@kungfu-tech/buildchain 2.12.7-alpha.2 → 2.12.7-alpha.21

package/actions/promote-buildchain-ref/README.md

@@ -336,7 +336,11 @@ Missing required artifacts can be published on the next run. Conflicting
 refs, digests, or declared provenance put the transaction into
 `repair_required`; `abandoned` and
 `failed_permanently` also fail closed unless `publish-transaction-override` is
-set for a controlled repair.
+set for a controlled repair. The same override may replace a stale transaction
+only when its version, exact tag, target ref, and channel are unchanged, the
+transaction is not complete, and it contains no published artifacts or
+evidence. This lets a newly admitted source retry a previously failed paper
+publication without weakening already-published facts.
 
 In strict buildchain promotion, ref movement is also gated by the old ABV
 governance semantics:

package/dist/site/buildchain-contract.json

@@ -4,7 +4,7 @@
   "product": {
     "name": "Buildchain",
     "package": "@kungfu-tech/buildchain",
-    "version": "2.12.7-alpha.2",
+    "version": "2.12.7-alpha.21",
     "repository": "https://github.com/kungfu-systems/buildchain"
   },
   "majorLine": "v2",
@@ -50,7 +50,7 @@
         "retryable GitHub fallback fetches use a bounded attempt budget before exact source SHA and tree verification"
       ],
       "breakingDigest": "sha256:a6a35370d6b0d0f46e1b2712dcc01961fe53c2febde95409a27a485c10a36650",
-      "auditDigest": "sha256:18b1cdc05272152120fdb52eb98be1d146702664ca8eba29ae92591ae55d5d2a"
+      "auditDigest": "sha256:d468a640a96539be038335ca4ec2d1800e263cad553d8ee790f268a9e8dfc981"
     },
     {
       "contractVersion": 1,
@@ -159,7 +159,7 @@
         "GitHub Release passport and evidence publication is delegated to promote-buildchain-ref after the semver release transaction completes"
       ],
       "breakingDigest": "sha256:6dbae32ce3d7aab3be6957065105af574794581847b7637314dad45f5349c919",
-      "auditDigest": "sha256:5392d7281cf54d5903d114191a81243cde58a19846e143accf617dcdd57995a2"
+      "auditDigest": "sha256:3de1fbbaad4c5b09cf958bed1aeba4fd9a3e101baa96076088c9c4a91c2d9784"
     },
     {
       "contractVersion": 1,
@@ -269,7 +269,7 @@
         "semver GitHub Releases are created or updated only after transaction completion, with prerelease/latest metadata derived from the public release tag"
       ],
       "breakingDigest": "sha256:a59f0910e6df842e7699139472e5dd69ac2fdd7f7213bf2cb346d1d622556874",
-      "auditDigest": "sha256:61edd187a303c33eeef28ccca138e46d7494645b16e6df72719b6d632b0d8e80"
+      "auditDigest": "sha256:2ee7b15a8f2e04ecb798d315c99c29dbb7ad857b87256f8f09a2cb4c024e7cf6"
     },
     {
       "contractVersion": 1,
@@ -527,7 +527,7 @@
         "manual entries carry source file digests so downstream sites and agents can detect stale hand-written documentation"
       ],
       "breakingDigest": "sha256:7d0d2819e3a3e72989d9c57b5efe9d0bc0a79bc0f2c82a0c7b9d6c5a211a91f2",
-      "auditDigest": "sha256:1b444a6dd4d4ea1b7f55ab74e6e53b4e042c9a872d6dee247acf63f7bbab9f23"
+      "auditDigest": "sha256:147a919feefa45c601f1e1fbf00a2d57bb0343294303adac2ea1f196a453ca4b"
     },
     {
       "contractVersion": 1,
@@ -549,7 +549,7 @@
         "agents can discover supported Node APIs without importing internal file paths"
       ],
       "breakingDigest": "sha256:48f925608d3e2131d90936b07dc2a30341204cae3e6e785c0f77d61ad755c945",
-      "auditDigest": "sha256:cd51cdc232d3c96ebfc9176ff99dc6ddaae1c93822d7f50be055973355b20dc4"
+      "auditDigest": "sha256:6cb094e42fb35ae6a3b166fbe179a4663f019737cd82bad6279ffaf690110737"
     },
     {
       "contractVersion": 1,
@@ -600,7 +600,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:373723a73d188194d389dee04c394d3b79cb0c016a370f2f5d0f60979a02ed48",
-        "registryDigest": "sha256:f4ea94c3590360ef21ade53056129f0183356de3d1997e43c49a0494d0acd34a",
+        "registryDigest": "sha256:22be9d05109396f2b5c44a74fb0f67e4a554c462662c5a41e44e466c4d90ed04",
         "inputClassifications": {
           "buildchain-ref": {
             "classification": "included",
@@ -746,7 +746,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:ce2ada5daf86cbe6e58327c190fdfe07510952cc8820cf445eb4342daae4da18",
-        "registryDigest": "sha256:f4ea94c3590360ef21ade53056129f0183356de3d1997e43c49a0494d0acd34a",
+        "registryDigest": "sha256:22be9d05109396f2b5c44a74fb0f67e4a554c462662c5a41e44e466c4d90ed04",
         "inputClassifications": {
           "BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN": {
             "classification": "redacted",
@@ -1001,7 +1001,7 @@
         "missing receipts are non-qualifying and must not be represented as a successful controller run"
       ],
       "breakingDigest": "sha256:e264a79f9f399038c2fcfd21e4168c68c2e1485ee5c651c02242a02b622ac2be",
-      "auditDigest": "sha256:18b1cdc05272152120fdb52eb98be1d146702664ca8eba29ae92591ae55d5d2a"
+      "auditDigest": "sha256:d468a640a96539be038335ca4ec2d1800e263cad553d8ee790f268a9e8dfc981"
     },
     {
       "contractVersion": 1,
@@ -1107,7 +1107,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:0ed17d03e410ca1b7726422716522a5e9096eee7badb197401291d53198518ea",
-        "registryDigest": "sha256:f4ea94c3590360ef21ade53056129f0183356de3d1997e43c49a0494d0acd34a",
+        "registryDigest": "sha256:22be9d05109396f2b5c44a74fb0f67e4a554c462662c5a41e44e466c4d90ed04",
         "inputClassifications": {
           "BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN": {
             "classification": "redacted",
@@ -1433,7 +1433,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:29569f4b754595792a16742d1c4c63838b54601674a2cb6c96261a72c962dece",
-        "registryDigest": "sha256:f4ea94c3590360ef21ade53056129f0183356de3d1997e43c49a0494d0acd34a",
+        "registryDigest": "sha256:22be9d05109396f2b5c44a74fb0f67e4a554c462662c5a41e44e466c4d90ed04",
         "inputClassifications": {
           "artifact-name": {
             "classification": "included",
@@ -1520,7 +1520,7 @@
         "missing receipts are non-qualifying and must not be represented as a successful controller run"
       ],
       "breakingDigest": "sha256:5f1868478b7ccd9fb79aea76bc771289d2ca6bd2dccd1abf57575426f1eae5fb",
-      "auditDigest": "sha256:2b8db410486b9f572536be9fc68b8819c373ba31bdf8a7379c2770ce5168eb6c"
+      "auditDigest": "sha256:f478f291726cd47d998c37d454d9fc3e97f1d4a45dc60fe756d8c239fa1245bd"
     },
     {
       "contractVersion": 1,
@@ -1603,7 +1603,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:f08c4970f33c059f8e0b43110f0063172fb1015ac914bdb0c8e9646692fb9f06",
-        "registryDigest": "sha256:f4ea94c3590360ef21ade53056129f0183356de3d1997e43c49a0494d0acd34a",
+        "registryDigest": "sha256:22be9d05109396f2b5c44a74fb0f67e4a554c462662c5a41e44e466c4d90ed04",
         "inputClassifications": {
           "artifact-path": {
             "classification": "digest-only",
@@ -1820,7 +1820,11 @@
         "buildchain-ref",
         "buildchain-repository",
         "node-version",
+        "package-name",
+        "prepare-paper-package",
+        "publish-dist-tag",
         "setup-node",
+        "target-ref",
         "toolchain-command",
         "toolchain-digest",
         "toolchain-image",
@@ -1830,8 +1834,8 @@
       ],
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
-        "digest": "sha256:d09d8f4081e7b5b9296487337206111591eeca6f8d7667e90012ac911c1b71cf",
-        "registryDigest": "sha256:f4ea94c3590360ef21ade53056129f0183356de3d1997e43c49a0494d0acd34a",
+        "digest": "sha256:6b132790b9798e8a5dfbe095701d8e024c160a08bc7c4bd477ee79feef7a9cfd",
+        "registryDigest": "sha256:22be9d05109396f2b5c44a74fb0f67e4a554c462662c5a41e44e466c4d90ed04",
         "inputClassifications": {
           "artifact-name": {
             "classification": "included",
@@ -1873,10 +1877,26 @@
             "classification": "included",
             "source": "workflow-call-input"
           },
+          "package-name": {
+            "classification": "included",
+            "source": "workflow-call-input"
+          },
+          "prepare-paper-package": {
+            "classification": "included",
+            "source": "workflow-call-input"
+          },
+          "publish-dist-tag": {
+            "classification": "included",
+            "source": "workflow-call-input"
+          },
           "setup-node": {
             "classification": "included",
             "source": "workflow-call-input"
           },
+          "target-ref": {
+            "classification": "included",
+            "source": "workflow-call-input"
+          },
           "toolchain-command": {
             "classification": "digest-only",
             "source": "workflow-call-input"
@@ -1910,7 +1930,7 @@
         "missing receipts are non-qualifying and must not be represented as a successful controller run"
       ],
       "breakingDigest": "sha256:3f76502666069c2727d23efcfdb08fb80f89ced1955a69e29f11525ae88aca1d",
-      "auditDigest": "sha256:4756627241ae819e4796b6ddb3b37096223c62652dbc79ac95c2fce8f1bc74a8"
+      "auditDigest": "sha256:f83405748e500d31a237240438f7f410c1bb2b4ef39ab7323131fa54f38c1a59"
     },
     {
       "contractVersion": 1,
@@ -1996,7 +2016,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:0613ea545fe2d630f34e665c8e6fe99df3f5333d75051a7176e9cf991e494f59",
-        "registryDigest": "sha256:f4ea94c3590360ef21ade53056129f0183356de3d1997e43c49a0494d0acd34a",
+        "registryDigest": "sha256:22be9d05109396f2b5c44a74fb0f67e4a554c462662c5a41e44e466c4d90ed04",
         "inputClassifications": {
           "artifact-name": {
             "classification": "included",
@@ -2155,7 +2175,7 @@
         "missing receipts are non-qualifying and must not be represented as a successful controller run"
       ],
       "breakingDigest": "sha256:0eb318df455ef9cb737a7c2515a2411b685d34ed0bde7b5f5b173a7a42513114",
-      "auditDigest": "sha256:4dfb8623c947f6b8ab339a11e31de132401997c6bb5ea0cfe70e45e3b4aa9429"
+      "auditDigest": "sha256:9b810a4120c819dc28021921da243ddcc8d3f832fd610ef9d1be0212d3ba3fa6"
     },
     {
       "contractVersion": 1,
@@ -2203,6 +2223,7 @@
         "BUILDCHAIN_ISSUE_APP_ID",
         "BUILDCHAIN_ISSUE_APP_PRIVATE_KEY",
         "BUILDCHAIN_ISSUE_TOKEN",
+        "BUILDCHAIN_PROMOTION_TOKEN",
         "allow-repository",
         "artifact-name",
         "artifact-patterns",
@@ -2225,6 +2246,7 @@
         "package-manager",
         "publication-admission-json",
         "publication-auto-admission",
+        "publication-auto-no-gate",
         "publication-control-plane-audit-json",
         "publication-expected-json",
         "publication-gate-aggregate-json",
@@ -2264,8 +2286,8 @@
       ],
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
-        "digest": "sha256:380a550c76a7a0c884d0519b5e6e605ad3e04e86f637ba846c20b546faec4a0f",
-        "registryDigest": "sha256:f4ea94c3590360ef21ade53056129f0183356de3d1997e43c49a0494d0acd34a",
+        "digest": "sha256:c5dfeb63bbe3507e3c58f74e2a5792e6558002e3aafab6453cc8b8837db2a729",
+        "registryDigest": "sha256:22be9d05109396f2b5c44a74fb0f67e4a554c462662c5a41e44e466c4d90ed04",
         "inputClassifications": {
           "BUILDCHAIN_ISSUE_APP_ID": {
             "classification": "redacted",
@@ -2279,6 +2301,10 @@
             "classification": "redacted",
             "source": "workflow-call-secret"
           },
+          "BUILDCHAIN_PROMOTION_TOKEN": {
+            "classification": "redacted",
+            "source": "workflow-call-secret"
+          },
           "allow-repository": {
             "classification": "included",
             "source": "workflow-call-input"
@@ -2367,6 +2393,10 @@
             "classification": "included",
             "source": "workflow-call-input"
           },
+          "publication-auto-no-gate": {
+            "classification": "included",
+            "source": "workflow-call-input"
+          },
           "publication-control-plane-audit-json": {
             "classification": "digest-only",
             "source": "workflow-call-input"
@@ -2520,7 +2550,7 @@
         "missing receipts are non-qualifying and must not be represented as a successful controller run"
       ],
       "breakingDigest": "sha256:46238f8fc3c20924decc57ecad142a462fc4739c6bc21409d5cd2457fc1c3cdd",
-      "auditDigest": "sha256:5392d7281cf54d5903d114191a81243cde58a19846e143accf617dcdd57995a2"
+      "auditDigest": "sha256:3de1fbbaad4c5b09cf958bed1aeba4fd9a3e101baa96076088c9c4a91c2d9784"
     },
     {
       "contractVersion": 1,
@@ -2578,7 +2608,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:9b9f9a2320c4349903d72ee46e329211b5538ed5ebebaa93559df4eafb835997",
-        "registryDigest": "sha256:f4ea94c3590360ef21ade53056129f0183356de3d1997e43c49a0494d0acd34a",
+        "registryDigest": "sha256:22be9d05109396f2b5c44a74fb0f67e4a554c462662c5a41e44e466c4d90ed04",
         "inputClassifications": {
           "buildchain-ref": {
             "classification": "included",
@@ -2649,5 +2679,5 @@
     }
   ],
   "compatibilityDigest": "sha256:af162b86ab4506e9b5f1d3c59b41f3fd57fbad79ff4d749a7f12ff16460517f8",
-  "contractDigest": "sha256:7f22a8f5d6dffde608969a9892c1d5658677523f9cb87cd847fb3b369210aa9c"
+  "contractDigest": "sha256:048014d9eac273cb507311984dda5030552741df29ed2177f0b9a347d932a423"
 }