@kungfu-tech/buildchain 2.14.17 → 2.14.18-alpha.0

package/dist/site/capability-registry.json

@@ -285,11 +285,11 @@
       "maturity": "stable",
       "counts": {
         "manualCount": 1,
-        "pageCount": 6,
+        "pageCount": 7,
         "cliCommandCount": 0,
         "nodeApiCount": 2,
         "workflowCount": 33,
-        "actionCount": 0
+        "actionCount": 1
       },
       "manuals": [
         "docs/cli.md"

package/dist/site/controller-registry.json

@@ -98,6 +98,26 @@
           "classification": "redacted",
           "source": "workflow-call-secret"
         },
+        "BUILDCHAIN_MACOS_CERTIFICATE_P12_BASE64": {
+          "classification": "redacted",
+          "source": "workflow-call-secret"
+        },
+        "BUILDCHAIN_MACOS_CERTIFICATE_PASSWORD": {
+          "classification": "redacted",
+          "source": "workflow-call-secret"
+        },
+        "BUILDCHAIN_MACOS_NOTARY_API_ISSUER": {
+          "classification": "redacted",
+          "source": "workflow-call-secret"
+        },
+        "BUILDCHAIN_MACOS_NOTARY_API_KEY_ID": {
+          "classification": "redacted",
+          "source": "workflow-call-secret"
+        },
+        "BUILDCHAIN_MACOS_NOTARY_API_KEY_P8_BASE64": {
+          "classification": "redacted",
+          "source": "workflow-call-secret"
+        },
         "artifact-name": {
           "classification": "included",
           "source": "workflow-call-input"
@@ -202,10 +222,26 @@
           "classification": "digest-only",
           "source": "workflow-call-input"
         },
+        "credential-island-environment": {
+          "classification": "digest-only",
+          "source": "workflow-call-input"
+        },
+        "credential-island-macos-app-path": {
+          "classification": "digest-only",
+          "source": "workflow-call-input"
+        },
+        "credential-island-macos-platform-id": {
+          "classification": "included",
+          "source": "workflow-call-input"
+        },
         "expected-artifacts-json": {
           "classification": "digest-only",
           "source": "workflow-call-input"
         },
+        "fail-fast": {
+          "classification": "included",
+          "source": "workflow-call-input"
+        },
         "gate-profile-aggregate-json": {
           "classification": "digest-only",
           "source": "workflow-call-input"
@@ -357,6 +393,10 @@
             "id": "build",
             "required": true
           },
+          {
+            "id": "credential-island",
+            "required": false
+          },
           {
             "id": "verify",
             "required": true
@@ -369,6 +409,7 @@
         "capabilities": [
           "source-lock",
           "lifecycle-build",
+          "credential-island",
           "lifecycle-verify",
           "artifact-admission"
         ],
@@ -378,7 +419,7 @@
           "controller-receipt"
         ]
       },
-      "digest": "sha256:b3e101ac0b0f75aebff59b2129e4eff512c38d4d0a34a0a3785e8ea8f998846a"
+      "digest": "sha256:fd1519f97e045331a21454da1132385d3f4e68f21479b311f0f3569618fe62b1"
     },
     {
       "schemaVersion": 1,
@@ -402,6 +443,26 @@
           "classification": "redacted",
           "source": "workflow-call-secret"
         },
+        "BUILDCHAIN_MACOS_CERTIFICATE_P12_BASE64": {
+          "classification": "redacted",
+          "source": "workflow-call-secret"
+        },
+        "BUILDCHAIN_MACOS_CERTIFICATE_PASSWORD": {
+          "classification": "redacted",
+          "source": "workflow-call-secret"
+        },
+        "BUILDCHAIN_MACOS_NOTARY_API_ISSUER": {
+          "classification": "redacted",
+          "source": "workflow-call-secret"
+        },
+        "BUILDCHAIN_MACOS_NOTARY_API_KEY_ID": {
+          "classification": "redacted",
+          "source": "workflow-call-secret"
+        },
+        "BUILDCHAIN_MACOS_NOTARY_API_KEY_P8_BASE64": {
+          "classification": "redacted",
+          "source": "workflow-call-secret"
+        },
         "artifact-name": {
           "classification": "included",
           "source": "workflow-call-input"
@@ -518,10 +579,26 @@
           "classification": "digest-only",
           "source": "workflow-call-input"
         },
+        "credential-island-environment": {
+          "classification": "digest-only",
+          "source": "workflow-call-input"
+        },
+        "credential-island-macos-app-path": {
+          "classification": "digest-only",
+          "source": "workflow-call-input"
+        },
+        "credential-island-macos-platform-id": {
+          "classification": "included",
+          "source": "workflow-call-input"
+        },
         "expected-artifacts-json": {
           "classification": "digest-only",
           "source": "workflow-call-input"
         },
+        "fail-fast": {
+          "classification": "included",
+          "source": "workflow-call-input"
+        },
         "gate-profile-aggregate-json": {
           "classification": "digest-only",
           "source": "workflow-call-input"
@@ -680,7 +757,7 @@
           "controller-receipt"
         ]
       },
-      "digest": "sha256:5ca752570c4180746f09df3fdf5c17e7ce90b04ed06fff362d2a195048024dda"
+      "digest": "sha256:1f6bc118b79876ecab5760356676a3b5076da44f4ba763a6b110f9b1d6fdfb38"
     },
     {
       "schemaVersion": 1,
@@ -1585,6 +1662,10 @@
           "classification": "included",
           "source": "workflow-call-input"
         },
+        "publish-rematerialize-on-resume": {
+          "classification": "included",
+          "source": "workflow-call-input"
+        },
         "publish-required-artifacts-json": {
           "classification": "digest-only",
           "source": "workflow-call-input"
@@ -1723,7 +1804,7 @@
           "controller-receipt"
         ]
       },
-      "digest": "sha256:2bb0137a7dd25706b86beeb212938df2a71c69d2ef6e49391c615e4cb21a19a6"
+      "digest": "sha256:bde6769a31f35ea89e8bdc67a4ca37175f24028b2b3975ff795ba5b2fb95d3a5"
     },
     {
       "schemaVersion": 1,
@@ -1899,5 +1980,5 @@
       "digest": "sha256:b6f53563c0adc859bc586c05fce560a5094d7d9666438d63c5fd3e1fc4774555"
     }
   ],
-  "digest": "sha256:40a7362d72303c106c064126881dae0716ed2d1902a8cac43f409af78bd7cddf"
+  "digest": "sha256:f3c286292ba70b3c9b74eb8ae4052bafb8d5c393ce0037a06b4fc8e675de0f40"
 }

package/dist/site/kfd-claims.json

@@ -14,19 +14,19 @@
   },
   "runtimeContract": {
     "contract": "kungfu-buildchain-runtime-contract-world",
-    "compatibilityDigest": "sha256:cdf588422ec6b460bd6f631400efa6e361a045e052c8967d6c50fadd7aa4dd90",
+    "compatibilityDigest": "sha256:df13c3b8066068925ce847b31002201d533034d10d342542422db3a665c10475",
     "majorLine": "v2"
   },
   "publicSurfaceReverseAudit": {
     "contract": "kungfu-buildchain-public-surface-reverse-audit",
     "path": "dist/site/public-surface-audit.json",
     "status": "passed",
-    "sha256": "847949ab0db4f76342603c628bf668218f9046ad1eceb27c8368e0e539d9bd8f",
+    "sha256": "c473db3464da86da98a089fb487525f80d56da7aad2103e58845cc8d3e0efb0f",
     "summary": {
       "cliCommandCount": 86,
       "workflowCount": 51,
-      "actionCount": 4,
-      "sitePageCount": 52,
+      "actionCount": 5,
+      "sitePageCount": 53,
       "docCommandRefCount": 265,
       "failureCount": 0
     },
@@ -228,12 +228,12 @@
       "contract": "kungfu-buildchain-public-surface-reverse-audit",
       "path": "dist/site/public-surface-audit.json",
       "status": "passed",
-      "sha256": "847949ab0db4f76342603c628bf668218f9046ad1eceb27c8368e0e539d9bd8f",
+      "sha256": "c473db3464da86da98a089fb487525f80d56da7aad2103e58845cc8d3e0efb0f",
       "summary": {
         "cliCommandCount": 86,
         "workflowCount": 51,
-        "actionCount": 4,
-        "sitePageCount": 52,
+        "actionCount": 5,
+        "sitePageCount": 53,
         "docCommandRefCount": 265,
         "failureCount": 0
       },
@@ -260,6 +260,18 @@
           "public": true,
           "plane": "use"
         },
+        {
+          "id": "doc:actions/macos-credential-island/README.md",
+          "name": "actions/macos-credential-island/README.md",
+          "kind": "documentation",
+          "sourcePath": "actions/macos-credential-island/README.md",
+          "evidencePath": "actions/macos-credential-island/README.md",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "plane": "action"
+        },
         {
           "id": "doc:actions/promote-buildchain-ref/README.md",
           "name": "actions/promote-buildchain-ref/README.md",
@@ -2697,7 +2709,7 @@
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 60,
+          "inputCount": 64,
           "inputs": [
             "artifact-name",
             "artifact-name-template",
@@ -2725,7 +2737,11 @@
             "checkout-cache-mode",
             "checkout-cache-reference-repository-template",
             "checkout-cache-timeout-seconds",
+            "credential-island-environment",
+            "credential-island-macos-app-path",
+            "credential-island-macos-platform-id",
             "expected-artifacts-json",
+            "fail-fast",
             "gate-profile-aggregate-json",
             "install-command",
             "kfd-agent-hub",
@@ -2867,7 +2883,7 @@
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 73,
+          "inputCount": 74,
           "inputs": [
             "allow-repository",
             "artifact-name",
@@ -2918,6 +2934,7 @@
             "publish-mode",
             "publish-package-main",
             "publish-package-set-order",
+            "publish-rematerialize-on-resume",
             "publish-required-artifacts-json",
             "publish-target",
             "release-candidate-workflow-file",
@@ -3306,7 +3323,7 @@
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 63,
+          "inputCount": 67,
           "inputs": [
             "artifact-name",
             "artifact-name-template",
@@ -3337,7 +3354,11 @@
             "checkout-cache-mode",
             "checkout-cache-reference-repository-template",
             "checkout-cache-timeout-seconds",
+            "credential-island-environment",
+            "credential-island-macos-app-path",
+            "credential-island-macos-platform-id",
             "expected-artifacts-json",
+            "fail-fast",
             "gate-profile-aggregate-json",
             "install-command",
             "kfd-agent-hub",
@@ -3826,7 +3847,7 @@
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 65,
+          "inputCount": 66,
           "inputs": [
             "allow-repository",
             "artifact-name",
@@ -3869,6 +3890,7 @@
             "publish-mode",
             "publish-package-main",
             "publish-package-set-order",
+            "publish-rematerialize-on-resume",
             "publish-required-artifacts-json",
             "publish-target",
             "release-candidate-workflow-file",
@@ -4060,6 +4082,41 @@
           "inputs": [],
           "reverseAuditSource": ".github/workflows"
         },
+        {
+          "id": "action:macos-credential-island",
+          "name": "action:macos-credential-island",
+          "kind": "action",
+          "sourcePath": "actions/macos-credential-island/action.yml",
+          "evidencePath": "actions/macos-credential-island/action.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 20,
+          "inputs": [
+            "artifact-name",
+            "artifact-relative-output",
+            "artifact-stem",
+            "buildchain-runtime-sha",
+            "certificate-p12-base64",
+            "certificate-password",
+            "certificate-sha1",
+            "entitlements-profile",
+            "expected-bundle-id",
+            "expected-team-id",
+            "input-root",
+            "notary-api-issuer",
+            "notary-api-key-id",
+            "notary-api-key-p8-base64",
+            "output-root",
+            "platform-id",
+            "source-ref",
+            "source-repository",
+            "source-sha",
+            "source-tree-sha"
+          ],
+          "reverseAuditSource": "actions/*/action.yml"
+        },
         {
           "id": "action:promote-buildchain-ref",
           "name": "action:promote-buildchain-ref",
@@ -4070,7 +4127,7 @@
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 62,
+          "inputCount": 63,
           "inputs": [
             "allow-repository",
             "branch-protection-bypass-apps",
@@ -4096,6 +4153,7 @@
             "publish-mode",
             "publish-package-main",
             "publish-package-set-order",
+            "publish-rematerialize-on-resume",
             "publish-required-artifacts-json",
             "publish-source-locked",
             "publish-source-ref",
@@ -4249,6 +4307,18 @@
           ],
           "reverseAuditSource": "actions/*/action.yml"
         },
+        {
+          "id": "site-page:action:macos-credential-island",
+          "name": "site-page:action:macos-credential-island",
+          "kind": "site-page",
+          "sourcePath": "dist/site/page-registry.json",
+          "evidencePath": "dist/site/page-registry.json",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "reverseAuditSource": "dist/site/page-registry.json"
+        },
         {
           "id": "site-page:action:promote-buildchain-ref",
           "name": "site-page:action:promote-buildchain-ref",
@@ -4931,6 +5001,28 @@
         "participantFacing": true,
         "public": true
       },
+      {
+        "id": "control:actions/macos-credential-island/action.yml",
+        "name": "control:actions/macos-credential-island/action.yml",
+        "kind": "action",
+        "sourcePath": "actions/macos-credential-island/action.yml",
+        "evidencePath": "actions/macos-credential-island/action.yml",
+        "availability": "shipped",
+        "visibility": "public",
+        "participantFacing": true,
+        "public": true
+      },
+      {
+        "id": "control:actions/macos-credential-island/index.js",
+        "name": "control:actions/macos-credential-island/index.js",
+        "kind": "action",
+        "sourcePath": "actions/macos-credential-island/index.js",
+        "evidencePath": "actions/macos-credential-island/index.js",
+        "availability": "shipped",
+        "visibility": "public",
+        "participantFacing": true,
+        "public": true
+      },
       {
         "id": "control:actions/promote-buildchain-ref/action.yml",
         "name": "control:actions/promote-buildchain-ref/action.yml",
@@ -4989,6 +5081,6 @@
         }
       }
     ],
-    "publicSurfaceCount": 318
+    "publicSurfaceCount": 323
   }
 }

package/dist/site/kfd-upstream-aggregate.json

@@ -4,7 +4,7 @@
   "product": {
     "id": "kungfu-tech-buildchain",
     "name": "@kungfu-tech/buildchain",
-    "version": "2.14.17",
+    "version": "2.14.18-alpha.0",
     "repository": "https://github.com/kungfu-systems/buildchain"
   },
   "source": {

package/dist/site/manual-registry.json

@@ -274,7 +274,7 @@
       "title": "KFD support and KFD-3 surface registration",
       "path": "docs/kfd-support.md",
       "plane": "verify",
-      "digest": "sha256:ab15de33a1a9e292b6da74c00b8b96b7c46330d0553a454d1de4c24c672fc025",
+      "digest": "sha256:58a60b3e54bc47d4bc9b6e08a432ba4ff75ed2275ef056d04c44cc2bc25046da",
       "capabilityGroup": "kfd-trust",
       "audience": [
         "agent",
@@ -317,7 +317,7 @@
       "title": "Reusable build surface",
       "path": "docs/reusable-build-surface.md",
       "plane": "use",
-      "digest": "sha256:9c125f6d2b519c96718f45da62ac1a891ab618bcb331d3b14c4b88b5158fc4a9",
+      "digest": "sha256:069ba73cf32b9f55a62fd5f4bfaec00608498019b53e8ae1387d7dc9de26bc29",
       "capabilityGroup": "reusable-build",
       "audience": [
         "consumer",
@@ -386,7 +386,7 @@
       "title": "Versioning",
       "path": "docs/versioning.md",
       "plane": "why",
-      "digest": "sha256:10ec868fcb3fd58ae35b54ecd8ccd9a4556516f460c262f0c1ee41c81bdbc264",
+      "digest": "sha256:199ed8e83c988836f757c9a16b58ec441e0bd04a4f3465f21cc73ed7f530e610",
       "capabilityGroup": "governance-versioning",
       "audience": [
         "maintainer"

package/dist/site/node-api-registry.json

@@ -99,7 +99,7 @@
       "specifier": "@kungfu-tech/buildchain/buildchain-contract",
       "export": "./buildchain-contract",
       "target": "./packages/core/buildchain-contract.js",
-      "digest": "sha256:1e5f8a1741a0a98116e754ef0874337db4c1821bb7a153ab398009145509681c",
+      "digest": "sha256:cf08a6c4fd2a56dff45e4a97d1c470ce94e453ab613a304bd86b3fe9d298a153",
       "summary": "Runtime contract world and compatibility digest APIs for floating-ref drift checks.",
       "capabilityGroup": "governance-versioning",
       "audience": [
@@ -125,7 +125,7 @@
       "specifier": "@kungfu-tech/buildchain/controller-evidence",
       "export": "./controller-evidence",
       "target": "./packages/core/controller-evidence.js",
-      "digest": "sha256:c061ed32e02713fd99ffd291ee8ed4a4dba563265ee530deef4b37197cbb65e6",
+      "digest": "sha256:5a4d6d9f2180f60de2eaab5eeb5a0deb79cde688d6047719c3748eaefdd31940",
       "summary": "Project-independent controller descriptors, source/runtime-bound plans, receipts, aggregates, and validation APIs.",
       "capabilityGroup": "reusable-build",
       "audience": [
@@ -437,7 +437,7 @@
       "specifier": "@kungfu-tech/buildchain/buildchain-kfd-claims",
       "export": "./buildchain-kfd-claims",
       "target": "./packages/core/buildchain-kfd-claims.js",
-      "digest": "sha256:a2c297daa22fb8d3bf7e84e2ee22ba269e81c206b2772ac9fd18bf095dcb2b84",
+      "digest": "sha256:c61f4ce244fae5030afc308661f95a87b72dcab00d1edb11c17a8d734d2fb5c6",
       "summary": "Buildchain self KFD claim registry, witnesses, and public claim APIs.",
       "capabilityGroup": "kfd-trust",
       "audience": [
@@ -461,7 +461,7 @@
     {
       "id": "kfd-support",
       "path": "docs/kfd-support.md",
-      "digest": "sha256:ab15de33a1a9e292b6da74c00b8b96b7c46330d0553a454d1de4c24c672fc025"
+      "digest": "sha256:58a60b3e54bc47d4bc9b6e08a432ba4ff75ed2275ef056d04c44cc2bc25046da"
     },
     {
       "id": "readme-badges",