@norskvideo/ctl-dev-kit 0.1.65 → 0.1.67

package/conventions/check-drift.ts

@@ -238,6 +238,9 @@ export interface CanonicalBytes {
   flake: string;
   upgradeLatest: string;
   syncDevKit: string;
+  /** conventions/sync-ctl-packages.yml — the ctl-* pin freshness PR. No per-repo
+   *  line at all, so it is verbatim and sync-drift creates it where absent. */
+  syncCtlPackages: string;
   publishDocs: string;
   /** conventions/build-docs.yml — the embedded docs variant (bundle -> image, no upload). */
   buildDocs: string;
@@ -513,6 +516,14 @@ export function checkDrift(repoRoot: string, canonical: CanonicalBytes, opts: Ch
     );
   }
 
+  // sync-ctl-packages.yml is OPTIONAL until a repo has been synced once — it is
+  // NEW, and sync-drift creates it. Unlike its neighbours it carries no per-repo
+  // line (it dispatches to no dashboard), so the whole file is canonical.
+  const syncCtlPath = join(repoRoot, ".github", "workflows", "sync-ctl-packages.yml");
+  if (existsSync(syncCtlPath) && readFileSync(syncCtlPath, "utf8") !== canonical.syncCtlPackages) {
+    push(`.github/workflows/sync-ctl-packages.yml differs from conventions/sync-ctl-packages.yml. ${RESYNC}`);
+  }
+
   // smoke.yml is OPTIONAL until every product carries a tests/smoke.spec.ts
   // (04b s7.2 sequences the required-file rule last). When present it is the
   // shared, single-sourced workflow; only its `product:` dispatch key and the
@@ -569,6 +580,7 @@ if (import.meta.main) {
     flake: readFileSync(join(import.meta.dir, "..", "build", "flake.nix"), "utf8"),
     upgradeLatest: readFileSync(join(import.meta.dir, "upgrade-latest.yml"), "utf8"),
     syncDevKit: readFileSync(join(import.meta.dir, "sync-dev-kit.yml"), "utf8"),
+    syncCtlPackages: readFileSync(join(import.meta.dir, "sync-ctl-packages.yml"), "utf8"),
     publishDocs: readFileSync(join(import.meta.dir, "publish-docs.yml"), "utf8"),
     buildDocs: readFileSync(join(import.meta.dir, "build-docs.yml"), "utf8"),
     checks: readFileSync(join(import.meta.dir, "checks.yml"), "utf8"),

package/conventions/smoke.yml

@@ -102,37 +102,47 @@ jobs:
       # gracefully, and this workflow cancels its own superseded runs -- a killed
       # daemon reaps nothing and the port stays held for every later job here.
       #
-      # On 2026-08-30 something held it on one runner from 11:18 to ~16:00 and
+      # On 2026-08-30 something held it on ar-arm-vm from 11:18 to ~16:00 and
       # took out the next nine smoke and integration jobs across four repos.
       # What held it was never established: the job that last bound it PASSED
-      # and shut down cleanly, so it may not have been a control-plane container
-      # at all -- a stale docker-proxy or dangling endpoint reports the same
-      # "already allocated". So this reaps what it can name AND names whatever
-      # still holds the port, rather than exiting quiet and leaving the next
-      # occurrence as much of a mystery as this one.
+      # and shut down cleanly, and every add-path failure already removes its
+      # own container -- so the holder may not have been a control plane at all.
+      # "already allocated" is also what a dangling endpoint or a stranded
+      # docker-proxy reports after an unclean removal.
       #
-      # Gated on the daemon being this runner's own. The GPU box runs several
-      # runners as sibling CONTAINERS against one host daemon, where a blanket
-      # reap would kill a concurrent job's control plane.
+      # Hence: kill by PORT rather than by name, prune the endpoints a removal
+      # can strand, and then PROVE the port binds instead of assuming it. This
+      # branch only runs where the docker daemon is this runner's own and jobs
+      # are serial, so there is nothing else here to protect. The GPU box runs
+      # several runners as sibling CONTAINERS against one host daemon and is
+      # excluded -- there, a blanket reap would kill a concurrent job.
       - name: Reap a stranded product control plane
         if: ${{ env.NORSK_RUNNER_OWNS_DOCKER == 'true' }}
         run: |
           set -uo pipefail
-          stale="$(docker ps -aq --filter 'name=^norsk-product-')"
-          if [ -n "$stale" ]; then
-            echo "::warning::reaping a stranded product control plane -- a previous job did not tear its own down"
-            docker inspect --format '{{.Name}} {{.State.Status}} {{.Config.Image}}' $stale || true
-            docker rm -f $stale || true
+          port=14321
+          bindable() { docker run --rm -p "127.0.0.1:$port:1" alpine true >/dev/null 2>&1; }
+
+          held="$(docker ps -a --filter "publish=$port" --format '{{.Names}} {{.Status}} {{.Image}}')"
+          if [ -n "$held" ]; then
+            echo "::warning::$port was held on entry by: $held"
+            docker rm -f $(docker ps -aq --filter "publish=$port") || true
           fi
-          # Whatever is left on the port is the thing worth seeing: if this is
-          # ever non-empty after the reap above, the holder is not a control
-          # plane and `docker rm` was never going to clear it.
-          holder="$(docker ps -a --filter 'publish=14321' --format '{{.Names}} {{.Status}} {{.Image}}')"
-          if [ -n "$holder" ]; then
-            echo "::warning::14321 is still published by: $holder"
-          else
-            echo "14321 free; no container publishes it"
+          # A control plane that is stopped, or one whose publish docker no
+          # longer reports, still gets removed: nothing here outlives a job.
+          leftover="$(docker ps -aq --filter 'name=^norsk-product-')"
+          [ -z "$leftover" ] || docker rm -f $leftover || true
+
+          if ! bindable; then
+            echo "::warning::$port still not bindable after removing containers -- pruning dangling endpoints"
+            docker network prune -f || true
+          fi
+          if ! bindable; then
+            echo "::error::cannot bind 127.0.0.1:$port; the journey would fail later and more obscurely"
+            docker ps -a --filter "publish=$port" || true
+            exit 1
           fi
+          echo "$port is bindable"
 
       - name: Write the Norsk license (from the org secret)
         env:

package/conventions/sync-ctl-packages.yml

@@ -0,0 +1,162 @@
+# Keep this product fresh against the ctl-* npm family: the test harness that
+# drives its smoke and integration tiers, the SDK, the foundation helpers and
+# the product-template schema.
+#
+# sync-dev-kit already does this for the conventions package, and upgrade-latest
+# does it for the Norsk nightly line. Nothing did it for the rest, so the pins
+# drifted silently: on 2026-08-30 studio carried a conventions pin bumped that
+# morning beside an SDK three releases behind, and three repos ran three
+# different vintages of the same smoke runner. The caret ranges admit the new
+# versions -- `--frozen-lockfile` is what holds them back, and nothing ever
+# regenerated the lockfile.
+#
+# Unlike sync-dev-kit this NEVER pushes to main. Its gate is drift + lint +
+# typecheck + unit, and a bump to the test harness changes the code that drives
+# smoke and integration -- neither of which that gate runs, because both need
+# Docker and a licence. A green gate therefore proves strictly less here than it
+# does for a conventions bump, so the bump goes to a human as a PR. A red gate
+# still opens one, as a draft: adopting a breaking change is real engineering,
+# not a copy-paste, and the PR is where that work belongs.
+#
+# Single-sourced in @norskvideo/ctl-dev-kit (conventions/sync-ctl-packages.yml)
+# and copied verbatim into each product repo; the check:drift gate fails CI if a
+# copy diverges. Never hand-edit the copy -- edit the source and re-sync.
+name: sync-ctl-packages
+
+on:
+  schedule:
+    # Clear of sync-dev-kit's 04:37 so the two never race the same lockfile.
+    - cron: "52 4 * * *"
+  workflow_dispatch:
+
+permissions:
+  contents: write
+  pull-requests: write
+
+concurrency:
+  group: sync-ctl-packages-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  sync:
+    runs-on: x64
+    steps:
+      # CI_DISPATCH_TOKEN, not the automatic GITHUB_TOKEN: a PR opened by
+      # GITHUB_TOKEN raises no workflow runs, so the product's own build, smoke
+      # and integration would never execute against the new pins -- which is the
+      # entire reason for opening it. clean: false for the same reason as the
+      # other shared jobs: the suites leave root-owned bind-mount dirs under
+      # test-temp/ that a non-root git clean cannot remove.
+      - uses: actions/checkout@v5
+        with:
+          token: ${{ secrets.CI_DISPATCH_TOKEN }}
+          clean: false
+
+      - name: Resolve the newest published ctl-* packages and rewrite the pins
+        id: bump
+        run: |
+          set -euo pipefail
+          reg="https://registry.npmjs.org"
+          # The conventions package is deliberately absent: sync-dev-kit owns it,
+          # lands it straight to main, and re-syncs the copied files with it.
+          family="ctl-test-harness ctl-sdk ctl-foundation ctl-product-template-schema"
+
+          # Every tracked package.json, not just the root: a repo can pin the
+          # same package in a nested workspace (playout pins the harness twice),
+          # and a root-only rewrite would split the line across the two.
+          mapfile -t manifests < <(git ls-files '*package.json' ':!:**/node_modules/**')
+
+          moved=""
+          for short in $family; do
+            pkg="@norskvideo/$short"
+            enc="@norskvideo%2F$short"
+            # The runner has no npm; read the dist-tag off the registry with
+            # curl+jq, as sync-dev-kit and upgrade-latest both do.
+            new="$(curl -fsSL --retry 3 --retry-all-errors --retry-delay 2 "$reg/$enc" | jq -r '."dist-tags".latest')"
+            [ -n "$new" ] && [ "$new" != "null" ] || { echo "could not resolve $pkg latest"; exit 1; }
+
+            for m in "${manifests[@]}"; do
+              old="$(grep -oE "\"$pkg\"[[:space:]]*:[[:space:]]*\"[^\"]*\"" "$m" | head -1 | sed -E 's/.*"([^"]*)"$/\1/' || true)"
+              # Absent here, or a workspace protocol spec that names no version.
+              case "$old" in "" | workspace:*) continue ;; esac
+              old_bare="${old#^}"; old_bare="${old_bare#~}"
+              [ "$old_bare" != "$new" ] || continue
+              # Surgical single-line rewrite so the file keeps its formatting;
+              # a jq reserialize would reflow it and trip the formatter.
+              sed -i -E "s|(\"$pkg\"[[:space:]]*:[[:space:]]*\")[^\"]*(\")|\1^$new\2|" "$m"
+              echo "$m: $pkg $old -> ^$new"
+              moved="$moved- \`$pkg\` $old -> \`^$new\` ($m)"$'\n'
+            done
+          done
+
+          if [ -z "$moved" ]; then
+            echo "every ctl-* pin is already on its newest published version."
+            echo "changed=0" >> "$GITHUB_OUTPUT"
+          else
+            echo "changed=1" >> "$GITHUB_OUTPUT"
+            { echo "moved<<PINS"; printf '%s' "$moved"; echo "PINS"; } >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Reinstall and run the product gate
+        id: gate
+        if: steps.bump.outputs.changed == '1'
+        continue-on-error: true
+        run: |
+          nix develop .#build --command bash -c '
+            set -euo pipefail
+            bun install
+            bun run check:drift
+            bun run lint
+            bun run typecheck
+            bun run test:unit
+          '
+
+      - name: Open (or update) the pin-freshness PR
+        if: steps.bump.outputs.changed == '1'
+        env:
+          GH_TOKEN: ${{ secrets.CI_DISPATCH_TOKEN }}
+          GATE: ${{ steps.gate.outcome }}
+        run: |
+          set -euo pipefail
+          branch="chore/sync-ctl-packages"
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git checkout -B "$branch"
+          git add -A
+          git commit -m "chore: sync the ctl-* pins to their newest published versions"
+          # One branch, force-pushed: a daily schedule must refresh the standing
+          # PR rather than accumulate a new one every morning.
+          git push -f origin "$branch"
+
+          if [ "$GATE" = "success" ]; then
+            verdict="Gate green: check:drift, lint, typecheck and unit tests all pass on the new pins."
+            draft=""
+          else
+            verdict="**Gate red** — the new pins do not fit this product as-is. Adopting them is real engineering, not a merge."
+            draft="--draft"
+          fi
+
+          body="$(cat <<EOF
+          Automated by \`sync-ctl-packages\`.
+
+          ## Pins moved
+
+          ${{ steps.bump.outputs.moved }}
+
+          ## What the gate proved
+
+          $verdict
+
+          It did **not** run smoke or integration — both need Docker and a licence.
+          A test-harness bump changes the code that drives those tiers, so the
+          runs raised on this PR are the real evidence. Read them before merging.
+          EOF
+          )"
+
+          if [ -z "$(gh pr list --head "$branch" --state open --json number --jq '.[].number')" ]; then
+            gh pr create $draft --head "$branch" --base main \
+              --title "chore: sync the ctl-* pins to their newest published versions" \
+              --body "$body"
+          else
+            gh pr edit "$branch" --body "$body"
+          fi

package/conventions/sync-drift.ts

@@ -223,6 +223,15 @@ export function syncDrift(repoRoot: string, canonical: CanonicalBytes): SyncRepo
   syncWorkflow(repoRoot, ".github/workflows/checks.yml", canonical.checks, r);
   syncWorkflow(repoRoot, ".github/workflows/upgrade-latest.yml", canonical.upgradeLatest, r);
   syncWorkflow(repoRoot, ".github/workflows/sync-dev-kit.yml", canonical.syncDevKit, r);
+  // No per-repo line to preserve, so it is written whole -- and CREATED where
+  // absent, unlike syncWorkflow's copies. That is how a repo acquires the
+  // workflow at all: its next sync run installs it.
+  writeIfChanged(
+    join(repoRoot, ".github/workflows/sync-ctl-packages.yml"),
+    canonical.syncCtlPackages,
+    ".github/workflows/sync-ctl-packages.yml",
+    r.written,
+  );
   syncBuildImage(repoRoot, canonical.buildImage, r);
   syncSmoke(repoRoot, canonical.smoke, r);
 
@@ -256,6 +265,7 @@ if (import.meta.main) {
     flake: readFileSync(join(dir, "..", "build", "flake.nix"), "utf8"),
     upgradeLatest: readFileSync(join(dir, "upgrade-latest.yml"), "utf8"),
     syncDevKit: readFileSync(join(dir, "sync-dev-kit.yml"), "utf8"),
+    syncCtlPackages: readFileSync(join(dir, "sync-ctl-packages.yml"), "utf8"),
     publishDocs: readFileSync(join(dir, "publish-docs.yml"), "utf8"),
     buildDocs: readFileSync(join(dir, "build-docs.yml"), "utf8"),
     checks: readFileSync(join(dir, "checks.yml"), "utf8"),

package/create-product/canon.ts

@@ -18,6 +18,7 @@ export interface Canon {
   flakeLock: string;
   upgradeLatest: string;
   syncDevKit: string;
+  syncCtlPackages: string;
   checks: string;
   biome: string;
   tsconfigBase: string;
@@ -39,6 +40,7 @@ export function loadCanon(): Canon {
     flakeLock: readFileSync(join(buildDir, "flake.lock"), "utf8"),
     upgradeLatest: readFileSync(join(conventionsDir, "upgrade-latest.yml"), "utf8"),
     syncDevKit: readFileSync(join(conventionsDir, "sync-dev-kit.yml"), "utf8"),
+    syncCtlPackages: readFileSync(join(conventionsDir, "sync-ctl-packages.yml"), "utf8"),
     checks: readFileSync(join(conventionsDir, "checks.yml"), "utf8"),
     buildDocs: readFileSync(join(conventionsDir, "build-docs.yml"), "utf8"),
     biome: readFileSync(join(conventionsDir, "biome.base.json"), "utf8"),

package/create-product/create-product.ts

@@ -111,6 +111,7 @@ function conventionFiles(ctx: ShapeContext, shape: ShapeModule): GeneratedFile[]
     { path: ".github/workflows/checks.yml", content: fillProduct(canon.checks) },
     { path: ".github/workflows/upgrade-latest.yml", content: fillProduct(canon.upgradeLatest) },
     { path: ".github/workflows/sync-dev-kit.yml", content: fillProduct(canon.syncDevKit) },
+    { path: ".github/workflows/sync-ctl-packages.yml", content: canon.syncCtlPackages },
     { path: ".github/workflows/build-image.yml", content: fillProduct(canon.buildImage) },
     { path: ".github/actions/ci-status-dispatch/action.yml", content: loadAsset("ci-status-dispatch.yml") },
     { path: "manifest.seed.json", content: seedJson(ctx) },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@norskvideo/ctl-dev-kit",
-  "version": "0.1.65",
+  "version": "0.1.67",
   "type": "module",
   "exports": {
     "./create-product": "./create-product/create-product.ts",