[P3] CI duplicate download/run-test blocks across 5 jobs in test.yml — consolidate into the toolchain composite action

[itsmiso-ai]

Ask: Extract the repeated Godot download/install and run-test-suite steps in test.yml into one reusable composite action and have every job call it.
Expected files: .github/workflows/test.yml, .github/actions/load-godot-toolchain/action.yml

Problem:
The CI workflow re-implements the same "download Godot → verify binary → install system deps → run headless smoke test → run all tests/test_*.gd suites" sequence in nearly identical form across five jobs (smoke-test, script-tests, macos-validation, and both Linux export-validation jobs each also download/install templates). A composite action already exists (load-godot-toolchain) but it only resolves version/URL/checksum outputs; the download, unzip, chmod, dependency-install, and the test-suite loop are copy-pasted per job. This makes workflow edits error-prone (a change must be applied in 5+ places) and the OS-specific variants (macos-latest vs ubuntu-latest) drift out of sync — as seen where the macOS job already needs a separate subprocess-based smoke-test wrapper with continue-on-error.

Evidence:

• .github/workflows/test.yml — smoke-test:10, script-tests:53, macos-validation:96, export-validation:184, export-validation-windows:236, export-validation-macos:289, export-validation-web:341
• The "Download Godot" + "Verify Godot binary" + "Install Godot system dependencies" + "Run headless smoke test" + "Run all test suites" blocks are repeated (the run-tests loop appears in both script-tests and macos-validation; the macOS smoke-test additionally reappears as an inline python wrapper at the macos-validation job).
• .github/actions/load-godot-toolchain/action.yml — currently only emits config outputs; it does not perform the download/install.

Acceptance:

• A single composite action (or a shared job template) performs the download, checksum verification, install, and test-suite loop for a given platform/version.
• Each job in test.yml invokes the shared step with the minimal platform-specific inputs (linux_url vs macos_url, template install as needed).
• test.yml has no more than one copy of the run-all-tests suite loop and no more than one copy of the Linux download/install steps.
• CI for all five validation jobs (smoke, script-tests, macOS, export Linux/Windows/macOS/Web) still passes green.

[itsmiso-ai]

Not worth doing yet

Considered but deliberately not filed as separate issues this audit:

• save_game()/load_game() ignore the path argument on web builds (scripts/game_state.gd:103-118). The web branch always reads/writes the fixed SAVE_KEY, ignoring target_path. This is latent API inconsistency, but no current caller passes a path on a web build (the desktop file path and web localStorage key are intentionally different storage backends), and "patching" it would churn the persistence plumbing for no user-visible gain. Revisit only if a multi-save or named-save feature arrives.

• Fresh saves omitting save_version is already self-healing. migrate_save() (game_state.gd:505-506) back-fills a missing version as "current", so missing stamps load correctly today. The real defect — documented in [P2] Dead code in persist() severed save_version stamping — fresh saves omit the version field #345 — is that the stamping code is unreachable, not that existing saves break.

• No dependency/security findings. The only external dependencies are the Godot toolchain (pinned to 4.7.1 with SHA-256 checksums in godot-toolchain.json) and CI actions (pinned by commit SHA). renovate.json is wired to the shared misospace/renovate-config. Nothing actionable.

• Test coverage is already strong (≈7.3k lines of tests vs ≈4.5k lines of scripts, with targeted suites for localStorage/XSS, save schema, reservations, milestones, and tick integration). The two gaps worth filing were the zero-worker tick path ([P2] Ambient-event crash on a zero-worker save — maybe_fire_event indexes an empty workers array #346) and the unaffected save-version path ([P2] Dead code in persist() severed save_version stamping — fresh saves omit the version field #345); the rest of the sim is well covered.

• save_game/load_game desktop fallback when FileAccess.open fails is already surfaced to the player via [P2] Save write failures are silently swallowed — players believe their colony is saved #331/Surface save write failures to the player (Fixes #331) #338 (save-failure announcement). No new finding there.

[itsmiso-ai]

The recent audit comment notes this is "Not worth doing yet," but doesn't specify the rationale or when to revisit. Could you clarify if we should proceed with consolidating the CI blocks into the composite action, or defer until a later cycle?

[itsmiso-ai]

The audit noted this as "Not worth doing yet" but didn't specify the rationale or a clear trigger for revisiting. Could you clarify whether we should proceed with consolidating these blocks, or defer until a specific milestone (e.g., next Godot upgrade, or when CI maintenance overhead becomes noticeable)?