@kungfu-tech/buildchain 2.4.10-alpha.1 → 2.4.10

package/docs/cli.md

@@ -365,10 +365,14 @@ transaction that promotes release refs:
   workflow and do not publish.
 
 The promotion workflow uses npm Trusted Publishing through GitHub Actions OIDC.
-It runs on a GitHub-hosted runner with `id-token: write`, generates the
-version-state commit, runs `lifecycle.verify`, runs `lifecycle.publish`, writes
-Buildchain publish evidence, validates that evidence, and only then moves exact
-tags and floating refs.
+It runs on a GitHub-hosted runner with `id-token: write`, but it does not
+manually run the release-candidate resolver or promote action. Buildchain's own
+dogfood path calls the declarative `release-candidate-promote.yml` wrapper with
+channel, target ref/SHA, PR-stage workflow, artifact, status-check, and passport
+inputs. The wrapper generates the version-state commit, runs
+`lifecycle.verify`, runs `lifecycle.publish`, writes Buildchain publish
+evidence, validates that evidence, and only then moves exact tags and floating
+refs.
 
 ```bash
 node scripts/npm-publish-transaction.mjs

package/docs/release-governance.md

@@ -59,7 +59,9 @@ Buildchain implements the same governance loop with:
 
 - `.github/workflows/release-verify.yml` for PR verification;
 - `.github/workflows/buildchain-ref-promotion.yml` for post-verify ref
-  promotion;
+  promotion; this workflow dogfoods the declarative
+  `release-candidate-promote.yml` wrapper and does not hand-wire resolver,
+  artifact download, publish-gate, or promote action steps;
 - `actions/promote-buildchain-ref` for branch, tag, version-state, and
   governance checks;
 - package-manager adapters that can update version state for pnpm, npm, and
@@ -305,9 +307,10 @@ When debugging or extending release behavior, read in this order:
 1. `docs/release-flow.md`
 2. `.github/workflows/release-verify.yml`
 3. `.github/workflows/buildchain-ref-promotion.yml`
-4. `actions/promote-buildchain-ref/README.md`
-5. `actions/promote-buildchain-ref/src/`
-6. `docs/migration-inventory.md`
+4. `.github/workflows/release-candidate-promote.yml`
+5. `actions/promote-buildchain-ref/README.md`
+6. `actions/promote-buildchain-ref/src/`
+7. `docs/migration-inventory.md`
 
 That path gives the policy first, the workflow trigger second, and the action
 implementation last.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kungfu-tech/buildchain",
-  "version": "2.4.10-alpha.1",
+  "version": "2.4.10",
   "private": false,
   "description": "Buildchain Release Passport, release governance, CLI toolkit, and site facts.",
   "repository": "https://github.com/kungfu-systems/buildchain",

package/scripts/check-inventory.mjs

@@ -200,13 +200,23 @@ for (const forbiddenSnippet of [
 }
 for (const requiredSnippet of [
   "id-token: write",
-  "registry-url: \"https://registry.npmjs.org/\"",
-  "publish-transaction: \"true\"",
+  "actions: read",
+  "uses: ./.github/workflows/release-candidate-promote.yml",
+  "target-sha: ${{ github.event.workflow_run.head_sha || inputs.sha || github.sha }}",
+  "publish-required-artifacts-json: \"[]\"",
 ]) {
   if (!buildchainRefPromotionWorkflow.includes(requiredSnippet)) {
     throw new Error(`buildchain ref promotion workflow missing npm transaction snippet: ${requiredSnippet}`);
   }
 }
+for (const forbiddenSnippet of [
+  "run: node scripts/release-candidate-resolver.mjs",
+  "uses: ./actions/promote-buildchain-ref",
+]) {
+  if (buildchainRefPromotionWorkflow.includes(forbiddenSnippet)) {
+    throw new Error(`buildchain ref promotion workflow must use the declarative wrapper, found manual snippet: ${forbiddenSnippet}`);
+  }
+}
 for (const requiredSnippet of [
   "distTag || (pkg.version.includes(\"-\") ? \"alpha\" : \"latest\")",
   "\"publish\", \"--dry-run\", \"--access\", \"public\"",