ci: add ECS runner qwen update workflow

.github/workflows/update-ecs-runner-qwen.yml

@@ -0,0 +1,67 @@
+name: 'Update ECS Runner Qwen'
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'Optional. Empty means latest from npm.'
+        required: false
+        default: ''
+        type: 'string'
+
+permissions:
+  contents: 'read'
+
+concurrency:
+  group: 'update-ecs-runner-qwen-sg'
+  cancel-in-progress: false
+
+jobs:
+  update:
+    name: 'Update Qwen on Singapore ECS runner'
+    if: "${{ github.repository == 'QwenLM/qwen-code' }}"
+    runs-on: ['self-hosted', 'linux', 'x64', 'ecs-qwen']
+    timeout-minutes: 10
+    steps:
+      - name: 'Resolve version'
+        id: 'version'
+        env:
+          INPUT_VERSION: '${{ inputs.version }}'
+        run: |-
+          set -euo pipefail
+          specifier="@qwen-code/qwen-code@${INPUT_VERSION#v}"
+          if [[ "${specifier}" == '@qwen-code/qwen-code@' ]]; then
+            specifier='@qwen-code/qwen-code@latest'
+          fi
+          version="$(npm view "${specifier}" version | tail -n 1)" || true
+          if [[ -z "${version}" ]]; then
+            echo "::error::No published qwen version matches '${INPUT_VERSION:-latest}'."
+            exit 1
+          fi
+          echo "version=${version}" >> "${GITHUB_OUTPUT}"
+          echo "Resolved qwen version: ${version}"
+
+      - name: 'Update qwen'
+        env:
+          VERSION: '${{ steps.version.outputs.version }}'
+        run: |-
+          set -euo pipefail
+          global_root="$(npm root -g)"
+          global_bin="$(npm prefix -g)/bin"
+          if [[ -w "${global_root}" && -w "${global_bin}" ]]; then
+            npm install -g "@qwen-code/qwen-code@${VERSION}"
+          elif command -v sudo >/dev/null 2>&1 && sudo -n true; then
+            sudo npm install -g "@qwen-code/qwen-code@${VERSION}"
+          else
+            echo "::error::Global npm install directories are not writable and passwordless sudo is unavailable."
+            exit 1
+          fi
+
+      - name: 'Verify version'
+        env:
+          VERSION: '${{ steps.version.outputs.version }}'
+        run: |-
+          set -euo pipefail
+          actual="$(qwen --version)"
+          echo "qwen version: ${actual}"
+          test "${actual}" = "${VERSION}"