ci: authenticate Turbo remote cache via GitHub OIDC

[yamcodes]

Summary

• Port of #1644 (OIDC Turbo remote cache) onto default branch dev. Pattern-matched, not cherry-picked — package layout and workflows differ between v1 and dev.
• Shared composite .github/actions/setup-turbo-remote-cache exchanges GitHub OIDC for a short-lived Vercel Remote Cache token after checkout on every job that runs Turbo.
• #1106 is already closed from the v1 merge; this extends the same fix to dev (and thus main deploys). Do not delete the TURBO_TOKEN GitHub secret until this PR merges. After both v1 and dev use OIDC, the secret can go.

Assumes the Vercel Turborepo CLI OIDC policy for yamcodes/arkenv and TURBO_TEAM are already set (same as #1644).

Test plan

• PR test workflow: setup step succeeds
• Turbo logs Remote caching enabled
• No Insufficient permissions to write to remote cache on test / test-build / test-e2e
• Optional: re-run the same workflow on this SHA and look for remote cache hits across jobs

Made with Cursor

[changeset-bot]

⚠️ No Changeset found

Latest commit: 2d50597

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[pullfrog]

ℹ️ Minor suggestions only — the OIDC swap is correct and complete; two small cleanups were left behind.

Reviewed changes

• New shared composite action — .github/actions/setup-turbo-remote-cache/action.yml exchanges GitHub OIDC for a short-lived Vercel turbo cache token via vercel/setup-turborepo-remote-cache-action@v1.1.0, guarded to skip fork pull_request runs where GitHub withholds OIDC (ports #1644 verbatim).
• Value swap across all turbo-running workflows — removed the TURBO_TOKEN/TURBO_TEAM env from test.yml, deploy-www.yml, deploy-www-manual.yml, pkg-pr-new.yml, release.yml, size-limit.yml, and preview-www-reusable.yml, and added the setup step after checkout in every turbo-running job (all 7 test.yml jobs included, down to the matrix/schedule variants).
• permissions: hardening — id-token: write added at workflow/job level everywhere the action runs; test.yml explicitly retains actions: write (needed for actions/cache saves and artifact uploads) and the preview callers keep pull-requests: write.

Fork coverage, OIDC-mint rules (schedule/workflow_dispatch/pull_request_target all mint; the action's if guard handles the one legit skip case), and the secrets.TURBO_TOKEN end-state are all consistent with the #1644 reference and the repo's existing patterns.

ℹ️ Nitpicks

• After dropping turbo_token/turbo_team from the size-limit.yml with: block, .github/actions/size-limit/action.yml still declares both inputs and src/config.ts/src/size-limit/run.ts still read them. They're inert — config.ts no-ops on empty input and run.ts falls back to the TURBO_TOKEN/TURBO_TEAM the setup action exports — but they're the last TURBO_TOKEN-shaped config standing once the secret is deleted. Consider removing both inputs (and the INPUT_TURBO_* env mappings) as a follow-up.
• preview-www-default.yml and preview-www-labeled.yml add id-token: write at the caller job, but the reusable workflow's Deploy-Preview job already declares its own job-level permissions including the new id-token: write. For same-repo reusable workflows GitHub only requires the caller-level grant when the reusable workflow is external to the org, so these are redundant — harmless (neither caller requests a token itself), just not needed.

  ^{｜ Fix it ➔ ｜ View workflow run ｜ Using DeepSeek Flash (free via Pullfrog for OSS) ｜ 𝕏}

[cursor]

Triaging the Pullfrog nits as non-blocking for this port of #1644:

• size-limit leftover turbo_token/turbo_team inputs — agreed they are inert (config.ts no-ops on empty input; run.ts uses the env the OIDC setup action exports). Leaving them for a follow-up rather than expanding this PR beyond the workflow/OIDC swap.
• Caller id-token: write on preview-www default/labeled — redundant with the reusable job permissions for a same-repo workflow, and harmless. Keeping the explicit caller grant.

No code change for either.