fix(native-pipeline): cap runtime session pile-up under the 6-user trial license

The portable-app runtime runs under a developer/trial license limited to 6
concurrent named users. Every Maestro flow does `launchApp clearState:true`,
which clears device state but opens a FRESH server session that lingers for the
default 10-min SessionTimeout. Widgets whose flow count (+smoke launch +retries)
exceeds 6 therefore wedge mid-suite on the "Maximum number of sessions exceeded"
screen — Precondition can't find the Widgets menu and the shard fails. This hit
background-image (8 flows), safe-area-view (7), accordion (6), and the js-tests
job (mobile-resources 5 + nanoflow 3 = 8); every <=5-flow widget stays green.

Fast-fail un-masked this rather than causing it: the old 4x-retry/long-timeout
config spread a shard's launches past the 10-min window, so early sessions
expired and freed slots before later retries ran (eventual green, just slow).

start-mendix-runtime now shortens the server session idle timeout
(RUNTIME_PARAMS_SESSIONTIMEOUT=60000, via a tunable session-timeout-ms input)
and reaps expired sessions promptly (RUNTIME_PARAMS_CLUSTERMANAGERACTIONINTERVAL
=30000), both ridden through the portable app's existing HOCON env overrides.
At ~30s/flow this holds peak concurrency to ~2-3, well under 6, with no test
changes. Confirmed against run 28168923730's safe-area-view runtime log.

Also reword script/action/workflow comments and the scripts README to describe
the current design instead of narrating what it replaced.

Author: vadim-v

.github/actions/setup-tools/action.yaml

@@ -7,11 +7,11 @@ outputs:
 runs:
   using: "composite"
   steps:
-    # NOTE: Python and Node/pnpm setup were both removed here.
-    #  - Python was only needed by the old m2ee runtime (replaced by the portable app package).
-    #  - Node/pnpm `install` ran the root `prepare` lifecycle (building tool packages), which the
-    #    maestro test jobs don't need and which flaked with ENOTEMPTY. Maestro is a standalone
-    #    binary, so the test jobs need only Java + Maestro.
+    # Test jobs need only Java + Maestro:
+    #  - the portable app package bundles the runtime, so there's no CDN runtime download and no
+    #    m2ee tooling to set up (and nothing here needs Python).
+    #  - Maestro is a standalone binary, so there's no Node/pnpm install — which would also run the
+    #    root `prepare` lifecycle the test jobs don't need (a known ENOTEMPTY flake source).
 
     - name: "Setup Java 21"
       id: setup-java
@@ -20,10 +20,6 @@ runs:
         distribution: "temurin"
         java-version: "21"
 
-    # NOTE: the Mendix-runtime tarball and m2ee-tools caches were removed here.
-    # The portable app package bundles the runtime, so the test jobs no longer
-    # download the runtime from the CDN or clone m2ee-tools.
-
     - name: "Install Maestro"
       uses: ./.github/actions/setup-maestro
 

.github/actions/start-mendix-runtime/action.yaml

@@ -21,6 +21,17 @@ inputs:
     description: "How long to wait for the runtime to become ready before failing"
     required: false
     default: "300"
+  session-timeout-ms:
+    description: >
+      Server-side session idle timeout (ms). The runtime uses a trial license capped at
+      6 concurrent named users, and every Maestro flow does `launchApp clearState: true`,
+      which starts a FRESH server session while the previous one lingers for the full
+      timeout. With Mendix's 10-min default, a widget with >5 flows piles past 6 sessions
+      and the next login fails with "Maximum number of sessions exceeded". A short idle
+      timeout lets each flow's session expire before the next ones accumulate. Active
+      sessions aren't affected — client requests keep resetting the idle timer mid-flow.
+    required: false
+    default: "60000"
 runs:
   using: "composite"
   steps:
@@ -32,6 +43,13 @@ runs:
         M2EE_ADMIN_PASS: ${{ inputs.admin-pass }}
         RUNTIME_URL: ${{ inputs.runtime-url }}
         TIMEOUT_SECONDS: ${{ inputs.timeout-seconds }}
+        # Read by the portable app's HOCON config (etc/variables.conf: ${?RUNTIME_PARAMS_*}),
+        # inherited by the JVM started below. Caps session pile-up under the 6-user trial
+        # license — see the session-timeout-ms input for the full rationale.
+        RUNTIME_PARAMS_SESSIONTIMEOUT: ${{ inputs.session-timeout-ms }}
+        # Reap expired sessions promptly (default cluster cleanup runs only every 5 min, which
+        # would hold license slots long after the sessions go idle).
+        RUNTIME_PARAMS_CLUSTERMANAGERACTIONINTERVAL: "30000"
       run: |
         set -euo pipefail
 

.github/scripts/README.md

@@ -64,14 +64,14 @@ would fail.
 
 -   **determine-nt-version.mjs** — resolves the Native Template release/branch from the
     Mendix version. Node ESM, no external deps (uses global `fetch` + a small version
-    comparator); run with the runner's preinstalled `node`. Replaced the former
-    `determine-nt-version.py` (the Python toolchain — `setup-python` / `pip install` —
-    was dropped). Fails loudly rather than silently pinning `master`.
+    comparator); run with the runner's preinstalled `node`. Fails loudly rather than
+    silently pinning `master`.
 -   **mxbuild.Dockerfile** — Docker image for mxbuild.
 
 > The Mendix runtime for the test jobs is produced as a **portable app package**
 > (`mxbuild --target=portable-app-package`) in the `project` job and started by the
 > `start-mendix-runtime` composite action, which waits for a real readiness probe.
-> This replaced the old `setup-runtime.sh` / `start-runtime-with-verification.sh`
-> scripts and the `m2ee-native.yml` config (which cloned m2ee-tools and downloaded
-> the runtime from the CDN).
+> That runtime runs under a 6-user trial license, so the action shortens the server
+> session idle timeout (`RUNTIME_PARAMS_SESSIONTIMEOUT`) — each Maestro flow opens a
+> fresh session via `launchApp clearState`, and a short timeout lets them expire
+> between flows instead of piling up past the cap.

.github/scripts/determine-nt-version.mjs

@@ -1,8 +1,7 @@
 #!/usr/bin/env node
 // Resolve which Native Template release/branch to build against, given the resolved Mendix
-// version. Ported from determine-nt-version.py (Phase 5, D3: standardise pipeline scripting on
-// Node/JS and drop the Python toolchain — no more setup-python / `pip install`). No external
-// deps: uses the global fetch + a small dotted-version comparator instead of requests/packaging.
+// version. No external deps: uses the global fetch + a small dotted-version comparator, so it
+// runs on the runner's preinstalled node with no setup step.
 
 import fs from "node:fs";
 

.github/workflows/NativePipeline.yml

@@ -248,8 +248,7 @@ jobs:
       - name: "Build resources"
         # On a full build with an exact cache hit every widget's dist is already current, so
         # skip the slow rollup/babel rebuild. Otherwise build the scoped widgets + JS actions
-        # in one pnpm invocation (multiple --filter targets run concurrently) instead of the
-        # old one-at-a-time loop.
+        # in one pnpm invocation (multiple --filter targets run concurrently).
         run: |
           if [ "${{ needs.scope.outputs.full_build }}" = "true" ] && [ "${{ steps.resources-cache.outputs.cache-hit }}" = "true" ]; then
             echo "Full build with cached resources — skipping rebuild."
@@ -359,9 +358,9 @@ jobs:
           fi
       - name: "Register widgets in the test project"
         # Run unconditionally: update-widgets must sync the project's widget definitions with the
-        # mpks in widgets/ regardless of whether THIS run overlaid fresh ones. Previously it was
-        # nested in the mpk-move guard, so a `js-actions` dispatch (or any run that builds no
-        # mpks) skipped it and left stale Atlas widget defs for the portable-app build.
+        # mpks in widgets/ regardless of whether THIS run overlaid fresh ones. Must NOT be nested
+        # in the mpk-move guard — a `js-actions` dispatch (or any run that builds no mpks) would
+        # then skip it and leave stale Atlas widget defs for the portable-app build.
         shell: bash
         run: mx update-widgets --loose-version-check Native-Mobile-Resources-main/NativeComponentsTestProject.mpr
       - name: "Move mobile-resources"