@kungfu-tech/buildchain 2.14.17-alpha.8 → 2.14.17

package/actions/promote-buildchain-ref/README.md

@@ -229,14 +229,6 @@ a machine-managed branch under `buildchain/release-state/<version>`, with
 that durable ref before running publish, so reruns do not depend on a previous
 runner's local `.buildchain` directory.
 
-Consumers whose publish lifecycle only assembles local release assets or
-Passport inputs may set `publish-rematerialize-on-resume: true`. After
-Buildchain restores and validates durable publish evidence, it replays that
-consumer-owned lifecycle with the original transaction environment before
-Passport collection. This is explicit opt-in because registry publication and
-other provider mutations must not be replayed blindly; the option rejects
-`promote-existing-version`.
-
 The action runs `lifecycle.publish` from `buildchain.toml` or the explicit
 `publish-command` input, then validates publish evidence before exact tags and
 floating refs move. If durable state persistence fails, the action fails closed

package/dist/site/buildchain-contract.json

@@ -4,7 +4,7 @@
   "product": {
     "name": "Buildchain",
     "package": "@kungfu-tech/buildchain",
-    "version": "2.14.17-alpha.8",
+    "version": "2.14.17",
     "repository": "https://github.com/kungfu-systems/buildchain"
   },
   "majorLine": "v2",
@@ -50,7 +50,7 @@
         "retryable GitHub fallback fetches use a bounded attempt budget before exact source SHA and tree verification"
       ],
       "breakingDigest": "sha256:a6a35370d6b0d0f46e1b2712dcc01961fe53c2febde95409a27a485c10a36650",
-      "auditDigest": "sha256:ea76a52d7fdac0ed8e30ffbb48b155cc4d16a94d2b49cd05379d3e56661c60d4"
+      "auditDigest": "sha256:d393c10fe8c970730c19495e2e7db7dfd802ebb628f1a2de835aa918a990e2cc"
     },
     {
       "contractVersion": 1,
@@ -89,7 +89,7 @@
         "alpha and stable channel selections use separate consumer contract locks by default"
       ],
       "breakingDigest": "sha256:c4597dfa89e1a58f1023905092b849644f5c080abf150aeba9c7e1cd5ed43962",
-      "auditDigest": "sha256:50baf9fb6743b74d4c2489941dbc1e2e917a6df8e053258a4a4414e4868ec0cc"
+      "auditDigest": "sha256:7804f03ac13edf2ffda40774c17d95e24416a97ee4b9091fc28b6cc32daea46e"
     },
     {
       "contractVersion": 1,
@@ -170,7 +170,7 @@
         "GitHub Release passport and evidence publication is delegated to promote-buildchain-ref after the semver release transaction completes"
       ],
       "breakingDigest": "sha256:1f476fb9a4854b362c4b24cef89a3c7675d7d63baf3bc828d7b8ae7d2787cead",
-      "auditDigest": "sha256:069b7e2f83dea972b139ccee42876b4cb4644fcff2e7931696b9d0c9e8d98f09"
+      "auditDigest": "sha256:0fbb4713eead1951f01ec1cf7896cac9ab25cd73986573b3c3227ad133550f69"
     },
     {
       "contractVersion": 1,
@@ -212,7 +212,7 @@
         "promotion reuses PR-stage release-candidate artifacts and does not run the heavy native build matrix"
       ],
       "breakingDigest": "sha256:aa30f22e3af0a89841310bdbdc900844dd95a66974db173fa140a71bbd7e82c0",
-      "auditDigest": "sha256:ce4cdad0b0165349fe2fa1377f10a7625faa90fa2fb858d7603640b19de0de06"
+      "auditDigest": "sha256:a68b535582028c1dd708e447a43f5083106074df092b74528dfa16db4a4f4153"
     },
     {
       "contractVersion": 1,
@@ -327,63 +327,7 @@
         "sha256:a59f0910e6df842e7699139472e5dd69ac2fdd7f7213bf2cb346d1d622556874"
       ],
       "breakingDigest": "sha256:6147c0a8d5c36bfaa6021871574e1fc28192a3f1b8cfdae4d24ef3059ac1ebda",
-      "auditDigest": "sha256:cfb90e83dd459200534dbabeabce0effbc143e1e2578313c849743d009864d86"
-    },
-    {
-      "contractVersion": 1,
-      "stability": "stable",
-      "additiveChanges": "optional inputs, optional outputs, diagnostics, and documentation may be added within the same major line",
-      "id": "macos-credential-island-action",
-      "kind": "action",
-      "path": "actions/macos-credential-island/action.yml",
-      "publicRef": "kungfu-systems/buildchain/actions/macos-credential-island@v2",
-      "requiredInputs": [
-        "input-root",
-        "output-root",
-        "source-repository",
-        "source-sha",
-        "source-tree-sha",
-        "buildchain-runtime-sha",
-        "artifact-name",
-        "expected-bundle-id",
-        "expected-team-id",
-        "certificate-sha1",
-        "certificate-p12-base64",
-        "certificate-password",
-        "notary-api-key-p8-base64",
-        "notary-api-key-id",
-        "notary-api-issuer"
-      ],
-      "requiredOutputs": [
-        "evidence-path",
-        "manifest-path",
-        "artifact-root",
-        "dmg-path",
-        "zip-path",
-        "dmg-sha256",
-        "zip-sha256"
-      ],
-      "breakingDefaults": {
-        "entitlementsProfile": "electron-desktop-v1",
-        "credentialBoundary": "protected-caller-job",
-        "consumerCodeExecution": "forbidden"
-      },
-      "optionalInputs": [
-        "source-ref",
-        "platform-id",
-        "entitlements-profile",
-        "artifact-stem",
-        "artifact-relative-output"
-      ],
-      "guarantees": [
-        "the action validates a source-bound sealed app before credentials are imported",
-        "the action accepts one exact Developer ID Application fingerprint and a Buildchain-owned entitlements profile",
-        "consumer source and artifact-contained executables are never invoked",
-        "the app and DMG are notarized, stapled, Gatekeeper assessed, and bound to retained evidence",
-        "temporary keychain and API key material are cleaned in both main and post phases"
-      ],
-      "breakingDigest": "sha256:61866985864205770c70cbe14c3c60f479512a32c0b007b5fd6d8d65132ff8be",
-      "auditDigest": "sha256:efbc4a3641ab7e7137da5a197f5a9414c40a070bf75c6bf9fcb98ddcbf621e73"
+      "auditDigest": "sha256:ff220542fd1cb21fc4780d0bb31eb9f78d44d70746b6c4364483e104b48ae083"
     },
     {
       "contractVersion": 1,
@@ -641,7 +585,7 @@
         "manual entries carry source file digests so downstream sites and agents can detect stale hand-written documentation"
       ],
       "breakingDigest": "sha256:7d0d2819e3a3e72989d9c57b5efe9d0bc0a79bc0f2c82a0c7b9d6c5a211a91f2",
-      "auditDigest": "sha256:eba91f08a1327fc7465029e7788d8da9b909531581ddb2bc402a46452f54e17e"
+      "auditDigest": "sha256:0fb186b28d135cf5a22bfdcadee21ac37b8eee72899e53e44a3ca17b999b0568"
     },
     {
       "contractVersion": 1,
@@ -663,7 +607,7 @@
         "agents can discover supported Node APIs without importing internal file paths"
       ],
       "breakingDigest": "sha256:48f925608d3e2131d90936b07dc2a30341204cae3e6e785c0f77d61ad755c945",
-      "auditDigest": "sha256:0e17c4d3fd07e8c4b4db81efa6757cf7554449139dfe9657aeaaf81dc79f8c0d"
+      "auditDigest": "sha256:9b3996940294ff7e8d2f6eb9a6f63451fb5bad2a9668a1e8c953199360b5c1b4"
     },
     {
       "contractVersion": 1,
@@ -714,7 +658,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:373723a73d188194d389dee04c394d3b79cb0c016a370f2f5d0f60979a02ed48",
-        "registryDigest": "sha256:f3c286292ba70b3c9b74eb8ae4052bafb8d5c393ce0037a06b4fc8e675de0f40",
+        "registryDigest": "sha256:40a7362d72303c106c064126881dae0716ed2d1902a8cac43f409af78bd7cddf",
         "inputClassifications": {
           "buildchain-ref": {
             "classification": "included",
@@ -784,7 +728,6 @@
         "capabilities": [
           "source-lock",
           "lifecycle-build",
-          "credential-island",
           "lifecycle-verify",
           "artifact-admission"
         ],
@@ -799,11 +742,6 @@
         "BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN",
         "BUILDCHAIN_ARTIFACT_RELAY_S3_ROLE_ARN",
         "BUILDCHAIN_ARTIFACT_RELAY_S3_UPLOAD_ROLE_ARN",
-        "BUILDCHAIN_MACOS_CERTIFICATE_P12_BASE64",
-        "BUILDCHAIN_MACOS_CERTIFICATE_PASSWORD",
-        "BUILDCHAIN_MACOS_NOTARY_API_ISSUER",
-        "BUILDCHAIN_MACOS_NOTARY_API_KEY_ID",
-        "BUILDCHAIN_MACOS_NOTARY_API_KEY_P8_BASE64",
         "artifact-name",
         "artifact-name-template",
         "artifact-paths",
@@ -830,11 +768,7 @@
         "checkout-cache-mode",
         "checkout-cache-reference-repository-template",
         "checkout-cache-timeout-seconds",
-        "credential-island-environment",
-        "credential-island-macos-app-path",
-        "credential-island-macos-platform-id",
         "expected-artifacts-json",
-        "fail-fast",
         "gate-profile-aggregate-json",
         "install-command",
         "kfd-agent-hub",
@@ -871,8 +805,8 @@
       ],
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
-        "digest": "sha256:fd1519f97e045331a21454da1132385d3f4e68f21479b311f0f3569618fe62b1",
-        "registryDigest": "sha256:f3c286292ba70b3c9b74eb8ae4052bafb8d5c393ce0037a06b4fc8e675de0f40",
+        "digest": "sha256:b3e101ac0b0f75aebff59b2129e4eff512c38d4d0a34a0a3785e8ea8f998846a",
+        "registryDigest": "sha256:40a7362d72303c106c064126881dae0716ed2d1902a8cac43f409af78bd7cddf",
         "inputClassifications": {
           "BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN": {
             "classification": "redacted",
@@ -886,26 +820,6 @@
             "classification": "redacted",
             "source": "workflow-call-secret"
           },
-          "BUILDCHAIN_MACOS_CERTIFICATE_P12_BASE64": {
-            "classification": "redacted",
-            "source": "workflow-call-secret"
-          },
-          "BUILDCHAIN_MACOS_CERTIFICATE_PASSWORD": {
-            "classification": "redacted",
-            "source": "workflow-call-secret"
-          },
-          "BUILDCHAIN_MACOS_NOTARY_API_ISSUER": {
-            "classification": "redacted",
-            "source": "workflow-call-secret"
-          },
-          "BUILDCHAIN_MACOS_NOTARY_API_KEY_ID": {
-            "classification": "redacted",
-            "source": "workflow-call-secret"
-          },
-          "BUILDCHAIN_MACOS_NOTARY_API_KEY_P8_BASE64": {
-            "classification": "redacted",
-            "source": "workflow-call-secret"
-          },
           "artifact-name": {
             "classification": "included",
             "source": "workflow-call-input"
@@ -1010,26 +924,10 @@
             "classification": "digest-only",
             "source": "workflow-call-input"
           },
-          "credential-island-environment": {
-            "classification": "digest-only",
-            "source": "workflow-call-input"
-          },
-          "credential-island-macos-app-path": {
-            "classification": "digest-only",
-            "source": "workflow-call-input"
-          },
-          "credential-island-macos-platform-id": {
-            "classification": "included",
-            "source": "workflow-call-input"
-          },
           "expected-artifacts-json": {
             "classification": "digest-only",
             "source": "workflow-call-input"
           },
-          "fail-fast": {
-            "classification": "included",
-            "source": "workflow-call-input"
-          },
           "gate-profile-aggregate-json": {
             "classification": "digest-only",
             "source": "workflow-call-input"
@@ -1164,17 +1062,14 @@
           }
         }
       },
-      "compatibleBreakingDigests": [
-        "sha256:e264a79f9f399038c2fcfd21e4168c68c2e1485ee5c651c02242a02b622ac2be"
-      ],
       "guarantees": [
         "plans bind exact consumer source SHA, exact Buildchain runtime SHA, and the runtime contract digest",
         "receipts bind the plan digest and preserve pass, fail, skip, and partial stage outcomes",
         "redacted input values are never serialized and digest-only input values are never emitted in plaintext",
         "missing receipts are non-qualifying and must not be represented as a successful controller run"
       ],
-      "breakingDigest": "sha256:30745921541e9b0f70475bb2178c2559f6aef248f6680670ccd44d8c5a69a6b1",
-      "auditDigest": "sha256:ea76a52d7fdac0ed8e30ffbb48b155cc4d16a94d2b49cd05379d3e56661c60d4"
+      "breakingDigest": "sha256:e264a79f9f399038c2fcfd21e4168c68c2e1485ee5c651c02242a02b622ac2be",
+      "auditDigest": "sha256:d393c10fe8c970730c19495e2e7db7dfd802ebb628f1a2de835aa918a990e2cc"
     },
     {
       "contractVersion": 1,
@@ -1215,11 +1110,6 @@
         "BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN",
         "BUILDCHAIN_ARTIFACT_RELAY_S3_ROLE_ARN",
         "BUILDCHAIN_ARTIFACT_RELAY_S3_UPLOAD_ROLE_ARN",
-        "BUILDCHAIN_MACOS_CERTIFICATE_P12_BASE64",
-        "BUILDCHAIN_MACOS_CERTIFICATE_PASSWORD",
-        "BUILDCHAIN_MACOS_NOTARY_API_ISSUER",
-        "BUILDCHAIN_MACOS_NOTARY_API_KEY_ID",
-        "BUILDCHAIN_MACOS_NOTARY_API_KEY_P8_BASE64",
         "artifact-name",
         "artifact-name-template",
         "artifact-paths",
@@ -1249,11 +1139,7 @@
         "checkout-cache-mode",
         "checkout-cache-reference-repository-template",
         "checkout-cache-timeout-seconds",
-        "credential-island-environment",
-        "credential-island-macos-app-path",
-        "credential-island-macos-platform-id",
         "expected-artifacts-json",
-        "fail-fast",
         "gate-profile-aggregate-json",
         "install-command",
         "kfd-agent-hub",
@@ -1290,8 +1176,8 @@
       ],
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
-        "digest": "sha256:1f6bc118b79876ecab5760356676a3b5076da44f4ba763a6b110f9b1d6fdfb38",
-        "registryDigest": "sha256:f3c286292ba70b3c9b74eb8ae4052bafb8d5c393ce0037a06b4fc8e675de0f40",
+        "digest": "sha256:5ca752570c4180746f09df3fdf5c17e7ce90b04ed06fff362d2a195048024dda",
+        "registryDigest": "sha256:40a7362d72303c106c064126881dae0716ed2d1902a8cac43f409af78bd7cddf",
         "inputClassifications": {
           "BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN": {
             "classification": "redacted",
@@ -1305,26 +1191,6 @@
             "classification": "redacted",
             "source": "workflow-call-secret"
           },
-          "BUILDCHAIN_MACOS_CERTIFICATE_P12_BASE64": {
-            "classification": "redacted",
-            "source": "workflow-call-secret"
-          },
-          "BUILDCHAIN_MACOS_CERTIFICATE_PASSWORD": {
-            "classification": "redacted",
-            "source": "workflow-call-secret"
-          },
-          "BUILDCHAIN_MACOS_NOTARY_API_ISSUER": {
-            "classification": "redacted",
-            "source": "workflow-call-secret"
-          },
-          "BUILDCHAIN_MACOS_NOTARY_API_KEY_ID": {
-            "classification": "redacted",
-            "source": "workflow-call-secret"
-          },
-          "BUILDCHAIN_MACOS_NOTARY_API_KEY_P8_BASE64": {
-            "classification": "redacted",
-            "source": "workflow-call-secret"
-          },
           "artifact-name": {
             "classification": "included",
             "source": "workflow-call-input"
@@ -1441,26 +1307,10 @@
             "classification": "digest-only",
             "source": "workflow-call-input"
           },
-          "credential-island-environment": {
-            "classification": "digest-only",
-            "source": "workflow-call-input"
-          },
-          "credential-island-macos-app-path": {
-            "classification": "digest-only",
-            "source": "workflow-call-input"
-          },
-          "credential-island-macos-platform-id": {
-            "classification": "included",
-            "source": "workflow-call-input"
-          },
           "expected-artifacts-json": {
             "classification": "digest-only",
             "source": "workflow-call-input"
           },
-          "fail-fast": {
-            "classification": "included",
-            "source": "workflow-call-input"
-          },
           "gate-profile-aggregate-json": {
             "classification": "digest-only",
             "source": "workflow-call-input"
@@ -1602,7 +1452,7 @@
         "missing receipts are non-qualifying and must not be represented as a successful controller run"
       ],
       "breakingDigest": "sha256:d40dd05d7e07473d4b2dc1b62fbb0ed6f06449b4d3a7c44a2e8014313e3c0273",
-      "auditDigest": "sha256:50baf9fb6743b74d4c2489941dbc1e2e917a6df8e053258a4a4414e4868ec0cc"
+      "auditDigest": "sha256:7804f03ac13edf2ffda40774c17d95e24416a97ee4b9091fc28b6cc32daea46e"
     },
     {
       "contractVersion": 1,
@@ -1661,7 +1511,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:29569f4b754595792a16742d1c4c63838b54601674a2cb6c96261a72c962dece",
-        "registryDigest": "sha256:f3c286292ba70b3c9b74eb8ae4052bafb8d5c393ce0037a06b4fc8e675de0f40",
+        "registryDigest": "sha256:40a7362d72303c106c064126881dae0716ed2d1902a8cac43f409af78bd7cddf",
         "inputClassifications": {
           "artifact-name": {
             "classification": "included",
@@ -1832,7 +1682,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:7e6283c8fbeab7a680bae57c9ab9c8eb94aab7400d3ee01c5b9dfdd03f149edb",
-        "registryDigest": "sha256:f3c286292ba70b3c9b74eb8ae4052bafb8d5c393ce0037a06b4fc8e675de0f40",
+        "registryDigest": "sha256:40a7362d72303c106c064126881dae0716ed2d1902a8cac43f409af78bd7cddf",
         "inputClassifications": {
           "artifact-path": {
             "classification": "digest-only",
@@ -2068,7 +1918,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:6b132790b9798e8a5dfbe095701d8e024c160a08bc7c4bd477ee79feef7a9cfd",
-        "registryDigest": "sha256:f3c286292ba70b3c9b74eb8ae4052bafb8d5c393ce0037a06b4fc8e675de0f40",
+        "registryDigest": "sha256:40a7362d72303c106c064126881dae0716ed2d1902a8cac43f409af78bd7cddf",
         "inputClassifications": {
           "artifact-name": {
             "classification": "included",
@@ -2249,7 +2099,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:0613ea545fe2d630f34e665c8e6fe99df3f5333d75051a7176e9cf991e494f59",
-        "registryDigest": "sha256:f3c286292ba70b3c9b74eb8ae4052bafb8d5c393ce0037a06b4fc8e675de0f40",
+        "registryDigest": "sha256:40a7362d72303c106c064126881dae0716ed2d1902a8cac43f409af78bd7cddf",
         "inputClassifications": {
           "artifact-name": {
             "classification": "included",
@@ -2509,7 +2359,6 @@
         "publish-mode",
         "publish-package-main",
         "publish-package-set-order",
-        "publish-rematerialize-on-resume",
         "publish-required-artifacts-json",
         "publish-target",
         "release-candidate-workflow-file",
@@ -2537,8 +2386,8 @@
       ],
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
-        "digest": "sha256:bde6769a31f35ea89e8bdc67a4ca37175f24028b2b3975ff795ba5b2fb95d3a5",
-        "registryDigest": "sha256:f3c286292ba70b3c9b74eb8ae4052bafb8d5c393ce0037a06b4fc8e675de0f40",
+        "digest": "sha256:2bb0137a7dd25706b86beeb212938df2a71c69d2ef6e49391c615e4cb21a19a6",
+        "registryDigest": "sha256:40a7362d72303c106c064126881dae0716ed2d1902a8cac43f409af78bd7cddf",
         "inputClassifications": {
           "BUILDCHAIN_ISSUE_APP_ID": {
             "classification": "redacted",
@@ -2764,10 +2613,6 @@
             "classification": "included",
             "source": "workflow-call-input"
           },
-          "publish-rematerialize-on-resume": {
-            "classification": "included",
-            "source": "workflow-call-input"
-          },
           "publish-required-artifacts-json": {
             "classification": "digest-only",
             "source": "workflow-call-input"
@@ -2873,7 +2718,7 @@
         "missing receipts are non-qualifying and must not be represented as a successful controller run"
       ],
       "breakingDigest": "sha256:015d8de793adbd4c539416be7d7512e18cc92097e629b0203fa06d2c183e98bd",
-      "auditDigest": "sha256:ce4cdad0b0165349fe2fa1377f10a7625faa90fa2fb858d7603640b19de0de06"
+      "auditDigest": "sha256:a68b535582028c1dd708e447a43f5083106074df092b74528dfa16db4a4f4153"
     },
     {
       "contractVersion": 1,
@@ -2934,7 +2779,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:f97656a8df0758c8e404d5b7c387529256a1ec45d1748f8efb6847a3256b1216",
-        "registryDigest": "sha256:f3c286292ba70b3c9b74eb8ae4052bafb8d5c393ce0037a06b4fc8e675de0f40",
+        "registryDigest": "sha256:40a7362d72303c106c064126881dae0716ed2d1902a8cac43f409af78bd7cddf",
         "inputClassifications": {
           "buildchain-ref": {
             "classification": "included",
@@ -3057,7 +2902,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:b6f53563c0adc859bc586c05fce560a5094d7d9666438d63c5fd3e1fc4774555",
-        "registryDigest": "sha256:f3c286292ba70b3c9b74eb8ae4052bafb8d5c393ce0037a06b4fc8e675de0f40",
+        "registryDigest": "sha256:40a7362d72303c106c064126881dae0716ed2d1902a8cac43f409af78bd7cddf",
         "inputClassifications": {}
       },
       "guarantees": [
@@ -3070,6 +2915,6 @@
       "auditDigest": "sha256:e07a5db56a71bd0ac79c81f12619938055361bf0a0ed8e5891f88ca1c51f1c93"
     }
   ],
-  "compatibilityDigest": "sha256:df13c3b8066068925ce847b31002201d533034d10d342542422db3a665c10475",
-  "contractDigest": "sha256:6395cd78437750f40b06238cccc5dbe30495d78e820ca52f7d8b0c9ddf43d082"
+  "compatibilityDigest": "sha256:cdf588422ec6b460bd6f631400efa6e361a045e052c8967d6c50fadd7aa4dd90",
+  "contractDigest": "sha256:b0e34eb1c596aebf2e32c195a0fbf05534ed6ca5624b26059d3d9e753aeb3053"
 }