@kungfu-tech/buildchain 3.0.2-alpha.4 → 3.0.2-alpha.6

package/dist/site/public-surface-audit.json

@@ -3,11 +3,11 @@
   "contract": "kungfu-buildchain-public-surface-reverse-audit",
   "status": "passed",
   "summary": {
-    "cliCommandCount": 96,
-    "workflowCount": 54,
-    "actionCount": 5,
-    "sitePageCount": 57,
-    "docCommandRefCount": 286,
+    "cliCommandCount": 97,
+    "workflowCount": 55,
+    "actionCount": 6,
+    "sitePageCount": 59,
+    "docCommandRefCount": 291,
     "failureCount": 0
   },
   "enumerated": {
@@ -462,6 +462,11 @@
         "source": "bin/buildchain.mjs",
         "usage": "buildchain verify artifact-envelope <file-or-json> [--assessment-time <epoch>]"
       },
+      {
+        "id": "verify-github-artifact-attestation",
+        "source": "bin/buildchain.mjs",
+        "usage": "buildchain verify github-artifact-attestation <artifact>"
+      },
       {
         "id": "verify-infra-contract-evidence-bundle",
         "source": "bin/buildchain.mjs",
@@ -596,6 +601,9 @@
           "expected-artifacts-json",
           "fail-fast",
           "gate-profile-aggregate-json",
+          "github-artifact-attestation-platform-id",
+          "github-artifact-attestation-signer-sha",
+          "github-artifact-attestation-subject-path",
           "install-command",
           "kfd-agent-hub",
           "lifecycle-timeout-minutes",
@@ -629,7 +637,7 @@
           "verify-command",
           "working-directory"
         ],
-        "inputCount": 69,
+        "inputCount": 72,
         "secrets": [
           "BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN",
           "BUILDCHAIN_ARTIFACT_RELAY_S3_ROLE_ARN",
@@ -828,6 +836,9 @@
           "buildchain-repository",
           "channel",
           "dry-run",
+          "github-artifact-attestation-environment",
+          "github-artifact-attestation-policy-json",
+          "github-artifact-attestation-retention-days",
           "github-governance-receipt-json",
           "github-release",
           "github-release-notes",
@@ -901,7 +912,7 @@
           "target-sha",
           "trusted-publishing"
         ],
-        "inputCount": 85,
+        "inputCount": 88,
         "secrets": [
           "BUILDCHAIN_ISSUE_APP_ID",
           "BUILDCHAIN_ISSUE_APP_PRIVATE_KEY",
@@ -924,6 +935,10 @@
           "controller-receipt-digest",
           "controller-receipt-json",
           "controller-receipt-status",
+          "github-artifact-attestation-evidence-root",
+          "github-artifact-attestation-id",
+          "github-artifact-attestation-publication-receipt-digest",
+          "github-artifact-attestation-url",
           "promoted-sha",
           "publication-capability-digest",
           "publication-commit-evidence-digest",
@@ -932,7 +947,7 @@
           "publication-commit-url",
           "release-candidate-artifact"
         ],
-        "outputCount": 15
+        "outputCount": 19
       },
       {
         "id": ".release-docker",
@@ -1363,6 +1378,9 @@
           "expected-artifacts-json",
           "fail-fast",
           "gate-profile-aggregate-json",
+          "github-artifact-attestation-platform-id",
+          "github-artifact-attestation-signer-sha",
+          "github-artifact-attestation-subject-path",
           "install-command",
           "kfd-agent-hub",
           "lifecycle-timeout-minutes",
@@ -1396,7 +1414,7 @@
           "verify-command",
           "working-directory"
         ],
-        "inputCount": 72,
+        "inputCount": 75,
         "secrets": [
           "BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN",
           "BUILDCHAIN_ARTIFACT_RELAY_S3_ROLE_ARN",
@@ -1620,22 +1638,27 @@
           "dev-workflow-path",
           "dry-run",
           "max-age-seconds",
+          "settlement-authorized",
           "source-branch",
           "target-branch"
         ],
-        "inputCount": 9,
+        "inputCount": 10,
         "secrets": [
           "promotion-token"
         ],
         "secretCount": 1,
         "outputs": [
+          "active-candidate-pr",
+          "controller-state",
           "eligible",
+          "next-candidate-sha",
           "promotion-pr",
           "result-path",
           "selected-sha",
+          "settlement-action",
           "source-lock-ref"
         ],
-        "outputCount": 5
+        "outputCount": 9
       },
       {
         "id": "dev-merge-queue-governance",
@@ -1682,6 +1705,37 @@
         ],
         "outputCount": 6
       },
+      {
+        "id": "github-artifact-attestation",
+        "path": ".github/workflows/github-artifact-attestation.yml",
+        "reusable": true,
+        "inputs": [
+          "buildchain-ref",
+          "environment",
+          "evidence-artifact-name",
+          "evidence-run-id",
+          "platform-manifest-artifact-name",
+          "platform-manifest-relative-path",
+          "policy-json",
+          "release-passport-artifact-name",
+          "release-passport-relative-path",
+          "retention-days",
+          "source-sha",
+          "subject-artifact-name",
+          "subject-relative-path"
+        ],
+        "inputCount": 13,
+        "secrets": [],
+        "secretCount": 0,
+        "outputs": [
+          "attestation-id",
+          "attestation-url",
+          "bundle-digest",
+          "evidence-artifact-name",
+          "evidence-root"
+        ],
+        "outputCount": 5
+      },
       {
         "id": "github-governance-audit",
         "path": ".github/workflows/github-governance-audit.yml",
@@ -1991,6 +2045,9 @@
           "buildchain-stable-contract-lock-path",
           "channel",
           "dry-run",
+          "github-artifact-attestation-environment",
+          "github-artifact-attestation-policy-json",
+          "github-artifact-attestation-retention-days",
           "github-governance-receipt-json",
           "github-release",
           "github-release-notes",
@@ -2053,7 +2110,7 @@
           "target-sha",
           "trusted-publishing"
         ],
-        "inputCount": 77,
+        "inputCount": 80,
         "secrets": [
           "BUILDCHAIN_ISSUE_APP_ID",
           "BUILDCHAIN_ISSUE_APP_PRIVATE_KEY",
@@ -2077,6 +2134,10 @@
           "controller-receipt-digest",
           "controller-receipt-json",
           "controller-receipt-status",
+          "github-artifact-attestation-evidence-root",
+          "github-artifact-attestation-id",
+          "github-artifact-attestation-publication-receipt-digest",
+          "github-artifact-attestation-url",
           "promoted-sha",
           "promotion-contract-lock-digest",
           "promotion-contract-lock-path",
@@ -2096,7 +2157,7 @@
           "publication-commit-url",
           "release-candidate-artifact"
         ],
-        "outputCount": 27
+        "outputCount": 31
       },
       {
         "id": "release-governance-reconcile",
@@ -2260,6 +2321,26 @@
       }
     ],
     "actionInputs": [
+      {
+        "id": "github-artifact-attestation",
+        "path": "actions/github-artifact-attestation/action.yml",
+        "inputs": [
+          "attestation-id",
+          "attestation-url",
+          "bundle-path",
+          "expected-buildchain-ref",
+          "expected-caller-repository",
+          "expected-source-sha",
+          "mode",
+          "output-dir",
+          "platform-manifest-path",
+          "policy-json",
+          "preparation-json",
+          "release-passport-path",
+          "subject-path"
+        ],
+        "inputCount": 13
+      },
       {
         "id": "macos-credential-island",
         "path": "actions/macos-credential-island/action.yml",
@@ -2332,6 +2413,7 @@
           "release-passport",
           "release-passport-build-summary-path",
           "release-passport-buildchain-self-kfd",
+          "release-passport-github-artifact-attestation-policy-jsons",
           "release-passport-impact-json",
           "release-passport-invariant-passport-command",
           "release-passport-invariant-passport-jsons",
@@ -2358,7 +2440,7 @@
           "transaction-state-path",
           "verification-command"
         ],
-        "inputCount": 66
+        "inputCount": 67
       },
       {
         "id": "report-buildchain-issue",
@@ -2450,6 +2532,10 @@
       }
     ],
     "sitePages": [
+      {
+        "id": "action:github-artifact-attestation",
+        "category": "action"
+      },
       {
         "id": "action:macos-credential-island",
         "category": "action"
@@ -2554,6 +2640,10 @@
         "id": "manual:dev-alpha-candidate-patrol",
         "category": "manual"
       },
+      {
+        "id": "manual:github-artifact-attestation",
+        "category": "manual"
+      },
       {
         "id": "manual:github-governance-authority",
         "category": "manual"
@@ -2910,6 +3000,11 @@
         "path": "docs/cli.md",
         "command": "buildchain collect github-release"
       },
+      {
+        "id": "collect-github-release",
+        "path": "docs/github-artifact-attestation.md",
+        "command": "buildchain collect github-release"
+      },
       {
         "id": "collect-github-release",
         "path": "docs/kfd-agent-hub.md",
@@ -2925,6 +3020,16 @@
         "path": "docs/release-passport.md",
         "command": "buildchain collect github-release"
       },
+      {
+        "id": "create",
+        "path": "docs/cli.md",
+        "command": "buildchain create github-artifact-attestation-policy"
+      },
+      {
+        "id": "create",
+        "path": "docs/github-artifact-attestation.md",
+        "command": "buildchain create github-artifact-attestation-policy"
+      },
       {
         "id": "dev",
         "path": "docs/cli.md",
@@ -4005,6 +4110,16 @@
         "path": "docs/release-passport.md",
         "command": "buildchain verify artifact"
       },
+      {
+        "id": "verify-github-artifact-attestation",
+        "path": "docs/cli.md",
+        "command": "buildchain verify github-artifact-attestation"
+      },
+      {
+        "id": "verify-github-artifact-attestation",
+        "path": "docs/github-artifact-attestation.md",
+        "command": "buildchain verify github-artifact-attestation"
+      },
       {
         "id": "verify-infra-contract-evidence-bundle",
         "path": "docs/cli.md",
@@ -4116,9 +4231,9 @@
     "cliRegistryPath": "dist/site/cli-registry.json",
     "workflowRegistryPath": "dist/site/workflow-registry.json",
     "pageRegistryPath": "dist/site/page-registry.json",
-    "cliRegistryDigest": "a1c10dd6977d85a7bc793054baa549108b46d6d18098de109733e01b9151a024",
-    "workflowRegistryDigest": "adbf4d0f0f67aab550735fac44b544cb5eeeaa94d1604c18953d7e81d3cb0136",
-    "pageRegistryDigest": "d0af91a01b205954540fe4388cc08dcfaa9182f4eb6cfb162bb0c987fc33eef2"
+    "cliRegistryDigest": "0be723caa314a36a1a36b03522527eb5b13e9b741e6566ff7f6ee06958df02ca",
+    "workflowRegistryDigest": "18405fac6ddfebd647c2ba7d3927ec666e6d43dc1913043b0334c91e2bf143f1",
+    "pageRegistryDigest": "b453877a28760e2446d5b58ee2bcbb3edd1059731a4046166ce1a4fc6649624b"
   },
   "comparison": {
     "missingCliRegistry": [],

package/dist/site/publication-authority-registry.json

@@ -349,6 +349,21 @@
       "runnerPolicy": "unqualified",
       "notes": ""
     },
+    {
+      "workflowPath": ".github/workflows/github-artifact-attestation.yml",
+      "authorityClass": "evidence-publication",
+      "publicationCapable": true,
+      "capabilityIds": [
+        "github-artifact-attestation"
+      ],
+      "credentialMode": "oidc",
+      "publisherWorkflowMode": "caller-bound",
+      "publisherWorkflowPath": ".github/workflows/github-artifact-attestation.yml",
+      "environment": "consumer-defined",
+      "environmentMode": "caller-bound",
+      "runnerPolicy": "qualified-measured",
+      "notes": ""
+    },
     {
       "workflowPath": ".github/workflows/github-governance-audit.yml",
       "authorityClass": "governance-write",
@@ -588,7 +603,8 @@
       "path": ".github/workflows/.release-candidate-promote.yml",
       "signals": [
         "write-permission",
-        "oidc"
+        "oidc",
+        "environment"
       ],
       "classified": true
     },
@@ -777,6 +793,15 @@
       ],
       "classified": true
     },
+    {
+      "path": ".github/workflows/github-artifact-attestation.yml",
+      "signals": [
+        "write-permission",
+        "oidc",
+        "environment"
+      ],
+      "classified": true
+    },
     {
       "path": ".github/workflows/github-governance-audit.yml",
       "signals": [
@@ -908,5 +933,5 @@
       "classified": false
     }
   ],
-  "registryDigest": "63da1d278191895989a87b3dc6b4eda344c1e9cefd97fcdcb114438b9371e57b"
+  "registryDigest": "26c309e610d1d8885cfd7d78fb7a574be903bf9085d5db929f9b41005c4f682b"
 }

package/dist/site/publication-registry.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-publication-release-registry",
-  "generatedAt": "2026-07-27T05:08:19.148Z",
-  "publishedAt": "2026-07-27T05:08:19.148Z",
+  "generatedAt": "2026-07-27T11:31:51.000Z",
+  "publishedAt": "2026-07-27T11:31:51.000Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "ba9a63a1960beab3660cacaca76ceed02ea9a0f1",
+  "sourceRevision": "e48aadba016f39ead070e73eff9a7c4c1a25d08b",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -32,7 +32,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "3.0.2-alpha.4",
+    "version": "3.0.2-alpha.6",
     "versionSource": "package.json#version"
   },
   "sourceKind": "package-site-bundle",

package/dist/site/release-model.json

@@ -45,7 +45,8 @@
     "evidenceAssets": [
       "publish evidence JSON",
       "buildchain.release.json",
-      "release passport assets"
+      "release passport assets",
+      "GitHub artifact attestation Sigstore bundle and Buildchain evidence JSON"
     ],
     "owner": "promote-buildchain-ref"
   },

package/dist/site/release-passport-check-manifest.json

@@ -43,6 +43,7 @@
       "distTagPromotion",
       "controllerReceipts",
       "kfdSupport",
+      "githubArtifactAttestations",
       "artifacts",
       "evidence",
       "recovery"

package/dist/site/release-provenance.json

@@ -14,6 +14,7 @@
       "./core": "./packages/core/index.js",
       "./artifact-passport": "./packages/core/artifact-passport.js",
       "./artifact-verification-envelope": "./packages/core/artifact-verification-envelope.js",
+      "./github-artifact-attestation": "./packages/core/github-artifact-attestation.js",
       "./anchored-version-material": "./packages/core/anchored-version-material.js",
       "./buildchain-contract": "./packages/core/buildchain-contract.js",
       "./candidate-timeline": "./packages/core/candidate-timeline.js",

package/dist/site/schemas/release-passport-v1.schema.json

@@ -187,6 +187,12 @@
         "type": "object"
       }
     },
+    "githubArtifactAttestations": {
+      "type": "array",
+      "items": {
+        "type": "object"
+      }
+    },
     "kfd-1": {
       "type": "object"
     },

package/dist/site/site-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-manifest",
-  "generatedAt": "2026-07-27T05:08:19.148Z",
-  "publishedAt": "2026-07-27T05:08:19.148Z",
+  "generatedAt": "2026-07-27T11:31:51.000Z",
+  "publishedAt": "2026-07-27T11:31:51.000Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "ba9a63a1960beab3660cacaca76ceed02ea9a0f1",
+  "sourceRevision": "e48aadba016f39ead070e73eff9a7c4c1a25d08b",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "3.0.2-alpha.4",
+    "version": "3.0.2-alpha.6",
     "versionSource": "package.json#version"
   },
   "entrypoint": "buildchain-site.json",
@@ -53,7 +53,7 @@
       "path": "docs/MAP.md",
       "plane": "use",
       "exists": true,
-      "digest": "sha256:fc8f7c63b8427e513f9524b8e22e4b0dcd8981fcc724417a29b942fe237fc0a9"
+      "digest": "sha256:23158252e5d2bd09b9b54dc08a0a452562e4b3a6ec3861b991632a34199d9820"
     },
     {
       "id": "auditable-demo",
@@ -77,7 +77,15 @@
       "path": "docs/release-passport.md",
       "plane": "verify",
       "exists": true,
-      "digest": "sha256:ed29d25882cbf4ec062abc21e7d069a6377eaf7e3171c24642dfe08da2e4c05b"
+      "digest": "sha256:d698078075700e60bafb9677bc4c35d49970136b98caaecfc51d38344285cdd5"
+    },
+    {
+      "id": "github-artifact-attestation",
+      "title": "GitHub-native Linux artifact attestation",
+      "path": "docs/github-artifact-attestation.md",
+      "plane": "verify",
+      "exists": true,
+      "digest": "sha256:afdb8172bc41b9a20c0d18f4ddcc55ee287ac56db05e67e55d12de1843b724e1"
     },
     {
       "id": "controller-evidence",
@@ -141,7 +149,7 @@
       "path": "docs/binary-distribution.md",
       "plane": "verify",
       "exists": true,
-      "digest": "sha256:ae0f8e6cafbb4c39732e6a7252d46b523b0a69e8e05d3ce7ee0b51a916b1b027"
+      "digest": "sha256:b1611dcf0e6825e53921e4c9d31d1afe16fca81e6868360bfad1902587cd52ef"
     },
     {
       "id": "consumer-issue-reporting",
@@ -205,7 +213,7 @@
       "path": "docs/cli.md",
       "plane": "use",
       "exists": true,
-      "digest": "sha256:47be88f5e5fd14124d03510b807722215034d34eefcebdfe2599a310350b7697"
+      "digest": "sha256:49da688f9f8b726a9169a3e4b246cb6ef07c6c626ea15c22f0b26ba1a37a58b4"
     },
     {
       "id": "build-facts",
@@ -245,7 +253,7 @@
       "path": "docs/reusable-build-surface.md",
       "plane": "use",
       "exists": true,
-      "digest": "sha256:cd1c110cd44d475f3ef0406626f710f0d075013db3a8b15718b1e76676e4b5f5"
+      "digest": "sha256:5d46d0f5e6e03541c187ffea154dcce703ef78e59d16bd0e4fa7c175da940480"
     },
     {
       "id": "publish-transaction",