@kungfu-tech/buildchain 2.12.1-alpha.6 → 2.12.1-alpha.7

package/dist/site/buildchain-contract.json

@@ -4,7 +4,7 @@
   "product": {
     "name": "Buildchain",
     "package": "@kungfu-tech/buildchain",
-    "version": "2.12.1-alpha.6",
+    "version": "2.12.1-alpha.7",
     "repository": "https://github.com/kungfu-systems/buildchain"
   },
   "majorLine": "v2",
@@ -507,5 +507,5 @@
     }
   ],
   "compatibilityDigest": "sha256:2090784977bc7d54fc647215ef73532b9db26147a0b40ec3f56c31d611d806cc",
-  "contractDigest": "sha256:0d99192c0680fb9e00d7af90061eae0ef7e82b41453599f79fae7b5105df3c71"
+  "contractDigest": "sha256:b19d9fa286103c97b1bd3ae20bfca923bef32a6521450e70813b74ba3252bb7f"
 }

package/dist/site/buildchain-site.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-bundle",
-  "generatedAt": "2026-07-12T07:16:47.627Z",
-  "publishedAt": "2026-07-12T07:16:47.627Z",
+  "generatedAt": "2026-07-12T08:33:40.639Z",
+  "publishedAt": "2026-07-12T08:33:40.639Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "f189e978df8dc612f9a8f9553ee21dad653a5029",
+  "sourceRevision": "fff859ed6eee0dfb1d3e8ed873e7348aa74accc2",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "2.12.1-alpha.6",
+    "version": "2.12.1-alpha.7",
     "versionSource": "package.json#version"
   },
   "source": {

package/dist/site/kfd-upstream-aggregate.json

@@ -4,7 +4,7 @@
   "product": {
     "id": "kungfu-tech-buildchain",
     "name": "@kungfu-tech/buildchain",
-    "version": "2.12.1-alpha.6",
+    "version": "2.12.1-alpha.7",
     "repository": "https://github.com/kungfu-systems/buildchain"
   },
   "source": {

package/dist/site/publication-registry.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-publication-release-registry",
-  "generatedAt": "2026-07-12T07:16:47.627Z",
-  "publishedAt": "2026-07-12T07:16:47.627Z",
+  "generatedAt": "2026-07-12T08:33:40.639Z",
+  "publishedAt": "2026-07-12T08:33:40.639Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "f189e978df8dc612f9a8f9553ee21dad653a5029",
+  "sourceRevision": "fff859ed6eee0dfb1d3e8ed873e7348aa74accc2",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -32,7 +32,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "2.12.1-alpha.6",
+    "version": "2.12.1-alpha.7",
     "versionSource": "package.json#version"
   },
   "sourceKind": "package-site-bundle",

package/dist/site/site-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-manifest",
-  "generatedAt": "2026-07-12T07:16:47.627Z",
-  "publishedAt": "2026-07-12T07:16:47.627Z",
+  "generatedAt": "2026-07-12T08:33:40.639Z",
+  "publishedAt": "2026-07-12T08:33:40.639Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "f189e978df8dc612f9a8f9553ee21dad653a5029",
+  "sourceRevision": "fff859ed6eee0dfb1d3e8ed873e7348aa74accc2",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "2.12.1-alpha.6",
+    "version": "2.12.1-alpha.7",
     "versionSource": "package.json#version"
   },
   "entrypoint": "buildchain-site.json",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kungfu-tech/buildchain",
-  "version": "2.12.1-alpha.6",
+  "version": "2.12.1-alpha.7",
   "private": false,
   "description": "Buildchain Release Passport, release governance, CLI toolkit, and site facts.",
   "repository": "https://github.com/kungfu-systems/buildchain",

package/scripts/locked-source-checkout.mjs

@@ -200,6 +200,7 @@ export function fetchSourceCommit({
   remoteUrl,
   sha,
   fetchRef,
+  sourceTreeSha = "",
   timeoutMs,
   env = {},
   runGit = git,
@@ -225,7 +226,20 @@ export function fetchSourceCommit({
         stdio: "ignore",
       });
       if (containsCommit(targetPath, sha, timeoutMs)) {
-        return { selector: "ref" };
+        return { selector: "ref", checkoutSha: sha };
+      }
+      if (/^refs\/pull\/\d+\/merge$/.test(fetchRef) && sourceTreeSha) {
+        const fetchedSha = runGit(["rev-parse", "refs/buildchain/source-ref^{commit}"], {
+          cwd: targetPath,
+          timeoutMs,
+        });
+        const fetchedTree = runGit(["rev-parse", "refs/buildchain/source-ref^{tree}"], {
+          cwd: targetPath,
+          timeoutMs,
+        });
+        if (fetchedTree === sourceTreeSha) {
+          return { selector: "ref-tree", checkoutSha: fetchedSha };
+        }
       }
     } catch (error) {
       // A retryable transport failure belongs to the bounded outer retry. Do
@@ -245,7 +259,7 @@ export function fetchSourceCommit({
   if (!containsCommit(targetPath, sha, timeoutMs)) {
     throw new Error(`fetched ${fetchRef || sha}, but ${sha} is not available`);
   }
-  return { selector: "sha" };
+  return { selector: "sha", checkoutSha: sha };
 }
 
 export function runBoundedFetch({ attempts = 1, fetch, onAttempt = () => {}, onRetry = () => {}, shouldRetry = () => true }) {
@@ -272,18 +286,30 @@ function githubRemoteUrl({ repository, serverUrl = "https://github.com" }) {
   return `${base}/${repository}.git`;
 }
 
-function verifyCheckout({ targetPath, sourceSha, sourceTreeSha = "" }) {
+function verifyCheckout({ targetPath, sourceSha, sourceTreeSha = "", fetchRef = "" }) {
   const head = git(["rev-parse", "HEAD"], { cwd: targetPath });
   const tree = git(["rev-parse", "HEAD^{tree}"], { cwd: targetPath });
   const headOk = head === sourceSha;
   const treeOk = !sourceTreeSha || tree === sourceTreeSha;
-  if (!headOk) {
+  const pullMergeTreeEquivalent = !headOk
+    && /^refs\/pull\/\d+\/merge$/.test(fetchRef)
+    && Boolean(sourceTreeSha)
+    && treeOk;
+  if (!headOk && !pullMergeTreeEquivalent) {
     throw new Error(`locked source checkout head mismatch: expected ${sourceSha}, got ${head}`);
   }
   if (!treeOk) {
     throw new Error(`locked source checkout tree mismatch: expected ${sourceTreeSha}, got ${tree}`);
   }
-  return { head, tree, headOk, treeOk };
+  return {
+    head,
+    expectedHead: sourceSha,
+    tree,
+    headOk,
+    treeOk,
+    identityOk: headOk || pullMergeTreeEquivalent,
+    identityMode: pullMergeTreeEquivalent ? "tree-equivalent-pull-merge" : "commit",
+  };
 }
 
 function writeEvidence(filePath, evidence) {
@@ -365,6 +391,7 @@ export function lockedSourceCheckout({
     durationMs: 0,
   };
   let checkoutError;
+  let checkoutSha = sha;
   if (normalizedMode !== "off") {
     try {
       if (renderedReferenceRepository) {
@@ -380,15 +407,17 @@ export function lockedSourceCheckout({
         checkoutFetchedCommit(targetPath, sha, timeoutMs);
       } else if (renderedMirrorUrl) {
         evidence.cache.transport = "mirror-url";
-        fetchSourceCommit({
+        const fetchResult = fetchSourceCommit({
           targetPath,
           remoteName: "buildchain-cache",
           remoteUrl: renderedMirrorUrl,
           sha,
           fetchRef,
+          sourceTreeSha: treeSha,
           timeoutMs,
         });
-        checkoutFetchedCommit(targetPath, sha, timeoutMs);
+        checkoutSha = fetchResult.checkoutSha || sha;
+        checkoutFetchedCommit(targetPath, checkoutSha, timeoutMs);
       } else {
         throw new Error("checkout cache is enabled but no mirror URL or reference repository template was provided");
       }
@@ -422,6 +451,7 @@ export function lockedSourceCheckout({
           remoteUrl,
           sha,
           fetchRef,
+          sourceTreeSha: treeSha,
           timeoutMs: githubTimeoutMs,
           env: githubAuthEnv(githubToken),
         }),
@@ -430,14 +460,20 @@ export function lockedSourceCheckout({
         shouldRetry: retryableGitFetchError,
       });
       evidence.cache.githubFetchAttempts = fetchResult.attempts;
+      checkoutSha = fetchResult.value.checkoutSha || sha;
     } catch (error) {
       evidence.durationMs = Date.now() - startedAt;
       writeEvidence(path.resolve(workspace, diagnosticsPath), evidence);
       throw error;
     }
-    checkoutFetchedCommit(targetPath, sha, timeoutMs);
+    checkoutFetchedCommit(targetPath, checkoutSha, timeoutMs);
   }
-  evidence.verification = verifyCheckout({ targetPath, sourceSha: sha, sourceTreeSha: treeSha });
+  evidence.verification = verifyCheckout({
+    targetPath,
+    sourceSha: sha,
+    sourceTreeSha: treeSha,
+    fetchRef,
+  });
   evidence.durationMs = Date.now() - startedAt;
   writeEvidence(path.resolve(workspace, diagnosticsPath), evidence);
   return evidence;