@kungfu-tech/buildchain 2.12.6 → 2.12.7-alpha.10

package/dist/site/public-surface-audit.json

@@ -3,15 +3,20 @@
   "contract": "kungfu-buildchain-public-surface-reverse-audit",
   "status": "passed",
   "summary": {
-    "cliCommandCount": 76,
-    "workflowCount": 43,
+    "cliCommandCount": 79,
+    "workflowCount": 47,
     "actionCount": 4,
-    "sitePageCount": 48,
-    "docCommandRefCount": 241,
+    "sitePageCount": 49,
+    "docCommandRefCount": 246,
     "failureCount": 0
   },
   "enumerated": {
     "cliCommands": [
+      {
+        "id": "audit",
+        "source": "bin/buildchain.mjs",
+        "usage": "buildchain audit publication-control-plane --repository <owner/repo> --branch <protected-branch>"
+      },
       {
         "id": "badges",
         "source": "bin/buildchain.mjs",
@@ -47,6 +52,11 @@
         "source": "bin/buildchain.mjs",
         "usage": "buildchain collect github-release --tag <tag> [--repository <owner/repo>]"
       },
+      {
+        "id": "create",
+        "source": "bin/buildchain.mjs",
+        "usage": "buildchain create publication-admission --input-json <file-or-json> [--output <file>] [--json]"
+      },
       {
         "id": "diagnostics",
         "source": "bin/buildchain.mjs",
@@ -377,6 +387,11 @@
         "source": "bin/buildchain.mjs",
         "usage": "buildchain verify observability-log <jsonl> [--min-events <n>]"
       },
+      {
+        "id": "verify-publication-admission",
+        "source": "bin/buildchain.mjs",
+        "usage": "buildchain verify publication-admission <file-or-json>"
+      },
       {
         "id": "verify-release-passport",
         "source": "bin/buildchain.mjs",
@@ -394,6 +409,27 @@
       }
     ],
     "workflowInputs": [
+      {
+        "id": ".binary-release-assets",
+        "path": ".github/workflows/.binary-release-assets.yml",
+        "reusable": true,
+        "inputs": [
+          "buildchain-ref",
+          "buildchain-repository",
+          "evidence-run-id",
+          "publication-admission-json",
+          "publication-control-plane-audit-json",
+          "publication-expected-json",
+          "publication-runner-provenance-json",
+          "publication-used-nonces-json",
+          "release-tag"
+        ],
+        "inputCount": 9,
+        "secrets": [],
+        "secretCount": 0,
+        "outputs": [],
+        "outputCount": 0
+      },
       {
         "id": ".build",
         "path": ".github/workflows/.build.yml",
@@ -567,6 +603,50 @@
         ],
         "outputCount": 14
       },
+      {
+        "id": ".publication-authority",
+        "path": ".github/workflows/.publication-authority.yml",
+        "reusable": true,
+        "inputs": [
+          "admission-json",
+          "authority-workflow-path",
+          "auto-admission",
+          "auto-admission-kind",
+          "buildchain-ref",
+          "buildchain-repository",
+          "control-plane-audit-json",
+          "dry-run",
+          "evidence-controller-artifact",
+          "evidence-manifest-pattern",
+          "evidence-passport-artifact",
+          "evidence-payload-pattern",
+          "evidence-publication-artifact",
+          "evidence-repository",
+          "evidence-run-id",
+          "evidence-summary-artifact",
+          "expected-json",
+          "gate-aggregate-json",
+          "package-name",
+          "product",
+          "publication-target",
+          "publication-version",
+          "publisher-workflow-path",
+          "required-status-check",
+          "runner-provenance-json",
+          "source-sha",
+          "target-ref",
+          "used-nonces-json"
+        ],
+        "inputCount": 28,
+        "secrets": [],
+        "secretCount": 0,
+        "outputs": [
+          "capability-artifact",
+          "capability-digest",
+          "capability-json"
+        ],
+        "outputCount": 3
+      },
       {
         "id": ".release-docker",
         "path": ".github/workflows/.release-docker.yml",
@@ -832,6 +912,11 @@
           "production-release-on-main",
           "production-release-pr-mode",
           "production-release-pr-token",
+          "publication-admission-json",
+          "publication-control-plane-audit-json",
+          "publication-expected-json",
+          "publication-runner-provenance-json",
+          "publication-used-nonces-json",
           "release-feedback-actor-privacy",
           "staging-apply",
           "staging-aws-role-arn",
@@ -839,7 +924,7 @@
           "verify-command",
           "working-directory"
         ],
-        "inputCount": 33,
+        "inputCount": 38,
         "secrets": [
           "production-release-app-private-key"
         ],
@@ -921,6 +1006,17 @@
         "outputs": [],
         "outputCount": 0
       },
+      {
+        "id": "binary-release-assets",
+        "path": ".github/workflows/binary-release-assets.yml",
+        "reusable": false,
+        "inputs": [],
+        "inputCount": 0,
+        "secrets": [],
+        "secretCount": 0,
+        "outputs": [],
+        "outputCount": 0
+      },
       {
         "id": "build-surface-fixture",
         "path": ".github/workflows/build-surface-fixture.yml",
@@ -1244,6 +1340,49 @@
         "outputs": [],
         "outputCount": 0
       },
+      {
+        "id": "paper-release-sealed",
+        "path": ".github/workflows/paper-release-sealed.yml",
+        "reusable": true,
+        "inputs": [
+          "artifact-name",
+          "artifact-paths",
+          "artifact-retention-days",
+          "branch-protection-bypass-apps",
+          "branch-protection-bypass-teams",
+          "branch-protection-bypass-users",
+          "buildchain-contract-lock-path",
+          "buildchain-ref",
+          "buildchain-repository",
+          "dry-run",
+          "github-release",
+          "github-release-notes",
+          "github-release-title",
+          "package-name",
+          "publish-dist-tag",
+          "publisher-workflow-path",
+          "release-passport-impact-json",
+          "release-passport-output-dir",
+          "release-passport-product-name",
+          "required-status-check",
+          "target-ref",
+          "target-sha",
+          "toolchain-type",
+          "verify-command",
+          "working-directory"
+        ],
+        "inputCount": 25,
+        "secrets": [],
+        "secretCount": 0,
+        "outputs": [
+          "github-release-url",
+          "package-name",
+          "package-version",
+          "public-release-tag",
+          "release-passport-path"
+        ],
+        "outputCount": 5
+      },
       {
         "id": "paper-release",
         "path": ".github/workflows/paper-release.yml",
@@ -1266,6 +1405,11 @@
           "github-release-title",
           "node-version",
           "package-name",
+          "publication-admission-json",
+          "publication-control-plane-audit-json",
+          "publication-expected-json",
+          "publication-runner-provenance-json",
+          "publication-used-nonces-json",
           "publish-dist-tag",
           "publish-package-set-order",
           "release-passport-impact-json",
@@ -1282,11 +1426,9 @@
           "verify-command",
           "working-directory"
         ],
-        "inputCount": 32,
-        "secrets": [
-          "BUILDCHAIN_PROMOTION_TOKEN"
-        ],
-        "secretCount": 1,
+        "inputCount": 37,
+        "secrets": [],
+        "secretCount": 0,
         "outputs": [
           "controller-plan-artifact",
           "controller-plan-digest",
@@ -1398,7 +1540,11 @@
           "buildchain-ref",
           "buildchain-repository",
           "node-version",
+          "package-name",
+          "prepare-paper-package",
+          "publish-dist-tag",
           "setup-node",
+          "target-ref",
           "toolchain-command",
           "toolchain-digest",
           "toolchain-image",
@@ -1406,7 +1552,7 @@
           "verify-command",
           "working-directory"
         ],
-        "inputCount": 17,
+        "inputCount": 21,
         "secrets": [],
         "secretCount": 0,
         "outputs": [
@@ -1417,13 +1563,17 @@
           "controller-receipt-digest",
           "controller-receipt-json",
           "controller-receipt-status",
+          "package-name",
+          "package-version",
           "publication-artifact-name",
           "publication-manifest-json",
           "publication-manifest-path",
           "publication-passport-path",
-          "publication-registry-path"
+          "publication-registry-path",
+          "publish-dist-tag",
+          "runtime-sha"
         ],
-        "outputCount": 12
+        "outputCount": 16
       },
       {
         "id": "release-candidate-promote",
@@ -1447,6 +1597,17 @@
           "github-release-notes",
           "github-release-title",
           "package-manager",
+          "publication-admission-json",
+          "publication-auto-admission",
+          "publication-control-plane-audit-json",
+          "publication-expected-json",
+          "publication-gate-aggregate-json",
+          "publication-package-name",
+          "publication-product",
+          "publication-publisher-workflow-path",
+          "publication-runner-provenance-json",
+          "publication-target",
+          "publication-used-nonces-json",
           "publish-artifact-kind",
           "publish-command",
           "publish-dist-tag",
@@ -1475,7 +1636,7 @@
           "target-sha",
           "trusted-publishing"
         ],
-        "inputCount": 44,
+        "inputCount": 55,
         "secrets": [
           "BUILDCHAIN_ISSUE_APP_ID",
           "BUILDCHAIN_ISSUE_APP_PRIVATE_KEY",
@@ -1496,9 +1657,10 @@
           "controller-receipt-json",
           "controller-receipt-status",
           "promoted-sha",
+          "publication-capability-digest",
           "release-candidate-artifact"
         ],
-        "outputCount": 10
+        "outputCount": 11
       },
       {
         "id": "release-line-bootstrap",
@@ -1649,9 +1811,11 @@
           "branch-protection-bypass-teams",
           "branch-protection-bypass-users",
           "dry-run",
+          "expected-publication-version",
           "generated-ref-update-token",
           "generated-status-check-token",
           "github-release",
+          "github-release-artifact-paths",
           "github-release-notes",
           "github-release-title",
           "promote-only-release-candidate",
@@ -1697,7 +1861,7 @@
           "transaction-state-path",
           "verification-command"
         ],
-        "inputCount": 52
+        "inputCount": 54
       },
       {
         "id": "report-buildchain-issue",
@@ -1916,6 +2080,10 @@
         "id": "manual:publication-artifacts",
         "category": "manual"
       },
+      {
+        "id": "manual:publication-authority",
+        "category": "manual"
+      },
       {
         "id": "manual:publish-transaction",
         "category": "manual"
@@ -1982,6 +2150,26 @@
       }
     ],
     "docCommandRefs": [
+      {
+        "id": "audit",
+        "path": "docs/publication-authority.md",
+        "command": "buildchain audit publication-control-plane"
+      },
+      {
+        "id": "audit",
+        "path": "docs/publication-authority.md",
+        "command": "buildchain audit publication-control-plane"
+      },
+      {
+        "id": "audit",
+        "path": "docs/publication-authority.md",
+        "command": "buildchain audit publication-control-plane"
+      },
+      {
+        "id": "audit",
+        "path": "docs/publication-authority.md",
+        "command": "buildchain audit publication-control-plane"
+      },
       {
         "id": "badges-bundle",
         "path": "docs/cli.md",
@@ -3142,6 +3330,11 @@
         "path": "README.md",
         "command": "buildchain verify observability-log"
       },
+      {
+        "id": "verify-publication-admission",
+        "path": "docs/publication-authority.md",
+        "command": "buildchain verify publication-admission admission"
+      },
       {
         "id": "verify-release-passport",
         "path": "docs/cli.md",
@@ -3193,9 +3386,9 @@
     "cliRegistryPath": "dist/site/cli-registry.json",
     "workflowRegistryPath": "dist/site/workflow-registry.json",
     "pageRegistryPath": "dist/site/page-registry.json",
-    "cliRegistryDigest": "ab57fec294efb9dde1612787bfd0d532b5bb95298b5da14a2b51a5e71b9c7dcc",
-    "workflowRegistryDigest": "1da5cf730fa6a4816bc3d15a457b34dba28d9dfdcdc3146e9b35cb7e0e6c7abf",
-    "pageRegistryDigest": "0319f1af7e6241d1cf41d063b4b2870d2b405f475133cbfef05cfd8f435d0584"
+    "cliRegistryDigest": "a6daf4822365bf576425777230246046ebca67b3f8dcfea61fc7a61773776185",
+    "workflowRegistryDigest": "a61b85b07185e02e340c27d50f77a6710968db87dd42d1b1f4dd81260779a0ed",
+    "pageRegistryDigest": "3a4779e3d85d0a175e33c7d2a8bee30ede3931cc721a7d8c422ab321f0dec723"
   },
   "comparison": {
     "missingCliRegistry": [],