@kungfu-tech/buildchain 3.0.2 → 3.0.3-alpha.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/actions/report-buildchain-issue/README.md +1 -1
- package/contracts/buildchain-v2-residuals-v1.json +191 -0
- package/dist/site/buildchain-contract.json +58 -35
- package/dist/site/buildchain-site.json +33 -33
- package/dist/site/controller-registry.json +24 -3
- package/dist/site/kfd-claims.json +11 -6
- package/dist/site/kfd-upstream-aggregate.json +1 -1
- package/dist/site/manual-registry.json +7 -7
- package/dist/site/node-api-registry.json +6 -6
- package/dist/site/page-registry.json +22 -22
- package/dist/site/public-surface-audit.json +10 -5
- package/dist/site/publication-registry.json +4 -4
- package/dist/site/site-manifest.json +11 -11
- package/dist/site/workflow-registry.json +8 -3
- package/docs/auditable-demo.md +19 -1
- package/docs/consumer-issue-reporting.md +1 -1
- package/docs/dev-alpha-candidate-patrol.md +24 -10
- package/docs/github-governance-authority.md +23 -30
- package/docs/observed-evidence-patrol.md +28 -12
- package/docs/release-governance.md +8 -1
- package/docs/reusable-build-surface.md +124 -64
- package/docs/shifu-gate-profiles.md +7 -1
- package/docs/versioning.md +41 -21
- package/docs/web-surface-deployments.md +20 -1
- package/package.json +1 -1
- package/packages/core/artifact-signing.js +1 -0
- package/packages/core/buildchain-contract.js +1 -0
- package/packages/core/controller-evidence.js +2 -0
- package/packages/core/github-governance-authority.js +25 -17
- package/packages/core/publication-control-plane-audit.js +28 -0
- package/packages/core/release-passport.js +36 -27
- package/packages/core/stable-release-gate.js +4 -1
- package/scripts/artifact-signing-delegation.mjs +268 -0
- package/scripts/audit-github-governance.mjs +32 -13
- package/scripts/audit-publication-control-plane.mjs +17 -8
- package/scripts/auditable-demo.mjs +147 -2
- package/scripts/buildchain-patrol.mjs +1 -1
- package/scripts/check-inventory.mjs +1 -0
- package/scripts/dev-alpha-candidate-patrol.mjs +20 -0
- package/scripts/dispatch-artifact-signing-authority.mjs +7 -1
- package/scripts/finalize-native-artifact-signing-result.mjs +114 -31
- package/scripts/gate-profile-core.mjs +6 -1
- package/scripts/inspect-artifact-signing-requests.mjs +45 -14
- package/scripts/observed-evidence.mjs +151 -33
- package/scripts/reconcile-github-governance.mjs +8 -1
- package/scripts/resolve-artifact-signing-upload-route.mjs +55 -0
- package/scripts/run-candidate-body-prefix-renderer.mjs +187 -0
- package/scripts/runtime-ref-core.mjs +13 -2
- package/scripts/seal-artifact-signing-requests.mjs +51 -6
- package/scripts/stable-candidate-qualification.mjs +8 -0
- package/scripts/verify-artifact-signing-results.mjs +26 -1
- package/scripts/web-surface-production-decision.mjs +19 -3
|
@@ -122,6 +122,10 @@
|
|
|
122
122
|
"classification": "redacted",
|
|
123
123
|
"source": "workflow-call-secret"
|
|
124
124
|
},
|
|
125
|
+
"artifact-compression-level": {
|
|
126
|
+
"classification": "included",
|
|
127
|
+
"source": "workflow-call-input"
|
|
128
|
+
},
|
|
125
129
|
"artifact-name": {
|
|
126
130
|
"classification": "included",
|
|
127
131
|
"source": "workflow-call-input"
|
|
@@ -166,6 +170,10 @@
|
|
|
166
170
|
"classification": "included",
|
|
167
171
|
"source": "workflow-call-input"
|
|
168
172
|
},
|
|
173
|
+
"artifact-signing-request-upload-no-proxy": {
|
|
174
|
+
"classification": "included",
|
|
175
|
+
"source": "workflow-call-input"
|
|
176
|
+
},
|
|
169
177
|
"artifact-transfer-mode": {
|
|
170
178
|
"classification": "included",
|
|
171
179
|
"source": "workflow-call-input"
|
|
@@ -429,6 +437,10 @@
|
|
|
429
437
|
"id": "build",
|
|
430
438
|
"required": true
|
|
431
439
|
},
|
|
440
|
+
{
|
|
441
|
+
"id": "signing-finalization",
|
|
442
|
+
"required": true
|
|
443
|
+
},
|
|
432
444
|
{
|
|
433
445
|
"id": "credential-island",
|
|
434
446
|
"required": false
|
|
@@ -445,6 +457,7 @@
|
|
|
445
457
|
"capabilities": [
|
|
446
458
|
"source-lock",
|
|
447
459
|
"lifecycle-build",
|
|
460
|
+
"artifact-signing-finalization",
|
|
448
461
|
"credential-island",
|
|
449
462
|
"lifecycle-verify",
|
|
450
463
|
"artifact-admission"
|
|
@@ -455,7 +468,7 @@
|
|
|
455
468
|
"controller-receipt"
|
|
456
469
|
]
|
|
457
470
|
},
|
|
458
|
-
"digest": "sha256:
|
|
471
|
+
"digest": "sha256:c9c8c1493e95aecfc1a2ec092f9490c1e16b9a9cdc1e3673bf6bdd329baac523"
|
|
459
472
|
},
|
|
460
473
|
{
|
|
461
474
|
"schemaVersion": 1,
|
|
@@ -503,6 +516,10 @@
|
|
|
503
516
|
"classification": "redacted",
|
|
504
517
|
"source": "workflow-call-secret"
|
|
505
518
|
},
|
|
519
|
+
"artifact-compression-level": {
|
|
520
|
+
"classification": "included",
|
|
521
|
+
"source": "workflow-call-input"
|
|
522
|
+
},
|
|
506
523
|
"artifact-name": {
|
|
507
524
|
"classification": "included",
|
|
508
525
|
"source": "workflow-call-input"
|
|
@@ -547,6 +564,10 @@
|
|
|
547
564
|
"classification": "included",
|
|
548
565
|
"source": "workflow-call-input"
|
|
549
566
|
},
|
|
567
|
+
"artifact-signing-request-upload-no-proxy": {
|
|
568
|
+
"classification": "included",
|
|
569
|
+
"source": "workflow-call-input"
|
|
570
|
+
},
|
|
550
571
|
"artifact-transfer-mode": {
|
|
551
572
|
"classification": "included",
|
|
552
573
|
"source": "workflow-call-input"
|
|
@@ -829,7 +850,7 @@
|
|
|
829
850
|
"controller-receipt"
|
|
830
851
|
]
|
|
831
852
|
},
|
|
832
|
-
"digest": "sha256:
|
|
853
|
+
"digest": "sha256:eac228a4746684d61d9664e8bce63e20d4b1e7bea0afd8718c8584cef941a95d"
|
|
833
854
|
},
|
|
834
855
|
{
|
|
835
856
|
"schemaVersion": 1,
|
|
@@ -2176,5 +2197,5 @@
|
|
|
2176
2197
|
"digest": "sha256:b6f53563c0adc859bc586c05fce560a5094d7d9666438d63c5fd3e1fc4774555"
|
|
2177
2198
|
}
|
|
2178
2199
|
],
|
|
2179
|
-
"digest": "sha256:
|
|
2200
|
+
"digest": "sha256:f18f3b706683ae34168ed582d0b51f2d7d2574d627dda4c7b667d01f86623331"
|
|
2180
2201
|
}
|
|
@@ -14,14 +14,14 @@
|
|
|
14
14
|
},
|
|
15
15
|
"runtimeContract": {
|
|
16
16
|
"contract": "kungfu-buildchain-runtime-contract-world",
|
|
17
|
-
"compatibilityDigest": "sha256:
|
|
17
|
+
"compatibilityDigest": "sha256:32a651504c57829085dc8863f0e41dee98eb60708ff6dec958c9c7e4b1010102",
|
|
18
18
|
"majorLine": "v3"
|
|
19
19
|
},
|
|
20
20
|
"publicSurfaceReverseAudit": {
|
|
21
21
|
"contract": "kungfu-buildchain-public-surface-reverse-audit",
|
|
22
22
|
"path": "dist/site/public-surface-audit.json",
|
|
23
23
|
"status": "passed",
|
|
24
|
-
"sha256": "
|
|
24
|
+
"sha256": "136d1f27a3ffa01d9d4581eb9086685a3470a61ce4b6e0897feb2e140aedf577",
|
|
25
25
|
"summary": {
|
|
26
26
|
"cliCommandCount": 97,
|
|
27
27
|
"workflowCount": 57,
|
|
@@ -228,7 +228,7 @@
|
|
|
228
228
|
"contract": "kungfu-buildchain-public-surface-reverse-audit",
|
|
229
229
|
"path": "dist/site/public-surface-audit.json",
|
|
230
230
|
"status": "passed",
|
|
231
|
-
"sha256": "
|
|
231
|
+
"sha256": "136d1f27a3ffa01d9d4581eb9086685a3470a61ce4b6e0897feb2e140aedf577",
|
|
232
232
|
"summary": {
|
|
233
233
|
"cliCommandCount": 97,
|
|
234
234
|
"workflowCount": 57,
|
|
@@ -3045,8 +3045,9 @@
|
|
|
3045
3045
|
"visibility": "public",
|
|
3046
3046
|
"participantFacing": true,
|
|
3047
3047
|
"public": true,
|
|
3048
|
-
"inputCount":
|
|
3048
|
+
"inputCount": 74,
|
|
3049
3049
|
"inputs": [
|
|
3050
|
+
"artifact-compression-level",
|
|
3050
3051
|
"artifact-name",
|
|
3051
3052
|
"artifact-name-template",
|
|
3052
3053
|
"artifact-paths",
|
|
@@ -3058,6 +3059,7 @@
|
|
|
3058
3059
|
"artifact-relay-s3-role-arn",
|
|
3059
3060
|
"artifact-relay-s3-upload-role-arn",
|
|
3060
3061
|
"artifact-retention-days",
|
|
3062
|
+
"artifact-signing-request-upload-no-proxy",
|
|
3061
3063
|
"artifact-transfer-mode",
|
|
3062
3064
|
"build-command",
|
|
3063
3065
|
"buildchain-contract-compatibility-policy",
|
|
@@ -3723,8 +3725,9 @@
|
|
|
3723
3725
|
"visibility": "public",
|
|
3724
3726
|
"participantFacing": true,
|
|
3725
3727
|
"public": true,
|
|
3726
|
-
"inputCount":
|
|
3728
|
+
"inputCount": 77,
|
|
3727
3729
|
"inputs": [
|
|
3730
|
+
"artifact-compression-level",
|
|
3728
3731
|
"artifact-name",
|
|
3729
3732
|
"artifact-name-template",
|
|
3730
3733
|
"artifact-paths",
|
|
@@ -3736,6 +3739,7 @@
|
|
|
3736
3739
|
"artifact-relay-s3-role-arn",
|
|
3737
3740
|
"artifact-relay-s3-upload-role-arn",
|
|
3738
3741
|
"artifact-retention-days",
|
|
3742
|
+
"artifact-signing-request-upload-no-proxy",
|
|
3739
3743
|
"artifact-transfer-mode",
|
|
3740
3744
|
"build-command",
|
|
3741
3745
|
"buildchain-alpha-contract-lock-path",
|
|
@@ -3978,7 +3982,7 @@
|
|
|
3978
3982
|
"visibility": "public",
|
|
3979
3983
|
"participantFacing": true,
|
|
3980
3984
|
"public": true,
|
|
3981
|
-
"inputCount":
|
|
3985
|
+
"inputCount": 12,
|
|
3982
3986
|
"inputs": [
|
|
3983
3987
|
"alpha-workflow-path",
|
|
3984
3988
|
"buildchain-ref",
|
|
@@ -3988,6 +3992,7 @@
|
|
|
3988
3992
|
"dry-run",
|
|
3989
3993
|
"max-age-seconds",
|
|
3990
3994
|
"pull-request-body-prefix",
|
|
3995
|
+
"pull-request-body-prefix-renderer",
|
|
3991
3996
|
"settlement-authorized",
|
|
3992
3997
|
"source-branch",
|
|
3993
3998
|
"target-branch"
|
|
@@ -23,7 +23,7 @@
|
|
|
23
23
|
"title": "Auditable demo artifact pipeline",
|
|
24
24
|
"path": "docs/auditable-demo.md",
|
|
25
25
|
"plane": "verify",
|
|
26
|
-
"digest": "sha256:
|
|
26
|
+
"digest": "sha256:6af21e489bc3d2e9e2d01838926f1fbab6d74d92446d1f9cfc5eb08e090dd3a5",
|
|
27
27
|
"capabilityGroup": "reusable-build",
|
|
28
28
|
"audience": [
|
|
29
29
|
"consumer",
|
|
@@ -107,7 +107,7 @@
|
|
|
107
107
|
"title": "GitHub governance authority",
|
|
108
108
|
"path": "docs/github-governance-authority.md",
|
|
109
109
|
"plane": "verify",
|
|
110
|
-
"digest": "sha256:
|
|
110
|
+
"digest": "sha256:304d0246d21bdd0f6a77183ac6839a5d1234d08d98bd5da9728c85a65b1ff7b7",
|
|
111
111
|
"capabilityGroup": "governance-versioning",
|
|
112
112
|
"audience": [
|
|
113
113
|
"maintainer",
|
|
@@ -192,7 +192,7 @@
|
|
|
192
192
|
"title": "Consumer issue reporting",
|
|
193
193
|
"path": "docs/consumer-issue-reporting.md",
|
|
194
194
|
"plane": "use",
|
|
195
|
-
"digest": "sha256:
|
|
195
|
+
"digest": "sha256:20c33ab68e91227837626d1289d6c5540a318c8ff484d9a1f0ebe7dbe8626d02",
|
|
196
196
|
"capabilityGroup": "observability-diagnostics",
|
|
197
197
|
"audience": [
|
|
198
198
|
"consumer",
|
|
@@ -360,7 +360,7 @@
|
|
|
360
360
|
"title": "Reusable build surface",
|
|
361
361
|
"path": "docs/reusable-build-surface.md",
|
|
362
362
|
"plane": "use",
|
|
363
|
-
"digest": "sha256:
|
|
363
|
+
"digest": "sha256:4409c8259c3613b51a1db809493e73d9b85a0d16d292a491046fd36770d98fb0",
|
|
364
364
|
"capabilityGroup": "reusable-build",
|
|
365
365
|
"audience": [
|
|
366
366
|
"consumer",
|
|
@@ -387,7 +387,7 @@
|
|
|
387
387
|
"title": "Release governance",
|
|
388
388
|
"path": "docs/release-governance.md",
|
|
389
389
|
"plane": "why",
|
|
390
|
-
"digest": "sha256:
|
|
390
|
+
"digest": "sha256:8c31e6daccd40ea4e7cb08e8fa3eb2f238006e331621aed45eddcb80aee5532f",
|
|
391
391
|
"capabilityGroup": "governance-versioning",
|
|
392
392
|
"audience": [
|
|
393
393
|
"maintainer",
|
|
@@ -429,7 +429,7 @@
|
|
|
429
429
|
"title": "Versioning",
|
|
430
430
|
"path": "docs/versioning.md",
|
|
431
431
|
"plane": "why",
|
|
432
|
-
"digest": "sha256:
|
|
432
|
+
"digest": "sha256:52f58a1a69ea924cb1fae11bb6a8def2b0c66cc4ab08416553cf680c213b5ded",
|
|
433
433
|
"capabilityGroup": "governance-versioning",
|
|
434
434
|
"audience": [
|
|
435
435
|
"maintainer"
|
|
@@ -442,7 +442,7 @@
|
|
|
442
442
|
"title": "Web surface deployments",
|
|
443
443
|
"path": "docs/web-surface-deployments.md",
|
|
444
444
|
"plane": "use",
|
|
445
|
-
"digest": "sha256:
|
|
445
|
+
"digest": "sha256:6b907af93c55ffd8274cd83ad87a45dd48eb9a01938cf419aafebb5557be5821",
|
|
446
446
|
"capabilityGroup": "site-and-propagation",
|
|
447
447
|
"audience": [
|
|
448
448
|
"site",
|
|
@@ -99,7 +99,7 @@
|
|
|
99
99
|
"specifier": "@kungfu-tech/buildchain/artifact-signing",
|
|
100
100
|
"export": "./artifact-signing",
|
|
101
101
|
"target": "./packages/core/artifact-signing.js",
|
|
102
|
-
"digest": "sha256:
|
|
102
|
+
"digest": "sha256:7b4c88201125f08645092b121eeeab0390b4fdee665f0d6c949217cb6545d590",
|
|
103
103
|
"summary": "Credential-free artifact signing declarations, source-bound requests, authority receipts, profile resolution, and fail-closed validation APIs.",
|
|
104
104
|
"capabilityGroup": "reusable-build",
|
|
105
105
|
"audience": [
|
|
@@ -151,7 +151,7 @@
|
|
|
151
151
|
"specifier": "@kungfu-tech/buildchain/buildchain-contract",
|
|
152
152
|
"export": "./buildchain-contract",
|
|
153
153
|
"target": "./packages/core/buildchain-contract.js",
|
|
154
|
-
"digest": "sha256:
|
|
154
|
+
"digest": "sha256:325ec94cd696d84dfb084add313b3110bde410db0a5822e1fecd3988fef51022",
|
|
155
155
|
"summary": "Runtime contract world and compatibility digest APIs for floating-ref drift checks.",
|
|
156
156
|
"capabilityGroup": "governance-versioning",
|
|
157
157
|
"audience": [
|
|
@@ -203,7 +203,7 @@
|
|
|
203
203
|
"specifier": "@kungfu-tech/buildchain/controller-evidence",
|
|
204
204
|
"export": "./controller-evidence",
|
|
205
205
|
"target": "./packages/core/controller-evidence.js",
|
|
206
|
-
"digest": "sha256:
|
|
206
|
+
"digest": "sha256:5237d49ad4bb4cc803bdeb96039967b1896145483f6d9f40c7e06e0303545457",
|
|
207
207
|
"summary": "Project-independent controller descriptors, source/runtime-bound plans, receipts, aggregates, and validation APIs.",
|
|
208
208
|
"capabilityGroup": "reusable-build",
|
|
209
209
|
"audience": [
|
|
@@ -411,7 +411,7 @@
|
|
|
411
411
|
"specifier": "@kungfu-tech/buildchain/publication-control-plane-audit",
|
|
412
412
|
"export": "./publication-control-plane-audit",
|
|
413
413
|
"target": "./packages/core/publication-control-plane-audit.js",
|
|
414
|
-
"digest": "sha256:
|
|
414
|
+
"digest": "sha256:a2d207047837abddf9d1f2b728b5a730467917444cbcb2221310f8c45fe0ce5d",
|
|
415
415
|
"summary": "Read-only publication control-plane snapshot evaluation APIs.",
|
|
416
416
|
"capabilityGroup": "release-passport-trust",
|
|
417
417
|
"audience": [
|
|
@@ -437,7 +437,7 @@
|
|
|
437
437
|
"specifier": "@kungfu-tech/buildchain/github-governance-authority",
|
|
438
438
|
"export": "./github-governance-authority",
|
|
439
439
|
"target": "./packages/core/github-governance-authority.js",
|
|
440
|
-
"digest": "sha256:
|
|
440
|
+
"digest": "sha256:4aa2aeeb39516ae17db4d671ee8ce5fdce552a969db9858d8128f1a897acee89",
|
|
441
441
|
"summary": "Fail-closed GitHub ownership, effective-policy, managed-zone admission, rollout-plan, and immutable receipt APIs.",
|
|
442
442
|
"capabilityGroup": "governance-versioning",
|
|
443
443
|
"audience": [
|
|
@@ -489,7 +489,7 @@
|
|
|
489
489
|
"specifier": "@kungfu-tech/buildchain/release-passport",
|
|
490
490
|
"export": "./release-passport",
|
|
491
491
|
"target": "./packages/core/release-passport.js",
|
|
492
|
-
"digest": "sha256:
|
|
492
|
+
"digest": "sha256:46f9f5dd3c27da361b9b4dad88df6630d77d025e13a7c3711cc844ed598d449d",
|
|
493
493
|
"summary": "Release passport collection, verification, explanation, and evidence APIs.",
|
|
494
494
|
"capabilityGroup": "release-passport-trust",
|
|
495
495
|
"audience": [
|