@kungfu-tech/buildchain 3.0.2-alpha.0 → 3.0.2-alpha.10

package/dist/site/public-surface-audit.json

@@ -3,11 +3,11 @@
   "contract": "kungfu-buildchain-public-surface-reverse-audit",
   "status": "passed",
   "summary": {
-    "cliCommandCount": 96,
-    "workflowCount": 53,
-    "actionCount": 5,
-    "sitePageCount": 56,
-    "docCommandRefCount": 286,
+    "cliCommandCount": 97,
+    "workflowCount": 57,
+    "actionCount": 6,
+    "sitePageCount": 59,
+    "docCommandRefCount": 291,
     "failureCount": 0
   },
   "enumerated": {
@@ -462,6 +462,11 @@
         "source": "bin/buildchain.mjs",
         "usage": "buildchain verify artifact-envelope <file-or-json> [--assessment-time <epoch>]"
       },
+      {
+        "id": "verify-github-artifact-attestation",
+        "source": "bin/buildchain.mjs",
+        "usage": "buildchain verify github-artifact-attestation <artifact>"
+      },
       {
         "id": "verify-infra-contract-evidence-bundle",
         "source": "bin/buildchain.mjs",
@@ -502,6 +507,7 @@
           "adapter-path",
           "artifact-retention-days",
           "buildchain-repository",
+          "media-profile",
           "render-media",
           "renderer-image",
           "require-trusted-event",
@@ -509,7 +515,7 @@
           "source-artifact-name",
           "source-ref"
         ],
-        "inputCount": 9,
+        "inputCount": 10,
         "secrets": [],
         "secretCount": 0,
         "outputs": [
@@ -522,10 +528,12 @@
           "media-artifact-id",
           "media-artifact-name",
           "media-artifact-url",
+          "media-profile",
+          "media-qualification-root",
           "media-root",
           "source-sha"
         ],
-        "outputCount": 11
+        "outputCount": 13
       },
       {
         "id": ".binary-release-assets",
@@ -577,6 +585,9 @@
           "buildchain-contract-lock-path",
           "buildchain-ref",
           "buildchain-repository",
+          "cache-dependency-lock-root",
+          "cache-policy-root",
+          "cache-toolchain-root",
           "cargo-registry-index",
           "checkout-cache-fallback",
           "checkout-cache-fetch-attempts",
@@ -593,6 +604,9 @@
           "expected-artifacts-json",
           "fail-fast",
           "gate-profile-aggregate-json",
+          "github-artifact-attestation-platform-id",
+          "github-artifact-attestation-signer-sha",
+          "github-artifact-attestation-subject-path",
           "install-command",
           "kfd-agent-hub",
           "lifecycle-timeout-minutes",
@@ -626,7 +640,7 @@
           "verify-command",
           "working-directory"
         ],
-        "inputCount": 66,
+        "inputCount": 72,
         "secrets": [
           "BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN",
           "BUILDCHAIN_ARTIFACT_RELAY_S3_ROLE_ARN",
@@ -635,9 +649,10 @@
           "BUILDCHAIN_MACOS_CERTIFICATE_PASSWORD",
           "BUILDCHAIN_MACOS_NOTARY_API_ISSUER",
           "BUILDCHAIN_MACOS_NOTARY_API_KEY_ID",
-          "BUILDCHAIN_MACOS_NOTARY_API_KEY_P8_BASE64"
+          "BUILDCHAIN_MACOS_NOTARY_API_KEY_P8_BASE64",
+          "BUILDCHAIN_PROMOTION_TOKEN"
         ],
-        "secretCount": 8,
+        "secretCount": 9,
         "outputs": [
           "artifact-coordinates-json",
           "build-diagnostics-summary-artifact",
@@ -825,6 +840,9 @@
           "buildchain-repository",
           "channel",
           "dry-run",
+          "github-artifact-attestation-environment",
+          "github-artifact-attestation-policy-json",
+          "github-artifact-attestation-retention-days",
           "github-governance-receipt-json",
           "github-release",
           "github-release-notes",
@@ -898,7 +916,7 @@
           "target-sha",
           "trusted-publishing"
         ],
-        "inputCount": 85,
+        "inputCount": 88,
         "secrets": [
           "BUILDCHAIN_ISSUE_APP_ID",
           "BUILDCHAIN_ISSUE_APP_PRIVATE_KEY",
@@ -921,6 +939,10 @@
           "controller-receipt-digest",
           "controller-receipt-json",
           "controller-receipt-status",
+          "github-artifact-attestation-evidence-root",
+          "github-artifact-attestation-id",
+          "github-artifact-attestation-publication-receipt-digest",
+          "github-artifact-attestation-url",
           "promoted-sha",
           "publication-capability-digest",
           "publication-commit-evidence-digest",
@@ -929,7 +951,7 @@
           "publication-commit-url",
           "release-candidate-artifact"
         ],
-        "outputCount": 15
+        "outputCount": 19
       },
       {
         "id": ".release-docker",
@@ -1282,6 +1304,28 @@
         "outputs": [],
         "outputCount": 0
       },
+      {
+        "id": "artifact-signing-authority",
+        "path": ".github/workflows/artifact-signing-authority.yml",
+        "reusable": false,
+        "inputs": [],
+        "inputCount": 0,
+        "secrets": [],
+        "secretCount": 0,
+        "outputs": [],
+        "outputCount": 0
+      },
+      {
+        "id": "auditable-demo-media-profile-qualification",
+        "path": ".github/workflows/auditable-demo-media-profile-qualification.yml",
+        "reusable": false,
+        "inputs": [],
+        "inputCount": 0,
+        "secrets": [],
+        "secretCount": 0,
+        "outputs": [],
+        "outputCount": 0
+      },
       {
         "id": "binary-distribution",
         "path": ".github/workflows/binary-distribution.yml",
@@ -1341,6 +1385,9 @@
           "buildchain-ref",
           "buildchain-repository",
           "buildchain-stable-contract-lock-path",
+          "cache-dependency-lock-root",
+          "cache-policy-root",
+          "cache-toolchain-root",
           "cargo-registry-index",
           "checkout-cache-fallback",
           "checkout-cache-fetch-attempts",
@@ -1357,6 +1404,9 @@
           "expected-artifacts-json",
           "fail-fast",
           "gate-profile-aggregate-json",
+          "github-artifact-attestation-platform-id",
+          "github-artifact-attestation-signer-sha",
+          "github-artifact-attestation-subject-path",
           "install-command",
           "kfd-agent-hub",
           "lifecycle-timeout-minutes",
@@ -1390,7 +1440,7 @@
           "verify-command",
           "working-directory"
         ],
-        "inputCount": 69,
+        "inputCount": 75,
         "secrets": [
           "BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN",
           "BUILDCHAIN_ARTIFACT_RELAY_S3_ROLE_ARN",
@@ -1399,9 +1449,10 @@
           "BUILDCHAIN_MACOS_CERTIFICATE_PASSWORD",
           "BUILDCHAIN_MACOS_NOTARY_API_ISSUER",
           "BUILDCHAIN_MACOS_NOTARY_API_KEY_ID",
-          "BUILDCHAIN_MACOS_NOTARY_API_KEY_P8_BASE64"
+          "BUILDCHAIN_MACOS_NOTARY_API_KEY_P8_BASE64",
+          "BUILDCHAIN_PROMOTION_TOKEN"
         ],
-        "secretCount": 8,
+        "secretCount": 9,
         "outputs": [
           "artifact-coordinates-json",
           "build-diagnostics-summary-artifact",
@@ -1602,6 +1653,41 @@
         ],
         "outputCount": 7
       },
+      {
+        "id": "dev-alpha-candidate-patrol",
+        "path": ".github/workflows/dev-alpha-candidate-patrol.yml",
+        "reusable": true,
+        "inputs": [
+          "alpha-workflow-path",
+          "buildchain-ref",
+          "buildchain-repository",
+          "create-pull-request",
+          "dev-workflow-path",
+          "dry-run",
+          "max-age-seconds",
+          "pull-request-body-prefix",
+          "settlement-authorized",
+          "source-branch",
+          "target-branch"
+        ],
+        "inputCount": 11,
+        "secrets": [
+          "promotion-token"
+        ],
+        "secretCount": 1,
+        "outputs": [
+          "active-candidate-pr",
+          "controller-state",
+          "eligible",
+          "next-candidate-sha",
+          "promotion-pr",
+          "result-path",
+          "selected-sha",
+          "settlement-action",
+          "source-lock-ref"
+        ],
+        "outputCount": 9
+      },
       {
         "id": "dev-merge-queue-governance",
         "path": ".github/workflows/dev-merge-queue-governance.yml",
@@ -1647,6 +1733,37 @@
         ],
         "outputCount": 6
       },
+      {
+        "id": "github-artifact-attestation",
+        "path": ".github/workflows/github-artifact-attestation.yml",
+        "reusable": true,
+        "inputs": [
+          "buildchain-ref",
+          "environment",
+          "evidence-artifact-name",
+          "evidence-run-id",
+          "platform-manifest-artifact-name",
+          "platform-manifest-relative-path",
+          "policy-json",
+          "release-passport-artifact-name",
+          "release-passport-relative-path",
+          "retention-days",
+          "source-sha",
+          "subject-artifact-name",
+          "subject-relative-path"
+        ],
+        "inputCount": 13,
+        "secrets": [],
+        "secretCount": 0,
+        "outputs": [
+          "attestation-id",
+          "attestation-url",
+          "bundle-digest",
+          "evidence-artifact-name",
+          "evidence-root"
+        ],
+        "outputCount": 5
+      },
       {
         "id": "github-governance-audit",
         "path": ".github/workflows/github-governance-audit.yml",
@@ -1956,6 +2073,9 @@
           "buildchain-stable-contract-lock-path",
           "channel",
           "dry-run",
+          "github-artifact-attestation-environment",
+          "github-artifact-attestation-policy-json",
+          "github-artifact-attestation-retention-days",
           "github-governance-receipt-json",
           "github-release",
           "github-release-notes",
@@ -2018,7 +2138,7 @@
           "target-sha",
           "trusted-publishing"
         ],
-        "inputCount": 77,
+        "inputCount": 80,
         "secrets": [
           "BUILDCHAIN_ISSUE_APP_ID",
           "BUILDCHAIN_ISSUE_APP_PRIVATE_KEY",
@@ -2042,6 +2162,10 @@
           "controller-receipt-digest",
           "controller-receipt-json",
           "controller-receipt-status",
+          "github-artifact-attestation-evidence-root",
+          "github-artifact-attestation-id",
+          "github-artifact-attestation-publication-receipt-digest",
+          "github-artifact-attestation-url",
           "promoted-sha",
           "promotion-contract-lock-digest",
           "promotion-contract-lock-path",
@@ -2061,7 +2185,7 @@
           "publication-commit-url",
           "release-candidate-artifact"
         ],
-        "outputCount": 27
+        "outputCount": 31
       },
       {
         "id": "release-governance-reconcile",
@@ -2225,6 +2349,26 @@
       }
     ],
     "actionInputs": [
+      {
+        "id": "github-artifact-attestation",
+        "path": "actions/github-artifact-attestation/action.yml",
+        "inputs": [
+          "attestation-id",
+          "attestation-url",
+          "bundle-path",
+          "expected-buildchain-ref",
+          "expected-caller-repository",
+          "expected-source-sha",
+          "mode",
+          "output-dir",
+          "platform-manifest-path",
+          "policy-json",
+          "preparation-json",
+          "release-passport-path",
+          "subject-path"
+        ],
+        "inputCount": 13
+      },
       {
         "id": "macos-credential-island",
         "path": "actions/macos-credential-island/action.yml",
@@ -2297,6 +2441,7 @@
           "release-passport",
           "release-passport-build-summary-path",
           "release-passport-buildchain-self-kfd",
+          "release-passport-github-artifact-attestation-policy-jsons",
           "release-passport-impact-json",
           "release-passport-invariant-passport-command",
           "release-passport-invariant-passport-jsons",
@@ -2323,7 +2468,7 @@
           "transaction-state-path",
           "verification-command"
         ],
-        "inputCount": 66
+        "inputCount": 67
       },
       {
         "id": "report-buildchain-issue",
@@ -2415,6 +2560,10 @@
       }
     ],
     "sitePages": [
+      {
+        "id": "action:github-artifact-attestation",
+        "category": "action"
+      },
       {
         "id": "action:macos-credential-island",
         "category": "action"
@@ -2515,6 +2664,14 @@
         "id": "manual:controller-evidence",
         "category": "manual"
       },
+      {
+        "id": "manual:dev-alpha-candidate-patrol",
+        "category": "manual"
+      },
+      {
+        "id": "manual:github-artifact-attestation",
+        "category": "manual"
+      },
       {
         "id": "manual:github-governance-authority",
         "category": "manual"
@@ -2871,6 +3028,11 @@
         "path": "docs/cli.md",
         "command": "buildchain collect github-release"
       },
+      {
+        "id": "collect-github-release",
+        "path": "docs/github-artifact-attestation.md",
+        "command": "buildchain collect github-release"
+      },
       {
         "id": "collect-github-release",
         "path": "docs/kfd-agent-hub.md",
@@ -2886,6 +3048,16 @@
         "path": "docs/release-passport.md",
         "command": "buildchain collect github-release"
       },
+      {
+        "id": "create",
+        "path": "docs/cli.md",
+        "command": "buildchain create github-artifact-attestation-policy"
+      },
+      {
+        "id": "create",
+        "path": "docs/github-artifact-attestation.md",
+        "command": "buildchain create github-artifact-attestation-policy"
+      },
       {
         "id": "dev",
         "path": "docs/cli.md",
@@ -3966,6 +4138,16 @@
         "path": "docs/release-passport.md",
         "command": "buildchain verify artifact"
       },
+      {
+        "id": "verify-github-artifact-attestation",
+        "path": "docs/cli.md",
+        "command": "buildchain verify github-artifact-attestation"
+      },
+      {
+        "id": "verify-github-artifact-attestation",
+        "path": "docs/github-artifact-attestation.md",
+        "command": "buildchain verify github-artifact-attestation"
+      },
       {
         "id": "verify-infra-contract-evidence-bundle",
         "path": "docs/cli.md",
@@ -4077,9 +4259,9 @@
     "cliRegistryPath": "dist/site/cli-registry.json",
     "workflowRegistryPath": "dist/site/workflow-registry.json",
     "pageRegistryPath": "dist/site/page-registry.json",
-    "cliRegistryDigest": "a1c10dd6977d85a7bc793054baa549108b46d6d18098de109733e01b9151a024",
-    "workflowRegistryDigest": "97e21bf5f4332b830cbaffecc3c1891d9fa1036984c7093e77daac78dc8e3221",
-    "pageRegistryDigest": "d11a4b7ed807d075b52fedb80c85bfa8f13431f5aa86dae38fc00d3f428f0c6e"
+    "cliRegistryDigest": "0be723caa314a36a1a36b03522527eb5b13e9b741e6566ff7f6ee06958df02ca",
+    "workflowRegistryDigest": "01792ad09bcdcd3c12d018e6ee9613a09b5a1b87525d6f643a18f963f0d973a1",
+    "pageRegistryDigest": "56583b14046754bc0c02c512602c4e1c4e9ecdf68e6e639fcab8d550c3e082b4"
   },
   "comparison": {
     "missingCliRegistry": [],

package/dist/site/publication-authority-registry.json

@@ -167,6 +167,19 @@
       "runnerPolicy": "unqualified",
       "notes": ""
     },
+    {
+      "workflowPath": ".github/workflows/artifact-signing-authority.yml",
+      "authorityClass": "evidence-publication",
+      "publicationCapable": false,
+      "capabilityIds": [],
+      "credentialMode": "none",
+      "publisherWorkflowMode": "fixed",
+      "publisherWorkflowPath": ".github/workflows/artifact-signing-authority.yml",
+      "environment": "",
+      "environmentMode": "fixed",
+      "runnerPolicy": "unqualified",
+      "notes": ""
+    },
     {
       "workflowPath": ".github/workflows/binary-distribution.yml",
       "authorityClass": "evidence-publication",
@@ -310,6 +323,19 @@
       "runnerPolicy": "unqualified",
       "notes": ""
     },
+    {
+      "workflowPath": ".github/workflows/dev-alpha-candidate-patrol.yml",
+      "authorityClass": "governance-write",
+      "publicationCapable": false,
+      "capabilityIds": [],
+      "credentialMode": "none",
+      "publisherWorkflowMode": "fixed",
+      "publisherWorkflowPath": ".github/workflows/dev-alpha-candidate-patrol.yml",
+      "environment": "",
+      "environmentMode": "fixed",
+      "runnerPolicy": "unqualified",
+      "notes": ""
+    },
     {
       "workflowPath": ".github/workflows/dev-merge-queue-governance.yml",
       "authorityClass": "governance-write",
@@ -336,6 +362,21 @@
       "runnerPolicy": "unqualified",
       "notes": ""
     },
+    {
+      "workflowPath": ".github/workflows/github-artifact-attestation.yml",
+      "authorityClass": "evidence-publication",
+      "publicationCapable": true,
+      "capabilityIds": [
+        "github-artifact-attestation"
+      ],
+      "credentialMode": "oidc",
+      "publisherWorkflowMode": "caller-bound",
+      "publisherWorkflowPath": ".github/workflows/github-artifact-attestation.yml",
+      "environment": "consumer-defined",
+      "environmentMode": "caller-bound",
+      "runnerPolicy": "qualified-measured",
+      "notes": ""
+    },
     {
       "workflowPath": ".github/workflows/github-governance-audit.yml",
       "authorityClass": "governance-write",
@@ -575,7 +616,8 @@
       "path": ".github/workflows/.release-candidate-promote.yml",
       "signals": [
         "write-permission",
-        "oidc"
+        "oidc",
+        "environment"
       ],
       "classified": true
     },
@@ -648,6 +690,18 @@
       ],
       "classified": true
     },
+    {
+      "path": ".github/workflows/artifact-signing-authority.yml",
+      "signals": [
+        "environment"
+      ],
+      "classified": true
+    },
+    {
+      "path": ".github/workflows/auditable-demo-media-profile-qualification.yml",
+      "signals": [],
+      "classified": false
+    },
     {
       "path": ".github/workflows/binary-distribution.yml",
       "signals": [
@@ -745,6 +799,13 @@
       "signals": [],
       "classified": false
     },
+    {
+      "path": ".github/workflows/dev-alpha-candidate-patrol.yml",
+      "signals": [
+        "write-permission"
+      ],
+      "classified": true
+    },
     {
       "path": ".github/workflows/dev-merge-queue-governance.yml",
       "signals": [],
@@ -757,6 +818,15 @@
       ],
       "classified": true
     },
+    {
+      "path": ".github/workflows/github-artifact-attestation.yml",
+      "signals": [
+        "write-permission",
+        "oidc",
+        "environment"
+      ],
+      "classified": true
+    },
     {
       "path": ".github/workflows/github-governance-audit.yml",
       "signals": [
@@ -888,5 +958,5 @@
       "classified": false
     }
   ],
-  "registryDigest": "cb18522c1957f0cb2e03c525847602a6163d3b276c106a8bce5b8028d8b9a011"
+  "registryDigest": "0f4705fb7b2afcb72e9136dac44eac7fc47d9440330aa3c72a8ae8bd8f3339c3"
 }

package/dist/site/publication-registry.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-publication-release-registry",
-  "generatedAt": "2026-07-26T15:42:26.745Z",
-  "publishedAt": "2026-07-26T15:42:26.745Z",
+  "generatedAt": "2026-07-28T18:18:43.092Z",
+  "publishedAt": "2026-07-28T18:18:43.092Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "ed47430f8cadfc327c52004aae9e5ef62aaa6e37",
+  "sourceRevision": "6d22340e3c2ab0202ce8d830cf1f85400ada5ae7",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -32,7 +32,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "3.0.2-alpha.0",
+    "version": "3.0.2-alpha.10",
     "versionSource": "package.json#version"
   },
   "sourceKind": "package-site-bundle",

package/dist/site/release-model.json

@@ -45,7 +45,8 @@
     "evidenceAssets": [
       "publish evidence JSON",
       "buildchain.release.json",
-      "release passport assets"
+      "release passport assets",
+      "GitHub artifact attestation Sigstore bundle and Buildchain evidence JSON"
     ],
     "owner": "promote-buildchain-ref"
   },

package/dist/site/release-passport-check-manifest.json

@@ -43,6 +43,7 @@
       "distTagPromotion",
       "controllerReceipts",
       "kfdSupport",
+      "githubArtifactAttestations",
       "artifacts",
       "evidence",
       "recovery"

package/dist/site/release-provenance.json

@@ -14,9 +14,15 @@
       "./core": "./packages/core/index.js",
       "./artifact-passport": "./packages/core/artifact-passport.js",
       "./artifact-verification-envelope": "./packages/core/artifact-verification-envelope.js",
+      "./github-artifact-attestation": "./packages/core/github-artifact-attestation.js",
+      "./artifact-signing": "./packages/core/artifact-signing.js",
+      "./artifact-signing-result": "./packages/core/artifact-signing-result.js",
+      "./detached-artifact-signature": "./packages/core/detached-artifact-signature.js",
       "./anchored-version-material": "./packages/core/anchored-version-material.js",
       "./buildchain-contract": "./packages/core/buildchain-contract.js",
       "./candidate-timeline": "./packages/core/candidate-timeline.js",
+      "./channel-candidate": "./packages/core/channel-candidate.js",
+      "./cache-evidence": "./packages/core/cache-evidence.js",
       "./controller-evidence": "./packages/core/controller-evidence.js",
       "./diagnostics": "./packages/core/diagnostics.js",
       "./homebrew": "./packages/core/homebrew.js",

package/dist/site/schemas/release-passport-v1.schema.json

@@ -187,6 +187,12 @@
         "type": "object"
       }
     },
+    "githubArtifactAttestations": {
+      "type": "array",
+      "items": {
+        "type": "object"
+      }
+    },
     "kfd-1": {
       "type": "object"
     },