@norskvideo/ctl-dev-kit 0.2.64 → 0.2.66

package/conventions/sync-ctl-packages.yml

@@ -1,309 +0,0 @@
-# Keep this product fresh against the ctl-* npm family: the test harness that
-# drives its smoke and integration tiers, the SDK, the foundation helpers and
-# the product-template schema. Also the @norskvideo/moq-* family, the MoQ
-# player stack the dashboards embed.
-#
-# sync-dev-kit already does this for the conventions package, and upgrade-latest
-# does it for the Norsk nightly line. Nothing did it for the rest, so the pins
-# drifted silently: on 2026-08-30 studio carried a conventions pin bumped that
-# morning beside an SDK three releases behind, and three repos ran three
-# different vintages of the same smoke runner. The caret ranges admit the new
-# versions -- `--frozen-lockfile` is what holds them back, and nothing ever
-# regenerated the lockfile.
-#
-# Rewriting the pins is not enough on its own: a family member can be a
-# transitive dep with no pin to rewrite, and the gate step re-resolves those
-# explicitly. Note the residual gap -- a staleness that is PURELY transitive
-# moves nothing in a package.json, so `changed` stays 0 and this workflow does
-# nothing that morning. It is picked up the next time any pin moves, which for
-# this family is most days.
-#
-# This NEVER pushes to main -- and since ci-fragility proposal B neither do
-# upgrade-latest or sync-dev-kit, which once landed on a green gate. Its gate
-# is drift + lint + typecheck + unit, and a bump to the test harness changes
-# the code that drives smoke and integration -- neither of which that gate
-# runs, because both need Docker and a licence; the PR's own tiers do, and
-# bot-prs merges it only once they pass. A red gate
-# still opens one, as a draft: adopting a breaking change is real engineering,
-# not a copy-paste, and the PR is where that work belongs.
-#
-# Single-sourced in @norskvideo/ctl-dev-kit (conventions/sync-ctl-packages.yml)
-# and copied verbatim into each product repo; the check:drift gate fails CI if a
-# copy diverges. Never hand-edit the copy -- edit the source and re-sync.
-name: sync-ctl-packages
-
-on:
-  schedule:
-    # Clear of sync-dev-kit's 04:37 so the two never race the same lockfile.
-    - cron: "52 4 * * *"
-  workflow_dispatch:
-
-permissions:
-  contents: write
-  pull-requests: write
-
-concurrency:
-  group: sync-ctl-packages-${{ github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  sync:
-    runs-on: x64
-    steps:
-      # Runs BEFORE checkout, and does two things: points the harness's temp base
-      # out of the workspace for every later step in this job, and clears whatever
-      # the old repo-local default left behind on this runner. The body carries the
-      # why. It fails the job only when legacy litter survives -- which would take
-      # the checkout down a step later anyway, but report nothing useful.
-      - name: Route test-temp out of the workspace (pre-checkout)
-        run: |
-          set -uo pipefail
-          # These runners are docker-OUTSIDE-of-docker, so a bind-mount source the
-          # HOST daemon has not seen before is created by dockerd, as ROOT, on the
-          # host -- even when the launch passes --container-user (reproduced
-          # 2026-09-04). The harness's default base is repo-local for an OrbStack
-          # inotify constraint that binds macOS dev and nothing here, so every run
-          # seeded the CHECKOUT with root-owned dirs a non-root `git clean -ffdx`
-          # cannot remove. That took commentary's checks AND integration red on
-          # 2026-09-03. Use the sanctioned override, per-run and outside the
-          # checkout -- as 8ff17a8d did in June for one debug workflow, and stopped.
-          base="$RUNNER_TEMP/nctt-$GITHUB_RUN_ID-$GITHUB_RUN_ATTEMPT"
-          mkdir -p "$base"
-          echo "NORSK_CTL_TEST_TMP=$base" >> "$GITHUB_ENV"
-          # Yesterday's bases hold dockerd-created root dirs, so a non-root rm
-          # EACCESes. They cannot wedge a checkout, but they do fill the disk.
-          for old in $(find "$RUNNER_TEMP" -maxdepth 1 -name 'nctt-*' -mtime +0 -printf '%f\n' 2>/dev/null || true); do
-            docker run --rm --user 0:0 -v "$RUNNER_TEMP":/t alpine sh -c 'rm -rf -- "/t/$1"' sh "$old" >/dev/null 2>&1 || true
-          done
-          # LEGACY: a runner that ran the old default still carries a workspace
-          # test-temp, and a checkout with clean:true dies on it. Reap the holders
-          # first -- rm cannot unlink a live mountpoint even as root (EBUSY), and a
-          # RESTARTING leaked container re-creates the path as root seconds after
-          # any clean. Match on mount SOURCE, not a label: the holders are untracked
-          # by construction, because a killed run labels nothing.
-          tt="$GITHUB_WORKSPACE/test-temp"
-          [ -d "$tt" ] || exit 0
-          stuck=""
-          for c in $(docker ps -aq 2>/dev/null || true); do
-            if docker inspect -f '{{range .Mounts}}{{println .Source}}{{end}}' "$c" 2>/dev/null | grep -q "^$tt/"; then
-              stuck="$stuck $c"
-            fi
-          done
-          if [ -n "$stuck" ]; then
-            echo "reaping containers holding mounts under $tt:$stuck"
-            docker rm -f $stuck || true
-          fi
-          # The DIRECTORY, not just its contents: an empty but root-owned base
-          # still EACCESes a later mkdtemp. Mounting the PARENT is what lets a root
-          # container unlink the leaf.
-          docker run --rm --user 0:0 -v "$GITHUB_WORKSPACE":/w alpine \
-            sh -c 'rm -rf /w/test-temp' || rm -rf "$tt" || true
-          # Fail HERE if it survived. The checkout fails on it either way, but
-          # reports only an EACCES rmdir with no clue what was holding the path.
-          if [ -e "$tt" ]; then
-            echo "::error::$tt survived the pre-checkout clean"
-            ls -lan "$tt" || true
-            exit 1
-          fi
-
-      - uses: actions/checkout@v5
-        with:
-          token: ${{ secrets.CI_DISPATCH_TOKEN }}
-          clean: true
-
-      - name: Resolve the newest published ctl-* and moq-* packages and rewrite the pins
-        id: bump
-        run: |
-          set -euo pipefail
-          reg="https://registry.npmjs.org"
-          # The conventions package is deliberately absent: sync-dev-kit owns it,
-          # bumps it in its own PR, and re-syncs the copied files with it.
-          # The moq-* members are the @norskvideo fork of moq-dev/moq that the
-          # dashboards play through. They pin each other at one version, so all
-          # nine move together, including the ones a product only gets
-          # transitively. A minor bump of these (0.1 -> 0.2) is a breaking API
-          # change, which is what the red-gate draft PR is for.
-          family="ctl-test-harness ctl-sdk ctl-foundation ctl-product-template-schema moq-signals moq-flate moq-pattern moq-net moq-json moq-loc moq-msf moq-hang moq-watch"
-
-          # Every tracked package.json, not just the root: a repo can pin the
-          # same package in a nested workspace (playout pins the harness twice),
-          # and a root-only rewrite would split the line across the two.
-          mapfile -t manifests < <(git ls-files '*package.json' ':!:**/node_modules/**')
-
-          moved=""
-          for short in $family; do
-            pkg="@norskvideo/$short"
-            enc="@norskvideo%2F$short"
-            # The runner has no npm; read the dist-tag off the registry with
-            # curl+jq, as sync-dev-kit and upgrade-latest both do.
-            new="$(curl -fsSL --retry 3 --retry-all-errors --retry-delay 2 "$reg/$enc" | jq -r '."dist-tags".latest')"
-            [ -n "$new" ] && [ "$new" != "null" ] || { echo "could not resolve $pkg latest"; exit 1; }
-
-            for m in "${manifests[@]}"; do
-              old="$(grep -oE "\"$pkg\"[[:space:]]*:[[:space:]]*\"[^\"]*\"" "$m" | head -1 | sed -E 's/.*"([^"]*)"$/\1/' || true)"
-              # Absent here, or a workspace protocol spec that names no version.
-              case "$old" in "" | workspace:*) continue ;; esac
-              old_bare="${old#^}"; old_bare="${old_bare#~}"
-              [ "$old_bare" != "$new" ] || continue
-              # Surgical single-line rewrite so the file keeps its formatting;
-              # a jq reserialize would reflow it and trip the formatter.
-              sed -i -E "s|(\"$pkg\"[[:space:]]*:[[:space:]]*\")[^\"]*(\")|\1^$new\2|" "$m"
-              echo "$m: $pkg $old -> ^$new"
-              moved="$moved- \`$pkg\` $old -> \`^$new\` ($m)"$'\n'
-            done
-          done
-
-          if [ -z "$moved" ]; then
-            echo "every ctl-* and moq-* pin is already on its newest published version."
-            echo "changed=0" >> "$GITHUB_OUTPUT"
-          else
-            echo "changed=1" >> "$GITHUB_OUTPUT"
-            { echo "moved<<PINS"; printf '%s' "$moved"; echo "PINS"; } >> "$GITHUB_OUTPUT"
-          fi
-
-      - name: Refresh the lockfiles against the new pins
-        if: steps.bump.outputs.changed == '1'
-        # NOT continue-on-error, unlike the gate below. A refresh that dies
-        # part-way (the runner OOM-killed it on 2026-10-03) leaves bumped
-        # manifests beside the old lockfiles; carrying on then committed exactly
-        # that, and every frozen install on the PR failed. Fail here instead,
-        # before anything is committed.
-        run: |
-          nix develop .#build --command bash -c '
-            set -euo pipefail
-            # Per INSTALL ROOT, not per repo. The rewrite above walks every
-            # tracked package.json, and a manifest outside the root workspace
-            # list (funke proxy/ui) owns its own lockfile that a root-only
-            # install never regenerates -- leaving a bumped pin its own
-            # --frozen-lockfile then rejects.
-            for lock in $(git ls-files "*bun.lock"); do
-              (cd "$(dirname "$lock")" && bun install)
-            done
-            # A ctl-* package also arrives TRANSITIVELY, and those never move on
-            # their own. probe pins no ctl-foundation at all: it comes through
-            # ctl-sdk and ctl-product-template-schema, both of which ask for
-            # ^0.1.0 -- and `bun install` keeps whatever the lockfile already
-            # resolved for a range it still satisfies. So probe sat on
-            # ctl-foundation 0.1.14 from 2026-09-02 while 0.1.19 was current,
-            # and this gate went red on an Export-named-parseProductRoleName-
-            # not-found from @norskvideo+ctl-foundation@0.1.14 -- which reads as
-            # the bumped harness breaking the product, when it is a four-week-
-            # stale transitive dep that no pin rewrite can reach. (No apostrophe
-            # anywhere in this step: the whole body is one bash -c string in
-            # single quotes, and conventions/workflow-quoting.test.ts fails on
-            # one.)
-            #
-            # Same family as the rewrite above, and deliberately named again
-            # rather than shared: the two steps are separate shells.
-            for pkg in ctl-test-harness ctl-sdk ctl-foundation ctl-product-template-schema moq-signals moq-flate moq-pattern moq-net moq-json moq-loc moq-msf moq-hang moq-watch; do
-              for lock in $(git ls-files "*bun.lock"); do
-                # Not every install root has every member, directly or
-                # otherwise; bun says so and this moves on.
-                (cd "$(dirname "$lock")" && bun update "@norskvideo/$pkg") || true
-              done
-            done
-          '
-
-      - name: Run the product gate
-        id: gate
-        if: steps.bump.outputs.changed == '1'
-        continue-on-error: true
-        run: |
-          nix develop .#build --command bash -c '
-            set -euo pipefail
-            bun run check:drift
-            bun run lint
-            bun run typecheck
-            bun run test:unit
-          '
-
-      - name: Open (or update) the pin-freshness PR
-        if: steps.bump.outputs.changed == '1'
-        env:
-          API_TOKEN: ${{ secrets.CI_DISPATCH_TOKEN }}
-          GATE: ${{ steps.gate.outcome }}
-          # Through the env, never interpolated into the script below: see the
-          # heredoc comment for what happens when it is.
-          MOVED: ${{ steps.bump.outputs.moved }}
-        run: |
-          set -euo pipefail
-          branch="chore/sync-ctl-packages"
-          git config user.name "github-actions[bot]"
-          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
-          git checkout -B "$branch"
-          git add -A
-          git commit -m "chore: sync the ctl-* and moq-* pins to their newest published versions"
-          # One branch, force-pushed: a daily schedule must refresh the standing
-          # PR rather than accumulate a new one every morning.
-          git push -f origin "$branch"
-
-          if [ "$GATE" = "success" ]; then
-            verdict="Gate green: check:drift, lint, typecheck and unit tests all pass on the new pins."
-            draft=false
-          else
-            verdict="**Gate red** — the new pins do not fit this product as-is. Adopting them is real engineering, not a merge."
-            draft=true
-          fi
-
-          # $MOVED, not the expression that produced it. This heredoc is unquoted
-          # so $verdict expands, which means its literal text is scanned for
-          # command substitution too -- and the moved-pin list names every package
-          # in backticks. Pasted in directly, each name RAN (exit 127, no PR,
-          # every morning since this workflow shipped). Bash does not rescan an
-          # expansion's result, so through the env the same backticks are inert.
-          body="$(cat <<EOF
-          Automated by \`sync-ctl-packages\`.
-
-          ## Pins moved
-
-          $MOVED
-
-          ## What the gate proved
-
-          $verdict
-
-          It did **not** run smoke or integration — both need Docker and a licence.
-          A test-harness bump changes the code that drives those tiers, so the
-          runs raised on this PR are the real evidence. Read them before merging.
-          EOF
-          )"
-
-          # gh is not on the self-hosted runner PATH -- it lives only inside
-          # `nix develop`, and this step runs outside it -- so create/update the
-          # PR straight against the REST API with the same PAT that pushed the
-          # branch. This is the identical fix sync-dev-kit already carries and
-          # documents; it was applied to one sibling convention and not its twin,
-          # so this step failed with exit 127 in every product repo. curl and jq
-          # ARE on the host PATH (the pin-resolve step above uses them).
-          title="chore: sync the ctl-* and moq-* pins to their newest published versions"
-          repo="${{ github.repository }}"; owner="${repo%%/*}"
-          api="https://api.github.com/repos/$repo/pulls"
-          curl_api=(--fail-with-body -sS -H "Authorization: Bearer $API_TOKEN" -H "Accept: application/vnd.github+json")
-          existing="$(curl "${curl_api[@]}" "$api?head=$owner:$branch&state=open" | jq -r '.[0].number // empty')"
-          if [ -n "$existing" ]; then
-            # draft is not settable by PATCH; the standing PR keeps whichever
-            # state it opened in and the refreshed body carries the verdict.
-            curl "${curl_api[@]}" -X PATCH "$api/$existing" \
-              --data "$(jq -nc --arg t "$title" --arg b "$body" '{title:$t, body:$b}')" >/dev/null
-          else
-            curl "${curl_api[@]}" -X POST "$api" \
-              --data "$(jq -nc --arg t "$title" --arg b "$body" --arg h "$branch" --argjson d "$draft" '{title:$t, body:$b, head:$h, base:"main", draft:$d}')" >/dev/null
-          fi
-      - name: Reap the containers this job launched
-        # Whatever the tests did. A teardown cut short by a test timeout leaves
-        # its instance running on the shared Docker daemon (see JOB_REAP_STEP in
-        # conventions/workflow-shell.ts); everything this job launched mounts its
-        # own test-temp, so that is what goes.
-        if: always()
-        run: |
-          base="${NORSK_CTL_TEST_TMP:-}"
-          tt="$GITHUB_WORKSPACE/test-temp"
-          s=""
-          for c in $(docker ps -aq); do
-            src="$(docker inspect -f '{{range .Mounts}}{{println .Source}}{{end}}' "$c" 2>/dev/null)" || continue
-            if { [ -n "$base" ] && grep -q "^$base/" <<<"$src"; } || grep -q "^$tt/" <<<"$src"; then s="$s $c"; fi
-          done
-          if [ -n "$s" ]; then
-            echo "::warning::removing containers this job left running:$s"
-            docker rm -f $s
-          fi