@norskvideo/ctl-dev-kit 0.1.20 → 0.1.21

package/conventions/checks.yml

@@ -29,7 +29,13 @@ jobs:
   drift:
     runs-on: x64
     steps:
+      # clean: false -- the integration suite (shared x64 pool) leaves root-owned
+      # bind-mount dirs under test-temp/ that a non-root git clean can't remove
+      # (EACCES). These jobs never need those files; skip the clean so an innocent
+      # bystander checkout doesn't choke on another workflow's leftovers.
       - uses: actions/checkout@v5
+        with:
+          clean: false
       - name: Shared-conventions drift-check (Workstream I)
         run: |
           nix develop .#build --command bash -c '
@@ -41,7 +47,13 @@ jobs:
   quality:
     runs-on: x64
     steps:
+      # clean: false -- the integration suite (shared x64 pool) leaves root-owned
+      # bind-mount dirs under test-temp/ that a non-root git clean can't remove
+      # (EACCES). These jobs never need those files; skip the clean so an innocent
+      # bystander checkout doesn't choke on another workflow's leftovers.
       - uses: actions/checkout@v5
+        with:
+          clean: false
       - name: Lint + typecheck + unit tests
         run: |
           nix develop .#build --command bash -c '
@@ -63,7 +75,13 @@ jobs:
     if: ${{ !cancelled() && github.event_name == 'push' }}
     runs-on: x64
     steps:
+      # clean: false -- the integration suite (shared x64 pool) leaves root-owned
+      # bind-mount dirs under test-temp/ that a non-root git clean can't remove
+      # (EACCES). These jobs never need those files; skip the clean so an innocent
+      # bystander checkout doesn't choke on another workflow's leftovers.
       - uses: actions/checkout@v5
+        with:
+          clean: false
       - id: meta
         run: |
           if [ "${{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') }}" = "true" ]; then

package/conventions/sync-dev-kit.yml

@@ -43,7 +43,21 @@ jobs:
   sync:
     runs-on: x64
     steps:
+      # Check out with CI_DISPATCH_TOKEN, not the automatic GITHUB_TOKEN: this job
+      # pushes re-synced copies, and the dev-kit single-sources the shared
+      # .github/workflows/ files -- so a sync can rewrite a workflow file, and
+      # GITHUB_TOKEN is categorically barred from pushing under .github/workflows/
+      # (no permissions: key unlocks it). CI_DISPATCH_TOKEN carries the fine-grained
+      # Workflows:write permission, so its push is allowed. The checkout credential
+      # is what both the green push:main and the red branch push authenticate with.
+      # clean: false -- the integration suite (shared x64 pool) leaves root-owned
+      # bind-mount dirs under test-temp/ a non-root git clean can't remove
+      # (EACCES); this job never needs them. `git add -A` below still ignores
+      # them (test-temp is gitignored), so the sync commit stays clean.
       - uses: actions/checkout@v5
+        with:
+          token: ${{ secrets.CI_DISPATCH_TOKEN }}
+          clean: false
 
       - name: Resolve the newest published dev-kit and bump the pin
         id: sync
@@ -108,9 +122,11 @@ jobs:
           forced copies re-synced from the new canonical (sync-drift); check:drift +
           lint + typecheck + unit tests green against the new bytes. Lockfile
           regenerated."
-          # A GITHUB_TOKEN push does not retrigger checks (Actions' recursion
-          # guard) -- fine, the gate above already ran them. Rebase-and-retry so a
-          # commit landing mid-run does not red the sync; a real conflict aborts.
+          # This pushes with CI_DISPATCH_TOKEN (a PAT), so unlike a GITHUB_TOKEN
+          # push it DOES retrigger downstream checks -- intended: the landed sync
+          # should exercise the product's build workflows once (sync-dev-kit itself
+          # is schedule/dispatch-only, so no loop). Rebase-and-retry so a commit
+          # landing mid-run does not red the sync; a real conflict aborts.
           for attempt in 1 2 3 4 5; do
             if git push origin HEAD:main; then exit 0; fi
             echo "push rejected (attempt $attempt) - rebasing onto latest origin/main"
@@ -166,7 +182,11 @@ jobs:
     if: ${{ !cancelled() }}
     runs-on: x64
     steps:
+      # clean: false -- see the sync job; avoid a git-clean EACCES on integration's
+      # root-owned test-temp leftovers on the shared x64 pool.
       - uses: actions/checkout@v5
+        with:
+          clean: false
       - id: meta
         run: |
           if [ "${{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') }}" = "true" ]; then

package/conventions/upgrade-latest.yml

@@ -37,7 +37,13 @@ jobs:
       changed: ${{ steps.bump.outputs.changed }}
       summary: ${{ steps.bump.outputs.summary }}
     steps:
+      # clean: false -- the integration suite (shared x64 pool) leaves root-owned
+      # bind-mount dirs under test-temp/ that a non-root git clean can't remove
+      # (EACCES). These jobs never need those files; skip the clean so an innocent
+      # bystander checkout doesn't choke on another workflow's leftovers.
       - uses: actions/checkout@v5
+        with:
+          clean: false
 
       - name: Resolve the nightly channel and rewrite the coupled pins
         id: bump
@@ -200,7 +206,13 @@ jobs:
     if: ${{ !cancelled() }}
     runs-on: x64
     steps:
+      # clean: false -- the integration suite (shared x64 pool) leaves root-owned
+      # bind-mount dirs under test-temp/ that a non-root git clean can't remove
+      # (EACCES). These jobs never need those files; skip the clean so an innocent
+      # bystander checkout doesn't choke on another workflow's leftovers.
       - uses: actions/checkout@v5
+        with:
+          clean: false
       - id: meta
         run: |
           if [ "${{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') }}" = "true" ]; then

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@norskvideo/ctl-dev-kit",
-  "version": "0.1.20",
+  "version": "0.1.21",
   "type": "module",
   "exports": {
     "./package.json": "./package.json",