@kungfu-tech/buildchain 2.14.14-alpha.1 → 2.14.14-alpha.2

package/scripts/generate-channel-promotion-workflow.mjs

@@ -204,7 +204,7 @@ ${secrets.trimEnd()}
 ${publicOutputs(outputs)}
 
 permissions:
-  actions: read
+  actions: write
   checks: write
   contents: write
   id-token: write
@@ -404,7 +404,7 @@ jobs:
     if: \${{ needs.resolve-promotion.outputs.channel == 'alpha' }}
     uses: kungfu-systems/buildchain/${alphaRoute.workflowPath}@${alphaRoute.callRef}
     permissions:
-      actions: read
+      actions: write
       checks: write
       contents: write
       id-token: write
@@ -419,7 +419,7 @@ ${alphaForwarded}
     if: \${{ needs.resolve-promotion.outputs.channel == 'stable' }}
     uses: kungfu-systems/buildchain/${stableRoute.workflowPath}@${stableRoute.callRef}
     permissions:
-      actions: read
+      actions: write
       checks: write
       contents: write
       id-token: write

package/scripts/generate-site-bundle.mjs

@@ -28,6 +28,7 @@ import {
   enumerateWorkflowInputs,
 } from "../packages/core/public-surface-audit.js";
 import { createSurfaceTimestampPolicy } from "../packages/core/surface-manifest.js";
+import { projectHomepageIntro } from "./site-bundle-homepage.mjs";
 
 const SITE_BUNDLE_CONTRACT = "kungfu-buildchain-site-bundle";
 const PUBLICATION_RELEASE_REGISTRY_CONTRACT = "kungfu-buildchain-publication-release-registry";
@@ -702,6 +703,7 @@ function buildSiteBundle() {
   const packageJson = readJson("package.json");
   const inventory = readJson("tests/buildchain-inventory.json");
   const readme = parseReadme(readText(README_PATH));
+  const homepageIntro = projectHomepageIntro(readme.intro);
   const docs = BUILDCHAIN_AGENT_MANUALS.map((manual) => docEntry(manual.id, manual.title, manual.path, manual.plane));
   const pages = buildSitePages();
   const preservedTimestampPolicy = readExistingSiteTimestampPolicy(packageJson.version);
@@ -945,8 +947,10 @@ function buildSiteBundle() {
     },
     githubRelease: {
       exactTagRelease: true,
-      prereleaseTags: "semver prerelease tags set prerelease=true and make_latest=false",
-      stableTags: "stable semver tags set make_latest=true",
+      authoritativeIntent: "Buildchain publication channel controls prerelease/latest metadata when available",
+      alphaChannel: "alpha publication sets prerelease=true and make_latest=false",
+      stableChannels: "release, stable, and major publication set prerelease=false and make_latest=true",
+      tagFallback: "ordinary callers without publication intent use semver prerelease syntax",
       evidenceAssets: [
         "publish evidence JSON",
         "buildchain.release.json",
@@ -1218,8 +1222,8 @@ function buildSiteBundle() {
     },
     homepage: {
       title: readme.title,
-      lead: paragraphBlocks(readme.intro)[0] || "",
-      mechanismSummary: paragraphBlocks(readme.intro).slice(1),
+      lead: homepageIntro.lead,
+      mechanismSummary: homepageIntro.mechanismSummary,
       sections: homepageSections,
       displayPlan: {
         firstScreen: {

package/scripts/runtime-ref-core.mjs

@@ -111,6 +111,8 @@ export function validateRuntimeOverrideTrust({
   requestedRef = "",
   eventName = "",
   actorPermission = "",
+  sameRepositoryPullRequest = false,
+  pullRequestHeadSha = "",
 } = {}) {
   if (!String(requestedRef || "").trim()) {
     return { ok: true, decision: "stable-default" };
@@ -118,6 +120,16 @@ export function validateRuntimeOverrideTrust({
   if (isOfficialBuildchainChannelRef(requestedRef)) {
     return { ok: true, decision: "official-channel" };
   }
+  const normalizedRequested = String(requestedRef || "").trim().toLowerCase();
+  const normalizedHeadSha = String(pullRequestHeadSha || "").trim().toLowerCase();
+  if (
+    eventName === "pull_request" &&
+    sameRepositoryPullRequest === true &&
+    EXACT_SHA_RE.test(normalizedRequested) &&
+    normalizedRequested === normalizedHeadSha
+  ) {
+    return { ok: true, decision: "same-repository-pr-head" };
+  }
   if (eventName !== "workflow_dispatch") {
     return {
       ok: false,

package/scripts/site-bundle-homepage.mjs

@@ -0,0 +1,39 @@
+const BADGE_BLOCK_START = "<!-- buildchain:badges:start -->";
+const BADGE_BLOCK_END = "<!-- buildchain:badges:end -->";
+
+function normalizeMarkdown(value) {
+  return String(value || "").replace(/\r\n/g, "\n").trim();
+}
+
+function paragraphBlocks(markdown) {
+  return normalizeMarkdown(markdown)
+    .split(/\n{2,}/)
+    .map((block) => block.replace(/\n/g, " ").trim())
+    .filter(Boolean);
+}
+
+export function projectHomepageIntro(markdown) {
+  const intro = normalizeMarkdown(markdown);
+  const start = intro.indexOf(BADGE_BLOCK_START);
+  const end = intro.indexOf(BADGE_BLOCK_END);
+  if ((start >= 0) !== (end >= 0) || (start >= 0 && end < start)) {
+    throw new Error("README.md managed badge block is incomplete");
+  }
+  if (start >= 0) {
+    const endOffset = end + BADGE_BLOCK_END.length;
+    const lead = intro.slice(start, endOffset).trim();
+    const remaining = [intro.slice(0, start), intro.slice(endOffset)]
+      .map((part) => part.trim())
+      .filter(Boolean)
+      .join("\n\n");
+    return {
+      lead,
+      mechanismSummary: paragraphBlocks(remaining),
+    };
+  }
+  const blocks = paragraphBlocks(intro);
+  return {
+    lead: blocks[0] || "",
+    mechanismSummary: blocks.slice(1),
+  };
+}