@kungfu-tech/buildchain 2.14.18-alpha.11 → 2.14.18-alpha.3

package/scripts/audit-publication-control-plane.mjs

@@ -239,16 +239,6 @@ function main() {
   const deploymentBranches = environment !== "none" && environmentState.deployment_branch_policy?.custom_branch_policies === true
     ? githubJson(`repos/${repository}/environments/${encodeURIComponent(environment)}/deployment-branch-policies?per_page=100`, "Environment deployment branch policy")
     : { branch_policies: [] };
-  const exactEnvironmentBranchPolicy = (deploymentBranches.branch_policies || []).find((entry) =>
-    entry?.type === "branch" && entry?.name === branch
-  );
-  const environmentBranchAuthorized = environment !== "none" && (
-    (
-      environmentState.deployment_branch_policy?.protected_branches === true &&
-      branchState.protected === true
-    ) ||
-    Boolean(exactEnvironmentBranchPolicy)
-  );
   const oidc = githubJson(`repos/${repository}/actions/oidc/customization/sub`, "OIDC subject policy");
   if (!["npm-trusted-publisher", "github-token", "oidc-role"].includes(publisherMode)) {
     throw new Error(`unsupported --publisher-mode: ${publisherMode}`);
@@ -287,24 +277,10 @@ function main() {
       message: sourceMessage,
       changedPaths: sourceChangedPaths,
     };
-    const branchHeadSha = String(branchState.commit?.sha || "").toLowerCase();
-    const sourceComparison = sourceSha === branchHeadSha
-      ? null
-      : githubJson(
-        `repos/${repository}/compare/${sourceSha}...${branchHeadSha}`,
-        "source protected-branch lineage",
-      );
-    const sourceContainedInBranch = sourceSha === branchHeadSha || (
-      sourceComparison?.status === "ahead" &&
-      String(sourceComparison?.merge_base_commit?.sha || "").toLowerCase() === sourceSha
-    );
     let pullRequests = githubJson(`repos/${repository}/commits/${authorizationSha}/pulls`, "source pull-request lineage");
     let mergedPullRequest = (Array.isArray(pullRequests) ? pullRequests : []).find((entry) =>
       entry?.merged_at &&
-      (
-        String(entry.merge_commit_sha || "").toLowerCase() === authorizationSha ||
-        String(entry.head?.sha || "").toLowerCase() === authorizationSha
-      ) &&
+      entry.merge_commit_sha === authorizationSha &&
       entry.base?.ref === branch &&
       entry.head?.repo?.full_name === repository
     );
@@ -342,12 +318,10 @@ function main() {
       const login = String(review?.user?.login || "");
       if (login) latestReviews.set(login, review);
     }
-    const pullRequestHeadSha = String(mergedPullRequest?.head?.sha || "").toLowerCase();
     const independentApprovals = [...latestReviews.values()].filter((review) =>
-      review.state === "APPROVED" &&
-      review.user?.login !== mergedPullRequest?.user?.login &&
-      String(review.commit_id || "").toLowerCase() === pullRequestHeadSha
+      review.state === "APPROVED" && review.user?.login !== mergedPullRequest?.user?.login
     );
+    const pullRequestHeadSha = String(mergedPullRequest?.head?.sha || "").toLowerCase();
     const checkRuns = /^[0-9a-f]{40}$/.test(pullRequestHeadSha)
       ? githubJson(`repos/${repository}/commits/${pullRequestHeadSha}/check-runs?per_page=100`, "merged pull-request head check runs")
       : { check_runs: [] };
@@ -386,8 +360,7 @@ function main() {
       requiredCheckSha: pullRequestHeadSha,
       sourceSha,
       authorizationSha,
-      headSha: branchHeadSha,
-      sourceContainedInBranch,
+      headSha: String(branchState.commit?.sha || "").toLowerCase(),
       releaseReconciliation,
       mergedPullRequest: Boolean(mergedPullRequest),
       pullRequestNumber: mergedPullRequest?.number || 0,
@@ -464,13 +437,6 @@ function main() {
         protected: (environmentState.protection_rules || []).length > 0 ||
           environmentState.deployment_branch_policy?.protected_branches === true ||
           (deploymentBranches.branch_policies || []).length > 0,
-        branchAuthorized: environmentBranchAuthorized,
-        branchPolicyMode: environmentState.deployment_branch_policy?.protected_branches === true
-          ? "protected-branches"
-          : exactEnvironmentBranchPolicy
-            ? "exact-custom-branch"
-            : "unqualified",
-        authorizedBranch: exactEnvironmentBranchPolicy?.name || "",
         reviewRequired: reviewRules.length > 0,
         preventSelfReview: reviewRules.some((rule) => rule.prevent_self_review === true),
       },

package/scripts/generate-channel-promotion-workflow.mjs

@@ -209,7 +209,6 @@ permissions:
   contents: write
   id-token: write
   issues: write
-  pull-requests: write
 
 jobs:
   resolve-promotion:
@@ -410,7 +409,6 @@ jobs:
       contents: write
       id-token: write
       issues: write
-      pull-requests: write
     with:
 ${alphaForwarded}
     secrets: inherit
@@ -426,7 +424,6 @@ ${alphaForwarded}
       contents: write
       id-token: write
       issues: write
-      pull-requests: write
     with:
 ${stableForwarded}
     secrets: inherit