@norskvideo/ctl-dev-kit 0.1.64 → 0.1.66

package/conventions/smoke.yml

@@ -97,27 +97,52 @@ jobs:
             echo "NORSK_RUNNER_OWNS_DOCKER=true" >> "$GITHUB_ENV"
           fi
 
-      # `product add --image` publishes the control plane on 127.0.0.1:14321 and
-      # the container is a singleton that outlives its daemon, so a job killed
-      # after registering -- this workflow cancels its own superseded runs --
-      # strands it holding the port and every later job here fails to bind. One
-      # leaked on 2026-08-30 and took out the next nine smoke and integration
-      # jobs across four repos before a human cleared it. The harness teardown
-      # closes the clean-exit half; nothing but this can heal a runner that is
-      # already poisoned, because a SIGKILLed job runs no teardown.
+      # `product add --image` publishes the control plane on 127.0.0.1:14321. The
+      # daemon means to reap it on shutdown (daemon.ts, model B) but only does so
+      # gracefully, and this workflow cancels its own superseded runs -- a killed
+      # daemon reaps nothing and the port stays held for every later job here.
       #
-      # Gated on the daemon being this runner's own. The GPU box runs several
-      # runners as sibling CONTAINERS against one host daemon, where a blanket
-      # reap would kill a concurrent job's control plane.
+      # On 2026-08-30 something held it on ar-arm-vm from 11:18 to ~16:00 and
+      # took out the next nine smoke and integration jobs across four repos.
+      # What held it was never established: the job that last bound it PASSED
+      # and shut down cleanly, and every add-path failure already removes its
+      # own container -- so the holder may not have been a control plane at all.
+      # "already allocated" is also what a dangling endpoint or a stranded
+      # docker-proxy reports after an unclean removal.
+      #
+      # Hence: kill by PORT rather than by name, prune the endpoints a removal
+      # can strand, and then PROVE the port binds instead of assuming it. This
+      # branch only runs where the docker daemon is this runner's own and jobs
+      # are serial, so there is nothing else here to protect. The GPU box runs
+      # several runners as sibling CONTAINERS against one host daemon and is
+      # excluded -- there, a blanket reap would kill a concurrent job.
       - name: Reap a stranded product control plane
         if: ${{ env.NORSK_RUNNER_OWNS_DOCKER == 'true' }}
         run: |
           set -uo pipefail
-          stale="$(docker ps -aq --filter 'name=^norsk-product-')"
-          [ -n "$stale" ] || { echo "no stranded control plane"; exit 0; }
-          echo "::warning::reaping a stranded product control plane -- a previous job did not tear its own down"
-          docker inspect --format '{{.Name}} {{.State.Status}} {{.Config.Image}}' $stale || true
-          docker rm -f $stale || true
+          port=14321
+          bindable() { docker run --rm -p "127.0.0.1:$port:1" alpine true >/dev/null 2>&1; }
+
+          held="$(docker ps -a --filter "publish=$port" --format '{{.Names}} {{.Status}} {{.Image}}')"
+          if [ -n "$held" ]; then
+            echo "::warning::$port was held on entry by: $held"
+            docker rm -f $(docker ps -aq --filter "publish=$port") || true
+          fi
+          # A control plane that is stopped, or one whose publish docker no
+          # longer reports, still gets removed: nothing here outlives a job.
+          leftover="$(docker ps -aq --filter 'name=^norsk-product-')"
+          [ -z "$leftover" ] || docker rm -f $leftover || true
+
+          if ! bindable; then
+            echo "::warning::$port still not bindable after removing containers -- pruning dangling endpoints"
+            docker network prune -f || true
+          fi
+          if ! bindable; then
+            echo "::error::cannot bind 127.0.0.1:$port; the journey would fail later and more obscurely"
+            docker ps -a --filter "publish=$port" || true
+            exit 1
+          fi
+          echo "$port is bindable"
 
       - name: Write the Norsk license (from the org secret)
         env:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@norskvideo/ctl-dev-kit",
-  "version": "0.1.64",
+  "version": "0.1.66",
   "type": "module",
   "exports": {
     "./create-product": "./create-product/create-product.ts",