@kungfu-tech/buildchain 2.13.0 → 2.14.0-alpha.1

package/actions/promote-buildchain-ref/README.md

@@ -83,15 +83,15 @@ explicitly, then run the normal channel promotion flow for that line.
 When branch protection requires pull requests, generated version-state commits
 still run through promotion automation first. The action updates
 Buildchain-managed channel protection before generated bookkeeping, adds the
-authenticated promotion token user or app to the bypass allowlist, creates the
-configured required check on the exact generated version-state commit, then
+authenticated promotion token user or app to the bypass allowlist, creates
+every configured required check on the exact generated version-state commit, then
 tries to apply that commit directly. If GitHub still rejects release
 finalization bookkeeping, Buildchain creates or reuses a same-repository
 `buildchain/version-state/*` PR based on the current target channel head and
 returns `finalization-needed=true`; a later idempotent promotion run can resume
 from the durable transaction state. Strict alpha promotion still fails with a
 configuration diagnostic instead of opening a post-publish human PR. Reusable
-wrapper callers should allow `checks: write` so the generated check is owned by
+wrapper callers should allow `checks: write` so the generated checks are owned by
 GitHub Actions and matches the managed branch protection rule.
 
 Stable promotion also protects concurrent development work. The reusable

package/bin/buildchain.mjs

@@ -185,6 +185,10 @@ function usage() {
   buildchain inspect release --passport <file-or-url> [--json]
   buildchain inspect artifact <subject> [--passport <file-or-url>] [--npm-registry <url>] [--json]
   buildchain doctor [--cwd <dir>] [--require-publish-source-lock] [--json]
+  buildchain dev merge-queue --repository <owner/repo> --branch <dev/vN/vN.M>
+                             --workflow <required-workflow.yml>... [--cwd <dir>]
+                             [--check-response-timeout-minutes <n>]
+                             [--max-entries-to-build <n>] [--apply]
   buildchain log <info|warn|error> --event <name> [--phase <phase>]
                  [--component <name>] [--source <name>] [--attribute key=value]...
                  [--path <jsonl>] [--json]
@@ -1385,6 +1389,15 @@ async function main(argv = process.argv.slice(2)) {
     return;
   }
 
+  if (command === "dev") {
+    const [subcommand = "", ...devArgs] = args;
+    if (subcommand !== "merge-queue") {
+      throw new Error("usage: buildchain dev merge-queue --repository <owner/repo> --branch <dev/vN/vN.M> --workflow <path>...");
+    }
+    runScript("dev-merge-queue.mjs", devArgs);
+    return;
+  }
+
   if (command === "log") {
     const [levelOrSubcommand = "info", ...logArgs] = args;
     if (levelOrSubcommand === "summary") {

package/dist/site/buildchain-contract.json

@@ -4,7 +4,7 @@
   "product": {
     "name": "Buildchain",
     "package": "@kungfu-tech/buildchain",
-    "version": "2.13.0",
+    "version": "2.14.0-alpha.1",
     "repository": "https://github.com/kungfu-systems/buildchain"
   },
   "majorLine": "v2",
@@ -203,7 +203,7 @@
         "channel-aware artifact host facts are checked against the deploy plan before adapter side effects"
       ],
       "breakingDigest": "sha256:da569f90374e878948e3d5160ed9929338ce0572473ca8ee54867b0fe1aaeace",
-      "auditDigest": "sha256:06fba8db3e322232bb2576139668026937b781b39c5e35bc16308a6ae3d1cab4"
+      "auditDigest": "sha256:d9aa7c4c2b30e741d0e24274307ecafc840f3db64dc46103bd30c09e54c4c47e"
     },
     {
       "contractVersion": 1,
@@ -269,7 +269,7 @@
         "semver GitHub Releases are created or updated only after transaction completion, with prerelease/latest metadata derived from the public release tag"
       ],
       "breakingDigest": "sha256:a59f0910e6df842e7699139472e5dd69ac2fdd7f7213bf2cb346d1d622556874",
-      "auditDigest": "sha256:d4fd25131a275abafdbb22b91b82fa8e04ff86850fdbb80a619e6615bb4eb716"
+      "auditDigest": "sha256:1dadbe655476a33323749a80a30daa624d8ffa60b7b452d45d920fd94a1a317c"
     },
     {
       "contractVersion": 1,
@@ -437,7 +437,7 @@
         "README badge block checks and writes are generated from machine-readable repository facts"
       ],
       "breakingDigest": "sha256:90a73892b2d6c214048448d5f45df75639bdf7b7e8fefd9c596e04b087407bcc",
-      "auditDigest": "sha256:5bbdc589ebfe1677f0f62de0561d2c3d4cba1e35616f2b952b695f9f0e4756b3"
+      "auditDigest": "sha256:da02a9a5dd23c28317010ac52ad75e1d99262e09beedc58993fb46568ea90f46"
     },
     {
       "contractVersion": 1,
@@ -527,7 +527,7 @@
         "manual entries carry source file digests so downstream sites and agents can detect stale hand-written documentation"
       ],
       "breakingDigest": "sha256:7d0d2819e3a3e72989d9c57b5efe9d0bc0a79bc0f2c82a0c7b9d6c5a211a91f2",
-      "auditDigest": "sha256:e346148685e4bc0f69341177829bca8c02eaebd884982dddd137b873951e2684"
+      "auditDigest": "sha256:32e2353d96a70c0334f6b56508b8689de0e5c5a89eb5789aebcc456e1613ed1e"
     },
     {
       "contractVersion": 1,
@@ -549,7 +549,7 @@
         "agents can discover supported Node APIs without importing internal file paths"
       ],
       "breakingDigest": "sha256:48f925608d3e2131d90936b07dc2a30341204cae3e6e785c0f77d61ad755c945",
-      "auditDigest": "sha256:8a00371d5676377bbcd9281e957b8c7338be6da0da08e892f2d6c2351e732f8a"
+      "auditDigest": "sha256:749a7207d0b71b3d9f5f4a2d4b23c3f92c9ebdb2c3ce41b38869327f9b43fd5b"
     },
     {
       "contractVersion": 1,
@@ -600,7 +600,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:373723a73d188194d389dee04c394d3b79cb0c016a370f2f5d0f60979a02ed48",
-        "registryDigest": "sha256:1a8a2ace3d97dce074ccea44cfbd88d27e466e4bb8f87fb8ce129397256c2b51",
+        "registryDigest": "sha256:266928038838e26ba1350c70d78290723ddb2fd209b66ab1afab776d948a379b",
         "inputClassifications": {
           "buildchain-ref": {
             "classification": "included",
@@ -747,7 +747,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:367be236280f2597ffefc49680feb106b4cf9e8f5fb9420713351f075a168c4a",
-        "registryDigest": "sha256:1a8a2ace3d97dce074ccea44cfbd88d27e466e4bb8f87fb8ce129397256c2b51",
+        "registryDigest": "sha256:266928038838e26ba1350c70d78290723ddb2fd209b66ab1afab776d948a379b",
         "inputClassifications": {
           "BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN": {
             "classification": "redacted",
@@ -1113,7 +1113,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:2e113607af3cb0a17b4da64b8758652a4bee4a162656ce7256a8e06de3d4cf2f",
-        "registryDigest": "sha256:1a8a2ace3d97dce074ccea44cfbd88d27e466e4bb8f87fb8ce129397256c2b51",
+        "registryDigest": "sha256:266928038838e26ba1350c70d78290723ddb2fd209b66ab1afab776d948a379b",
         "inputClassifications": {
           "BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN": {
             "classification": "redacted",
@@ -1443,7 +1443,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:29569f4b754595792a16742d1c4c63838b54601674a2cb6c96261a72c962dece",
-        "registryDigest": "sha256:1a8a2ace3d97dce074ccea44cfbd88d27e466e4bb8f87fb8ce129397256c2b51",
+        "registryDigest": "sha256:266928038838e26ba1350c70d78290723ddb2fd209b66ab1afab776d948a379b",
         "inputClassifications": {
           "artifact-name": {
             "classification": "included",
@@ -1601,6 +1601,7 @@
         "publication-admission-json",
         "publication-control-plane-audit-json",
         "publication-expected-json",
+        "publication-gate-aggregate-json",
         "publication-runner-provenance-json",
         "publication-used-nonces-json",
         "release-feedback-actor-privacy",
@@ -1612,8 +1613,8 @@
       ],
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
-        "digest": "sha256:f08c4970f33c059f8e0b43110f0063172fb1015ac914bdb0c8e9646692fb9f06",
-        "registryDigest": "sha256:1a8a2ace3d97dce074ccea44cfbd88d27e466e4bb8f87fb8ce129397256c2b51",
+        "digest": "sha256:7e6283c8fbeab7a680bae57c9ab9c8eb94aab7400d3ee01c5b9dfdd03f149edb",
+        "registryDigest": "sha256:266928038838e26ba1350c70d78290723ddb2fd209b66ab1afab776d948a379b",
         "inputClassifications": {
           "artifact-path": {
             "classification": "digest-only",
@@ -1739,6 +1740,10 @@
             "classification": "digest-only",
             "source": "workflow-call-input"
           },
+          "publication-gate-aggregate-json": {
+            "classification": "digest-only",
+            "source": "workflow-call-input"
+          },
           "publication-runner-provenance-json": {
             "classification": "digest-only",
             "source": "workflow-call-input"
@@ -1780,7 +1785,7 @@
         "missing receipts are non-qualifying and must not be represented as a successful controller run"
       ],
       "breakingDigest": "sha256:f14825324a16b51c2e9ed708ebe64e1932e05b6d5e0866f83aea8439decb4a27",
-      "auditDigest": "sha256:06fba8db3e322232bb2576139668026937b781b39c5e35bc16308a6ae3d1cab4"
+      "auditDigest": "sha256:d9aa7c4c2b30e741d0e24274307ecafc840f3db64dc46103bd30c09e54c4c47e"
     },
     {
       "contractVersion": 1,
@@ -1845,7 +1850,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:6b132790b9798e8a5dfbe095701d8e024c160a08bc7c4bd477ee79feef7a9cfd",
-        "registryDigest": "sha256:1a8a2ace3d97dce074ccea44cfbd88d27e466e4bb8f87fb8ce129397256c2b51",
+        "registryDigest": "sha256:266928038838e26ba1350c70d78290723ddb2fd209b66ab1afab776d948a379b",
         "inputClassifications": {
           "artifact-name": {
             "classification": "included",
@@ -2026,7 +2031,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:0613ea545fe2d630f34e665c8e6fe99df3f5333d75051a7176e9cf991e494f59",
-        "registryDigest": "sha256:1a8a2ace3d97dce074ccea44cfbd88d27e466e4bb8f87fb8ce129397256c2b51",
+        "registryDigest": "sha256:266928038838e26ba1350c70d78290723ddb2fd209b66ab1afab776d948a379b",
         "inputClassifications": {
           "artifact-name": {
             "classification": "included",
@@ -2300,7 +2305,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:2507d132710f66d3ae6ffdb18f5e66172707b8e0f9ad9e888f7422fdacc99133",
-        "registryDigest": "sha256:1a8a2ace3d97dce074ccea44cfbd88d27e466e4bb8f87fb8ce129397256c2b51",
+        "registryDigest": "sha256:266928038838e26ba1350c70d78290723ddb2fd209b66ab1afab776d948a379b",
         "inputClassifications": {
           "BUILDCHAIN_ISSUE_APP_ID": {
             "classification": "redacted",
@@ -2633,7 +2638,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:9b9f9a2320c4349903d72ee46e329211b5538ed5ebebaa93559df4eafb835997",
-        "registryDigest": "sha256:1a8a2ace3d97dce074ccea44cfbd88d27e466e4bb8f87fb8ce129397256c2b51",
+        "registryDigest": "sha256:266928038838e26ba1350c70d78290723ddb2fd209b66ab1afab776d948a379b",
         "inputClassifications": {
           "buildchain-ref": {
             "classification": "included",
@@ -2700,9 +2705,9 @@
         "missing receipts are non-qualifying and must not be represented as a successful controller run"
       ],
       "breakingDigest": "sha256:d7a1f15990ce8bd13149474888232c7d4451dd2a49bebf4d4ce1336695da430e",
-      "auditDigest": "sha256:d94cab26784b13d57920b7cd6acc1db3b5569d0db0a8771f0932884b9b02493d"
+      "auditDigest": "sha256:2750630ae675352b601dd6cb6a987df14bf11029fcf02aa54638b4fcdcb7590e"
     }
   ],
   "compatibilityDigest": "sha256:af162b86ab4506e9b5f1d3c59b41f3fd57fbad79ff4d749a7f12ff16460517f8",
-  "contractDigest": "sha256:96593e211e995724701c04826ecf885e3a1fa0c49ab38948b5e481d44b3eba6b"
+  "contractDigest": "sha256:e155fe8cce9a0ea11f7f586665243bd07c59fdba7c170665d746d794fdf97fc2"
 }