@kungfu-tech/buildchain 2.12.6 → 2.12.7-alpha.1

package/packages/core/buildchain-publication-authority.js

@@ -0,0 +1,79 @@
+import fs from "node:fs";
+import path from "node:path";
+
+import { createPublicationAuthorityRegistry } from "./publication-authority.js";
+
+const DESCRIPTORS = Object.freeze([
+  [".github/workflows/.build.yml", "non-publication-oidc"],
+  [".github/workflows/.publication-authority.yml", "evidence-publication"],
+  [".github/workflows/.release-verify.yml", "governance-write"],
+  [".github/workflows/.sam-release.yml", "retired-deny"],
+  [".github/workflows/.sam-verify.yml", "retired-deny"],
+  [".github/workflows/.sync-remote-git.yml", "governance-write"],
+  [".github/workflows/.web-surface.yml", "product-publication", true, ["web-production"], "oidc", "consumer-defined", "caller-bound", "caller-bound"],
+  [".github/workflows/.wheel-release.yml", "retired-deny"],
+  [".github/workflows/.wheel-verify.yml", "retired-deny"],
+  [".github/workflows/.binary-release-assets.yml", "product-publication", true, ["github-release"], "github-token", "buildchain-release-assets"],
+  [".github/workflows/binary-distribution.yml", "evidence-publication"],
+  [".github/workflows/binary-release-assets.yml", "governance-write"],
+  [".github/workflows/build-surface-fixture.yml", "non-publication-oidc"],
+  [".github/workflows/build.yml", "non-publication-oidc"],
+  [".github/workflows/buildchain-alpha-self-dogfood.yml", "non-publication-oidc"],
+  [".github/workflows/buildchain-patrol-daily.yml", "governance-write"],
+  [".github/workflows/buildchain-patrol-monthly.yml", "governance-write"],
+  [".github/workflows/buildchain-patrol-weekly.yml", "governance-write"],
+  [".github/workflows/buildchain-patrol.yml", "governance-write"],
+  [".github/workflows/buildchain-ref-promotion.yml", "governance-write"],
+  [".github/workflows/buildchain-stable-candidate-patrol.yml", "governance-write"],
+  [".github/workflows/dev-pr-auto-merge.yml", "governance-write"],
+  [".github/workflows/npm-publish.yml", "dry-run-only"],
+  [".github/workflows/paper-release.yml", "product-publication", true, ["npm-publish", "github-release"], "trusted-publishing", "none", "fixed", "caller-bound"],
+  [".github/workflows/patrol-daily.yml", "governance-write"],
+  [".github/workflows/patrol-monthly.yml", "governance-write"],
+  [".github/workflows/patrol-weekly.yml", "governance-write"],
+  [".github/workflows/publication-artifact.yml", "evidence-publication"],
+  [".github/workflows/release-candidate-promote.yml", "product-publication", true, ["npm-publish", "github-release", "channel-ref"], "trusted-publishing", "none", "fixed", "caller-bound"],
+  [".github/workflows/release-line-bootstrap.yml", "governance-write"],
+  [".github/workflows/release-propagation.yml", "governance-write"],
+  [".github/workflows/release-verify.yml", "governance-write"],
+  [".github/workflows/stable-candidate-patrol.yml", "governance-write"],
+]);
+
+export function buildchainPublicationAuthorityDescriptors() {
+  return DESCRIPTORS.map(([
+    workflowPath,
+    authorityClass,
+    publicationCapable = false,
+    capabilityIds = [],
+    credentialMode = "none",
+    environment = "",
+    environmentMode = "fixed",
+    publisherWorkflowMode = "fixed",
+    publisherWorkflowPath = workflowPath,
+  ]) => ({
+    workflowPath,
+    authorityClass,
+    publicationCapable,
+    capabilityIds,
+    credentialMode,
+    publisherWorkflowMode,
+    publisherWorkflowPath,
+    environment,
+    environmentMode,
+    runnerPolicy: publicationCapable ? "qualified-measured" : "unqualified",
+  }));
+}
+
+export function createBuildchainPublicationAuthorityRegistry({ root = process.cwd() } = {}) {
+  const workflowsDir = path.join(root, ".github", "workflows");
+  const workflows = fs.readdirSync(workflowsDir)
+    .filter((name) => name.endsWith(".yml") || name.endsWith(".yaml"))
+    .map((name) => ({
+      path: `.github/workflows/${name}`,
+      text: fs.readFileSync(path.join(workflowsDir, name), "utf8"),
+    }));
+  return createPublicationAuthorityRegistry({
+    descriptors: buildchainPublicationAuthorityDescriptors(),
+    workflows,
+  });
+}

package/packages/core/controller-evidence.js

@@ -47,9 +47,9 @@ const CONTROLLER_SPECS = [
     id: "web-surface",
     workflowId: ".web-surface",
     version: 1,
-    capabilities: ["web-build", "web-verify", "deployment-plan", "deployment-apply"],
-    stages: ["resolve-runtime", "plan", "build", "verify", "apply", "aggregate"],
-    optionalStages: ["build", "verify", "apply"],
+    capabilities: ["web-build", "web-verify", "deployment-plan", "deployment-apply", "publication-authority"],
+    stages: ["resolve-runtime", "plan", "build", "verify", "publication-authority", "apply", "aggregate"],
+    optionalStages: ["build", "verify", "publication-authority", "apply"],
     evidence: ["web-surface-plan", "controller-receipt"],
   },
   {
@@ -65,8 +65,8 @@ const CONTROLLER_SPECS = [
     id: "paper-release",
     workflowId: "paper-release",
     version: 1,
-    capabilities: ["publication-build", "artifact-admission", "release-publish", "release-passport"],
-    stages: ["resolve-runtime", "build", "verify", "collect", "publish", "passport", "aggregate"],
+    capabilities: ["publication-build", "artifact-admission", "publication-authority", "release-publish", "release-passport"],
+    stages: ["resolve-runtime", "build", "verify", "collect", "publication-authority", "publish", "passport", "aggregate"],
     optionalStages: ["verify"],
     evidence: ["publication-manifest", "release-passport", "controller-receipt"],
   },
@@ -74,8 +74,8 @@ const CONTROLLER_SPECS = [
     id: "release-candidate-promotion",
     workflowId: "release-candidate-promote",
     version: 1,
-    capabilities: ["promotion-preflight", "artifact-admission", "publish-transaction", "release-passport"],
-    stages: ["preflight", "admit-release-candidate", "publish", "passport", "aggregate"],
+    capabilities: ["promotion-preflight", "artifact-admission", "publication-authority", "publish-transaction", "release-passport"],
+    stages: ["preflight", "admit-release-candidate", "publication-authority", "publish", "passport", "aggregate"],
     evidence: ["release-candidate-passport", "publish-evidence", "release-passport", "controller-receipt"],
   },
   {

package/packages/core/index.js

@@ -132,6 +132,34 @@ export {
   preparePublicationNpmPackage,
 } from "./publication-package.js";
 
+export {
+  PUBLICATION_ADMISSION_CONTRACT,
+  PUBLICATION_ARTIFACT_MANIFEST_SET_CONTRACT,
+  PUBLICATION_AUTHORITY_CLASSES,
+  PUBLICATION_AUTHORITY_REGISTRY_CONTRACT,
+  PUBLICATION_CAPABILITY_CONTRACT,
+  PUBLICATION_CONTROL_PLANE_AUDIT_CONTRACT,
+  PUBLICATION_GATE_DECISION_CONTRACT,
+  RUNNER_PROVENANCE_CLASSES,
+  RUNNER_PROVENANCE_CONTRACT,
+  createPublicationAuthorityRegistry,
+  createPublicationAdmission,
+  createPublicationArtifactManifestSet,
+  createPublicationControlPlaneAudit,
+  createPublicationGateDecision,
+  createRunnerProvenance,
+  detectPublicationAuthoritySignals,
+  publicationAuthorityDigest,
+  verifyPublicationAdmission,
+} from "./publication-authority.js";
+
+export {
+  buildchainPublicationAuthorityDescriptors,
+  createBuildchainPublicationAuthorityRegistry,
+} from "./buildchain-publication-authority.js";
+
+export { evaluatePublicationControlPlaneSnapshot } from "./publication-control-plane-audit.js";
+
 export {
   ARTIFACT_PASSPORT_LOCATOR_CONTRACT,
   ARTIFACT_PASSPORT_POINTER_CONTRACT,