chore: turn the CI workflow into a scaffold and document pnpm

[fey]

Closes part of #42.

Why

.github/workflows/nodeci.yml was added yesterday in #43 so the example repo would pass its own CI. That fixed item 4 of #42, but it broke the exercise the repo exists for: the CI course tells the student to write the workflow.

• Lesson 300-jobs: «Форкните репозиторий … Создайте воркфлоу. В нем должны быть три шага: make setup, make lint, make test»
• Lesson 380-actions: «добавьте в воркфлоу экшен hexlet-components/hello-from-hexlet-action@release»

A fork currently arrives with all of that already written, so the self-study is done for the student.

What changed

nodeci.yml is renamed to main.yml and turned into a scaffold. Everything the student is not asked to figure out stays in place — checkout, pnpm and setup-node, including the pnpm-before-setup-node ordering that would otherwise make them fail on an unrelated topic. The three make steps move behind BEGIN / END markers:

      # BEGIN
      # Set the project up, run the linter and run the tests.
      # END

The marker comment deliberately says nothing about the Hexlet action — that is the next lesson’s task.

The file is named main.yml because that is the path the course points at as the reference: https://github.com/hexlet-components/hexlet-ci-app/blob/final/.github/workflows/main.yml. With the same name on both branches, the difference between a fresh fork and the reference is exactly the marked region.

on: is no longer filtered to main. The reference branch final needs the workflow to run there too, otherwise its README badge has no status. The cost is two runs per in-repo PR, which is what the previous reference did as well.

README said NPM >= 10.x while the Makefile calls pnpm. Lesson 300-jobs step 2 tells the student to read the README, so that mismatch sends them to install the wrong tool.

The trade-off, stated plainly

main no longer runs lint and test in CI. The workflow stays green but checks nothing, so PRs into main — including Dependabot ones — are not validated by a build any more. This is the opposite of what the last paragraph of #42 asked for, and it undoes part of #43 on purpose: the repository exists as course material first. pr-title.yml is untouched and still enforces conventional titles.

If keeping real checks on main matters more, the alternative is a second workflow under a different name — but then the fork ships a working CI again and we are back to the exercise being pre-solved.

Next

The filled-in reference goes to final, rebuilt from current main. That branch is 17 commits behind and still on Strapi 4.2.3 / jest 28 / node >=12 <=16, which is the rest of #42.