@norskvideo/ctl-dev-kit 0.2.34 → 0.2.36

package/conventions/checks.sdk-app.yml

@@ -208,6 +208,31 @@ jobs:
             # in here and breaks a schema handed across the instance boundary.
             bun node_modules/@norskvideo/ctl-dev-kit/conventions/zod-singleton.ts
           '
+      # licenseTemplate.json records the entry a licence is minted from: this
+      # product at the image CI builds. One naming another image mints a licence
+      # that entitles nothing, first seen as a refused launch at the customer.
+      # The Studio checks pair this with check-product-name (the compose asks
+      # for what is recorded); an sdk-app names itself in its own handshake, so
+      # there is no Studio declaration to lint. Cheap, no secrets, every PR.
+      #
+      # The image name is CI's own rule: PUBLISH_IMAGE when set, else the build
+      # script's IMAGE_TAG default, tag stripped -- a licence matches the repo
+      # part alone, never the tag.
+      - name: Check this repo records its own licence
+        run: |
+          set -euo pipefail
+          product="$(sed -nE 's/.*PRODUCT_NAME[[:space:]]*=[[:space:]]*"([^"]+)".*/\1/p' src/product/version.ts | head -1)"
+          [ -n "$product" ] || { echo "::error::could not read PRODUCT_NAME from src/product/version.ts"; exit 1; }
+          pub="$(sed -nE 's/^[[:space:]]*PUBLISH_IMAGE:[[:space:]]*"?([^" ]*)"?[[:space:]]*$/\1/p' .github/workflows/build-image.yml | head -1)"
+          def="$(sed -nE 's/.*IMAGE_TAG:-([^}]+)\}.*/\1/p' deployment/build-image.sh | head -1)"
+          ref="${pub:-$def}"
+          # A colon is a tag only after the last slash (a registry host may carry a port).
+          image="${ref%:*}"
+          case "${ref##*/}" in *:*) ;; *) image="$ref" ;; esac
+          [ -n "$image" ] || { echo "::error::could not determine the image this repo builds"; exit 1; }
+          nix develop .#build --command bun \
+            node_modules/@norskvideo/ctl-dev-kit/licence/check-template.ts \
+            licenseTemplate.json "$product" "$image"
       - name: Reap the containers this job launched
         # Whatever the tests did. A teardown cut short by a test timeout leaves
         # its instance running on the shared Docker daemon (see JOB_REAP_STEP in

package/conventions/publish-docs.yml

@@ -30,6 +30,11 @@ on:
   schedule:
     - cron: "30 1 * * *" # 01:30 UTC — ahead of ctl's nightly docs build
   workflow_dispatch:
+    inputs:
+      publish:
+        description: "Publish the regenerated manual. Off runs every guide tier and reports the result without touching the docs-latest release (a branch dry run)."
+        type: boolean
+        default: true
 
 permissions:
   contents: write # move the docs-latest release + clobber its asset
@@ -226,6 +231,7 @@ jobs:
       # gh is on PATH inside the nix shell; `upload --clobber` replaces the
       # same-named asset in place, so the release stays latest-only.
       - name: Publish manual.html to the moving docs-latest release
+        if: ${{ github.event_name != 'workflow_dispatch' || inputs.publish }}
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
@@ -274,6 +280,7 @@ jobs:
       # exports map, so this works whether ctl-dev-kit is the published package or
       # a workspace link (scripts/set-ctl-source.ts local mode).
       - name: Publish the versioned docs bundle and move the pointer
+        if: ${{ github.event_name != 'workflow_dispatch' || inputs.publish }}
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           # How many bundles to keep on the release, the current one included.
@@ -308,6 +315,7 @@ jobs:
       # key through ci-workflows' registry, so a new product needs no new mapping
       # here. Not wrapped in nix -- plain curl, and the quoting stays readable.
       - name: Tell norsk-ctl a new bundle is published
+        if: ${{ github.event_name != 'workflow_dispatch' || inputs.publish }}
         env:
           DISPATCH_TOKEN: ${{ secrets.CI_DISPATCH_TOKEN }}
         run: |
@@ -337,3 +345,103 @@ jobs:
             echo "::warning::removing containers this job left running:$s"
             docker rm -f $s
           fi
+
+  # Report the result to the aggregated product CI dashboard (id3as/ci-workflows)
+  # as the `docs` cell. Red as well as green: the guides failed every night for a
+  # month while the board showed nothing, because this workflow never reported.
+  # A dry run (publish off) stays off the board -- it may be a branch.
+  notify:
+    needs: [publish]
+    if: ${{ !cancelled() && (github.event_name != 'workflow_dispatch' || inputs.publish) }}
+    runs-on: x64
+    steps:
+      # Runs BEFORE checkout, and does two things: points the harness's temp base
+      # out of the workspace for every later step in this job, and clears whatever
+      # the old repo-local default left behind on this runner. The body carries the
+      # why. It fails the job only when legacy litter survives -- which would take
+      # the checkout down a step later anyway, but report nothing useful.
+      - name: Route test-temp out of the workspace (pre-checkout)
+        run: |
+          set -uo pipefail
+          # These runners are docker-OUTSIDE-of-docker, so a bind-mount source the
+          # HOST daemon has not seen before is created by dockerd, as ROOT, on the
+          # host -- even when the launch passes --container-user (reproduced
+          # 2026-09-04). The harness's default base is repo-local for an OrbStack
+          # inotify constraint that binds macOS dev and nothing here, so every run
+          # seeded the CHECKOUT with root-owned dirs a non-root `git clean -ffdx`
+          # cannot remove. That took commentary's checks AND integration red on
+          # 2026-09-03. Use the sanctioned override, per-run and outside the
+          # checkout -- as 8ff17a8d did in June for one debug workflow, and stopped.
+          base="$RUNNER_TEMP/nctt-$GITHUB_RUN_ID-$GITHUB_RUN_ATTEMPT"
+          mkdir -p "$base"
+          echo "NORSK_CTL_TEST_TMP=$base" >> "$GITHUB_ENV"
+          # Yesterday's bases hold dockerd-created root dirs, so a non-root rm
+          # EACCESes. They cannot wedge a checkout, but they do fill the disk.
+          for old in $(find "$RUNNER_TEMP" -maxdepth 1 -name 'nctt-*' -mtime +0 -printf '%f\n' 2>/dev/null || true); do
+            docker run --rm --user 0:0 -v "$RUNNER_TEMP":/t alpine sh -c 'rm -rf -- "/t/$1"' sh "$old" >/dev/null 2>&1 || true
+          done
+          # LEGACY: a runner that ran the old default still carries a workspace
+          # test-temp, and a checkout with clean:true dies on it. Reap the holders
+          # first -- rm cannot unlink a live mountpoint even as root (EBUSY), and a
+          # RESTARTING leaked container re-creates the path as root seconds after
+          # any clean. Match on mount SOURCE, not a label: the holders are untracked
+          # by construction, because a killed run labels nothing.
+          tt="$GITHUB_WORKSPACE/test-temp"
+          [ -d "$tt" ] || exit 0
+          stuck=""
+          for c in $(docker ps -aq 2>/dev/null || true); do
+            if docker inspect -f '{{range .Mounts}}{{println .Source}}{{end}}' "$c" 2>/dev/null | grep -q "^$tt/"; then
+              stuck="$stuck $c"
+            fi
+          done
+          if [ -n "$stuck" ]; then
+            echo "reaping containers holding mounts under $tt:$stuck"
+            docker rm -f $stuck || true
+          fi
+          # The DIRECTORY, not just its contents: an empty but root-owned base
+          # still EACCESes a later mkdtemp. Mounting the PARENT is what lets a root
+          # container unlink the leaf.
+          docker run --rm --user 0:0 -v "$GITHUB_WORKSPACE":/w alpine \
+            sh -c 'rm -rf /w/test-temp' || rm -rf "$tt" || true
+          # Fail HERE if it survived. The checkout fails on it either way, but
+          # reports only an EACCES rmdir with no clue what was holding the path.
+          if [ -e "$tt" ]; then
+            echo "::error::$tt survived the pre-checkout clean"
+            ls -lan "$tt" || true
+            exit 1
+          fi
+
+      - uses: actions/checkout@v5
+        with:
+          clean: true
+      - id: meta
+        run: |
+          if [ "${{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') }}" = "true" ]; then
+            echo "state=failure" >> "$GITHUB_OUTPUT"
+          else
+            echo "state=success" >> "$GITHUB_OUTPUT"
+          fi
+      - uses: ./.github/actions/ci-status-dispatch
+        with:
+          token: ${{ secrets.CI_DISPATCH_TOKEN }}
+          product: __PRODUCT__
+          pipeline: docs
+          status: ${{ steps.meta.outputs.state }}
+      - name: Reap the containers this job launched
+        # Whatever the tests did. A teardown cut short by a test timeout leaves
+        # its instance running on the shared Docker daemon (see JOB_REAP_STEP in
+        # conventions/workflow-shell.ts); everything this job launched mounts its
+        # own test-temp, so that is what goes.
+        if: always()
+        run: |
+          base="${NORSK_CTL_TEST_TMP:-}"
+          tt="$GITHUB_WORKSPACE/test-temp"
+          s=""
+          for c in $(docker ps -aq); do
+            src="$(docker inspect -f '{{range .Mounts}}{{println .Source}}{{end}}' "$c" 2>/dev/null)" || continue
+            if { [ -n "$base" ] && grep -q "^$base/" <<<"$src"; } || grep -q "^$tt/" <<<"$src"; then s="$s $c"; fi
+          done
+          if [ -n "$s" ]; then
+            echo "::warning::removing containers this job left running:$s"
+            docker rm -f $s
+          fi

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@norskvideo/ctl-dev-kit",
-  "version": "0.2.34",
+  "version": "0.2.36",
   "type": "module",
   "exports": {
     "./create-product": "./create-product/create-product.ts",