chore(ci): bump the dev-env image to v2.2.1 and drop the mops prewarm

[marc0olo]

Stack

	PR	Base	Contents
2	#1483 (you are here)	fix/flaky-example-tests	dev-env image → v2.2.1, drops the mops prewarm
1	#1482	master	the three flakiness fixes

Merge bottom-up. GitHub has no stacked-PR view, so this table is maintained by hand.

---

Bumps the dev-env image v2.0.0 → v2.2.1 and removes the mops install prewarm step #1482 added, in one commit, because the two are coupled: dropping the prewarm before CI runs mops ≥ 3.2.1 brings the flake straight back.

Why the prewarm can go

mops 3.2.1 fixed caffeinelabs/mops#818 — a version is now extracted into a staging directory and renamed into place under a per-version lock, and the project-local .mops/_tmp scratch directory is gone. Verified against the real example rather than the changelog:

scenario	mops 3.1.0 (in v2.0.0)	mops 3.2.2 (in v2.2.1)
icp build on motoko/pub-sub, cold moc cache, no prewarm	3/3 fail	3/3 clean
two concurrent mops build, cold cache	3/6 fail	0/8 clean

The waiting process now prints Waiting for another mops process to install moc <version>... and uses the finished install. 3.2.1 also replaced the opaque exit code: undefined with the actual signal or spawn error.

What else rides along

v2.2.1 is not only mops:

ICP_CLI_VERSION  1.3.0   → 1.5.0
NODE_VERSION     24.15.0 → 24.21.0
PNPM_VERSION     11.4.0  → 11.26.0
IC_MOPS_VERSION  3.1.0   → 3.2.2
YQ_VERSION       4.53.3  → 4.53.6

It also carries a security fix: mops 3.2.2 closes GHSA-7w5x-hrqm-74c2 / CVE-2026-85730 (CVSS 8.2, CWE-835), where smol-toml never returns on a value followed by an unterminated comment inside an array or inline table. mops reads each installed dependency's own mops.toml during resolution, so the exposure is through third-party manifests, not just your own file.

Neither icp-cli 1.4.0 nor 1.5.0 has a breaking change, but 1.5.0 changes one behaviour worth watching here:

Env-specific builds previously did not affect which canisters were being built. Now, any canisters not listed in that environment will not be built.

Eleven of 72 example icp.yaml files declare environments:, so that is the most likely place for this bump to bite. Keeping the bump separate from #1482 is what makes a red check here attributable to the toolchain rather than to the flakiness fixes.

🤖 Generated with Claude Code