@norskvideo/ctl-dev-kit 0.1.19 → 0.1.21

package/conventions/checks.yml

@@ -29,7 +29,13 @@ jobs:
   drift:
     runs-on: x64
     steps:
+      # clean: false -- the integration suite (shared x64 pool) leaves root-owned
+      # bind-mount dirs under test-temp/ that a non-root git clean can't remove
+      # (EACCES). These jobs never need those files; skip the clean so an innocent
+      # bystander checkout doesn't choke on another workflow's leftovers.
       - uses: actions/checkout@v5
+        with:
+          clean: false
       - name: Shared-conventions drift-check (Workstream I)
         run: |
           nix develop .#build --command bash -c '
@@ -41,7 +47,13 @@ jobs:
   quality:
     runs-on: x64
     steps:
+      # clean: false -- the integration suite (shared x64 pool) leaves root-owned
+      # bind-mount dirs under test-temp/ that a non-root git clean can't remove
+      # (EACCES). These jobs never need those files; skip the clean so an innocent
+      # bystander checkout doesn't choke on another workflow's leftovers.
       - uses: actions/checkout@v5
+        with:
+          clean: false
       - name: Lint + typecheck + unit tests
         run: |
           nix develop .#build --command bash -c '
@@ -54,14 +66,22 @@ jobs:
 
   # Report this pipeline's result to the aggregated product CI dashboard
   # (id3as/ci-workflows) instead of posting its own pony — the dashboard renders
-  # the pony/emoji from the dispatched result. always() so a red or manual run
-  # still reports.
+  # the pony/emoji from the dispatched result. !cancelled() so a real pass/fail
+  # reports, but a cancelled/superseded run does NOT — a cancellation dispatched
+  # as failure would false-red the board on every drained or concurrency-
+  # superseded run.
   notify:
     needs: [drift, quality]
-    if: always() && github.event_name == 'push'
+    if: ${{ !cancelled() && github.event_name == 'push' }}
     runs-on: x64
     steps:
+      # clean: false -- the integration suite (shared x64 pool) leaves root-owned
+      # bind-mount dirs under test-temp/ that a non-root git clean can't remove
+      # (EACCES). These jobs never need those files; skip the clean so an innocent
+      # bystander checkout doesn't choke on another workflow's leftovers.
       - uses: actions/checkout@v5
+        with:
+          clean: false
       - id: meta
         run: |
           if [ "${{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') }}" = "true" ]; then

package/conventions/sync-dev-kit.yml

@@ -43,7 +43,21 @@ jobs:
   sync:
     runs-on: x64
     steps:
+      # Check out with CI_DISPATCH_TOKEN, not the automatic GITHUB_TOKEN: this job
+      # pushes re-synced copies, and the dev-kit single-sources the shared
+      # .github/workflows/ files -- so a sync can rewrite a workflow file, and
+      # GITHUB_TOKEN is categorically barred from pushing under .github/workflows/
+      # (no permissions: key unlocks it). CI_DISPATCH_TOKEN carries the fine-grained
+      # Workflows:write permission, so its push is allowed. The checkout credential
+      # is what both the green push:main and the red branch push authenticate with.
+      # clean: false -- the integration suite (shared x64 pool) leaves root-owned
+      # bind-mount dirs under test-temp/ a non-root git clean can't remove
+      # (EACCES); this job never needs them. `git add -A` below still ignores
+      # them (test-temp is gitignored), so the sync commit stays clean.
       - uses: actions/checkout@v5
+        with:
+          token: ${{ secrets.CI_DISPATCH_TOKEN }}
+          clean: false
 
       - name: Resolve the newest published dev-kit and bump the pin
         id: sync
@@ -108,9 +122,11 @@ jobs:
           forced copies re-synced from the new canonical (sync-drift); check:drift +
           lint + typecheck + unit tests green against the new bytes. Lockfile
           regenerated."
-          # A GITHUB_TOKEN push does not retrigger checks (Actions' recursion
-          # guard) -- fine, the gate above already ran them. Rebase-and-retry so a
-          # commit landing mid-run does not red the sync; a real conflict aborts.
+          # This pushes with CI_DISPATCH_TOKEN (a PAT), so unlike a GITHUB_TOKEN
+          # push it DOES retrigger downstream checks -- intended: the landed sync
+          # should exercise the product's build workflows once (sync-dev-kit itself
+          # is schedule/dispatch-only, so no loop). Rebase-and-retry so a commit
+          # landing mid-run does not red the sync; a real conflict aborts.
           for attempt in 1 2 3 4 5; do
             if git push origin HEAD:main; then exit 0; fi
             echo "push rejected (attempt $attempt) - rebasing onto latest origin/main"
@@ -157,15 +173,20 @@ jobs:
         run: echo "dev-kit pin already current -- nothing to sync."
 
   # Report the sync result to the aggregated product CI dashboard
-  # (id3as/ci-workflows). always() so a failed sync shows a sad pony. A gate-red
-  # run that opened a PR is still a successful sync -- the red lives on the PR's
-  # own checks run, not here.
+  # (id3as/ci-workflows). !cancelled() so a failed sync shows a sad pony but a
+  # cancelled/superseded run does not false-red the board. A gate-red run that
+  # opened a PR is still a successful sync -- the red lives on the PR's own checks
+  # run, not here.
   notify:
     needs: sync
-    if: always()
+    if: ${{ !cancelled() }}
     runs-on: x64
     steps:
+      # clean: false -- see the sync job; avoid a git-clean EACCES on integration's
+      # root-owned test-temp leftovers on the shared x64 pool.
       - uses: actions/checkout@v5
+        with:
+          clean: false
       - id: meta
         run: |
           if [ "${{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') }}" = "true" ]; then

package/conventions/upgrade-latest.yml

@@ -37,7 +37,13 @@ jobs:
       changed: ${{ steps.bump.outputs.changed }}
       summary: ${{ steps.bump.outputs.summary }}
     steps:
+      # clean: false -- the integration suite (shared x64 pool) leaves root-owned
+      # bind-mount dirs under test-temp/ that a non-root git clean can't remove
+      # (EACCES). These jobs never need those files; skip the clean so an innocent
+      # bystander checkout doesn't choke on another workflow's leftovers.
       - uses: actions/checkout@v5
+        with:
+          clean: false
 
       - name: Resolve the nightly channel and rewrite the coupled pins
         id: bump
@@ -192,14 +198,21 @@ jobs:
         run: echo "Nightly pins already current — nothing to bump."
 
   # Report the nightly bump result to the aggregated product CI dashboard
-  # (id3as/ci-workflows). always() so a failed bump shows a sad pony; the summary
-  # rides along as the cell detail.
+  # (id3as/ci-workflows). !cancelled() so a failed bump shows a sad pony (a
+  # cancelled/superseded run must not false-red the board); the summary rides
+  # along as the cell detail.
   notify:
     needs: bump
-    if: always()
+    if: ${{ !cancelled() }}
     runs-on: x64
     steps:
+      # clean: false -- the integration suite (shared x64 pool) leaves root-owned
+      # bind-mount dirs under test-temp/ that a non-root git clean can't remove
+      # (EACCES). These jobs never need those files; skip the clean so an innocent
+      # bystander checkout doesn't choke on another workflow's leftovers.
       - uses: actions/checkout@v5
+        with:
+          clean: false
       - id: meta
         run: |
           if [ "${{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') }}" = "true" ]; then

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@norskvideo/ctl-dev-kit",
-  "version": "0.1.19",
+  "version": "0.1.21",
   "type": "module",
   "exports": {
     "./package.json": "./package.json",