@norskvideo/ctl-dev-kit 0.1.71 → 0.1.73

package/conventions/checks.yml

@@ -78,16 +78,27 @@ jobs:
             bun run docs:check
           '
 
-      # Does this repo's licence template still describe this repo? A template
-      # naming the wrong product, or an imageRef the build never produces, mints
-      # a licence that entitles nothing -- and the first sign of that is a
-      # 60-second readiness timeout at launch, indistinguishable from a product
-      # that failed to start. Cheap, no secrets, every PR.
+      # The two halves of one licence guarantee, run together because they only
+      # work as a pair: check-template asserts this repo RECORDS the entitlement
+      # it needs, and check-product-name asserts it ASKS for the one it records.
+      #
+      # Either alone leaves them free to drift. funke-pegasus recorded
+      # funke-pegasus and asked for "norsk-studio" -- Studio's baked default,
+      # used whenever NORSK_PRODUCT_NAME is unset -- for its entire life. The
+      # template check was green throughout, because the template was never the
+      # wrong half. What that cost: the handshake was refused, so every media
+      # node was refused, so no SRT listener bound, while the instance reported
+      # healthy and Studio served its API. It reads as a broken workflow, and it
+      # took most of a day to find.
+      #
+      # PRODUCT_NAME is read ONCE and handed to both: two readings could
+      # disagree, and a lint that passes while naming the wrong product is worse
+      # than no lint. Cheap, no secrets, every PR.
       #
       # The image name is CI's own rule: PUBLISH_IMAGE when set, else the build
       # script's IMAGE_TAG default, tag stripped -- a licence matches the repo
       # part alone, never the tag.
-      - name: Check the licence template matches this repo
+      - name: Check this repo records, and asks for, its own licence
         run: |
           set -euo pipefail
           product="$(sed -nE 's/.*PRODUCT_NAME[[:space:]]*=[[:space:]]*"([^"]+)".*/\1/p' shared/src/version.ts | head -1)"
@@ -102,6 +113,13 @@ jobs:
           nix develop .#build --command bun \
             node_modules/@norskvideo/ctl-dev-kit/licence/check-template.ts \
             licenseTemplate.json "$product" "$image"
+          # The compose the product renders is where the declaration has to be;
+          # the check exits 1 on an unreadable file rather than passing quietly,
+          # so a repo that moves this module fails here instead of silently
+          # dropping the gate.
+          nix develop .#build --command bun \
+            node_modules/@norskvideo/ctl-dev-kit/licence/check-product-name.ts \
+            shared/src/product-template.ts "$product"
 
   # Report this pipeline's result to the aggregated product CI dashboard
   # (id3as/ci-workflows) instead of posting its own pony — the dashboard renders

package/conventions/sync-ctl-packages.yml

@@ -114,8 +114,11 @@ jobs:
       - name: Open (or update) the pin-freshness PR
         if: steps.bump.outputs.changed == '1'
         env:
-          GH_TOKEN: ${{ secrets.CI_DISPATCH_TOKEN }}
+          API_TOKEN: ${{ secrets.CI_DISPATCH_TOKEN }}
           GATE: ${{ steps.gate.outcome }}
+          # Through the env, never interpolated into the script below: see the
+          # heredoc comment for what happens when it is.
+          MOVED: ${{ steps.bump.outputs.moved }}
         run: |
           set -euo pipefail
           branch="chore/sync-ctl-packages"
@@ -130,18 +133,24 @@ jobs:
 
           if [ "$GATE" = "success" ]; then
             verdict="Gate green: check:drift, lint, typecheck and unit tests all pass on the new pins."
-            draft=""
+            draft=false
           else
             verdict="**Gate red** — the new pins do not fit this product as-is. Adopting them is real engineering, not a merge."
-            draft="--draft"
+            draft=true
           fi
 
+          # $MOVED, not the expression that produced it. This heredoc is unquoted
+          # so $verdict expands, which means its literal text is scanned for
+          # command substitution too -- and the moved-pin list names every package
+          # in backticks. Pasted in directly, each name RAN (exit 127, no PR,
+          # every morning since this workflow shipped). Bash does not rescan an
+          # expansion's result, so through the env the same backticks are inert.
           body="$(cat <<EOF
           Automated by \`sync-ctl-packages\`.
 
           ## Pins moved
 
-          ${{ steps.bump.outputs.moved }}
+          $MOVED
 
           ## What the gate proved
 
@@ -153,10 +162,24 @@ jobs:
           EOF
           )"
 
-          if [ -z "$(gh pr list --head "$branch" --state open --json number --jq '.[].number')" ]; then
-            gh pr create $draft --head "$branch" --base main \
-              --title "chore: sync the ctl-* pins to their newest published versions" \
-              --body "$body"
+          # gh is not on the self-hosted runner PATH -- it lives only inside
+          # `nix develop`, and this step runs outside it -- so create/update the
+          # PR straight against the REST API with the same PAT that pushed the
+          # branch. This is the identical fix sync-dev-kit already carries and
+          # documents; it was applied to one sibling convention and not its twin,
+          # so this step failed with exit 127 in every product repo. curl and jq
+          # ARE on the host PATH (the pin-resolve step above uses them).
+          title="chore: sync the ctl-* pins to their newest published versions"
+          repo="${{ github.repository }}"; owner="${repo%%/*}"
+          api="https://api.github.com/repos/$repo/pulls"
+          curl_api=(--fail-with-body -sS -H "Authorization: Bearer $API_TOKEN" -H "Accept: application/vnd.github+json")
+          existing="$(curl "${curl_api[@]}" "$api?head=$owner:$branch&state=open" | jq -r '.[0].number // empty')"
+          if [ -n "$existing" ]; then
+            # draft is not settable by PATCH; the standing PR keeps whichever
+            # state it opened in and the refreshed body carries the verdict.
+            curl "${curl_api[@]}" -X PATCH "$api/$existing" \
+              --data "$(jq -nc --arg t "$title" --arg b "$body" '{title:$t, body:$b}')" >/dev/null
           else
-            gh pr edit "$branch" --body "$body"
+            curl "${curl_api[@]}" -X POST "$api" \
+              --data "$(jq -nc --arg t "$title" --arg b "$body" --arg h "$branch" --argjson d "$draft" '{title:$t, body:$b, head:$h, base:"main", draft:$d}')" >/dev/null
           fi

package/conventions/workflow-shell.ts

@@ -0,0 +1,27 @@
+// Convention workflows carry real shell scripts inside YAML, and the two live in
+// different worlds: the runner's bare PATH outside `nix develop`, a single-quoted
+// word inside `bash -c '...'`. The guards over those hazards all need the same
+// question answered first — is this line inside a quoted block or not — so it is
+// asked in one place.
+
+/** 1-indexed line numbers inside a multi-line `bash -c '` block, which ends at a
+ *  line that is just `'`. A one-liner closing its own quote (`bash -c 'a; b'`)
+ *  opens no block — it is already balanced. */
+export function bashBlockLines(yaml: string): Set<number> {
+  const OPEN = "bash -c '";
+  const inside = new Set<number>();
+  let open = false;
+  yaml.split("\n").forEach((text, i) => {
+    if (!open) {
+      const at = text.indexOf(OPEN);
+      if (at >= 0 && !text.slice(at + OPEN.length).includes("'")) open = true;
+      return;
+    }
+    if (text.trim() === "'") {
+      open = false;
+      return;
+    }
+    inside.add(i + 1);
+  });
+  return inside;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@norskvideo/ctl-dev-kit",
-  "version": "0.1.71",
+  "version": "0.1.73",
   "type": "module",
   "exports": {
     "./create-product": "./create-product/create-product.ts",