@kungfu-tech/buildchain 3.0.2-alpha.0 → 3.0.2-alpha.10

package/scripts/build-contract-core.mjs

@@ -31,6 +31,36 @@ export const RUNNER_PRESETS = Object.freeze({
       capabilities: ["node", "native-toolchain", "product-artifacts", "rust"],
     },
   ],
+  "kungfu-v4-native": [
+    {
+      id: "linux-x64",
+      name: "Linux x64",
+      platform: "linux",
+      runner: '["self-hosted","Linux","X64","kungfu-build-v4-linux-x64"]',
+      capabilities: ["node", "native-toolchain", "product-artifacts", "rust"],
+    },
+    {
+      id: "linux-arm64",
+      name: "Linux ARM64",
+      platform: "linux",
+      runner: '["ubuntu-24.04-arm"]',
+      capabilities: ["node", "native-toolchain", "product-artifacts", "rust"],
+    },
+    {
+      id: "macos-arm64",
+      name: "macOS ARM64",
+      platform: "macos",
+      runner: '["self-hosted","macOS","ARM64","kungfu-build-v4-macos-arm64"]',
+      capabilities: ["node", "native-toolchain", "product-artifacts", "rust"],
+    },
+    {
+      id: "windows-x64",
+      name: "Windows x64",
+      platform: "windows",
+      runner: '["self-hosted","Windows","X64","kungfu-build-v4-windows-x64"]',
+      capabilities: ["node", "native-toolchain", "product-artifacts", "rust"],
+    },
+  ],
 });
 
 export const LINUX_CONTAINER_PRESETS = Object.freeze({
@@ -46,6 +76,7 @@ const RUNNER_PRESET_ALIASES = Object.freeze({
   kungfu: "kungfu-v4-self-hosted",
   "kungfu-self-hosted": "kungfu-v4-self-hosted",
   "kungfu-v4": "kungfu-v4-self-hosted",
+  "kungfu-v4-four-platform": "kungfu-v4-native",
 });
 
 const LINUX_CONTAINER_PRESET_ALIASES = Object.freeze({

package/scripts/buildchain-channel-router.mjs

@@ -9,6 +9,7 @@ const STABLE_PUBLISH_CHANNELS = new Set(["release", "major"]);
 const OFFICIAL_REF = /^v(\d+)(?:\.\d+)?(?:-alpha)?$/;
 const EXACT_SHA = /^[0-9a-f]{40}$/i;
 const TRAIN_REF = /^(?:refs\/heads\/)?train\/v(\d+)\/v\d+\.\d+\/[A-Za-z0-9._/-]+$/;
+const AUTHORITY_REF = /^(?:refs\/heads\/)?authority\/v(\d+)\/v\d+\.\d+\/[A-Za-z0-9._/-]+$/;
 const SEMVER_TAG = /^refs\/tags\/v?\d+\.\d+\.\d+(?:-([0-9A-Za-z.-]+))?$/;
 
 function normalized(value) {
@@ -36,6 +37,8 @@ function majorFrom(value) {
   if (official) return Number(official[1]);
   const train = text.match(TRAIN_REF);
   if (train) return Number(train[1]);
+  const authority = text.match(AUTHORITY_REF);
+  if (authority) return Number(authority[1]);
   const embedded = text.match(/(?:^|\/)v(\d+)(?:$|[./-])/);
   if (embedded) return Number(embedded[1]);
   const version = text.match(/^(\d+)\.\d+\.\d+/);
@@ -57,6 +60,9 @@ function classifyRequestedRef(value) {
   if (TRAIN_REF.test(value) || TRAIN_REF.test(ref)) {
     return { kind: "override", ref: normalized(value).replace(/^refs\/heads\//, "") };
   }
+  if (AUTHORITY_REF.test(value) || AUTHORITY_REF.test(ref)) {
+    return { kind: "override", ref: normalized(value).replace(/^refs\/heads\//, "") };
+  }
   const official = ref.match(OFFICIAL_REF);
   if (official) {
     return {
@@ -65,7 +71,7 @@ function classifyRequestedRef(value) {
       major: Number(official[1]),
     };
   }
-  throw new Error("buildchain-ref must be an official vN/vN.M channel, a train ref, or an exact 40-character SHA");
+  throw new Error("buildchain-ref must be an official vN/vN.M channel, a train ref, an authority ref, or an exact 40-character SHA");
 }
 
 function selected(channel, major, source, reason) {
@@ -100,7 +106,7 @@ export function resolveBuildchainChannel({
       throw new Error(`buildchain-channel=${channel} conflicts with buildchain-ref=${explicitRef.ref}`);
     }
     if (channel !== "auto" && explicitRef.kind === "override") {
-      throw new Error("train and exact-SHA buildchain-ref overrides require buildchain-channel=auto");
+      throw new Error("train, authority, and exact-SHA buildchain-ref overrides require buildchain-channel=auto");
     }
     return {
       channel: explicitRef.kind,

package/scripts/check-inventory.mjs

@@ -68,8 +68,14 @@ const requiredPaths = [
   "docs/product-mechanism.md",
   "docs/readme-badges.md",
   "docs/release-passport.md",
+  "docs/github-artifact-attestation.md",
   "docs/shifu-gate-profiles.md",
   "docs/auditable-demo.md",
+  "contracts/auditable-demo-media-profiles-v1.json",
+  "contracts/evidence/auditable-demo-web-delivery-v1.json",
+  "contracts/fixtures/auditable-demo-web-delivery-v1/complete-transcript.txt",
+  "contracts/fixtures/auditable-demo-web-delivery-v1/public-projection.json",
+  "contracts/fixtures/auditable-demo-web-delivery-v1/scene.json",
   "docs/release-propagation.md",
   "docs/site-bundle-contract.md",
   "docs/toolkit-observability.md",
@@ -358,6 +364,9 @@ if (rootPackage.exports?.["./kfd-gate"] !== "./packages/core/kfd-gate.js") {
 if (rootPackage.exports?.["./release-passport"] !== "./packages/core/release-passport.js") {
   throw new Error("root package must export @kungfu-tech/buildchain/release-passport");
 }
+if (rootPackage.exports?.["./github-artifact-attestation"] !== "./packages/core/github-artifact-attestation.js") {
+  throw new Error("root package must export @kungfu-tech/buildchain/github-artifact-attestation");
+}
 if (rootPackage.exports?.["./release-passport-contract"] !== "./packages/core/release-passport-contract.js") {
   throw new Error("root package must export @kungfu-tech/buildchain/release-passport-contract");
 }

package/scripts/create-github-artifact-attestation-policy.mjs

@@ -0,0 +1,62 @@
+#!/usr/bin/env node
+
+import fs from "node:fs";
+import path from "node:path";
+import process from "node:process";
+
+import {
+  GITHUB_ARTIFACT_ATTESTATION_WORKFLOW,
+  createGitHubArtifactAttestationPolicy,
+  githubArtifactAttestationSha256File,
+} from "../packages/core/github-artifact-attestation.js";
+
+function env(name, fallback = "") {
+  return String(process.env[name] || fallback).trim();
+}
+
+function required(name) {
+  const value = env(name);
+  if (!value) throw new Error(`${name} is required`);
+  return value;
+}
+
+const cwd = path.resolve(env("BUILDCHAIN_SOURCE_CWD", "."));
+const subjectRelativePath = required("BUILDCHAIN_GITHUB_ATTESTATION_SUBJECT_PATH").replace(/\\/g, "/");
+const subjectPath = path.resolve(cwd, subjectRelativePath);
+const manifestPath = path.resolve(required("BUILDCHAIN_GITHUB_ATTESTATION_PLATFORM_MANIFEST"));
+const outputPath = path.resolve(required("BUILDCHAIN_GITHUB_ATTESTATION_POLICY_OUTPUT"));
+const manifest = JSON.parse(fs.readFileSync(manifestPath, "utf8"));
+const manifestEntry = (manifest.files || []).find((entry) => (
+  String(entry.path || "").replace(/\\/g, "/") === subjectRelativePath
+));
+if (!manifestEntry) throw new Error(`platform manifest does not contain ${subjectRelativePath}`);
+const digest = githubArtifactAttestationSha256File(subjectPath);
+const size = fs.statSync(subjectPath).size;
+if (`sha256:${String(manifestEntry.sha256 || "").toLowerCase()}` !== digest || Number(manifestEntry.size) !== size) {
+  throw new Error("subject bytes do not match the final platform manifest");
+}
+const manifestDigest = githubArtifactAttestationSha256File(manifestPath);
+const runtimeSha = required("BUILDCHAIN_RUNTIME_SHA").toLowerCase();
+const signerSha = required("BUILDCHAIN_GITHUB_ATTESTATION_SIGNER_SHA").toLowerCase();
+const policy = createGitHubArtifactAttestationPolicy({
+  subject: { name: path.basename(subjectPath), path: subjectRelativePath, size, digest },
+  caller: {
+    repository: required("BUILDCHAIN_SOURCE_REPOSITORY"),
+    sourceSha: required("BUILDCHAIN_SOURCE_SHA").toLowerCase(),
+    sourceTreeSha: required("BUILDCHAIN_SOURCE_TREE_SHA").toLowerCase(),
+  },
+  signer: {
+    repository: "kungfu-systems/buildchain",
+    workflowPath: GITHUB_ARTIFACT_ATTESTATION_WORKFLOW,
+    workflowDigest: signerSha,
+  },
+  build: {
+    platform: required("BUILDCHAIN_PLATFORM_ID"),
+    platformManifestDigest: manifestDigest,
+    runnerReceiptRoot: manifestDigest,
+    buildchainRuntimeSha: runtimeSha,
+  },
+});
+fs.mkdirSync(path.dirname(outputPath), { recursive: true });
+fs.writeFileSync(outputPath, `${JSON.stringify(policy, null, 2)}\n`);
+process.stdout.write(`github-artifact-attestation-policy=${outputPath}\n`);