@kungfu-tech/buildchain 2.11.14-alpha.6 → 2.12.0-alpha.0

package/AGENTS.md

@@ -14,16 +14,27 @@ restating them.
 
 ## Using this repo as a Buildchain consumer
 
-Stable consumers should pin actions and reusable workflows through the released
-Buildchain refs:
+Consumers that want Buildchain to select alpha for development/prerelease work
+and stable for production releases use the channel router. The router defaults
+to `auto`; repositories only add channel configuration when they intentionally
+override that policy:
 
 ```yaml
-uses: kungfu-systems/buildchain/actions/validate-config@v2
-uses: kungfu-systems/buildchain/actions/run-lifecycle@v2
-uses: kungfu-systems/buildchain/actions/promote-buildchain-ref@v2
-uses: kungfu-systems/buildchain/.github/workflows/.build.yml@v2
+uses: kungfu-systems/buildchain/.github/workflows/build.yml@v2
 ```
 
+During the v2.12 alpha evaluation window, canaries call the same router through
+the matching prerelease ref:
+
+```yaml
+uses: kungfu-systems/buildchain/.github/workflows/build.yml@v2-alpha
+```
+
+The default policy selects `vN-alpha` for pull requests, development, nightly,
+and prerelease intent; it selects stable `vN` for stable release intent. The
+advanced `.build.yml` surface and explicit `buildchain-ref` train/SHA validation
+remain available when a repository needs precise control.
+
 For new repositories, prefer the CLI:
 
 ```sh

package/README.md

@@ -201,6 +201,8 @@ The active reusable workflow surfaces are:
 
 - `.github/workflows/.build.yml` for deterministic multi-platform build and
   artifact contracts;
+- `.github/workflows/build.yml` for the single-config channel router that uses
+  `vN-alpha` during development/prerelease work and `vN` for stable releases;
 - `.github/workflows/release-candidate-promote.yml` for post-merge
   promote-only publication from a PR-stage release candidate, without a second
   heavy build;
@@ -219,7 +221,7 @@ uses: kungfu-systems/buildchain/actions/validate-config@v2
 ```
 
 ```yaml
-uses: kungfu-systems/buildchain/.github/workflows/.build.yml@v2
+uses: kungfu-systems/buildchain/.github/workflows/build.yml@v2
 ```
 
 ```yaml

package/dist/site/buildchain-contract.json

@@ -4,7 +4,7 @@
   "product": {
     "name": "Buildchain",
     "package": "@kungfu-tech/buildchain",
-    "version": "2.11.14-alpha.6",
+    "version": "2.12.0-alpha.0",
     "repository": "https://github.com/kungfu-systems/buildchain"
   },
   "majorLine": "v2",
@@ -50,7 +50,46 @@
         "retryable GitHub fallback fetches use a bounded attempt budget before exact source SHA and tree verification"
       ],
       "breakingDigest": "sha256:a6a35370d6b0d0f46e1b2712dcc01961fe53c2febde95409a27a485c10a36650",
-      "auditDigest": "sha256:51ae2f281edc42b6d825976cdc3312a0e42e968e7eb71bef68cd4b30bc7cd382"
+      "auditDigest": "sha256:d07b446c85a29ba854baa8438d6f7aca15ebccaf7673527d6a1d2912b2fb66e6"
+    },
+    {
+      "contractVersion": 1,
+      "stability": "stable",
+      "additiveChanges": "optional inputs, optional outputs, diagnostics, and documentation may be added within the same major line",
+      "id": "channel-build-router",
+      "kind": "workflow",
+      "path": ".github/workflows/build.yml",
+      "publicRef": "kungfu-systems/buildchain/.github/workflows/build.yml@v2",
+      "requiredInputs": [],
+      "requiredOutputs": [
+        "buildchain-channel",
+        "buildchain-runtime-sha",
+        "build-summary-artifact"
+      ],
+      "breakingDefaults": {
+        "channelDefault": "auto",
+        "developmentDefault": "alpha",
+        "prereleaseDefault": "alpha",
+        "stableReleaseDefault": "stable",
+        "ambiguousReleasePolicy": "fail-closed"
+      },
+      "optionalInputs": [
+        "buildchain-channel",
+        "buildchain-ref",
+        "buildchain-alpha-contract-lock-path",
+        "buildchain-stable-contract-lock-path",
+        "buildchain-contract-lock-path"
+      ],
+      "guarantees": [
+        "consumers declare one build job while Buildchain selects the matching generic major channel",
+        "development and prerelease intent select vN-alpha",
+        "stable release intent selects vN",
+        "ambiguous release-like intent fails before build jobs",
+        "explicit train and exact-SHA overrides retain the reusable build trust gate",
+        "alpha and stable channel selections use separate consumer contract locks by default"
+      ],
+      "breakingDigest": "sha256:c4597dfa89e1a58f1023905092b849644f5c080abf150aeba9c7e1cd5ed43962",
+      "auditDigest": "sha256:421dc3ff2c95da3a5d556281af3f2918f08cfd8782a0c968e8465ca0e09d3afb"
     },
     {
       "contractVersion": 1,
@@ -141,7 +180,7 @@
         "channel-aware artifact host facts are checked against the deploy plan before adapter side effects"
       ],
       "breakingDigest": "sha256:da569f90374e878948e3d5160ed9929338ce0572473ca8ee54867b0fe1aaeace",
-      "auditDigest": "sha256:a229811cdba006d4d04cec00e7df7a7363bbe2bf45e8429790f7f98b34f8be34"
+      "auditDigest": "sha256:9834ea899b16cb5603551df460b9e62fa4229c320d13f91a2353b696563fe07c"
     },
     {
       "contractVersion": 1,
@@ -442,7 +481,7 @@
         "manual entries carry source file digests so downstream sites and agents can detect stale hand-written documentation"
       ],
       "breakingDigest": "sha256:7d0d2819e3a3e72989d9c57b5efe9d0bc0a79bc0f2c82a0c7b9d6c5a211a91f2",
-      "auditDigest": "sha256:a7e839af9aa768fa216c2856ada768d4bfd97e920c3f99d9c63e14b1fb82e89c"
+      "auditDigest": "sha256:2b171c123d063c5b812c701e43b10578dca168b186937b29b57846ae47e4f647"
     },
     {
       "contractVersion": 1,
@@ -464,9 +503,9 @@
         "agents can discover supported Node APIs without importing internal file paths"
       ],
       "breakingDigest": "sha256:48f925608d3e2131d90936b07dc2a30341204cae3e6e785c0f77d61ad755c945",
-      "auditDigest": "sha256:b3833018162da89782de7b4f5723f1aca1bd7dc362b8276bf5e997fd6640d7f1"
+      "auditDigest": "sha256:678d254ee0ba8e58d9cc572d3721a916597e3260590113d4f8ba33b742868daf"
     }
   ],
-  "compatibilityDigest": "sha256:1396e42444aaf3f26a40121faf3d599eb9db13537f627fc8dbcef2475af8af44",
-  "contractDigest": "sha256:71a7ea68f69e0a69d61a7219ca0fb1181a2bfe57e8617f8a15b5e5a5093abd2e"
+  "compatibilityDigest": "sha256:2090784977bc7d54fc647215ef73532b9db26147a0b40ec3f56c31d611d806cc",
+  "contractDigest": "sha256:ceac237105bc966d6d2225db28e456b697d66093b59b2697c552d4867640c62d"
 }