@kungfu-tech/buildchain 3.0.2-alpha.1 → 3.0.2-alpha.10

package/dist/site/kfd-claims.json

@@ -14,20 +14,20 @@
   },
   "runtimeContract": {
     "contract": "kungfu-buildchain-runtime-contract-world",
-    "compatibilityDigest": "sha256:008b1c5a90a787cf30106829ac7aca68ab501f6d9c375e415d9c5c6b89039f46",
+    "compatibilityDigest": "sha256:9770baa99ba374e9dbd743ca9624a72137513b8c4e65af1fbf2160cb3ef51d9d",
     "majorLine": "v3"
   },
   "publicSurfaceReverseAudit": {
     "contract": "kungfu-buildchain-public-surface-reverse-audit",
     "path": "dist/site/public-surface-audit.json",
     "status": "passed",
-    "sha256": "08eb47b0eeab5cf1a11b63314b9572115ba71feb20843adf3e6cef0536dd5f47",
+    "sha256": "5d48015039ed4e6885acc9a0057d492f48e0b8b31b853a482af41ebae525d801",
     "summary": {
-      "cliCommandCount": 96,
-      "workflowCount": 53,
-      "actionCount": 5,
-      "sitePageCount": 56,
-      "docCommandRefCount": 286,
+      "cliCommandCount": 97,
+      "workflowCount": 57,
+      "actionCount": 6,
+      "sitePageCount": 59,
+      "docCommandRefCount": 291,
       "failureCount": 0
     },
     "auditBoundary": {
@@ -228,13 +228,13 @@
       "contract": "kungfu-buildchain-public-surface-reverse-audit",
       "path": "dist/site/public-surface-audit.json",
       "status": "passed",
-      "sha256": "08eb47b0eeab5cf1a11b63314b9572115ba71feb20843adf3e6cef0536dd5f47",
+      "sha256": "5d48015039ed4e6885acc9a0057d492f48e0b8b31b853a482af41ebae525d801",
       "summary": {
-        "cliCommandCount": 96,
-        "workflowCount": 53,
-        "actionCount": 5,
-        "sitePageCount": 56,
-        "docCommandRefCount": 286,
+        "cliCommandCount": 97,
+        "workflowCount": 57,
+        "actionCount": 6,
+        "sitePageCount": 59,
+        "docCommandRefCount": 291,
         "failureCount": 0
       },
       "auditBoundary": {
@@ -260,6 +260,18 @@
           "public": true,
           "plane": "use"
         },
+        {
+          "id": "doc:actions/github-artifact-attestation/README.md",
+          "name": "actions/github-artifact-attestation/README.md",
+          "kind": "documentation",
+          "sourcePath": "actions/github-artifact-attestation/README.md",
+          "evidencePath": "actions/github-artifact-attestation/README.md",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "plane": "action"
+        },
         {
           "id": "doc:actions/macos-credential-island/README.md",
           "name": "actions/macos-credential-island/README.md",
@@ -404,6 +416,18 @@
           "public": true,
           "plane": "verify"
         },
+        {
+          "id": "doc:docs/github-artifact-attestation.md",
+          "name": "GitHub-native Linux artifact attestation",
+          "kind": "documentation",
+          "sourcePath": "docs/github-artifact-attestation.md",
+          "evidencePath": "docs/github-artifact-attestation.md",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "plane": "verify"
+        },
         {
           "id": "doc:docs/github-governance-authority.md",
           "name": "GitHub governance authority",
@@ -872,6 +896,17 @@
           "participantFacing": true,
           "public": true
         },
+        {
+          "id": "schema:packages/core/github-artifact-attestation.js",
+          "name": "schema:packages/core/github-artifact-attestation.js",
+          "kind": "schema",
+          "sourcePath": "packages/core/github-artifact-attestation.js",
+          "evidencePath": "packages/core/github-artifact-attestation.js",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true
+        },
         {
           "id": "schema:packages/core/buildchain-contract.js",
           "name": "schema:packages/core/buildchain-contract.js",
@@ -1113,6 +1148,54 @@
           "public": true,
           "packageExport": "./artifact-verification-envelope"
         },
+        {
+          "id": "export:./github-artifact-attestation",
+          "name": "@kungfu-tech/buildchain/github-artifact-attestation",
+          "kind": "package-export",
+          "sourcePath": "packages/core/github-artifact-attestation.js",
+          "evidencePath": "packages/core/github-artifact-attestation.js",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "packageExport": "./github-artifact-attestation"
+        },
+        {
+          "id": "export:./artifact-signing",
+          "name": "@kungfu-tech/buildchain/artifact-signing",
+          "kind": "package-export",
+          "sourcePath": "packages/core/artifact-signing.js",
+          "evidencePath": "packages/core/artifact-signing.js",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "packageExport": "./artifact-signing"
+        },
+        {
+          "id": "export:./artifact-signing-result",
+          "name": "@kungfu-tech/buildchain/artifact-signing-result",
+          "kind": "package-export",
+          "sourcePath": "packages/core/artifact-signing-result.js",
+          "evidencePath": "packages/core/artifact-signing-result.js",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "packageExport": "./artifact-signing-result"
+        },
+        {
+          "id": "export:./detached-artifact-signature",
+          "name": "@kungfu-tech/buildchain/detached-artifact-signature",
+          "kind": "package-export",
+          "sourcePath": "packages/core/detached-artifact-signature.js",
+          "evidencePath": "packages/core/detached-artifact-signature.js",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "packageExport": "./detached-artifact-signature"
+        },
         {
           "id": "export:./anchored-version-material",
           "name": "@kungfu-tech/buildchain/anchored-version-material",
@@ -1149,6 +1232,18 @@
           "public": true,
           "packageExport": "./candidate-timeline"
         },
+        {
+          "id": "export:./channel-candidate",
+          "name": "@kungfu-tech/buildchain/channel-candidate",
+          "kind": "package-export",
+          "sourcePath": "packages/core/channel-candidate.js",
+          "evidencePath": "packages/core/channel-candidate.js",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "packageExport": "./channel-candidate"
+        },
         {
           "id": "export:./cache-evidence",
           "name": "@kungfu-tech/buildchain/cache-evidence",
@@ -2801,6 +2896,18 @@
           "public": true,
           "reverseAuditSource": "bin/buildchain.mjs"
         },
+        {
+          "id": "cli:verify-github-artifact-attestation",
+          "name": "buildchain verify github-artifact-attestation <artifact>",
+          "kind": "cli-command",
+          "sourcePath": "bin/buildchain.mjs",
+          "evidencePath": "bin/buildchain.mjs",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "reverseAuditSource": "bin/buildchain.mjs"
+        },
         {
           "id": "cli:verify-infra-contract-evidence-bundle",
           "name": "buildchain verify infra-contract-evidence-bundle <file> [--json]",
@@ -2883,11 +2990,12 @@
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 9,
+          "inputCount": 10,
           "inputs": [
             "adapter-path",
             "artifact-retention-days",
             "buildchain-repository",
+            "media-profile",
             "render-media",
             "renderer-image",
             "require-trusted-event",
@@ -2937,7 +3045,7 @@
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 69,
+          "inputCount": 72,
           "inputs": [
             "artifact-name",
             "artifact-name-template",
@@ -2976,6 +3084,9 @@
             "expected-artifacts-json",
             "fail-fast",
             "gate-profile-aggregate-json",
+            "github-artifact-attestation-platform-id",
+            "github-artifact-attestation-signer-sha",
+            "github-artifact-attestation-subject-path",
             "install-command",
             "kfd-agent-hub",
             "lifecycle-timeout-minutes",
@@ -3128,7 +3239,7 @@
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 85,
+          "inputCount": 88,
           "inputs": [
             "allow-repository",
             "artifact-name",
@@ -3143,6 +3254,9 @@
             "buildchain-repository",
             "channel",
             "dry-run",
+            "github-artifact-attestation-environment",
+            "github-artifact-attestation-policy-json",
+            "github-artifact-attestation-retention-days",
             "github-governance-receipt-json",
             "github-release",
             "github-release-notes",
@@ -3529,6 +3643,34 @@
           ],
           "reverseAuditSource": ".github/workflows"
         },
+        {
+          "id": "workflow:artifact-signing-authority",
+          "name": "workflow:artifact-signing-authority",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/artifact-signing-authority.yml",
+          "evidencePath": ".github/workflows/artifact-signing-authority.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 0,
+          "inputs": [],
+          "reverseAuditSource": ".github/workflows"
+        },
+        {
+          "id": "workflow:auditable-demo-media-profile-qualification",
+          "name": "workflow:auditable-demo-media-profile-qualification",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/auditable-demo-media-profile-qualification.yml",
+          "evidencePath": ".github/workflows/auditable-demo-media-profile-qualification.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 0,
+          "inputs": [],
+          "reverseAuditSource": ".github/workflows"
+        },
         {
           "id": "workflow:binary-distribution",
           "name": "workflow:binary-distribution",
@@ -3581,7 +3723,7 @@
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 72,
+          "inputCount": 75,
           "inputs": [
             "artifact-name",
             "artifact-name-template",
@@ -3623,6 +3765,9 @@
             "expected-artifacts-json",
             "fail-fast",
             "gate-profile-aggregate-json",
+            "github-artifact-attestation-platform-id",
+            "github-artifact-attestation-signer-sha",
+            "github-artifact-attestation-subject-path",
             "install-command",
             "kfd-agent-hub",
             "lifecycle-timeout-minutes",
@@ -3823,6 +3968,32 @@
           ],
           "reverseAuditSource": ".github/workflows"
         },
+        {
+          "id": "workflow:dev-alpha-candidate-patrol",
+          "name": "workflow:dev-alpha-candidate-patrol",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/dev-alpha-candidate-patrol.yml",
+          "evidencePath": ".github/workflows/dev-alpha-candidate-patrol.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 11,
+          "inputs": [
+            "alpha-workflow-path",
+            "buildchain-ref",
+            "buildchain-repository",
+            "create-pull-request",
+            "dev-workflow-path",
+            "dry-run",
+            "max-age-seconds",
+            "pull-request-body-prefix",
+            "settlement-authorized",
+            "source-branch",
+            "target-branch"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
         {
           "id": "workflow:dev-merge-queue-governance",
           "name": "workflow:dev-merge-queue-governance",
@@ -3865,6 +4036,34 @@
           ],
           "reverseAuditSource": ".github/workflows"
         },
+        {
+          "id": "workflow:github-artifact-attestation",
+          "name": "workflow:github-artifact-attestation",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/github-artifact-attestation.yml",
+          "evidencePath": ".github/workflows/github-artifact-attestation.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 13,
+          "inputs": [
+            "buildchain-ref",
+            "environment",
+            "evidence-artifact-name",
+            "evidence-run-id",
+            "platform-manifest-artifact-name",
+            "platform-manifest-relative-path",
+            "policy-json",
+            "release-passport-artifact-name",
+            "release-passport-relative-path",
+            "retention-days",
+            "source-sha",
+            "subject-artifact-name",
+            "subject-relative-path"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
         {
           "id": "workflow:github-governance-audit",
           "name": "workflow:github-governance-audit",
@@ -4126,7 +4325,7 @@
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 77,
+          "inputCount": 80,
           "inputs": [
             "allow-repository",
             "artifact-name",
@@ -4144,6 +4343,9 @@
             "buildchain-stable-contract-lock-path",
             "channel",
             "dry-run",
+            "github-artifact-attestation-environment",
+            "github-artifact-attestation-policy-json",
+            "github-artifact-attestation-retention-days",
             "github-governance-receipt-json",
             "github-release",
             "github-release-notes",
@@ -4372,6 +4574,34 @@
           "inputs": [],
           "reverseAuditSource": ".github/workflows"
         },
+        {
+          "id": "action:github-artifact-attestation",
+          "name": "action:github-artifact-attestation",
+          "kind": "action",
+          "sourcePath": "actions/github-artifact-attestation/action.yml",
+          "evidencePath": "actions/github-artifact-attestation/action.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 13,
+          "inputs": [
+            "attestation-id",
+            "attestation-url",
+            "bundle-path",
+            "expected-buildchain-ref",
+            "expected-caller-repository",
+            "expected-source-sha",
+            "mode",
+            "output-dir",
+            "platform-manifest-path",
+            "policy-json",
+            "preparation-json",
+            "release-passport-path",
+            "subject-path"
+          ],
+          "reverseAuditSource": "actions/*/action.yml"
+        },
         {
           "id": "action:macos-credential-island",
           "name": "action:macos-credential-island",
@@ -4417,7 +4647,7 @@
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 66,
+          "inputCount": 67,
           "inputs": [
             "allow-repository",
             "branch-protection-bypass-apps",
@@ -4460,6 +4690,7 @@
             "release-passport",
             "release-passport-build-summary-path",
             "release-passport-buildchain-self-kfd",
+            "release-passport-github-artifact-attestation-policy-jsons",
             "release-passport-impact-json",
             "release-passport-invariant-passport-command",
             "release-passport-invariant-passport-jsons",
@@ -4600,6 +4831,18 @@
           ],
           "reverseAuditSource": "actions/*/action.yml"
         },
+        {
+          "id": "site-page:action:github-artifact-attestation",
+          "name": "site-page:action:github-artifact-attestation",
+          "kind": "site-page",
+          "sourcePath": "dist/site/page-registry.json",
+          "evidencePath": "dist/site/page-registry.json",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "reverseAuditSource": "dist/site/page-registry.json"
+        },
         {
           "id": "site-page:action:macos-credential-island",
           "name": "site-page:action:macos-credential-island",
@@ -4900,6 +5143,30 @@
           "public": true,
           "reverseAuditSource": "dist/site/page-registry.json"
         },
+        {
+          "id": "site-page:manual:dev-alpha-candidate-patrol",
+          "name": "site-page:manual:dev-alpha-candidate-patrol",
+          "kind": "site-page",
+          "sourcePath": "dist/site/page-registry.json",
+          "evidencePath": "dist/site/page-registry.json",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "reverseAuditSource": "dist/site/page-registry.json"
+        },
+        {
+          "id": "site-page:manual:github-artifact-attestation",
+          "name": "site-page:manual:github-artifact-attestation",
+          "kind": "site-page",
+          "sourcePath": "dist/site/page-registry.json",
+          "evidencePath": "dist/site/page-registry.json",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "reverseAuditSource": "dist/site/page-registry.json"
+        },
         {
           "id": "site-page:manual:github-governance-authority",
           "name": "site-page:manual:github-governance-authority",
@@ -5319,6 +5586,39 @@
         "participantFacing": true,
         "public": true
       },
+      {
+        "id": "control:.github/workflows/github-artifact-attestation.yml",
+        "name": "control:.github/workflows/github-artifact-attestation.yml",
+        "kind": "workflow",
+        "sourcePath": ".github/workflows/github-artifact-attestation.yml",
+        "evidencePath": ".github/workflows/github-artifact-attestation.yml",
+        "availability": "shipped",
+        "visibility": "public",
+        "participantFacing": true,
+        "public": true
+      },
+      {
+        "id": "control:actions/github-artifact-attestation/action.yml",
+        "name": "control:actions/github-artifact-attestation/action.yml",
+        "kind": "action",
+        "sourcePath": "actions/github-artifact-attestation/action.yml",
+        "evidencePath": "actions/github-artifact-attestation/action.yml",
+        "availability": "shipped",
+        "visibility": "public",
+        "participantFacing": true,
+        "public": true
+      },
+      {
+        "id": "control:actions/github-artifact-attestation/index.js",
+        "name": "control:actions/github-artifact-attestation/index.js",
+        "kind": "action",
+        "sourcePath": "actions/github-artifact-attestation/index.js",
+        "evidencePath": "actions/github-artifact-attestation/index.js",
+        "availability": "shipped",
+        "visibility": "public",
+        "participantFacing": true,
+        "public": true
+      },
       {
         "id": "control:.github/workflows/release-propagation.yml",
         "name": "control:.github/workflows/release-propagation.yml",
@@ -5410,6 +5710,6 @@
         }
       }
     ],
-    "publicSurfaceCount": 345
+    "publicSurfaceCount": 365
   }
 }

package/dist/site/kfd-upstream-aggregate.json

@@ -4,7 +4,7 @@
   "product": {
     "id": "kungfu-tech-buildchain",
     "name": "@kungfu-tech/buildchain",
-    "version": "3.0.2-alpha.1",
+    "version": "3.0.2-alpha.10",
     "repository": "https://github.com/kungfu-systems/buildchain"
   },
   "source": {

package/dist/site/manual-registry.json

@@ -9,7 +9,7 @@
       "title": "Buildchain documentation map",
       "path": "docs/MAP.md",
       "plane": "use",
-      "digest": "sha256:fc8f7c63b8427e513f9524b8e22e4b0dcd8981fcc724417a29b942fe237fc0a9",
+      "digest": "sha256:cc32692e8d04816e8de94f208e43c2d5c5c7a8425cec8b32edc73ab78591fbbf",
       "capabilityGroup": "getting-started",
       "audience": [
         "agent",
@@ -23,7 +23,7 @@
       "title": "Auditable demo artifact pipeline",
       "path": "docs/auditable-demo.md",
       "plane": "verify",
-      "digest": "sha256:cff9786d4de098c84ea7e494b523627d6431909f15c82940e2193dbda1ef10e9",
+      "digest": "sha256:0e8cf2162c2e1f83cfe3a6171e3055f494cab5f03fdcbec3854e1793678e6908",
       "capabilityGroup": "reusable-build",
       "audience": [
         "consumer",
@@ -50,7 +50,7 @@
       "title": "Release Passport protocol",
       "path": "docs/release-passport.md",
       "plane": "verify",
-      "digest": "sha256:ed29d25882cbf4ec062abc21e7d069a6377eaf7e3171c24642dfe08da2e4c05b",
+      "digest": "sha256:d698078075700e60bafb9677bc4c35d49970136b98caaecfc51d38344285cdd5",
       "capabilityGroup": "release-passport-trust",
       "audience": [
         "release-operator",
@@ -59,6 +59,20 @@
       "maturity": "stable",
       "order": 100
     },
+    {
+      "id": "github-artifact-attestation",
+      "title": "GitHub-native Linux artifact attestation",
+      "path": "docs/github-artifact-attestation.md",
+      "plane": "verify",
+      "digest": "sha256:51f28b0b01fae4e3f80a7433f6c491d0c795bd091bff64ca1264c5cc0819c545",
+      "capabilityGroup": "release-passport-trust",
+      "audience": [
+        "release-operator",
+        "agent"
+      ],
+      "maturity": "preview",
+      "order": 108
+    },
     {
       "id": "controller-evidence",
       "title": "Controller evidence contract",
@@ -164,7 +178,7 @@
       "title": "Binary distribution contract",
       "path": "docs/binary-distribution.md",
       "plane": "verify",
-      "digest": "sha256:ae0f8e6cafbb4c39732e6a7252d46b523b0a69e8e05d3ce7ee0b51a916b1b027",
+      "digest": "sha256:b1611dcf0e6825e53921e4c9d31d1afe16fca81e6868360bfad1902587cd52ef",
       "capabilityGroup": "release-passport-trust",
       "audience": [
         "release-operator",
@@ -275,7 +289,7 @@
       "title": "CLI and npm package",
       "path": "docs/cli.md",
       "plane": "use",
-      "digest": "sha256:47be88f5e5fd14124d03510b807722215034d34eefcebdfe2599a310350b7697",
+      "digest": "sha256:49da688f9f8b726a9169a3e4b246cb6ef07c6c626ea15c22f0b26ba1a37a58b4",
       "capabilityGroup": "api-cli-reference",
       "audience": [
         "agent",
@@ -346,7 +360,7 @@
       "title": "Reusable build surface",
       "path": "docs/reusable-build-surface.md",
       "plane": "use",
-      "digest": "sha256:6a739755239e5592299f6f8789cf6f9091350bb945b5db5df11edff3496df026",
+      "digest": "sha256:ea36ec722f811f5156735aa7471ed080cdc7e87d71c20c300243b226e233e675",
       "capabilityGroup": "reusable-build",
       "audience": [
         "consumer",
@@ -373,7 +387,7 @@
       "title": "Release governance",
       "path": "docs/release-governance.md",
       "plane": "why",
-      "digest": "sha256:a77c2bb1d2245e1ee2318f650ad64ada6c8cdd3292a62a028e3ccc7517fb4e12",
+      "digest": "sha256:42a45f51db7ea11658431718835e1a430959db2a5cc80fc4651681502fe6fb7c",
       "capabilityGroup": "governance-versioning",
       "audience": [
         "maintainer",
@@ -401,7 +415,7 @@
       "title": "Runtime train validation",
       "path": "docs/runtime-train-validation.md",
       "plane": "verify",
-      "digest": "sha256:1315fe264d0e22215183122fc05e287be974751a78268642076898b689e435e6",
+      "digest": "sha256:c9ebf451294f92a2be3aa2ac4b2ec7afb3cc17bbeae2ece7879b800c0f274a40",
       "capabilityGroup": "governance-versioning",
       "audience": [
         "maintainer",
@@ -415,7 +429,7 @@
       "title": "Versioning",
       "path": "docs/versioning.md",
       "plane": "why",
-      "digest": "sha256:f3665f2f173bdcb287cf8aa509035164e818b20088849f4a2bce098951c84ea3",
+      "digest": "sha256:4b40cb8675c111b7588297102a61cb241630f2b707a67a0384a6df7527b2c64c",
       "capabilityGroup": "governance-versioning",
       "audience": [
         "maintainer"
@@ -447,6 +461,7 @@
     "docs/reusable-build-surface.md",
     "docs/release-candidate.md",
     "docs/stable-candidate-patrol.md",
+    "docs/dev-alpha-candidate-patrol.md",
     "docs/observed-evidence-patrol.md",
     "docs/release-governance.md",
     "docs/release-passport.md",