@kungfu-tech/buildchain 2.14.3-alpha.1 → 2.14.3-alpha.11

package/scripts/generate-channel-promotion-workflow.mjs

@@ -7,6 +7,7 @@ import { fileURLToPath } from "node:url";
 const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 const sourcePath = path.join(root, ".github/workflows/.release-candidate-promote.yml");
 const targetPath = path.join(root, ".github/workflows/release-candidate-promote.yml");
+const routingPath = path.join(root, ".buildchain/promotion-shell-routing.json");
 const internalInputs = new Set([
   "promotion-router-ref",
   "promotion-router-sha",
@@ -89,32 +90,80 @@ function publicOutputs(outputBlock) {
   return [...routed, ...forwarded].join("\n");
 }
 
-function forwardedInputs(inputNames) {
-  return inputNames.map((name) => {
-    const routed = {
-      "buildchain-ref": "runtime-ref",
-      "buildchain-contract-lock-path": "contract-lock-path",
-      channel: "publication-channel",
-      "target-ref": "target-ref",
-      "promotion-router-ref": "router-ref",
-      "promotion-router-sha": "router-sha",
-      "promotion-shell-ref": "shell-ref",
-      "promotion-shell-sha": "shell-sha",
-      "promotion-runtime-ref": "runtime-ref",
-      "promotion-runtime-sha": "runtime-sha",
-      "promotion-contract-lock-path": "contract-lock-path",
-      "promotion-contract-lock-digest": "contract-lock-digest",
-      "promotion-publication-channel": "publication-channel",
-      "promotion-target-ref": "target-ref",
-      "promotion-override-used": "override-used",
-    }[name];
-    return routed
-      ? `      ${name}: \${{ needs.resolve-promotion.outputs.${routed} }}`
-      : `      ${name}: \${{ inputs.${name} }}`;
-  }).join("\n");
+function forwardedInputs(inputNames, { includeInternal = true } = {}) {
+  return inputNames
+    .filter((name) => includeInternal || !internalInputs.has(name))
+    .map((name) => {
+      const routed = {
+        "buildchain-ref": "runtime-ref",
+        "buildchain-contract-lock-path": "contract-lock-path",
+        channel: "publication-channel",
+        "target-ref": "target-ref",
+        "promotion-router-ref": "router-ref",
+        "promotion-router-sha": "router-sha",
+        "promotion-shell-ref": "shell-ref",
+        "promotion-shell-sha": "shell-sha",
+        "promotion-runtime-ref": "runtime-ref",
+        "promotion-runtime-sha": "runtime-sha",
+        "promotion-contract-lock-path": "contract-lock-path",
+        "promotion-contract-lock-digest": "contract-lock-digest",
+        "promotion-publication-channel": "publication-channel",
+        "promotion-target-ref": "target-ref",
+        "promotion-override-used": "override-used",
+      }[name];
+      if (name === "promotion-override-used") {
+        return `      ${name}: \${{ needs.resolve-promotion.outputs.override-used == 'true' }}`;
+      }
+      return routed
+        ? `      ${name}: \${{ needs.resolve-promotion.outputs.${routed} }}`
+        : `      ${name}: \${{ inputs.${name} }}`;
+    }).join("\n");
 }
 
-export function generateChannelPromotionWorkflow(source, { major = 2 } = {}) {
+function validateWorkflowRoute(name, route, expectedLogicalRef) {
+  if (!route || typeof route !== "object") throw new Error(`promotion shell routing missing ${name} route`);
+  if (route.logicalRef !== expectedLogicalRef) {
+    throw new Error(`promotion shell ${name} logicalRef must be ${expectedLogicalRef}`);
+  }
+  if (!/^\.github\/workflows\/[.a-z0-9-]+\.ya?ml$/.test(route.workflowPath || "")) {
+    throw new Error(`promotion shell ${name} workflowPath must name a reusable workflow`);
+  }
+  if (!/^(?:v[0-9]+(?:-alpha)?|[0-9a-f]{40})$/.test(route.callRef || "")) {
+    throw new Error(`promotion shell ${name} callRef must be an official channel ref or exact SHA`);
+  }
+  if (typeof route.forwardInternalInputs !== "boolean") {
+    throw new Error(`promotion shell ${name} forwardInternalInputs must be boolean`);
+  }
+  return { ...route };
+}
+
+export function parsePromotionShellRouting(source, { major = 2 } = {}) {
+  const parsed = JSON.parse(source);
+  if (parsed.schemaVersion !== 1) throw new Error("promotion shell routing schemaVersion must be 1");
+  if (parsed.major !== major) throw new Error(`promotion shell routing major must be ${major}`);
+  return {
+    alpha: validateWorkflowRoute("alpha", parsed.alpha, `v${major}-alpha`),
+    stable: validateWorkflowRoute("stable", parsed.stable, `v${major}`),
+  };
+}
+
+export function generateChannelPromotionWorkflow(source, { major = 2, shellRouting } = {}) {
+  const routes = shellRouting || {
+    alpha: {
+      logicalRef: `v${major}-alpha`,
+      callRef: `v${major}-alpha`,
+      workflowPath: ".github/workflows/.release-candidate-promote.yml",
+      forwardInternalInputs: true,
+    },
+    stable: {
+      logicalRef: `v${major}`,
+      callRef: `v${major}`,
+      workflowPath: ".github/workflows/.release-candidate-promote.yml",
+      forwardInternalInputs: true,
+    },
+  };
+  const alphaRoute = validateWorkflowRoute("alpha", routes.alpha, `v${major}-alpha`);
+  const stableRoute = validateWorkflowRoute("stable", routes.stable, `v${major}`);
   const inputs = blockBetween(source, "    inputs:\n", "    secrets:\n");
   const secrets = blockBetween(source, "    secrets:\n", "    outputs:\n");
   const outputs = blockBetween(source, "    outputs:\n", "\nconcurrency:\n");
@@ -122,7 +171,12 @@ export function generateChannelPromotionWorkflow(source, { major = 2 } = {}) {
   for (const required of ["buildchain-ref", "buildchain-contract-lock-path", "channel", "target-ref", ...internalInputs]) {
     if (!inputNames.includes(required)) throw new Error(`advanced promotion workflow missing input: ${required}`);
   }
-  const forwarded = forwardedInputs(inputNames);
+  const alphaForwarded = forwardedInputs(inputNames, {
+    includeInternal: alphaRoute.forwardInternalInputs,
+  });
+  const stableForwarded = forwardedInputs(inputNames, {
+    includeInternal: stableRoute.forwardInternalInputs,
+  });
   return `# Generated by scripts/generate-channel-promotion-workflow.mjs. Do not edit directly.
 name: Release Candidate Promote
 
@@ -269,12 +323,39 @@ jobs:
       - name: Resolve immutable promotion identities
         id: identities
         shell: bash
+        env:
+          CHANNEL: \${{ steps.route.outputs.channel }}
+          SELECTED_SHELL_REF: \${{ steps.route.outputs.shell-ref }}
+          ALPHA_SHELL_REF: ${alphaRoute.logicalRef}
+          ALPHA_SHELL_CALL_REF: ${alphaRoute.callRef}
+          ALPHA_SHELL_WORKFLOW_PATH: ${alphaRoute.workflowPath}
+          STABLE_SHELL_REF: ${stableRoute.logicalRef}
+          STABLE_SHELL_CALL_REF: ${stableRoute.callRef}
+          STABLE_SHELL_WORKFLOW_PATH: ${stableRoute.workflowPath}
         run: |
           set -euo pipefail
-          test -f .buildchain/shell/.github/workflows/.release-candidate-promote.yml
+          if [[ "\${CHANNEL}" = "alpha" ]]; then
+            expected_ref="\${ALPHA_SHELL_REF}"
+            call_ref="\${ALPHA_SHELL_CALL_REF}"
+            workflow_path="\${ALPHA_SHELL_WORKFLOW_PATH}"
+          else
+            expected_ref="\${STABLE_SHELL_REF}"
+            call_ref="\${STABLE_SHELL_CALL_REF}"
+            workflow_path="\${STABLE_SHELL_WORKFLOW_PATH}"
+          fi
+          if [[ "\${SELECTED_SHELL_REF}" != "\${expected_ref}" ]]; then
+            echo "::error::Selected promotion shell ref \${SELECTED_SHELL_REF} does not match configured \${expected_ref}"
+            exit 1
+          fi
+          test -f ".buildchain/shell/\${workflow_path}"
+          shell_sha="$(git -C .buildchain/shell rev-parse HEAD)"
+          if [[ "\${call_ref}" =~ ^[0-9a-f]{40}$ && "\${shell_sha}" != "\${call_ref}" ]]; then
+            echo "::error::Pinned promotion shell \${call_ref} does not match selected \${shell_sha}"
+            exit 1
+          fi
           {
             echo "router-sha=$(git -C .buildchain/router rev-parse HEAD)"
-            echo "shell-sha=$(git -C .buildchain/shell rev-parse HEAD)"
+            echo "shell-sha=\${shell_sha}"
             echo "runtime-sha=$(git -C .buildchain/runtime rev-parse HEAD)"
           } >> "\${GITHUB_OUTPUT}"
 
@@ -282,7 +363,7 @@ jobs:
     name: Promote with alpha workflow shell
     needs: resolve-promotion
     if: \${{ needs.resolve-promotion.outputs.channel == 'alpha' }}
-    uses: kungfu-systems/buildchain/.github/workflows/.release-candidate-promote.yml@v${major}-alpha
+    uses: kungfu-systems/buildchain/${alphaRoute.workflowPath}@${alphaRoute.callRef}
     permissions:
       actions: read
       checks: write
@@ -290,14 +371,14 @@ jobs:
       id-token: write
       issues: write
     with:
-${forwarded}
+${alphaForwarded}
     secrets: inherit
 
   stable:
     name: Promote with stable workflow shell
     needs: resolve-promotion
     if: \${{ needs.resolve-promotion.outputs.channel == 'stable' }}
-    uses: kungfu-systems/buildchain/.github/workflows/.release-candidate-promote.yml@v${major}
+    uses: kungfu-systems/buildchain/${stableRoute.workflowPath}@${stableRoute.callRef}
     permissions:
       actions: read
       checks: write
@@ -305,7 +386,7 @@ ${forwarded}
       id-token: write
       issues: write
     with:
-${forwarded}
+${stableForwarded}
     secrets: inherit
 `;
 }
@@ -315,7 +396,8 @@ function main() {
   const version = JSON.parse(fs.readFileSync(path.join(root, "package.json"), "utf8")).version;
   const major = Number(String(version).match(/^(\d+)\./)?.[1]);
   if (!Number.isInteger(major)) throw new Error("package version must expose a numeric major");
-  const generated = generateChannelPromotionWorkflow(source, { major });
+  const shellRouting = parsePromotionShellRouting(fs.readFileSync(routingPath, "utf8"), { major });
+  const generated = generateChannelPromotionWorkflow(source, { major, shellRouting });
   if (process.argv.includes("--check")) {
     const current = fs.existsSync(targetPath) ? fs.readFileSync(targetPath, "utf8") : "";
     if (current !== generated) {

package/scripts/promotion-channel-router.mjs

@@ -23,12 +23,10 @@ function targetIntent(targetRef, requestedPublicationChannel = "") {
   if (requested && requested !== target.publicationChannel) {
     throw new Error(`promotion channel ${requested} does not match target ref ${ref} (${target.publicationChannel})`);
   }
-  const match = ref.match(target.pattern);
   return {
     targetRef: ref,
     publicationChannel: target.publicationChannel,
     shellChannel: target.shellChannel,
-    targetMajor: match?.[1] ? Number(match[1]) : undefined,
   };
 }
 
@@ -55,11 +53,6 @@ export function resolvePromotionChannel({
       `promotion target ${intent.targetRef} requires ${intent.shellChannel} shell/runtime, got ${selected.channel}`,
     );
   }
-  if (Number.isInteger(intent.targetMajor) && selected.major !== intent.targetMajor) {
-    throw new Error(
-      `promotion target ${intent.targetRef} requires Buildchain v${intent.targetMajor}, got v${selected.major}`,
-    );
-  }
   const shellRef = intent.shellChannel === "alpha" ? `v${selected.major}-alpha` : `v${selected.major}`;
   return {
     targetRef: intent.targetRef,

package/scripts/stable-candidate-patrol.mjs

@@ -223,7 +223,7 @@ export async function runStableCandidatePatrol(optionsInput = {}, clientInput) {
           `Buildchain Stable Candidate Patrol human release-now for ${selection.candidate.version}`,
         );
       }
-      await client.ensureBranch(refs.sourceRef, selection.candidate.sha);
+      await client.ensureBranch(refs.sourceRef, selection.candidate.sha, refs.targetRef);
       const pullRequest = await client.ensurePromotionPullRequest({
         head: refs.sourceRef,
         base: refs.targetRef,
@@ -371,15 +371,64 @@ export function createGitHubStableCandidateClient({ repository: repositoryInput,
         },
       });
     },
-    async ensureBranch(ref, candidateSha) {
+    async ensureBranch(ref, candidateSha, targetRef) {
       const current = await api(`/repos/${owner}/${repo}/git/ref/heads/${encodeRef(ref)}`, { allow404: true });
-      if (!current) {
+      if (!targetRef) {
+        if (!current) {
+          return api(`/repos/${owner}/${repo}/git/refs`, { method: "POST", body: { ref: `refs/heads/${ref}`, sha: candidateSha } });
+        }
+        if (current.object.sha !== candidateSha) {
+          throw new Error(`source-lock branch ${ref} already points to ${current.object.sha}, not ${candidateSha}`);
+        }
+        return current;
+      }
+
+      const candidateCommit = await api(`/repos/${owner}/${repo}/git/commits/${candidateSha}`);
+      let sourceSha = current?.object?.sha || candidateSha;
+      if (sourceSha !== candidateSha) {
+        const sourceCommit = await api(`/repos/${owner}/${repo}/git/commits/${sourceSha}`);
+        if (sourceCommit.tree?.sha !== candidateCommit.tree?.sha) {
+          throw new Error(`source-lock branch ${ref} no longer preserves candidate ${candidateSha} tree`);
+        }
+        const candidateLineage = await api(`/repos/${owner}/${repo}/compare/${candidateSha}...${sourceSha}`);
+        if (!["ahead", "identical"].includes(candidateLineage.status)) {
+          throw new Error(`source-lock branch ${ref} no longer descends from candidate ${candidateSha}`);
+        }
+      }
+
+      const target = await api(`/repos/${owner}/${repo}/git/ref/heads/${encodeRef(targetRef)}`);
+      const targetSha = target.object?.sha || "";
+      const targetLineage = await api(`/repos/${owner}/${repo}/compare/${targetSha}...${sourceSha}`);
+      if (["ahead", "identical"].includes(targetLineage.status)) {
+        if (current) return current;
         return api(`/repos/${owner}/${repo}/git/refs`, { method: "POST", body: { ref: `refs/heads/${ref}`, sha: candidateSha } });
       }
-      if (current.object.sha !== candidateSha) {
-        throw new Error(`source-lock branch ${ref} already points to ${current.object.sha}, not ${candidateSha}`);
+
+      const identity = { name: "Buildchain Patrol", email: "buildchain-patrol@kungfu.link" };
+      const reconciliation = await api(`/repos/${owner}/${repo}/git/commits`, {
+        method: "POST",
+        body: {
+          message: [
+            "chore(buildchain): reconcile stable source-lock ancestry",
+            "",
+            `Preserve the exact candidate tree from ${candidateSha} while admitting ${targetRef} at ${targetSha}.`,
+            "",
+            "Signed-off-by: Buildchain Patrol <buildchain-patrol@kungfu.link>",
+          ].join("\n"),
+          tree: candidateCommit.tree.sha,
+          parents: [sourceSha, targetSha],
+          author: identity,
+          committer: identity,
+        },
+      });
+      sourceSha = reconciliation.sha;
+      if (!current) {
+        return api(`/repos/${owner}/${repo}/git/refs`, { method: "POST", body: { ref: `refs/heads/${ref}`, sha: sourceSha } });
       }
-      return current;
+      return api(`/repos/${owner}/${repo}/git/refs/heads/${encodeRef(ref)}`, {
+        method: "PATCH",
+        body: { sha: sourceSha, force: false },
+      });
     },
     async ensurePromotionPullRequest({ head, base, title, body }) {
       const open = await api(`/repos/${owner}/${repo}/pulls?state=open&head=${encodeURIComponent(`${owner}:${head}`)}&base=${encodeURIComponent(base)}&per_page=20`);