@kungfu-tech/buildchain 3.0.2-alpha.4 → 3.0.2-alpha.6

package/dist/site/capability-registry.json

@@ -47,15 +47,16 @@
       ],
       "maturity": "stable",
       "counts": {
-        "manualCount": 4,
-        "pageCount": 4,
-        "cliCommandCount": 21,
-        "nodeApiCount": 8,
-        "workflowCount": 2,
-        "actionCount": 1
+        "manualCount": 5,
+        "pageCount": 5,
+        "cliCommandCount": 22,
+        "nodeApiCount": 9,
+        "workflowCount": 3,
+        "actionCount": 2
       },
       "manuals": [
         "docs/release-passport.md",
+        "docs/github-artifact-attestation.md",
         "docs/publication-authority.md",
         "docs/binary-distribution.md",
         "docs/publish-transaction.md"
@@ -287,7 +288,7 @@
       "maturity": "stable",
       "counts": {
         "manualCount": 1,
-        "pageCount": 7,
+        "pageCount": 8,
         "cliCommandCount": 0,
         "nodeApiCount": 2,
         "workflowCount": 35,

package/dist/site/cli-registry.json

@@ -1085,6 +1085,18 @@
       ],
       "maturity": "stable"
     },
+    {
+      "id": "verify-github-artifact-attestation",
+      "source": "bin/buildchain.mjs",
+      "usage": "buildchain verify github-artifact-attestation <artifact>",
+      "purpose": "Verify GitHub keyless attestation identity plus local artifact, manifest, Passport, predicate, bundle, and evidence bindings.",
+      "capabilityGroup": "release-passport-trust",
+      "audience": [
+        "agent",
+        "operator"
+      ],
+      "maturity": "stable"
+    },
     {
       "id": "verify-infra-contract-evidence-bundle",
       "source": "bin/buildchain.mjs",

package/dist/site/controller-registry.json

@@ -266,6 +266,18 @@
           "classification": "digest-only",
           "source": "workflow-call-input"
         },
+        "github-artifact-attestation-platform-id": {
+          "classification": "included",
+          "source": "workflow-call-input"
+        },
+        "github-artifact-attestation-signer-sha": {
+          "classification": "included",
+          "source": "workflow-call-input"
+        },
+        "github-artifact-attestation-subject-path": {
+          "classification": "digest-only",
+          "source": "workflow-call-input"
+        },
         "install-command": {
           "classification": "digest-only",
           "source": "workflow-call-input"
@@ -439,7 +451,7 @@
           "controller-receipt"
         ]
       },
-      "digest": "sha256:7ab36c233a4a448f3894e19c3e6a3b5f765095d2a8628cbbe421e4b82fe3e4b9"
+      "digest": "sha256:16c0a2506088fc5a4e3337c7c23f5cc7d14f30e9cde23c1d39fc335d05b4a4f9"
     },
     {
       "schemaVersion": 1,
@@ -643,6 +655,18 @@
           "classification": "digest-only",
           "source": "workflow-call-input"
         },
+        "github-artifact-attestation-platform-id": {
+          "classification": "included",
+          "source": "workflow-call-input"
+        },
+        "github-artifact-attestation-signer-sha": {
+          "classification": "included",
+          "source": "workflow-call-input"
+        },
+        "github-artifact-attestation-subject-path": {
+          "classification": "digest-only",
+          "source": "workflow-call-input"
+        },
         "install-command": {
           "classification": "digest-only",
           "source": "workflow-call-input"
@@ -797,7 +821,7 @@
           "controller-receipt"
         ]
       },
-      "digest": "sha256:9e5d5244c54d6613024beb43613afcae8d9cfb5cae7799c7a83a2799034ad64f"
+      "digest": "sha256:529f68186a49a8df1f2012fc4a38058548d1cc93eb06b6bed35befddd72519ef"
     },
     {
       "schemaVersion": 1,
@@ -1626,6 +1650,18 @@
           "classification": "included",
           "source": "workflow-call-input"
         },
+        "github-artifact-attestation-environment": {
+          "classification": "digest-only",
+          "source": "workflow-call-input"
+        },
+        "github-artifact-attestation-policy-json": {
+          "classification": "digest-only",
+          "source": "workflow-call-input"
+        },
+        "github-artifact-attestation-retention-days": {
+          "classification": "included",
+          "source": "workflow-call-input"
+        },
         "github-governance-receipt-json": {
           "classification": "digest-only",
           "source": "workflow-call-input"
@@ -1956,7 +1992,7 @@
           "controller-receipt"
         ]
       },
-      "digest": "sha256:4bd94f0bb1790c87af758b71aa592a3e22fdcd84a9851931d252e3f60cba8d40"
+      "digest": "sha256:00baae93d9ed75129fdaed6fcc33285e515b8c7de84816831a39e660941dd7ae"
     },
     {
       "schemaVersion": 1,
@@ -2132,5 +2168,5 @@
       "digest": "sha256:b6f53563c0adc859bc586c05fce560a5094d7d9666438d63c5fd3e1fc4774555"
     }
   ],
-  "digest": "sha256:fcd7a66644c922460625b5bce0b3ceaa20bc84e87681bf949e807bd8c358fcf4"
+  "digest": "sha256:2d022091ac72303cc5fab5888de3dfd5aecfc8520281f753d963ac7208828d6f"
 }

package/dist/site/kfd-claims.json

@@ -21,13 +21,13 @@
     "contract": "kungfu-buildchain-public-surface-reverse-audit",
     "path": "dist/site/public-surface-audit.json",
     "status": "passed",
-    "sha256": "ef5ce46ab398bd64e8ddaf9916d6f107baea6ddd91f21eb904470f14ff4926dd",
+    "sha256": "6d778d2a4d04a1b93ed21622719e08b3fa1e149af2941e09675c66582a3ebcdd",
     "summary": {
-      "cliCommandCount": 96,
-      "workflowCount": 54,
-      "actionCount": 5,
-      "sitePageCount": 57,
-      "docCommandRefCount": 286,
+      "cliCommandCount": 97,
+      "workflowCount": 55,
+      "actionCount": 6,
+      "sitePageCount": 59,
+      "docCommandRefCount": 291,
       "failureCount": 0
     },
     "auditBoundary": {
@@ -228,13 +228,13 @@
       "contract": "kungfu-buildchain-public-surface-reverse-audit",
       "path": "dist/site/public-surface-audit.json",
       "status": "passed",
-      "sha256": "ef5ce46ab398bd64e8ddaf9916d6f107baea6ddd91f21eb904470f14ff4926dd",
+      "sha256": "6d778d2a4d04a1b93ed21622719e08b3fa1e149af2941e09675c66582a3ebcdd",
       "summary": {
-        "cliCommandCount": 96,
-        "workflowCount": 54,
-        "actionCount": 5,
-        "sitePageCount": 57,
-        "docCommandRefCount": 286,
+        "cliCommandCount": 97,
+        "workflowCount": 55,
+        "actionCount": 6,
+        "sitePageCount": 59,
+        "docCommandRefCount": 291,
         "failureCount": 0
       },
       "auditBoundary": {
@@ -260,6 +260,18 @@
           "public": true,
           "plane": "use"
         },
+        {
+          "id": "doc:actions/github-artifact-attestation/README.md",
+          "name": "actions/github-artifact-attestation/README.md",
+          "kind": "documentation",
+          "sourcePath": "actions/github-artifact-attestation/README.md",
+          "evidencePath": "actions/github-artifact-attestation/README.md",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "plane": "action"
+        },
         {
           "id": "doc:actions/macos-credential-island/README.md",
           "name": "actions/macos-credential-island/README.md",
@@ -404,6 +416,18 @@
           "public": true,
           "plane": "verify"
         },
+        {
+          "id": "doc:docs/github-artifact-attestation.md",
+          "name": "GitHub-native Linux artifact attestation",
+          "kind": "documentation",
+          "sourcePath": "docs/github-artifact-attestation.md",
+          "evidencePath": "docs/github-artifact-attestation.md",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "plane": "verify"
+        },
         {
           "id": "doc:docs/github-governance-authority.md",
           "name": "GitHub governance authority",
@@ -872,6 +896,17 @@
           "participantFacing": true,
           "public": true
         },
+        {
+          "id": "schema:packages/core/github-artifact-attestation.js",
+          "name": "schema:packages/core/github-artifact-attestation.js",
+          "kind": "schema",
+          "sourcePath": "packages/core/github-artifact-attestation.js",
+          "evidencePath": "packages/core/github-artifact-attestation.js",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true
+        },
         {
           "id": "schema:packages/core/buildchain-contract.js",
           "name": "schema:packages/core/buildchain-contract.js",
@@ -1113,6 +1148,18 @@
           "public": true,
           "packageExport": "./artifact-verification-envelope"
         },
+        {
+          "id": "export:./github-artifact-attestation",
+          "name": "@kungfu-tech/buildchain/github-artifact-attestation",
+          "kind": "package-export",
+          "sourcePath": "packages/core/github-artifact-attestation.js",
+          "evidencePath": "packages/core/github-artifact-attestation.js",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "packageExport": "./github-artifact-attestation"
+        },
         {
           "id": "export:./anchored-version-material",
           "name": "@kungfu-tech/buildchain/anchored-version-material",
@@ -2813,6 +2860,18 @@
           "public": true,
           "reverseAuditSource": "bin/buildchain.mjs"
         },
+        {
+          "id": "cli:verify-github-artifact-attestation",
+          "name": "buildchain verify github-artifact-attestation <artifact>",
+          "kind": "cli-command",
+          "sourcePath": "bin/buildchain.mjs",
+          "evidencePath": "bin/buildchain.mjs",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "reverseAuditSource": "bin/buildchain.mjs"
+        },
         {
           "id": "cli:verify-infra-contract-evidence-bundle",
           "name": "buildchain verify infra-contract-evidence-bundle <file> [--json]",
@@ -2949,7 +3008,7 @@
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 69,
+          "inputCount": 72,
           "inputs": [
             "artifact-name",
             "artifact-name-template",
@@ -2988,6 +3047,9 @@
             "expected-artifacts-json",
             "fail-fast",
             "gate-profile-aggregate-json",
+            "github-artifact-attestation-platform-id",
+            "github-artifact-attestation-signer-sha",
+            "github-artifact-attestation-subject-path",
             "install-command",
             "kfd-agent-hub",
             "lifecycle-timeout-minutes",
@@ -3140,7 +3202,7 @@
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 85,
+          "inputCount": 88,
           "inputs": [
             "allow-repository",
             "artifact-name",
@@ -3155,6 +3217,9 @@
             "buildchain-repository",
             "channel",
             "dry-run",
+            "github-artifact-attestation-environment",
+            "github-artifact-attestation-policy-json",
+            "github-artifact-attestation-retention-days",
             "github-governance-receipt-json",
             "github-release",
             "github-release-notes",
@@ -3593,7 +3658,7 @@
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 72,
+          "inputCount": 75,
           "inputs": [
             "artifact-name",
             "artifact-name-template",
@@ -3635,6 +3700,9 @@
             "expected-artifacts-json",
             "fail-fast",
             "gate-profile-aggregate-json",
+            "github-artifact-attestation-platform-id",
+            "github-artifact-attestation-signer-sha",
+            "github-artifact-attestation-subject-path",
             "install-command",
             "kfd-agent-hub",
             "lifecycle-timeout-minutes",
@@ -3845,7 +3913,7 @@
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 9,
+          "inputCount": 10,
           "inputs": [
             "alpha-workflow-path",
             "buildchain-ref",
@@ -3854,6 +3922,7 @@
             "dev-workflow-path",
             "dry-run",
             "max-age-seconds",
+            "settlement-authorized",
             "source-branch",
             "target-branch"
           ],
@@ -3901,6 +3970,34 @@
           ],
           "reverseAuditSource": ".github/workflows"
         },
+        {
+          "id": "workflow:github-artifact-attestation",
+          "name": "workflow:github-artifact-attestation",
+          "kind": "workflow",
+          "sourcePath": ".github/workflows/github-artifact-attestation.yml",
+          "evidencePath": ".github/workflows/github-artifact-attestation.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 13,
+          "inputs": [
+            "buildchain-ref",
+            "environment",
+            "evidence-artifact-name",
+            "evidence-run-id",
+            "platform-manifest-artifact-name",
+            "platform-manifest-relative-path",
+            "policy-json",
+            "release-passport-artifact-name",
+            "release-passport-relative-path",
+            "retention-days",
+            "source-sha",
+            "subject-artifact-name",
+            "subject-relative-path"
+          ],
+          "reverseAuditSource": ".github/workflows"
+        },
         {
           "id": "workflow:github-governance-audit",
           "name": "workflow:github-governance-audit",
@@ -4162,7 +4259,7 @@
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 77,
+          "inputCount": 80,
           "inputs": [
             "allow-repository",
             "artifact-name",
@@ -4180,6 +4277,9 @@
             "buildchain-stable-contract-lock-path",
             "channel",
             "dry-run",
+            "github-artifact-attestation-environment",
+            "github-artifact-attestation-policy-json",
+            "github-artifact-attestation-retention-days",
             "github-governance-receipt-json",
             "github-release",
             "github-release-notes",
@@ -4408,6 +4508,34 @@
           "inputs": [],
           "reverseAuditSource": ".github/workflows"
         },
+        {
+          "id": "action:github-artifact-attestation",
+          "name": "action:github-artifact-attestation",
+          "kind": "action",
+          "sourcePath": "actions/github-artifact-attestation/action.yml",
+          "evidencePath": "actions/github-artifact-attestation/action.yml",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "inputCount": 13,
+          "inputs": [
+            "attestation-id",
+            "attestation-url",
+            "bundle-path",
+            "expected-buildchain-ref",
+            "expected-caller-repository",
+            "expected-source-sha",
+            "mode",
+            "output-dir",
+            "platform-manifest-path",
+            "policy-json",
+            "preparation-json",
+            "release-passport-path",
+            "subject-path"
+          ],
+          "reverseAuditSource": "actions/*/action.yml"
+        },
         {
           "id": "action:macos-credential-island",
           "name": "action:macos-credential-island",
@@ -4453,7 +4581,7 @@
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 66,
+          "inputCount": 67,
           "inputs": [
             "allow-repository",
             "branch-protection-bypass-apps",
@@ -4496,6 +4624,7 @@
             "release-passport",
             "release-passport-build-summary-path",
             "release-passport-buildchain-self-kfd",
+            "release-passport-github-artifact-attestation-policy-jsons",
             "release-passport-impact-json",
             "release-passport-invariant-passport-command",
             "release-passport-invariant-passport-jsons",
@@ -4636,6 +4765,18 @@
           ],
           "reverseAuditSource": "actions/*/action.yml"
         },
+        {
+          "id": "site-page:action:github-artifact-attestation",
+          "name": "site-page:action:github-artifact-attestation",
+          "kind": "site-page",
+          "sourcePath": "dist/site/page-registry.json",
+          "evidencePath": "dist/site/page-registry.json",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "reverseAuditSource": "dist/site/page-registry.json"
+        },
         {
           "id": "site-page:action:macos-credential-island",
           "name": "site-page:action:macos-credential-island",
@@ -4948,6 +5089,18 @@
           "public": true,
           "reverseAuditSource": "dist/site/page-registry.json"
         },
+        {
+          "id": "site-page:manual:github-artifact-attestation",
+          "name": "site-page:manual:github-artifact-attestation",
+          "kind": "site-page",
+          "sourcePath": "dist/site/page-registry.json",
+          "evidencePath": "dist/site/page-registry.json",
+          "availability": "shipped",
+          "visibility": "public",
+          "participantFacing": true,
+          "public": true,
+          "reverseAuditSource": "dist/site/page-registry.json"
+        },
         {
           "id": "site-page:manual:github-governance-authority",
           "name": "site-page:manual:github-governance-authority",
@@ -5367,6 +5520,39 @@
         "participantFacing": true,
         "public": true
       },
+      {
+        "id": "control:.github/workflows/github-artifact-attestation.yml",
+        "name": "control:.github/workflows/github-artifact-attestation.yml",
+        "kind": "workflow",
+        "sourcePath": ".github/workflows/github-artifact-attestation.yml",
+        "evidencePath": ".github/workflows/github-artifact-attestation.yml",
+        "availability": "shipped",
+        "visibility": "public",
+        "participantFacing": true,
+        "public": true
+      },
+      {
+        "id": "control:actions/github-artifact-attestation/action.yml",
+        "name": "control:actions/github-artifact-attestation/action.yml",
+        "kind": "action",
+        "sourcePath": "actions/github-artifact-attestation/action.yml",
+        "evidencePath": "actions/github-artifact-attestation/action.yml",
+        "availability": "shipped",
+        "visibility": "public",
+        "participantFacing": true,
+        "public": true
+      },
+      {
+        "id": "control:actions/github-artifact-attestation/index.js",
+        "name": "control:actions/github-artifact-attestation/index.js",
+        "kind": "action",
+        "sourcePath": "actions/github-artifact-attestation/index.js",
+        "evidencePath": "actions/github-artifact-attestation/index.js",
+        "availability": "shipped",
+        "visibility": "public",
+        "participantFacing": true,
+        "public": true
+      },
       {
         "id": "control:.github/workflows/release-propagation.yml",
         "name": "control:.github/workflows/release-propagation.yml",
@@ -5458,6 +5644,6 @@
         }
       }
     ],
-    "publicSurfaceCount": 348
+    "publicSurfaceCount": 360
   }
 }

package/dist/site/kfd-upstream-aggregate.json

@@ -4,7 +4,7 @@
   "product": {
     "id": "kungfu-tech-buildchain",
     "name": "@kungfu-tech/buildchain",
-    "version": "3.0.2-alpha.4",
+    "version": "3.0.2-alpha.6",
     "repository": "https://github.com/kungfu-systems/buildchain"
   },
   "source": {

package/dist/site/manual-registry.json

@@ -9,7 +9,7 @@
       "title": "Buildchain documentation map",
       "path": "docs/MAP.md",
       "plane": "use",
-      "digest": "sha256:fc8f7c63b8427e513f9524b8e22e4b0dcd8981fcc724417a29b942fe237fc0a9",
+      "digest": "sha256:23158252e5d2bd09b9b54dc08a0a452562e4b3a6ec3861b991632a34199d9820",
       "capabilityGroup": "getting-started",
       "audience": [
         "agent",
@@ -50,7 +50,7 @@
       "title": "Release Passport protocol",
       "path": "docs/release-passport.md",
       "plane": "verify",
-      "digest": "sha256:ed29d25882cbf4ec062abc21e7d069a6377eaf7e3171c24642dfe08da2e4c05b",
+      "digest": "sha256:d698078075700e60bafb9677bc4c35d49970136b98caaecfc51d38344285cdd5",
       "capabilityGroup": "release-passport-trust",
       "audience": [
         "release-operator",
@@ -59,6 +59,20 @@
       "maturity": "stable",
       "order": 100
     },
+    {
+      "id": "github-artifact-attestation",
+      "title": "GitHub-native Linux artifact attestation",
+      "path": "docs/github-artifact-attestation.md",
+      "plane": "verify",
+      "digest": "sha256:afdb8172bc41b9a20c0d18f4ddcc55ee287ac56db05e67e55d12de1843b724e1",
+      "capabilityGroup": "release-passport-trust",
+      "audience": [
+        "release-operator",
+        "agent"
+      ],
+      "maturity": "preview",
+      "order": 108
+    },
     {
       "id": "controller-evidence",
       "title": "Controller evidence contract",
@@ -164,7 +178,7 @@
       "title": "Binary distribution contract",
       "path": "docs/binary-distribution.md",
       "plane": "verify",
-      "digest": "sha256:ae0f8e6cafbb4c39732e6a7252d46b523b0a69e8e05d3ce7ee0b51a916b1b027",
+      "digest": "sha256:b1611dcf0e6825e53921e4c9d31d1afe16fca81e6868360bfad1902587cd52ef",
       "capabilityGroup": "release-passport-trust",
       "audience": [
         "release-operator",
@@ -275,7 +289,7 @@
       "title": "CLI and npm package",
       "path": "docs/cli.md",
       "plane": "use",
-      "digest": "sha256:47be88f5e5fd14124d03510b807722215034d34eefcebdfe2599a310350b7697",
+      "digest": "sha256:49da688f9f8b726a9169a3e4b246cb6ef07c6c626ea15c22f0b26ba1a37a58b4",
       "capabilityGroup": "api-cli-reference",
       "audience": [
         "agent",
@@ -346,7 +360,7 @@
       "title": "Reusable build surface",
       "path": "docs/reusable-build-surface.md",
       "plane": "use",
-      "digest": "sha256:cd1c110cd44d475f3ef0406626f710f0d075013db3a8b15718b1e76676e4b5f5",
+      "digest": "sha256:5d46d0f5e6e03541c187ffea154dcce703ef78e59d16bd0e4fa7c175da940480",
       "capabilityGroup": "reusable-build",
       "audience": [
         "consumer",