@norskvideo/ctl-dev-kit 0.1.20 → 0.1.22

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (4) hide show
  1. package/conventions/checks.yml +30 -0
  2. package/conventions/sync-dev-kit.yml +23 -3
  3. package/conventions/upgrade-latest.yml +12 -0
  4. package/package.json +1 -1
package/conventions/checks.yml CHANGED
@@ -29,11 +29,23 @@ jobs:
29
29
  drift:
30
30
  runs-on: x64
31
31
  steps:
32
+ # clean: false -- the integration suite (shared x64 pool) leaves root-owned
33
+ # bind-mount dirs under test-temp/ that a non-root git clean can't remove
34
+ # (EACCES). These jobs never need those files; skip the clean so an innocent
35
+ # bystander checkout doesn't choke on another workflow's leftovers.
32
36
  - uses: actions/checkout@v5
37
+ with:
38
+ clean: false
33
39
  - name: Shared-conventions drift-check (Workstream I)
34
40
  run: |
35
41
  nix develop .#build --command bash -c '
36
42
  set -euo pipefail
43
+ # clean:false persists node_modules between runs, and a frozen install
44
+ # will NOT relink a dep/workspace whose pinned version moved -- e.g. a
45
+ # dev-kit bump leaves a stale node_modules/@norskvideo/ctl-dev-kit, so
46
+ # check:drift would run the OLD checker against the new canonical. Nuke
47
+ # every node_modules first so the pinned versions are what actually run.
48
+ find . -name node_modules -type d -prune -exec rm -rf {} + 2>/dev/null || true
37
49
  bun install --frozen-lockfile
38
50
  bun run check:drift
39
51
  '
@@ -41,11 +53,23 @@ jobs:
41
53
  quality:
42
54
  runs-on: x64
43
55
  steps:
56
+ # clean: false -- the integration suite (shared x64 pool) leaves root-owned
57
+ # bind-mount dirs under test-temp/ that a non-root git clean can't remove
58
+ # (EACCES). These jobs never need those files; skip the clean so an innocent
59
+ # bystander checkout doesn't choke on another workflow's leftovers.
44
60
  - uses: actions/checkout@v5
61
+ with:
62
+ clean: false
45
63
  - name: Lint + typecheck + unit tests
46
64
  run: |
47
65
  nix develop .#build --command bash -c '
48
66
  set -euo pipefail
67
+ # clean:false persists node_modules between runs, and a frozen install
68
+ # will NOT relink a dep/workspace whose pinned version moved -- e.g. a
69
+ # dev-kit bump leaves a stale node_modules/@norskvideo/ctl-dev-kit, so
70
+ # check:drift would run the OLD checker against the new canonical. Nuke
71
+ # every node_modules first so the pinned versions are what actually run.
72
+ find . -name node_modules -type d -prune -exec rm -rf {} + 2>/dev/null || true
49
73
  bun install --frozen-lockfile
50
74
  bun run lint
51
75
  bun run typecheck
@@ -63,7 +87,13 @@ jobs:
63
87
  if: ${{ !cancelled() && github.event_name == 'push' }}
64
88
  runs-on: x64
65
89
  steps:
90
+ # clean: false -- the integration suite (shared x64 pool) leaves root-owned
91
+ # bind-mount dirs under test-temp/ that a non-root git clean can't remove
92
+ # (EACCES). These jobs never need those files; skip the clean so an innocent
93
+ # bystander checkout doesn't choke on another workflow's leftovers.
66
94
  - uses: actions/checkout@v5
95
+ with:
96
+ clean: false
67
97
  - id: meta
68
98
  run: |
69
99
  if [ "${{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') }}" = "true" ]; then
package/conventions/sync-dev-kit.yml CHANGED
@@ -43,7 +43,21 @@ jobs:
43
43
  sync:
44
44
  runs-on: x64
45
45
  steps:
46
+ # Check out with CI_DISPATCH_TOKEN, not the automatic GITHUB_TOKEN: this job
47
+ # pushes re-synced copies, and the dev-kit single-sources the shared
48
+ # .github/workflows/ files -- so a sync can rewrite a workflow file, and
49
+ # GITHUB_TOKEN is categorically barred from pushing under .github/workflows/
50
+ # (no permissions: key unlocks it). CI_DISPATCH_TOKEN carries the fine-grained
51
+ # Workflows:write permission, so its push is allowed. The checkout credential
52
+ # is what both the green push:main and the red branch push authenticate with.
53
+ # clean: false -- the integration suite (shared x64 pool) leaves root-owned
54
+ # bind-mount dirs under test-temp/ a non-root git clean can't remove
55
+ # (EACCES); this job never needs them. `git add -A` below still ignores
56
+ # them (test-temp is gitignored), so the sync commit stays clean.
46
57
  - uses: actions/checkout@v5
58
+ with:
59
+ token: ${{ secrets.CI_DISPATCH_TOKEN }}
60
+ clean: false
47
61
 
48
62
  - name: Resolve the newest published dev-kit and bump the pin
49
63
  id: sync
@@ -108,9 +122,11 @@ jobs:
108
122
  forced copies re-synced from the new canonical (sync-drift); check:drift +
109
123
  lint + typecheck + unit tests green against the new bytes. Lockfile
110
124
  regenerated."
111
- # A GITHUB_TOKEN push does not retrigger checks (Actions' recursion
112
- # guard) -- fine, the gate above already ran them. Rebase-and-retry so a
113
- # commit landing mid-run does not red the sync; a real conflict aborts.
125
+ # This pushes with CI_DISPATCH_TOKEN (a PAT), so unlike a GITHUB_TOKEN
126
+ # push it DOES retrigger downstream checks -- intended: the landed sync
127
+ # should exercise the product's build workflows once (sync-dev-kit itself
128
+ # is schedule/dispatch-only, so no loop). Rebase-and-retry so a commit
129
+ # landing mid-run does not red the sync; a real conflict aborts.
114
130
  for attempt in 1 2 3 4 5; do
115
131
  if git push origin HEAD:main; then exit 0; fi
116
132
  echo "push rejected (attempt $attempt) - rebasing onto latest origin/main"
@@ -166,7 +182,11 @@ jobs:
166
182
  if: ${{ !cancelled() }}
167
183
  runs-on: x64
168
184
  steps:
185
+ # clean: false -- see the sync job; avoid a git-clean EACCES on integration's
186
+ # root-owned test-temp leftovers on the shared x64 pool.
169
187
  - uses: actions/checkout@v5
188
+ with:
189
+ clean: false
170
190
  - id: meta
171
191
  run: |
172
192
  if [ "${{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') }}" = "true" ]; then
package/conventions/upgrade-latest.yml CHANGED
@@ -37,7 +37,13 @@ jobs:
37
37
  changed: ${{ steps.bump.outputs.changed }}
38
38
  summary: ${{ steps.bump.outputs.summary }}
39
39
  steps:
40
+ # clean: false -- the integration suite (shared x64 pool) leaves root-owned
41
+ # bind-mount dirs under test-temp/ that a non-root git clean can't remove
42
+ # (EACCES). These jobs never need those files; skip the clean so an innocent
43
+ # bystander checkout doesn't choke on another workflow's leftovers.
40
44
  - uses: actions/checkout@v5
45
+ with:
46
+ clean: false
41
47
 
42
48
  - name: Resolve the nightly channel and rewrite the coupled pins
43
49
  id: bump
@@ -200,7 +206,13 @@ jobs:
200
206
  if: ${{ !cancelled() }}
201
207
  runs-on: x64
202
208
  steps:
209
+ # clean: false -- the integration suite (shared x64 pool) leaves root-owned
210
+ # bind-mount dirs under test-temp/ that a non-root git clean can't remove
211
+ # (EACCES). These jobs never need those files; skip the clean so an innocent
212
+ # bystander checkout doesn't choke on another workflow's leftovers.
203
213
  - uses: actions/checkout@v5
214
+ with:
215
+ clean: false
204
216
  - id: meta
205
217
  run: |
206
218
  if [ "${{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') }}" = "true" ]; then
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@norskvideo/ctl-dev-kit",
3
- "version": "0.1.20",
3
+ "version": "0.1.22",
4
4
  "type": "module",
5
5
  "exports": {
6
6
  "./package.json": "./package.json",