@norskvideo/ctl-dev-kit 0.1.44 → 0.1.46

package/conventions/check-drift.ts

@@ -60,6 +60,11 @@ export const PRODUCT_SENTINEL = "__PRODUCT__";
 // unfilled-sentinel check.
 export const PUBLISH_IMAGE_LINE = /^(\s*PUBLISH_IMAGE:\s*).*$/gm;
 
+// smoke.yml carries a second per-repo line: the matrix `runner:` label array
+// the journey runs on ('["x64"]' for the pool, '["ARM64","nvidia"]' for the GPU
+// box). Masked like product:; any filled value is valid, so no sentinel check.
+export const RUNNER_LINE = /^(\s*-?\s*runner:\s*).*$/gm;
+
 function workflowProblem(
   relPath: string,
   canonicalRef: string,
@@ -74,7 +79,7 @@ function workflowProblem(
   if (mask(actual) !== mask(canonical)) {
     return `${relPath} has drifted from @norskvideo/ctl-dev-kit ${canonicalRef} (${firstDiffLine(mask(actual), mask(canonical))}). ${RESYNC}`;
   }
-  if (actual.match(/^\s*product:\s*(\S+)/m)?.[1] === PRODUCT_SENTINEL) {
+  if (new RegExp(`^\\s*product:\\s*${PRODUCT_SENTINEL}\\s*$`, "m").test(actual)) {
     return `${relPath} still has the ${PRODUCT_SENTINEL} placeholder — set \`product:\` to this repo's dashboard key.`;
   }
   return undefined;
@@ -239,6 +244,7 @@ export interface CanonicalBytes {
   buildImageBootstrap: string;
   gitignoreCore: string;
   buildImage: string;
+  smoke: string;
 }
 
 // A file that must be a verbatim, byte-for-byte copy of its dev-kit canonical.
@@ -397,6 +403,23 @@ export function checkDrift(repoRoot: string, canonical: CanonicalBytes): DriftRe
     );
   }
 
+  // smoke.yml is OPTIONAL until every product carries a tests/smoke.spec.ts
+  // (04b s7.2 sequences the required-file rule last). When present it is the
+  // shared, single-sourced workflow; only its `product:` dispatch key and the
+  // matrix `runner:` label array are per-repo.
+  const smokePath = join(repoRoot, ".github", "workflows", "smoke.yml");
+  if (existsSync(smokePath)) {
+    push(
+      workflowProblem(
+        ".github/workflows/smoke.yml",
+        "conventions/smoke.yml",
+        readFileSync(smokePath, "utf8"),
+        canonical.smoke,
+        [PRODUCT_LINE, RUNNER_LINE],
+      ),
+    );
+  }
+
   // publish-docs.yml is OPTIONAL — a product carries it once it has an
   // illustrated manual to publish nightly. Unlike the workflows above it has NO
   // per-repo line: it is deliberately product-agnostic (per-repo bits live in
@@ -430,6 +453,7 @@ if (import.meta.main) {
     buildImageBootstrap: readFileSync(join(import.meta.dir, "..", "build", "build-image.bootstrap.sh"), "utf8"),
     gitignoreCore: readFileSync(join(import.meta.dir, "gitignore.core"), "utf8"),
     buildImage: readFileSync(join(import.meta.dir, "build-image.yml"), "utf8"),
+    smoke: readFileSync(join(import.meta.dir, "smoke.yml"), "utf8"),
   };
   const report = checkDrift(repoRoot, canonical);
   if (report.ok) {

package/conventions/smoke.yml

@@ -0,0 +1,207 @@
+# The smoke tier, single-sourced in @norskvideo/ctl-dev-kit (conventions/smoke.yml)
+# and drift-checked — the two per-repo lines are the ci-status-dispatch
+# `product:` key and the `runner:` label array.
+#
+# One journey per product (04b s7.2): launch from the stored template, accept
+# the source the manifest advertises, produce the observable it advertises —
+# tests/smoke.spec.ts over @norskvideo/ctl-test-harness/smoke. The image under
+# test is built HERE (`bun run build:image`), on the same runner that holds the
+# licence, so the tier runs on pull requests and needs no cross-workflow state;
+# the bytes build-image pushed are covered by ctl's manifest-driven job from the
+# published tag instead. The daemon is the RELEASED norsk-ctl binary, as a
+# customer would run it.
+#
+# Runner selection is a one-entry matrix carrying a JSON label array, because a
+# string like '[ARM64, nvidia]' in runs-on is ONE label, not two. The runner
+# MUST run Docker natively: `product add --image` publishes the control plane on
+# a host port and the daemon polls 127.0.0.1:<port> for readiness, so on a
+# docker-outside-of-docker pool (the x64 runners are containers) that loopback
+# is the docker host's, never the runner's, and registration times out. Default
+# '["ar-arm-vm"]' (native Docker, arm64 — the image is built for it here); the
+# GPU box is '["ARM64","nvidia"]'.
+name: smoke
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+  repository_dispatch:
+    types: [ctl-candidate, pins-bumped]
+  workflow_dispatch:
+    inputs:
+      ctl_channel:
+        description: "norsk-ctl S3 channel to test against (release-gate dispatches 'rc' to validate a candidate before promoting latest)."
+        type: string
+        default: latest
+
+permissions:
+  contents: read
+
+# Key the group on event_name so a push never cancels an in-flight ctl-candidate
+# validation: pushes cancel pushes, candidate validations cancel only newer
+# candidates. A cancelled validation would score as a red at release-collect.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}-${{ github.event_name }}
+  cancel-in-progress: true
+
+jobs:
+  smoke:
+    strategy:
+      matrix:
+        include:
+          - runner: '["ar-arm-vm"]'
+    runs-on: ${{ fromJSON(matrix.runner) }}
+    steps:
+      # BEFORE checkout: launched instances leave root-owned bind-mount target
+      # dirs under test-temp/ that the non-root runner user cannot remove, so
+      # actions/checkout's own cleanup would fail the job before anything runs.
+      # Nuke them from a throwaway root container first. Best-effort.
+      - name: Clear stale root-owned test-temp (pre-checkout)
+        run: |
+          set -uo pipefail
+          tt="$GITHUB_WORKSPACE/test-temp"
+          [ -d "$tt" ] || exit 0
+          docker run --rm --user 0:0 -v "$tt":/t alpine sh \
+            -c 'rm -rf /t/* /t/.[!.]* 2>/dev/null || true' || rm -rf "$tt"/* 2>/dev/null || true
+
+      - uses: actions/checkout@v5
+        with:
+          clean: false
+
+      # A containerised runner (docker-outside-of-docker) reaches host-published
+      # ports via the host-gateway alias and can join norsk-net for direct reach;
+      # a bare-metal host runner (the GPU box) must stay on localhost + publish.
+      # Detect rather than hardcode, so one byte-identical file serves both.
+      - name: Probe runner docker topology and set NORSK_TEST_HOST + NORSK_NET_REACH
+        run: |
+          set -uo pipefail
+          echo "hostname=$(hostname)"
+          if docker inspect "$(hostname)" >/dev/null 2>&1; then
+            echo "TOPO: hostname resolves to a container -> runner is containerized (DooD)"
+            echo "NORSK_TEST_HOST=host.docker.internal" >> "$GITHUB_ENV"
+            echo "NORSK_NET_REACH=direct" >> "$GITHUB_ENV"
+          else
+            echo "TOPO: hostname is not a container -> runner is host-based"
+            echo "NORSK_TEST_HOST=localhost" >> "$GITHUB_ENV"
+            echo "NORSK_NET_REACH=publish" >> "$GITHUB_ENV"
+          fi
+
+      - name: Write the Norsk license (from the org secret)
+        env:
+          NORSK_LICENSE_V2: ${{ secrets.NORSK_LICENSE_V2 }}
+        run: printf '%s' "$NORSK_LICENSE_V2" > "$RUNNER_TEMP/norsk-license.json"
+
+      # Pick the binary for THIS runner's architecture: the GPU box is aarch64,
+      # the x64 pool is x86_64, and the wrong one dies with "Exec format error"
+      # deep in the suite. No `|| true` on --version: a bad binary must fail here.
+      - name: Download the released norsk-ctl binary
+        run: |
+          set -euo pipefail
+          channel="${{ github.event.client_payload.channel || inputs.ctl_channel || 'latest' }}"
+          case "$(uname -m)" in
+            x86_64) arch=linux-x64 ;;
+            aarch64 | arm64) arch=linux-arm64 ;;
+            *) echo "unsupported runner arch: $(uname -m)" >&2; exit 1 ;;
+          esac
+          S3="https://s3.eu-west-1.amazonaws.com/norsk.video/norsk-ctl"
+          ver="$(curl -fsSL "$S3/$channel")"
+          echo "norsk-ctl $channel channel -> $ver ($arch)"
+          curl -fsSL "$S3/$ver/norsk-ctl-$ver-$arch" -o "$RUNNER_TEMP/norsk-ctl"
+          chmod +x "$RUNNER_TEMP/norsk-ctl"
+          "$RUNNER_TEMP/norsk-ctl" --version
+
+      # Instance launch docker-composes the media + studio images; on a cold
+      # runner the first pull overruns the per-test timeout. Pre-pull them (tags
+      # from manifest.seed.json), plus whatever the repo lists in the optional
+      # scripts/smoke/prepull-extra.sh hook (a driver image, a sidecar).
+      - name: Pre-pull the media + studio images
+        run: |
+          set -euo pipefail
+          for img in "$(jq -r '.latest.media' manifest.seed.json)" "$(jq -r '.latest.studio' manifest.seed.json)"; do
+            echo "pre-pulling $img"
+            docker pull "$img"
+          done
+          if [ -x scripts/smoke/prepull-extra.sh ]; then
+            echo "running scripts/smoke/prepull-extra.sh"
+            ./scripts/smoke/prepull-extra.sh
+          fi
+
+      # The image is built UNDER THE LICENSED REPO: a V2 licence entitles a
+      # product by image repo (norskvideo/norsk-<x>-product), so `product add`
+      # refuses a throwaway name. That repo is the PUBLISH_IMAGE line
+      # build-image.yml already carries per repo; a build-only product (empty)
+      # falls back to its build script default, which its own licence must name.
+      - name: Build the image and run the smoke journey against it
+        env:
+          NORSK_CTL_BINARY: ${{ runner.temp }}/norsk-ctl
+          NORSK_LICENSE_FILE: ${{ runner.temp }}/norsk-license.json
+        run: |
+          nix develop .#build --command bash -c '
+            set -euo pipefail
+            # clean:false keeps node_modules between runs, and a frozen install
+            # does not reliably relink a hoisted package whose version moved: a
+            # stale test-harness once survived a bump and a new export was "not
+            # found" at import. Drop the harness copy so the pinned version runs.
+            rm -rf node_modules/@norskvideo/ctl-test-harness
+            bun install --frozen-lockfile
+            pub="$(sed -nE "s/^[[:space:]]*PUBLISH_IMAGE:[[:space:]]*\"?([^\" ]*)\"?[[:space:]]*$/\\1/p" .github/workflows/build-image.yml | head -1)"
+            def="$(sed -nE "s/.*IMAGE_TAG:-([^}]+)\\}.*/\\1/p" deployment/build-image.sh | head -1)"
+            export IMAGE_TAG="${pub:+$pub:smoke}"
+            export IMAGE_TAG="${IMAGE_TAG:-$def}"
+            echo "smoke image: $IMAGE_TAG"
+            bun run build:image
+            SMOKE_IMAGE_TAG="$IMAGE_TAG" bun run test:smoke
+          '
+
+  # Report this pipeline's result to the aggregated product CI dashboard
+  # (id3as/ci-workflows). !cancelled() so a real pass/fail reports, but a
+  # cancelled/superseded run does NOT — a cancellation dispatched as failure
+  # would false-red the board. Candidate validations report to ctl instead.
+  notify:
+    needs: smoke
+    if: ${{ !cancelled() && github.event_name != 'repository_dispatch' }}
+    runs-on: x64
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          clean: false
+      - id: meta
+        run: |
+          if [ "${{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') }}" = "true" ]; then
+            echo "state=failure" >> "$GITHUB_OUTPUT"
+          else
+            echo "state=success" >> "$GITHUB_OUTPUT"
+          fi
+      - uses: ./.github/actions/ci-status-dispatch
+        with:
+          token: ${{ secrets.CI_DISPATCH_TOKEN }}
+          product: __PRODUCT__
+          pipeline: smoke
+          status: ${{ steps.meta.outputs.state }}
+
+  # Report the rc-candidate validation result to the norsk-ctl release gate. Only
+  # on a ctl-candidate dispatch; release-collect tallies these and promotes
+  # latest once every gating product is green on the candidate.
+  report-candidate:
+    needs: smoke
+    if: ${{ always() && github.event_name == 'repository_dispatch' && github.event.action == 'ctl-candidate' }}
+    runs-on: x64
+    steps:
+      - name: Fire ctl-candidate-result at norsk-ctl
+        env:
+          GH_TOKEN: ${{ secrets.CI_DISPATCH_TOKEN }}
+          # Lowercase on purpose: the drift gate masks every `product:` line, so
+          # one per-repo key serves both the notify and the report jobs.
+          product: __PRODUCT__
+          VERSION: ${{ github.event.client_payload.version }}
+          RESULT: ${{ needs.smoke.result }}
+        run: |
+          set -euo pipefail
+          state=failure; [ "$RESULT" = "success" ] && state=success
+          body="$(jq -nc --arg p "$product" --arg v "$VERSION" --arg r "$state" \
+            '{event_type:"ctl-candidate-result",client_payload:{product:$p,version:$v,result:$r}}')"
+          code="$(curl -sS -o /dev/null -w '%{http_code}' -X POST \
+            -H "Authorization: Bearer $GH_TOKEN" \
+            -H "Accept: application/vnd.github+json" \
+            https://api.github.com/repos/id3as/norsk-ctl/dispatches -d "$body")"
+          [ "$code" = "204" ] || { echo "::error::report to norsk-ctl failed (HTTP $code)"; exit 1; }

package/conventions/sync-drift.ts

@@ -31,6 +31,7 @@ import {
   PRODUCT_LINE,
   PRODUCT_SENTINEL,
   PUBLISH_IMAGE_LINE,
+  RUNNER_LINE,
   splitAtMarkers,
 } from "./check-drift.ts";
 
@@ -91,6 +92,30 @@ function syncBuildImage(repoRoot: string, canonical: string, r: SyncReport): voi
   writeIfChanged(path, out, rel, r.written);
 }
 
+// smoke.yml: optional (a repo carries it once it has a smoke spec), canonical
+// byte-for-byte except the notify/report `product:` key and the matrix
+// `runner:` label array. Re-emit the canonical with both restored; the runner
+// line goes back through a function replacer so a `$` in it is never read as a
+// backreference.
+function syncSmoke(repoRoot: string, canonical: string, r: SyncReport): void {
+  const rel = ".github/workflows/smoke.yml";
+  const path = join(repoRoot, rel);
+  if (!existsSync(path)) {
+    r.skipped.push(`${rel} (absent)`);
+    return;
+  }
+  const existing = readFileSync(path, "utf8");
+  const key = existing.match(/^\s*product:\s*(\S+)/m)?.[1];
+  if (!key || key === PRODUCT_SENTINEL) {
+    r.skipped.push(`${rel} (no product: key to preserve)`);
+    return;
+  }
+  const runnerLine = existing.match(/^\s*-?\s*runner:.*$/m)?.[0];
+  let out = canonical.replace(PRODUCT_LINE, `$1${key}`);
+  if (runnerLine !== undefined) out = out.replace(RUNNER_LINE, () => runnerLine);
+  writeIfChanged(path, out, rel, r.written);
+}
+
 // flake.nix is verbatim except the dev-only ctl pin (ctlVersion + the four
 // per-platform hashes), which floats per repo. Re-emit canonical STRUCTURE with
 // the repo's pin restored in order — so a structural edit (e.g. a stray comment)
@@ -180,6 +205,7 @@ export function syncDrift(repoRoot: string, canonical: CanonicalBytes): SyncRepo
   syncWorkflow(repoRoot, ".github/workflows/upgrade-latest.yml", canonical.upgradeLatest, r);
   syncWorkflow(repoRoot, ".github/workflows/sync-dev-kit.yml", canonical.syncDevKit, r);
   syncBuildImage(repoRoot, canonical.buildImage, r);
+  syncSmoke(repoRoot, canonical.smoke, r);
 
   // publish-docs.yml is optional and verbatim (no per-repo line) — only re-sync a
   // repo that already carries it, unlike biome/tsconfig which every repo must have.
@@ -212,6 +238,7 @@ if (import.meta.main) {
     buildImageBootstrap: readFileSync(join(dir, "..", "build", "build-image.bootstrap.sh"), "utf8"),
     gitignoreCore: readFileSync(join(dir, "gitignore.core"), "utf8"),
     buildImage: readFileSync(join(dir, "build-image.yml"), "utf8"),
+    smoke: readFileSync(join(dir, "smoke.yml"), "utf8"),
   };
   const report = syncDrift(repoRoot, canonical);
   if (report.written.length === 0) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@norskvideo/ctl-dev-kit",
-  "version": "0.1.44",
+  "version": "0.1.46",
   "type": "module",
   "exports": {
     "./package.json": "./package.json",