@kungfu-tech/buildchain 3.0.2-alpha.4 → 3.0.2-alpha.6

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (49) hide show
  1. package/README.md +1 -0
  2. package/actions/github-artifact-attestation/README.md +10 -0
  3. package/actions/promote-buildchain-ref/README.md +7 -0
  4. package/bin/buildchain.mjs +5 -0
  5. package/bin/internal/trust-release-cli.mjs +74 -3
  6. package/dist/site/artifact-schemas.json +5 -1
  7. package/dist/site/buildchain-contract.json +79 -28
  8. package/dist/site/buildchain-site.json +110 -27
  9. package/dist/site/capability-registry.json +8 -7
  10. package/dist/site/cli-registry.json +12 -0
  11. package/dist/site/controller-registry.json +40 -4
  12. package/dist/site/kfd-claims.json +205 -19
  13. package/dist/site/kfd-upstream-aggregate.json +1 -1
  14. package/dist/site/manual-registry.json +19 -5
  15. package/dist/site/node-api-registry.json +22 -9
  16. package/dist/site/page-registry.json +91 -17
  17. package/dist/site/public-surface-audit.json +132 -17
  18. package/dist/site/publication-authority-registry.json +27 -2
  19. package/dist/site/publication-registry.json +4 -4
  20. package/dist/site/release-model.json +2 -1
  21. package/dist/site/release-passport-check-manifest.json +1 -0
  22. package/dist/site/release-provenance.json +1 -0
  23. package/dist/site/schemas/release-passport-v1.schema.json +6 -0
  24. package/dist/site/site-manifest.json +17 -9
  25. package/dist/site/workflow-registry.json +91 -9
  26. package/docs/MAP.md +3 -1
  27. package/docs/binary-distribution.md +7 -0
  28. package/docs/cli.md +9 -0
  29. package/docs/dev-alpha-candidate-patrol.md +51 -13
  30. package/docs/github-artifact-attestation.md +219 -0
  31. package/docs/release-passport.md +13 -0
  32. package/docs/reusable-build-surface.md +6 -0
  33. package/package.json +2 -1
  34. package/packages/core/buildchain-contract.js +6 -0
  35. package/packages/core/buildchain-kfd-claims.js +5 -0
  36. package/packages/core/buildchain-publication-authority.js +1 -0
  37. package/packages/core/github-artifact-attestation.js +642 -0
  38. package/packages/core/index.js +19 -0
  39. package/packages/core/publication-authority.js +1 -1
  40. package/packages/core/release-passport-contract.js +2 -0
  41. package/packages/core/release-passport.js +60 -3
  42. package/scripts/check-inventory.mjs +4 -0
  43. package/scripts/create-github-artifact-attestation-policy.mjs +62 -0
  44. package/scripts/dev-alpha-candidate-patrol.mjs +471 -71
  45. package/scripts/generate-channel-promotion-workflow.mjs +6 -0
  46. package/scripts/generate-site-bundle.mjs +12 -0
  47. package/scripts/publish-github-artifact-attestation-evidence.mjs +201 -0
  48. package/scripts/release-candidate-resolver.mjs +12 -0
  49. package/scripts/stage-github-artifact-attestation-inputs.mjs +65 -0
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@kungfu-tech/buildchain",
3
- "version": "3.0.2-alpha.4",
3
+ "version": "3.0.2-alpha.6",
4
4
  "private": false,
5
5
  "description": "Buildchain Release Passport, release governance, CLI toolkit, and site facts.",
6
6
  "repository": "https://github.com/kungfu-systems/buildchain",
@@ -17,6 +17,7 @@
17
17
  "./core": "./packages/core/index.js",
18
18
  "./artifact-passport": "./packages/core/artifact-passport.js",
19
19
  "./artifact-verification-envelope": "./packages/core/artifact-verification-envelope.js",
20
+ "./github-artifact-attestation": "./packages/core/github-artifact-attestation.js",
20
21
  "./anchored-version-material": "./packages/core/anchored-version-material.js",
21
22
  "./buildchain-contract": "./packages/core/buildchain-contract.js",
22
23
  "./candidate-timeline": "./packages/core/candidate-timeline.js",
package/packages/core/buildchain-contract.js CHANGED
@@ -121,6 +121,8 @@ export function createBuildchainContractWorld({
121
121
  "runner-preset",
122
122
  "platforms-json",
123
123
  "release-candidate",
124
+ "github-artifact-attestation-subject-path",
125
+ "github-artifact-attestation-platform-id",
124
126
  "artifact-transfer-mode",
125
127
  "checkout-cache-mode",
126
128
  "checkout-cache-fallback",
@@ -196,6 +198,9 @@ export function createBuildchainContractWorld({
196
198
  "release-passport-kfd-3-artifact-verify-command",
197
199
  "release-passport-invariant-passport-jsons",
198
200
  "release-passport-invariant-passport-command",
201
+ "github-artifact-attestation-policy-json",
202
+ "github-artifact-attestation-environment",
203
+ "github-artifact-attestation-retention-days",
199
204
  "buildchain-contract-lock-path",
200
205
  "buildchain-contract-drift-issue-mode",
201
206
  "github-release",
@@ -369,6 +374,7 @@ export function createBuildchainContractWorld({
369
374
  "release-passport-kfd-3-artifact-verify-command",
370
375
  "release-passport-invariant-passport-jsons",
371
376
  "release-passport-invariant-passport-command",
377
+ "release-passport-github-artifact-attestation-policy-jsons",
372
378
  "github-release",
373
379
  "github-release-title",
374
380
  "github-release-notes",
package/packages/core/buildchain-kfd-claims.js CHANGED
@@ -16,6 +16,7 @@ export const BUILDCHAIN_AGENT_MANUALS = Object.freeze([
16
16
  { id: "auditable-demo", title: "Auditable demo artifact pipeline", path: "docs/auditable-demo.md", plane: "verify" },
17
17
  { id: "install", title: "Install and verify Buildchain", path: "docs/install.md", plane: "use" },
18
18
  { id: "release-passport", title: "Release Passport protocol", path: "docs/release-passport.md", plane: "verify" },
19
+ { id: "github-artifact-attestation", title: "GitHub-native Linux artifact attestation", path: "docs/github-artifact-attestation.md", plane: "verify" },
19
20
  { id: "controller-evidence", title: "Controller evidence contract", path: "docs/controller-evidence.md", plane: "verify" },
20
21
  { id: "publication-authority", title: "Sealed publication authority", path: "docs/publication-authority.md", plane: "verify" },
21
22
  { id: "github-governance-authority", title: "GitHub governance authority", path: "docs/github-governance-authority.md", plane: "verify" },
@@ -71,6 +72,7 @@ const SITE_CONTRACT_FILES = Object.freeze([
71
72
  const SCHEMA_AND_STANDARD_FILES = Object.freeze([
72
73
  "packages/core/kfd-gate.js",
73
74
  "packages/core/release-passport.js",
75
+ "packages/core/github-artifact-attestation.js",
74
76
  "packages/core/buildchain-contract.js",
75
77
  "packages/core/controller-evidence.js",
76
78
  "packages/core/publication-authority.js",
@@ -89,6 +91,9 @@ const WORKFLOW_AND_ACTION_FILES = Object.freeze([
89
91
  ".github/workflows/.release-candidate-promote.yml",
90
92
  ".github/workflows/release-candidate-promote.yml",
91
93
  ".github/workflows/buildchain-ref-promotion.yml",
94
+ ".github/workflows/github-artifact-attestation.yml",
95
+ "actions/github-artifact-attestation/action.yml",
96
+ "actions/github-artifact-attestation/index.js",
92
97
  ".github/workflows/release-propagation.yml",
93
98
  "actions/macos-credential-island/action.yml",
94
99
  "actions/macos-credential-island/index.js",
package/packages/core/buildchain-publication-authority.js CHANGED
@@ -31,6 +31,7 @@ const DESCRIPTORS = Object.freeze([
31
31
  [".github/workflows/dev-merge-queue-governance.yml", "governance-write"],
32
32
  [".github/workflows/dev-pr-auto-merge.yml", "governance-write"],
33
33
  [".github/workflows/github-governance-audit.yml", "governance-write"],
34
+ [".github/workflows/github-artifact-attestation.yml", "evidence-publication", true, ["github-artifact-attestation"], "oidc", "consumer-defined", "caller-bound", "caller-bound"],
34
35
  [".github/workflows/npm-publish.yml", "dry-run-only"],
35
36
  [".github/workflows/paper-release-sealed.yml", "product-publication", true, ["npm-publish", "github-release"], "trusted-publishing", "none", "fixed", "caller-bound"],
36
37
  [".github/workflows/paper-release.yml", "product-publication", true, ["npm-publish", "github-release"], "trusted-publishing", "none", "fixed", "caller-bound"],