@kungfu-tech/buildchain 2.14.18-alpha.1 → 2.14.18-alpha.11

package/dist/site/capability-registry.json

@@ -247,14 +247,15 @@
       ],
       "maturity": "stable",
       "counts": {
-        "manualCount": 7,
-        "pageCount": 7,
-        "cliCommandCount": 7,
-        "nodeApiCount": 3,
+        "manualCount": 8,
+        "pageCount": 8,
+        "cliCommandCount": 8,
+        "nodeApiCount": 4,
         "workflowCount": 11,
         "actionCount": 0
       },
       "manuals": [
+        "docs/github-governance-authority.md",
         "docs/infra-contract.md",
         "docs/migration-inventory.md",
         "docs/ownership.md",
@@ -288,7 +289,7 @@
         "pageCount": 7,
         "cliCommandCount": 0,
         "nodeApiCount": 2,
-        "workflowCount": 33,
+        "workflowCount": 34,
         "actionCount": 1
       },
       "manuals": [

package/dist/site/cli-registry.json

@@ -221,6 +221,18 @@
       ],
       "maturity": "stable"
     },
+    {
+      "id": "github-governance",
+      "source": "bin/buildchain.mjs",
+      "usage": "buildchain github-governance <plan|apply|rollback|protection-policy-plan|ruleset-policy-plan> ...",
+      "purpose": "Plan, apply, or roll back one root-bound GitHub branch-protection rollout after a frozen read-only inventory.",
+      "capabilityGroup": "governance-versioning",
+      "audience": [
+        "agent",
+        "operator"
+      ],
+      "maturity": "stable"
+    },
     {
       "id": "help",
       "source": "bin/buildchain.mjs",

package/dist/site/controller-registry.json

@@ -222,6 +222,10 @@
           "classification": "digest-only",
           "source": "workflow-call-input"
         },
+        "credential-island-caller-owned": {
+          "classification": "included",
+          "source": "workflow-call-input"
+        },
         "credential-island-environment": {
           "classification": "digest-only",
           "source": "workflow-call-input"
@@ -419,7 +423,7 @@
           "controller-receipt"
         ]
       },
-      "digest": "sha256:fd1519f97e045331a21454da1132385d3f4e68f21479b311f0f3569618fe62b1"
+      "digest": "sha256:a06607b6ebd3fb00b77519098c81d6fb5e9943ec268aebb1e5fdbefef6e598ad"
     },
     {
       "schemaVersion": 1,
@@ -579,6 +583,10 @@
           "classification": "digest-only",
           "source": "workflow-call-input"
         },
+        "credential-island-caller-owned": {
+          "classification": "included",
+          "source": "workflow-call-input"
+        },
         "credential-island-environment": {
           "classification": "digest-only",
           "source": "workflow-call-input"
@@ -757,7 +765,7 @@
           "controller-receipt"
         ]
       },
-      "digest": "sha256:1f6bc118b79876ecab5760356676a3b5076da44f4ba763a6b110f9b1d6fdfb38"
+      "digest": "sha256:4fc6c33bf5b429f8087ac752d5cf2a19f4a1cc30db01aae927a28cee1cf924f0"
     },
     {
       "schemaVersion": 1,
@@ -918,6 +926,10 @@
           "classification": "included",
           "source": "workflow-call-input"
         },
+        "github-governance-receipt-json": {
+          "classification": "digest-only",
+          "source": "workflow-call-input"
+        },
         "node-version": {
           "classification": "included",
           "source": "workflow-call-input"
@@ -1086,7 +1098,7 @@
           "controller-receipt"
         ]
       },
-      "digest": "sha256:7e6283c8fbeab7a680bae57c9ab9c8eb94aab7400d3ee01c5b9dfdd03f149edb"
+      "digest": "sha256:65cc01e6d2b622277d67237e4811e82d24d2289d55c2f7d2dfb72325c610b2ea"
     },
     {
       "schemaVersion": 1,
@@ -1277,6 +1289,10 @@
           "classification": "included",
           "source": "workflow-call-input"
         },
+        "github-governance-receipt-json": {
+          "classification": "digest-only",
+          "source": "workflow-call-input"
+        },
         "github-release": {
           "classification": "included",
           "source": "workflow-call-input"
@@ -1426,7 +1442,7 @@
           "controller-receipt"
         ]
       },
-      "digest": "sha256:0613ea545fe2d630f34e665c8e6fe99df3f5333d75051a7176e9cf991e494f59"
+      "digest": "sha256:6d71409659fbf8543c7e520b0c493d8afe86bdf60286b860bb917f0041ebc173"
     },
     {
       "schemaVersion": 1,
@@ -1454,6 +1470,18 @@
           "classification": "redacted",
           "source": "workflow-call-secret"
         },
+        "BUILDCHAIN_PUBLICATION_COMMIT_SIGNING_KEY": {
+          "classification": "redacted",
+          "source": "workflow-call-secret"
+        },
+        "BUILDCHAIN_PUBLICATION_COMMIT_TOKEN": {
+          "classification": "redacted",
+          "source": "workflow-call-secret"
+        },
+        "KUNGFU_GOVERNANCE_AUDITOR_APP_PRIVATE_KEY": {
+          "classification": "redacted",
+          "source": "workflow-call-secret"
+        },
         "allow-repository": {
           "classification": "included",
           "source": "workflow-call-input"
@@ -1518,6 +1546,10 @@
           "classification": "included",
           "source": "workflow-call-input"
         },
+        "github-governance-receipt-json": {
+          "classification": "digest-only",
+          "source": "workflow-call-input"
+        },
         "github-release": {
           "classification": "included",
           "source": "workflow-call-input"
@@ -1526,6 +1558,10 @@
           "classification": "digest-only",
           "source": "workflow-call-input"
         },
+        "github-release-payload-patterns": {
+          "classification": "included",
+          "source": "workflow-call-input"
+        },
         "github-release-title": {
           "classification": "included",
           "source": "workflow-call-input"
@@ -1590,6 +1626,14 @@
           "classification": "included",
           "source": "workflow-call-input"
         },
+        "publication-commit-command": {
+          "classification": "digest-only",
+          "source": "workflow-call-input"
+        },
+        "publication-commit-evidence-path": {
+          "classification": "digest-only",
+          "source": "workflow-call-input"
+        },
         "publication-consumer-predicate-id": {
           "classification": "included",
           "source": "workflow-call-input"
@@ -1804,7 +1848,7 @@
           "controller-receipt"
         ]
       },
-      "digest": "sha256:bde6769a31f35ea89e8bdc67a4ca37175f24028b2b3975ff795ba5b2fb95d3a5"
+      "digest": "sha256:98e2676d01470992d7b4ca9c2a1e12b0e6c816c0586a8e8e1736f4b58a1360a9"
     },
     {
       "schemaVersion": 1,
@@ -1980,5 +2024,5 @@
       "digest": "sha256:b6f53563c0adc859bc586c05fce560a5094d7d9666438d63c5fd3e1fc4774555"
     }
   ],
-  "digest": "sha256:f3c286292ba70b3c9b74eb8ae4052bafb8d5c393ce0037a06b4fc8e675de0f40"
+  "digest": "sha256:15fdbedc9c0a2b51104e854300d1725bcab76b11cebde61f53a70a49fe43966b"
 }

package/dist/site/kfd-claims.json

@@ -21,13 +21,13 @@
     "contract": "kungfu-buildchain-public-surface-reverse-audit",
     "path": "dist/site/public-surface-audit.json",
     "status": "passed",
-    "sha256": "c473db3464da86da98a089fb487525f80d56da7aad2103e58845cc8d3e0efb0f",
+    "sha256": "e2ed3df53a48587531486466e02c82f044920fb629a77b0880e9b9aaa762adac",
     "summary": {
-      "cliCommandCount": 86,
-      "workflowCount": 51,
+      "cliCommandCount": 87,
+      "workflowCount": 52,
       "actionCount": 5,
-      "sitePageCount": 53,
-      "docCommandRefCount": 265,
+      "sitePageCount": 54,
+      "docCommandRefCount": 276,
       "failureCount": 0
     },
     "auditBoundary": {
@@ -228,13 +228,13 @@
       "contract": "kungfu-buildchain-public-surface-reverse-audit",
       "path": "dist/site/public-surface-audit.json",
       "status": "passed",
-      "sha256": "c473db3464da86da98a089fb487525f80d56da7aad2103e58845cc8d3e0efb0f",
+      "sha256": "e2ed3df53a48587531486466e02c82f044920fb629a77b0880e9b9aaa762adac",
       "summary": {
-        "cliCommandCount": 86,
-        "workflowCount": 51,
+        "cliCommandCount": 87,
+        "workflowCount": 52,
         "actionCount": 5,
-        "sitePageCount": 53,
-        "docCommandRefCount": 265,
+        "sitePageCount": 54,
+        "docCommandRefCount": 276,
         "failureCount": 0
       },
       "auditBoundary": {
@@ -392,6 +392,18 @@
           "public": true,
           "plane": "verify"
         },
+        {
+          "id": "doc:docs/github-governance-authority.md",
+          "name": "GitHub governance authority",
+          "kind": "documentation",
+          "sourcePath": "docs/github-governance-authority.md",
+          "evidencePath": "docs/github-governance-authority.md",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "plane": "verify"
+        },
         {
           "id": "doc:docs/homebrew.md",
           "name": "Homebrew distribution indexes",
@@ -903,6 +915,17 @@
           "participantFacing": true,
           "public": true
         },
+        {
+          "id": "schema:packages/core/github-governance-authority.js",
+          "name": "schema:packages/core/github-governance-authority.js",
+          "kind": "schema",
+          "sourcePath": "packages/core/github-governance-authority.js",
+          "evidencePath": "packages/core/github-governance-authority.js",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true
+        },
         {
           "id": "schema:packages/core/buildchain-kfd-claims.js",
           "name": "schema:packages/core/buildchain-kfd-claims.js",
@@ -1318,6 +1341,18 @@
           "public": true,
           "packageExport": "./buildchain-publication-authority"
         },
+        {
+          "id": "export:./github-governance-authority",
+          "name": "@kungfu-tech/buildchain/github-governance-authority",
+          "kind": "package-export",
+          "sourcePath": "packages/core/github-governance-authority.js",
+          "evidencePath": "packages/core/github-governance-authority.js",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "packageExport": "./github-governance-authority"
+        },
         {
           "id": "export:./kfd-gate",
           "name": "@kungfu-tech/buildchain/kfd-gate",
@@ -1854,6 +1889,18 @@
           "public": true,
           "reverseAuditSource": "bin/buildchain.mjs"
         },
+        {
+          "id": "cli:github-governance",
+          "name": "buildchain github-governance <plan|apply|rollback|protection-policy-plan|ruleset-policy-plan> ...",
+          "kind": "cli-command",
+          "sourcePath": "bin/buildchain.mjs",
+          "evidencePath": "bin/buildchain.mjs",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "reverseAuditSource": "bin/buildchain.mjs"
+        },
         {
           "id": "cli:help",
           "name": "buildchain --help",
@@ -2680,12 +2727,13 @@
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 14,
+          "inputCount": 15,
           "inputs": [
             "auto-admission",
             "buildchain-ref",
             "buildchain-repository",
             "evidence-run-id",
+            "github-governance-receipt-json",
             "publication-admission-json",
             "publication-control-plane-audit-json",
             "publication-expected-json",
@@ -2709,7 +2757,7 @@
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 64,
+          "inputCount": 65,
           "inputs": [
             "artifact-name",
             "artifact-name-template",
@@ -2737,6 +2785,7 @@
             "checkout-cache-mode",
             "checkout-cache-reference-repository-template",
             "checkout-cache-timeout-seconds",
+            "credential-island-caller-owned",
             "credential-island-environment",
             "credential-island-macos-app-path",
             "credential-island-macos-platform-id",
@@ -2836,7 +2885,7 @@
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 32,
+          "inputCount": 33,
           "inputs": [
             "admission-json",
             "authority-workflow-path",
@@ -2860,6 +2909,7 @@
             "evidence-summary-artifact",
             "expected-json",
             "gate-aggregate-json",
+            "github-governance-receipt-json",
             "package-name",
             "product",
             "publication-target",
@@ -2883,7 +2933,7 @@
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 74,
+          "inputCount": 78,
           "inputs": [
             "allow-repository",
             "artifact-name",
@@ -2898,8 +2948,10 @@
             "buildchain-repository",
             "channel",
             "dry-run",
+            "github-governance-receipt-json",
             "github-release",
             "github-release-notes",
+            "github-release-payload-patterns",
             "github-release-title",
             "package-manager",
             "promotion-contract-lock-digest",
@@ -2916,6 +2968,8 @@
             "publication-admission-json",
             "publication-auto-admission",
             "publication-auto-no-gate",
+            "publication-commit-command",
+            "publication-commit-evidence-path",
             "publication-consumer-predicate-id",
             "publication-consumer-qualification-command",
             "publication-control-plane-audit-json",
@@ -3189,7 +3243,7 @@
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 39,
+          "inputCount": 40,
           "inputs": [
             "artifact-path",
             "aws-region",
@@ -3200,6 +3254,7 @@
             "buildchain-ref",
             "buildchain-repository",
             "fail-on-release-pr-error",
+            "github-governance-receipt-json",
             "node-version",
             "preview-apply",
             "preview-aws-role-arn",
@@ -3323,7 +3378,7 @@
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 67,
+          "inputCount": 68,
           "inputs": [
             "artifact-name",
             "artifact-name-template",
@@ -3354,6 +3409,7 @@
             "checkout-cache-mode",
             "checkout-cache-reference-repository-template",
             "checkout-cache-timeout-seconds",
+            "credential-island-caller-owned",
             "credential-island-environment",
             "credential-island-macos-app-path",
             "credential-island-macos-platform-id",
@@ -3602,6 +3658,20 @@
           ],
           "reverseAuditSource": ".github/workflows"
         },
+        {
+          "id": "workflow:github-governance-audit",
+          "name": "workflow:github-governance-audit",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/github-governance-audit.yml",
+          "evidencePath": ".github/workflows/github-governance-audit.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 0,
+          "inputs": [],
+          "reverseAuditSource": ".github/workflows"
+        },
         {
           "id": "workflow:npm-publish",
           "name": "workflow:npm-publish",
@@ -3626,7 +3696,7 @@
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 25,
+          "inputCount": 26,
           "inputs": [
             "artifact-name",
             "artifact-paths",
@@ -3638,6 +3708,7 @@
             "buildchain-ref",
             "buildchain-repository",
             "dry-run",
+            "github-governance-receipt-json",
             "github-release",
             "github-release-notes",
             "github-release-title",
@@ -3666,7 +3737,7 @@
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 37,
+          "inputCount": 38,
           "inputs": [
             "artifact-name",
             "artifact-retention-days",
@@ -3680,6 +3751,7 @@
             "buildchain-ref",
             "buildchain-repository",
             "dry-run",
+            "github-governance-receipt-json",
             "github-release",
             "github-release-notes",
             "github-release-title",
@@ -3847,7 +3919,7 @@
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 66,
+          "inputCount": 70,
           "inputs": [
             "allow-repository",
             "artifact-name",
@@ -3865,13 +3937,17 @@
             "buildchain-stable-contract-lock-path",
             "channel",
             "dry-run",
+            "github-governance-receipt-json",
             "github-release",
             "github-release-notes",
+            "github-release-payload-patterns",
             "github-release-title",
             "package-manager",
             "publication-admission-json",
             "publication-auto-admission",
             "publication-auto-no-gate",
+            "publication-commit-command",
+            "publication-commit-evidence-path",
             "publication-consumer-predicate-id",
             "publication-consumer-qualification-command",
             "publication-control-plane-audit-json",
@@ -4127,7 +4203,7 @@
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 63,
+          "inputCount": 64,
           "inputs": [
             "allow-repository",
             "branch-protection-bypass-apps",
@@ -4135,6 +4211,7 @@
             "branch-protection-bypass-users",
             "dry-run",
             "expected-publication-version",
+            "generated-pull-request-token",
             "generated-ref-update-token",
             "generated-status-check-token",
             "github-release",
@@ -4595,6 +4672,18 @@
           "public": true,
           "reverseAuditSource": "dist/site/page-registry.json"
         },
+        {
+          "id": "site-page:manual:github-governance-authority",
+          "name": "site-page:manual:github-governance-authority",
+          "kind": "site-page",
+          "sourcePath": "dist/site/page-registry.json",
+          "evidencePath": "dist/site/page-registry.json",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "reverseAuditSource": "dist/site/page-registry.json"
+        },
         {
           "id": "site-page:manual:homebrew",
           "name": "site-page:manual:homebrew",
@@ -5081,6 +5170,6 @@
         }
       }
     ],
-    "publicSurfaceCount": 323
+    "publicSurfaceCount": 329
   }
 }

package/dist/site/kfd-upstream-aggregate.json

@@ -4,7 +4,7 @@
   "product": {
     "id": "kungfu-tech-buildchain",
     "name": "@kungfu-tech/buildchain",
-    "version": "2.14.18-alpha.1",
+    "version": "2.14.18-alpha.11",
     "repository": "https://github.com/kungfu-systems/buildchain"
   },
   "source": {

package/dist/site/manual-registry.json

@@ -9,7 +9,7 @@
       "title": "Buildchain documentation map",
       "path": "docs/MAP.md",
       "plane": "use",
-      "digest": "sha256:7f007a9d295d597dfc5b1447629ab0d6bf2b3fa3d625b02d27abf7493d73bb40",
+      "digest": "sha256:c9eb92eb02601e1e36cb38d7df93097c582dec2b8dc34f769f58c30fc5190bbe",
       "capabilityGroup": "getting-started",
       "audience": [
         "agent",
@@ -74,6 +74,21 @@
       "maturity": "preview",
       "order": 105
     },
+    {
+      "id": "github-governance-authority",
+      "title": "GitHub governance authority",
+      "path": "docs/github-governance-authority.md",
+      "plane": "verify",
+      "digest": "sha256:8484b18d5b0fe6d61d102d6b9cb9e18beac9f47ecb516d430fb5427518e2931f",
+      "capabilityGroup": "governance-versioning",
+      "audience": [
+        "maintainer",
+        "release-operator",
+        "agent"
+      ],
+      "maturity": "preview",
+      "order": 106
+    },
     {
       "id": "release-candidate",
       "title": "Release Candidate Passport",
@@ -303,7 +318,7 @@
       "title": "Lifecycle protocol",
       "path": "docs/lifecycle-protocol.md",
       "plane": "use",
-      "digest": "sha256:71552baae51146fa790d40af02d5d5b3a1a4aa0d9764af09907bb05d3360b0cc",
+      "digest": "sha256:9c669d3d2d1926dc5b421207089cca85bac0a6dcdb5544c28a7e1659ba9ed5ee",
       "capabilityGroup": "reusable-build",
       "audience": [
         "consumer",
@@ -317,7 +332,7 @@
       "title": "Reusable build surface",
       "path": "docs/reusable-build-surface.md",
       "plane": "use",
-      "digest": "sha256:069ba73cf32b9f55a62fd5f4bfaec00608498019b53e8ae1387d7dc9de26bc29",
+      "digest": "sha256:ff6f36e1db2be12df37ef076935b5583493742528d98403297678a0682b67dc2",
       "capabilityGroup": "reusable-build",
       "audience": [
         "consumer",
@@ -331,7 +346,7 @@
       "title": "Publish transaction",
       "path": "docs/publish-transaction.md",
       "plane": "verify",
-      "digest": "sha256:57673d6e1e57a9be0019b30ad0f8784cd05c9a0f389a775ac5f49f67d8f52a79",
+      "digest": "sha256:cde5256d5f6443a6d32b47783900a0677e973855266af5a360db8d4d112bb677",
       "capabilityGroup": "release-passport-trust",
       "audience": [
         "release-operator"
@@ -344,7 +359,7 @@
       "title": "Release governance",
       "path": "docs/release-governance.md",
       "plane": "why",
-      "digest": "sha256:4476d9464d29b4ff3951a362607a11c78b7a3b723247af93ded1b15ff8f0b83e",
+      "digest": "sha256:5aa7fef2c831d14b4d1df4cddb45c6ce97929d8530eb14e3b3dfa3dee5e0d651",
       "capabilityGroup": "governance-versioning",
       "audience": [
         "maintainer",
@@ -399,7 +414,7 @@
       "title": "Web surface deployments",
       "path": "docs/web-surface-deployments.md",
       "plane": "use",
-      "digest": "sha256:ecdece4b7d916b7d8b323db68c5d81c533d67348c71907b46eb97d3c2fe432ba",
+      "digest": "sha256:809d765d89277320d710ecfdc2287029530b74fe38f36dd04d057076dded9a0d",
       "capabilityGroup": "site-and-propagation",
       "audience": [
         "site",