@kungfu-tech/buildchain 2.12.0-alpha.4 → 2.12.0-alpha.5

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (7) hide show
  1. package/dist/site/buildchain-contract.json +3 -3
  2. package/dist/site/buildchain-site.json +4 -4
  3. package/dist/site/kfd-upstream-aggregate.json +1 -1
  4. package/dist/site/publication-registry.json +4 -4
  5. package/dist/site/site-manifest.json +4 -4
  6. package/package.json +1 -1
  7. package/scripts/stable-release-gate.mjs +43 -9
package/dist/site/buildchain-contract.json CHANGED
@@ -4,7 +4,7 @@
4
4
  "product": {
5
5
  "name": "Buildchain",
6
6
  "package": "@kungfu-tech/buildchain",
7
- "version": "2.12.0-alpha.4",
7
+ "version": "2.12.0-alpha.5",
8
8
  "repository": "https://github.com/kungfu-systems/buildchain"
9
9
  },
10
10
  "majorLine": "v2",
@@ -136,7 +136,7 @@
136
136
  "GitHub Release passport and evidence publication is delegated to promote-buildchain-ref after the semver release transaction completes"
137
137
  ],
138
138
  "breakingDigest": "sha256:6dbae32ce3d7aab3be6957065105af574794581847b7637314dad45f5349c919",
139
- "auditDigest": "sha256:8fb996788c04b2384aca31dee0418746b3f035deed4fcbbf001e7ce007777783"
139
+ "auditDigest": "sha256:489f399f6ae7e3270a495daf9f0275d0f8c07c26f7f02a29cec45980f8332792"
140
140
  },
141
141
  {
142
142
  "contractVersion": 1,
@@ -507,5 +507,5 @@
507
507
  }
508
508
  ],
509
509
  "compatibilityDigest": "sha256:2090784977bc7d54fc647215ef73532b9db26147a0b40ec3f56c31d611d806cc",
510
- "contractDigest": "sha256:36353997ad89f0083a752dfd677335fda0651ac7c670d46dd7299b467d174b85"
510
+ "contractDigest": "sha256:f04c34aa46e5424f6f2cc2224facbed50ecc2df7971bb2f5d4491c66603d2086"
511
511
  }
package/dist/site/buildchain-site.json CHANGED
@@ -1,8 +1,8 @@
1
1
  {
2
2
  "schemaVersion": 1,
3
3
  "contract": "kungfu-buildchain-site-bundle",
4
- "generatedAt": "2026-07-11T05:45:16.756Z",
5
- "publishedAt": "2026-07-11T05:45:16.756Z",
4
+ "generatedAt": "2026-07-11T07:42:57.779Z",
5
+ "publishedAt": "2026-07-11T07:42:57.779Z",
6
6
  "reproducible": true,
7
7
  "timestampPolicy": "ci-injected",
8
8
  "deterministicInputs": [
@@ -19,7 +19,7 @@
19
19
  "declared Buildchain surface manifest contract"
20
20
  ],
21
21
  "sourceDateEpoch": "0",
22
- "sourceRevision": "6ac5e0fbb3e3659c4948685993b9856ad8cf34e5",
22
+ "sourceRevision": "ff00db1f3dd500ded00b126f9743b3bba2b03d53",
23
23
  "timestampPolicyDetails": {
24
24
  "contract": "kungfu-buildchain-surface-timestamp-policy",
25
25
  "timestampFields": [
@@ -37,7 +37,7 @@
37
37
  },
38
38
  "package": {
39
39
  "name": "@kungfu-tech/buildchain",
40
- "version": "2.12.0-alpha.4",
40
+ "version": "2.12.0-alpha.5",
41
41
  "versionSource": "package.json#version"
42
42
  },
43
43
  "source": {
package/dist/site/kfd-upstream-aggregate.json CHANGED
@@ -4,7 +4,7 @@
4
4
  "product": {
5
5
  "id": "kungfu-tech-buildchain",
6
6
  "name": "@kungfu-tech/buildchain",
7
- "version": "2.12.0-alpha.4",
7
+ "version": "2.12.0-alpha.5",
8
8
  "repository": "https://github.com/kungfu-systems/buildchain"
9
9
  },
10
10
  "source": {
package/dist/site/publication-registry.json CHANGED
@@ -1,8 +1,8 @@
1
1
  {
2
2
  "schemaVersion": 1,
3
3
  "contract": "kungfu-buildchain-publication-release-registry",
4
- "generatedAt": "2026-07-11T05:45:16.756Z",
5
- "publishedAt": "2026-07-11T05:45:16.756Z",
4
+ "generatedAt": "2026-07-11T07:42:57.779Z",
5
+ "publishedAt": "2026-07-11T07:42:57.779Z",
6
6
  "reproducible": true,
7
7
  "timestampPolicy": "ci-injected",
8
8
  "deterministicInputs": [
@@ -19,7 +19,7 @@
19
19
  "declared Buildchain surface manifest contract"
20
20
  ],
21
21
  "sourceDateEpoch": "0",
22
- "sourceRevision": "6ac5e0fbb3e3659c4948685993b9856ad8cf34e5",
22
+ "sourceRevision": "ff00db1f3dd500ded00b126f9743b3bba2b03d53",
23
23
  "timestampPolicyDetails": {
24
24
  "contract": "kungfu-buildchain-surface-timestamp-policy",
25
25
  "timestampFields": [
@@ -32,7 +32,7 @@
32
32
  },
33
33
  "package": {
34
34
  "name": "@kungfu-tech/buildchain",
35
- "version": "2.12.0-alpha.4",
35
+ "version": "2.12.0-alpha.5",
36
36
  "versionSource": "package.json#version"
37
37
  },
38
38
  "sourceKind": "package-site-bundle",
package/dist/site/site-manifest.json CHANGED
@@ -1,8 +1,8 @@
1
1
  {
2
2
  "schemaVersion": 1,
3
3
  "contract": "kungfu-buildchain-site-manifest",
4
- "generatedAt": "2026-07-11T05:45:16.756Z",
5
- "publishedAt": "2026-07-11T05:45:16.756Z",
4
+ "generatedAt": "2026-07-11T07:42:57.779Z",
5
+ "publishedAt": "2026-07-11T07:42:57.779Z",
6
6
  "reproducible": true,
7
7
  "timestampPolicy": "ci-injected",
8
8
  "deterministicInputs": [
@@ -19,7 +19,7 @@
19
19
  "declared Buildchain surface manifest contract"
20
20
  ],
21
21
  "sourceDateEpoch": "0",
22
- "sourceRevision": "6ac5e0fbb3e3659c4948685993b9856ad8cf34e5",
22
+ "sourceRevision": "ff00db1f3dd500ded00b126f9743b3bba2b03d53",
23
23
  "timestampPolicyDetails": {
24
24
  "contract": "kungfu-buildchain-surface-timestamp-policy",
25
25
  "timestampFields": [
@@ -37,7 +37,7 @@
37
37
  },
38
38
  "package": {
39
39
  "name": "@kungfu-tech/buildchain",
40
- "version": "2.12.0-alpha.4",
40
+ "version": "2.12.0-alpha.5",
41
41
  "versionSource": "package.json#version"
42
42
  },
43
43
  "entrypoint": "buildchain-site.json",
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@kungfu-tech/buildchain",
3
- "version": "2.12.0-alpha.4",
3
+ "version": "2.12.0-alpha.5",
4
4
  "private": false,
5
5
  "description": "Buildchain Release Passport, release governance, CLI toolkit, and site facts.",
6
6
  "repository": "https://github.com/kungfu-systems/buildchain",
package/scripts/stable-release-gate.mjs CHANGED
@@ -87,6 +87,27 @@ function selectPreviousStable({ releases = [], candidate }) {
87
87
  .sort((left, right) => right.patch - left.patch)[0]?.release;
88
88
  }
89
89
 
90
+ function selectProductComparisonStable({ releases = [], candidate }) {
91
+ return releases
92
+ .map((release) => {
93
+ const match = String(release.tag_name || "").match(/^v(\d+)\.(\d+)\.(\d+)$/);
94
+ if (!match) {
95
+ return undefined;
96
+ }
97
+ const major = Number(match[1]);
98
+ const minor = Number(match[2]);
99
+ const patch = Number(match[3]);
100
+ const precedesCandidate =
101
+ major === candidate.major &&
102
+ (minor < candidate.minor || (minor === candidate.minor && patch < candidate.patch));
103
+ return precedesCandidate && release.published_at
104
+ ? { release, minor, patch }
105
+ : undefined;
106
+ })
107
+ .filter(Boolean)
108
+ .sort((left, right) => right.minor - left.minor || right.patch - left.patch)[0]?.release;
109
+ }
110
+
90
111
  function loadImpact({ cwd, input }) {
91
112
  const normalized = String(input || "").trim();
92
113
  if (!normalized) {
@@ -123,20 +144,32 @@ async function resolveCanaryEvidence({
123
144
  evidence.push({ id: canary.id, status: "missing", candidateSha });
124
145
  continue;
125
146
  }
126
- const run = await api(
147
+ let run = await api(
127
148
  `/repos/${repository.owner}/${repository.repo}/actions/runs/${encodeURIComponent(releaseCandidateRunId)}`,
128
149
  );
150
+ if (run.head_sha !== candidateSha) {
151
+ const exactRuns = await api(
152
+ `/repos/${repository.owner}/${repository.repo}/actions/runs?head_sha=${encodeURIComponent(candidateSha)}&status=success&per_page=100`,
153
+ );
154
+ run = (exactRuns.workflow_runs || []).find((entry) => {
155
+ const workflowMatches = !canary.workflow ||
156
+ canary.workflow === entry.name || canary.workflow === entry.path?.split("/").pop();
157
+ return entry.head_sha === candidateSha && entry.conclusion === "success" && workflowMatches;
158
+ });
159
+ }
129
160
  const workflowMatches = !canary.workflow ||
130
- canary.workflow === run.name || canary.workflow === run.path?.split("/").pop();
161
+ canary.workflow === run?.name || canary.workflow === run?.path?.split("/").pop();
131
162
  evidence.push({
132
163
  id: canary.id,
133
- status: run.conclusion === "success" && workflowMatches ? "success" : run.conclusion || "failure",
164
+ status: run?.head_sha === candidateSha && run.conclusion === "success" && workflowMatches
165
+ ? "success"
166
+ : run?.conclusion || "missing",
134
167
  candidateSha,
135
- completedAt: run.updated_at || run.run_started_at || "",
136
- evidenceUrl: run.html_url || releaseCandidateRunUrl,
168
+ completedAt: run?.updated_at || run?.run_started_at || "",
169
+ evidenceUrl: run?.html_url || "",
137
170
  repository: repository.fullName,
138
- workflow: run.name || run.path || "",
139
- attestor: run.actor?.login || run.triggering_actor?.login || "",
171
+ workflow: run?.name || run?.path || "",
172
+ attestor: run?.actor?.login || run?.triggering_actor?.login || "",
140
173
  });
141
174
  continue;
142
175
  }
@@ -233,12 +266,13 @@ export async function collectStableReleaseGateReport({
233
266
  resolveTagCommitSha({ api, repository, tag: candidate.tag }),
234
267
  ]);
235
268
  const previousRelease = selectPreviousStable({ releases, candidate });
269
+ const productComparisonRelease = selectProductComparisonStable({ releases, candidate });
236
270
  const previousSha = previousRelease
237
271
  ? await resolveTagCommitSha({ api, repository, tag: previousRelease.tag_name })
238
272
  : "";
239
- const comparison = previousRelease
273
+ const comparison = productComparisonRelease
240
274
  ? await api(
241
- `/repos/${repository.owner}/${repository.repo}/compare/${encodeURIComponent(previousRelease.tag_name)}...${encodeURIComponent(candidate.tag)}`,
275
+ `/repos/${repository.owner}/${repository.repo}/compare/${encodeURIComponent(productComparisonRelease.tag_name)}...${encodeURIComponent(candidate.tag)}`,
242
276
  )
243
277
  : { files: [] };
244
278
  const canaries = await resolveCanaryEvidence({