@kungfu-tech/buildchain 2.8.6 → 2.8.7-alpha.1

package/dist/site/buildchain-contract.json

@@ -4,7 +4,7 @@
   "product": {
     "name": "Buildchain",
     "package": "@kungfu-tech/buildchain",
-    "version": "2.8.6",
+    "version": "2.8.7-alpha.1",
     "repository": "https://github.com/kungfu-systems/buildchain"
   },
   "majorLine": "v2",
@@ -92,7 +92,7 @@
         "GitHub Release passport and evidence publication is delegated to promote-buildchain-ref after the semver release transaction completes"
       ],
       "breakingDigest": "sha256:403d2fcdb0c5eabe749e89102defad69745f70a1556707bec7831fcc2e9fa8f8",
-      "auditDigest": "sha256:b6dd734ffe4dbd705ab4cfbc209e169400c89158b52eab594f6bf6738b0b47ec"
+      "auditDigest": "sha256:320dd5103edabbb9c4e1a9ccdf314db3a74cc9049a7e66bf49a8820286e2cc7d"
     },
     {
       "contractVersion": 1,
@@ -320,7 +320,7 @@
         "manual entries carry source file digests so downstream sites and agents can detect stale hand-written documentation"
       ],
       "breakingDigest": "sha256:7d0d2819e3a3e72989d9c57b5efe9d0bc0a79bc0f2c82a0c7b9d6c5a211a91f2",
-      "auditDigest": "sha256:d0401a021d68a3ab06d312c55278e84282cebedce46bf1a4b010adf0c48e72d8"
+      "auditDigest": "sha256:d5288916e9e83d773188f40713ade69e9ba8418886205727c2290aca512dda0f"
     },
     {
       "contractVersion": 1,
@@ -346,5 +346,5 @@
     }
   ],
   "compatibilityDigest": "sha256:36421b592a782decbfe31a7d8d42d70ce1100a56a2c4f4a0ccc21f0617dc72bf",
-  "contractDigest": "sha256:e414a6ea720b352d80a1839d148f8e5c81ce6706dc3c11ede887add9d54974d4"
+  "contractDigest": "sha256:2f9b2f7c688818a6255d5f13059eedd0c23059f1daddecafd95ef4b9e60250a0"
 }

package/dist/site/buildchain-site.json

@@ -105,7 +105,7 @@
       "path": "docs/reusable-build-surface.md",
       "plane": "use",
       "exists": true,
-      "digest": "sha256:e5b2222fddd0624b6aff1c999bb156df26eebbd7b365ec65ef3622611dc055ea"
+      "digest": "sha256:8c3e7a5e099c8eb0715bb6f58af90d261f8cb83d384f3281b8763f340277582b"
     },
     {
       "id": "publish-transaction",
@@ -121,7 +121,7 @@
       "path": "docs/release-governance.md",
       "plane": "why",
       "exists": true,
-      "digest": "sha256:8aab1af617e511011974cb63f04240463fc99c427cb3b29e5f5d385c88620464"
+      "digest": "sha256:c7348c64e83ea1d154955e2fc0f7318a1c5582a3dfa6bdc5728958ddb418e92d"
     },
     {
       "id": "release-flow",

package/dist/site/manual-registry.json

@@ -72,7 +72,7 @@
       "title": "Reusable build surface",
       "path": "docs/reusable-build-surface.md",
       "plane": "use",
-      "digest": "sha256:e5b2222fddd0624b6aff1c999bb156df26eebbd7b365ec65ef3622611dc055ea"
+      "digest": "sha256:8c3e7a5e099c8eb0715bb6f58af90d261f8cb83d384f3281b8763f340277582b"
     },
     {
       "id": "publish-transaction",
@@ -86,7 +86,7 @@
       "title": "Release governance",
       "path": "docs/release-governance.md",
       "plane": "why",
-      "digest": "sha256:8aab1af617e511011974cb63f04240463fc99c427cb3b29e5f5d385c88620464"
+      "digest": "sha256:c7348c64e83ea1d154955e2fc0f7318a1c5582a3dfa6bdc5728958ddb418e92d"
     },
     {
       "id": "release-flow",

package/dist/site/site-manifest.json

@@ -90,7 +90,7 @@
       "path": "docs/reusable-build-surface.md",
       "plane": "use",
       "exists": true,
-      "digest": "sha256:e5b2222fddd0624b6aff1c999bb156df26eebbd7b365ec65ef3622611dc055ea"
+      "digest": "sha256:8c3e7a5e099c8eb0715bb6f58af90d261f8cb83d384f3281b8763f340277582b"
     },
     {
       "id": "publish-transaction",
@@ -106,7 +106,7 @@
       "path": "docs/release-governance.md",
       "plane": "why",
       "exists": true,
-      "digest": "sha256:8aab1af617e511011974cb63f04240463fc99c427cb3b29e5f5d385c88620464"
+      "digest": "sha256:c7348c64e83ea1d154955e2fc0f7318a1c5582a3dfa6bdc5728958ddb418e92d"
     },
     {
       "id": "release-flow",

package/docs/release-candidate.md

@@ -82,13 +82,14 @@ other package as `role: platform`. Consumer workflows therefore stay
 declarative and do not need their own artifact download or publish-evidence
 generation scripts.
 
-When `github-release: true`, the wrapper forwards GitHub Release publication to
-the underlying `promote-buildchain-ref` semver model. Once the release
-transaction is complete, the action creates or updates the exact-tag GitHub
-Release, applies prerelease/latest metadata from the semver tag, and uploads the
-publish evidence file together with the generated release passport assets. This
-keeps npm/registry publication, Buildchain release passport persistence, and
-`release.published` propagation in one declarative reusable workflow.
+By default, the wrapper forwards GitHub Release publication to the underlying
+`promote-buildchain-ref` semver model. Once the release transaction is complete,
+the action creates or updates the exact-tag GitHub Release, applies
+prerelease/latest metadata from the semver tag, and uploads the publish evidence
+file together with the generated release passport assets. This keeps
+npm/registry publication, Buildchain release passport persistence, and
+`release.published` propagation in one declarative reusable workflow. Consumers
+that do not publish GitHub Releases can opt out with `github-release: false`.
 
 Products that publish KFD release trust evidence can keep that path declarative
 too. Pass KFD-1 self contract witnesses, KFD-2 public claim files, and KFD-3
@@ -101,7 +102,6 @@ jobs:
     with:
       channel: alpha
       artifact-name: libnode
-      github-release: true
       release-passport-kfd-1-witness-jsons: .buildchain/kfd-1/standard-contract.witness.json
       release-passport-kfd-2-claim-jsons: .buildchain/kfd-2/release-claims.json
       release-passport-kfd-3-prebuild-witness-jsons: .buildchain/kfd-3/collaboration-interface.prebuild.json

package/docs/release-governance.md

@@ -442,7 +442,8 @@ publication models.
 
 Semver GitHub Release publication is owned by `promote-buildchain-ref`, not by
 consumer shell glue. Consumers normally use the `release-candidate-promote.yml`
-wrapper and set `github-release: true`; the wrapper passes that declaration to
+wrapper, where GitHub Release publication is enabled by default and can be
+disabled with `github-release: false`; the wrapper passes that declaration to
 the action. After the publish transaction reaches `complete`, Buildchain creates
 or updates the exact-tag GitHub Release and uploads the generated
 `buildchain.release.json`, release-passport assets, and publish evidence. Semver

package/docs/reusable-build-surface.md

@@ -570,15 +570,16 @@ resolution and before publish. A compatible `v2` drift leaves an issue in the
 consumer repository but does not trigger a second heavy build; an incompatible
 drift fails before publish side effects.
 
-Set `github-release: true` when the promoted exact tag should also publish a
-GitHub Release. After `promote-buildchain-ref` reports a complete release
-transaction, the wrapper creates or updates the exact-tag release, marks semver
-prerelease tags such as `v1.2.3-alpha.0`, `v1.2.3-rc.1`, or
-`v22.22.3-kf.3-alpha.7` as `prerelease=true` and `make_latest=false`, marks
-stable semver tags as latest, and uploads the publish evidence file plus every
-file in the generated release passport directory, including
-`buildchain.release.json` and `check-report.json`. Consumers do not need to
-hand-write `gh release` logic to trigger `release.published` propagation.
+The wrapper publishes the promoted exact tag as a GitHub Release by default.
+After `promote-buildchain-ref` reports a complete release transaction, the
+wrapper creates or updates the exact-tag release, marks semver prerelease tags
+such as `v1.2.3-alpha.0`, `v1.2.3-rc.1`, or `v22.22.3-kf.3-alpha.7` as
+`prerelease=true` and `make_latest=false`, marks stable semver tags as latest,
+and uploads the publish evidence file plus every file in the generated release
+passport directory, including `buildchain.release.json` and `check-report.json`.
+Consumers do not need to hand-write `gh release` logic to trigger
+`release.published` propagation. Set `github-release: false` only for
+repositories that intentionally do not maintain GitHub Releases.
 If the transaction still needs protected-ref finalization, the wrapper defers
 GitHub Release creation until the later run that reaches `state=complete`.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kungfu-tech/buildchain",
-  "version": "2.8.6",
+  "version": "2.8.7-alpha.1",
   "private": false,
   "description": "Buildchain Release Passport, release governance, CLI toolkit, and site facts.",
   "repository": "https://github.com/kungfu-systems/buildchain",

package/scripts/check-inventory.mjs

@@ -363,6 +363,7 @@ for (const requiredSnippet of [
   "Generate Buildchain self KFD release claims",
   "generate-buildchain-kfd-witnesses.mjs",
   "github-release:",
+  "default: true",
   "github-release: ${{ inputs.github-release }}",
   "github-release-title: ${{ inputs.github-release-title }}",
   "github-release-notes: ${{ inputs.github-release-notes }}",