@kungfu-tech/buildchain 2.12.0-alpha.1 → 2.12.0-alpha.4

package/actions/promote-buildchain-ref/README.md

@@ -159,10 +159,19 @@ for an older SHA after the protected channel has advanced, the workflow records
 the requested/current SHA pair, verifies that the current target is ahead of
 the requested commit, and exits successfully as a superseded no-op. Diverged,
 behind, or unreadable comparisons still fail closed.
+After queued-intent revalidation, the reusable workflow runs the canonical
+release-candidate resolver in metadata-only mode before installing candidate
+dependencies or starting the full promotion job. The full job resolves and
+downloads the evidence again before any publish-gate or publication mutation.
+This preserves the final exact-evidence trust check while making missing or
+stale PR-stage evidence fail early.
 The action repeats that check at its mutation boundary for governed promotion
 calls, closing the race between workflow preflight and action start. Direct
 non-governed calls and dry-runs keep the strict target mismatch error so local
 diagnostics cannot silently reinterpret a stale request.
+Expected manual dry-run failures remain visible in the workflow result and do
+not create automated workflow-friction issues; issue reporting is reserved for
+non-dry-run promotion failures.
 The reusable build workflow performs the cheaper channel-ref preflight earlier:
 after source-lock resolution and before the build matrix, it requires the target
 channel ref such as `alpha/v22/v22.22` or `release/v22/v22.22` to already point

package/dist/site/buildchain-contract.json

@@ -4,7 +4,7 @@
   "product": {
     "name": "Buildchain",
     "package": "@kungfu-tech/buildchain",
-    "version": "2.12.0-alpha.1",
+    "version": "2.12.0-alpha.4",
     "repository": "https://github.com/kungfu-systems/buildchain"
   },
   "majorLine": "v2",
@@ -50,7 +50,7 @@
         "retryable GitHub fallback fetches use a bounded attempt budget before exact source SHA and tree verification"
       ],
       "breakingDigest": "sha256:a6a35370d6b0d0f46e1b2712dcc01961fe53c2febde95409a27a485c10a36650",
-      "auditDigest": "sha256:d506b27c6c3c3194861d7e44fed9995de97adf387d03022bdf8280b014f19be7"
+      "auditDigest": "sha256:39937bb295433612f03174854aa8939aeda2e106c3e77d8f109d4e80989d9e45"
     },
     {
       "contractVersion": 1,
@@ -136,7 +136,7 @@
         "GitHub Release passport and evidence publication is delegated to promote-buildchain-ref after the semver release transaction completes"
       ],
       "breakingDigest": "sha256:6dbae32ce3d7aab3be6957065105af574794581847b7637314dad45f5349c919",
-      "auditDigest": "sha256:c02484e4e6b073311cdf4b9ac9690b84344b4ec214adf799515f7dd4480fd7f8"
+      "auditDigest": "sha256:8fb996788c04b2384aca31dee0418746b3f035deed4fcbbf001e7ce007777783"
     },
     {
       "contractVersion": 1,
@@ -481,7 +481,7 @@
         "manual entries carry source file digests so downstream sites and agents can detect stale hand-written documentation"
       ],
       "breakingDigest": "sha256:7d0d2819e3a3e72989d9c57b5efe9d0bc0a79bc0f2c82a0c7b9d6c5a211a91f2",
-      "auditDigest": "sha256:842e4237925bdb1f6f22cdae8ff4080a30661d557822ebe4ae837a5d0f0d5f09"
+      "auditDigest": "sha256:514363aee40e515e12f82a7e90b017c8faf2ec468485cefff5644e16f5081071"
     },
     {
       "contractVersion": 1,
@@ -507,5 +507,5 @@
     }
   ],
   "compatibilityDigest": "sha256:2090784977bc7d54fc647215ef73532b9db26147a0b40ec3f56c31d611d806cc",
-  "contractDigest": "sha256:2db167ddb24070bb657b8d1d62f895c4e0242f2e1d146d44dc93b05be83e4db8"
+  "contractDigest": "sha256:36353997ad89f0083a752dfd677335fda0651ac7c670d46dd7299b467d174b85"
 }