@norskvideo/ctl-dev-kit 0.2.61 → 0.2.63

package/conventions/bot-prs.yml

@@ -67,10 +67,13 @@ permissions:
   contents: read
   checks: read
   pull-requests: read
-  # The workflow runs on a PR's head: whether each gating tier has passed there.
-  actions: read
-  # The rebuild dispatch and its marker comment go through the PAT (WRITE_TOKEN),
-  # like the merges; this token only reads.
+  # Reads which gating tiers have passed on a PR's head, and writes Actions:
+  # re-running a cancelled tier and dispatching a bot's workflow to rebuild a
+  # conflicting PR. Those went through the PAT, which has no Actions write, and
+  # failed with HTTP 403 in every repo (2026-10-10). A workflow_dispatch made
+  # with this token does start a run (exempt from the recursion guard). Merges,
+  # branch deletes and comments stay on the PAT (WRITE_TOKEN).
+  actions: write
 
 concurrency:
   # One at a time per repo, and never cancelled: a merge half-done by a run that
@@ -99,6 +102,9 @@ jobs:
           curl_as() { local tok="$1"; shift; curl -sS --retry 3 --retry-all-errors -H "Authorization: Bearer $tok" -H "Accept: application/vnd.github+json" "$@"; }
           gh_api() { curl_as "$READ_TOKEN" "$@"; }
           gh_write() { curl_as "$WRITE_TOKEN" "$@"; }
+          # Actions writes (re-run a tier, dispatch a bot's workflow) use the
+          # job token, which permissions grant actions: write; the PAT cannot.
+          gh_actions() { curl_as "$READ_TOKEN" "$@"; }
           # An API error is a JSON object with a message; say what it was rather
           # than letting jq fail later on a missing field.
           expect() {
@@ -232,7 +238,7 @@ jobs:
               red\ *) red+=("#$n $ref: ${verdict#red }"); continue ;;
               rerun\ *)
                 for id in ${verdict#rerun }; do
-                  code="$(gh_write -o /dev/null -w '%{http_code}' -X POST "$api/actions/runs/$id/rerun")"
+                  code="$(gh_actions -o /dev/null -w '%{http_code}' -X POST "$api/actions/runs/$id/rerun")"
                   echo "#$n $ref: a gating tier (run $id) was cancelled; re-running it (HTTP $code)"
                 done
                 continue ;;
@@ -256,7 +262,7 @@ jobs:
               elif jq -e --arg m "$marker" 'any(.[]; .body | contains($m))' >/dev/null <<<"$comments"; then
                 red+=("#$n $ref: still does not merge cleanly with main after $wf rebuilt it")
               else
-                code="$(gh_write -o /dev/null -w '%{http_code}' -X POST "$api/actions/workflows/$wf/dispatches" -d '{"ref":"main"}')"
+                code="$(gh_actions -o /dev/null -w '%{http_code}' -X POST "$api/actions/workflows/$wf/dispatches" -d '{"ref":"main"}')"
                 if [ "$code" = "204" ]; then
                   body="$marker -- it conflicted with main (another bot landed first), so $wf was re-run to rebuild it from today's main. If the rebuilt branch conflicts too, this PR is reported for a human."
                   gh_write -o /dev/null -X POST "$api/issues/$n/comments" -d "$(jq -nc --arg b "$body" '{body:$b}')" || true

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@norskvideo/ctl-dev-kit",
-  "version": "0.2.61",
+  "version": "0.2.63",
   "type": "module",
   "exports": {
     "./create-product": "./create-product/create-product.ts",
@@ -39,9 +39,9 @@
   "devDependencies": {
     "@norskvideo/ctl-oas-to-ts": "^0.1.0",
     "@norskvideo/norsk-sdk": "1.3.1-2026-10-08-846f25e3",
-    "@norskvideo/norsk-studio": "1.30.0-2026-10-08-8f4b6c11",
-    "@norskvideo/norsk-studio-builder": "1.30.0-2026-10-08-8f4b6c11",
-    "@norskvideo/norsk-studio-built-ins": "1.30.0-2026-10-08-8f4b6c11",
+    "@norskvideo/norsk-studio": "1.30.0-2026-10-09-0cd6f070",
+    "@norskvideo/norsk-studio-builder": "1.30.0-2026-10-09-0cd6f070",
+    "@norskvideo/norsk-studio-built-ins": "1.30.0-2026-10-09-0cd6f070",
     "@playwright/test": "^1.59.0",
     "@types/bun": "latest",
     "@types/cors": "^2.8.17",