@norskvideo/ctl-dev-kit 0.1.62 → 0.1.64

package/conventions/checks.yml

@@ -78,6 +78,31 @@ jobs:
             bun run docs:check
           '
 
+      # Does this repo's licence template still describe this repo? A template
+      # naming the wrong product, or an imageRef the build never produces, mints
+      # a licence that entitles nothing -- and the first sign of that is a
+      # 60-second readiness timeout at launch, indistinguishable from a product
+      # that failed to start. Cheap, no secrets, every PR.
+      #
+      # The image name is CI's own rule: PUBLISH_IMAGE when set, else the build
+      # script's IMAGE_TAG default, tag stripped -- a licence matches the repo
+      # part alone, never the tag.
+      - name: Check the licence template matches this repo
+        run: |
+          set -euo pipefail
+          product="$(sed -nE 's/.*PRODUCT_NAME[[:space:]]*=[[:space:]]*"([^"]+)".*/\1/p' shared/src/version.ts | head -1)"
+          [ -n "$product" ] || { echo "::error::could not read PRODUCT_NAME from shared/src/version.ts"; exit 1; }
+          pub="$(sed -nE 's/^[[:space:]]*PUBLISH_IMAGE:[[:space:]]*"?([^" ]*)"?[[:space:]]*$/\1/p' .github/workflows/build-image.yml | head -1)"
+          def="$(sed -nE 's/.*IMAGE_TAG:-([^}]+)\}.*/\1/p' deployment/build-image.sh | head -1)"
+          ref="${pub:-$def}"
+          # A colon is a tag only after the last slash (a registry host may carry a port).
+          image="${ref%:*}"
+          case "${ref##*/}" in *:*) ;; *) image="$ref" ;; esac
+          [ -n "$image" ] || { echo "::error::could not determine the image this repo builds"; exit 1; }
+          nix develop .#build --command bun \
+            node_modules/@norskvideo/ctl-dev-kit/licence/check-template.ts \
+            licenseTemplate.json "$product" "$image"
+
   # Report this pipeline's result to the aggregated product CI dashboard
   # (id3as/ci-workflows) instead of posting its own pony — the dashboard renders
   # the pony/emoji from the dispatched result. !cancelled() so a real pass/fail

package/conventions/smoke.yml

@@ -88,13 +88,37 @@ jobs:
             echo "NORSK_TEST_HOST=host.docker.internal" >> "$GITHUB_ENV"
             echo "NORSK_NET_REACH=direct" >> "$GITHUB_ENV"
             echo "NORSK_CTL_PRODUCT_REACH=container-address" >> "$GITHUB_ENV"
+            echo "NORSK_RUNNER_OWNS_DOCKER=false" >> "$GITHUB_ENV"
           else
             echo "TOPO: hostname is not a container -> runner is host-based"
             echo "NORSK_TEST_HOST=localhost" >> "$GITHUB_ENV"
             echo "NORSK_NET_REACH=publish" >> "$GITHUB_ENV"
             echo "NORSK_CTL_PRODUCT_REACH=host" >> "$GITHUB_ENV"
+            echo "NORSK_RUNNER_OWNS_DOCKER=true" >> "$GITHUB_ENV"
           fi
 
+      # `product add --image` publishes the control plane on 127.0.0.1:14321 and
+      # the container is a singleton that outlives its daemon, so a job killed
+      # after registering -- this workflow cancels its own superseded runs --
+      # strands it holding the port and every later job here fails to bind. One
+      # leaked on 2026-08-30 and took out the next nine smoke and integration
+      # jobs across four repos before a human cleared it. The harness teardown
+      # closes the clean-exit half; nothing but this can heal a runner that is
+      # already poisoned, because a SIGKILLed job runs no teardown.
+      #
+      # Gated on the daemon being this runner's own. The GPU box runs several
+      # runners as sibling CONTAINERS against one host daemon, where a blanket
+      # reap would kill a concurrent job's control plane.
+      - name: Reap a stranded product control plane
+        if: ${{ env.NORSK_RUNNER_OWNS_DOCKER == 'true' }}
+        run: |
+          set -uo pipefail
+          stale="$(docker ps -aq --filter 'name=^norsk-product-')"
+          [ -n "$stale" ] || { echo "no stranded control plane"; exit 0; }
+          echo "::warning::reaping a stranded product control plane -- a previous job did not tear its own down"
+          docker inspect --format '{{.Name}} {{.State.Status}} {{.Config.Image}}' $stale || true
+          docker rm -f $stale || true
+
       - name: Write the Norsk license (from the org secret)
         env:
           NORSK_LICENSE_V2: ${{ secrets.NORSK_LICENSE_V2 }}

package/package.json

@@ -1,21 +1,22 @@
 {
   "name": "@norskvideo/ctl-dev-kit",
-  "version": "0.1.62",
+  "version": "0.1.64",
   "type": "module",
   "exports": {
-    "./package.json": "./package.json",
-    "./testing/invariants": "./testing/invariants.ts",
-    "./testing/byte-snapshot": "./testing/byte-snapshot.ts",
     "./create-product": "./create-product/create-product.ts",
-    "./docs/path-existence": "./docs/path-existence.ts",
-    "./docs/splice-generated": "./docs/splice-generated.ts",
     "./doc-guide": "./doc-guide/doc-guide.js",
     "./doc-guide/build-manual": "./doc-guide/build-manual.js",
     "./doc-guide/bundle": "./doc-guide/bundle.js",
-    "./doc-guide/prose-bundle": "./doc-guide/prose-bundle.js",
     "./doc-guide/guides-config": "./doc-guide/guides-config.js",
     "./doc-guide/instance-proxy": "./doc-guide/instance-proxy.js",
-    "./doc-guide/live-browser": "./doc-guide/live-browser.js"
+    "./doc-guide/live-browser": "./doc-guide/live-browser.js",
+    "./doc-guide/prose-bundle": "./doc-guide/prose-bundle.js",
+    "./docs/path-existence": "./docs/path-existence.ts",
+    "./docs/splice-generated": "./docs/splice-generated.ts",
+    "./licence/check-template": "./licence/check-template.ts",
+    "./package.json": "./package.json",
+    "./testing/byte-snapshot": "./testing/byte-snapshot.ts",
+    "./testing/invariants": "./testing/invariants.ts"
   },
   "bin": {
     "ctl-dev-kit": "./create-product/cli.ts"