@norskvideo/ctl-dev-kit 0.2.28 → 0.2.29

package/conventions/upgrade-latest.yml

@@ -237,6 +237,18 @@ jobs:
           if [ "$old_studio_img" != "$new_studio_img" ]; then
             git grep -lF "norskvideo/norsk-studio:$old_studio_img" -- . ':!bun.lock' \
               | xargs -r sed -i "s|norskvideo/norsk-studio:$old_studio_img|norskvideo/norsk-studio:$new_studio_img|g"
+            # And the tag on its own: a product can carry it unprefixed (onair2026's
+            # committed template input has `"studioTag": "<tag>"`), which the
+            # prefixed rewrite never reached -- the engine moved, studio did not,
+            # and the repo's own pin test went red (2026-10-04). Safe because the
+            # image tag and the npm library version are different strings; if
+            # they ever coincide, the bare rewrite would also hit the lib pins, so
+            # it is skipped and the lib rewrite below owns that string.
+            if [ "$old_studio_img" != "$old_studio_lib" ]; then
+              # `|| true`: after the prefixed rewrite most repos have no bare
+              # occurrence left, and git grep exits 1 on no match (pipefail).
+              { git grep -lF "$old_studio_img" -- . ':!bun.lock' || true; } | xargs -r sed -i "s|$old_studio_img|$new_studio_img|g"
+            fi
             changed=1
           fi
           if [ -n "$new_studio_lib" ] && [ "$old_studio_lib" != "$new_studio_lib" ]; then
@@ -319,6 +331,8 @@ jobs:
         if: steps.bump.outputs.changed == '1' && steps.gate.outcome == 'success'
         env:
           API_TOKEN: ${{ secrets.CI_DISPATCH_TOKEN }}
+          # Through env, never pasted into the script (see the PR step below).
+          SUMMARY: ${{ steps.bump.outputs.summary }}
         run: |
           set -euo pipefail
           # This bump is about to land, which makes any upgrade-latest/* PR an earlier
@@ -341,7 +355,7 @@ jobs:
           git add -A
           git commit -m "chore: bump Norsk nightly + ctl pins to latest channel
 
-          ${{ steps.bump.outputs.summary }}
+          ${SUMMARY}
 
           Coupled Norsk pins (npm overrides + manifest.seed.json image tags +
           version-pin guard test) moved together via a global version-string
@@ -371,6 +385,11 @@ jobs:
         if: steps.bump.outputs.changed == '1' && steps.gate.outcome == 'failure'
         env:
           API_TOKEN: ${{ secrets.CI_DISPATCH_TOKEN }}
+          # Through env, never pasted into the script: the summary wraps each
+          # version in backticks, and inside a double-quoted shell string those
+          # ran as commands ("1.3.1-...: command not found"), dropping every
+          # version from the commit message and PR body.
+          SUMMARY: ${{ steps.bump.outputs.summary }}
         run: |
           set -euo pipefail
           branch="upgrade-latest/nightly"
@@ -380,7 +399,7 @@ jobs:
           git add -A
           git commit -m "chore: bump Norsk nightly + ctl pins to latest channel (needs reconciliation)
 
-          ${{ steps.bump.outputs.summary }}"
+          ${SUMMARY}"
           git push -f origin "$branch"
           title="Bump Norsk nightly + ctl pins to latest channel"
           body="$(printf '%s\n' \
@@ -388,7 +407,7 @@ jobs:
             "pins came with it -- but the product gate is **red**, so this bump needs a" \
             "human before it reaches main." \
             "" \
-            "    ${{ steps.bump.outputs.summary }}" \
+            "    ${SUMMARY}" \
             "" \
             "A red gate here usually means the new Norsk nightly is bad, or genuinely" \
             "changed something the product depends on. Run it to see which:" \

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@norskvideo/ctl-dev-kit",
-  "version": "0.2.28",
+  "version": "0.2.29",
   "type": "module",
   "exports": {
     "./create-product": "./create-product/create-product.ts",