@kungfu-tech/buildchain 3.0.2-alpha.0 → 3.0.2-alpha.10

package/scripts/reconcile-github-governance.mjs

@@ -90,6 +90,12 @@ function readJson(filePath, label) {
   }
 }
 
+function writeJson(filePath, value) {
+  const target = path.resolve(filePath);
+  fs.mkdirSync(path.dirname(target), { recursive: true });
+  fs.writeFileSync(target, `${JSON.stringify(value, null, 2)}\n`);
+}
+
 function githubApi(route, { method = "GET", body } = {}) {
   const args = [
     "api",
@@ -142,6 +148,42 @@ function readRuleset(repository, rulesetId) {
   return normalizeGithubRulesetSnapshot(response.data);
 }
 
+function readMatchingRulesetEntries(repository, branch) {
+  const response = githubApi(
+    `repos/${repository}/rulesets?includes_parents=false&per_page=100`,
+  );
+  const include = `refs/heads/${branch}`;
+  return (response.data || [])
+    .map((entry) => ({
+      id: Number(entry.id),
+      ruleset: readRuleset(repository, entry.id),
+    }))
+    .filter(({ ruleset }) => {
+      const refName = ruleset.conditions?.ref_name || {};
+      return (
+        ruleset.target === "branch" &&
+        (refName.include || []).length === 1 &&
+        refName.include[0] === include &&
+        (refName.exclude || []).length === 0
+      );
+    })
+    .sort((left, right) => left.ruleset.name.localeCompare(right.ruleset.name));
+}
+
+function readMatchingRulesets(repository, branch) {
+  return readMatchingRulesetEntries(repository, branch).map(
+    ({ ruleset }) => ruleset,
+  );
+}
+
+function rulesetInventory(repository, branch) {
+  return {
+    repository,
+    targetRef: branch,
+    matchingRulesets: readMatchingRulesets(repository, branch),
+  };
+}
+
 function snapshotCore(repository, branch, protection) {
   return {
     schemaVersion: 1,
@@ -200,8 +242,8 @@ function rulesetPlan(args) {
     ...planCore,
     planRoot: githubGovernanceDigest(planCore),
   };
-  fs.writeFileSync(path.resolve(snapshotOutput), `${JSON.stringify(snapshot, null, 2)}\n`);
-  fs.writeFileSync(path.resolve(planOutput), `${JSON.stringify(finalPlan, null, 2)}\n`);
+  writeJson(snapshotOutput, snapshot);
+  writeJson(planOutput, finalPlan);
   return finalPlan;
 }
 
@@ -209,13 +251,45 @@ function rulesetPolicyPlan(args) {
   const repository = required(flag(args, "repository"), "--repository");
   const branch = required(flag(args, "branch"), "--branch")
     .replace(/^refs\/heads\//, "");
-  const rulesetId = Number(required(flag(args, "ruleset-id"), "--ruleset-id"));
-  if (!Number.isInteger(rulesetId) || rulesetId <= 0) {
-    throw new Error("--ruleset-id must be a positive integer");
-  }
+  const requestedRulesetId = flag(args, "ruleset-id");
+  const rulesetName = required(flag(args, "ruleset-name"), "--ruleset-name");
   const snapshotOutput = required(flag(args, "snapshot-output"), "--snapshot-output");
   const planOutput = required(flag(args, "plan-output"), "--plan-output");
-  const before = readRuleset(repository, rulesetId);
+  const matchingEntries = readMatchingRulesetEntries(repository, branch);
+  const inventory = {
+    repository,
+    targetRef: branch,
+    matchingRulesets: matchingEntries.map(({ ruleset }) => ruleset),
+  };
+  let rulesetId = null;
+  let before = null;
+  if (requestedRulesetId) {
+    rulesetId = Number(requestedRulesetId);
+    if (!Number.isInteger(rulesetId) || rulesetId <= 0) {
+      throw new Error("--ruleset-id must be a positive integer");
+    }
+    before = readRuleset(repository, rulesetId);
+    if (
+      !inventory.matchingRulesets.some(
+        (ruleset) =>
+          githubGovernanceDigest(ruleset) === githubGovernanceDigest(before),
+      )
+    ) {
+      throw new Error("--ruleset-id does not target the exact requested branch");
+    }
+  } else if (matchingEntries.length === 1) {
+    before = matchingEntries[0].ruleset;
+    rulesetId = matchingEntries[0].id;
+    if (!Number.isInteger(rulesetId) || rulesetId <= 0) {
+      throw new Error("matching ruleset id could not be resolved");
+    }
+  } else if (inventory.matchingRulesets.length > 1) {
+    throw new Error("multiple exact-target rulesets are ambiguous");
+  } else if (!hasFlag(args, "create-if-missing")) {
+    throw new Error(
+      "exact-target ruleset is absent; pass --create-if-missing to plan creation",
+    );
+  }
   const targetPolicy = resolveGithubGovernanceTargetPolicy({
     repository,
     targetRef: branch,
@@ -225,6 +299,7 @@ function rulesetPolicyPlan(args) {
     contract: "kungfu-buildchain-github-governance-ruleset-rollback-snapshot",
     repository,
     targetRef: branch,
+    rulesetExists: Boolean(before),
     rulesetId,
     ruleset: before,
   };
@@ -236,13 +311,16 @@ function rulesetPolicyPlan(args) {
     repository,
     targetRef: branch,
     rulesetId,
-    inventory: before,
+    rulesetName,
+    inventory,
     rollbackSnapshot: before,
     desiredProtection: {
       strictRequiredChecks: targetPolicy.strictRequiredChecks,
       requiredCheckBindings: targetPolicy.requiredCheckBindings,
       requiredApprovals: targetPolicy.requiredApprovals,
       rulesetBypassActors: [],
+      blockDeletions: hasFlag(args, "block-deletions"),
+      blockNonFastForward: hasFlag(args, "block-non-fast-forward"),
     },
   });
   const boundCore = {
@@ -255,8 +333,8 @@ function rulesetPolicyPlan(args) {
     ...planCore,
     planRoot: githubGovernanceDigest(planCore),
   };
-  fs.writeFileSync(path.resolve(snapshotOutput), `${JSON.stringify(snapshot, null, 2)}\n`);
-  fs.writeFileSync(path.resolve(planOutput), `${JSON.stringify(finalPlan, null, 2)}\n`);
+  writeJson(snapshotOutput, snapshot);
+  writeJson(planOutput, finalPlan);
   return finalPlan;
 }
 
@@ -276,20 +354,29 @@ function rulesetApply(args) {
       snapshotRoot !== githubGovernanceDigest(snapshotCore)) {
     throw new Error("ruleset rollback snapshot root mismatch");
   }
-  const current = readRuleset(rollout.repository, rollout.rulesetId);
-  if (githubGovernanceDigest(current) !== rollout.inventoryRoot) {
+  const currentInventory = rulesetInventory(
+    rollout.repository,
+    rollout.targetRef,
+  );
+  if (githubGovernanceDigest(currentInventory) !== rollout.inventoryRoot) {
     throw new Error("live GitHub ruleset drifted after planning; apply stopped");
   }
-  githubApi(rollout.operations[0].endpoint, {
+  const result = githubApi(rollout.operations[0].endpoint, {
     method: rollout.operations[0].method,
     body: rollout.operations[0].body,
   });
-  const after = readRuleset(rollout.repository, rollout.rulesetId);
+  const rulesetId =
+    rollout.rulesetId ||
+    Number(result.data?.id || 0);
+  if (!Number.isInteger(rulesetId) || rulesetId <= 0) {
+    throw new Error("GitHub did not return the created ruleset id");
+  }
+  const after = readRuleset(rollout.repository, rulesetId);
   const afterRoot = githubGovernanceDigest(after);
   if (afterRoot !== rollout.expectedObservation.rulesetRoot) {
     throw new Error("post-change GitHub ruleset read-back does not match the rollout plan");
   }
-  return {
+  const receiptCore = {
     schemaVersion: 1,
     contract: "kungfu-buildchain-github-governance-ruleset-rollout-receipt",
     status: "applied",
@@ -297,7 +384,21 @@ function rulesetApply(args) {
     snapshotRoot: rollout.snapshotRoot,
     afterRoot,
     repository: rollout.repository,
-    rulesetId: rollout.rulesetId,
+    targetRef: rollout.targetRef,
+    rulesetId,
+    rollback:
+      rollout.action === "create"
+        ? {
+            method: "DELETE",
+            endpoint: rulesetEndpoint(rollout.repository, rulesetId),
+            body: null,
+            preconditionRoot: afterRoot,
+          }
+        : rollout.rollback[0],
+  };
+  return {
+    ...receiptCore,
+    receiptRoot: githubGovernanceDigest(receiptCore),
   };
 }
 
@@ -311,14 +412,46 @@ function rulesetRollback(args) {
   if (rollout.snapshotRoot !== confirmed) {
     throw new Error("--confirm-rollback-root does not match the frozen ruleset snapshot");
   }
-  const operation = rollout.rollback[0];
+  let rulesetId = rollout.rulesetId;
+  let operation = rollout.rollback[0];
+  if (operation.requiresApplyReceipt) {
+    const receipt = readJson(
+      required(flag(args, "apply-receipt"), "--apply-receipt"),
+      "ruleset apply receipt",
+    );
+    const { receiptRoot, ...receiptCore } = receipt;
+    if (
+      receiptRoot !== githubGovernanceDigest(receiptCore) ||
+      receipt.planRoot !== rollout.planRoot ||
+      receipt.repository !== rollout.repository ||
+      receipt.targetRef !== rollout.targetRef
+    ) {
+      throw new Error("ruleset apply receipt does not match the rollout plan");
+    }
+    rulesetId = Number(receipt.rulesetId);
+    operation = receipt.rollback;
+    const current = readRuleset(rollout.repository, rulesetId);
+    if (githubGovernanceDigest(current) !== operation.preconditionRoot) {
+      throw new Error("created ruleset drifted after apply; rollback stopped");
+    }
+  }
   githubApi(operation.endpoint, {
     method: operation.method,
     body: operation.body,
   });
-  const restored = readRuleset(rollout.repository, rollout.rulesetId);
-  if (githubGovernanceDigest(restored) !== operation.preconditionRoot) {
-    throw new Error("ruleset rollback read-back does not match the frozen snapshot");
+  if (operation.method === "DELETE") {
+    const remaining = readMatchingRulesets(
+      rollout.repository,
+      rollout.targetRef,
+    );
+    if (remaining.length !== 0) {
+      throw new Error("created ruleset remains after rollback");
+    }
+  } else {
+    const restored = readRuleset(rollout.repository, rulesetId);
+    if (githubGovernanceDigest(restored) !== operation.preconditionRoot) {
+      throw new Error("ruleset rollback read-back does not match the frozen snapshot");
+    }
   }
   return {
     schemaVersion: 1,
@@ -327,7 +460,7 @@ function rulesetRollback(args) {
     planRoot: rollout.planRoot,
     snapshotRoot: rollout.snapshotRoot,
     repository: rollout.repository,
-    rulesetId: rollout.rulesetId,
+    rulesetId,
   };
 }
 
@@ -368,8 +501,8 @@ function protectionPolicyPlan(args) {
     ...boundCore,
     planRoot: githubGovernanceDigest(boundCore),
   };
-  fs.writeFileSync(path.resolve(snapshotOutput), `${JSON.stringify(snapshotWithRoot, null, 2)}\n`);
-  fs.writeFileSync(path.resolve(planOutput), `${JSON.stringify(finalPlan, null, 2)}\n`);
+  writeJson(snapshotOutput, snapshotWithRoot);
+  writeJson(planOutput, finalPlan);
   return finalPlan;
 }
 
@@ -419,8 +552,8 @@ function plan(args) {
     ...boundCore,
     planRoot: githubGovernanceDigest(boundCore),
   };
-  fs.writeFileSync(path.resolve(snapshotOutput), `${JSON.stringify(snapshotWithRoot, null, 2)}\n`);
-  fs.writeFileSync(path.resolve(planOutput), `${JSON.stringify(finalPlan, null, 2)}\n`);
+  writeJson(snapshotOutput, snapshotWithRoot);
+  writeJson(planOutput, finalPlan);
   return finalPlan;
 }
 

package/scripts/release-candidate-resolver.mjs

@@ -608,6 +608,10 @@ export async function resolveReleaseCandidateArtifacts({
   }
   const passport = JSON.parse(fs.readFileSync(passportPath, "utf8"));
   const platformManifestPaths = findDownloadedFiles(payloadDir, "manifest.json");
+  const githubArtifactAttestationPolicyPaths = findDownloadedFiles(
+    payloadDir,
+    "github-artifact-attestation-policy.json",
+  );
   const npmTarballPaths = publishArtifactKind === "npm"
     ? findDownloadedFilesByExtension(payloadDir, [".tgz"])
     : [];
@@ -639,6 +643,7 @@ export async function resolveReleaseCandidateArtifacts({
       buildSummary: outputPath(buildSummaryPath),
       payloads: outputPath(payloadDir),
       platformManifests: platformManifestPaths.map(outputPath),
+      githubArtifactAttestationPolicies: githubArtifactAttestationPolicyPaths.map(outputPath),
       npmTarballs: npmTarballPaths.map(outputPath),
       releaseAssets: releaseAssetPaths.map(outputPath),
       publishRequiredArtifacts: outputPath(requiredArtifactsPath),
@@ -647,6 +652,7 @@ export async function resolveReleaseCandidateArtifacts({
     candidateHash: passport.candidateHash || "",
     payloadCount: payloadArtifacts.length,
     platformManifestCount: platformManifestPaths.length,
+    githubArtifactAttestationPolicyCount: githubArtifactAttestationPolicyPaths.length,
     npmTarballCount: npmTarballPaths.length,
     publishRequiredArtifacts: generatedRequiredArtifacts,
   };
@@ -684,6 +690,12 @@ export async function resolveReleaseCandidateArtifactsCli() {
     "release-candidate-payload-dir": result.paths?.payloads || "",
     "release-candidate-platform-manifest-paths": (result.paths?.platformManifests || []).join(","),
     "release-candidate-platform-manifest-count": String(result.platformManifestCount || 0),
+    "release-candidate-github-artifact-attestation-policy-paths": (
+      result.paths?.githubArtifactAttestationPolicies || []
+    ).join(","),
+    "release-candidate-github-artifact-attestation-policy-count": String(
+      result.githubArtifactAttestationPolicyCount || 0,
+    ),
     "release-candidate-npm-tarball-paths": (result.paths?.npmTarballs || []).join(","),
     "release-candidate-npm-tarball-count": String(result.npmTarballCount || 0),
     "release-candidate-github-release-artifact-paths": (

package/scripts/release-line-policy.mjs

@@ -70,6 +70,18 @@ export function parsePublishGateChannelRef(ref) {
   };
 }
 
+export function parseAuthorityRef(ref) {
+  const normalizedRef = normalizeRef(ref);
+  const match = normalizedRef.match(/^authority\/v(\d+)\/v(\d+\.\d+)\/[A-Za-z0-9._/-]+$/);
+  if (!match) return undefined;
+  return {
+    major: Number(match[1]),
+    loose: Number(match[2]),
+    normalizedRef,
+    lineSuffix: `/v${match[1]}/v${match[2]}`,
+  };
+}
+
 export function getChannel(ref) {
   const versionStateTarget = parseVersionStateRef(ref);
   if (versionStateTarget) return versionStateTarget.channel;
@@ -116,6 +128,7 @@ export function getBumpKeyword({ cwd = process.cwd(), headRef, baseRef, loose =
   const versionStateTarget = parseVersionStateRef(headRef);
   const releaseLineRecoveryTarget = parseReleaseLineRecoveryRef(headRef);
   const publishGateTarget = parsePublishGateChannelRef(headRef);
+  const authorityTarget = parseAuthorityRef(baseRef);
   const headChannel = getChannel(headRef);
   const baseChannel = getChannel(baseRef);
   const key = `${headChannel}->${baseChannel}`;
@@ -130,6 +143,20 @@ export function getBumpKeyword({ cwd = process.cwd(), headRef, baseRef, loose =
   const preminor = headChannel === "release" && lts;
   const majorGate = headChannel === "release" && baseChannel === MAJOR_GATE_CHANNEL;
 
+  if (authorityTarget) {
+    const headMatch = normalizeRef(headRef).match(/^dev\/v(\d+)\/v(\d+\.\d+)$/);
+    if (
+      !headMatch ||
+      Number(headMatch[1]) !== authorityTarget.major ||
+      Number(headMatch[2]) !== authorityTarget.loose ||
+      version.major !== authorityTarget.major ||
+      looseVersionNumber !== authorityTarget.loose
+    ) {
+      throw new Error(`Versions not match for head/base refs: ${headRef} -> ${baseRef}`);
+    }
+    return "none";
+  }
+
   if (releaseLineRecoveryTarget) {
     if (baseChannel !== "release" || releaseLineRecoveryTarget.normalizedRef !== normalizeRef(baseRef)) {
       throw new Error(`Versions not match for head/base refs: ${headRef} -> ${baseRef}`);

package/scripts/runtime-ref-core.mjs

@@ -1,5 +1,6 @@
 const EXACT_SHA_RE = /^[0-9a-f]{40}$/i;
 const TRAIN_REF_RE = /^train\/v\d+\/v\d+\.\d+\/[A-Za-z0-9._/-]+$/;
+const AUTHORITY_REF_RE = /^authority\/v\d+\/v\d+\.\d+\/[A-Za-z0-9._/-]+$/;
 const OFFICIAL_CHANNEL_REF_RE = /^v\d+(?:\.\d+)?(?:-alpha)?$/;
 
 export function parseWorkflowShellRef(workflowRef = "", fallback = "v2", buildchainRepository = "kungfu-systems/buildchain") {
@@ -20,6 +21,9 @@ export function classifyBuildchainRuntimeRef(ref = "") {
   if (TRAIN_REF_RE.test(value)) {
     return "train";
   }
+  if (AUTHORITY_REF_RE.test(value)) {
+    return "authority";
+  }
   if (/^v\d+(?:\.\d+)?$/.test(value) || /^v\d+\.\d+\.\d+$/.test(value)) {
     return "stable";
   }
@@ -58,16 +62,16 @@ export function normalizeRequestedRuntimeRef(requestedRef = "") {
       officialChannel: false,
     };
   }
-  const trainRef = requested.replace(/^refs\/heads\//, "");
-  if (!TRAIN_REF_RE.test(trainRef)) {
+  const protectedRef = requested.replace(/^refs\/heads\//, "");
+  if (!TRAIN_REF_RE.test(protectedRef) && !AUTHORITY_REF_RE.test(protectedRef)) {
     throw new Error(
-      "buildchain-ref override must be train/vN/vN.M/<capability>, refs/heads/train/vN/vN.M/<capability>, or an exact 40-character SHA",
+      "buildchain-ref override must be train/vN/vN.M/<capability>, refs/heads/train/vN/vN.M/<capability>, authority/vN/vN.M/<capability>, refs/heads/authority/vN/vN.M/<capability>, or an exact 40-character SHA",
     );
   }
   return {
-    ref: trainRef,
-    fullRef: `refs/heads/${trainRef}`,
-    class: "train",
+    ref: protectedRef,
+    fullRef: `refs/heads/${protectedRef}`,
+    class: AUTHORITY_REF_RE.test(protectedRef) ? "authority" : "train",
     exactSha: false,
     officialChannel: false,
   };