@norskvideo/ctl-dev-kit 0.1.21 → 0.1.23

package/conventions/checks.yml

@@ -40,6 +40,12 @@ jobs:
         run: |
           nix develop .#build --command bash -c '
             set -euo pipefail
+            # clean:false persists node_modules between runs, and a frozen install
+            # will NOT relink a dep/workspace whose pinned version moved -- e.g. a
+            # dev-kit bump leaves a stale node_modules/@norskvideo/ctl-dev-kit, so
+            # check:drift would run the OLD checker against the new canonical. Nuke
+            # every node_modules first so the pinned versions are what actually run.
+            find . -name node_modules -type d -prune -exec rm -rf {} + 2>/dev/null || true
             bun install --frozen-lockfile
             bun run check:drift
           '
@@ -58,6 +64,12 @@ jobs:
         run: |
           nix develop .#build --command bash -c '
             set -euo pipefail
+            # clean:false persists node_modules between runs, and a frozen install
+            # will NOT relink a dep/workspace whose pinned version moved -- e.g. a
+            # dev-kit bump leaves a stale node_modules/@norskvideo/ctl-dev-kit, so
+            # check:drift would run the OLD checker against the new canonical. Nuke
+            # every node_modules first so the pinned versions are what actually run.
+            find . -name node_modules -type d -prune -exec rm -rf {} + 2>/dev/null || true
             bun install --frozen-lockfile
             bun run lint
             bun run typecheck

package/conventions/sync-dev-kit.yml

@@ -138,7 +138,7 @@ jobs:
       - name: Open a reconciliation PR (gate red)
         if: steps.sync.outputs.changed == '1' && steps.gate.outcome == 'failure'
         env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          API_TOKEN: ${{ secrets.CI_DISPATCH_TOKEN }}
         run: |
           set -euo pipefail
           branch="sync-dev-kit/${{ steps.sync.outputs.new }}"
@@ -162,10 +162,22 @@ jobs:
             "    bun run lint && bun run typecheck && bun run test:unit   # a convention that breaks real code" \
             "" \
             "Resolve whichever is failing, pushing to this branch until green -- then merge.")"
-          if existing="$(gh pr list --head "$branch" --state open --json number -q '.[0].number')" && [ -n "$existing" ]; then
-            gh pr edit "$existing" --title "$title" --body "$body"
+          # gh is not on the self-hosted runner PATH (it lives only inside
+          # `nix develop`, and this step runs outside it), so create/update the PR
+          # straight against the REST API with the same PAT that pushed the branch.
+          # Using the PAT (not GITHUB_TOKEN) lets the PR's own checks run so a human
+          # sees the red/green. curl+jq are on the host PATH (the pin-resolve step
+          # above already uses them).
+          repo="${{ github.repository }}"; owner="${repo%%/*}"
+          api="https://api.github.com/repos/$repo/pulls"
+          curl_api=(--fail-with-body -sS -H "Authorization: Bearer $API_TOKEN" -H "Accept: application/vnd.github+json")
+          existing="$(curl "${curl_api[@]}" "$api?head=$owner:$branch&state=open" | jq -r '.[0].number // empty')"
+          if [ -n "$existing" ]; then
+            curl "${curl_api[@]}" -X PATCH "$api/$existing" \
+              --data "$(jq -nc --arg t "$title" --arg b "$body" '{title:$t, body:$b}')" >/dev/null
           else
-            gh pr create --base main --head "$branch" --title "$title" --body "$body"
+            curl "${curl_api[@]}" -X POST "$api" \
+              --data "$(jq -nc --arg t "$title" --arg b "$body" --arg h "$branch" '{title:$t, body:$b, head:$h, base:"main"}')" >/dev/null
           fi
 
       - name: Report "already fresh"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@norskvideo/ctl-dev-kit",
-  "version": "0.1.21",
+  "version": "0.1.23",
   "type": "module",
   "exports": {
     "./package.json": "./package.json",