From 87a8d6b0dd5eba4f976dd446952a50e2458cc91e Mon Sep 17 00:00:00 2001
From: GPTomek <314538226+gptomek[bot]@users.noreply.github.com>
Date: Sat, 17 Oct 2026 10:36:14 +0000
Subject: [PATCH 1/2] perf(ci): reuse stats renderer for all profile cards

---
 .github/workflows/stats.yml | 91 +++++++++++++++++--------------------
 1 file changed, 42 insertions(+), 49 deletions(-)

diff --git a/.github/workflows/stats.yml b/.github/workflows/stats.yml
index 8b68f0e..1aed9d1 100644
--- a/.github/workflows/stats.yml
+++ b/.github/workflows/stats.yml
@@ -60,68 +60,61 @@ jobs:
             const run = require("./.github/scripts/generate-contributors.cjs");
             await run({ github, core });
 
-      - name: top languages card
+      # Cards run only on manual/reusable invocations. The upstream composite
+      # action bootstraps pnpm, Node, and npm core on *every* use. Prepare once.
+      - name: Checkout stats card renderer
         if: github.event_name == 'workflow_dispatch' || github.event_name == 'workflow_call'
-        uses: stats-organization/github-readme-stats-action@v2
-        with:
-          card: top-langs
-          options: username=${{ github.repository_owner }}&layout=donut&langs_count=13&hide_title=true&theme=ambient_gradient&show_icons=true&locale=pl
-          path: assets/profile/top-langs.svg
-          token: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: feedseek card
-        if: github.event_name == 'workflow_dispatch' || github.event_name == 'workflow_call'
-        uses: stats-organization/github-readme-stats-action@v2
+        uses: actions/checkout@v7
         with:
-          card: pin
-          options: username=${{ github.repository_owner }}&show_icons=true&locale=pl&repo=trvny%2Ffeedseek&theme=great-gatsby&description_lines_count=1
-          path: assets/profile/pin-feeds.svg
-          token: ${{ github.token }}
+          repository: stats-organization/github-readme-stats-action
+          ref: 2c498845f71017821efaad14293ebc736156ef21 # v2.1.0 (v2 tag)
+          path: .github-stats-action
+          persist-credentials: false
 
-      - name: kanarek card
+      - name: Set up pnpm once
         if: github.event_name == 'workflow_dispatch' || github.event_name == 'workflow_call'
-        uses: stats-organization/github-readme-stats-action@v2
+        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
         with:
-          card: pin
-          options: username=${{ github.repository_owner }}&show_icons=true&locale=pl&repo=travnie%2Fkanarek&theme=shades-of-purple&description_lines_count=1
-          path: assets/profile/pin-kanarek.svg
-          token: ${{ github.token }}
+          package_json_file: .github-stats-action/package.json
 
-      - name: tvpi card
+      - name: Set up Node and pnpm cache
         if: github.event_name == 'workflow_dispatch' || github.event_name == 'workflow_call'
-        uses: stats-organization/github-readme-stats-action@v2
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          card: pin
-          options: username=${{ github.repository_owner }}&show_icons=true&locale=pl&repo=trvny%2Ftvpi&theme=yeblu&description_lines_count=1
-          path: assets/profile/pin-tvpi.svg
-          token: ${{ github.token }}
+          node-version-file: .github-stats-action/package.json
+          cache: pnpm
+          cache-dependency-path: .github-stats-action/pnpm-lock.yaml
 
-      - name: wambridge card
+      - name: Install stats renderer dependencies once
         if: github.event_name == 'workflow_dispatch' || github.event_name == 'workflow_call'
-        uses: stats-organization/github-readme-stats-action@v2
-        with:
-          card: pin
-          options: username=${{ github.repository_owner }}&show_icons=true&locale=pl&repo=travnie%2Fwambridge&theme=blue_navy&description_lines_count=1
-          path: assets/profile/pin-wambridge.svg
-          token: ${{ github.token }}
+        working-directory: .github-stats-action
+        run: pnpm install --frozen-lockfile --prod --ignore-scripts
 
-      - name: autka card
+      - name: Generate seven profile cards
         if: github.event_name == 'workflow_dispatch' || github.event_name == 'workflow_call'
-        uses: stats-organization/github-readme-stats-action@v2
-        with:
-          card: pin
-          options: username=${{ github.repository_owner }}&show_icons=true&locale=pl&repo=travnie%2Fautka&theme=synthwave&description_lines_count=1
-          path: assets/profile/pin-autka.svg
-          token: ${{ github.token }}
+        shell: bash
+        env:
+          CARD_OWNER: ${{ github.repository_owner }}
+          CARD_TOKEN: ${{ github.token }}
+          GIST_TOKEN: ${{ secrets.GH_PAT }}
+        run: |
+          set -euo pipefail
+          # Reuse the upstream action's bundled core; no seven repeated npm
+          # installs of core@v2. The action's pinned lockfile supplies core 2.2.0.
+          render() {
+            local card="$1" output="$2" options="$3" token="${4:-$CARD_TOKEN}"
+            INPUT_CARD="$card" INPUT_PATH="$output" INPUT_OPTIONS="$options" \
+              INPUT_CORE_VERSION="" INPUT_FAIL_ON_ERROR="true" PAT_1="$token" \
+              node .github-stats-action/index.js
+          }
+          render top-langs assets/profile/top-langs.svg "username=${CARD_OWNER}&layout=donut&langs_count=13&hide_title=true&theme=ambient_gradient&show_icons=true&locale=pl"
+          render pin assets/profile/pin-feeds.svg "username=${CARD_OWNER}&show_icons=true&locale=pl&repo=trvny%2Ffeedseek&theme=great-gatsby&description_lines_count=1"
+          render pin assets/profile/pin-kanarek.svg "username=${CARD_OWNER}&show_icons=true&locale=pl&repo=travnie%2Fkanarek&theme=shades-of-purple&description_lines_count=1"
+          render pin assets/profile/pin-tvpi.svg "username=${CARD_OWNER}&show_icons=true&locale=pl&repo=trvny%2Ftvpi&theme=yeblu&description_lines_count=1"
+          render pin assets/profile/pin-wambridge.svg "username=${CARD_OWNER}&show_icons=true&locale=pl&repo=travnie%2Fwambridge&theme=blue_navy&description_lines_count=1"
+          render pin assets/profile/pin-autka.svg "username=${CARD_OWNER}&show_icons=true&locale=pl&repo=travnie%2Fautka&theme=synthwave&description_lines_count=1"
+          render gist assets/profile/gist.svg "id=167d2271e3cf7d21e118aa7d906a7d2c&theme=aura" "$GIST_TOKEN"
 
-      - name: gist card
-        if: github.event_name == 'workflow_dispatch' || github.event_name == 'workflow_call'
-        uses: stats-organization/github-readme-stats-action@v2
-        with:
-          card: gist
-          options: id=167d2271e3cf7d21e118aa7d906a7d2c&theme=aura
-          token: ${{ secrets.GH_PAT }}
-          path: assets/profile/gist.svg
 
       - name: Commit profile assets
         run: |

From dc94dfc5f77cb5a87193d400ac9c835c8e9c7701 Mon Sep 17 00:00:00 2001
From: GPTomek <314538226+gptomek[bot]@users.noreply.github.com>
Date: Sat, 17 Oct 2026 10:39:53 +0000
Subject: [PATCH 2/2] fix(ci): scope gist PAT to its renderer step

---
 .github/workflows/stats.yml | 25 ++++++++++++++++++-------
 1 file changed, 18 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/stats.yml b/.github/workflows/stats.yml
index 1aed9d1..6327c38 100644
--- a/.github/workflows/stats.yml
+++ b/.github/workflows/stats.yml
@@ -90,21 +90,19 @@ jobs:
         working-directory: .github-stats-action
         run: pnpm install --frozen-lockfile --prod --ignore-scripts
 
-      - name: Generate seven profile cards
+      - name: Generate six public profile cards
         if: github.event_name == 'workflow_dispatch' || github.event_name == 'workflow_call'
         shell: bash
         env:
           CARD_OWNER: ${{ github.repository_owner }}
           CARD_TOKEN: ${{ github.token }}
-          GIST_TOKEN: ${{ secrets.GH_PAT }}
         run: |
           set -euo pipefail
-          # Reuse the upstream action's bundled core; no seven repeated npm
-          # installs of core@v2. The action's pinned lockfile supplies core 2.2.0.
+          # One upstream Node/pnpm install and bundled core for all cards.
           render() {
-            local card="$1" output="$2" options="$3" token="${4:-$CARD_TOKEN}"
+            local card="$1" output="$2" options="$3"
             INPUT_CARD="$card" INPUT_PATH="$output" INPUT_OPTIONS="$options" \
-              INPUT_CORE_VERSION="" INPUT_FAIL_ON_ERROR="true" PAT_1="$token" \
+              INPUT_CORE_VERSION="" INPUT_FAIL_ON_ERROR="true" PAT_1="$CARD_TOKEN" \
               node .github-stats-action/index.js
           }
           render top-langs assets/profile/top-langs.svg "username=${CARD_OWNER}&layout=donut&langs_count=13&hide_title=true&theme=ambient_gradient&show_icons=true&locale=pl"
@@ -113,7 +111,20 @@ jobs:
           render pin assets/profile/pin-tvpi.svg "username=${CARD_OWNER}&show_icons=true&locale=pl&repo=trvny%2Ftvpi&theme=yeblu&description_lines_count=1"
           render pin assets/profile/pin-wambridge.svg "username=${CARD_OWNER}&show_icons=true&locale=pl&repo=travnie%2Fwambridge&theme=blue_navy&description_lines_count=1"
           render pin assets/profile/pin-autka.svg "username=${CARD_OWNER}&show_icons=true&locale=pl&repo=travnie%2Fautka&theme=synthwave&description_lines_count=1"
-          render gist assets/profile/gist.svg "id=167d2271e3cf7d21e118aa7d906a7d2c&theme=aura" "$GIST_TOKEN"
+
+      - name: Generate gist card with scoped PAT
+        if: github.event_name == 'workflow_dispatch' || github.event_name == 'workflow_call'
+        shell: bash
+        env:
+          CARD_TOKEN: ${{ github.token }}
+          GIST_TOKEN: ${{ secrets.GH_PAT }}
+        run: |
+          set -euo pipefail
+          INPUT_CARD="gist" INPUT_PATH="assets/profile/gist.svg" \
+            INPUT_OPTIONS="id=167d2271e3cf7d21e118aa7d906a7d2c&theme=aura" \
+            INPUT_CORE_VERSION="" INPUT_FAIL_ON_ERROR="true" \
+            PAT_1="${GIST_TOKEN:-$CARD_TOKEN}" \
+            node .github-stats-action/index.js
 
 
       - name: Commit profile assets