@kungfu-tech/buildchain 2.12.7-alpha.20 → 2.12.7-alpha.21

package/dist/site/buildchain-contract.json

@@ -4,7 +4,7 @@
   "product": {
     "name": "Buildchain",
     "package": "@kungfu-tech/buildchain",
-    "version": "2.12.7-alpha.20",
+    "version": "2.12.7-alpha.21",
     "repository": "https://github.com/kungfu-systems/buildchain"
   },
   "majorLine": "v2",
@@ -2679,5 +2679,5 @@
     }
   ],
   "compatibilityDigest": "sha256:af162b86ab4506e9b5f1d3c59b41f3fd57fbad79ff4d749a7f12ff16460517f8",
-  "contractDigest": "sha256:4d9fa59bd60cb59e2b2a0158a603316251320123dec0d840dc2e678ec181b273"
+  "contractDigest": "sha256:048014d9eac273cb507311984dda5030552741df29ed2177f0b9a347d932a423"
 }

package/dist/site/buildchain-site.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-bundle",
-  "generatedAt": "2026-07-15T11:14:41.049Z",
-  "publishedAt": "2026-07-15T11:14:41.049Z",
+  "generatedAt": "2026-07-15T12:26:57.218Z",
+  "publishedAt": "2026-07-15T12:26:57.218Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "ff6924b387efca463b7312eb7198416bfe39654d",
+  "sourceRevision": "97973413b7ba208df42a3ead28d2b80067a3ecc8",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "2.12.7-alpha.20",
+    "version": "2.12.7-alpha.21",
     "versionSource": "package.json#version"
   },
   "source": {

package/dist/site/kfd-upstream-aggregate.json

@@ -4,7 +4,7 @@
   "product": {
     "id": "kungfu-tech-buildchain",
     "name": "@kungfu-tech/buildchain",
-    "version": "2.12.7-alpha.20",
+    "version": "2.12.7-alpha.21",
     "repository": "https://github.com/kungfu-systems/buildchain"
   },
   "source": {

package/dist/site/publication-registry.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-publication-release-registry",
-  "generatedAt": "2026-07-15T11:14:41.049Z",
-  "publishedAt": "2026-07-15T11:14:41.049Z",
+  "generatedAt": "2026-07-15T12:26:57.218Z",
+  "publishedAt": "2026-07-15T12:26:57.218Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "ff6924b387efca463b7312eb7198416bfe39654d",
+  "sourceRevision": "97973413b7ba208df42a3ead28d2b80067a3ecc8",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -32,7 +32,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "2.12.7-alpha.20",
+    "version": "2.12.7-alpha.21",
     "versionSource": "package.json#version"
   },
   "sourceKind": "package-site-bundle",

package/dist/site/site-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-manifest",
-  "generatedAt": "2026-07-15T11:14:41.049Z",
-  "publishedAt": "2026-07-15T11:14:41.049Z",
+  "generatedAt": "2026-07-15T12:26:57.218Z",
+  "publishedAt": "2026-07-15T12:26:57.218Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "ff6924b387efca463b7312eb7198416bfe39654d",
+  "sourceRevision": "97973413b7ba208df42a3ead28d2b80067a3ecc8",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "2.12.7-alpha.20",
+    "version": "2.12.7-alpha.21",
     "versionSource": "package.json#version"
   },
   "entrypoint": "buildchain-site.json",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kungfu-tech/buildchain",
-  "version": "2.12.7-alpha.20",
+  "version": "2.12.7-alpha.21",
   "private": false,
   "description": "Buildchain Release Passport, release governance, CLI toolkit, and site facts.",
   "repository": "https://github.com/kungfu-systems/buildchain",

package/scripts/locked-source-checkout.mjs

@@ -6,6 +6,7 @@ import path from "node:path";
 import { pathToFileURL } from "node:url";
 
 export const LOCKED_SOURCE_CHECKOUT_CONTRACT = "kungfu-buildchain-locked-source-checkout-cache";
+export const ISOLATED_GIT_GLOBAL_CONFIG = process.platform === "win32" ? "NUL" : "/dev/null";
 
 const GIT_SHA_PATTERN = /^[0-9a-f]{40}$/i;
 
@@ -133,6 +134,24 @@ function githubAuthEnv(token = "") {
   };
 }
 
+function isolatedGitFetchEnv(env = {}, targetPath) {
+  const configuredCount = Number.parseInt(env.GIT_CONFIG_COUNT || "0", 10);
+  const safeDirectoryIndex = Number.isInteger(configuredCount) && configuredCount >= 0
+    ? configuredCount
+    : 0;
+  return {
+    ...env,
+    // Runner-global URL rewrites are shared mutable state. A concurrent job
+    // may point the same repository URL at a different single-SHA bundle, so
+    // network fetches must not consult the account-level Git config.
+    GIT_CONFIG_GLOBAL: ISOLATED_GIT_GLOBAL_CONFIG,
+    GIT_CONFIG_NOSYSTEM: "1",
+    GIT_CONFIG_COUNT: String(safeDirectoryIndex + 1),
+    [`GIT_CONFIG_KEY_${safeDirectoryIndex}`]: "safe.directory",
+    [`GIT_CONFIG_VALUE_${safeDirectoryIndex}`]: path.resolve(targetPath),
+  };
+}
+
 function markSafeDirectory(targetPath, timeoutMs) {
   try {
     git(["config", "--global", "--add", "safe.directory", path.resolve(targetPath)], {
@@ -206,6 +225,7 @@ export function fetchSourceCommit({
   runGit = git,
   containsCommit = hasCommit,
 }) {
+  const fetchEnv = isolatedGitFetchEnv(env, targetPath);
   try {
     runGit(["remote", "remove", remoteName], { cwd: targetPath, timeoutMs, stdio: "ignore" });
   } catch {
@@ -222,7 +242,7 @@ export function fetchSourceCommit({
       runGit(["fetch", "--no-tags", "--depth=1", remoteName, `+${fetchRef}:refs/buildchain/source-ref`], {
         cwd: targetPath,
         timeoutMs,
-        env,
+        env: fetchEnv,
       });
       if (containsCommit(targetPath, sha, timeoutMs)) {
         return { selector: "ref", checkoutSha: sha };
@@ -252,7 +272,7 @@ export function fetchSourceCommit({
   runGit(["fetch", "--no-tags", "--depth=1", remoteName, `+${sha}:refs/buildchain/source`], {
     cwd: targetPath,
     timeoutMs,
-    env,
+    env: fetchEnv,
   });
   if (!containsCommit(targetPath, sha, timeoutMs)) {
     throw new Error(`fetched ${fetchRef || sha}, but ${sha} is not available`);