@kungfu-tech/buildchain 2.8.0 → 2.8.1

package/scripts/check-inventory.mjs

@@ -87,6 +87,9 @@ if (rootPackage.exports?.["."] !== "./packages/core/index.js") {
 if (rootPackage.exports?.["./diagnostics"] !== "./packages/core/diagnostics.js") {
   throw new Error("root package must export @kungfu-tech/buildchain/diagnostics");
 }
+if (rootPackage.exports?.["./buildchain-contract"] !== "./packages/core/buildchain-contract.js") {
+  throw new Error("root package must export @kungfu-tech/buildchain/buildchain-contract");
+}
 if (rootPackage.exports?.["./issue-reporting"] !== "./packages/core/issue-reporting.js") {
   throw new Error("root package must export @kungfu-tech/buildchain/issue-reporting");
 }
@@ -141,6 +144,12 @@ if (!coreIndexSource.includes("collectBuildchainDiagnostics")) {
 if (!coreIndexSource.includes("reportBuildchainIssue")) {
   throw new Error("packages/core/index.js must export reportBuildchainIssue");
 }
+if (!coreIndexSource.includes("createBuildchainContractWorld")) {
+  throw new Error("packages/core/index.js must export Buildchain contract lock APIs");
+}
+if (!coreIndexSource.includes("KFD2_RELEASE_TRUST_PASSPORT_CONTRACT")) {
+  throw new Error("packages/core/index.js must export KFD-2 release trust passport contract");
+}
 for (const requiredSnippet of [
   "createKfd1ReleaseGateEvidence",
   "resolveKfd1Metadata",
@@ -150,6 +159,15 @@ for (const requiredSnippet of [
     throw new Error(`packages/core/index.js must export KFD-1 gate API: ${requiredSnippet}`);
   }
 }
+for (const requiredSnippet of [
+  "createKfd3CollaborationInterfaceReleaseGateEvidence",
+  "resolveKfd3Metadata",
+  "validateKfd3CollaborationInterfaceReleaseGateEvidence",
+]) {
+  if (!coreIndexSource.includes(requiredSnippet)) {
+    throw new Error(`packages/core/index.js must export KFD-3 gate API: ${requiredSnippet}`);
+  }
+}
 for (const requiredSnippet of [
   "surfaceImpacts[]",
   "versionImpact.final",
@@ -168,15 +186,35 @@ for (const requiredSnippet of [
 const releasePassportDoc = fs.readFileSync(path.join(root, "docs/release-passport.md"), "utf8");
 for (const requiredSnippet of [
   "--kfd-1-witness-json",
+  "--kfd-2-claim-json",
   "@kungfu-tech/kfd",
   "currently named `kfd-1`",
   "Buildchain formatting policy",
   "Verification fails closed",
+  "KFD-2 release trust passport audit",
+  "Unbound public claims fail",
+  "Floating Buildchain contract lock",
+  "buildchain.contract-lock.json",
+  "--kfd-3-prebuild-witness-json",
+  "--kfd-3-artifact-verify-cmd",
+  "currently named `kfd-3`",
+  "KFD-3 collaboration-interface release gate",
 ]) {
   if (!releasePassportDoc.includes(requiredSnippet)) {
     throw new Error(`release passport doc missing KFD-1 gate snippet: ${requiredSnippet}`);
   }
 }
+const reusableBuildSurfaceDoc = fs.readFileSync(path.join(root, "docs/reusable-build-surface.md"), "utf8");
+for (const requiredSnippet of [
+  "Floating Ref Contract Lock",
+  "dist/site/buildchain-contract.json",
+  "buildchain-contract-drift-issue-mode",
+  "compatible drift",
+]) {
+  if (!reusableBuildSurfaceDoc.includes(requiredSnippet)) {
+    throw new Error(`reusable build surface doc missing contract lock snippet: ${requiredSnippet}`);
+  }
+}
 for (const [docName, docSource] of Object.entries({ "docs/cli.md": cliDoc, "docs/install.md": installDoc })) {
   for (const requiredSnippet of [
     "minimumReleaseAgeExclude",
@@ -252,10 +290,14 @@ for (const requiredSnippet of [
   "uses: ./.github/workflows/release-candidate-promote.yml",
   "github.event.workflow_run.event == 'push'",
   "target-sha: ${{ github.event.workflow_run.head_sha || inputs.sha || github.sha }}",
+  "github-release: true",
   "publish-required-artifacts-json: \"[]\"",
   "release-passport-impact-json: >-",
-  "Buildchain v2.8 promotes KFD-1 contract-world release gates",
+  "Buildchain v2.8 promotes KFD self-verification",
   "kfd-1-contract-world-release-gate",
+  "kfd-2-release-trust-passport-audit",
+  "kfd-3-collaboration-interface-trust-proof",
+  "publish-source-lock-enforcement",
   "required-check-protection",
   "\"surfaceImpacts\":[",
 ]) {
@@ -267,9 +309,69 @@ const releaseCandidatePromoteWorkflow = fs.readFileSync(path.join(root, ".github
 for (const requiredSnippet of [
   "release-passport-kfd-1-witness-jsons:",
   "release-passport-kfd-1-witness-jsons: ${{ inputs.release-passport-kfd-1-witness-jsons }}",
+  "release-passport-kfd-2-claim-jsons:",
+  "release-passport-kfd-2-claim-jsons: ${{ inputs.release-passport-kfd-2-claim-jsons }}",
+  "release-passport-kfd-3-prebuild-witness-jsons:",
+  "release-passport-kfd-3-prebuild-witness-jsons: ${{ inputs.release-passport-kfd-3-prebuild-witness-jsons }}",
+  "release-passport-kfd-3-artifact-witness-jsons:",
+  "release-passport-kfd-3-artifact-verify-command:",
+  "github-release:",
+  "Publish GitHub Release evidence",
+  "scripts/ensure-github-release.mjs",
+  "gh release upload \"${RELEASE_TAG}\" \"${upload_args[@]}\" --clobber",
+  "require-publish-source-lock: \"true\"",
+  "publish-source-ref: ${{ steps.publish-gate.outputs.ref }}",
+  "publish-source-sha: ${{ steps.publish-gate.outputs.sha }}",
+  "publish-source-locked: ${{ steps.publish-gate.outputs.locked }}",
 ]) {
   if (!releaseCandidatePromoteWorkflow.includes(requiredSnippet)) {
-    throw new Error(`release candidate promote workflow missing KFD-1 gate pass-through: ${requiredSnippet}`);
+    throw new Error(`release candidate promote workflow missing KFD gate pass-through: ${requiredSnippet}`);
+  }
+}
+const workflowDir = path.join(root, ".github/workflows");
+for (const workflowFile of fs.readdirSync(workflowDir).filter((entry) => entry.endsWith(".yml"))) {
+  const workflowPath = path.join(workflowDir, workflowFile);
+  const workflowSource = fs.readFileSync(workflowPath, "utf8");
+  if (!/uses:\s*(?:\.\/\.buildchain\/runtime\/actions\/promote-buildchain-ref|\.\/actions\/promote-buildchain-ref|.*\/actions\/promote-buildchain-ref(?:@|$))/m.test(workflowSource)) {
+    continue;
+  }
+  for (const requiredSnippet of [
+    "require-publish-source-lock:",
+    "publish-source-ref:",
+    "publish-source-sha:",
+    "publish-source-locked:",
+  ]) {
+    if (!workflowSource.includes(requiredSnippet)) {
+      throw new Error(`${workflowFile} calls promote-buildchain-ref without publish source-lock input: ${requiredSnippet}`);
+    }
+  }
+}
+for (const retiredWorkflow of [
+  ".release-new-version.yml",
+  ".release-elastic-beanstalk.yml",
+  ".sam-release.yml",
+  ".wheel-release.yml",
+]) {
+  const retiredSource = fs.readFileSync(path.join(workflowDir, retiredWorkflow), "utf8");
+  for (const requiredSnippet of [
+    "release path is retired",
+    "release-candidate-promote.yml@v2",
+    "publish-gate source-lock enforcement",
+  ]) {
+    if (!retiredSource.includes(requiredSnippet)) {
+      throw new Error(`${retiredWorkflow} must fail closed and point callers at the source-locked release-candidate-promote model: ${requiredSnippet}`);
+    }
+  }
+  for (const forbiddenSnippet of [
+    "npm publish --access=public",
+    "actions/publish-prebuilt@v2",
+    "actions/bump-version@v2",
+    "beanstalk-deploy@",
+    "sam deploy",
+  ]) {
+    if (retiredSource.includes(forbiddenSnippet)) {
+      throw new Error(`${retiredWorkflow} must not keep retired publish side effects: ${forbiddenSnippet}`);
+    }
   }
 }
 for (const forbiddenSnippet of [
@@ -388,7 +490,7 @@ for (const artifact of [
   }
 }
 
-for (const siteFile of ["buildchain-site.json", "site-manifest.json", "cli-registry.json", "release-model.json"]) {
+for (const siteFile of ["buildchain-site.json", "site-manifest.json", "cli-registry.json", "release-model.json", "buildchain-contract.json"]) {
   if (!fs.existsSync(path.join(root, "dist", "site", siteFile))) {
     throw new Error(`site bundle missing ${siteFile}`);
   }

package/scripts/ensure-github-release.mjs

@@ -3,15 +3,15 @@ import { pathToFileURL } from "node:url";
 
 export function classifyReleaseTag(tag) {
   const normalized = String(tag || "").trim();
-  const match = normalized.match(/^v\d+\.\d+\.\d+(?:-alpha\.\d+)?$/);
+  const match = normalized.match(/^v\d+\.\d+\.\d+(?:-[0-9A-Za-z][0-9A-Za-z.-]*)?$/);
   if (!match) {
-    throw new Error(`Unsupported Buildchain release tag: ${tag}`);
+    throw new Error(`Unsupported semver release tag: ${tag}`);
   }
-  const alpha = normalized.includes("-alpha.");
+  const prerelease = normalized.includes("-");
   return {
     tag: normalized,
-    prerelease: alpha,
-    makeLatest: alpha ? "false" : "true",
+    prerelease,
+    makeLatest: prerelease ? "false" : "true",
   };
 }
 

package/scripts/generate-site-bundle.mjs

@@ -2,6 +2,7 @@
 import fs from "node:fs";
 import path from "node:path";
 import { pathToFileURL } from "node:url";
+import { createBuildchainContractWorld } from "../packages/core/buildchain-contract.js";
 
 const SITE_BUNDLE_CONTRACT = "kungfu-buildchain-site-bundle";
 const root = path.resolve(import.meta.dirname, "..");
@@ -146,6 +147,7 @@ function buildSiteBundle() {
       "workflow-registry.json",
       "release-model.json",
       "artifact-schemas.json",
+      "buildchain-contract.json",
       "product-mechanism.json",
       "release-provenance.json",
       "agent-index.json",
@@ -228,6 +230,7 @@ function buildSiteBundle() {
       "cli-registry.json",
       "workflow-registry.json",
       "artifact-schemas.json",
+      "buildchain-contract.json",
     ],
     instruction: "Use this bundle as the package-owned fact source for Buildchain pages. Do not infer current release mechanics from prose alone.",
   };
@@ -252,6 +255,7 @@ function buildSiteBundle() {
     "workflow-registry.json": workflowRegistry,
     "release-model.json": releaseModel,
     "artifact-schemas.json": artifactSchemas,
+    "buildchain-contract.json": createBuildchainContractWorld({ root }),
     "product-mechanism.json": productMechanism,
     "release-provenance.json": releaseProvenance,
     "agent-index.json": agentIndex,

package/scripts/release-candidate-resolver.mjs

@@ -106,7 +106,7 @@ export function selectReleaseCandidateRuns({ runs = [], pullRequest, workflowNam
     const matchesHeadBranch = prHeadBranch
       && runHeadBranch === prHeadBranch
       && (!prHeadRepository || !runHeadRepository || runHeadRepository === prHeadRepository);
-    const matchesPr = matchesPrNumber || matchesHeadSha || matchesHeadBranch;
+    const matchesPr = matchesPrNumber || matchesHeadSha || (!prNumber && !prHeadSha && matchesHeadBranch);
     const matchesWorkflow = !workflowName || run.name === workflowName || run.workflow_name === workflowName;
     return matchesPr && matchesWorkflow && run.event === "pull_request" && run.status === "completed" && run.conclusion === "success";
   });