@norskvideo/ctl-dev-kit 0.2.60 → 0.2.61

package/conventions/upgrade-latest.yml

@@ -9,22 +9,29 @@
 # tracked package.json actually depends on them) move in lockstep via a global
 # string-replace of old->new across every tracked file — which also updates the
 # version-pin guard test, no drift. A repo with no studio npm deps needs no
-# package.json `overrides` block at all. Also rebumps the dev flake's pinned
-# norsk-ctl daemon to the `latest` channel (dev-only; CI downloads ctl
-# directly, so a stale pin never affects CI or customers).
+# package.json `overrides` block at all. Also moves flake.nix's norsk-ctl pin
+# (ctlVersion + the per-platform hashes) to the `latest` channel. That pin is
+# not dev-only: every CI tier runs the norsk-ctl it names, so a product's result
+# belongs to a commit (ctl-pinned-in-repo.test.ts).
 #
 # Nightly cron + on demand. The bump runs the product's own gate (lint,
-# typecheck, unit tests) BEFORE it lands, exactly as sync-dev-kit does: green
-# lands on main, red opens a reconciliation PR and main stays green.
+# typecheck, unit tests), then ALWAYS opens (or updates) a PR on
+# upgrade-latest/nightly, as sync-ctl-packages does; it never pushes to main.
+# bot-prs merges the PR once checks, smoke, integration and the guides gate are
+# green on its head, so a bad Norsk nightly or norsk-ctl shows up as a red bot
+# PR and main stays green.
 #
-# It used to commit straight to main and rely on the push-triggered run for its
-# verdict. The push is made with CI_DISPATCH_TOKEN (a PAT), so that run really
-# does happen -- a GITHUB_TOKEN push would fire nothing (Actions' recursion
-# guard) -- but it makes a RED `main` the alarm, and nobody watches a product
-# repo's own `main`: playout sat red ~12h, then funke, then probe, inside three
-# days (fleet review 04c, class 8). Gating first turns "a bad Norsk nightly reds
-# six repos overnight" into "a bad Norsk nightly opens a PR that says so".
-# Pinned for the class by conventions/gate-before-main.test.ts.
+# History, because each step was a fix. It first committed straight to main and
+# let the push-triggered run be the verdict -- a RED `main` as the alarm, and
+# nobody watches a product repo's own `main`: playout sat red ~12h, then funke,
+# then probe, inside three days (fleet review 04c, class 8). Then it gated
+# first and landed on green. That kept lint/typecheck/unit failures off main,
+# but smoke, integration and the guides ran only after landing, so a bad
+# upstream release still reddened main in every repo that took it
+# (ci-workflows docs/dashboard/ci-fragility.md, problem 2 and proposal B).
+# Pinned for the class by conventions/gate-before-main.test.ts. The branch is
+# pushed with CI_DISPATCH_TOKEN (a PAT): a GITHUB_TOKEN push would fire none of
+# the PR's workflows (Actions' recursion guard).
 #
 # Single-sourced in @norskvideo/ctl-dev-kit (conventions/upgrade-latest.yml) and
 # copied verbatim into each product repo; the check:drift gate fails CI if a copy
@@ -116,6 +123,18 @@ jobs:
           reg="https://registry.npmjs.org"
           changed=0
 
+          # NORSK-CTL: the version flake.nix's ctlVersion names is the daemon every
+          # CI tier runs (ctl-pinned-in-repo.test.ts) as well as the one the dev
+          # shell launches, so it moves here like the engine does and the bump
+          # PR's tiers are what test it (ci-workflows docs/dashboard/
+          # ci-fragility.md, proposal A). Resolved up front, with everything
+          # else, so a refusal rewrites nothing.
+          ctl_base="https://s3.eu-west-1.amazonaws.com/norsk.video/norsk-ctl"
+          old_ctl="$( { grep -oE 'ctlVersion = "[^"]+"' flake.nix 2>/dev/null || true; } | head -1 | sed -E 's/.*"(.*)"/\1/')"
+          [ -n "$old_ctl" ] || { echo "::error::flake.nix pins no ctlVersion. CI runs the norsk-ctl it names, so add ctlVersion = \"<version>\"; to flake.nix."; exit 1; }
+          new_ctl="$(curl -fsSL --retry 3 --retry-all-errors --retry-delay 2 "$ctl_base/latest")"
+          [ -n "$new_ctl" ] || { echo "::error::could not resolve norsk-ctl's latest channel"; exit 1; }
+
           # Accumulate a COMPACT summary: only the components that actually moved
           # get an entry, so a no-op nightly (old == new) posts nothing. Was: the
           # full media + studio-lib + studio-image triple every night for every
@@ -264,18 +283,16 @@ jobs:
             parts+=("studio-lib \`$new_studio_lib\`")
           fi
 
-          # --- ctl daemon pin (flake.nix) -----------------------------------
-          # The pinned norsk-ctl in the dev flake is dev-only (CI downloads the
-          # released binary directly), but keep it fresh too. Bump ctlVersion +
-          # the four per-platform hashes to the `latest` channel. Mirrors
+          # --- norsk-ctl pin (flake.nix) ------------------------------------
+          # ctlVersion, plus the per-platform hash of each platform the flake
+          # fetches the daemon for. A Studio product's flake fetches all four; an
+          # sdk-app's fetches none and carries the version alone. Mirrors
           # packages/dev-kit/build/refresh-ctl-pin.sh in the ctl monorepo.
-          ctl_base="https://s3.eu-west-1.amazonaws.com/norsk.video/norsk-ctl"
-          old_ctl="$(grep -oE 'ctlVersion = "[^"]+"' flake.nix | sed -E 's/.*"(.*)"/\1/')"
-          new_ctl="$(curl -fsSL --retry 3 --retry-all-errors --retry-delay 2 "$ctl_base/latest")"
-          if [ -n "$new_ctl" ] && [ "$old_ctl" != "$new_ctl" ]; then
+          if [ "$old_ctl" != "$new_ctl" ]; then
             declare -A ctlplat=([x86_64-linux]=linux-x64 [aarch64-linux]=linux-arm64 [aarch64-darwin]=darwin-arm64 [x86_64-darwin]=darwin-x64)
             for sys in "${!ctlplat[@]}"; do
               p="${ctlplat[$sys]}"
+              grep -qF "plat = \"$p\";" flake.nix || continue
               hex="$(curl -fsSL --retry 3 --retry-all-errors --retry-delay 2 "$ctl_base/$new_ctl/norsk-ctl-$new_ctl-$p.sha256" | awk '{print $1}')"
               [ -n "$hex" ] || { echo "no sha256 sidecar for $p"; exit 1; }
               sri="$(nix hash convert --hash-algo sha256 --to sri "$hex")"
@@ -327,31 +344,51 @@ jobs:
             bun run test:unit
           '
 
-      - name: Land the bump on main (gate green)
-        if: steps.bump.outputs.changed == '1' && steps.gate.outcome == 'success'
+      # The bump's only way to main is this PR. bot-prs merges it once every tier
+      # that runs on a bot PR -- checks, smoke, integration and build-image's
+      # guides gate, wherever this repo has them -- is green on its head
+      # (ci-workflows docs/dashboard/ci-fragility.md, proposal B). Landing on a
+      # green gate kept lint, typecheck and unit failures off main, but the tiers
+      # that break on an upstream change ran only after landing, so a bad
+      # upstream release still turned main red in every repo that took it. The
+      # gate above still runs: its verdict heads the PR body, and a red one
+      # shows on the PR's own checks too. Never a draft: bot-prs reads red from
+      # the tiers, and a draft could never become ready again by PATCH.
+      - name: Open (or update) the bump PR
+        if: steps.bump.outputs.changed == '1'
         env:
           API_TOKEN: ${{ secrets.CI_DISPATCH_TOKEN }}
-          # Through env, never pasted into the script (see the PR step below).
+          GATE: ${{ steps.gate.outcome }}
+          # Through env, never pasted into the script: the summary wraps each
+          # version in backticks, and inside a double-quoted shell string those
+          # ran as commands ("1.3.1-...: command not found"), dropping every
+          # version from the commit message and PR body.
           SUMMARY: ${{ steps.bump.outputs.summary }}
         run: |
           set -euo pipefail
-          # This bump is about to land, which makes any upgrade-latest/* PR an earlier
-          # red run opened obsolete. Left open they piled up -- nine were closed
-          # by hand on 2026-10-03 -- so close them once the push has landed.
-          # Best-effort: a failure here must not fail the landing.
+          branch="upgrade-latest/nightly"
+          prefix="upgrade-latest/"
+          title="Bump Norsk nightly + ctl pins to latest channel"
+          repo="${{ github.repository }}"; owner="${repo%%/*}"
+          api="https://api.github.com/repos/$repo/pulls"
+          # An older PR of this bot's family is obsolete once this one is open:
+          # left open they piled up (nine were closed by hand on 2026-10-03).
+          # Best-effort: a failure here must not fail the bump.
           close_superseded() {
-            api="https://api.github.com/repos/$GITHUB_REPOSITORY"
+            local keep="$1" n
             auth=(-H "Authorization: Bearer $API_TOKEN" -H "Accept: application/vnd.github+json")
-            for n in $(curl -sS "${auth[@]}" "$api/pulls?state=open&per_page=100" \
-                | jq -r --arg repo "$GITHUB_REPOSITORY" '.[] | select(.head.repo.full_name == $repo and (.head.ref | startswith("upgrade-latest/"))) | .number'); do
-              curl -sS -o /dev/null "${auth[@]}" -X POST "$api/issues/$n/comments" \
-                -d '{"body":"Superseded: a later upgrade-latest run landed its bump on main."}'
-              curl -sS -o /dev/null "${auth[@]}" -X PATCH "$api/pulls/$n" -d '{"state":"closed"}'
+            for n in $(curl -sS "${auth[@]}" "$api?state=open&per_page=100" \
+                | jq -r --arg repo "$repo" --arg prefix "$prefix" --argjson keep "$keep" \
+                  '.[] | select(.head.repo.full_name == $repo and (.head.ref | startswith($prefix)) and .number != $keep) | .number'); do
+              curl -sS -o /dev/null "${auth[@]}" -X POST "https://api.github.com/repos/$repo/issues/$n/comments" \
+                -d "$(jq -nc --arg b "Superseded by #$keep, a later run of this bot." '{body:$b}')"
+              curl -sS -o /dev/null "${auth[@]}" -X PATCH "$api/$n" -d '{"state":"closed"}'
               echo "closed superseded PR #$n"
             done
           }
           git config user.name "github-actions[bot]"
           git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git checkout -B "$branch"
           git add -A
           git commit -m "chore: bump Norsk nightly + ctl pins to latest channel
 
@@ -359,81 +396,52 @@ jobs:
 
           Coupled Norsk pins (npm overrides + manifest.seed.json image tags +
           version-pin guard test) moved together via a global version-string
-          replace; lockfile regenerated. Dev flake norsk-ctl pin (version + 4
-          platform hashes) rebumped to the latest channel."
-          # main can advance under a long bump (lockfile regen + registry
-          # lookups run for minutes); a bare push then loses a non-fast-forward
-          # race and reds the nightly. Rebase-and-retry so an unrelated commit
-          # landing mid-run does not fail the bump; a genuine content conflict
-          # still aborts loudly rather than force-pushing over other work.
-          for attempt in 1 2 3 4 5; do
-            if git push origin HEAD:main; then close_superseded || true; exit 0; fi
-            echo "push rejected (attempt $attempt) - rebasing onto latest origin/main"
-            # --unshallow, not a plain fetch: these runners keep their .git
-            # between jobs, and a commit an earlier job fetched at depth 1 stays
-            # recorded as parentless. A plain fetch does not re-fetch an object it
-            # already holds, so main's tip can look like an unrelated root and the
-            # rebase replays our base commit over it -- add/add conflicts on every
-            # file it touches (playout + studio, 2026-10-03). The fallback covers
-            # a repo that is already complete, where --unshallow is refused.
-            git fetch --unshallow origin main 2>/dev/null || git fetch origin main
-            git rebase origin/main || { git rebase --abort; echo "rebase hit a real conflict; aborting"; exit 1; }
-          done
-          echo "push still failing after 5 rebase attempts"; exit 1
-
-      - name: Open a reconciliation PR (gate red)
-        if: steps.bump.outputs.changed == '1' && steps.gate.outcome == 'failure'
-        env:
-          API_TOKEN: ${{ secrets.CI_DISPATCH_TOKEN }}
-          # Through env, never pasted into the script: the summary wraps each
-          # version in backticks, and inside a double-quoted shell string those
-          # ran as commands ("1.3.1-...: command not found"), dropping every
-          # version from the commit message and PR body.
-          SUMMARY: ${{ steps.bump.outputs.summary }}
-        run: |
-          set -euo pipefail
-          branch="upgrade-latest/nightly"
-          git config user.name "github-actions[bot]"
-          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
-          git checkout -b "$branch"
-          git add -A
-          git commit -m "chore: bump Norsk nightly + ctl pins to latest channel (needs reconciliation)
-
-          ${SUMMARY}"
-          git push -f origin "$branch"
-          title="Bump Norsk nightly + ctl pins to latest channel"
+          replace; lockfile regenerated. flake.nix norsk-ctl pin (version + the
+          per-platform hashes), which CI runs, moved to the latest channel."
+          # One branch per bump, force-pushed from today's main -- but only when
+          # its tree changed. A red bump PR left standing is rebuilt by every run
+          # of this bot, and pushing the same tree again would re-run every slow
+          # tier on it for nothing.
+          if git fetch -q origin "$branch" 2>/dev/null && [ "$(git rev-parse 'HEAD^{tree}')" = "$(git rev-parse 'FETCH_HEAD^{tree}')" ]; then
+            echo "$branch already holds this bump; not re-pushing it"
+          else
+            git push -f origin "$branch"
+          fi
+          if [ "$GATE" = "success" ]; then
+            verdict="Gate green: lint, typecheck and unit tests pass on the bumped pins."
+          else
+            verdict="**Gate red**: lint, typecheck or unit tests fail on the bumped pins. That usually means the new Norsk nightly is bad, or genuinely changed something the product depends on. Fix it on this branch, or close this PR to skip the bump -- the next nightly run reopens it against whatever the channel holds then."
+          fi
           body="$(printf '%s\n' \
-            "Automated nightly pin bump: the Norsk nightly channel moved and the coupled" \
-            "pins came with it -- but the product gate is **red**, so this bump needs a" \
-            "human before it reaches main." \
+            "Automated nightly pin bump: the Norsk nightly channel and norsk-ctl latest moved, and the coupled pins came with them." \
             "" \
             "    ${SUMMARY}" \
             "" \
-            "A red gate here usually means the new Norsk nightly is bad, or genuinely" \
-            "changed something the product depends on. Run it to see which:" \
-            "" \
-            "    bun run lint && bun run typecheck && bun run test:unit" \
+            "$verdict" \
             "" \
-            "Fix it on this branch and merge, or close this PR to skip the bump -- the" \
-            "next nightly run reopens it against whatever the channel holds then.")"
+            "bot-prs merges this once checks, smoke, integration and the guides gate" \
+            "(build-image) have all passed on its head, wherever this repo runs them." \
+            "Until then main does not move; a red tier keeps it open and reports it on" \
+            "the product dashboard.")"
           # gh is not on the self-hosted runner PATH (it lives only inside
           # `nix develop`, and this step runs outside it), so create/update the PR
           # straight against the REST API with the same PAT that pushed the branch.
-          # The PAT (not GITHUB_TOKEN) is what lets the PR's own checks run, which
-          # is the whole point: the bump is judged before it lands, not after.
-          repo="${{ github.repository }}"; owner="${repo%%/*}"
-          api="https://api.github.com/repos/$repo/pulls"
+          # The PAT (not GITHUB_TOKEN) is what lets the PR's own workflows run,
+          # which is the whole point: the bump is judged before it lands.
           curl_api=(--fail-with-body -sS -H "Authorization: Bearer $API_TOKEN" -H "Accept: application/vnd.github+json")
           existing="$(curl "${curl_api[@]}" "$api?head=$owner:$branch&state=open" | jq -r '.[0].number // empty')"
           if [ -n "$existing" ]; then
             curl "${curl_api[@]}" -X PATCH "$api/$existing" \
               --data "$(jq -nc --arg t "$title" --arg b "$body" '{title:$t, body:$b}')" > /dev/null
-            echo "updated PR #$existing"
+            number="$existing"
+            echo "updated PR #$number"
           else
-            curl "${curl_api[@]}" -X POST "$api" \
+            number="$(curl "${curl_api[@]}" -X POST "$api" \
               --data "$(jq -nc --arg t "$title" --arg b "$body" --arg h "$branch" \
-                '{title:$t, body:$b, head:$h, base:"main"}')" | jq -r '"opened PR #\(.number)"'
+                '{title:$t, body:$b, head:$h, base:"main"}')" | jq -r .number)"
+            echo "opened PR #$number"
           fi
+          close_superseded "$number" || true
 
       - name: Report "already fresh"
         if: steps.bump.outputs.changed != '1'

package/docs-theme/README.md

@@ -85,8 +85,8 @@ a class attribute on every page of the site.
 site: `hasDocsSite()` tests for `website/astro.config.mjs`, and
 `docsThemeProblems()` routes this directory's `checkTheme` into the same report as
 `biome.json` and the shared workflows. `conventions/sync-drift.ts` is the writer
-half, so `sync-dev-kit.yml` rolls a theme change out to every product hands-free
-like any other convention. The site directory is `website/` across the fleet
+half, so `sync-dev-kit.yml` rolls a theme change out to every product like any
+other convention, through a bot PR that `bot-prs.yml` merges once its tiers pass. The site directory is `website/` across the fleet
 (`DOCS_SITE_DIR`).
 
 A site inside THIS monorepo still runs `sync.ts check` from its own test suite,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@norskvideo/ctl-dev-kit",
-  "version": "0.2.60",
+  "version": "0.2.61",
   "type": "module",
   "exports": {
     "./create-product": "./create-product/create-product.ts",