@kungfu-tech/buildchain 2.13.0 → 2.14.0-alpha.0

package/scripts/verify-web-surface-publication-capability.mjs

@@ -0,0 +1,78 @@
+#!/usr/bin/env node
+import crypto from "node:crypto";
+import fs from "node:fs";
+
+import { publicationAuthorityDigest } from "../packages/core/publication-authority.js";
+import { webSurfacePublicationDigest } from "../packages/core/web-surface-publication-candidate.js";
+
+function required(name) {
+  const value = String(process.env[name] || "").trim();
+  if (!value) throw new Error(`${name} is required`);
+  return value;
+}
+
+function main() {
+  const capability = JSON.parse(required("BUILDCHAIN_PUBLICATION_CAPABILITY_JSON"));
+  const { capabilityDigest, ...payload } = capability;
+  if (publicationAuthorityDigest(payload) !== capabilityDigest) {
+    throw new Error("web-surface publication capability digest mismatch");
+  }
+  if (capability.decision !== "allow" || Date.parse(capability.expiresAt) <= Date.now()) {
+    throw new Error("web-surface publication capability is not live and authorizing");
+  }
+  const candidate = JSON.parse(required("BUILDCHAIN_WEB_SURFACE_CANDIDATE_JSON"));
+  const { candidateDigest, ...candidatePayload } = candidate;
+  if (
+    webSurfacePublicationDigest(candidatePayload) !== candidateDigest ||
+    candidateDigest !== capability.artifactDigest
+  ) {
+    throw new Error("web-surface publication candidate capability binding mismatch");
+  }
+  const plan = JSON.parse(fs.readFileSync(required("BUILDCHAIN_WEB_SURFACE_PLAN_PATH"), "utf8"));
+  const planDigest = crypto
+    .createHash("sha256")
+    .update(`${JSON.stringify(plan, null, 2)}\n`)
+    .digest("hex");
+  if (
+    candidate.planDigest !== planDigest ||
+    candidate.artifactHash !== plan.artifact?.hash ||
+    candidate.deployTarget !== plan.manifest?.deployTarget
+  ) {
+    throw new Error("web-surface publication candidate plan binding mismatch");
+  }
+  const roleArn = required("BUILDCHAIN_PRODUCTION_ROLE_ARN");
+  const exact = {
+    workflowPath: ".github/workflows/.web-surface.yml",
+    repository: required("BUILDCHAIN_REPOSITORY"),
+    sourceSha: required("BUILDCHAIN_SOURCE_SHA").toLowerCase(),
+    runtimeSha: required("BUILDCHAIN_RUNTIME_SHA").toLowerCase(),
+    environment: required("BUILDCHAIN_PUBLICATION_ENVIRONMENT"),
+    product: String(plan.manifest?.site || ""),
+    target: `aws-role:${roleArn}#deploy:${String(plan.manifest?.deployTarget || "")}`,
+    version: required("BUILDCHAIN_SOURCE_SHA").toLowerCase(),
+    channel: "production",
+  };
+  for (const [name, value] of Object.entries(exact)) {
+    if (capability[name] !== value) throw new Error(`web-surface publication capability ${name} binding mismatch`);
+  }
+  for (const [name, value] of Object.entries({
+    repository: exact.repository,
+    sourceSha: exact.sourceSha,
+    runtimeSha: exact.runtimeSha,
+    site: exact.product,
+    environment: exact.environment,
+  })) {
+    if (candidate[name] !== value) throw new Error(`web-surface publication candidate ${name} binding mismatch`);
+  }
+  if (capability.capabilityIds?.includes("web-production") !== true) {
+    throw new Error("web-surface publication capability lacks web-production authority");
+  }
+  process.stdout.write(`${JSON.stringify({ ok: true, capabilityDigest })}\n`);
+}
+
+try {
+  main();
+} catch (error) {
+  console.error(`verify web-surface publication capability: ${error.message}`);
+  process.exitCode = 1;
+}

package/scripts/web-surface-production-decision.mjs

@@ -0,0 +1,138 @@
+#!/usr/bin/env node
+import fs from "node:fs";
+import { pathToFileURL } from "node:url";
+
+import { createWebSurfaceProductionDecision } from "../packages/core/web-surface-publication-candidate.js";
+
+const TRUSTED_PERMISSIONS = new Set(["write", "maintain", "admin"]);
+
+export function resolveWebSurfaceProductionDecision({
+  eventName,
+  refName,
+  repository,
+  sourceSha,
+  actor,
+  productionApply,
+  productionApproved,
+  productionReleaseOnMain,
+  actorPermission = "",
+  releaseApproved = false,
+  releasePr = 0,
+  releaseSource = "",
+} = {}) {
+  if (
+    eventName === "workflow_dispatch" &&
+    productionApply === true &&
+    productionApproved === true
+  ) {
+    const trusted = TRUSTED_PERMISSIONS.has(String(actorPermission));
+    return createWebSurfaceProductionDecision({
+      approved: trusted,
+      kind: trusted ? "manual-dispatch" : "none",
+      repository,
+      sourceSha,
+      actor,
+      actorPermission,
+      reason: trusted ? "trusted-manual-dispatch" : "manual-actor-permission-insufficient",
+    });
+  }
+  if (
+    eventName === "push" &&
+    refName === "main" &&
+    productionApply === true &&
+    productionReleaseOnMain === true &&
+    releaseApproved === true
+  ) {
+    return createWebSurfaceProductionDecision({
+      approved: true,
+      kind: "release-pr",
+      repository,
+      sourceSha,
+      actor,
+      releasePr,
+      releaseSource,
+      reason: "reviewed-release-pr-merged",
+    });
+  }
+  return createWebSurfaceProductionDecision({
+    approved: false,
+    kind: "none",
+    repository,
+    sourceSha,
+    actor,
+    actorPermission,
+    releasePr,
+    releaseSource,
+    reason: "no-authorizing-production-event",
+  });
+}
+
+async function actorPermission(repository, actor, token, apiUrl) {
+  const response = await fetch(
+    `${apiUrl}/repos/${repository}/collaborators/${encodeURIComponent(actor)}/permission`,
+    {
+      headers: {
+        accept: "application/vnd.github+json",
+        authorization: `Bearer ${token}`,
+        "x-github-api-version": "2022-11-28",
+      },
+    },
+  );
+  if (!response.ok) {
+    throw new Error(`could not resolve production actor permission: GitHub API ${response.status}`);
+  }
+  return String((await response.json()).permission || "");
+}
+
+function bool(name) {
+  return String(process.env[name] || "") === "true";
+}
+
+async function main() {
+  const eventName = String(process.env.GITHUB_EVENT_NAME || "");
+  const repository = String(process.env.GITHUB_REPOSITORY || "");
+  const actor = String(process.env.GITHUB_ACTOR || "");
+  let permission = "";
+  if (eventName === "workflow_dispatch" && bool("BUILDCHAIN_PRODUCTION_APPLY")) {
+    permission = await actorPermission(
+      repository,
+      actor,
+      String(process.env.GITHUB_TOKEN || ""),
+      String(process.env.GITHUB_API_URL || "https://api.github.com"),
+    );
+  }
+  const decision = resolveWebSurfaceProductionDecision({
+    eventName,
+    refName: process.env.GITHUB_REF_NAME,
+    repository,
+    sourceSha: process.env.GITHUB_SHA,
+    actor,
+    productionApply: bool("BUILDCHAIN_PRODUCTION_APPLY"),
+    productionApproved: bool("BUILDCHAIN_PRODUCTION_APPROVED"),
+    productionReleaseOnMain: bool("BUILDCHAIN_PRODUCTION_RELEASE_ON_MAIN"),
+    actorPermission: permission,
+    releaseApproved: bool("BUILDCHAIN_PRODUCTION_RELEASE_APPROVED"),
+    releasePr: Number(process.env.BUILDCHAIN_PRODUCTION_RELEASE_PR || 0),
+    releaseSource: process.env.BUILDCHAIN_PRODUCTION_RELEASE_SOURCE,
+  });
+  if (process.env.GITHUB_OUTPUT) {
+    fs.appendFileSync(
+      process.env.GITHUB_OUTPUT,
+      `approved=${decision.approved}\ndecision-json=${JSON.stringify(decision)}\n`,
+    );
+  }
+  if (process.env.GITHUB_STEP_SUMMARY) {
+    fs.appendFileSync(
+      process.env.GITHUB_STEP_SUMMARY,
+      `## Web production decision\n\n- approved: \`${decision.approved}\`\n- kind: \`${decision.kind}\`\n- reason: \`${decision.reason}\`\n`,
+    );
+  }
+  process.stdout.write(`${JSON.stringify(decision)}\n`);
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  main().catch((error) => {
+    console.error(`web-surface production decision: ${error.message}`);
+    process.exitCode = 1;
+  });
+}