@kungfu-tech/buildchain 3.0.1-alpha.4 → 3.0.1-alpha.6

package/dist/site/workflow-registry.json

@@ -100,6 +100,7 @@
         "checkout-cache-mode",
         "checkout-cache-reference-repository-template",
         "checkout-cache-timeout-seconds",
+        "control-runner-json",
         "credential-island-caller-owned",
         "credential-island-environment",
         "credential-island-macos-app-path",
@@ -140,7 +141,7 @@
         "verify-command",
         "working-directory"
       ],
-      "inputCount": 65,
+      "inputCount": 66,
       "secrets": [
         "BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN",
         "BUILDCHAIN_ARTIFACT_RELAY_S3_ROLE_ARN",
@@ -226,6 +227,7 @@
         "artifact-retention-days",
         "buildchain-ref",
         "buildchain-repository",
+        "cargo-registry-index",
         "checkout-cache-fallback",
         "checkout-cache-fetch-attempts",
         "checkout-cache-github-timeout-seconds",
@@ -243,13 +245,16 @@
         "platforms-json",
         "require-trusted-event",
         "runner-preset",
+        "rust-toolchain",
+        "rustup-dist-server",
+        "rustup-update-root",
         "shifu-cache-profile-digest",
         "shifu-cache-profile-ref",
         "source-ref",
         "untrusted-policy",
         "working-directory"
       ],
-      "inputCount": 26,
+      "inputCount": 30,
       "secrets": [],
       "secretCount": 0,
       "outputs": [
@@ -914,6 +919,7 @@
         "checkout-cache-mode",
         "checkout-cache-reference-repository-template",
         "checkout-cache-timeout-seconds",
+        "control-runner-json",
         "credential-island-caller-owned",
         "credential-island-environment",
         "credential-island-macos-app-path",
@@ -954,7 +960,7 @@
         "verify-command",
         "working-directory"
       ],
-      "inputCount": 68,
+      "inputCount": 69,
       "secrets": [
         "BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN",
         "BUILDCHAIN_ARTIFACT_RELAY_S3_ROLE_ARN",

package/docs/reusable-build-surface.md

@@ -1151,6 +1151,24 @@ with:
 Do not set `require-trusted-event: false` for workflows that use self-hosted
 runners or secrets.
 
+The build matrix and the workflow control plane are routed independently. The
+matrix continues to use `runner-preset` and `platforms-json`. Consumers with a
+governed runner may also move channel resolution, trust evaluation, contract
+resolution, controller evidence, artifact transfer, and aggregation off the
+default GitHub-hosted runner:
+
+```yaml
+with:
+  control-runner-json: '["self-hosted","agent-120"]'
+  runner-preset: custom
+  platforms-json: '[{"id":"linux-x64","name":"Linux x64","runner":"[\"self-hosted\",\"agent-120\"]"}]'
+```
+
+`control-runner-json` is additive and defaults to `["ubuntu-24.04"]`. Keep
+`require-trusted-event: true` whenever either runner input selects
+`self-hosted`; a self-hosted control plane must not be exposed to untrusted fork
+events or arbitrary caller-controlled workflow code.
+
 `require-trusted-event` controls access to build runners. It does not override
 the publish gate: pull requests remain non-publishing events.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kungfu-tech/buildchain",
-  "version": "3.0.1-alpha.4",
+  "version": "3.0.1-alpha.6",
   "private": false,
   "description": "Buildchain Release Passport, release governance, CLI toolkit, and site facts.",
   "repository": "https://github.com/kungfu-systems/buildchain",

package/scripts/generate-channel-build-workflow.mjs

@@ -93,7 +93,7 @@ function routerControllerPlanJob() {
   return `  controller-plan:
     name: Plan channel router controller evidence
     needs: resolve-channel
-    runs-on: ubuntu-24.04
+    runs-on: \${{ fromJSON(inputs.control-runner-json) }}
     outputs:
       controller-plan-artifact: \${{ steps.names.outputs.controller-plan-artifact }}
       controller-plan-json: \${{ steps.plan.outputs.controller-plan-json }}
@@ -156,7 +156,7 @@ function routerControllerReceiptJob() {
       - controller-plan
       - build
     if: \${{ always() && needs.controller-plan.result == 'success' }}
-    runs-on: ubuntu-24.04
+    runs-on: \${{ fromJSON(inputs.control-runner-json) }}
     outputs:
       controller-receipt-artifact: \${{ steps.names.outputs.controller-receipt-artifact }}
       controller-receipt-json: \${{ steps.receipt.outputs.controller-receipt-json }}
@@ -218,7 +218,7 @@ function routerAggregateJob() {
       - build
       - controller-receipt
     if: \${{ always() }}
-    runs-on: ubuntu-24.04
+    runs-on: \${{ fromJSON(inputs.control-runner-json) }}
     steps:
       - name: Enforce public channel router aggregate
         shell: bash
@@ -295,6 +295,7 @@ function bindRouterCheckoutToWorkflowSha(workflow) {
 
 export function generateChannelBuildWorkflow(source) {
   const generated = bindRouterCheckoutToWorkflowSha(generateChannelBuildWorkflowBase(source))
+    .replaceAll("runs-on: ubuntu-24.04", "runs-on: ${{ fromJSON(inputs.control-runner-json) }}")
     .replace(
       "\npermissions:\n  contents: read\n",
       "\npermissions:\n  actions: read\n  contents: read\n",