@norskvideo/ctl-dev-kit 0.1.76 → 0.1.78

package/conventions/build-docs.yml

@@ -56,9 +56,27 @@ jobs:
           docker run --rm --user 0:0 -v "$tt":/t alpine sh \
             -c 'rm -rf /t/* /t/.[!.]* 2>/dev/null || true' || rm -rf "$tt"/* 2>/dev/null || true
 
+      # Root-owned leftovers under test-temp/ are what `clean: false` used to route
+      # around: the integration suite bind-mounts host dirs into containers, and a
+      # non-root git clean then EACCESes on what they wrote -- taking down whatever
+      # innocent job checked out next. Skipping the clean cured that symptom and
+      # caused another: every gitignored artifact survived between runs, so a test
+      # could pass on build output an earlier job left behind and go red the first
+      # time it landed on a cold runner (probe, 2026-09-01). Clear the leftovers
+      # from a root container FIRST, and the checkout can clean properly again.
+      # Best-effort by construction: no docker, no test-temp, or a failed run all
+      # fall through without failing the job.
+      - name: Clear stale root-owned test-temp (pre-checkout)
+        run: |
+          set -uo pipefail
+          tt="$GITHUB_WORKSPACE/test-temp"
+          [ -d "$tt" ] || exit 0
+          docker run --rm --user 0:0 -v "$tt":/t alpine sh \
+            -c 'rm -rf /t/* /t/.[!.]* 2>/dev/null || true' || rm -rf "$tt"/* 2>/dev/null || true
+
       - uses: actions/checkout@v5
         with:
-          clean: false
+          clean: true
 
       - name: Write the Norsk license (from the org secret)
         env:
@@ -113,7 +131,7 @@ jobs:
         run: |
           nix develop .#build --command bash -c '
             set -euo pipefail
-            # clean:false persists node_modules between runs for speed, but a
+            # Belt-and-braces now that the checkout cleans: a persisted node_modules
             # workspace dep whose version moved leaves stale copies that
             # --frozen-lockfile does not reliably relink, so a new export is "not
             # found". Nuke EVERY node_modules — including nested per-workspace ones

package/conventions/build-image.yml

@@ -66,9 +66,27 @@ jobs:
       # publish job gates on this output instead of on PUBLISH_IMAGE directly.
       publish: ${{ steps.gen.outputs.publish }}
     steps:
+      # Root-owned leftovers under test-temp/ are what `clean: false` used to route
+      # around: the integration suite bind-mounts host dirs into containers, and a
+      # non-root git clean then EACCESes on what they wrote -- taking down whatever
+      # innocent job checked out next. Skipping the clean cured that symptom and
+      # caused another: every gitignored artifact survived between runs, so a test
+      # could pass on build output an earlier job left behind and go red the first
+      # time it landed on a cold runner (probe, 2026-09-01). Clear the leftovers
+      # from a root container FIRST, and the checkout can clean properly again.
+      # Best-effort by construction: no docker, no test-temp, or a failed run all
+      # fall through without failing the job.
+      - name: Clear stale root-owned test-temp (pre-checkout)
+        run: |
+          set -uo pipefail
+          tt="$GITHUB_WORKSPACE/test-temp"
+          [ -d "$tt" ] || exit 0
+          docker run --rm --user 0:0 -v "$tt":/t alpine sh \
+            -c 'rm -rf /t/* /t/.[!.]* 2>/dev/null || true' || rm -rf "$tt"/* 2>/dev/null || true
+
       - uses: actions/checkout@v5
         with:
-          clean: false
+          clean: true
       - id: gen
         run: |
           label="$(date -u +%Y-%m-%d)-$(git rev-parse --short=8 HEAD)"
@@ -91,13 +109,27 @@ jobs:
             arch: arm64
     runs-on: ${{ matrix.runner }}
     steps:
-      # clean: false -- the integration suite (shared pool) leaves root-owned
-      # bind-mount dirs under test-temp/ that a non-root git clean can't remove
-      # (EACCES). This job never needs them; skip the clean so it doesn't choke on
-      # another workflow's leftovers.
+      # Root-owned leftovers under test-temp/ are what `clean: false` used to route
+      # around: the integration suite bind-mounts host dirs into containers, and a
+      # non-root git clean then EACCESes on what they wrote -- taking down whatever
+      # innocent job checked out next. Skipping the clean cured that symptom and
+      # caused another: every gitignored artifact survived between runs, so a test
+      # could pass on build output an earlier job left behind and go red the first
+      # time it landed on a cold runner (probe, 2026-09-01). Clear the leftovers
+      # from a root container FIRST, and the checkout can clean properly again.
+      # Best-effort by construction: no docker, no test-temp, or a failed run all
+      # fall through without failing the job.
+      - name: Clear stale root-owned test-temp (pre-checkout)
+        run: |
+          set -uo pipefail
+          tt="$GITHUB_WORKSPACE/test-temp"
+          [ -d "$tt" ] || exit 0
+          docker run --rm --user 0:0 -v "$tt":/t alpine sh \
+            -c 'rm -rf /t/* /t/.[!.]* 2>/dev/null || true' || rm -rf "$tt"/* 2>/dev/null || true
+
       - uses: actions/checkout@v5
         with:
-          clean: false
+          clean: true
 
       - name: Build product image (copy-only, via the dev-kit driver, native ${{ matrix.arch }})
         run: |
@@ -133,9 +165,27 @@ jobs:
     if: ${{ needs.label.outputs.publish == 'true' && !inputs.dry_run }}
     runs-on: x64
     steps:
+      # Root-owned leftovers under test-temp/ are what `clean: false` used to route
+      # around: the integration suite bind-mounts host dirs into containers, and a
+      # non-root git clean then EACCESes on what they wrote -- taking down whatever
+      # innocent job checked out next. Skipping the clean cured that symptom and
+      # caused another: every gitignored artifact survived between runs, so a test
+      # could pass on build output an earlier job left behind and go red the first
+      # time it landed on a cold runner (probe, 2026-09-01). Clear the leftovers
+      # from a root container FIRST, and the checkout can clean properly again.
+      # Best-effort by construction: no docker, no test-temp, or a failed run all
+      # fall through without failing the job.
+      - name: Clear stale root-owned test-temp (pre-checkout)
+        run: |
+          set -uo pipefail
+          tt="$GITHUB_WORKSPACE/test-temp"
+          [ -d "$tt" ] || exit 0
+          docker run --rm --user 0:0 -v "$tt":/t alpine sh \
+            -c 'rm -rf /t/* /t/.[!.]* 2>/dev/null || true' || rm -rf "$tt"/* 2>/dev/null || true
+
       - uses: actions/checkout@v5
         with:
-          clean: false
+          clean: true
 
       - name: Log in to Docker Hub
         uses: docker/login-action@65b78e6e13532edd9afa3aa52ac7964289d1a9c1
@@ -166,9 +216,27 @@ jobs:
     if: ${{ !cancelled() }}
     runs-on: x64
     steps:
+      # Root-owned leftovers under test-temp/ are what `clean: false` used to route
+      # around: the integration suite bind-mounts host dirs into containers, and a
+      # non-root git clean then EACCESes on what they wrote -- taking down whatever
+      # innocent job checked out next. Skipping the clean cured that symptom and
+      # caused another: every gitignored artifact survived between runs, so a test
+      # could pass on build output an earlier job left behind and go red the first
+      # time it landed on a cold runner (probe, 2026-09-01). Clear the leftovers
+      # from a root container FIRST, and the checkout can clean properly again.
+      # Best-effort by construction: no docker, no test-temp, or a failed run all
+      # fall through without failing the job.
+      - name: Clear stale root-owned test-temp (pre-checkout)
+        run: |
+          set -uo pipefail
+          tt="$GITHUB_WORKSPACE/test-temp"
+          [ -d "$tt" ] || exit 0
+          docker run --rm --user 0:0 -v "$tt":/t alpine sh \
+            -c 'rm -rf /t/* /t/.[!.]* 2>/dev/null || true' || rm -rf "$tt"/* 2>/dev/null || true
+
       - uses: actions/checkout@v5
         with:
-          clean: false
+          clean: true
       - id: meta
         run: |
           if [ "${{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') }}" = "true" ]; then

package/conventions/checks.yml

@@ -30,22 +30,36 @@ jobs:
   drift:
     runs-on: x64
     steps:
-      # clean: false -- the integration suite (shared x64 pool) leaves root-owned
-      # bind-mount dirs under test-temp/ that a non-root git clean can't remove
-      # (EACCES). These jobs never need those files; skip the clean so an innocent
-      # bystander checkout doesn't choke on another workflow's leftovers.
+      # Root-owned leftovers under test-temp/ are what `clean: false` used to route
+      # around: the integration suite bind-mounts host dirs into containers, and a
+      # non-root git clean then EACCESes on what they wrote -- taking down whatever
+      # innocent job checked out next. Skipping the clean cured that symptom and
+      # caused another: every gitignored artifact survived between runs, so a test
+      # could pass on build output an earlier job left behind and go red the first
+      # time it landed on a cold runner (probe, 2026-09-01). Clear the leftovers
+      # from a root container FIRST, and the checkout can clean properly again.
+      # Best-effort by construction: no docker, no test-temp, or a failed run all
+      # fall through without failing the job.
+      - name: Clear stale root-owned test-temp (pre-checkout)
+        run: |
+          set -uo pipefail
+          tt="$GITHUB_WORKSPACE/test-temp"
+          [ -d "$tt" ] || exit 0
+          docker run --rm --user 0:0 -v "$tt":/t alpine sh \
+            -c 'rm -rf /t/* /t/.[!.]* 2>/dev/null || true' || rm -rf "$tt"/* 2>/dev/null || true
+
       - uses: actions/checkout@v5
         with:
-          clean: false
+          clean: true
       - name: Shared-conventions drift-check (Workstream I)
         run: |
           nix develop .#build --command bash -c '
             set -euo pipefail
-            # clean:false persists node_modules between runs, and a frozen install
-            # will NOT relink a dep/workspace whose pinned version moved -- e.g. a
-            # dev-kit bump leaves a stale node_modules/@norskvideo/ctl-dev-kit, so
-            # check:drift would run the OLD checker against the new canonical. Nuke
-            # every node_modules first so the pinned versions are what actually run.
+            # Belt-and-braces now that the checkout cleans: a persisted
+            # node_modules would defeat a frozen install, which does NOT relink a
+            # dep whose pinned version moved (a dev-kit bump leaves a stale
+            # node_modules/@norskvideo/ctl-dev-kit, so check:drift would run the
+            # OLD checker against the new canonical). Cheap when already gone.
             find . -name node_modules -type d -prune -exec rm -rf {} + 2>/dev/null || true
             bun install --frozen-lockfile
             bun run check:drift
@@ -54,22 +68,36 @@ jobs:
   quality:
     runs-on: x64
     steps:
-      # clean: false -- the integration suite (shared x64 pool) leaves root-owned
-      # bind-mount dirs under test-temp/ that a non-root git clean can't remove
-      # (EACCES). These jobs never need those files; skip the clean so an innocent
-      # bystander checkout doesn't choke on another workflow's leftovers.
+      # Root-owned leftovers under test-temp/ are what `clean: false` used to route
+      # around: the integration suite bind-mounts host dirs into containers, and a
+      # non-root git clean then EACCESes on what they wrote -- taking down whatever
+      # innocent job checked out next. Skipping the clean cured that symptom and
+      # caused another: every gitignored artifact survived between runs, so a test
+      # could pass on build output an earlier job left behind and go red the first
+      # time it landed on a cold runner (probe, 2026-09-01). Clear the leftovers
+      # from a root container FIRST, and the checkout can clean properly again.
+      # Best-effort by construction: no docker, no test-temp, or a failed run all
+      # fall through without failing the job.
+      - name: Clear stale root-owned test-temp (pre-checkout)
+        run: |
+          set -uo pipefail
+          tt="$GITHUB_WORKSPACE/test-temp"
+          [ -d "$tt" ] || exit 0
+          docker run --rm --user 0:0 -v "$tt":/t alpine sh \
+            -c 'rm -rf /t/* /t/.[!.]* 2>/dev/null || true' || rm -rf "$tt"/* 2>/dev/null || true
+
       - uses: actions/checkout@v5
         with:
-          clean: false
+          clean: true
       - name: Lint + typecheck + unit tests
         run: |
           nix develop .#build --command bash -c '
             set -euo pipefail
-            # clean:false persists node_modules between runs, and a frozen install
-            # will NOT relink a dep/workspace whose pinned version moved -- e.g. a
-            # dev-kit bump leaves a stale node_modules/@norskvideo/ctl-dev-kit, so
-            # check:drift would run the OLD checker against the new canonical. Nuke
-            # every node_modules first so the pinned versions are what actually run.
+            # Belt-and-braces now that the checkout cleans: a persisted
+            # node_modules would defeat a frozen install, which does NOT relink a
+            # dep whose pinned version moved (a dev-kit bump leaves a stale
+            # node_modules/@norskvideo/ctl-dev-kit, so check:drift would run the
+            # OLD checker against the new canonical). Cheap when already gone.
             find . -name node_modules -type d -prune -exec rm -rf {} + 2>/dev/null || true
             bun install --frozen-lockfile
             bun run lint
@@ -132,13 +160,27 @@ jobs:
     if: ${{ !cancelled() && github.event_name == 'push' }}
     runs-on: x64
     steps:
-      # clean: false -- the integration suite (shared x64 pool) leaves root-owned
-      # bind-mount dirs under test-temp/ that a non-root git clean can't remove
-      # (EACCES). These jobs never need those files; skip the clean so an innocent
-      # bystander checkout doesn't choke on another workflow's leftovers.
+      # Root-owned leftovers under test-temp/ are what `clean: false` used to route
+      # around: the integration suite bind-mounts host dirs into containers, and a
+      # non-root git clean then EACCESes on what they wrote -- taking down whatever
+      # innocent job checked out next. Skipping the clean cured that symptom and
+      # caused another: every gitignored artifact survived between runs, so a test
+      # could pass on build output an earlier job left behind and go red the first
+      # time it landed on a cold runner (probe, 2026-09-01). Clear the leftovers
+      # from a root container FIRST, and the checkout can clean properly again.
+      # Best-effort by construction: no docker, no test-temp, or a failed run all
+      # fall through without failing the job.
+      - name: Clear stale root-owned test-temp (pre-checkout)
+        run: |
+          set -uo pipefail
+          tt="$GITHUB_WORKSPACE/test-temp"
+          [ -d "$tt" ] || exit 0
+          docker run --rm --user 0:0 -v "$tt":/t alpine sh \
+            -c 'rm -rf /t/* /t/.[!.]* 2>/dev/null || true' || rm -rf "$tt"/* 2>/dev/null || true
+
       - uses: actions/checkout@v5
         with:
-          clean: false
+          clean: true
       - id: meta
         run: |
           if [ "${{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') }}" = "true" ]; then

package/conventions/publish-docs.yml

@@ -55,9 +55,27 @@ jobs:
           docker run --rm --user 0:0 -v "$tt":/t alpine sh \
             -c 'rm -rf /t/* /t/.[!.]* 2>/dev/null || true' || rm -rf "$tt"/* 2>/dev/null || true
 
+      # Root-owned leftovers under test-temp/ are what `clean: false` used to route
+      # around: the integration suite bind-mounts host dirs into containers, and a
+      # non-root git clean then EACCESes on what they wrote -- taking down whatever
+      # innocent job checked out next. Skipping the clean cured that symptom and
+      # caused another: every gitignored artifact survived between runs, so a test
+      # could pass on build output an earlier job left behind and go red the first
+      # time it landed on a cold runner (probe, 2026-09-01). Clear the leftovers
+      # from a root container FIRST, and the checkout can clean properly again.
+      # Best-effort by construction: no docker, no test-temp, or a failed run all
+      # fall through without failing the job.
+      - name: Clear stale root-owned test-temp (pre-checkout)
+        run: |
+          set -uo pipefail
+          tt="$GITHUB_WORKSPACE/test-temp"
+          [ -d "$tt" ] || exit 0
+          docker run --rm --user 0:0 -v "$tt":/t alpine sh \
+            -c 'rm -rf /t/* /t/.[!.]* 2>/dev/null || true' || rm -rf "$tt"/* 2>/dev/null || true
+
       - uses: actions/checkout@v5
         with:
-          clean: false
+          clean: true
 
       - name: Write the Norsk license (from the org secret)
         env:
@@ -112,7 +130,7 @@ jobs:
         run: |
           nix develop .#build --command bash -c '
             set -euo pipefail
-            # clean:false persists node_modules between runs for speed, but a
+            # Belt-and-braces now that the checkout cleans: a persisted node_modules
             # workspace dep whose version moved leaves stale copies that
             # --frozen-lockfile does not reliably relink, so a new export is "not
             # found". Nuke EVERY node_modules — including nested per-workspace ones

package/conventions/smoke.yml

@@ -66,7 +66,7 @@ jobs:
 
       - uses: actions/checkout@v5
         with:
-          clean: false
+          clean: true
 
       # A containerised runner (docker-outside-of-docker) reaches host-published
       # ports via the host-gateway alias and can join norsk-net for direct reach;
@@ -238,9 +238,20 @@ jobs:
     if: ${{ !cancelled() && github.event_name != 'repository_dispatch' }}
     runs-on: x64
     steps:
+      # Same reason as the first checkout in this file: clear root-owned leftovers
+      # from a root container so the checkout below can clean properly. Best-effort
+      # by construction -- no docker, no test-temp, or a failed run all fall through.
+      - name: Clear stale root-owned test-temp (pre-checkout)
+        run: |
+          set -uo pipefail
+          tt="$GITHUB_WORKSPACE/test-temp"
+          [ -d "$tt" ] || exit 0
+          docker run --rm --user 0:0 -v "$tt":/t alpine sh \
+            -c 'rm -rf /t/* /t/.[!.]* 2>/dev/null || true' || rm -rf "$tt"/* 2>/dev/null || true
+
       - uses: actions/checkout@v5
         with:
-          clean: false
+          clean: true
       - id: meta
         run: |
           if [ "${{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') }}" = "true" ]; then

package/conventions/sync-ctl-packages.yml

@@ -41,16 +41,28 @@ jobs:
   sync:
     runs-on: x64
     steps:
-      # CI_DISPATCH_TOKEN, not the automatic GITHUB_TOKEN: a PR opened by
-      # GITHUB_TOKEN raises no workflow runs, so the product's own build, smoke
-      # and integration would never execute against the new pins -- which is the
-      # entire reason for opening it. clean: false for the same reason as the
-      # other shared jobs: the suites leave root-owned bind-mount dirs under
-      # test-temp/ that a non-root git clean cannot remove.
+      # Root-owned leftovers under test-temp/ are what `clean: false` used to route
+      # around: the integration suite bind-mounts host dirs into containers, and a
+      # non-root git clean then EACCESes on what they wrote -- taking down whatever
+      # innocent job checked out next. Skipping the clean cured that symptom and
+      # caused another: every gitignored artifact survived between runs, so a test
+      # could pass on build output an earlier job left behind and go red the first
+      # time it landed on a cold runner (probe, 2026-09-01). Clear the leftovers
+      # from a root container FIRST, and the checkout can clean properly again.
+      # Best-effort by construction: no docker, no test-temp, or a failed run all
+      # fall through without failing the job.
+      - name: Clear stale root-owned test-temp (pre-checkout)
+        run: |
+          set -uo pipefail
+          tt="$GITHUB_WORKSPACE/test-temp"
+          [ -d "$tt" ] || exit 0
+          docker run --rm --user 0:0 -v "$tt":/t alpine sh \
+            -c 'rm -rf /t/* /t/.[!.]* 2>/dev/null || true' || rm -rf "$tt"/* 2>/dev/null || true
+
       - uses: actions/checkout@v5
         with:
           token: ${{ secrets.CI_DISPATCH_TOKEN }}
-          clean: false
+          clean: true
 
       - name: Resolve the newest published ctl-* packages and rewrite the pins
         id: bump

package/conventions/sync-dev-kit.yml

@@ -43,21 +43,28 @@ jobs:
   sync:
     runs-on: x64
     steps:
-      # Check out with CI_DISPATCH_TOKEN, not the automatic GITHUB_TOKEN: this job
-      # pushes re-synced copies, and the dev-kit single-sources the shared
-      # .github/workflows/ files -- so a sync can rewrite a workflow file, and
-      # GITHUB_TOKEN is categorically barred from pushing under .github/workflows/
-      # (no permissions: key unlocks it). CI_DISPATCH_TOKEN carries the fine-grained
-      # Workflows:write permission, so its push is allowed. The checkout credential
-      # is what both the green push:main and the red branch push authenticate with.
-      # clean: false -- the integration suite (shared x64 pool) leaves root-owned
-      # bind-mount dirs under test-temp/ a non-root git clean can't remove
-      # (EACCES); this job never needs them. `git add -A` below still ignores
-      # them (test-temp is gitignored), so the sync commit stays clean.
+      # Root-owned leftovers under test-temp/ are what `clean: false` used to route
+      # around: the integration suite bind-mounts host dirs into containers, and a
+      # non-root git clean then EACCESes on what they wrote -- taking down whatever
+      # innocent job checked out next. Skipping the clean cured that symptom and
+      # caused another: every gitignored artifact survived between runs, so a test
+      # could pass on build output an earlier job left behind and go red the first
+      # time it landed on a cold runner (probe, 2026-09-01). Clear the leftovers
+      # from a root container FIRST, and the checkout can clean properly again.
+      # Best-effort by construction: no docker, no test-temp, or a failed run all
+      # fall through without failing the job.
+      - name: Clear stale root-owned test-temp (pre-checkout)
+        run: |
+          set -uo pipefail
+          tt="$GITHUB_WORKSPACE/test-temp"
+          [ -d "$tt" ] || exit 0
+          docker run --rm --user 0:0 -v "$tt":/t alpine sh \
+            -c 'rm -rf /t/* /t/.[!.]* 2>/dev/null || true' || rm -rf "$tt"/* 2>/dev/null || true
+
       - uses: actions/checkout@v5
         with:
           token: ${{ secrets.CI_DISPATCH_TOKEN }}
-          clean: false
+          clean: true
 
       - name: Resolve the newest published dev-kit and bump the pin
         id: sync
@@ -194,11 +201,27 @@ jobs:
     if: ${{ !cancelled() }}
     runs-on: x64
     steps:
-      # clean: false -- see the sync job; avoid a git-clean EACCES on integration's
-      # root-owned test-temp leftovers on the shared x64 pool.
+      # Root-owned leftovers under test-temp/ are what `clean: false` used to route
+      # around: the integration suite bind-mounts host dirs into containers, and a
+      # non-root git clean then EACCESes on what they wrote -- taking down whatever
+      # innocent job checked out next. Skipping the clean cured that symptom and
+      # caused another: every gitignored artifact survived between runs, so a test
+      # could pass on build output an earlier job left behind and go red the first
+      # time it landed on a cold runner (probe, 2026-09-01). Clear the leftovers
+      # from a root container FIRST, and the checkout can clean properly again.
+      # Best-effort by construction: no docker, no test-temp, or a failed run all
+      # fall through without failing the job.
+      - name: Clear stale root-owned test-temp (pre-checkout)
+        run: |
+          set -uo pipefail
+          tt="$GITHUB_WORKSPACE/test-temp"
+          [ -d "$tt" ] || exit 0
+          docker run --rm --user 0:0 -v "$tt":/t alpine sh \
+            -c 'rm -rf /t/* /t/.[!.]* 2>/dev/null || true' || rm -rf "$tt"/* 2>/dev/null || true
+
       - uses: actions/checkout@v5
         with:
-          clean: false
+          clean: true
       - id: meta
         run: |
           if [ "${{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') }}" = "true" ]; then

package/conventions/upgrade-latest.yml

@@ -10,12 +10,18 @@
 # norsk-ctl daemon to the `latest` channel (dev-only; CI downloads ctl
 # directly, so a stale pin never affects CI or customers).
 #
-# Commits the bump straight to main (nightly cron + on demand). The push is
-# made with CI_DISPATCH_TOKEN (a PAT), so it DOES fire the product's push-
-# triggered workflows (checks, build-image, integration) against the bumped
-# pins; a GITHUB_TOKEN push would not (Actions' recursion guard), and the bump
-# would land unverified until the next human push. A red run at 04:2x on main
-# is the signal that a Norsk nightly is bad and the bump needs reverting.
+# Nightly cron + on demand. The bump runs the product's own gate (lint,
+# typecheck, unit tests) BEFORE it lands, exactly as sync-dev-kit does: green
+# lands on main, red opens a reconciliation PR and main stays green.
+#
+# It used to commit straight to main and rely on the push-triggered run for its
+# verdict. The push is made with CI_DISPATCH_TOKEN (a PAT), so that run really
+# does happen -- a GITHUB_TOKEN push would fire nothing (Actions' recursion
+# guard) -- but it makes a RED `main` the alarm, and nobody watches a product
+# repo's own `main`: playout sat red ~12h, then funke, then probe, inside three
+# days (fleet review 04c, class 8). Gating first turns "a bad Norsk nightly reds
+# six repos overnight" into "a bad Norsk nightly opens a PR that says so".
+# Pinned for the class by conventions/gate-before-main.test.ts.
 #
 # Single-sourced in @norskvideo/ctl-dev-kit (conventions/upgrade-latest.yml) and
 # copied verbatim into each product repo; the check:drift gate fails CI if a copy
@@ -39,18 +45,28 @@ jobs:
       changed: ${{ steps.bump.outputs.changed }}
       summary: ${{ steps.bump.outputs.summary }}
     steps:
-      # Check out with CI_DISPATCH_TOKEN, not the automatic GITHUB_TOKEN: the
-      # checkout credential is what the push to main below authenticates with,
-      # and only a PAT push triggers the push-driven workflows that validate the
-      # new pins (see the header). Same arrangement as sync-dev-kit.yml.
-      # clean: false -- the integration suite (shared x64 pool) leaves root-owned
-      # bind-mount dirs under test-temp/ that a non-root git clean can't remove
-      # (EACCES). These jobs never need those files; skip the clean so an innocent
-      # bystander checkout doesn't choke on another workflow's leftovers.
+      # Root-owned leftovers under test-temp/ are what `clean: false` used to route
+      # around: the integration suite bind-mounts host dirs into containers, and a
+      # non-root git clean then EACCESes on what they wrote -- taking down whatever
+      # innocent job checked out next. Skipping the clean cured that symptom and
+      # caused another: every gitignored artifact survived between runs, so a test
+      # could pass on build output an earlier job left behind and go red the first
+      # time it landed on a cold runner (probe, 2026-09-01). Clear the leftovers
+      # from a root container FIRST, and the checkout can clean properly again.
+      # Best-effort by construction: no docker, no test-temp, or a failed run all
+      # fall through without failing the job.
+      - name: Clear stale root-owned test-temp (pre-checkout)
+        run: |
+          set -uo pipefail
+          tt="$GITHUB_WORKSPACE/test-temp"
+          [ -d "$tt" ] || exit 0
+          docker run --rm --user 0:0 -v "$tt":/t alpine sh \
+            -c 'rm -rf /t/* /t/.[!.]* 2>/dev/null || true' || rm -rf "$tt"/* 2>/dev/null || true
+
       - uses: actions/checkout@v5
         with:
           token: ${{ secrets.CI_DISPATCH_TOKEN }}
-          clean: false
+          clean: true
 
       - name: Resolve the nightly channel and rewrite the coupled pins
         id: bump
@@ -202,8 +218,23 @@ jobs:
             done
           '
 
-      - name: Commit the bump to main
+      - name: Run the product gate against the bumped pins
+        id: gate
         if: steps.bump.outputs.changed == '1'
+        # continue-on-error so a red gate can open a PR below instead of failing
+        # the workflow -- which is why the steps after it read `outcome` and not
+        # `conclusion` (continue-on-error rewrites conclusion to success).
+        continue-on-error: true
+        run: |
+          nix develop .#build --command bash -c '
+            set -euo pipefail
+            bun run lint
+            bun run typecheck
+            bun run test:unit
+          '
+
+      - name: Land the bump on main (gate green)
+        if: steps.bump.outputs.changed == '1' && steps.gate.outcome == 'success'
         run: |
           set -euo pipefail
           git config user.name "github-actions[bot]"
@@ -230,6 +261,55 @@ jobs:
           done
           echo "push still failing after 5 rebase attempts"; exit 1
 
+      - name: Open a reconciliation PR (gate red)
+        if: steps.bump.outputs.changed == '1' && steps.gate.outcome == 'failure'
+        env:
+          API_TOKEN: ${{ secrets.CI_DISPATCH_TOKEN }}
+        run: |
+          set -euo pipefail
+          branch="upgrade-latest/nightly"
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git checkout -b "$branch"
+          git add -A
+          git commit -m "chore: bump Norsk nightly + ctl pins to latest channel (needs reconciliation)
+
+          ${{ steps.bump.outputs.summary }}"
+          git push -f origin "$branch"
+          title="Bump Norsk nightly + ctl pins to latest channel"
+          body="$(printf '%s\n' \
+            "Automated nightly pin bump: the Norsk nightly channel moved and the coupled" \
+            "pins came with it -- but the product gate is **red**, so this bump needs a" \
+            "human before it reaches main." \
+            "" \
+            "    ${{ steps.bump.outputs.summary }}" \
+            "" \
+            "A red gate here usually means the new Norsk nightly is bad, or genuinely" \
+            "changed something the product depends on. Run it to see which:" \
+            "" \
+            "    bun run lint && bun run typecheck && bun run test:unit" \
+            "" \
+            "Fix it on this branch and merge, or close this PR to skip the bump -- the" \
+            "next nightly run reopens it against whatever the channel holds then.")"
+          # gh is not on the self-hosted runner PATH (it lives only inside
+          # `nix develop`, and this step runs outside it), so create/update the PR
+          # straight against the REST API with the same PAT that pushed the branch.
+          # The PAT (not GITHUB_TOKEN) is what lets the PR's own checks run, which
+          # is the whole point: the bump is judged before it lands, not after.
+          repo="${{ github.repository }}"; owner="${repo%%/*}"
+          api="https://api.github.com/repos/$repo/pulls"
+          curl_api=(--fail-with-body -sS -H "Authorization: Bearer $API_TOKEN" -H "Accept: application/vnd.github+json")
+          existing="$(curl "${curl_api[@]}" "$api?head=$owner:$branch&state=open" | jq -r '.[0].number // empty')"
+          if [ -n "$existing" ]; then
+            curl "${curl_api[@]}" -X PATCH "$api/$existing" \
+              --data "$(jq -nc --arg t "$title" --arg b "$body" '{title:$t, body:$b}')" > /dev/null
+            echo "updated PR #$existing"
+          else
+            curl "${curl_api[@]}" -X POST "$api" \
+              --data "$(jq -nc --arg t "$title" --arg b "$body" --arg h "$branch" \
+                '{title:$t, body:$b, head:$h, base:"main"}')" | jq -r '"opened PR #\(.number)"'
+          fi
+
       - name: Report "already fresh"
         if: steps.bump.outputs.changed != '1'
         run: echo "Nightly pins already current — nothing to bump."
@@ -243,13 +323,27 @@ jobs:
     if: ${{ !cancelled() }}
     runs-on: x64
     steps:
-      # clean: false -- the integration suite (shared x64 pool) leaves root-owned
-      # bind-mount dirs under test-temp/ that a non-root git clean can't remove
-      # (EACCES). These jobs never need those files; skip the clean so an innocent
-      # bystander checkout doesn't choke on another workflow's leftovers.
+      # Root-owned leftovers under test-temp/ are what `clean: false` used to route
+      # around: the integration suite bind-mounts host dirs into containers, and a
+      # non-root git clean then EACCESes on what they wrote -- taking down whatever
+      # innocent job checked out next. Skipping the clean cured that symptom and
+      # caused another: every gitignored artifact survived between runs, so a test
+      # could pass on build output an earlier job left behind and go red the first
+      # time it landed on a cold runner (probe, 2026-09-01). Clear the leftovers
+      # from a root container FIRST, and the checkout can clean properly again.
+      # Best-effort by construction: no docker, no test-temp, or a failed run all
+      # fall through without failing the job.
+      - name: Clear stale root-owned test-temp (pre-checkout)
+        run: |
+          set -uo pipefail
+          tt="$GITHUB_WORKSPACE/test-temp"
+          [ -d "$tt" ] || exit 0
+          docker run --rm --user 0:0 -v "$tt":/t alpine sh \
+            -c 'rm -rf /t/* /t/.[!.]* 2>/dev/null || true' || rm -rf "$tt"/* 2>/dev/null || true
+
       - uses: actions/checkout@v5
         with:
-          clean: false
+          clean: true
       - id: meta
         run: |
           if [ "${{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') }}" = "true" ]; then

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@norskvideo/ctl-dev-kit",
-  "version": "0.1.76",
+  "version": "0.1.78",
   "type": "module",
   "exports": {
     "./create-product": "./create-product/create-product.ts",