@norskvideo/ctl-dev-kit 0.2.16 → 0.2.18

package/conventions/integration.yml

@@ -178,6 +178,39 @@ jobs:
             echo "NORSK_RUNNER_OWNS_DOCKER=true" >> "$GITHUB_ENV"
           fi
 
+      # Integration needs this host's docker to be able to create a network: the
+      # harness makes norsk-net and a network per instance. On 2026-10-02
+      # ashton-nuc's filter table had lost DOCKER-ISOLATION-STAGE-2, so every
+      # create failed with "Chain 'DOCKER-ISOLATION-STAGE-2' does not exist" --
+      # and commentary, probe and playout each ran a FULL integration suite on it
+      # and reported the result as test failures, 18 and 72 chain errors deep in
+      # their logs. The same host took four of that night's norsk image jobs down
+      # the same way. Nothing said "this machine's docker is broken".
+      #
+      # The chain is not readable without root on these runners, so this asserts
+      # the capability instead: create a throwaway network, remove it. One step,
+      # its own name, so the jobs API attributes the failure to it rather than to
+      # whatever composite step happened to be running.
+      - name: Check this host's docker can still create a network
+        run: |
+          set -uo pipefail
+          net="preflight-${{ github.run_id }}-${{ github.run_attempt }}-$RANDOM"
+          if err=$(docker network create "$net" 2>&1); then
+            docker network rm "$net" >/dev/null 2>&1 || true
+            echo "docker can create networks on $(hostname) -- ok"
+            exit 0
+          fi
+          echo "::error::docker on this runner cannot create a network, so every container this suite starts would silently not exist -- the tests would fail for a reason that is not theirs. Host: $(hostname). Fix: \`sudo systemctl restart docker\` on that machine (it rebuilds the DOCKER/DOCKER-ISOLATION iptables chains), then re-run."
+          echo "$err"
+          echo "--- docker0 (a subnet other than 172.17.0.1/16 means it was re-addressed) ---"
+          ip -br addr show docker0 2>/dev/null || true
+          echo "--- networks and their subnets ---"
+          for n in $(docker network ls --format '{{.Name}}' 2>/dev/null); do
+            printf '%-28s ' "$n"
+            docker network inspect "$n" --format '{{range .IPAM.Config}}{{.Subnet}} {{end}}' 2>/dev/null || echo
+          done
+          exit 1
+
       # `product add --image` publishes the control plane on 127.0.0.1:14321. The
       # daemon means to reap it on shutdown (daemon.ts, model B) but only does so
       # gracefully, and this workflow cancels its own superseded runs -- a killed

package/conventions/upgrade-latest.yml

@@ -134,6 +134,30 @@ jobs:
             changed=1
             parts+=("media \`$new_media\`")
           fi
+          # The rewrite above is a LITERAL replace of the value found in
+          # manifest.seed.json, so it only ever touches pins that already equal the
+          # seed. A pin that has drifted off it -- a hand edit, a merge, a
+          # half-finished run -- is invisible to this bump and to every later one,
+          # permanently, while the job still reports success. funke launched a
+          # 2026-09-30 engine against 2026-09-05 npm pins for a month that way;
+          # playout and probe sat two months back on 1.1.0-2026-08-02. The whole
+          # point of the family is that ONE version string drives it, so a
+          # divergent pin is a defect and the only thing missing was someone
+          # saying so.
+          #
+          # Not auto-rewritten: a pin held back on purpose is someone's decision,
+          # and silently moving it would be the same class of surprise in the
+          # other direction. Fail, name them, and let a human fix the pin or the
+          # intent.
+          stranded="$(git grep -hoE '"@norskvideo/norsk-(api|sdk|auto-manager|manager-sdk)"[[:space:]]*:[[:space:]]*"[0-9]+\.[0-9]+\.[0-9]+-[0-9]{4}-[0-9]{2}-[0-9]{2}-[0-9a-f]+"' -- '*package.json' \
+            | sed -E 's/.*"([^"]+)"$/\1/' | sort -u | grep -vxF "$new_media" || true)"
+          if [ -n "$stranded" ]; then
+            echo "::error::npm norsk pins are stranded off the nightly channel: $(printf '%s' "$stranded" | tr '\n' ' ')"
+            echo "The media family (api, sdk, auto-manager, manager-sdk) and the launched image are built from the same"
+            echo "commit, so every pin must read $new_media. These do not, and because the rewrite above is a literal"
+            echo "replace of the seed value, no later bump can reach them either. Set them to $new_media."
+            exit 1
+          fi
 
           # STUDIO: unlike media, Norsk builds the studio npm packages and the
           # studio Docker image from DIFFERENT commits — their hash suffixes never

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@norskvideo/ctl-dev-kit",
-  "version": "0.2.16",
+  "version": "0.2.18",
   "type": "module",
   "exports": {
     "./create-product": "./create-product/create-product.ts",