@norskvideo/ctl-dev-kit 0.2.64 → 0.2.66

package/conventions/upgrade-latest.sdk-app.yml

@@ -1,456 +0,0 @@
-# The sdk-app variant of upgrade-latest.yml: keep a bespoke-SDK product (no
-# Studio -- norsk-relay) fresh against the Norsk "nightly" channel (RFC 0001 --
-# product version freshness). Kept in lockstep with upgrade-latest.yml outside
-# the bump step; check-drift holds an sdk-app repo's copy to THIS file.
-#
-# An sdk-app has no Studio, so no {engine, studio} pair to take from
-# norsk-studio's channel manifest and no manifest.seed.json to anchor on. Its
-# whole norsk family is ONE version string: the @norskvideo/norsk-sdk and
-# norsk-api npm packages and the norskvideo/norsk engine image are built from
-# one commit and published under one version. The product's own exact
-# norsk-sdk pin is the current value; the SDK's npm nightly is the new one, and
-# the step confirms norsk-api and the engine image exist at it BEFORE rewriting
-# anything. Then every occurrence of the old string moves, lockfile aside (bun
-# install regenerates it) -- including the engine image ref the product's
-# template launches, which an sdk-app pins in its own source.
-#
-# Nightly cron + on demand. The bump runs the product's own gate (lint,
-# typecheck, unit tests), then ALWAYS opens (or updates) a PR on
-# upgrade-latest/nightly, exactly as upgrade-latest.yml does, for bot-prs to
-# merge once the PR's tiers are green; it never pushes to main (see that file
-# for why). The branch is pushed with CI_DISPATCH_TOKEN (a PAT), so the PR's
-# workflows fire -- a GITHUB_TOKEN push would fire nothing. It also moves
-# flake.nix's ctlVersion, the norsk-ctl the product's CI tiers run, to the
-# `latest` channel: an sdk-app's flake fetches no daemon, so it carries the
-# version alone (ctl-pinned-in-repo.test.ts).
-#
-# Single-sourced in @norskvideo/ctl-dev-kit (conventions/upgrade-latest.sdk-app.yml)
-# and copied verbatim into each sdk-app product repo as
-# .github/workflows/upgrade-latest.yml; the check:drift gate fails CI if a copy
-# diverges. Only the `product:` value below is per-repo (set it to this repo's
-# dashboard key); everything else must match the dev-kit source. Never hand-edit
-# the copy — edit the dev-kit source and re-sync.
-name: upgrade-latest
-
-on:
-  schedule:
-    - cron: "17 4 * * *"
-  workflow_dispatch:
-
-permissions:
-  contents: write
-
-jobs:
-  bump:
-    runs-on: x64
-    outputs:
-      changed: ${{ steps.bump.outputs.changed }}
-      summary: ${{ steps.bump.outputs.summary }}
-    steps:
-      # Runs BEFORE checkout, and does two things: points the harness's temp base
-      # out of the workspace for every later step in this job, and clears whatever
-      # the old repo-local default left behind on this runner. The body carries the
-      # why. It fails the job only when legacy litter survives -- which would take
-      # the checkout down a step later anyway, but report nothing useful.
-      - name: Route test-temp out of the workspace (pre-checkout)
-        run: |
-          set -uo pipefail
-          # These runners are docker-OUTSIDE-of-docker, so a bind-mount source the
-          # HOST daemon has not seen before is created by dockerd, as ROOT, on the
-          # host -- even when the launch passes --container-user (reproduced
-          # 2026-09-04). The harness's default base is repo-local for an OrbStack
-          # inotify constraint that binds macOS dev and nothing here, so every run
-          # seeded the CHECKOUT with root-owned dirs a non-root `git clean -ffdx`
-          # cannot remove. That took commentary's checks AND integration red on
-          # 2026-09-03. Use the sanctioned override, per-run and outside the
-          # checkout -- as 8ff17a8d did in June for one debug workflow, and stopped.
-          base="$RUNNER_TEMP/nctt-$GITHUB_RUN_ID-$GITHUB_RUN_ATTEMPT"
-          mkdir -p "$base"
-          echo "NORSK_CTL_TEST_TMP=$base" >> "$GITHUB_ENV"
-          # Yesterday's bases hold dockerd-created root dirs, so a non-root rm
-          # EACCESes. They cannot wedge a checkout, but they do fill the disk.
-          for old in $(find "$RUNNER_TEMP" -maxdepth 1 -name 'nctt-*' -mtime +0 -printf '%f\n' 2>/dev/null || true); do
-            docker run --rm --user 0:0 -v "$RUNNER_TEMP":/t alpine sh -c 'rm -rf -- "/t/$1"' sh "$old" >/dev/null 2>&1 || true
-          done
-          # LEGACY: a runner that ran the old default still carries a workspace
-          # test-temp, and a checkout with clean:true dies on it. Reap the holders
-          # first -- rm cannot unlink a live mountpoint even as root (EBUSY), and a
-          # RESTARTING leaked container re-creates the path as root seconds after
-          # any clean. Match on mount SOURCE, not a label: the holders are untracked
-          # by construction, because a killed run labels nothing.
-          tt="$GITHUB_WORKSPACE/test-temp"
-          [ -d "$tt" ] || exit 0
-          stuck=""
-          for c in $(docker ps -aq 2>/dev/null || true); do
-            if docker inspect -f '{{range .Mounts}}{{println .Source}}{{end}}' "$c" 2>/dev/null | grep -q "^$tt/"; then
-              stuck="$stuck $c"
-            fi
-          done
-          if [ -n "$stuck" ]; then
-            echo "reaping containers holding mounts under $tt:$stuck"
-            docker rm -f $stuck || true
-          fi
-          # The DIRECTORY, not just its contents: an empty but root-owned base
-          # still EACCESes a later mkdtemp. Mounting the PARENT is what lets a root
-          # container unlink the leaf.
-          docker run --rm --user 0:0 -v "$GITHUB_WORKSPACE":/w alpine \
-            sh -c 'rm -rf /w/test-temp' || rm -rf "$tt" || true
-          # Fail HERE if it survived. The checkout fails on it either way, but
-          # reports only an EACCES rmdir with no clue what was holding the path.
-          if [ -e "$tt" ]; then
-            echo "::error::$tt survived the pre-checkout clean"
-            ls -lan "$tt" || true
-            exit 1
-          fi
-
-      - uses: actions/checkout@v5
-        with:
-          token: ${{ secrets.CI_DISPATCH_TOKEN }}
-          clean: true
-
-      - name: Resolve the SDK nightly and rewrite the norsk family
-        id: bump
-        run: |
-          set -euo pipefail
-          reg="https://registry.npmjs.org"
-          hub="https://hub.docker.com/v2/repositories/norskvideo/norsk/tags"
-          tag_re='^[0-9]+\.[0-9]+\.[0-9]+-[0-9]{4}-[0-9]{2}-[0-9]{2}-[0-9a-f]+$'
-          changed=0
-          parts=()
-
-          # NORSK-CTL: the version flake.nix's ctlVersion names is the daemon every
-          # CI tier runs (ctl-pinned-in-repo.test.ts) as well as the one the dev
-          # shell launches, so it moves here like the engine does and the bump
-          # PR's tiers are what test it (ci-workflows docs/dashboard/
-          # ci-fragility.md, proposal A). Resolved up front, with everything
-          # else, so a refusal rewrites nothing.
-          ctl_base="https://s3.eu-west-1.amazonaws.com/norsk.video/norsk-ctl"
-          old_ctl="$( { grep -oE 'ctlVersion = "[^"]+"' flake.nix 2>/dev/null || true; } | head -1 | sed -E 's/.*"(.*)"/\1/')"
-          [ -n "$old_ctl" ] || { echo "::error::flake.nix pins no ctlVersion. CI runs the norsk-ctl it names, so add ctlVersion = \"<version>\"; to flake.nix."; exit 1; }
-          new_ctl="$(curl -fsSL --retry 3 --retry-all-errors --retry-delay 2 "$ctl_base/latest")"
-          [ -n "$new_ctl" ] || { echo "::error::could not resolve norsk-ctl's latest channel"; exit 1; }
-
-          # CURRENT: the product's exact norsk-sdk pin, wherever a tracked
-          # package.json carries it (deps, devDeps or overrides). It is the one
-          # string the family shares, so exactly one distinct value: none means
-          # nothing to anchor on, two means a rewrite would leave half behind.
-          old="$(git grep -hoE '"@norskvideo/norsk-sdk"[[:space:]]*:[[:space:]]*"[0-9]+\.[0-9]+\.[0-9]+-[0-9]{4}-[0-9]{2}-[0-9]{2}-[0-9a-f]+"' -- '*package.json' \
-            | sed -E 's/.*"([^"]+)"$/\1/' | sort -u || true)"
-          case "$(printf '%s' "$old" | grep -c .)" in
-            1) ;;
-            0) echo "::error::no exact @norskvideo/norsk-sdk nightly pin in any package.json: nothing to anchor the bump on"; exit 1 ;;
-            *) echo "::error::@norskvideo/norsk-sdk pins disagree across package.json files:"; echo "$old"; exit 1 ;;
-          esac
-
-          # NEW: the SDK's npm nightly. Not norsk-studio's channel manifest: that
-          # pairs the engine with a Studio image, and an sdk-app runs no Studio,
-          # so it would hold the product back whenever Studio's nightly stalls.
-          new="$(curl -fsSL --retry 3 --retry-all-errors --retry-delay 2 "$reg/@norskvideo%2Fnorsk-sdk" | jq -r '."dist-tags".nightly // empty')"
-          printf '%s' "$new" | grep -qE "$tag_re" || { echo "::error::the norsk-sdk npm nightly is not a dated nightly version: '$new'"; exit 1; }
-
-          # Everything resolved and checked BEFORE anything is rewritten, so a
-          # refusal never leaves the SDK moved and the API or the engine not.
-          api_has="$(curl -fsSL --retry 3 --retry-all-errors --retry-delay 2 "$reg/@norskvideo%2Fnorsk-api" | jq -r --arg v "$new" '.versions[$v] | if . == null then "" else "yes" end')"
-          [ "$api_has" = "yes" ] || { echo "::error::@norskvideo/norsk-api has no $new: the SDK nightly is not a whole family yet"; exit 1; }
-          curl -fsS --retry 3 --retry-delay 2 -o /dev/null "$hub/$new" ||
-            { echo "::error::the engine image norskvideo/norsk:$new is not published: not pinning an engine nobody can pull"; exit 1; }
-
-          # STRANDED: the rewrite below is a literal replace of the anchor, so a
-          # family pin that has drifted off it is invisible to this bump and to
-          # every later one, while the job reports success. Fail and name it
-          # rather than move it: a pin held back may be someone's decision.
-          stranded="$(git grep -hoE '"@norskvideo/norsk-(api|sdk|auto-manager|manager-sdk)"[[:space:]]*:[[:space:]]*"[0-9]+\.[0-9]+\.[0-9]+-[0-9]{4}-[0-9]{2}-[0-9]{2}-[0-9a-f]+"' -- '*package.json' \
-            | sed -E 's/.*"([^"]+)"$/\1/' | sort -u | grep -vxF "$old" | grep -vxF "$new" || true)"
-          if [ -n "$stranded" ]; then
-            echo "::error::npm norsk pins are stranded off the family: $(printf '%s' "$stranded" | tr '\n' ' ')"
-            echo "The family (api, sdk, auto-manager, manager-sdk) and the engine image share one version, so every pin"
-            echo "must read $new. These do not, and no later bump can reach them either. Set them to $new."
-            exit 1
-          fi
-
-          echo "norsk family: $old -> $new"
-          if [ "$old" != "$new" ]; then
-            git grep -lF "$old" -- . ':!bun.lock' | xargs -r sed -i "s|$old|$new|g"
-            changed=1
-            parts+=("media \`$new\`")
-          fi
-
-          # --- norsk-ctl pin (flake.nix) ------------------------------------
-          # ctlVersion, plus the per-platform hash of each platform the flake
-          # fetches the daemon for. A Studio product's flake fetches all four; an
-          # sdk-app's fetches none and carries the version alone. Mirrors
-          # packages/dev-kit/build/refresh-ctl-pin.sh in the ctl monorepo.
-          if [ "$old_ctl" != "$new_ctl" ]; then
-            declare -A ctlplat=([x86_64-linux]=linux-x64 [aarch64-linux]=linux-arm64 [aarch64-darwin]=darwin-arm64 [x86_64-darwin]=darwin-x64)
-            for sys in "${!ctlplat[@]}"; do
-              p="${ctlplat[$sys]}"
-              grep -qF "plat = \"$p\";" flake.nix || continue
-              hex="$(curl -fsSL --retry 3 --retry-all-errors --retry-delay 2 "$ctl_base/$new_ctl/norsk-ctl-$new_ctl-$p.sha256" | awk '{print $1}')"
-              [ -n "$hex" ] || { echo "no sha256 sidecar for $p"; exit 1; }
-              sri="$(nix hash convert --hash-algo sha256 --to sri "$hex")"
-              perl -0pi -e "s{(plat = \"$p\";\\s*hash = \")[^\"]*(\")}{\${1}$sri\${2}}" flake.nix
-            done
-            perl -0pi -e "s{(ctlVersion = \")[^\"]*(\")}{\${1}$new_ctl\${2}}" flake.nix
-            echo "ctl: $old_ctl -> $new_ctl"
-            changed=1
-            parts+=("norsk-ctl \`$new_ctl\`")
-          fi
-
-          summary=""
-          if [ ${#parts[@]} -gt 0 ]; then
-            summary="$(printf '%s, ' "${parts[@]}")"
-            summary="${summary%, }"
-          fi
-          {
-            echo "changed=$changed"
-            echo "summary=$summary"
-          } >> "$GITHUB_OUTPUT"
-
-      - name: Refresh the lockfile against the new pins
-        if: steps.bump.outputs.changed == '1'
-        # Per INSTALL ROOT: the rewrites above walk every tracked package.json,
-        # and a manifest outside the root workspace list owns a lockfile a
-        # root-only install never regenerates. See lockfile-reinstall.test.ts.
-        run: |
-          nix develop .#build --command bash -c '
-            set -euo pipefail
-            for lock in $(git ls-files "*bun.lock"); do
-              (cd "$(dirname "$lock")" && bun install)
-            done
-          '
-
-      - name: Run the product gate against the bumped pins
-        id: gate
-        if: steps.bump.outputs.changed == '1'
-        # continue-on-error so a red gate can open a PR below instead of failing
-        # the workflow -- which is why the steps after it read `outcome` and not
-        # `conclusion` (continue-on-error rewrites conclusion to success).
-        continue-on-error: true
-        run: |
-          nix develop .#build --command bash -c '
-            set -euo pipefail
-            bun run lint
-            bun run typecheck
-            bun run test:unit
-          '
-
-      # The bump's only way to main is this PR. bot-prs merges it once every tier
-      # that runs on a bot PR -- checks, smoke, integration and build-image's
-      # guides gate, wherever this repo has them -- is green on its head
-      # (ci-workflows docs/dashboard/ci-fragility.md, proposal B). Landing on a
-      # green gate kept lint, typecheck and unit failures off main, but the tiers
-      # that break on an upstream change ran only after landing, so a bad
-      # upstream release still turned main red in every repo that took it. The
-      # gate above still runs: its verdict heads the PR body, and a red one
-      # shows on the PR's own checks too. Never a draft: bot-prs reads red from
-      # the tiers, and a draft could never become ready again by PATCH.
-      - name: Open (or update) the bump PR
-        if: steps.bump.outputs.changed == '1'
-        env:
-          API_TOKEN: ${{ secrets.CI_DISPATCH_TOKEN }}
-          GATE: ${{ steps.gate.outcome }}
-          # Through env, never pasted into the script: the summary wraps each
-          # version in backticks, and inside a double-quoted shell string those
-          # ran as commands ("1.3.1-...: command not found"), dropping every
-          # version from the commit message and PR body.
-          SUMMARY: ${{ steps.bump.outputs.summary }}
-        run: |
-          set -euo pipefail
-          branch="upgrade-latest/nightly"
-          prefix="upgrade-latest/"
-          title="Bump the Norsk family to the SDK nightly"
-          repo="${{ github.repository }}"; owner="${repo%%/*}"
-          api="https://api.github.com/repos/$repo/pulls"
-          # An older PR of this bot's family is obsolete once this one is open:
-          # left open they piled up (nine were closed by hand on 2026-10-03).
-          # Best-effort: a failure here must not fail the bump.
-          close_superseded() {
-            local keep="$1" n
-            auth=(-H "Authorization: Bearer $API_TOKEN" -H "Accept: application/vnd.github+json")
-            for n in $(curl -sS "${auth[@]}" "$api?state=open&per_page=100" \
-                | jq -r --arg repo "$repo" --arg prefix "$prefix" --argjson keep "$keep" \
-                  '.[] | select(.head.repo.full_name == $repo and (.head.ref | startswith($prefix)) and .number != $keep) | .number'); do
-              curl -sS -o /dev/null "${auth[@]}" -X POST "https://api.github.com/repos/$repo/issues/$n/comments" \
-                -d "$(jq -nc --arg b "Superseded by #$keep, a later run of this bot." '{body:$b}')"
-              curl -sS -o /dev/null "${auth[@]}" -X PATCH "$api/$n" -d '{"state":"closed"}'
-              echo "closed superseded PR #$n"
-            done
-          }
-          git config user.name "github-actions[bot]"
-          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
-          git checkout -B "$branch"
-          git add -A
-          git commit -m "chore: bump the Norsk family to the SDK nightly
-
-          ${SUMMARY}
-
-          The norsk-sdk / norsk-api pins and the engine image ref moved together
-          via a global version-string replace; lockfile regenerated. flake.nix
-          ctlVersion, the norsk-ctl CI runs, moved to the latest channel."
-          # One branch per bump, force-pushed from today's main -- but only when
-          # its tree changed. A red bump PR left standing is rebuilt by every run
-          # of this bot, and pushing the same tree again would re-run every slow
-          # tier on it for nothing.
-          if git fetch -q origin "$branch" 2>/dev/null && [ "$(git rev-parse 'HEAD^{tree}')" = "$(git rev-parse 'FETCH_HEAD^{tree}')" ]; then
-            echo "$branch already holds this bump; not re-pushing it"
-          else
-            git push -f origin "$branch"
-          fi
-          if [ "$GATE" = "success" ]; then
-            verdict="Gate green: lint, typecheck and unit tests pass on the bumped pins."
-          else
-            verdict="**Gate red**: lint, typecheck or unit tests fail on the bumped pins. That usually means the new SDK nightly is bad, or genuinely changed something the product depends on. Fix it on this branch, or close this PR to skip the bump -- the next nightly run reopens it against whatever the channel holds then."
-          fi
-          body="$(printf '%s\n' \
-            "Automated nightly pin bump: the Norsk SDK nightly and norsk-ctl latest moved, and the pins came with them." \
-            "" \
-            "    ${SUMMARY}" \
-            "" \
-            "$verdict" \
-            "" \
-            "bot-prs merges this once checks, smoke, integration and the guides gate" \
-            "(build-image) have all passed on its head, wherever this repo runs them." \
-            "Until then main does not move; a red tier keeps it open and reports it on" \
-            "the product dashboard.")"
-          # gh is not on the self-hosted runner PATH (it lives only inside
-          # `nix develop`, and this step runs outside it), so create/update the PR
-          # straight against the REST API with the same PAT that pushed the branch.
-          # The PAT (not GITHUB_TOKEN) is what lets the PR's own workflows run,
-          # which is the whole point: the bump is judged before it lands.
-          curl_api=(--fail-with-body -sS -H "Authorization: Bearer $API_TOKEN" -H "Accept: application/vnd.github+json")
-          existing="$(curl "${curl_api[@]}" "$api?head=$owner:$branch&state=open" | jq -r '.[0].number // empty')"
-          if [ -n "$existing" ]; then
-            curl "${curl_api[@]}" -X PATCH "$api/$existing" \
-              --data "$(jq -nc --arg t "$title" --arg b "$body" '{title:$t, body:$b}')" > /dev/null
-            number="$existing"
-            echo "updated PR #$number"
-          else
-            number="$(curl "${curl_api[@]}" -X POST "$api" \
-              --data "$(jq -nc --arg t "$title" --arg b "$body" --arg h "$branch" \
-                '{title:$t, body:$b, head:$h, base:"main"}')" | jq -r .number)"
-            echo "opened PR #$number"
-          fi
-          close_superseded "$number" || true
-
-      - name: Report "already fresh"
-        if: steps.bump.outputs.changed != '1'
-        run: echo "Nightly pins already current — nothing to bump."
-      - name: Reap the containers this job launched
-        # Whatever the tests did. A teardown cut short by a test timeout leaves
-        # its instance running on the shared Docker daemon (see JOB_REAP_STEP in
-        # conventions/workflow-shell.ts); everything this job launched mounts its
-        # own test-temp, so that is what goes.
-        if: always()
-        run: |
-          base="${NORSK_CTL_TEST_TMP:-}"
-          tt="$GITHUB_WORKSPACE/test-temp"
-          s=""
-          for c in $(docker ps -aq); do
-            src="$(docker inspect -f '{{range .Mounts}}{{println .Source}}{{end}}' "$c" 2>/dev/null)" || continue
-            if { [ -n "$base" ] && grep -q "^$base/" <<<"$src"; } || grep -q "^$tt/" <<<"$src"; then s="$s $c"; fi
-          done
-          if [ -n "$s" ]; then
-            echo "::warning::removing containers this job left running:$s"
-            docker rm -f $s
-          fi
-
-  # Report the nightly bump result to the aggregated product CI dashboard
-  # (id3as/ci-workflows). !cancelled() so a failed bump shows a sad pony (a
-  # cancelled/superseded run must not false-red the board); the summary rides
-  # along as the cell detail.
-  notify:
-    needs: bump
-    if: ${{ !cancelled() }}
-    runs-on: x64
-    steps:
-      # Runs BEFORE checkout, and does two things: points the harness's temp base
-      # out of the workspace for every later step in this job, and clears whatever
-      # the old repo-local default left behind on this runner. The body carries the
-      # why. It fails the job only when legacy litter survives -- which would take
-      # the checkout down a step later anyway, but report nothing useful.
-      - name: Route test-temp out of the workspace (pre-checkout)
-        run: |
-          set -uo pipefail
-          # These runners are docker-OUTSIDE-of-docker, so a bind-mount source the
-          # HOST daemon has not seen before is created by dockerd, as ROOT, on the
-          # host -- even when the launch passes --container-user (reproduced
-          # 2026-09-04). The harness's default base is repo-local for an OrbStack
-          # inotify constraint that binds macOS dev and nothing here, so every run
-          # seeded the CHECKOUT with root-owned dirs a non-root `git clean -ffdx`
-          # cannot remove. That took commentary's checks AND integration red on
-          # 2026-09-03. Use the sanctioned override, per-run and outside the
-          # checkout -- as 8ff17a8d did in June for one debug workflow, and stopped.
-          base="$RUNNER_TEMP/nctt-$GITHUB_RUN_ID-$GITHUB_RUN_ATTEMPT"
-          mkdir -p "$base"
-          echo "NORSK_CTL_TEST_TMP=$base" >> "$GITHUB_ENV"
-          # Yesterday's bases hold dockerd-created root dirs, so a non-root rm
-          # EACCESes. They cannot wedge a checkout, but they do fill the disk.
-          for old in $(find "$RUNNER_TEMP" -maxdepth 1 -name 'nctt-*' -mtime +0 -printf '%f\n' 2>/dev/null || true); do
-            docker run --rm --user 0:0 -v "$RUNNER_TEMP":/t alpine sh -c 'rm -rf -- "/t/$1"' sh "$old" >/dev/null 2>&1 || true
-          done
-          # LEGACY: a runner that ran the old default still carries a workspace
-          # test-temp, and a checkout with clean:true dies on it. Reap the holders
-          # first -- rm cannot unlink a live mountpoint even as root (EBUSY), and a
-          # RESTARTING leaked container re-creates the path as root seconds after
-          # any clean. Match on mount SOURCE, not a label: the holders are untracked
-          # by construction, because a killed run labels nothing.
-          tt="$GITHUB_WORKSPACE/test-temp"
-          [ -d "$tt" ] || exit 0
-          stuck=""
-          for c in $(docker ps -aq 2>/dev/null || true); do
-            if docker inspect -f '{{range .Mounts}}{{println .Source}}{{end}}' "$c" 2>/dev/null | grep -q "^$tt/"; then
-              stuck="$stuck $c"
-            fi
-          done
-          if [ -n "$stuck" ]; then
-            echo "reaping containers holding mounts under $tt:$stuck"
-            docker rm -f $stuck || true
-          fi
-          # The DIRECTORY, not just its contents: an empty but root-owned base
-          # still EACCESes a later mkdtemp. Mounting the PARENT is what lets a root
-          # container unlink the leaf.
-          docker run --rm --user 0:0 -v "$GITHUB_WORKSPACE":/w alpine \
-            sh -c 'rm -rf /w/test-temp' || rm -rf "$tt" || true
-          # Fail HERE if it survived. The checkout fails on it either way, but
-          # reports only an EACCES rmdir with no clue what was holding the path.
-          if [ -e "$tt" ]; then
-            echo "::error::$tt survived the pre-checkout clean"
-            ls -lan "$tt" || true
-            exit 1
-          fi
-
-      - uses: actions/checkout@v5
-        with:
-          clean: true
-      - id: meta
-        run: |
-          if [ "${{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') }}" = "true" ]; then
-            echo "state=failure" >> "$GITHUB_OUTPUT"
-          else
-            echo "state=success" >> "$GITHUB_OUTPUT"
-          fi
-      - uses: ./.github/actions/ci-status-dispatch
-        with:
-          token: ${{ secrets.CI_DISPATCH_TOKEN }}
-          product: __PRODUCT__
-          pipeline: nightly
-          status: ${{ steps.meta.outputs.state }}
-          detail: ${{ needs.bump.outputs.summary }}
-      - name: Reap the containers this job launched
-        # Whatever the tests did. A teardown cut short by a test timeout leaves
-        # its instance running on the shared Docker daemon (see JOB_REAP_STEP in
-        # conventions/workflow-shell.ts); everything this job launched mounts its
-        # own test-temp, so that is what goes.
-        if: always()
-        run: |
-          base="${NORSK_CTL_TEST_TMP:-}"
-          tt="$GITHUB_WORKSPACE/test-temp"
-          s=""
-          for c in $(docker ps -aq); do
-            src="$(docker inspect -f '{{range .Mounts}}{{println .Source}}{{end}}' "$c" 2>/dev/null)" || continue
-            if { [ -n "$base" ] && grep -q "^$base/" <<<"$src"; } || grep -q "^$tt/" <<<"$src"; then s="$s $c"; fi
-          done
-          if [ -n "$s" ]; then
-            echo "::warning::removing containers this job left running:$s"
-            docker rm -f $s
-          fi