@kungfu-tech/buildchain 3.0.2 → 3.0.3-alpha.0

package/scripts/stable-candidate-qualification.mjs

@@ -91,8 +91,12 @@ async function ensureWorkflowEvidence({ client, repository, workflowFile, workfl
   let run = await client.findWorkflowRun({ repository, workflowFile, workflowName, headSha, runName, sourceSha });
   if (successful(run)) return { state: "existing", run };
 
+  let notBefore = "";
+  let excludeRunId = "";
   if (!active(run)) {
     if (options.dryRun) return { state: "planned", run };
+    notBefore = text(run?.created_at);
+    excludeRunId = text(run?.id);
     await client.dispatchWorkflow({ repository, workflowFile, ref, inputs: runName ? { buildchain_ref: headSha } : {} });
   }
 
@@ -104,6 +108,8 @@ async function ensureWorkflowEvidence({ client, repository, workflowFile, workfl
     headSha,
     runName,
     sourceSha,
+    notBefore,
+    excludeRunId,
     attempts: options.pollAttempts,
     intervalMs: options.pollIntervalMs,
   });
@@ -220,6 +226,8 @@ export function createGitHubQualificationClient({
           || (query.runName && (run.display_title === query.runName || run.name === query.runName))
         )
         && (!query.sourceSha || run.head_sha === query.sourceSha)
+        && (!query.notBefore || String(run.created_at || "") >= query.notBefore)
+        && (!query.excludeRunId || String(run.id || "") !== query.excludeRunId)
       ))
       .sort((left, right) => String(right.created_at).localeCompare(String(left.created_at)))[0];
   }

package/scripts/verify-artifact-signing-results.mjs

@@ -27,11 +27,36 @@ function resolveBelow(root, relative, label) {
   return target;
 }
 
+function walk(root, name, output = []) {
+  for (const entry of fs.readdirSync(root, { withFileTypes: true })) {
+    const child = path.join(root, entry.name);
+    if (entry.isDirectory()) walk(child, name, output);
+    else if (entry.isFile() && entry.name === name) output.push(child);
+  }
+  return output;
+}
+
+function resolveRequestRoot(root) {
+  const direct = path.join(root, "index.json");
+  if (fs.existsSync(direct)) return root;
+  const candidates = walk(root, "index.json").filter((candidate) => {
+    try {
+      return JSON.parse(fs.readFileSync(candidate, "utf8")).contract === "kungfu-buildchain-artifact-signing-request-index/v1";
+    } catch {
+      return false;
+    }
+  });
+  if (candidates.length !== 1) {
+    throw new Error(`expected exactly one artifact signing request index, found ${candidates.length}`);
+  }
+  return path.dirname(candidates[0]);
+}
+
 export function verifyArtifactSigningResults({
   requestRoot = process.env.BUILDCHAIN_SIGNING_REQUEST_ROOT,
   resultRoot = process.env.BUILDCHAIN_SIGNING_RESULT_ROOT,
 } = {}) {
-  const requests = path.resolve(required(requestRoot, "signing request root"));
+  const requests = resolveRequestRoot(path.resolve(required(requestRoot, "signing request root")));
   const results = path.resolve(required(resultRoot, "signing result root"));
   const requestIndex = JSON.parse(
     fs.readFileSync(path.join(requests, "index.json"), "utf8"),

package/scripts/web-surface-production-decision.mjs

@@ -37,9 +37,7 @@ export function resolveWebSurfaceProductionDecision({
       reason: trusted ? "trusted-manual-dispatch" : "manual-actor-permission-insufficient",
     });
   }
-  const reviewedReleaseEvent =
-    (eventName === "push" && refName === "main") ||
-    (eventName === "pull_request" && eventAction === "closed");
+  const reviewedReleaseEvent = eventName === "push" && refName === "main";
   if (
     reviewedReleaseEvent &&
     productionApply === true &&
@@ -57,6 +55,24 @@ export function resolveWebSurfaceProductionDecision({
       reason: "reviewed-release-pr-merged",
     });
   }
+  if (
+    eventName === "pull_request" &&
+    eventAction === "closed" &&
+    productionApply === true &&
+    productionReleaseOnMain === true &&
+    releaseApproved === true
+  ) {
+    return createWebSurfaceProductionDecision({
+      approved: false,
+      kind: "none",
+      repository,
+      sourceSha,
+      actor,
+      releasePr,
+      releaseSource,
+      reason: "release-pr-verified-awaiting-main-push",
+    });
+  }
   return createWebSurfaceProductionDecision({
     approved: false,
     kind: "none",