versions.ts script will update this version
@@ -35,9 +36,6 @@ const isMainOrTag = isMainBranch.or(isTag);
 const isPr = conditions.isPr();
 const hasCiFullLabel = conditions.hasPrLabel("ci-full");
 const hasCiBenchLabel = conditions.hasPrLabel("ci-bench");
-const isLinux = conditions.isRunnerOs("Linux");
-const isMacos = conditions.isRunnerOs("macOS");
-const isWindows = conditions.isRunnerOs("Windows");
 
 const Runners = {
   linuxX86: {
@@ -91,12 +89,8 @@ const Runners = {
 
 // discover all non-binary, non-test workspace members for the libs test job
 const libCrates = resolveLibCrates();
-const libTestCrateArgs = libCrates.map((p) => `-p ${p}`).join(" ");
 const libExcludeArgs = libCrates.map((p) => `--exclude ${p}`).join(" ");
 
-const prCacheKeyPrefix =
-  `${cacheVersion}-cargo-target-\${{ matrix.os }}-\${{ matrix.arch }}-\${{ matrix.profile }}-\${{ matrix.job }}-`;
-const prCacheKey = `${prCacheKeyPrefix}\${{ github.sha }}`;
 const prCachePath = [
   // this must match for save and restore (https://github.com/actions/cache/issues/1444)
   "./target",
@@ -193,27 +187,34 @@ CFLAGS=$CFLAGS
 " > $GITHUB_ENV`,
 };
 
-function handleMatrixItems(items: {
+function handleBuildItems(items: {
   skip_pr?: Condition | true;
   skip?: Condition | boolean;
   os: "linux" | "macos" | "windows";
   arch: "x86_64" | "aarch64";
   runner: string | ExpressionValue;
-  profile?: string;
-  job?: string;
+  profile: string;
+  job: string;
   use_sysroot?: boolean;
   wpt?: Condition | boolean;
 }[]) {
   return items.map(({ skip_pr, ...rest }) => {
+    const defaultValues = {
+      skip: false,
+      "use_sysroot": false,
+      wpt: false,
+    };
     if (skip_pr == null) {
       return {
+        ...defaultValues,
         ...rest,
         save_cache: true,
       };
     } else {
       // on PRs without the ci-full label, use a free runner and skip the job
       const shouldSkip = hasCiFullLabel.not().and(isPr).and(skip_pr);
       return {
+        ...defaultValues,
         ...rest,
         runner: shouldSkip.then(ubuntuX86Runner).else(rest.runner),
         skip: shouldSkip,
@@ -260,89 +261,143 @@ const installNodeStep = step({
     "node-version": 22,
   },
 });
-const installPythonStep = step({
-  name: "Install Python",
-  uses: "actions/setup-python@v6",
-  with: {
-    "python-version": 3.11,
-  },
-}, {
-  name: "Remove unused versions of Python",
-  if: isWindows,
-  shell: "pwsh",
-  run: [
-    '$env:PATH -split ";" |',
-    '  Where-Object { Test-Path "$_\\python.exe" } |',
-    "  Select-Object -Skip 1 |",
-    '  ForEach-Object { Move-Item "$_" "$_.disabled" }',
-  ],
-});
-const setupPrebuiltMacStep = step({
-  if: isMacos,
-  env: {
-    GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}",
-  },
-  run: "echo $GITHUB_WORKSPACE/third_party/prebuilt/mac >> $GITHUB_PATH",
-});
-const installLldStep = step
-  .dependsOn(
-    cloneStdSubmodule,
-    installDenoStep,
-    setupPrebuiltMacStep,
-  )({
-    name: "Install macOS aarch64 lld",
-    if: isMacos.and(conditions.isRunnerArch("ARM64")),
-    env: {
-      GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}",
+// factory for cache steps parameterized by os/arch/profile/job
+// works with both defineExprObj (inline values) and defineMatrix (matrix expressions)
+function createCacheSteps(m: {
+  os: ExpressionValue;
+  arch: ExpressionValue;
+  profile: ExpressionValue;
+  job: ExpressionValue;
+}) {
+  const cacheCargoHomeStep = step({
+    name: "Cache Cargo home",
+    uses: "cirruslabs/cache@v4",
+    with: {
+      path: [
+        "~/.cargo/.crates.toml",
+        "~/.cargo/.crates2.json",
+        "~/.cargo/bin",
+        "~/.cargo/registry/index",
+        "~/.cargo/registry/cache",
+        "~/.cargo/git/db",
+      ].join("\n"),
+      key:
+        `${cacheVersion}-cargo-home-${m.os}-${m.arch}-\${{ hashFiles('Cargo.lock') }}`,
+      "restore-keys": `${cacheVersion}-cargo-home-${m.os}-${m.arch}-`,
     },
-    run: "./tools/install_prebuilt.js ld64.lld",
   });
-const cacheCargoHomeStep = step({
-  name: "Cache Cargo home",
-  uses: "cirruslabs/cache@v4",
-  with: {
-    path: [
-      "~/.cargo/.crates.toml",
-      "~/.cargo/.crates2.json",
-      "~/.cargo/bin",
-      "~/.cargo/registry/index",
-      "~/.cargo/registry/cache",
-      "~/.cargo/git/db",
-    ].join("\n"),
-    key:
-      `${cacheVersion}-cargo-home-\${{ matrix.os }}-\${{ matrix.arch }}-\${{ hashFiles('Cargo.lock') }}`,
-    "restore-keys":
-      `${cacheVersion}-cargo-home-\${{ matrix.os }}-\${{ matrix.arch }}-`,
-  },
-});
+  const cacheKeyPrefix =
+    `${cacheVersion}-cargo-target-${m.os}-${m.arch}-${m.profile}-${m.job}-`;
+  const restoreCacheBuildOutputStep = step({
+    name: "Restore cache build output (PR)",
+    uses: "actions/cache/restore@v4",
+    if: isMainBranch.not().and(isNotTag),
+    with: {
+      path: prCachePath,
+      key: "never_saved",
+      "restore-keys": cacheKeyPrefix,
+    },
+  });
+  const saveCacheBuildOutputStep = step({
+    // in main branch, always create a fresh cache
+    name: "Save cache build output (main)",
+    uses: "actions/cache/save@v4",
+    if: isMainBranch,
+    with: {
+      path: prCachePath,
+      key: `${cacheKeyPrefix}\${{ github.sha }}`,
+    },
+  });
+  return {
+    cacheCargoHomeStep,
+    restoreCacheBuildOutputStep,
+    saveCacheBuildOutputStep,
+  };
+}
 const installRustStep = step({
   uses: "dsherret/rust-toolchain-file@v1",
 });
 const installWasmStep = step({
   name: "Install wasm target",
   run: "rustup target add wasm32-unknown-unknown",
 });
-const setupGcloud = step.dependsOn(installPythonStep)({
-  name: "Authenticate with Google Cloud",
-  uses: "google-github-actions/auth@v3",
-  with: {
-    "project_id": "denoland",
-    "credentials_json": "${{ secrets.GCP_SA_KEY }}",
-    "export_environment_variables": true,
-    "create_credentials_file": true,
-  },
-}, {
-  name: "Setup gcloud (unix)",
-  if: isWindows.not(),
-  uses: "google-github-actions/setup-gcloud@v3",
-  with: { project_id: "denoland" },
-}, {
-  name: "Setup gcloud (windows)",
-  if: isWindows,
-  uses: "google-github-actions/setup-gcloud@v2",
-  env: { CLOUDSDK_PYTHON: "${{env.pythonLocation}}\\python.exe" },
-  with: { project_id: "denoland" },
-});
+
+function getOsSpecificSteps({
+  isWindows,
+  isMacos,
+}: {
+  isWindows: Condition;
+  isMacos: Condition;
+}) {
+  const installPythonStep = step({
+    name: "Install Python",
+    uses: "actions/setup-python@v6",
+    with: {
+      "python-version": 3.11,
+    },
+  }, {
+    name: "Remove unused versions of Python",
+    if: isWindows,
+    shell: "pwsh",
+    run: [
+      '$env:PATH -split ";" |',
+      '  Where-Object { Test-Path "$_\\python.exe" } |',
+      "  Select-Object -Skip 1 |",
+      '  ForEach-Object { Move-Item "$_" "$_.disabled" }',
+    ],
+  });
+  const setupPrebuiltMacStep = step({
+    if: isMacos,
+    env: {
+      GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}",
+    },
+    run: "echo $GITHUB_WORKSPACE/third_party/prebuilt/mac >> $GITHUB_PATH",
+  });
+  const installLldStep = step
+    .dependsOn(
+      cloneStdSubmodule,
+      installDenoStep,
+      setupPrebuiltMacStep,
+    )({
+      name: "Install macOS aarch64 lld",
+      if: isMacos.and(conditions.isRunnerArch("ARM64")),
+      env: {
+        GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}",
+      },
+      run: "./tools/install_prebuilt.js ld64.lld",
+    });
+  const setupGcloudStep = step(
+    {
+      name: "Authenticate with Google Cloud",
+      uses: "google-github-actions/auth@v3",
+      with: {
+        "project_id": "denoland",
+        "credentials_json": "${{ secrets.GCP_SA_KEY }}",
+        "export_environment_variables": true,
+        "create_credentials_file": true,
+      },
+    },
+    {
+      name: "Setup gcloud (unix)",
+      if: isWindows.not(),
+      uses: "google-github-actions/setup-gcloud@v3",
+      with: { project_id: "denoland" },
+    },
+    step({
+      name: "Setup gcloud (windows)",
+      if: isWindows,
+      uses: "google-github-actions/setup-gcloud@v2",
+      env: { CLOUDSDK_PYTHON: "${{env.pythonLocation}}\\python.exe" },
+      with: { project_id: "denoland" },
+    }).dependsOn(installPythonStep),
+  );
+  return {
+    installPythonStep,
+    setupPrebuiltMacStep,
+    installLldStep,
+    setupGcloudStep,
+  };
+}
 
 // === pre_build job ===
 // The pre_build step is used to skip running the CI on draft PRs and to not even
@@ -373,667 +428,665 @@ const preBuildJob = job("pre_build", {
 
 // === build job ===
 
-const buildMatrix = defineMatrix({
-  include: handleMatrixItems([{
-    ...Runners.macosX86,
-    job: "test",
-    profile: "debug",
-  }, {
-    ...Runners.macosX86,
-    job: "test",
-    profile: "release",
-    skip_pr: true,
-  }, {
-    ...Runners.macosArm,
-    job: "test",
-    profile: "debug",
-  }, {
-    ...Runners.macosArmSelfHosted,
-    job: "test",
-    profile: "release",
-    skip_pr: true,
-  }, {
-    ...Runners.windowsX86,
-    job: "test",
-    profile: "debug",
-  }, {
-    ...Runners.windowsX86Xl,
-    job: "test",
-    profile: "release",
-    skip_pr: true,
-  }, {
-    ...Runners.windowsArm,
-    job: "test",
-    profile: "debug",
-  }, {
-    ...Runners.windowsArm,
-    job: "test",
-    profile: "release",
-    skip_pr: true,
-  }, {
-    ...Runners.linuxX86Xl,
-    job: "test",
-    profile: "release",
-    use_sysroot: true,
-    // Because CI is so slow on for OSX and Windows, we
-    // currently run the Web Platform tests only on Linux.
-    wpt: isNotTag,
-  }, {
-    ...Runners.linuxX86Xl,
-    job: "bench",
-    profile: "release",
-    use_sysroot: true,
-    skip_pr: hasCiBenchLabel.not(),
-  }, {
-    ...Runners.linuxX86,
-    job: "test",
-    profile: "debug",
-    use_sysroot: true,
-  }, {
-    ...Runners.linuxArm,
-    job: "test",
-    profile: "debug",
-  }, {
-    ...Runners.linuxArm,
-    job: "test",
-    profile: "release",
-    use_sysroot: true,
-    skip_pr: true,
-  }]),
-});
-
-// common build matrix conditions
-const restoreCacheBuildOutputStep = step({
-  name: "Restore cache build output (PR)",
-  uses: "actions/cache/restore@v4",
-  if: isMainBranch.not().and(isNotTag),
-  with: {
-    path: prCachePath,
-    key: "never_saved",
-    "restore-keys": prCacheKeyPrefix,
-  },
-});
-const saveCacheBuildOutputStep = step({
-  // In main branch, always create a fresh cache
-  name: "Save cache build output (main)",
-  uses: "actions/cache/save@v4",
-  if: isMainBranch,
-  with: {
-    path: prCachePath,
-    key: prCacheKey,
-  },
-});
-const isTest = buildMatrix.job.equals("test");
-const isRelease = buildMatrix.profile.equals("release");
-const isDebug = buildMatrix.profile.equals("debug");
-
-const buildJob = job("build", {
-  name:
-    `${buildMatrix.job} ${buildMatrix.profile} ${buildMatrix.os}-${buildMatrix.arch}`,
-  needs: [preBuildJob],
-  if: preBuildJob.outputs.skip_build.notEquals("true"),
-  runsOn: buildMatrix.runner,
-  // This is required to successfully authenticate with Azure using OIDC for
-  // code signing.
-  environment: {
-    name: isMainOrTag.then("build").else(""),
-  },
-  timeoutMinutes: 240,
-  defaults: {
-    run: {
-      // GH actions does not fail fast by default on
-      // Windows, so we set bash as the default shell
-      shell: "bash",
-    },
-  },
-  strategy: {
-    matrix: buildMatrix,
-    // Always run main branch builds to completion. This allows the cache to
-    // stay mostly up-to-date in situations where a single job fails due to
-    // e.g. a flaky test.
-    // Don't fast-fail on tag build because publishing binaries shouldn't be
-    // prevented if any of the stages fail (which can be a false negative).
-    failFast: isPr.or(isMainBranch.not().and(isTag.not())),
-  },
-  env: {
-    CARGO_TERM_COLOR: "always",
-    RUST_BACKTRACE: "full",
-    // disable anyhow's library backtrace
-    RUST_LIB_BACKTRACE: 0,
-  },
-  steps: (() => {
-    const cloneWptSubmodule = cloneSubmodule("./tests/wpt/suite");
-    const cargoBuildCacheStep = step
-      .dependsOn(cacheCargoHomeStep, installRustStep)(
-        restoreCacheBuildOutputStep,
-        {
-          name: "Apply and update mtime cache",
-          if: isNotTag,
-          uses: "./.github/mtime_cache",
-          with: {
-            "cache-path": "./target",
-          },
-        },
-      );
-    const sysRootStep = step({
-      if: buildMatrix.use_sysroot,
-      ...sysRootConfig,
-    });
-    const tarSourcePublishStep = step({
-      name: "Create source tarballs (release, linux)",
-      if: buildMatrix.os.equals("linux")
-        .and(buildMatrix.arch.equals("x86_64")),
-      run: [
-        "mkdir -p target/release",
-        'tar --exclude=".git*" --exclude=target --exclude=third_party/prebuilt \\',
-        "    -czvf target/release/deno_src.tar.gz -C .. deno",
-      ],
-    });
+const buildItems = handleBuildItems([{
+  ...Runners.macosX86,
+  job: "test",
+  profile: "debug",
+}, {
+  ...Runners.macosX86,
+  job: "test",
+  profile: "release",
+  skip_pr: true,
+}, {
+  ...Runners.macosArm,
+  job: "test",
+  profile: "debug",
+}, {
+  ...Runners.macosArmSelfHosted,
+  job: "test",
+  profile: "release",
+  skip_pr: true,
+}, {
+  ...Runners.windowsX86,
+  job: "test",
+  profile: "debug",
+}, {
+  ...Runners.windowsX86Xl,
+  job: "test",
+  profile: "release",
+  skip_pr: true,
+}, {
+  ...Runners.windowsArm,
+  job: "test",
+  profile: "debug",
+}, {
+  ...Runners.windowsArm,
+  job: "test",
+  profile: "release",
+  skip_pr: true,
+}, {
+  ...Runners.linuxX86Xl,
+  job: "test",
+  profile: "release",
+  use_sysroot: true,
+  // Because CI is so slow on for OSX and Windows, we
+  // currently run the Web Platform tests only on Linux.
+  wpt: isNotTag,
+}, {
+  ...Runners.linuxX86Xl,
+  job: "bench",
+  profile: "release",
+  use_sysroot: true,
+  skip_pr: hasCiBenchLabel.not(),
+}, {
+  ...Runners.linuxX86,
+  job: "test",
+  profile: "debug",
+  use_sysroot: true,
+}, {
+  ...Runners.linuxArm,
+  job: "test",
+  profile: "debug",
+}, {
+  ...Runners.linuxArm,
+  job: "test",
+  profile: "release",
+  use_sysroot: true,
+  skip_pr: true,
+}]);
 
-    const preRelease = step.if(isTest)(
-      {
-        name: "Upload PR artifact (linux)",
-        if: isTest.and(
-          buildMatrix.use_sysroot.equals(true).or(isDenoland.and(isMainOrTag)),
-        ),
-        uses: "actions/upload-artifact@v6",
-        with: {
-          name:
-            "deno-${{ matrix.os }}-${{ matrix.arch }}-${{ github.event.number }}",
-          path: "target/release/deno",
-        },
-      },
-      {
-        name: "Pre-release (linux)",
-        if: isLinux.and(isDenoland),
-        run: [
-          "cd target/release",
-          "./deno -A ../../tools/release/create_symcache.ts deno-${{ matrix.arch }}-unknown-linux-gnu.symcache",
-          "strip ./deno",
-          "zip -r deno-${{ matrix.arch }}-unknown-linux-gnu.zip deno",
-          "shasum -a 256 deno-${{ matrix.arch }}-unknown-linux-gnu.zip > deno-${{ matrix.arch }}-unknown-linux-gnu.zip.sha256sum",
-          "strip ./denort",
-          "zip -r denort-${{ matrix.arch }}-unknown-linux-gnu.zip denort",
-          "shasum -a 256 denort-${{ matrix.arch }}-unknown-linux-gnu.zip > denort-${{ matrix.arch }}-unknown-linux-gnu.zip.sha256sum",
-          "./deno types > lib.deno.d.ts",
-        ],
-      },
-      step.dependsOn(setupPrebuiltMacStep)({
-        name: "Install rust-codesign",
-        if: buildMatrix.os.equals("macos").and(isDenoland),
-        env: {
-          GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}",
-        },
-        run: "./tools/install_prebuilt.js rcodesign",
-      }),
-      {
-        name: "Pre-release (mac)",
-        if: isMacos.and(isDenoland),
-        env: {
-          "APPLE_CODESIGN_KEY": "${{ secrets.APPLE_CODESIGN_KEY }}",
-          "APPLE_CODESIGN_PASSWORD": "${{ secrets.APPLE_CODESIGN_PASSWORD }}",
-        },
-        run: [
-          "target/release/deno -A tools/release/create_symcache.ts target/release/deno-${{ matrix.arch }}-apple-darwin.symcache",
-          "strip -x -S target/release/deno",
-          'echo "Key is $(echo $APPLE_CODESIGN_KEY | base64 -d | wc -c) bytes"',
-          "rcodesign sign target/release/deno " +
-          "--code-signature-flags=runtime " +
-          '--p12-password="$APPLE_CODESIGN_PASSWORD" ' +
-          "--p12-file=<(echo $APPLE_CODESIGN_KEY | base64 -d) " +
-          "--entitlements-xml-file=cli/entitlements.plist",
-          "cd target/release",
-          "zip -r deno-${{ matrix.arch }}-apple-darwin.zip deno",
-          "shasum -a 256 deno-${{ matrix.arch }}-apple-darwin.zip > deno-${{ matrix.arch }}-apple-darwin.zip.sha256sum",
-          "strip -x -S ./denort",
-          "zip -r denort-${{ matrix.arch }}-apple-darwin.zip denort",
-          "shasum -a 256 denort-${{ matrix.arch }}-apple-darwin.zip > denort-${{ matrix.arch }}-apple-darwin.zip.sha256sum",
-        ],
-      },
-      {
-        // Note: Azure OIDC credentials are only valid for 5 minutes, so
-        // authentication must be done right before signing.
-        name: "Authenticate with Azure (windows)",
-        if: isWindows.and(isDenoland).and(isMainOrTag),
-        uses: "azure/login@v2",
-        with: {
-          "client-id": "${{ secrets.AZURE_CLIENT_ID }}",
-          "tenant-id": "${{ secrets.AZURE_TENANT_ID }}",
-          "subscription-id": "${{ secrets.AZURE_SUBSCRIPTION_ID }}",
-          "enable-AzPSSession": true,
-        },
+const buildJobs = buildItems.map((rawBuildItem) => {
+  const buildItem = defineExprObj(rawBuildItem);
+  return job(
+    `${buildItem.job}-${buildItem.profile}-${buildItem.os}-${buildItem.arch}`,
+    {
+      name:
+        `${buildItem.job} ${buildItem.profile} ${buildItem.os}-${buildItem.arch}`,
+      needs: [preBuildJob],
+      if: preBuildJob.outputs.skip_build.notEquals("true"),
+      runsOn: buildItem.runner,
+      // This is required to successfully authenticate with Azure using OIDC for
+      // code signing.
+      environment: {
+        name: isMainOrTag.then("build").else(""),
       },
-      {
-        name: "Code sign deno.exe (windows)",
-        if: isWindows.and(isDenoland).and(isMainOrTag),
-        uses: "Azure/artifact-signing-action@v0",
-        with: {
-          "endpoint": "https://eus.codesigning.azure.net/",
-          "trusted-signing-account-name": "deno-cli-code-signing",
-          "certificate-profile-name": "deno-cli-code-signing-cert",
-          "files-folder": "target/release",
-          "files-folder-filter": "deno.exe",
-          "file-digest": "SHA256",
-          "timestamp-rfc3161": "http://timestamp.acs.microsoft.com",
-          "timestamp-digest": "SHA256",
-          "exclude-environment-credential": true,
-          "exclude-workload-identity-credential": true,
-          "exclude-managed-identity-credential": true,
-          "exclude-shared-token-cache-credential": true,
-          "exclude-visual-studio-credential": true,
-          "exclude-visual-studio-code-credential": true,
-          "exclude-azure-cli-credential": false,
+      timeoutMinutes: 240,
+      defaults: {
+        run: {
+          // GH actions does not fail fast by default on
+          // Windows, so we set bash as the default shell
+          shell: "bash",
         },
       },
-      {
-        name: "Verify signature (windows)",
-        if: isWindows.and(isDenoland).and(isMainOrTag),
-        shell: "pwsh",
-        run: [
-          '$SignTool = Get-ChildItem -Path "C:\\Program Files*\\Windows Kits\\*\\bin\\*\\x64\\signtool.exe" -Recurse -ErrorAction SilentlyContinue | Select-Object -First 1',
-          "$SignToolPath = $SignTool.FullName",
-          "& $SignToolPath verify /pa /v target\\release\\deno.exe",
-        ],
-      },
-      {
-        name: "Pre-release (windows)",
-        if: isWindows.and(isDenoland),
-        shell: "pwsh",
-        run: [
-          "Compress-Archive -CompressionLevel Optimal -Force -Path target/release/deno.exe -DestinationPath target/release/deno-${{ matrix.arch }}-pc-windows-msvc.zip",
-          "Get-FileHash target/release/deno-${{ matrix.arch }}-pc-windows-msvc.zip -Algorithm SHA256 | Format-List > target/release/deno-${{ matrix.arch }}-pc-windows-msvc.zip.sha256sum",
-          "Compress-Archive -CompressionLevel Optimal -Force -Path target/release/denort.exe -DestinationPath target/release/denort-${{ matrix.arch }}-pc-windows-msvc.zip",
-          "Get-FileHash target/release/denort-${{ matrix.arch }}-pc-windows-msvc.zip -Algorithm SHA256 | Format-List > target/release/denort-${{ matrix.arch }}-pc-windows-msvc.zip.sha256sum",
-          "target/release/deno.exe -A tools/release/create_symcache.ts target/release/deno-${{ matrix.arch }}-pc-windows-msvc.symcache",
-        ],
+      env: {
+        CARGO_TERM_COLOR: "always",
+        RUST_BACKTRACE: "full",
+        // disable anyhow's library backtrace
+        RUST_LIB_BACKTRACE: 0,
       },
-      step.dependsOn(setupGcloud)({
-        name: "Upload canary to dl.deno.land",
-        if: isDenoland.and(isMainBranch),
-        run: [
-          'gsutil -h "Cache-Control: public, max-age=3600" cp ./target/release/*.zip gs://dl.deno.land/canary/$(git rev-parse HEAD)/',
-          'gsutil -h "Cache-Control: public, max-age=3600" cp ./target/release/*.sha256sum gs://dl.deno.land/canary/$(git rev-parse HEAD)/',
-          'gsutil -h "Cache-Control: public, max-age=3600" cp ./target/release/*.symcache gs://dl.deno.land/canary/$(git rev-parse HEAD)/',
-          "echo ${{ github.sha }} > canary-latest.txt",
-          'gsutil -h "Cache-Control: no-cache" cp canary-latest.txt gs://dl.deno.land/canary-$(rustc -vV | sed -n "s|host: ||p")-latest.txt',
-          "rm canary-latest.txt gha-creds-*.json",
-        ],
-      }),
-    );
-    const cargoBuildReleaseStep = step
-      .if(isRelease.and(isDenoland.or(buildMatrix.use_sysroot.equals(true))))
-      .dependsOn(
-        installLldStep,
-        installRustStep,
-        cacheCargoHomeStep,
-        cargoBuildCacheStep,
-        sysRootStep,
-      )(
-        {
-          name: "Configure canary build",
-          if: isTest.and(isMainBranch),
-          run: 'echo "DENO_CANARY=true" >> $GITHUB_ENV',
-        },
-        {
-          name: "Build release",
-          run: [
-            // output fs space before and after building
-            "df -h",
-            "cargo build --release --locked --all-targets --features=panic-trace",
-            "df -h",
-          ],
-        },
-        {
-          name: "Generate symcache",
-          run: [
-            "target/release/deno -A tools/release/create_symcache.ts ./deno.symcache",
-            "du -h deno.symcache",
-            "du -h target/release/deno",
-          ],
-          env: { NO_COLOR: 1 },
-        },
-        preRelease,
-        {
-          name: "Build product size info",
-          if: isMainOrTag,
-          run: [
-            'du -hd1 "./target/${{ matrix.profile }}"',
-            'du -ha  "./target/${{ matrix.profile }}/deno"',
-            'du -ha  "./target/${{ matrix.profile }}/denort"',
-          ],
-        },
-      );
-    const cargoBuildStep = step
-      .dependsOn(
-        installLldStep,
-        installRustStep,
-        cargoBuildCacheStep,
-        sysRootStep,
-      )
-      .comesAfter(tarSourcePublishStep)(
-        {
-          name: "Build debug",
-          if: isDebug,
-          run: "cargo build --locked --all-targets --features=panic-trace",
-          env: { CARGO_PROFILE_DEV_DEBUG: 0 },
-        },
-        cargoBuildReleaseStep,
-        {
-          // Run a minimal check to ensure that binary is not corrupted, regardless
-          // of our build mode
-          name: "Check deno binary",
-          if: isTest,
-          run:
-            'target/${{ matrix.profile }}/deno eval "console.log(1+2)" | grep 3',
-          env: { NO_COLOR: 1 },
-        },
-        {
-          // Verify that the binary actually works in the Ubuntu-16.04 sysroot.
-          name: "Check deno binary (in sysroot)",
-          if: isTest.and(buildMatrix.use_sysroot.equals(true)),
-          run:
-            'sudo chroot /sysroot "$(pwd)/target/${{ matrix.profile }}/deno" --version',
-        },
-      );
+      steps: (() => {
+        const {
+          cacheCargoHomeStep,
+          restoreCacheBuildOutputStep,
+          saveCacheBuildOutputStep,
+        } = createCacheSteps(buildItem);
 
-    const benchStep = step
-      .if(buildMatrix.job.equals("bench").and(isNotTag).and(isRelease))
-      .dependsOn(installNodeStep)(
-        cloneSubmodule("./cli/bench/testdata/lsp_benchdata"),
-        step.dependsOn(installDenoStep, setupPrebuiltMacStep)({
-          name: "Install benchmark tools",
-          env: { GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}" },
-          run: "./tools/install_prebuilt.js wrk hyperfine",
-        }),
-        step.dependsOn(cargoBuildReleaseStep)({
-          name: "Run benchmarks",
-          run: "cargo bench --locked",
-        }),
-        {
-          name: "Post benchmarks",
-          if: isDenoland.and(isMainBranch),
-          env: {
-            DENOBOT_PAT: "${{ secrets.DENOBOT_PAT }}",
-          },
+        const isLinux = buildItem.os.equals("linux");
+        const isWindows = buildItem.os.equals("windows");
+        const isMacos = buildItem.os.equals("macos");
+        const {
+          installPythonStep,
+          setupPrebuiltMacStep,
+          installLldStep,
+          setupGcloudStep,
+        } = getOsSpecificSteps({
+          isWindows,
+          isMacos,
+        });
+        const isTest = buildItem.job.equals("test");
+        const isRelease = buildItem.profile.equals("release");
+        const isDebug = buildItem.profile.equals("debug");
+        const cloneWptSubmodule = cloneSubmodule("./tests/wpt/suite");
+        const cargoBuildCacheStep = step
+          .dependsOn(cacheCargoHomeStep, installRustStep)(
+            restoreCacheBuildOutputStep,
+            {
+              name: "Apply and update mtime cache",
+              if: isNotTag,
+              uses: "./.github/mtime_cache",
+              with: {
+                "cache-path": "./target",
+              },
+            },
+          );
+        const sysRootStep = step({
+          if: buildItem.use_sysroot,
+          ...sysRootConfig,
+        });
+        const tarSourcePublishStep = step({
+          name: "Create source tarballs (release, linux)",
+          if: buildItem.os.equals("linux")
+            .and(buildItem.arch.equals("x86_64")),
           run: [
-            "git clone --depth 1 --branch gh-pages                             \\",
-            "    https://${DENOBOT_PAT}@github.com/denoland/benchmark_data.git \\",
-            "    gh-pages",
-            "./target/release/deno run --allow-all ./tools/build_benchmark_jsons.js --release",
-            "cd gh-pages",
-            'git config user.email "propelml@gmail.com"',
-            'git config user.name "denobot"',
-            "git add .",
-            'git commit --message "Update benchmarks"',
-            "git push origin gh-pages",
+            "mkdir -p target/release",
+            'tar --exclude=".git*" --exclude=target --exclude=third_party/prebuilt \\',
+            "    -czvf target/release/deno_src.tar.gz -C .. deno",
           ],
-        },
-        {
-          name: "Worker info",
-          run: ["cat /proc/cpuinfo", "cat /proc/meminfo"],
-        },
-      );
+        });
 
-    const testStep = step
-      .if(isTest)
-      .dependsOn(installNodeStep)(
-        cloneSubmodule("./tests/node_compat/runner/suite"),
-        {
-          name: "Set up playwright cache",
-          uses: "actions/cache@v5",
-          with: {
-            path: "./.ms-playwright",
-            key: "playwright-${{ runner.os }}-${{ runner.arch }}",
+        const preRelease = step.if(isTest)(
+          {
+            name: "Upload PR artifact (linux)",
+            if: isTest.and(
+              buildItem.use_sysroot.or(
+                isDenoland.and(isMainOrTag),
+              ),
+            ),
+            uses: "actions/upload-artifact@v6",
+            with: {
+              name:
+                `deno-${buildItem.os}-${buildItem.arch}-\${{ github.event.number }}`,
+              path: "target/release/deno",
+            },
           },
-        },
-        {
-          if: buildMatrix.os.equals("linux").and(
-            buildMatrix.arch.equals("aarch64"),
-          ),
-          name: "Load 'vsock_loopback; kernel module",
-          run: "sudo modprobe vsock_loopback",
-        },
-        cargoBuildStep,
-        {
-          name: "Autobahn testsuite",
-          if: isLinux.and(buildMatrix.arch.notEquals("aarch64")).and(isRelease)
-            .and(isNotTag),
-          run:
-            "target/release/deno run -A --config tests/config/deno.json ext/websocket/autobahn/fuzzingclient.js",
-        },
-        {
-          name: "Test (full, debug)",
-          // run full tests only on Linux
-          if: isDebug.and(isNotTag).and(isLinux),
-          run:
-            `cargo test --workspace --locked ${libExcludeArgs} --features=panic-trace`,
-          env: { CARGO_PROFILE_DEV_DEBUG: 0 },
-        },
-        {
-          name: "Test (fast, debug)",
-          if: isDebug.and(
-            isTag.or(buildMatrix.os.notEquals("linux")),
-          ),
-          run: [
-            // Run unit then integration tests. Skip doc tests here
-            // since they are sometimes very slow on Mac.
-            `cargo test --workspace --locked ${libExcludeArgs} --lib --features=panic-trace`,
-            `cargo test --workspace --locked ${libExcludeArgs} --tests --features=panic-trace`,
-          ],
-          env: { CARGO_PROFILE_DEV_DEBUG: 0 },
-        },
-        {
-          name: "Test (release)",
-          if: isRelease.and(
-            isDenoland.or(buildMatrix.use_sysroot.equals(true)),
-          ).and(isNotTag),
-          run:
-            `cargo test --workspace --release --locked ${libExcludeArgs} --features=panic-trace`,
-        },
-        {
-          name: "Ensure no git changes",
-          if: isPr,
-          run: [
-            'if [[ -n "$(git status --porcelain)" ]]; then',
-            'echo "❌ Git working directory is dirty. Ensure `cargo test` is not modifying git tracked files."',
-            'echo ""',
-            'echo "📋 Status:"',
-            "git status",
-            'echo ""',
-            "exit 1",
-            "fi",
-          ],
-        },
-        step.dependsOn(installDenoStep)({
-          name: "Combine test results",
-          if: conditions.status.always().and(isNotTag),
-          run: "deno run -RWN ./tools/combine_test_results.js",
-        }),
-        {
-          name: "Upload test results",
-          uses: "actions/upload-artifact@v4",
-          if: conditions.status.always().and(isNotTag),
-          with: {
-            name:
-              "test-results-${{ matrix.os }}-${{ matrix.arch }}-${{ matrix.profile }}.json",
-            path: "target/test_results.json",
+          {
+            name: "Pre-release (linux)",
+            if: isLinux.and(isDenoland),
+            run: [
+              "cd target/release",
+              `./deno -A ../../tools/release/create_symcache.ts deno-${buildItem.arch}-unknown-linux-gnu.symcache`,
+              "strip ./deno",
+              `zip -r deno-${buildItem.arch}-unknown-linux-gnu.zip deno`,
+              `shasum -a 256 deno-${buildItem.arch}-unknown-linux-gnu.zip > deno-${buildItem.arch}-unknown-linux-gnu.zip.sha256sum`,
+              "strip ./denort",
+              `zip -r denort-${buildItem.arch}-unknown-linux-gnu.zip denort`,
+              `shasum -a 256 denort-${buildItem.arch}-unknown-linux-gnu.zip > denort-${buildItem.arch}-unknown-linux-gnu.zip.sha256sum`,
+              "./deno types > lib.deno.d.ts",
+            ],
           },
-        },
-      );
+          step.dependsOn(setupPrebuiltMacStep)({
+            name: "Install rust-codesign",
+            if: buildItem.os.equals("macos").and(isDenoland),
+            env: {
+              GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}",
+            },
+            run: "./tools/install_prebuilt.js rcodesign",
+          }),
+          {
+            name: "Pre-release (mac)",
+            if: isMacos.and(isDenoland),
+            env: {
+              "APPLE_CODESIGN_KEY": "${{ secrets.APPLE_CODESIGN_KEY }}",
+              "APPLE_CODESIGN_PASSWORD":
+                "${{ secrets.APPLE_CODESIGN_PASSWORD }}",
+            },
+            run: [
+              `target/release/deno -A tools/release/create_symcache.ts target/release/deno-${buildItem.arch}-apple-darwin.symcache`,
+              "strip -x -S target/release/deno",
+              'echo "Key is $(echo $APPLE_CODESIGN_KEY | base64 -d | wc -c) bytes"',
+              "rcodesign sign target/release/deno " +
+              "--code-signature-flags=runtime " +
+              '--p12-password="$APPLE_CODESIGN_PASSWORD" ' +
+              "--p12-file=<(echo $APPLE_CODESIGN_KEY | base64 -d) " +
+              "--entitlements-xml-file=cli/entitlements.plist",
+              "cd target/release",
+              `zip -r deno-${buildItem.arch}-apple-darwin.zip deno`,
+              `shasum -a 256 deno-${buildItem.arch}-apple-darwin.zip > deno-${buildItem.arch}-apple-darwin.zip.sha256sum`,
+              "strip -x -S ./denort",
+              `zip -r denort-${buildItem.arch}-apple-darwin.zip denort`,
+              `shasum -a 256 denort-${buildItem.arch}-apple-darwin.zip > denort-${buildItem.arch}-apple-darwin.zip.sha256sum`,
+            ],
+          },
+          {
+            // Note: Azure OIDC credentials are only valid for 5 minutes, so
+            // authentication must be done right before signing.
+            name: "Authenticate with Azure (windows)",
+            if: isWindows.and(isDenoland).and(isMainOrTag),
+            uses: "azure/login@v2",
+            with: {
+              "client-id": "${{ secrets.AZURE_CLIENT_ID }}",
+              "tenant-id": "${{ secrets.AZURE_TENANT_ID }}",
+              "subscription-id": "${{ secrets.AZURE_SUBSCRIPTION_ID }}",
+              "enable-AzPSSession": true,
+            },
+          },
+          {
+            name: "Code sign deno.exe (windows)",
+            if: isWindows.and(isDenoland).and(isMainOrTag),
+            uses: "Azure/artifact-signing-action@v0",
+            with: {
+              "endpoint": "https://eus.codesigning.azure.net/",
+              "trusted-signing-account-name": "deno-cli-code-signing",
+              "certificate-profile-name": "deno-cli-code-signing-cert",
+              "files-folder": "target/release",
+              "files-folder-filter": "deno.exe",
+              "file-digest": "SHA256",
+              "timestamp-rfc3161": "http://timestamp.acs.microsoft.com",
+              "timestamp-digest": "SHA256",
+              "exclude-environment-credential": true,
+              "exclude-workload-identity-credential": true,
+              "exclude-managed-identity-credential": true,
+              "exclude-shared-token-cache-credential": true,
+              "exclude-visual-studio-credential": true,
+              "exclude-visual-studio-code-credential": true,
+              "exclude-azure-cli-credential": false,
+            },
+          },
+          {
+            name: "Verify signature (windows)",
+            if: isWindows.and(isDenoland).and(isMainOrTag),
+            shell: "pwsh",
+            run: [
+              '$SignTool = Get-ChildItem -Path "C:\\Program Files*\\Windows Kits\\*\\bin\\*\\x64\\signtool.exe" -Recurse -ErrorAction SilentlyContinue | Select-Object -First 1',
+              "$SignToolPath = $SignTool.FullName",
+              "& $SignToolPath verify /pa /v target\\release\\deno.exe",
+            ],
+          },
+          {
+            name: "Pre-release (windows)",
+            if: isWindows.and(isDenoland),
+            shell: "pwsh",
+            run: [
+              `Compress-Archive -CompressionLevel Optimal -Force -Path target/release/deno.exe -DestinationPath target/release/deno-${buildItem.arch}-pc-windows-msvc.zip`,
+              `Get-FileHash target/release/deno-${buildItem.arch}-pc-windows-msvc.zip -Algorithm SHA256 | Format-List > target/release/deno-${buildItem.arch}-pc-windows-msvc.zip.sha256sum`,
+              `Compress-Archive -CompressionLevel Optimal -Force -Path target/release/denort.exe -DestinationPath target/release/denort-${buildItem.arch}-pc-windows-msvc.zip`,
+              `Get-FileHash target/release/denort-${buildItem.arch}-pc-windows-msvc.zip -Algorithm SHA256 | Format-List > target/release/denort-${buildItem.arch}-pc-windows-msvc.zip.sha256sum`,
+              `target/release/deno.exe -A tools/release/create_symcache.ts target/release/deno-${buildItem.arch}-pc-windows-msvc.symcache`,
+            ],
+          },
+          step.dependsOn(setupGcloudStep)({
+            name: "Upload canary to dl.deno.land",
+            if: isDenoland.and(isMainBranch),
+            run: [
+              'gsutil -h "Cache-Control: public, max-age=3600" cp ./target/release/*.zip gs://dl.deno.land/canary/$(git rev-parse HEAD)/',
+              'gsutil -h "Cache-Control: public, max-age=3600" cp ./target/release/*.sha256sum gs://dl.deno.land/canary/$(git rev-parse HEAD)/',
+              'gsutil -h "Cache-Control: public, max-age=3600" cp ./target/release/*.symcache gs://dl.deno.land/canary/$(git rev-parse HEAD)/',
+              "echo ${{ github.sha }} > canary-latest.txt",
+              'gsutil -h "Cache-Control: no-cache" cp canary-latest.txt gs://dl.deno.land/canary-$(rustc -vV | sed -n "s|host: ||p")-latest.txt',
+              "rm canary-latest.txt gha-creds-*.json",
+            ],
+          }),
+        );
+        const cargoBuildReleaseStep = step
+          .if(
+            isRelease.and(isDenoland.or(buildItem.use_sysroot)),
+          )
+          .dependsOn(
+            installLldStep,
+            installRustStep,
+            cacheCargoHomeStep,
+            cargoBuildCacheStep,
+            sysRootStep,
+          )(
+            {
+              name: "Configure canary build",
+              if: isTest.and(isMainBranch),
+              run: 'echo "DENO_CANARY=true" >> $GITHUB_ENV',
+            },
+            {
+              name: "Build release",
+              run: [
+                // output fs space before and after building
+                "df -h",
+                "cargo build --release --locked --all-targets --features=panic-trace",
+                "df -h",
+              ],
+            },
+            {
+              name: "Generate symcache",
+              run: [
+                "target/release/deno -A tools/release/create_symcache.ts ./deno.symcache",
+                "du -h deno.symcache",
+                "du -h target/release/deno",
+              ],
+              env: { NO_COLOR: 1 },
+            },
+            preRelease,
+            {
+              name: "Build product size info",
+              if: isMainOrTag,
+              run: [
+                `du -hd1 "./target/${buildItem.profile}"`,
+                `du -ha  "./target/${buildItem.profile}/deno"`,
+                `du -ha  "./target/${buildItem.profile}/denort"`,
+              ],
+            },
+          );
+        const cargoBuildStep = step
+          .dependsOn(
+            installLldStep,
+            installRustStep,
+            cargoBuildCacheStep,
+            sysRootStep,
+          )
+          .comesAfter(tarSourcePublishStep)(
+            {
+              name: "Build debug",
+              if: isDebug,
+              run: "cargo build --locked --all-targets --features=panic-trace",
+              env: { CARGO_PROFILE_DEV_DEBUG: 0 },
+            },
+            cargoBuildReleaseStep,
+            {
+              // Run a minimal check to ensure that binary is not corrupted, regardless
+              // of our build mode
+              name: "Check deno binary",
+              if: isTest,
+              run:
+                `target/${buildItem.profile}/deno eval "console.log(1+2)" | grep 3`,
+              env: { NO_COLOR: 1 },
+            },
+            {
+              // Verify that the binary actually works in the Ubuntu-16.04 sysroot.
+              name: "Check deno binary (in sysroot)",
+              if: isTest.and(buildItem.use_sysroot),
+              run:
+                `sudo chroot /sysroot "$(pwd)/target/${buildItem.profile}/deno" --version`,
+            },
+          );
 
-    const wptTests = step
-      .if(buildMatrix.wpt.equals(true))
-      .dependsOn(cloneWptSubmodule, installDenoStep, installPythonStep)({
-        name: "Configure hosts file for WPT",
-        run: "./wpt make-hosts-file | sudo tee -a /etc/hosts",
-        workingDirectory: "tests/wpt/suite/",
-      }, {
-        name: "Run web platform tests (debug)",
-        if: isDebug,
-        env: { DENO_BIN: "./target/debug/deno" },
-        run: [
-          "deno run -RWNE --allow-run --lock=tools/deno.lock.json --config tests/config/deno.json \\",
-          "    ./tests/wpt/wpt.ts setup",
-          "deno run -RWNE --allow-run --lock=tools/deno.lock.json --config tests/config/deno.json --unsafely-ignore-certificate-errors \\",
-          '    ./tests/wpt/wpt.ts run --quiet --binary="$DENO_BIN"',
-        ],
-      }, {
-        name: "Run web platform tests (release)",
-        if: isRelease,
-        env: {
-          DENO_BIN: "./target/release/deno",
-        },
-        run: [
-          "deno run -RWNE --allow-run --lock=tools/deno.lock.json --config tests/config/deno.json \\",
-          "    ./tests/wpt/wpt.ts setup",
-          "deno run -RWNE --allow-run --lock=tools/deno.lock.json --config tests/config/deno.json --unsafely-ignore-certificate-errors \\",
-          '    ./tests/wpt/wpt.ts run --quiet --release --binary="$DENO_BIN" --json=wpt.json --wptreport=wptreport.json',
-        ],
-      }, {
-        name: "Upload wpt results to dl.deno.land",
-        continueOnError: true,
-        if: isRelease.and(isLinux).and(isDenoland).and(isMainBranch).and(
-          isNotTag,
-        ),
-        run: [
-          "gzip ./wptreport.json",
-          'gsutil -h "Cache-Control: public, max-age=3600" cp ./wpt.json gs://dl.deno.land/wpt/$(git rev-parse HEAD).json',
-          'gsutil -h "Cache-Control: public, max-age=3600" cp ./wptreport.json.gz gs://dl.deno.land/wpt/$(git rev-parse HEAD)-wptreport.json.gz',
-          "echo $(git rev-parse HEAD) > wpt-latest.txt",
-          'gsutil -h "Cache-Control: no-cache" cp wpt-latest.txt gs://dl.deno.land/wpt-latest.txt',
-        ],
-      }, {
-        name: "Upload wpt results to wpt.fyi",
-        continueOnError: true,
-        if: isRelease.and(isLinux).and(isDenoland).and(isMainBranch).and(
-          isNotTag,
-        ),
-        env: {
-          WPT_FYI_USER: "deno",
-          WPT_FYI_PW: "${{ secrets.WPT_FYI_PW }}",
-          GITHUB_TOKEN: "${{ secrets.DENOBOT_PAT }}",
-        },
-        run: [
-          "./target/release/deno run --allow-all --lock=tools/deno.lock.json \\",
-          "    ./tools/upload_wptfyi.js $(git rev-parse HEAD) --ghstatus",
-        ],
-      });
+        const benchStep = step
+          .if(buildItem.job.equals("bench").and(isNotTag).and(isRelease))
+          .dependsOn(installNodeStep)(
+            cloneSubmodule("./cli/bench/testdata/lsp_benchdata"),
+            step.dependsOn(installDenoStep, setupPrebuiltMacStep)({
+              name: "Install benchmark tools",
+              env: { GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}" },
+              run: "./tools/install_prebuilt.js wrk hyperfine",
+            }),
+            step.dependsOn(cargoBuildReleaseStep)({
+              name: "Run benchmarks",
+              run: "cargo bench --locked",
+            }),
+            {
+              name: "Post benchmarks",
+              if: isDenoland.and(isMainBranch),
+              env: {
+                DENOBOT_PAT: "${{ secrets.DENOBOT_PAT }}",
+              },
+              run: [
+                "git clone --depth 1 --branch gh-pages                             \\",
+                "    https://${DENOBOT_PAT}@github.com/denoland/benchmark_data.git \\",
+                "    gh-pages",
+                "./target/release/deno run --allow-all ./tools/build_benchmark_jsons.js --release",
+                "cd gh-pages",
+                'git config user.email "propelml@gmail.com"',
+                'git config user.name "denobot"',
+                "git add .",
+                'git commit --message "Update benchmarks"',
+                "git push origin gh-pages",
+              ],
+            },
+            {
+              name: "Worker info",
+              run: ["cat /proc/cpuinfo", "cat /proc/meminfo"],
+            },
+          );
 
-    const shouldPublishCondition = isTest.and(isRelease).and(isDenoland)
-      .and(isTag);
-    const publishStep = step.if(shouldPublishCondition)(
-      step.dependsOn(setupGcloud)({
-        name: "Upload release to dl.deno.land (unix)",
-        if: isWindows.not(),
-        run: [
-          'gsutil -h "Cache-Control: public, max-age=3600" cp ./target/release/*.zip gs://dl.deno.land/release/${GITHUB_REF#refs/*/}/',
-          'gsutil -h "Cache-Control: public, max-age=3600" cp ./target/release/*.sha256sum gs://dl.deno.land/release/${GITHUB_REF#refs/*/}/',
-          'gsutil -h "Cache-Control: public, max-age=3600" cp ./target/release/*.symcache gs://dl.deno.land/release/${GITHUB_REF#refs/*/}/',
-        ],
-      }, {
-        name: "Upload release to dl.deno.land (windows)",
-        if: isWindows,
-        env: { CLOUDSDK_PYTHON: "${{env.pythonLocation}}\\python.exe" },
-        run: [
-          'gsutil -h "Cache-Control: public, max-age=3600" cp ./target/release/*.zip gs://dl.deno.land/release/${GITHUB_REF#refs/*/}/',
-          'gsutil -h "Cache-Control: public, max-age=3600" cp ./target/release/*.sha256sum gs://dl.deno.land/release/${GITHUB_REF#refs/*/}/',
-          'gsutil -h "Cache-Control: public, max-age=3600" cp ./target/release/*.symcache gs://dl.deno.land/release/${GITHUB_REF#refs/*/}/',
-        ],
-      }),
-      {
-        name: "Create release notes",
-        run: [
-          "export PATH=$PATH:$(pwd)/target/release",
-          "./tools/release/05_create_release_notes.ts",
-        ],
-      },
-      {
-        name: "Upload release to GitHub",
-        uses: "softprops/action-gh-release@v2",
-        env: {
-          GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}",
-        },
-        with: {
-          files: [
-            "target/release/deno-x86_64-pc-windows-msvc.zip",
-            "target/release/deno-x86_64-pc-windows-msvc.zip.sha256sum",
-            "target/release/denort-x86_64-pc-windows-msvc.zip",
-            "target/release/denort-x86_64-pc-windows-msvc.zip.sha256sum",
-            "target/release/deno-aarch64-pc-windows-msvc.zip",
-            "target/release/deno-aarch64-pc-windows-msvc.zip.sha256sum",
-            "target/release/denort-aarch64-pc-windows-msvc.zip",
-            "target/release/denort-aarch64-pc-windows-msvc.zip.sha256sum",
-            "target/release/deno-x86_64-unknown-linux-gnu.zip",
-            "target/release/deno-x86_64-unknown-linux-gnu.zip.sha256sum",
-            "target/release/denort-x86_64-unknown-linux-gnu.zip",
-            "target/release/denort-x86_64-unknown-linux-gnu.zip.sha256sum",
-            "target/release/deno-x86_64-apple-darwin.zip",
-            "target/release/deno-x86_64-apple-darwin.zip.sha256sum",
-            "target/release/denort-x86_64-apple-darwin.zip",
-            "target/release/denort-x86_64-apple-darwin.zip.sha256sum",
-            "target/release/deno-aarch64-unknown-linux-gnu.zip",
-            "target/release/deno-aarch64-unknown-linux-gnu.zip.sha256sum",
-            "target/release/denort-aarch64-unknown-linux-gnu.zip",
-            "target/release/denort-aarch64-unknown-linux-gnu.zip.sha256sum",
-            "target/release/deno-aarch64-apple-darwin.zip",
-            "target/release/deno-aarch64-apple-darwin.zip.sha256sum",
-            "target/release/denort-aarch64-apple-darwin.zip",
-            "target/release/denort-aarch64-apple-darwin.zip.sha256sum",
-            "target/release/deno_src.tar.gz",
-            "target/release/lib.deno.d.ts",
-          ].join("\n"),
-          body_path: "target/release/release-notes.md",
-          draft: true,
-        },
-      },
-    );
+        const testStep = step
+          .if(isTest)
+          .dependsOn(installNodeStep)(
+            cloneSubmodule("./tests/node_compat/runner/suite"),
+            {
+              name: "Set up playwright cache",
+              uses: "actions/cache@v5",
+              with: {
+                path: "./.ms-playwright",
+                key: "playwright-${{ runner.os }}-${{ runner.arch }}",
+              },
+            },
+            {
+              if: buildItem.os.equals("linux").and(
+                buildItem.arch.equals("aarch64"),
+              ),
+              name: "Load 'vsock_loopback; kernel module",
+              run: "sudo modprobe vsock_loopback",
+            },
+            cargoBuildStep,
+            {
+              name: "Autobahn testsuite",
+              if: isLinux.and(buildItem.arch.notEquals("aarch64")).and(
+                isRelease,
+              )
+                .and(isNotTag),
+              run:
+                "target/release/deno run -A --config tests/config/deno.json ext/websocket/autobahn/fuzzingclient.js",
+            },
+            {
+              name: "Test (full, debug)",
+              // run full tests only on Linux
+              if: isDebug.and(isNotTag).and(isLinux),
+              run:
+                `cargo test --workspace --locked ${libExcludeArgs} --features=panic-trace`,
+              env: { CARGO_PROFILE_DEV_DEBUG: 0 },
+            },
+            {
+              name: "Test (fast, debug)",
+              if: isDebug.and(
+                isTag.or(buildItem.os.notEquals("linux")),
+              ),
+              run: [
+                // Run unit then integration tests. Skip doc tests here
+                // since they are sometimes very slow on Mac.
+                `cargo test --workspace --locked ${libExcludeArgs} --lib --features=panic-trace`,
+                `cargo test --workspace --locked ${libExcludeArgs} --tests --features=panic-trace`,
+              ],
+              env: { CARGO_PROFILE_DEV_DEBUG: 0 },
+            },
+            {
+              name: "Test (release)",
+              if: isRelease.and(
+                isDenoland.or(buildItem.use_sysroot),
+              ).and(isNotTag),
+              run:
+                `cargo test --workspace --release --locked ${libExcludeArgs} --features=panic-trace`,
+            },
+            {
+              name: "Ensure no git changes",
+              if: isPr,
+              run: [
+                'if [[ -n "$(git status --porcelain)" ]]; then',
+                'echo "❌ Git working directory is dirty. Ensure `cargo test` is not modifying git tracked files."',
+                'echo ""',
+                'echo "📋 Status:"',
+                "git status",
+                'echo ""',
+                "exit 1",
+                "fi",
+              ],
+            },
+            step.dependsOn(installDenoStep)({
+              name: "Combine test results",
+              if: conditions.status.always().and(isNotTag),
+              run: "deno run -RWN ./tools/combine_test_results.js",
+            }),
+            {
+              name: "Upload test results",
+              uses: "actions/upload-artifact@v4",
+              if: conditions.status.always().and(isNotTag),
+              with: {
+                name:
+                  `test-results-${buildItem.os}-${buildItem.arch}-${buildItem.profile}.json`,
+                path: "target/test_results.json",
+              },
+            },
+          );
 
-    return step.if(buildMatrix.skip.not())(
-      cloneRepoStep,
-      cloneStdSubmodule,
-      // ensure this happens right after cloning
-      tarSourcePublishStep.if(shouldPublishCondition),
-      {
-        name: "Remove macOS cURL --ipv4 flag",
-        run: [
-          // cURL's --ipv4 flag is busted for now
-          "curl --version",
-          "which curl",
-          "cat /etc/hosts",
-          "rm ~/.curlrc || true",
-        ],
-        if: buildMatrix.os.equals("macos"),
-      },
-      step({
-        name: "Log versions",
-        run: [
-          "echo '*** Python'",
-          "command -v python && python --version || echo 'No python found or bad executable'",
-          "echo '*** Rust'",
-          "command -v rustc && rustc --version || echo 'No rustc found or bad executable'",
-          "echo '*** Cargo'",
-          "command -v cargo && cargo --version || echo 'No cargo found or bad executable'",
-          "echo '*** Deno'",
-          "command -v deno && deno --version || echo 'No deno found or bad executable'",
-          "echo '*** Node'",
-          "command -v node && node --version || echo 'No node found or bad executable'",
-          "echo '*** Installed packages'",
-          "command -v dpkg && dpkg -l || echo 'No dpkg found or bad executable'",
-        ],
-      }).comesAfter(
-        installDenoStep,
-        installNodeStep,
-        installPythonStep,
-        installRustStep,
-      ),
-      cargoBuildStep,
-      testStep,
-      benchStep,
-      wptTests,
-      publishStep,
-      saveCacheBuildOutputStep.if(buildMatrix.save_cache),
-    );
-  })(),
+        const wptTests = step
+          .if(buildItem.wpt)
+          .dependsOn(cloneWptSubmodule, installDenoStep, installPythonStep)({
+            name: "Configure hosts file for WPT",
+            run: "./wpt make-hosts-file | sudo tee -a /etc/hosts",
+            workingDirectory: "tests/wpt/suite/",
+          }, {
+            name: "Run web platform tests (debug)",
+            if: isDebug,
+            env: { DENO_BIN: "./target/debug/deno" },
+            run: [
+              "deno run -RWNE --allow-run --lock=tools/deno.lock.json --config tests/config/deno.json \\",
+              "    ./tests/wpt/wpt.ts setup",
+              "deno run -RWNE --allow-run --lock=tools/deno.lock.json --config tests/config/deno.json --unsafely-ignore-certificate-errors \\",
+              '    ./tests/wpt/wpt.ts run --quiet --binary="$DENO_BIN"',
+            ],
+          }, {
+            name: "Run web platform tests (release)",
+            if: isRelease,
+            env: {
+              DENO_BIN: "./target/release/deno",
+            },
+            run: [
+              "deno run -RWNE --allow-run --lock=tools/deno.lock.json --config tests/config/deno.json \\",
+              "    ./tests/wpt/wpt.ts setup",
+              "deno run -RWNE --allow-run --lock=tools/deno.lock.json --config tests/config/deno.json --unsafely-ignore-certificate-errors \\",
+              '    ./tests/wpt/wpt.ts run --quiet --release --binary="$DENO_BIN" --json=wpt.json --wptreport=wptreport.json',
+            ],
+          }, {
+            name: "Upload wpt results to dl.deno.land",
+            continueOnError: true,
+            if: isRelease.and(isLinux).and(isDenoland).and(isMainBranch).and(
+              isNotTag,
+            ),
+            run: [
+              "gzip ./wptreport.json",
+              'gsutil -h "Cache-Control: public, max-age=3600" cp ./wpt.json gs://dl.deno.land/wpt/$(git rev-parse HEAD).json',
+              'gsutil -h "Cache-Control: public, max-age=3600" cp ./wptreport.json.gz gs://dl.deno.land/wpt/$(git rev-parse HEAD)-wptreport.json.gz',
+              "echo $(git rev-parse HEAD) > wpt-latest.txt",
+              'gsutil -h "Cache-Control: no-cache" cp wpt-latest.txt gs://dl.deno.land/wpt-latest.txt',
+            ],
+          }, {
+            name: "Upload wpt results to wpt.fyi",
+            continueOnError: true,
+            if: isRelease.and(isLinux).and(isDenoland).and(isMainBranch).and(
+              isNotTag,
+            ),
+            env: {
+              WPT_FYI_USER: "deno",
+              WPT_FYI_PW: "${{ secrets.WPT_FYI_PW }}",
+              GITHUB_TOKEN: "${{ secrets.DENOBOT_PAT }}",
+            },
+            run: [
+              "./target/release/deno run --allow-all --lock=tools/deno.lock.json \\",
+              "    ./tools/upload_wptfyi.js $(git rev-parse HEAD) --ghstatus",
+            ],
+          });
+
+        const shouldPublishCondition = isTest.and(isRelease).and(isDenoland)
+          .and(isTag);
+        const publishStep = step.if(shouldPublishCondition)(
+          step.dependsOn(setupGcloudStep)({
+            name: "Upload release to dl.deno.land (unix)",
+            if: isWindows.not(),
+            run: [
+              'gsutil -h "Cache-Control: public, max-age=3600" cp ./target/release/*.zip gs://dl.deno.land/release/${GITHUB_REF#refs/*/}/',
+              'gsutil -h "Cache-Control: public, max-age=3600" cp ./target/release/*.sha256sum gs://dl.deno.land/release/${GITHUB_REF#refs/*/}/',
+              'gsutil -h "Cache-Control: public, max-age=3600" cp ./target/release/*.symcache gs://dl.deno.land/release/${GITHUB_REF#refs/*/}/',
+            ],
+          }, {
+            name: "Upload release to dl.deno.land (windows)",
+            if: isWindows,
+            env: { CLOUDSDK_PYTHON: "${{env.pythonLocation}}\\python.exe" },
+            run: [
+              'gsutil -h "Cache-Control: public, max-age=3600" cp ./target/release/*.zip gs://dl.deno.land/release/${GITHUB_REF#refs/*/}/',
+              'gsutil -h "Cache-Control: public, max-age=3600" cp ./target/release/*.sha256sum gs://dl.deno.land/release/${GITHUB_REF#refs/*/}/',
+              'gsutil -h "Cache-Control: public, max-age=3600" cp ./target/release/*.symcache gs://dl.deno.land/release/${GITHUB_REF#refs/*/}/',
+            ],
+          }),
+          {
+            name: "Create release notes",
+            run: [
+              "export PATH=$PATH:$(pwd)/target/release",
+              "./tools/release/05_create_release_notes.ts",
+            ],
+          },
+          {
+            name: "Upload release to GitHub",
+            uses: "softprops/action-gh-release@v2",
+            env: {
+              GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}",
+            },
+            with: {
+              files: [
+                "target/release/deno-x86_64-pc-windows-msvc.zip",
+                "target/release/deno-x86_64-pc-windows-msvc.zip.sha256sum",
+                "target/release/denort-x86_64-pc-windows-msvc.zip",
+                "target/release/denort-x86_64-pc-windows-msvc.zip.sha256sum",
+                "target/release/deno-aarch64-pc-windows-msvc.zip",
+                "target/release/deno-aarch64-pc-windows-msvc.zip.sha256sum",
+                "target/release/denort-aarch64-pc-windows-msvc.zip",
+                "target/release/denort-aarch64-pc-windows-msvc.zip.sha256sum",
+                "target/release/deno-x86_64-unknown-linux-gnu.zip",
+                "target/release/deno-x86_64-unknown-linux-gnu.zip.sha256sum",
+                "target/release/denort-x86_64-unknown-linux-gnu.zip",
+                "target/release/denort-x86_64-unknown-linux-gnu.zip.sha256sum",
+                "target/release/deno-x86_64-apple-darwin.zip",
+                "target/release/deno-x86_64-apple-darwin.zip.sha256sum",
+                "target/release/denort-x86_64-apple-darwin.zip",
+                "target/release/denort-x86_64-apple-darwin.zip.sha256sum",
+                "target/release/deno-aarch64-unknown-linux-gnu.zip",
+                "target/release/deno-aarch64-unknown-linux-gnu.zip.sha256sum",
+                "target/release/denort-aarch64-unknown-linux-gnu.zip",
+                "target/release/denort-aarch64-unknown-linux-gnu.zip.sha256sum",
+                "target/release/deno-aarch64-apple-darwin.zip",
+                "target/release/deno-aarch64-apple-darwin.zip.sha256sum",
+                "target/release/denort-aarch64-apple-darwin.zip",
+                "target/release/denort-aarch64-apple-darwin.zip.sha256sum",
+                "target/release/deno_src.tar.gz",
+                "target/release/lib.deno.d.ts",
+              ].join("\n"),
+              body_path: "target/release/release-notes.md",
+              draft: true,
+            },
+          },
+        );
+
+        return step.if(buildItem.skip.not())(
+          cloneRepoStep,
+          cloneStdSubmodule,
+          // ensure this happens right after cloning
+          tarSourcePublishStep.if(shouldPublishCondition),
+          {
+            name: "Remove macOS cURL --ipv4 flag",
+            run: [
+              // cURL's --ipv4 flag is busted for now
+              "curl --version",
+              "which curl",
+              "cat /etc/hosts",
+              "rm ~/.curlrc || true",
+            ],
+            if: buildItem.os.equals("macos"),
+          },
+          step({
+            name: "Log versions",
+            run: [
+              "echo '*** Python'",
+              "command -v python && python --version || echo 'No python found or bad executable'",
+              "echo '*** Rust'",
+              "command -v rustc && rustc --version || echo 'No rustc found or bad executable'",
+              "echo '*** Cargo'",
+              "command -v cargo && cargo --version || echo 'No cargo found or bad executable'",
+              "echo '*** Deno'",
+              "command -v deno && deno --version || echo 'No deno found or bad executable'",
+              "echo '*** Node'",
+              "command -v node && node --version || echo 'No node found or bad executable'",
+              "echo '*** Installed packages'",
+              "command -v dpkg && dpkg -l || echo 'No dpkg found or bad executable'",
+            ],
+          }).comesAfter(
+            installDenoStep,
+            installNodeStep,
+            installPythonStep,
+            installRustStep,
+          ),
+          cargoBuildStep,
+          testStep,
+          benchStep,
+          wptTests,
+          publishStep,
+          saveCacheBuildOutputStep.if(buildItem.save_cache),
+        );
+      })(),
+    },
+  );
 });
 
 // === lint job ===
@@ -1068,33 +1121,40 @@ const lintJob = job("lint", {
   strategy: {
     matrix: lintMatrix,
   },
-  steps: step(
-    cloneRepoStep,
-    cloneStdSubmodule,
-    cacheCargoHomeStep,
-    restoreCacheBuildOutputStep,
-    installRustStep,
-    installDenoStep,
-    step.if(lintMatrix.os.equals("linux"))(
-      {
-        name: "test_format.js",
-        run:
-          "deno run --allow-write --allow-read --allow-run --allow-net ./tools/format.js --check",
-      },
+  steps: (() => {
+    const {
+      cacheCargoHomeStep,
+      restoreCacheBuildOutputStep,
+      saveCacheBuildOutputStep,
+    } = createCacheSteps(lintMatrix);
+    return step(
+      cloneRepoStep,
+      cloneStdSubmodule,
+      cacheCargoHomeStep,
+      restoreCacheBuildOutputStep,
+      installRustStep,
+      installDenoStep,
+      step.if(lintMatrix.os.equals("linux"))(
+        {
+          name: "test_format.js",
+          run:
+            "deno run --allow-write --allow-read --allow-run --allow-net ./tools/format.js --check",
+        },
+        {
+          name: "jsdoc_checker.js",
+          run:
+            "deno run --allow-read --allow-env --allow-sys ./tools/jsdoc_checker.js",
+        },
+      ),
       {
-        name: "jsdoc_checker.js",
+        name: "lint.js",
+        env: { GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}" },
         run:
-          "deno run --allow-read --allow-env --allow-sys ./tools/jsdoc_checker.js",
+          "deno run --allow-write --allow-read --allow-run --allow-net --allow-env ./tools/lint.js",
       },
-    ),
-    {
-      name: "lint.js",
-      env: { GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}" },
-      run:
-        "deno run --allow-write --allow-read --allow-run --allow-net --allow-env ./tools/lint.js",
-    },
-    saveCacheBuildOutputStep,
-  ),
+      saveCacheBuildOutputStep,
+    );
+  })(),
 });
 
 // === libs job ===
@@ -1125,15 +1185,29 @@ const libsJob = job("libs", {
     matrix: libsMatrix,
   },
   steps: (() => {
+    const {
+      cacheCargoHomeStep,
+      restoreCacheBuildOutputStep,
+      saveCacheBuildOutputStep,
+    } = createCacheSteps(libsMatrix);
     const repoSetupSteps = step(
       cloneRepoStep,
       cacheCargoHomeStep,
       restoreCacheBuildOutputStep,
       installRustStep,
     );
+    const isMacos = libsMatrix.os.equals("macos");
+    const isWindows = libsMatrix.os.equals("windows");
+    const isLinux = libsMatrix.os.equals("linux");
+    const {
+      installLldStep,
+    } = getOsSpecificSteps({
+      isWindows,
+      isMacos,
+    });
 
     const macSetup = step.if(
-      libsMatrix.os.equals("macos").and(libsMatrix.arch.equals("aarch64")),
+      isMacos.and(libsMatrix.arch.equals("aarch64")),
     )(
       installLldStep,
       {
@@ -1147,7 +1221,7 @@ const libsJob = job("libs", {
     );
 
     const linuxCargoChecks = step
-      .if(libsMatrix.os.equals("linux"))
+      .if(isLinux)
       .dependsOn(installWasmStep)(
         // we want these crates to be Wasm compatible
         {
@@ -1178,7 +1252,7 @@ const libsJob = job("libs", {
       linuxCargoChecks,
       step.dependsOn(repoSetupSteps, macSetup)({
         name: "Test libs",
-        run: `cargo test --locked ${libTestCrateArgs}`,
+        run: `cargo test --locked ${libCrates.map((p) => `-p ${p}`).join(" ")}`,
         env: { CARGO_PROFILE_DEV_DEBUG: 0 },
       }),
       saveCacheBuildOutputStep,
@@ -1191,32 +1265,27 @@ const libsJob = job("libs", {
 const publishCanaryJob = job("publish-canary", {
   name: "publish canary",
   runsOn: ubuntuX86Runner,
-  needs: [buildJob],
+  needs: [...buildJobs],
   if: isDenoland.and(isMainBranch),
-  steps: step(
-    {
-      name: "Authenticate with Google Cloud",
-      uses: "google-github-actions/auth@v3",
-      with: {
-        "project_id": "denoland",
-        "credentials_json": "${{ secrets.GCP_SA_KEY }}",
-        "export_environment_variables": true,
-        "create_credentials_file": true,
+  steps: (() => {
+    const {
+      setupGcloudStep,
+    } = getOsSpecificSteps({
+      // we only run this on linux
+      isWindows: conditions.isFalse(),
+      isMacos: conditions.isFalse(),
+    });
+    return step(
+      setupGcloudStep,
+      {
+        name: "Upload canary version file to dl.deno.land",
+        run: [
+          "echo ${{ github.sha }} > canary-latest.txt",
+          'gsutil -h "Cache-Control: no-cache" cp canary-latest.txt gs://dl.deno.land/canary-latest.txt',
+        ],
       },
-    },
-    {
-      name: "Setup gcloud",
-      uses: "google-github-actions/setup-gcloud@v3",
-      with: { project_id: "denoland" },
-    },
-    {
-      name: "Upload canary version file to dl.deno.land",
-      run: [
-        "echo ${{ github.sha }} > canary-latest.txt",
-        'gsutil -h "Cache-Control: no-cache" cp canary-latest.txt gs://dl.deno.land/canary-latest.txt',
-      ],
-    },
-  ),
+    );
+  })(),
 });
 
 // === generate workflow ===
@@ -1248,7 +1317,7 @@ const workflow = createWorkflow({
       "${{ github.workflow }}-${{ !contains(github.event.pull_request.labels.*.name, 'ci-test-flaky') && github.head_ref || github.run_id }}",
     cancelInProgress: true,
   },
-  jobs: [preBuildJob, buildJob, lintJob, libsJob, publishCanaryJob],
+  jobs: [preBuildJob, ...buildJobs, lintJob, libsJob, publishCanaryJob],
 });
 
 export function generate() {
@@ -1283,10 +1352,9 @@ function resolveLibCrates() {
       ),
     ) as { package: { name: string }; bin?: unknown[] };
 
-    // skip binary crates (they need their own build step)
-    if (cargoToml.bin) continue;
-
-    libCrates.push(cargoToml.package.name);
+    if (!cargoToml.bin) {
+      libCrates.push(cargoToml.package.name);
+    }
   }
   return libCrates;
 }

filename: tools/deno.lock.json
patch: @@ -3,7 +3,7 @@
   "specifiers": {
     "jsr:@david/console-static-text@0.3": "0.3.0",
     "jsr:@david/dax@~0.43.2": "0.43.2",
-    "jsr:@david/gagen@0.2.7": "0.2.7",
+    "jsr:@david/gagen@0.2.10": "0.2.10",
     "jsr:@david/path@0.2": "0.2.0",
     "jsr:@david/which@~0.4.1": "0.4.1",
     "jsr:@deno/rust-automation@0.22.2": "0.22.2",
@@ -39,8 +39,8 @@
         "jsr:@std/path@1"
       ]
     },
-    "@david/gagen@0.2.7": {
-      "integrity": "a5a998254c975c0854b1e643eef0dfde208dac541342f8399c11a26731ba6467",
+    "@david/gagen@0.2.10": {
+      "integrity": "85dea2b416399c4fbb57a6846769a7256bb4d9c08e238481d0415d8288fb2003",
       "dependencies": [
         "jsr:@std/yaml@^1.0.11"
       ]