@norskvideo/ctl-dev-kit 0.1.71 → 0.1.72

package/conventions/sync-ctl-packages.yml

@@ -114,8 +114,11 @@ jobs:
       - name: Open (or update) the pin-freshness PR
         if: steps.bump.outputs.changed == '1'
         env:
-          GH_TOKEN: ${{ secrets.CI_DISPATCH_TOKEN }}
+          API_TOKEN: ${{ secrets.CI_DISPATCH_TOKEN }}
           GATE: ${{ steps.gate.outcome }}
+          # Through the env, never interpolated into the script below: see the
+          # heredoc comment for what happens when it is.
+          MOVED: ${{ steps.bump.outputs.moved }}
         run: |
           set -euo pipefail
           branch="chore/sync-ctl-packages"
@@ -130,18 +133,24 @@ jobs:
 
           if [ "$GATE" = "success" ]; then
             verdict="Gate green: check:drift, lint, typecheck and unit tests all pass on the new pins."
-            draft=""
+            draft=false
           else
             verdict="**Gate red** — the new pins do not fit this product as-is. Adopting them is real engineering, not a merge."
-            draft="--draft"
+            draft=true
           fi
 
+          # $MOVED, not the expression that produced it. This heredoc is unquoted
+          # so $verdict expands, which means its literal text is scanned for
+          # command substitution too -- and the moved-pin list names every package
+          # in backticks. Pasted in directly, each name RAN (exit 127, no PR,
+          # every morning since this workflow shipped). Bash does not rescan an
+          # expansion's result, so through the env the same backticks are inert.
           body="$(cat <<EOF
           Automated by \`sync-ctl-packages\`.
 
           ## Pins moved
 
-          ${{ steps.bump.outputs.moved }}
+          $MOVED
 
           ## What the gate proved
 
@@ -153,10 +162,24 @@ jobs:
           EOF
           )"
 
-          if [ -z "$(gh pr list --head "$branch" --state open --json number --jq '.[].number')" ]; then
-            gh pr create $draft --head "$branch" --base main \
-              --title "chore: sync the ctl-* pins to their newest published versions" \
-              --body "$body"
+          # gh is not on the self-hosted runner PATH -- it lives only inside
+          # `nix develop`, and this step runs outside it -- so create/update the
+          # PR straight against the REST API with the same PAT that pushed the
+          # branch. This is the identical fix sync-dev-kit already carries and
+          # documents; it was applied to one sibling convention and not its twin,
+          # so this step failed with exit 127 in every product repo. curl and jq
+          # ARE on the host PATH (the pin-resolve step above uses them).
+          title="chore: sync the ctl-* pins to their newest published versions"
+          repo="${{ github.repository }}"; owner="${repo%%/*}"
+          api="https://api.github.com/repos/$repo/pulls"
+          curl_api=(--fail-with-body -sS -H "Authorization: Bearer $API_TOKEN" -H "Accept: application/vnd.github+json")
+          existing="$(curl "${curl_api[@]}" "$api?head=$owner:$branch&state=open" | jq -r '.[0].number // empty')"
+          if [ -n "$existing" ]; then
+            # draft is not settable by PATCH; the standing PR keeps whichever
+            # state it opened in and the refreshed body carries the verdict.
+            curl "${curl_api[@]}" -X PATCH "$api/$existing" \
+              --data "$(jq -nc --arg t "$title" --arg b "$body" '{title:$t, body:$b}')" >/dev/null
           else
-            gh pr edit "$branch" --body "$body"
+            curl "${curl_api[@]}" -X POST "$api" \
+              --data "$(jq -nc --arg t "$title" --arg b "$body" --arg h "$branch" --argjson d "$draft" '{title:$t, body:$b, head:$h, base:"main", draft:$d}')" >/dev/null
           fi

package/conventions/workflow-shell.ts

@@ -0,0 +1,27 @@
+// Convention workflows carry real shell scripts inside YAML, and the two live in
+// different worlds: the runner's bare PATH outside `nix develop`, a single-quoted
+// word inside `bash -c '...'`. The guards over those hazards all need the same
+// question answered first — is this line inside a quoted block or not — so it is
+// asked in one place.
+
+/** 1-indexed line numbers inside a multi-line `bash -c '` block, which ends at a
+ *  line that is just `'`. A one-liner closing its own quote (`bash -c 'a; b'`)
+ *  opens no block — it is already balanced. */
+export function bashBlockLines(yaml: string): Set<number> {
+  const OPEN = "bash -c '";
+  const inside = new Set<number>();
+  let open = false;
+  yaml.split("\n").forEach((text, i) => {
+    if (!open) {
+      const at = text.indexOf(OPEN);
+      if (at >= 0 && !text.slice(at + OPEN.length).includes("'")) open = true;
+      return;
+    }
+    if (text.trim() === "'") {
+      open = false;
+      return;
+    }
+    inside.add(i + 1);
+  });
+  return inside;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@norskvideo/ctl-dev-kit",
-  "version": "0.1.71",
+  "version": "0.1.72",
   "type": "module",
   "exports": {
     "./create-product": "./create-product/create-product.ts",