@kungfu-tech/buildchain 2.8.8-alpha.5 → 2.8.8-alpha.6
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/actions/promote-buildchain-ref/README.md +7 -0
- package/dist/site/buildchain-contract.json +5 -5
- package/dist/site/buildchain-site.json +14 -14
- package/dist/site/manual-registry.json +4 -4
- package/dist/site/page-registry.json +10 -10
- package/dist/site/site-manifest.json +4 -4
- package/docs/lifecycle-protocol.md +6 -4
- package/docs/publish-transaction.md +4 -1
- package/docs/release-governance.md +5 -2
- package/docs/reusable-build-surface.md +7 -3
- package/package.json +1 -1
|
@@ -107,6 +107,7 @@ trusted channel workflow:
|
|
|
107
107
|
- uses: kungfu-systems/buildchain/actions/promote-buildchain-ref@v2
|
|
108
108
|
with:
|
|
109
109
|
token: ${{ secrets.BUILDCHAIN_PROMOTION_TOKEN }}
|
|
110
|
+
generated-ref-update-token: ${{ secrets.BUILDCHAIN_PROMOTION_TOKEN }}
|
|
110
111
|
sha: ${{ github.sha }}
|
|
111
112
|
target-ref: release/v2/v2.0
|
|
112
113
|
publish-transaction: "true"
|
|
@@ -314,6 +315,12 @@ while the reusable build trust gate now checks the source-lock channel HEAD and
|
|
|
314
315
|
merged same-repository PR lineage before heavy build runners start. This action
|
|
315
316
|
still independently rechecks PR lineage, alpha/release tree equivalence, and
|
|
316
317
|
generated version-state verification before moving channel refs and tags.
|
|
318
|
+
Generated version-state direct ref updates can use a separate
|
|
319
|
+
`generated-ref-update-token`; the reusable wrapper defaults it to
|
|
320
|
+
`secrets.BUILDCHAIN_PROMOTION_TOKEN || github.token`. Consumers that protect
|
|
321
|
+
`dev/*`, `alpha/*`, or `release/*` with one required review should configure
|
|
322
|
+
`BUILDCHAIN_PROMOTION_TOKEN` as the bypass-capable release authority, so
|
|
323
|
+
post-publish dev/alpha/release bookkeeping completes without a human PR.
|
|
317
324
|
The reusable `release-candidate-promote.yml` wrapper defaults
|
|
318
325
|
`branch-protection-bypass-apps` to `github-actions`, so flow-internal promotion
|
|
319
326
|
can complete generated `dev`/`alpha`/`release` bookkeeping while ordinary human
|
|
@@ -4,7 +4,7 @@
|
|
|
4
4
|
"product": {
|
|
5
5
|
"name": "Buildchain",
|
|
6
6
|
"package": "@kungfu-tech/buildchain",
|
|
7
|
-
"version": "2.8.8-alpha.
|
|
7
|
+
"version": "2.8.8-alpha.6",
|
|
8
8
|
"repository": "https://github.com/kungfu-systems/buildchain"
|
|
9
9
|
},
|
|
10
10
|
"majorLine": "v2",
|
|
@@ -92,7 +92,7 @@
|
|
|
92
92
|
"GitHub Release passport and evidence publication is delegated to promote-buildchain-ref after the semver release transaction completes"
|
|
93
93
|
],
|
|
94
94
|
"breakingDigest": "sha256:403d2fcdb0c5eabe749e89102defad69745f70a1556707bec7831fcc2e9fa8f8",
|
|
95
|
-
"auditDigest": "sha256:
|
|
95
|
+
"auditDigest": "sha256:277d9e6a9b55986911f8331cfbad1d747631085cc73c3ab207319c52ed29d429"
|
|
96
96
|
},
|
|
97
97
|
{
|
|
98
98
|
"contractVersion": 1,
|
|
@@ -134,7 +134,7 @@
|
|
|
134
134
|
"semver GitHub Releases are created or updated only after transaction completion, with prerelease/latest metadata derived from the exact tag"
|
|
135
135
|
],
|
|
136
136
|
"breakingDigest": "sha256:347b65aecd38bc671d8f697eabd15254f905b6f745389d7b26d7595a904a720c",
|
|
137
|
-
"auditDigest": "sha256:
|
|
137
|
+
"auditDigest": "sha256:159883394a38435e91dcff90e4c039cfccddf5282c874d3847d7dfe9fd64d9cf"
|
|
138
138
|
},
|
|
139
139
|
{
|
|
140
140
|
"contractVersion": 1,
|
|
@@ -320,7 +320,7 @@
|
|
|
320
320
|
"manual entries carry source file digests so downstream sites and agents can detect stale hand-written documentation"
|
|
321
321
|
],
|
|
322
322
|
"breakingDigest": "sha256:7d0d2819e3a3e72989d9c57b5efe9d0bc0a79bc0f2c82a0c7b9d6c5a211a91f2",
|
|
323
|
-
"auditDigest": "sha256:
|
|
323
|
+
"auditDigest": "sha256:0c6b309846916fd75424c98b812e7089ab5382d833836e81d213ac6d3305e7a2"
|
|
324
324
|
},
|
|
325
325
|
{
|
|
326
326
|
"contractVersion": 1,
|
|
@@ -346,5 +346,5 @@
|
|
|
346
346
|
}
|
|
347
347
|
],
|
|
348
348
|
"compatibilityDigest": "sha256:36421b592a782decbfe31a7d8d42d70ce1100a56a2c4f4a0ccc21f0617dc72bf",
|
|
349
|
-
"contractDigest": "sha256:
|
|
349
|
+
"contractDigest": "sha256:e7a1f147962d07f6c8242ce3863058ac71ec02c34f5d18da21bd261b9e5158ec"
|
|
350
350
|
}
|