@norskvideo/ctl-dev-kit 0.2.51 → 0.2.53

package/conventions/check-drift.ts

@@ -20,7 +20,7 @@
 // workspace-symlinked and installed from the published tarball.
 
 import { execFileSync } from "node:child_process";
-import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
+import { existsSync, lstatSync, readdirSync, readFileSync, statSync } from "node:fs";
 import { join } from "node:path";
 import { parseManifestSeed } from "@norskvideo/ctl-sdk/manifest-seed";
 import { checkTheme } from "../docs-theme/sync.ts";
@@ -369,16 +369,21 @@ const CHECKS_LOGS = /\bproductTemplateLogsProblems\b/;
 const SKIP_DIRS = new Set(["node_modules", ".git", "dist", "build", "lib", "coverage", ".wireit"]);
 
 function sourceFiles(dir: string, out: string[] = []): string[] {
-  let names: string[];
-  try {
-    names = readdirSync(dir);
-  } catch {
-    return out;
-  }
-  for (const name of names) {
+  // `dir` is the repo root or an entry just stat'd as a directory: one the walk
+  // cannot list is a real failure, never an empty directory
+  for (const name of readdirSync(dir)) {
     if (SKIP_DIRS.has(name)) continue;
     const path = join(dir, name);
-    const st = statSync(path);
+    let st: ReturnType<typeof statSync>;
+    try {
+      st = statSync(path);
+    } catch (e) {
+      // Only a symlink whose target is absent is skipped: a docs site's link to
+      // a doc-guide capture not generated yet (a fresh checkout). Anything else
+      // that stops the walk reading an entry is a real failure.
+      if ((e as NodeJS.ErrnoException).code === "ENOENT" && lstatSync(path).isSymbolicLink()) continue;
+      throw e;
+    }
     if (st.isDirectory()) sourceFiles(path, out);
     else if (/\.(ts|tsx)$/.test(name)) out.push(path);
   }

package/conventions/integration.yml

@@ -187,29 +187,52 @@ jobs:
       # their logs. The same host took four of that night's norsk image jobs down
       # the same way. Nothing said "this machine's docker is broken".
       #
+      # A containerised (DooD) runner must also be able to JOIN a new network:
+      # the harness attaches it to each instance's network to reach the media
+      # container. On 2026-10-07/08 ashton-nuc's runner container had lost its
+      # network sandbox files (it lived through a dockerd restart), so every
+      # `docker network connect` failed with "open .../resolv.conf: no such file
+      # or directory" while create still worked: commentary saw "Unable to
+      # connect" in every scenario, playout "could not join <instance>'s
+      # network", and probe -- which never joins -- passed on the same host.
+      #
       # The chain is not readable without root on these runners, so this asserts
-      # the capability instead: create a throwaway network, remove it. One step,
-      # its own name, so the jobs API attributes the failure to it rather than to
-      # whatever composite step happened to be running.
-      - name: Check this host's docker can still create a network
+      # the capabilities instead: create a throwaway network, join it when
+      # containerised, leave, remove it. One step, its own name, so the jobs API
+      # attributes the failure to it rather than to whatever composite step
+      # happened to be running.
+      - name: Check this host's docker can still create a network and attach the runner to it
         run: |
           set -uo pipefail
           net="preflight-${{ github.run_id }}-${{ github.run_attempt }}-$RANDOM"
-          if err=$(docker network create "$net" 2>&1); then
-            docker network rm "$net" >/dev/null 2>&1 || true
-            echo "docker can create networks on $(hostname) -- ok"
-            exit 0
+          if ! err=$(docker network create "$net" 2>&1); then
+            echo "::error::docker on this runner cannot create a network, so every container this suite starts would silently not exist -- the tests would fail for a reason that is not theirs. Host: $(hostname). Fix: \`sudo systemctl restart docker\` on that machine (it rebuilds the DOCKER/DOCKER-ISOLATION iptables chains), then re-run."
+            echo "$err"
+            echo "--- docker0 (a subnet other than 172.17.0.1/16 means it was re-addressed) ---"
+            ip -br addr show docker0 2>/dev/null || true
+            echo "--- networks and their subnets ---"
+            for n in $(docker network ls --format '{{.Name}}' 2>/dev/null); do
+              printf '%-28s ' "$n"
+              docker network inspect "$n" --format '{{range .IPAM.Config}}{{.Subnet}} {{end}}' 2>/dev/null || echo
+            done
+            exit 1
           fi
-          echo "::error::docker on this runner cannot create a network, so every container this suite starts would silently not exist -- the tests would fail for a reason that is not theirs. Host: $(hostname). Fix: \`sudo systemctl restart docker\` on that machine (it rebuilds the DOCKER/DOCKER-ISOLATION iptables chains), then re-run."
-          echo "$err"
-          echo "--- docker0 (a subnet other than 172.17.0.1/16 means it was re-addressed) ---"
-          ip -br addr show docker0 2>/dev/null || true
-          echo "--- networks and their subnets ---"
-          for n in $(docker network ls --format '{{.Name}}' 2>/dev/null); do
-            printf '%-28s ' "$n"
-            docker network inspect "$n" --format '{{range .IPAM.Config}}{{.Subnet}} {{end}}' 2>/dev/null || echo
-          done
-          exit 1
+          me="$(hostname)"
+          if docker inspect "$me" >/dev/null 2>&1; then
+            # Containerised: join the network exactly as the harness will.
+            if ! err=$(docker network connect "$net" "$me" 2>&1); then
+              docker network disconnect -f "$net" "$me" >/dev/null 2>&1 || true
+              docker network rm "$net" >/dev/null 2>&1 || true
+              name="$(docker inspect -f '{{.Name}}' "$me" 2>/dev/null | sed 's|^/||')"
+              echo "::error::this runner's container cannot join a new docker network, so the harness cannot reach any instance it starts -- the tests would fail as 'Unable to connect' / 'could not join', for a reason that is not theirs. Host: $(hostname) (container ${name:-$me}). Fix: on the docker host, \`docker restart ${name:-$me}\` once it is idle (it rebuilds the container's network sandbox), then re-run. ashton-nuc does this itself every 15 min (~steve/bin/runner-netcheck.sh, user timer runner-netcheck.timer)."
+              echo "$err"
+              exit 1
+            fi
+            docker network disconnect "$net" "$me" >/dev/null 2>&1 || true
+            echo "the runner container ($me) can join a new network -- ok"
+          fi
+          docker network rm "$net" >/dev/null 2>&1 || true
+          echo "docker can create networks on $(hostname) -- ok"
 
       # `product add --image` publishes the control plane on 127.0.0.1:14321. The
       # daemon means to reap it on shutdown (daemon.ts, model B) but only does so

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@norskvideo/ctl-dev-kit",
-  "version": "0.2.51",
+  "version": "0.2.53",
   "type": "module",
   "exports": {
     "./create-product": "./create-product/create-product.ts",