@norskvideo/ctl-dev-kit 0.1.75 → 0.1.77

package/conventions/upgrade-latest.yml

@@ -10,12 +10,18 @@
 # norsk-ctl daemon to the `latest` channel (dev-only; CI downloads ctl
 # directly, so a stale pin never affects CI or customers).
 #
-# Commits the bump straight to main (nightly cron + on demand). The push is
-# made with CI_DISPATCH_TOKEN (a PAT), so it DOES fire the product's push-
-# triggered workflows (checks, build-image, integration) against the bumped
-# pins; a GITHUB_TOKEN push would not (Actions' recursion guard), and the bump
-# would land unverified until the next human push. A red run at 04:2x on main
-# is the signal that a Norsk nightly is bad and the bump needs reverting.
+# Nightly cron + on demand. The bump runs the product's own gate (lint,
+# typecheck, unit tests) BEFORE it lands, exactly as sync-dev-kit does: green
+# lands on main, red opens a reconciliation PR and main stays green.
+#
+# It used to commit straight to main and rely on the push-triggered run for its
+# verdict. The push is made with CI_DISPATCH_TOKEN (a PAT), so that run really
+# does happen -- a GITHUB_TOKEN push would fire nothing (Actions' recursion
+# guard) -- but it makes a RED `main` the alarm, and nobody watches a product
+# repo's own `main`: playout sat red ~12h, then funke, then probe, inside three
+# days (fleet review 04c, class 8). Gating first turns "a bad Norsk nightly reds
+# six repos overnight" into "a bad Norsk nightly opens a PR that says so".
+# Pinned for the class by conventions/gate-before-main.test.ts.
 #
 # Single-sourced in @norskvideo/ctl-dev-kit (conventions/upgrade-latest.yml) and
 # copied verbatim into each product repo; the check:drift gate fails CI if a copy
@@ -202,8 +208,23 @@ jobs:
             done
           '
 
-      - name: Commit the bump to main
+      - name: Run the product gate against the bumped pins
+        id: gate
         if: steps.bump.outputs.changed == '1'
+        # continue-on-error so a red gate can open a PR below instead of failing
+        # the workflow -- which is why the steps after it read `outcome` and not
+        # `conclusion` (continue-on-error rewrites conclusion to success).
+        continue-on-error: true
+        run: |
+          nix develop .#build --command bash -c '
+            set -euo pipefail
+            bun run lint
+            bun run typecheck
+            bun run test:unit
+          '
+
+      - name: Land the bump on main (gate green)
+        if: steps.bump.outputs.changed == '1' && steps.gate.outcome == 'success'
         run: |
           set -euo pipefail
           git config user.name "github-actions[bot]"
@@ -230,6 +251,55 @@ jobs:
           done
           echo "push still failing after 5 rebase attempts"; exit 1
 
+      - name: Open a reconciliation PR (gate red)
+        if: steps.bump.outputs.changed == '1' && steps.gate.outcome == 'failure'
+        env:
+          API_TOKEN: ${{ secrets.CI_DISPATCH_TOKEN }}
+        run: |
+          set -euo pipefail
+          branch="upgrade-latest/nightly"
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git checkout -b "$branch"
+          git add -A
+          git commit -m "chore: bump Norsk nightly + ctl pins to latest channel (needs reconciliation)
+
+          ${{ steps.bump.outputs.summary }}"
+          git push -f origin "$branch"
+          title="Bump Norsk nightly + ctl pins to latest channel"
+          body="$(printf '%s\n' \
+            "Automated nightly pin bump: the Norsk nightly channel moved and the coupled" \
+            "pins came with it -- but the product gate is **red**, so this bump needs a" \
+            "human before it reaches main." \
+            "" \
+            "    ${{ steps.bump.outputs.summary }}" \
+            "" \
+            "A red gate here usually means the new Norsk nightly is bad, or genuinely" \
+            "changed something the product depends on. Run it to see which:" \
+            "" \
+            "    bun run lint && bun run typecheck && bun run test:unit" \
+            "" \
+            "Fix it on this branch and merge, or close this PR to skip the bump -- the" \
+            "next nightly run reopens it against whatever the channel holds then.")"
+          # gh is not on the self-hosted runner PATH (it lives only inside
+          # `nix develop`, and this step runs outside it), so create/update the PR
+          # straight against the REST API with the same PAT that pushed the branch.
+          # The PAT (not GITHUB_TOKEN) is what lets the PR's own checks run, which
+          # is the whole point: the bump is judged before it lands, not after.
+          repo="${{ github.repository }}"; owner="${repo%%/*}"
+          api="https://api.github.com/repos/$repo/pulls"
+          curl_api=(--fail-with-body -sS -H "Authorization: Bearer $API_TOKEN" -H "Accept: application/vnd.github+json")
+          existing="$(curl "${curl_api[@]}" "$api?head=$owner:$branch&state=open" | jq -r '.[0].number // empty')"
+          if [ -n "$existing" ]; then
+            curl "${curl_api[@]}" -X PATCH "$api/$existing" \
+              --data "$(jq -nc --arg t "$title" --arg b "$body" '{title:$t, body:$b}')" > /dev/null
+            echo "updated PR #$existing"
+          else
+            curl "${curl_api[@]}" -X POST "$api" \
+              --data "$(jq -nc --arg t "$title" --arg b "$body" --arg h "$branch" \
+                '{title:$t, body:$b, head:$h, base:"main"}')" | jq -r '"opened PR #\(.number)"'
+          fi
+
       - name: Report "already fresh"
         if: steps.bump.outputs.changed != '1'
         run: echo "Nightly pins already current — nothing to bump."

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@norskvideo/ctl-dev-kit",
-  "version": "0.1.75",
+  "version": "0.1.77",
   "type": "module",
   "exports": {
     "./create-product": "./create-product/create-product.ts",