@norskvideo/ctl-dev-kit 0.2.64 → 0.2.65

package/conventions/sync-dev-kit.yml

@@ -1,404 +0,0 @@
-# Keep this product's shared conventions fresh against @norskvideo/ctl-dev-kit.
-# The dev-kit single-sources the files every ctl product would otherwise
-# copy-and-drift (the fenced CLAUDE.md core, nix/ctl-shell.nix, the biome/tsconfig/dprint
-# bases, the shared workflows, the build bootstrap). check:drift fails CI when a
-# copy diverges from the *installed* dev-kit — so a product goes stale two ways:
-# its pin lags the newest published dev-kit, and once the pin bumps its copies
-# need re-syncing. This workflow closes the first gap and surfaces the second.
-#
-# It bumps the @norskvideo/ctl-dev-kit pin to the newest published version,
-# reinstalls, re-syncs this product's forced copies from the new canonical
-# (sync-drift), runs the gate (check:drift + lint + typecheck + unit tests), and
-# ALWAYS opens (or updates) a PR on sync-dev-kit/<version> -- never a push to
-# main. bot-prs merges it once checks, smoke, integration and the guides gate
-# are green on its head. The gate's verdict heads the PR body: red means the new
-# dev-kit genuinely does not fit this product (a convention that fails
-# lint/typecheck/tests, or a copy sync-drift could not converge), and adopting
-# it is real engineering on the branch, not a copy-paste.
-#
-# Why a PR even when the gate is green: a new dev-kit changes the copied
-# workflows themselves, and those are exactly what the gate does not run. On
-# 2026-10-09 a newer copied build-image.yml, never run against oracle-reasoning's
-# set-up, broke it on main after a green gate landed it (ci-workflows
-# docs/dashboard/ci-fragility.md, proposal B). On the PR, build-image's build
-# and guides run against the new copy before main has it.
-#
-# sync-drift re-derives each copy from the canonical (never a second opinion that
-# can disagree), preserving the per-repo bits the gate masks -- the product: keys,
-# the product's own flake.nix, the dprint/gitignore/CLAUDE repo content. The gate runs AFTER
-# it, so a bad rewrite fails check:drift and a breaking convention fails the build,
-# rather than landing silently. Structural per-repo files it never touches.
-#
-# Single-sourced in @norskvideo/ctl-dev-kit (conventions/sync-dev-kit.yml) and
-# copied verbatim into each product repo; the check:drift gate fails CI if a copy
-# diverges. Only the `product:` value below is per-repo (set it to this repo's
-# dashboard key); everything else must match the dev-kit source. Never hand-edit
-# the copy -- edit the dev-kit source and re-sync.
-name: sync-dev-kit
-
-on:
-  schedule:
-    - cron: "37 4 * * *"
-  workflow_dispatch:
-
-permissions:
-  contents: write
-  pull-requests: write
-
-jobs:
-  sync:
-    runs-on: x64
-    steps:
-      # Runs BEFORE checkout, and does two things: points the harness's temp base
-      # out of the workspace for every later step in this job, and clears whatever
-      # the old repo-local default left behind on this runner. The body carries the
-      # why. It fails the job only when legacy litter survives -- which would take
-      # the checkout down a step later anyway, but report nothing useful.
-      - name: Route test-temp out of the workspace (pre-checkout)
-        run: |
-          set -uo pipefail
-          # These runners are docker-OUTSIDE-of-docker, so a bind-mount source the
-          # HOST daemon has not seen before is created by dockerd, as ROOT, on the
-          # host -- even when the launch passes --container-user (reproduced
-          # 2026-09-04). The harness's default base is repo-local for an OrbStack
-          # inotify constraint that binds macOS dev and nothing here, so every run
-          # seeded the CHECKOUT with root-owned dirs a non-root `git clean -ffdx`
-          # cannot remove. That took commentary's checks AND integration red on
-          # 2026-09-03. Use the sanctioned override, per-run and outside the
-          # checkout -- as 8ff17a8d did in June for one debug workflow, and stopped.
-          base="$RUNNER_TEMP/nctt-$GITHUB_RUN_ID-$GITHUB_RUN_ATTEMPT"
-          mkdir -p "$base"
-          echo "NORSK_CTL_TEST_TMP=$base" >> "$GITHUB_ENV"
-          # Yesterday's bases hold dockerd-created root dirs, so a non-root rm
-          # EACCESes. They cannot wedge a checkout, but they do fill the disk.
-          for old in $(find "$RUNNER_TEMP" -maxdepth 1 -name 'nctt-*' -mtime +0 -printf '%f\n' 2>/dev/null || true); do
-            docker run --rm --user 0:0 -v "$RUNNER_TEMP":/t alpine sh -c 'rm -rf -- "/t/$1"' sh "$old" >/dev/null 2>&1 || true
-          done
-          # LEGACY: a runner that ran the old default still carries a workspace
-          # test-temp, and a checkout with clean:true dies on it. Reap the holders
-          # first -- rm cannot unlink a live mountpoint even as root (EBUSY), and a
-          # RESTARTING leaked container re-creates the path as root seconds after
-          # any clean. Match on mount SOURCE, not a label: the holders are untracked
-          # by construction, because a killed run labels nothing.
-          tt="$GITHUB_WORKSPACE/test-temp"
-          [ -d "$tt" ] || exit 0
-          stuck=""
-          for c in $(docker ps -aq 2>/dev/null || true); do
-            if docker inspect -f '{{range .Mounts}}{{println .Source}}{{end}}' "$c" 2>/dev/null | grep -q "^$tt/"; then
-              stuck="$stuck $c"
-            fi
-          done
-          if [ -n "$stuck" ]; then
-            echo "reaping containers holding mounts under $tt:$stuck"
-            docker rm -f $stuck || true
-          fi
-          # The DIRECTORY, not just its contents: an empty but root-owned base
-          # still EACCESes a later mkdtemp. Mounting the PARENT is what lets a root
-          # container unlink the leaf.
-          docker run --rm --user 0:0 -v "$GITHUB_WORKSPACE":/w alpine \
-            sh -c 'rm -rf /w/test-temp' || rm -rf "$tt" || true
-          # Fail HERE if it survived. The checkout fails on it either way, but
-          # reports only an EACCES rmdir with no clue what was holding the path.
-          if [ -e "$tt" ]; then
-            echo "::error::$tt survived the pre-checkout clean"
-            ls -lan "$tt" || true
-            exit 1
-          fi
-
-      - uses: actions/checkout@v5
-        with:
-          token: ${{ secrets.CI_DISPATCH_TOKEN }}
-          clean: true
-
-      - name: Resolve the newest published dev-kit and bump the pin
-        id: sync
-        run: |
-          set -euo pipefail
-          reg="https://registry.npmjs.org"
-          pkg="@norskvideo/ctl-dev-kit"
-          enc="@norskvideo%2Fctl-dev-kit"
-
-          # The runner has no npm; read the dist-tag off the registry with curl+jq
-          # (same as upgrade-latest.yml resolves the Norsk nightly).
-          new="$(curl -fsSL --retry 3 --retry-all-errors --retry-delay 2 "$reg/$enc" | jq -r '."dist-tags".latest')"
-          [ -n "$new" ] && [ "$new" != "null" ] || { echo "could not resolve $pkg latest"; exit 1; }
-
-          # Every tracked package.json, not just the root. A nested workspace can
-          # pin the dev-kit too, and a root-only rewrite left it behind: playout's
-          # tests/ sat on 0.1.x after the root moved to 0.2, ran a guide proxy
-          # that built the wrong Studio prefix, and first-light failed every
-          # night from 2026-09-07. Same walk as sync-ctl-packages.yml.
-          mapfile -t manifests < <(git ls-files '*package.json' ':!:**/node_modules/**')
-          moved=""
-          for m in "${manifests[@]}"; do
-            old="$(grep -oE "\"$pkg\"[[:space:]]*:[[:space:]]*\"[^\"]*\"" "$m" | head -1 | sed -E 's/.*"([^"]*)"$/\1/' || true)"
-            # Absent here, or a workspace protocol spec that names no version.
-            case "$old" in "" | workspace:*) continue ;; esac
-            old_bare="${old#^}"; old_bare="${old_bare#~}"
-            [ "$old_bare" != "$new" ] || continue
-            # Surgical single-line rewrite so the file keeps its formatting
-            # (a jq reserialize would reflow it and trip the formatter).
-            sed -i -E "s|(\"$pkg\"[[:space:]]*:[[:space:]]*\")[^\"]*(\")|\1^$new\2|" "$m"
-            echo "dev-kit: $m $old -> ^$new"
-            moved="$moved $old_bare"
-          done
-          if [ -z "$moved" ]; then
-            echo "every dev-kit pin is already on the newest dev-kit ($new)."
-            echo "changed=0" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-          # `old` names the lowest pin moved, for the commit message and PR title.
-          old_bare="$(printf '%s\n' $moved | sort -V | head -1)"
-          echo "changed=1" >> "$GITHUB_OUTPUT"
-          echo "old=$old_bare" >> "$GITHUB_OUTPUT"
-          echo "new=$new" >> "$GITHUB_OUTPUT"
-
-      - name: Reinstall against the new pin
-        if: steps.sync.outputs.changed == '1'
-        # NOT continue-on-error, unlike the gate below. An install that dies
-        # part-way (the runner OOM-killed sync-ctl-packages' one on 2026-10-03)
-        # would otherwise read as a red gate and open a reconciliation PR around
-        # a stale lockfile. Fail here instead, before anything is committed.
-        run: |
-          nix develop .#build --command bash -c '
-            set -euo pipefail
-            # Per install root, as sync-ctl-packages.yml does: a manifest outside
-            # the root workspace owns its own lockfile. Then move the locked
-            # dev-kit to the newest in range: bun install keeps a locked version
-            # that still satisfies its range, so a nested workspace could
-            # otherwise stay on an old dev-kit under a new pin. Only where the
-            # lockfile already holds the dev-kit: bun update ADDS a package it
-            # does not find, and put the dev-kit into funke proxy/ui that way.
-            for lock in $(git ls-files "*bun.lock"); do
-              (cd "$(dirname "$lock")" && bun install)
-              if grep -q "\"@norskvideo/ctl-dev-kit@" "$lock"; then
-                (cd "$(dirname "$lock")" && bun update @norskvideo/ctl-dev-kit)
-              fi
-            done
-          '
-
-      - name: Re-sync the copies from canonical and run the product gate
-        id: gate
-        if: steps.sync.outputs.changed == '1'
-        continue-on-error: true
-        run: |
-          nix develop .#build --command bash -c '
-            set -euo pipefail
-            bun run node_modules/@norskvideo/ctl-dev-kit/conventions/sync-drift.ts
-            bun run check:drift
-            bun run lint
-            bun run typecheck
-            bun run test:unit
-          '
-
-      # The bump's only way to main is this PR. bot-prs merges it once every tier
-      # that runs on a bot PR -- checks, smoke, integration and build-image's
-      # guides gate, wherever this repo has them -- is green on its head
-      # (ci-workflows docs/dashboard/ci-fragility.md, proposal B). Landing on a
-      # green gate kept lint, typecheck and unit failures off main, but the tiers
-      # that break on an upstream change ran only after landing, so a bad
-      # upstream release still turned main red in every repo that took it. The
-      # gate above still runs: its verdict heads the PR body, and a red one
-      # shows on the PR's own checks too. Never a draft: bot-prs reads red from
-      # the tiers, and a draft could never become ready again by PATCH.
-      - name: Open (or update) the bump PR
-        if: steps.sync.outputs.changed == '1'
-        env:
-          API_TOKEN: ${{ secrets.CI_DISPATCH_TOKEN }}
-          GATE: ${{ steps.gate.outcome }}
-        run: |
-          set -euo pipefail
-          branch="sync-dev-kit/${{ steps.sync.outputs.new }}"
-          prefix="sync-dev-kit/"
-          title="Sync dev-kit ${{ steps.sync.outputs.old }} -> ${{ steps.sync.outputs.new }}"
-          repo="${{ github.repository }}"; owner="${repo%%/*}"
-          api="https://api.github.com/repos/$repo/pulls"
-          # An older PR of this bot's family is obsolete once this one is open:
-          # left open they piled up (nine were closed by hand on 2026-10-03).
-          # Best-effort: a failure here must not fail the bump.
-          close_superseded() {
-            local keep="$1" n
-            auth=(-H "Authorization: Bearer $API_TOKEN" -H "Accept: application/vnd.github+json")
-            for n in $(curl -sS "${auth[@]}" "$api?state=open&per_page=100" \
-                | jq -r --arg repo "$repo" --arg prefix "$prefix" --argjson keep "$keep" \
-                  '.[] | select(.head.repo.full_name == $repo and (.head.ref | startswith($prefix)) and .number != $keep) | .number'); do
-              curl -sS -o /dev/null "${auth[@]}" -X POST "https://api.github.com/repos/$repo/issues/$n/comments" \
-                -d "$(jq -nc --arg b "Superseded by #$keep, a later run of this bot." '{body:$b}')"
-              curl -sS -o /dev/null "${auth[@]}" -X PATCH "$api/$n" -d '{"state":"closed"}'
-              echo "closed superseded PR #$n"
-            done
-          }
-          git config user.name "github-actions[bot]"
-          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
-          git checkout -B "$branch"
-          git add -A
-          git commit -m "chore: sync dev-kit ${{ steps.sync.outputs.old }} -> ${{ steps.sync.outputs.new }}
-
-          @norskvideo/ctl-dev-kit pin bumped to the newest published version and the
-          forced copies re-synced from the new canonical (sync-drift). Lockfile
-          regenerated."
-          # One branch per bump, force-pushed from today's main -- but only when
-          # its tree changed. A red bump PR left standing is rebuilt by every run
-          # of this bot, and pushing the same tree again would re-run every slow
-          # tier on it for nothing.
-          if git fetch -q origin "$branch" 2>/dev/null && [ "$(git rev-parse 'HEAD^{tree}')" = "$(git rev-parse 'FETCH_HEAD^{tree}')" ]; then
-            echo "$branch already holds this bump; not re-pushing it"
-          else
-            git push -f origin "$branch"
-          fi
-          if [ "$GATE" = "success" ]; then
-            verdict="Gate green: check:drift, lint, typecheck and unit tests pass against the new dev-kit."
-          else
-            verdict="**Gate red**: the new dev-kit does not fit this product yet. Run the gate to see which part: \`bun install\`, then \`bun run check:drift\` (a copy sync-drift could not converge) and \`bun run lint && bun run typecheck && bun run test:unit\` (a convention that breaks real code). Fix it on this branch until green."
-          fi
-          body="$(printf '%s\n' \
-            "Automated dev-kit sync: the @norskvideo/ctl-dev-kit pin moved to the newest published version and sync-drift re-synced the forced copies from the new canonical." \
-            "" \
-            "$verdict" \
-            "" \
-            "bot-prs merges this once checks, smoke, integration and the guides gate" \
-            "(build-image) have all passed on its head, wherever this repo runs them." \
-            "Until then main does not move; a red tier keeps it open and reports it on" \
-            "the product dashboard.")"
-          # gh is not on the self-hosted runner PATH (it lives only inside
-          # `nix develop`, and this step runs outside it), so create/update the PR
-          # straight against the REST API with the same PAT that pushed the branch.
-          # The PAT (not GITHUB_TOKEN) is what lets the PR's own workflows run,
-          # which is the whole point: the bump is judged before it lands.
-          curl_api=(--fail-with-body -sS -H "Authorization: Bearer $API_TOKEN" -H "Accept: application/vnd.github+json")
-          existing="$(curl "${curl_api[@]}" "$api?head=$owner:$branch&state=open" | jq -r '.[0].number // empty')"
-          if [ -n "$existing" ]; then
-            curl "${curl_api[@]}" -X PATCH "$api/$existing" \
-              --data "$(jq -nc --arg t "$title" --arg b "$body" '{title:$t, body:$b}')" > /dev/null
-            number="$existing"
-            echo "updated PR #$number"
-          else
-            number="$(curl "${curl_api[@]}" -X POST "$api" \
-              --data "$(jq -nc --arg t "$title" --arg b "$body" --arg h "$branch" \
-                '{title:$t, body:$b, head:$h, base:"main"}')" | jq -r .number)"
-            echo "opened PR #$number"
-          fi
-          close_superseded "$number" || true
-
-      - name: Report "already fresh"
-        if: steps.sync.outputs.changed != '1'
-        run: echo "dev-kit pin already current -- nothing to sync."
-      - name: Reap the containers this job launched
-        # Whatever the tests did. A teardown cut short by a test timeout leaves
-        # its instance running on the shared Docker daemon (see JOB_REAP_STEP in
-        # conventions/workflow-shell.ts); everything this job launched mounts its
-        # own test-temp, so that is what goes.
-        if: always()
-        run: |
-          base="${NORSK_CTL_TEST_TMP:-}"
-          tt="$GITHUB_WORKSPACE/test-temp"
-          s=""
-          for c in $(docker ps -aq); do
-            src="$(docker inspect -f '{{range .Mounts}}{{println .Source}}{{end}}' "$c" 2>/dev/null)" || continue
-            if { [ -n "$base" ] && grep -q "^$base/" <<<"$src"; } || grep -q "^$tt/" <<<"$src"; then s="$s $c"; fi
-          done
-          if [ -n "$s" ]; then
-            echo "::warning::removing containers this job left running:$s"
-            docker rm -f $s
-          fi
-
-  # Report the sync result to the aggregated product CI dashboard
-  # (id3as/ci-workflows). !cancelled() so a failed sync shows a sad pony but a
-  # cancelled/superseded run does not false-red the board. A gate-red run that
-  # opened a PR is still a successful sync -- the red lives on the PR's own checks
-  # run, not here.
-  notify:
-    needs: sync
-    if: ${{ !cancelled() }}
-    runs-on: x64
-    steps:
-      # Runs BEFORE checkout, and does two things: points the harness's temp base
-      # out of the workspace for every later step in this job, and clears whatever
-      # the old repo-local default left behind on this runner. The body carries the
-      # why. It fails the job only when legacy litter survives -- which would take
-      # the checkout down a step later anyway, but report nothing useful.
-      - name: Route test-temp out of the workspace (pre-checkout)
-        run: |
-          set -uo pipefail
-          # These runners are docker-OUTSIDE-of-docker, so a bind-mount source the
-          # HOST daemon has not seen before is created by dockerd, as ROOT, on the
-          # host -- even when the launch passes --container-user (reproduced
-          # 2026-09-04). The harness's default base is repo-local for an OrbStack
-          # inotify constraint that binds macOS dev and nothing here, so every run
-          # seeded the CHECKOUT with root-owned dirs a non-root `git clean -ffdx`
-          # cannot remove. That took commentary's checks AND integration red on
-          # 2026-09-03. Use the sanctioned override, per-run and outside the
-          # checkout -- as 8ff17a8d did in June for one debug workflow, and stopped.
-          base="$RUNNER_TEMP/nctt-$GITHUB_RUN_ID-$GITHUB_RUN_ATTEMPT"
-          mkdir -p "$base"
-          echo "NORSK_CTL_TEST_TMP=$base" >> "$GITHUB_ENV"
-          # Yesterday's bases hold dockerd-created root dirs, so a non-root rm
-          # EACCESes. They cannot wedge a checkout, but they do fill the disk.
-          for old in $(find "$RUNNER_TEMP" -maxdepth 1 -name 'nctt-*' -mtime +0 -printf '%f\n' 2>/dev/null || true); do
-            docker run --rm --user 0:0 -v "$RUNNER_TEMP":/t alpine sh -c 'rm -rf -- "/t/$1"' sh "$old" >/dev/null 2>&1 || true
-          done
-          # LEGACY: a runner that ran the old default still carries a workspace
-          # test-temp, and a checkout with clean:true dies on it. Reap the holders
-          # first -- rm cannot unlink a live mountpoint even as root (EBUSY), and a
-          # RESTARTING leaked container re-creates the path as root seconds after
-          # any clean. Match on mount SOURCE, not a label: the holders are untracked
-          # by construction, because a killed run labels nothing.
-          tt="$GITHUB_WORKSPACE/test-temp"
-          [ -d "$tt" ] || exit 0
-          stuck=""
-          for c in $(docker ps -aq 2>/dev/null || true); do
-            if docker inspect -f '{{range .Mounts}}{{println .Source}}{{end}}' "$c" 2>/dev/null | grep -q "^$tt/"; then
-              stuck="$stuck $c"
-            fi
-          done
-          if [ -n "$stuck" ]; then
-            echo "reaping containers holding mounts under $tt:$stuck"
-            docker rm -f $stuck || true
-          fi
-          # The DIRECTORY, not just its contents: an empty but root-owned base
-          # still EACCESes a later mkdtemp. Mounting the PARENT is what lets a root
-          # container unlink the leaf.
-          docker run --rm --user 0:0 -v "$GITHUB_WORKSPACE":/w alpine \
-            sh -c 'rm -rf /w/test-temp' || rm -rf "$tt" || true
-          # Fail HERE if it survived. The checkout fails on it either way, but
-          # reports only an EACCES rmdir with no clue what was holding the path.
-          if [ -e "$tt" ]; then
-            echo "::error::$tt survived the pre-checkout clean"
-            ls -lan "$tt" || true
-            exit 1
-          fi
-
-      - uses: actions/checkout@v5
-        with:
-          clean: true
-      - id: meta
-        run: |
-          if [ "${{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') }}" = "true" ]; then
-            echo "state=failure" >> "$GITHUB_OUTPUT"
-          else
-            echo "state=success" >> "$GITHUB_OUTPUT"
-          fi
-      - uses: ./.github/actions/ci-status-dispatch
-        with:
-          token: ${{ secrets.CI_DISPATCH_TOKEN }}
-          product: __PRODUCT__
-          pipeline: dev-kit
-          status: ${{ steps.meta.outputs.state }}
-      - name: Reap the containers this job launched
-        # Whatever the tests did. A teardown cut short by a test timeout leaves
-        # its instance running on the shared Docker daemon (see JOB_REAP_STEP in
-        # conventions/workflow-shell.ts); everything this job launched mounts its
-        # own test-temp, so that is what goes.
-        if: always()
-        run: |
-          base="${NORSK_CTL_TEST_TMP:-}"
-          tt="$GITHUB_WORKSPACE/test-temp"
-          s=""
-          for c in $(docker ps -aq); do
-            src="$(docker inspect -f '{{range .Mounts}}{{println .Source}}{{end}}' "$c" 2>/dev/null)" || continue
-            if { [ -n "$base" ] && grep -q "^$base/" <<<"$src"; } || grep -q "^$tt/" <<<"$src"; then s="$s $c"; fi
-          done
-          if [ -n "$s" ]; then
-            echo "::warning::removing containers this job left running:$s"
-            docker rm -f $s
-          fi