ci: auto-update ECS runners on stable publish and harden update job

.github/workflows/qwen-triage.yml

@@ -575,15 +575,16 @@ jobs:
           sed -i "s/qwen3\.7-max/${ESCAPED}/g" "$TARGET"
 
       - name: 'Ensure qwen CLI'
+        id: 'ensure_qwen'
         run: |-
           set -euo pipefail
           if command -v qwen >/dev/null 2>&1; then
             echo "qwen already installed:"
-            qwen --version
           else
             npm install -g --loglevel=error --no-audit @qwen-code/qwen-code@latest
-            qwen --version
           fi
+          qwen --version
+          echo "version=$(qwen --version)" >> "${GITHUB_OUTPUT}"
 
       - name: 'Run Qwen Triage'
         id: 'triage'
@@ -600,6 +601,12 @@ jobs:
           OPENAI_API_KEY: '${{ secrets.OPENAI_API_KEY }}'
           OPENAI_BASE_URL: '${{ secrets.OPENAI_BASE_URL }}'
           OPENAI_MODEL: '${{ vars.QWEN_TRIAGE_MODEL || vars.QWEN_PR_REVIEW_MODEL }}'
+          # Pin the action's unconditional global reinstall to the version
+          # this job already runs. Left at `latest`, the action installs with
+          # --prefer-offline and resolves the dist-tag from the runner's
+          # persistent npm cache, which lags npm publishes and has downgraded
+          # the shared ECS box back to a stale release.
+          qwen_cli_version: '${{ steps.ensure_qwen.outputs.version }}'
           # The input name is `settings` — this action version has no
           # `settings_json` input. The old `settings_json:` block was silently
           # dropped ("Unexpected input(s) 'settings_json'" in the run log), so

.github/workflows/release.yml

@@ -611,6 +611,28 @@ jobs:
             --notes-file "${NOTES_FILE}" \
             ${PRERELEASE_FLAG}
 
+      - name: 'Trigger ECS runner qwen update'
+        # Stable releases only: nightly/preview must not move the fleet.
+        if: |-
+          ${{ github.repository == 'QwenLM/qwen-code' &&
+              needs.prepare.outputs.is_dry_run == 'false' &&
+              needs.prepare.outputs.npm_tag == 'latest' }}
+        # The packages are already published; a dispatch failure must not
+        # fail the release — report it and let maintainers re-run the update
+        # workflow manually instead.
+        continue-on-error: true
+        env:
+          GITHUB_TOKEN: '${{ secrets.CI_BOT_PAT }}'
+          RELEASE_VERSION: '${{ needs.prepare.outputs.release_version }}'
+        run: |-
+          gh api "repos/${GITHUB_REPOSITORY}/dispatches" \
+            --method POST \
+            -f 'event_type=npm-published' \
+            -f "client_payload[version]=${RELEASE_VERSION}" || {
+              echo "::error::npm-published dispatch failed; run the 'Update ECS Runner Qwen' workflow manually."
+              exit 1
+            }
+
   notify_failure:
     name: 'Notify Release Failure'
     runs-on: 'ubuntu-latest'

.github/workflows/update-ecs-runner-qwen.yml

@@ -55,7 +55,24 @@ jobs:
           # carry a runner user's custom npm prefix into the sudo install.
           (
             cd "${RUNNER_TEMP:?}"
-            sudo env -u NPM_CONFIG_PREFIX npm install -g --registry=https://registry.npmjs.org "@qwen-code/qwen-code@${VERSION}"
+            # All runner processes of a region share one machine, so another
+            # job's concurrent `npm install -g` can race npm's rename of the
+            # package dir (ENOTEMPTY). Clear trash left by crashed installs
+            # and retry through the seconds-long race window.
+            PKG_DIR='/usr/local/lib/node_modules/@qwen-code'
+            for attempt in 1 2 3; do
+              sudo rm -rf "${PKG_DIR}"/.qwen-code-* 2>/dev/null || true
+              if sudo env -u NPM_CONFIG_PREFIX npm install -g --registry=https://registry.npmjs.org "@qwen-code/qwen-code@${VERSION}"; then
+                exit 0
+              fi
+              if [[ "${attempt}" -lt 3 ]]; then
+                echo "::warning::npm install attempt ${attempt} failed; retrying"
+                sleep $((attempt * 10))
+              else
+                echo "::error::npm install of @qwen-code/qwen-code@${VERSION} failed after 3 attempts"
+              fi
+            done
+            exit 1
           )
 
       - name: 'Verify version'

scripts/tests/qwen-triage-workflow.test.js

@@ -219,6 +219,16 @@ describe('qwen-triage tmux workflow', () => {
     expect(runStep).toContain("QWEN_HOME: '${{ runner.temp }}/qwen-home'");
   });
 
+  it('pins the action reinstall to the version the job already runs', () => {
+    expect(workflow).toContain("id: 'ensure_qwen'");
+    expect(workflow).toContain(
+      'echo "version=$(qwen --version)" >> "${GITHUB_OUTPUT}"',
+    );
+    expect(workflow).toContain(
+      "qwen_cli_version: '${{ steps.ensure_qwen.outputs.version }}'",
+    );
+  });
+
   it('passes triage output through env before bash reads it', () => {
     const checkStep = step('Check triage response');
 

scripts/tests/release-workflow.test.js

@@ -0,0 +1,42 @@
+/**
+ * @license
+ * Copyright 2026 Qwen Team
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import { readFileSync } from 'node:fs';
+import { describe, expect, it } from 'vitest';
+
+const workflow = readFileSync('.github/workflows/release.yml', 'utf8');
+
+describe('release workflow', () => {
+  it('fires the fleet-moving npm-published dispatch on stable releases only', () => {
+    // This gate is the sole protection keeping a nightly/preview/dry-run
+    // release from moving the ECS fleet; the triggered update workflow
+    // installs whatever version it is handed, so there is no downstream
+    // guard. Pin all three clauses together so dropping or inverting one
+    // fails review instead of silently shipping a non-stable fleet.
+    expect(workflow).toContain(
+      'if: |-\n' +
+        "          ${{ github.repository == 'QwenLM/qwen-code' &&\n" +
+        "              needs.prepare.outputs.is_dry_run == 'false' &&\n" +
+        "              needs.prepare.outputs.npm_tag == 'latest' }}",
+    );
+    expect(workflow).toContain("-f 'event_type=npm-published'");
+    expect(workflow).toContain(
+      '-f "client_payload[version]=${RELEASE_VERSION}"',
+    );
+  });
+
+  it('keeps a dispatch failure from failing an already-published release', () => {
+    // The packages are published before this step runs, so it must not fail
+    // the release; but the failure must still surface (as an error, not a
+    // warning) so the fleet can be reconciled via a manual re-run.
+    expect(workflow).toContain(
+      'continue-on-error: true\n' +
+        '        env:\n' +
+        "          GITHUB_TOKEN: '${{ secrets.CI_BOT_PAT }}'",
+    );
+    expect(workflow).toContain('echo "::error::npm-published dispatch failed;');
+  });
+});

scripts/tests/update-ecs-runner-qwen-workflow.test.js

@@ -17,4 +17,18 @@ describe('ECS runner qwen update workflow', () => {
     expect(workflow).toContain('cd "${RUNNER_TEMP:?}"');
     expect(workflow).toContain('sudo env -u NPM_CONFIG_PREFIX npm install -g');
   });
+
+  it('annotates a retry and a terminal failure distinctly', () => {
+    // The final attempt must not log a "retrying" warning that never
+    // retries; a sustained failure ends with an explicit exhausted error.
+    expect(workflow).toContain(
+      'echo "::warning::npm install attempt ${attempt} failed; retrying"',
+    );
+    expect(workflow).toContain(
+      'echo "::error::npm install of @qwen-code/qwen-code@${VERSION} failed after 3 attempts"',
+    );
+    expect(workflow).toContain('for attempt in 1 2 3; do');
+    expect(workflow).toContain('if [[ "${attempt}" -lt 3 ]]; then');
+    expect(workflow).toContain('sudo rm -rf "${PKG_DIR}"/.qwen-code-*');
+  });
 });