@norskvideo/ctl-dev-kit 0.2.33 → 0.2.35

package/conventions/checks.sdk-app.yml

@@ -208,6 +208,31 @@ jobs:
             # in here and breaks a schema handed across the instance boundary.
             bun node_modules/@norskvideo/ctl-dev-kit/conventions/zod-singleton.ts
           '
+      # licenseTemplate.json records the entry a licence is minted from: this
+      # product at the image CI builds. One naming another image mints a licence
+      # that entitles nothing, first seen as a refused launch at the customer.
+      # The Studio checks pair this with check-product-name (the compose asks
+      # for what is recorded); an sdk-app names itself in its own handshake, so
+      # there is no Studio declaration to lint. Cheap, no secrets, every PR.
+      #
+      # The image name is CI's own rule: PUBLISH_IMAGE when set, else the build
+      # script's IMAGE_TAG default, tag stripped -- a licence matches the repo
+      # part alone, never the tag.
+      - name: Check this repo records its own licence
+        run: |
+          set -euo pipefail
+          product="$(sed -nE 's/.*PRODUCT_NAME[[:space:]]*=[[:space:]]*"([^"]+)".*/\1/p' src/product/version.ts | head -1)"
+          [ -n "$product" ] || { echo "::error::could not read PRODUCT_NAME from src/product/version.ts"; exit 1; }
+          pub="$(sed -nE 's/^[[:space:]]*PUBLISH_IMAGE:[[:space:]]*"?([^" ]*)"?[[:space:]]*$/\1/p' .github/workflows/build-image.yml | head -1)"
+          def="$(sed -nE 's/.*IMAGE_TAG:-([^}]+)\}.*/\1/p' deployment/build-image.sh | head -1)"
+          ref="${pub:-$def}"
+          # A colon is a tag only after the last slash (a registry host may carry a port).
+          image="${ref%:*}"
+          case "${ref##*/}" in *:*) ;; *) image="$ref" ;; esac
+          [ -n "$image" ] || { echo "::error::could not determine the image this repo builds"; exit 1; }
+          nix develop .#build --command bun \
+            node_modules/@norskvideo/ctl-dev-kit/licence/check-template.ts \
+            licenseTemplate.json "$product" "$image"
       - name: Reap the containers this job launched
         # Whatever the tests did. A teardown cut short by a test timeout leaves
         # its instance running on the shared Docker daemon (see JOB_REAP_STEP in

package/conventions/smoke.yml

@@ -228,12 +228,17 @@ jobs:
       # licence was never minted should say so in seconds, by name.
       #
       # The product name is the repo's own PRODUCT_NAME, not the short board key
-      # above (`funke` vs `funke-pegasus`): the licence names the product.
+      # above (`funke` vs `funke-pegasus`): the licence names the product. A
+      # Studio product keeps it in shared/src/version.ts, an sdk-app (norsk-relay)
+      # in src/product/version.ts; the first that exists is read.
       - name: Check the licence entitles this product
         run: |
           set -euo pipefail
-          product="$(sed -nE 's/.*PRODUCT_NAME[[:space:]]*=[[:space:]]*"([^"]+)".*/\1/p' shared/src/version.ts | head -1)"
-          [ -n "$product" ] || { echo "::error::could not read PRODUCT_NAME from shared/src/version.ts"; exit 1; }
+          vf=""
+          for f in shared/src/version.ts src/product/version.ts; do [ -f "$f" ] && { vf="$f"; break; }; done
+          [ -n "$vf" ] || { echo "::error::no shared/src/version.ts or src/product/version.ts"; exit 1; }
+          product="$(sed -nE 's/.*PRODUCT_NAME[[:space:]]*=[[:space:]]*"([^"]+)".*/\1/p' "$vf" | head -1)"
+          [ -n "$product" ] || { echo "::error::could not read PRODUCT_NAME from $vf"; exit 1; }
           nix develop .#build --command bun \
             node_modules/@norskvideo/ctl-dev-kit/licence/check-entitlement.ts \
             "$RUNNER_TEMP/norsk-license.json" "$product"
@@ -241,14 +246,17 @@ jobs:
       # Instance launch docker-composes the media + studio images; on a cold
       # runner the first pull overruns the per-test timeout. Pre-pull them (tags
       # from manifest.seed.json), plus whatever the repo lists in the optional
-      # scripts/smoke/prepull-extra.sh hook (a driver image, a sidecar).
+      # scripts/smoke/prepull-extra.sh hook (a driver image, a sidecar). An
+      # sdk-app has no Studio pair and no seed: its hook pulls its engine.
       - name: Pre-pull the media + studio images
         run: |
           set -euo pipefail
-          for img in "$(jq -r '.latest.media' manifest.seed.json)" "$(jq -r '.latest.studio' manifest.seed.json)"; do
-            echo "pre-pulling $img"
-            docker pull "$img"
-          done
+          if [ -f manifest.seed.json ]; then
+            for img in "$(jq -r '.latest.media' manifest.seed.json)" "$(jq -r '.latest.studio' manifest.seed.json)"; do
+              echo "pre-pulling $img"
+              docker pull "$img"
+            done
+          fi
           if [ -x scripts/smoke/prepull-extra.sh ]; then
             echo "running scripts/smoke/prepull-extra.sh"
             ./scripts/smoke/prepull-extra.sh
@@ -263,6 +271,12 @@ jobs:
         env:
           NORSK_CTL_BINARY: ${{ runner.temp }}/norsk-ctl
           NORSK_LICENSE_FILE: ${{ runner.temp }}/norsk-license.json
+          # A direct-SDK product's (sdk-app's) licence identity: the sdk-client
+          # cert + key it answers the engine's V2 handshake with, base64, as repo
+          # secrets. Studio carries its own baked identity, so a Studio product
+          # sets neither and these arrive empty.
+          NORSK_SDK_CLIENT_CERT_B64: ${{ secrets.NORSK_SDK_CLIENT_CERT_B64 }}
+          NORSK_SDK_CLIENT_KEY_B64: ${{ secrets.NORSK_SDK_CLIENT_KEY_B64 }}
           # Where the harness copies each instance's full engine logs
           # (/var/log/norsk -> debug.json, host-mounted under the store) before
           # teardown nukes them, plus — since ctl-test-harness 0.1.60 — each

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@norskvideo/ctl-dev-kit",
-  "version": "0.2.33",
+  "version": "0.2.35",
   "type": "module",
   "exports": {
     "./create-product": "./create-product/create-product.ts",