@kungfu-tech/buildchain 2.14.3-alpha.6 → 2.14.3-alpha.7

package/dist/site/buildchain-contract.json

@@ -4,7 +4,7 @@
   "product": {
     "name": "Buildchain",
     "package": "@kungfu-tech/buildchain",
-    "version": "2.14.3-alpha.6",
+    "version": "2.14.3-alpha.7",
     "repository": "https://github.com/kungfu-systems/buildchain"
   },
   "majorLine": "v2",
@@ -600,7 +600,7 @@
         "agents can discover supported Node APIs without importing internal file paths"
       ],
       "breakingDigest": "sha256:48f925608d3e2131d90936b07dc2a30341204cae3e6e785c0f77d61ad755c945",
-      "auditDigest": "sha256:21b2e8fa81fbeab636fbd6e65ee3f39c05ab5a521b5dc24b95ccbfd06c334cb8"
+      "auditDigest": "sha256:7d74190fd37b62acc862e5a50fa01f2888605b60404f600548a3bb32c0d8b93f"
     },
     {
       "contractVersion": 1,
@@ -2830,5 +2830,5 @@
     }
   ],
   "compatibilityDigest": "sha256:edc3653e5cb34efd97065a6941db16140bbf375a565bbcf329d9d795bb07676f",
-  "contractDigest": "sha256:bf9c8fda3dad12a5538f6c52b99eac7abb96713a6591533e33b72d68547e7c82"
+  "contractDigest": "sha256:bc4af5da2c40571f978cb16aa25370c0ffbbd08b3187c60844ebe58339f3ccae"
 }

package/dist/site/buildchain-site.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-bundle",
-  "generatedAt": "2026-07-19T03:26:09.138Z",
-  "publishedAt": "2026-07-19T03:26:09.138Z",
+  "generatedAt": "2026-07-19T04:23:28.973Z",
+  "publishedAt": "2026-07-19T04:23:28.973Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "681c22d52bd7a7d1edc356f890fd91d7debb295a",
+  "sourceRevision": "2d05819e8e90b7cb8cbf0bfee2b2b317065e4bb3",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "2.14.3-alpha.6",
+    "version": "2.14.3-alpha.7",
     "versionSource": "package.json#version"
   },
   "source": {

package/dist/site/kfd-upstream-aggregate.json

@@ -4,7 +4,7 @@
   "product": {
     "id": "kungfu-tech-buildchain",
     "name": "@kungfu-tech/buildchain",
-    "version": "2.14.3-alpha.6",
+    "version": "2.14.3-alpha.7",
     "repository": "https://github.com/kungfu-systems/buildchain"
   },
   "source": {

package/dist/site/node-api-registry.json

@@ -281,7 +281,7 @@
       "specifier": "@kungfu-tech/buildchain/publication-control-plane-audit",
       "export": "./publication-control-plane-audit",
       "target": "./packages/core/publication-control-plane-audit.js",
-      "digest": "sha256:58baa05440b86259812f370aa9645ba26a4df8e986dd57598412b479589286dc",
+      "digest": "sha256:3c082cdfea7bda55bd6d389dce140f1f359917c68ecf4e64eb6f2defa77cc03c",
       "summary": "Read-only publication control-plane snapshot evaluation APIs.",
       "capabilityGroup": "release-passport-trust",
       "audience": [

package/dist/site/publication-registry.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-publication-release-registry",
-  "generatedAt": "2026-07-19T03:26:09.138Z",
-  "publishedAt": "2026-07-19T03:26:09.138Z",
+  "generatedAt": "2026-07-19T04:23:28.973Z",
+  "publishedAt": "2026-07-19T04:23:28.973Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "681c22d52bd7a7d1edc356f890fd91d7debb295a",
+  "sourceRevision": "2d05819e8e90b7cb8cbf0bfee2b2b317065e4bb3",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -32,7 +32,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "2.14.3-alpha.6",
+    "version": "2.14.3-alpha.7",
     "versionSource": "package.json#version"
   },
   "sourceKind": "package-site-bundle",

package/dist/site/site-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-manifest",
-  "generatedAt": "2026-07-19T03:26:09.138Z",
-  "publishedAt": "2026-07-19T03:26:09.138Z",
+  "generatedAt": "2026-07-19T04:23:28.973Z",
+  "publishedAt": "2026-07-19T04:23:28.973Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "681c22d52bd7a7d1edc356f890fd91d7debb295a",
+  "sourceRevision": "2d05819e8e90b7cb8cbf0bfee2b2b317065e4bb3",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "2.14.3-alpha.6",
+    "version": "2.14.3-alpha.7",
     "versionSource": "package.json#version"
   },
   "entrypoint": "buildchain-site.json",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kungfu-tech/buildchain",
-  "version": "2.14.3-alpha.6",
+  "version": "2.14.3-alpha.7",
   "private": false,
   "description": "Buildchain Release Passport, release governance, CLI toolkit, and site facts.",
   "repository": "https://github.com/kungfu-systems/buildchain",

package/packages/core/publication-control-plane-audit.js

@@ -76,6 +76,8 @@ export function evaluatePublicationControlPlaneSnapshot({
     branchPolicy.requiredStatusCheck === requiredStatusCheck &&
     branchPolicy.requiredStatusChecks.includes(requiredStatusCheck) &&
     branchPolicy.requiredCheckPassed === true &&
+    /^[0-9a-f]{40}$/i.test(String(branchPolicy.requiredCheckSha || "")) &&
+    branchPolicy.requiredCheckSha === branchPolicy.pullRequestHeadSha &&
     branchPolicy.sourceSha === branchPolicy.headSha &&
     branchPolicy.mergedPullRequest === true &&
     branchPolicy.baseRef === branch &&

package/scripts/audit-publication-control-plane.mjs

@@ -278,7 +278,10 @@ function main() {
     const independentApprovals = [...latestReviews.values()].filter((review) =>
       review.state === "APPROVED" && review.user?.login !== mergedPullRequest?.user?.login
     );
-    const checkRuns = githubJson(`repos/${repository}/commits/${sourceSha}/check-runs?per_page=100`, "source check runs");
+    const pullRequestHeadSha = String(mergedPullRequest?.head?.sha || "").toLowerCase();
+    const checkRuns = /^[0-9a-f]{40}$/.test(pullRequestHeadSha)
+      ? githubJson(`repos/${repository}/commits/${pullRequestHeadSha}/check-runs?per_page=100`, "merged pull-request head check runs")
+      : { check_runs: [] };
     const requiredStatusCheckPolicy = branchState.protection?.required_status_checks || {};
     const requiredStatusChecks = requiredStatusCheckPolicy.contexts || [];
     const requiredCheckSource = (requiredStatusCheckPolicy.checks || []).find((entry) => entry.context === requiredStatusCheck);
@@ -295,10 +298,12 @@ function main() {
         (!requiredCheckSource?.app_id || entry.app?.id === requiredCheckSource.app_id)
       ),
       requiredCheckAppId: requiredCheckSource?.app_id || 0,
+      requiredCheckSha: pullRequestHeadSha,
       sourceSha,
       headSha: String(branchState.commit?.sha || "").toLowerCase(),
       mergedPullRequest: Boolean(mergedPullRequest),
       pullRequestNumber: mergedPullRequest?.number || 0,
+      pullRequestHeadSha,
       baseRef: mergedPullRequest?.base?.ref || "",
       headRepository: mergedPullRequest?.head?.repo?.full_name || "",
       approvalCount: independentApprovals.length,