@kungfu-tech/buildchain 3.0.2 → 3.0.3-alpha.1

package/scripts/aws-windows-jit-core.mjs

@@ -0,0 +1,374 @@
+import { digest } from "./aws-runner-burst-core.mjs";
+
+export const AWS_WINDOWS_JIT_CONTRACT = "kungfu-buildchain-aws-windows-jit/v1";
+
+export const WINDOWS_EC2_JIT = Object.freeze({
+  phase: "windows-ec2-jit",
+  region: "us-east-1",
+  repository: "kungfu-systems/kungfu",
+  stack: "kungfu-buildchain-windows-jit",
+  instanceType: "c7i.4xlarge",
+  pricePerHourUsd: 1.45,
+  maximumInstanceLifetimeMinutes: 180,
+  maxConcurrentInstances: 2,
+  maxAcceptedInstances: 6,
+  budgetLimitUsd: 40,
+  minimumSmokeJobs: 1,
+  minimumFullJobs: 3,
+  maximumCleanupLatencySeconds: 900,
+  runnerVersion: "2.336.0",
+  runnerArchive: "actions-runner-win-x64-2.336.0.zip",
+  runnerArchiveSha256:
+    "d59123a43003e357b0805b5d0f611d0bd2f65ab67d51bd070dd4e7a0f685c162",
+  powerShellVersion: "7.6.4",
+  powerShellArchive: "PowerShell-7.6.4-win-x64.msi",
+  powerShellArchiveSha256:
+    "d11942df52fd12470169797abfa4781d9480efdc81000ba4fa55a5b921ed8dd0",
+  amiSsmParameter:
+    "/aws/service/ami-windows-latest/Windows_Server-2025-English-Full-Base",
+  labelPrefix: "aws-us-ec2-windows-jit-",
+  jitParameterPrefix: "/kungfu/burst/windows/",
+});
+
+function exactSha(value, label) {
+  const normalized = String(value || "")
+    .trim()
+    .toLowerCase();
+  if (!/^[0-9a-f]{40}$/.test(normalized)) {
+    throw new Error(`${label} must be an exact 40-character Git SHA`);
+  }
+  return normalized;
+}
+
+function finiteNumber(value, label) {
+  const parsed = Number(value);
+  if (!Number.isFinite(parsed) || parsed < 0) {
+    throw new Error(`${label} must be a non-negative finite number`);
+  }
+  return parsed;
+}
+
+function iso(value, label) {
+  const parsed = new Date(value || "");
+  if (!Number.isFinite(parsed.getTime())) {
+    throw new Error(`${label} must be an ISO timestamp`);
+  }
+  return parsed.toISOString();
+}
+
+export function windowsJitRunnerLabel(value) {
+  const label = String(value || "")
+    .trim()
+    .toLowerCase();
+  const pattern = new RegExp(
+    `^${WINDOWS_EC2_JIT.labelPrefix}[a-z0-9][a-z0-9-]{0,31}$`,
+  );
+  if (!pattern.test(label)) {
+    throw new Error(
+      `runner label must match ${WINDOWS_EC2_JIT.labelPrefix}<bounded-id>`,
+    );
+  }
+  return label;
+}
+
+export function windowsJitRunnerLabels(value) {
+  return ["self-hosted", "Windows", "X64", windowsJitRunnerLabel(value)];
+}
+
+export function renderWindowsJitBootstrap(template, values = {}) {
+  const runnerLabel = windowsJitRunnerLabel(values.runnerLabel);
+  const jitParameterName = String(values.jitParameterName || "").trim();
+  if (
+    !jitParameterName.startsWith(WINDOWS_EC2_JIT.jitParameterPrefix) ||
+    !/^\/[A-Za-z0-9._/-]+$/.test(jitParameterName)
+  ) {
+    throw new Error("jitParameterName must use the dedicated Windows prefix");
+  }
+  const bounded = {
+    REGION: String(values.region || WINDOWS_EC2_JIT.region),
+    JIT_PARAMETER_NAME: jitParameterName,
+    EVIDENCE_BUCKET: String(values.evidenceBucket || ""),
+    RUNNER_LABEL: runnerLabel,
+    SOURCE_SHA: exactSha(values.sourceSha, "sourceSha"),
+    GITHUB_RUN_ID: String(values.githubRunId || ""),
+    GITHUB_RUN_ATTEMPT: String(values.githubRunAttempt || ""),
+    AMI_ID: String(values.amiId || ""),
+    AMI_NAME: String(values.amiName || ""),
+    INSTANCE_TYPE: String(values.instanceType || WINDOWS_EC2_JIT.instanceType),
+    LAUNCHED_AT: iso(values.launchedAt, "launchedAt"),
+  };
+  const patterns = {
+    REGION: /^us-[a-z]+-\d$/,
+    EVIDENCE_BUCKET: /^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$/,
+    GITHUB_RUN_ID: /^\d+$/,
+    GITHUB_RUN_ATTEMPT: /^\d+$/,
+    AMI_ID: /^ami-[0-9a-f]+$/,
+    AMI_NAME: /^[A-Za-z0-9._-]+$/,
+    INSTANCE_TYPE: /^[a-z0-9.]+$/,
+  };
+  for (const [name, pattern] of Object.entries(patterns)) {
+    if (!pattern.test(bounded[name])) {
+      throw new Error(`${name.toLowerCase()} is invalid`);
+    }
+  }
+  let rendered = String(template || "");
+  for (const [name, value] of Object.entries(bounded)) {
+    rendered = rendered.replaceAll(`__${name}__`, value);
+  }
+  const unresolved = rendered.match(/__[A-Z0-9_]+__/g) || [];
+  if (unresolved.length) {
+    throw new Error(
+      `bootstrap has unresolved variables: ${unresolved.join(",")}`,
+    );
+  }
+  if (/encoded_jit_config|github_pat_|ghp_|gho_/.test(rendered)) {
+    throw new Error("bootstrap must not contain a GitHub credential");
+  }
+  return rendered;
+}
+
+export function windowsEc2JitPlan(overrides = {}) {
+  const config = { ...WINDOWS_EC2_JIT, ...overrides };
+  const money = (value) => Math.round(value * 100) / 100;
+  const perInstanceMaximumUsd = money(
+    (config.pricePerHourUsd * config.maximumInstanceLifetimeMinutes) / 60,
+  );
+  const maximumCommittedComputeUsd = money(
+    perInstanceMaximumUsd * config.maxAcceptedInstances,
+  );
+  const maximumRaceStopUsd = money(
+    perInstanceMaximumUsd * config.maxConcurrentInstances,
+  );
+  const maximumBoundedSpendUsd = money(
+    maximumCommittedComputeUsd + maximumRaceStopUsd,
+  );
+  if (maximumBoundedSpendUsd >= config.budgetLimitUsd) {
+    throw new Error(
+      `bounded Windows EC2 spend ${maximumBoundedSpendUsd.toFixed(2)} must remain below budget ${config.budgetLimitUsd.toFixed(2)}`,
+    );
+  }
+  const plan = {
+    schemaVersion: 1,
+    contract: AWS_WINDOWS_JIT_CONTRACT,
+    kind: "phase-plan",
+    config,
+    costEnvelope: {
+      currency: "USD",
+      perInstanceMaximumUsd,
+      maximumCommittedComputeUsd,
+      maximumRaceStopUsd,
+      maximumBoundedSpendUsd,
+      assumption:
+        "The reaper charges every accepted and race instance for the full three-hour fail-closed lifetime.",
+    },
+    invariants: {
+      repositoryScopedJit: true,
+      oneJobPerRunner: true,
+      noInboundSecurityGroupRules: true,
+      imdsv2Required: true,
+      encryptedDeleteOnTerminationRoot: true,
+      jitConfigurationDeletedAfterRead: true,
+      jitConfigurationLabels: [
+        "self-hosted",
+        "Windows",
+        "X64",
+        `${config.labelPrefix}<bounded-id>`,
+      ],
+      staticAwsCredentialsForbidden: true,
+      signingAndPublicationCredentialsForbidden: true,
+      zeroWarmCapacity: true,
+    },
+  };
+  return { ...plan, digest: digest(plan) };
+}
+
+export function createWindowsJitEvidence({
+  repository,
+  sourceSha,
+  sourceRef,
+  githubRunId,
+  githubRunAttempt,
+  githubJob,
+  runnerName,
+  runnerLabels = [],
+  instanceId,
+  instanceType,
+  amiId,
+  amiName,
+  availabilityZone,
+  launchedAt,
+  runnerStartedAt,
+  runnerExitedAt,
+  terminatedAt,
+  cleanupResult,
+  cacheMode = "off",
+  observedAt = new Date().toISOString(),
+} = {}) {
+  if (repository !== WINDOWS_EC2_JIT.repository) {
+    throw new Error(`repository must be ${WINDOWS_EC2_JIT.repository}`);
+  }
+  if (instanceType !== WINDOWS_EC2_JIT.instanceType) {
+    throw new Error(`instanceType must be ${WINDOWS_EC2_JIT.instanceType}`);
+  }
+  if (!/^i-[0-9a-f]+$/.test(String(instanceId || ""))) {
+    throw new Error("instanceId must be an EC2 instance id");
+  }
+  if (!/^ami-[0-9a-f]+$/.test(String(amiId || ""))) {
+    throw new Error("amiId must be an EC2 AMI id");
+  }
+  const labels = [...new Set(runnerLabels.map((label) => String(label).trim()))]
+    .filter(Boolean)
+    .sort();
+  const customLabel = labels.find((label) =>
+    label.startsWith(WINDOWS_EC2_JIT.labelPrefix),
+  );
+  windowsJitRunnerLabel(customLabel);
+  for (const required of ["self-hosted", "Windows", "X64"]) {
+    if (!labels.includes(required)) {
+      throw new Error(`runnerLabels must include ${required}`);
+    }
+  }
+  const evidence = {
+    schemaVersion: 1,
+    contract: AWS_WINDOWS_JIT_CONTRACT,
+    kind: "runner-evidence",
+    phase: WINDOWS_EC2_JIT.phase,
+    provider: "aws-ec2",
+    repository,
+    source: {
+      sha: exactSha(sourceSha, "sourceSha"),
+      ref: String(sourceRef || "").trim(),
+    },
+    github: {
+      runId: String(githubRunId || "").trim(),
+      runAttempt: String(githubRunAttempt || "").trim(),
+      job: String(githubJob || "").trim(),
+    },
+    runner: {
+      name: String(runnerName || "").trim(),
+      labels,
+      version: WINDOWS_EC2_JIT.runnerVersion,
+      archiveSha256: WINDOWS_EC2_JIT.runnerArchiveSha256,
+      cacheMode: String(cacheMode || "off"),
+    },
+    aws: {
+      region: WINDOWS_EC2_JIT.region,
+      instanceId: String(instanceId),
+      instanceType,
+      amiId: String(amiId),
+      amiName: String(amiName || "").trim(),
+      availabilityZone: String(availabilityZone || "").trim(),
+    },
+    lifecycle: {
+      launchedAt: iso(launchedAt, "launchedAt"),
+      runnerStartedAt: iso(runnerStartedAt, "runnerStartedAt"),
+      runnerExitedAt: iso(runnerExitedAt, "runnerExitedAt"),
+      terminatedAt: terminatedAt ? iso(terminatedAt, "terminatedAt") : null,
+      cleanupResult: String(
+        cleanupResult || "runner-exit-termination-pending",
+      ).trim(),
+    },
+    observedAt: iso(observedAt, "observedAt"),
+  };
+  for (const [label, value] of Object.entries({
+    sourceRef: evidence.source.ref,
+    runId: evidence.github.runId,
+    runAttempt: evidence.github.runAttempt,
+    job: evidence.github.job,
+    runnerName: evidence.runner.name,
+    amiName: evidence.aws.amiName,
+    availabilityZone: evidence.aws.availabilityZone,
+    cleanupResult: evidence.lifecycle.cleanupResult,
+  })) {
+    if (!value) throw new Error(`${label} is required`);
+  }
+  return { ...evidence, digest: digest(evidence) };
+}
+
+export function verifyWindowsEc2JitQualification({
+  jobs = [],
+  cancellationCleanup = {},
+  timeoutCleanup = {},
+  registeredCloudRunners = [],
+  activeInstances = [],
+  disposableVolumes = [],
+  minCapacity = 0,
+  desiredCapacity = 0,
+  actualIncrementalSpendUsd,
+  observedAt = new Date().toISOString(),
+} = {}) {
+  const plan = windowsEc2JitPlan();
+  const issues = [];
+  const accepted = jobs.filter(
+    (job) =>
+      job?.trusted === true &&
+      job?.exactSource === true &&
+      job?.status === "succeeded" &&
+      job?.oneJobJit === true,
+  );
+  const smokeJobs = accepted.filter((job) => job.kind === "smoke");
+  const fullJobs = accepted.filter((job) => job.kind === "full");
+  if (smokeJobs.length < plan.config.minimumSmokeJobs) {
+    issues.push("runner-profile-smoke-missing");
+  }
+  if (fullJobs.length < plan.config.minimumFullJobs) {
+    issues.push("insufficient-trusted-full-windows-jobs");
+  }
+  for (const [kind, cleanup] of Object.entries({
+    cancellation: cancellationCleanup,
+    timeout: timeoutCleanup,
+  })) {
+    const latency = finiteNumber(
+      cleanup?.cleanupLatencySeconds,
+      `${kind}Cleanup.cleanupLatencySeconds`,
+    );
+    if (
+      cleanup?.status !== "passed" ||
+      cleanup?.instanceTerminated !== true ||
+      cleanup?.runnerRemoved !== true ||
+      latency > plan.config.maximumCleanupLatencySeconds
+    ) {
+      issues.push(`${kind}-cleanup-not-proven`);
+    }
+  }
+  const spend = finiteNumber(
+    actualIncrementalSpendUsd,
+    "actualIncrementalSpendUsd",
+  );
+  if (spend >= plan.config.budgetLimitUsd) {
+    issues.push("actual-spend-not-below-budget");
+  }
+  if (Number(minCapacity) !== 0 || Number(desiredCapacity) !== 0) {
+    issues.push("provider-capacity-not-zero");
+  }
+  if (registeredCloudRunners.length) issues.push("registered-runners-remain");
+  if (activeInstances.length) issues.push("active-instances-remain");
+  if (disposableVolumes.length) issues.push("disposable-volumes-remain");
+  const result = {
+    schemaVersion: 1,
+    contract: AWS_WINDOWS_JIT_CONTRACT,
+    kind: "phase-verification",
+    phase: plan.config.phase,
+    status: issues.length ? "failed" : "passed",
+    qualifying: issues.length === 0,
+    metrics: {
+      acceptedJobs: accepted.length,
+      smokeJobs: smokeJobs.length,
+      fullJobs: fullJobs.length,
+      actualIncrementalSpendUsd: spend,
+      registeredCloudRunners: registeredCloudRunners.length,
+      activeInstances: activeInstances.length,
+      disposableVolumes: disposableVolumes.length,
+      minCapacity: Number(minCapacity),
+      desiredCapacity: Number(desiredCapacity),
+    },
+    cleanup: {
+      cancellation: cancellationCleanup,
+      timeout: timeoutCleanup,
+    },
+    issues,
+    planDigest: plan.digest,
+    observedAt: iso(observedAt, "observedAt"),
+  };
+  return { ...result, digest: digest(result) };
+}

package/scripts/aws-windows-jit.mjs

@@ -0,0 +1,121 @@
+#!/usr/bin/env node
+import fs from "node:fs";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+import {
+  createWindowsJitEvidence,
+  renderWindowsJitBootstrap,
+  verifyWindowsEc2JitQualification,
+  windowsEc2JitPlan,
+} from "./aws-windows-jit-core.mjs";
+
+function arg(name, fallback = "") {
+  const index = process.argv.indexOf(`--${name}`);
+  return index === -1 ? fallback : process.argv[index + 1] || "";
+}
+
+function readJson(file) {
+  return JSON.parse(fs.readFileSync(path.resolve(file), "utf8"));
+}
+
+function writeJson(file, value) {
+  const resolved = path.resolve(file);
+  fs.mkdirSync(path.dirname(resolved), { recursive: true });
+  fs.writeFileSync(resolved, `${JSON.stringify(value, null, 2)}\n`);
+  return resolved;
+}
+
+export function main() {
+  const mode = process.argv[2] || "plan";
+  if (mode === "plan") {
+    const result = windowsEc2JitPlan();
+    process.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
+    return result;
+  }
+  if (mode === "evidence") {
+    const result = createWindowsJitEvidence({
+      repository: process.env.GITHUB_REPOSITORY,
+      sourceSha:
+        process.env.BUILDCHAIN_EXPECTED_SOURCE_SHA || process.env.GITHUB_SHA,
+      sourceRef:
+        process.env.BUILDCHAIN_EXPECTED_SOURCE_REF || process.env.GITHUB_REF,
+      githubRunId: process.env.GITHUB_RUN_ID,
+      githubRunAttempt: process.env.GITHUB_RUN_ATTEMPT,
+      githubJob: process.env.GITHUB_JOB,
+      runnerName: process.env.RUNNER_NAME,
+      runnerLabels: JSON.parse(process.env.BUILDCHAIN_RUNNER_LABELS_JSON || "[]"),
+      instanceId: process.env.AWS_EC2_INSTANCE_ID,
+      instanceType: process.env.AWS_EC2_INSTANCE_TYPE,
+      amiId: process.env.AWS_EC2_AMI_ID,
+      amiName: process.env.AWS_EC2_AMI_NAME,
+      availabilityZone: process.env.AWS_EC2_AVAILABILITY_ZONE,
+      launchedAt: process.env.AWS_EC2_LAUNCHED_AT,
+      runnerStartedAt: process.env.AWS_EC2_RUNNER_STARTED_AT,
+      runnerExitedAt:
+        process.env.AWS_EC2_RUNNER_EXITED_AT || new Date().toISOString(),
+      terminatedAt: process.env.AWS_EC2_TERMINATED_AT,
+      cleanupResult:
+        process.env.AWS_EC2_CLEANUP_RESULT || "runner-exit-termination-pending",
+      cacheMode: process.env.BUILDCHAIN_CHECKOUT_CACHE_MODE || "off",
+    });
+    const output = writeJson(
+      process.env.BUILDCHAIN_WINDOWS_JIT_EVIDENCE_PATH ||
+        ".buildchain/aws-windows-jit.json",
+      result,
+    );
+    process.stdout.write(`${output}\n`);
+    return result;
+  }
+  if (mode === "render-bootstrap") {
+    const template = arg(
+      "template",
+      "infra/aws-us-elastic-runner-burst-plane/windows-jit-bootstrap.ps1",
+    );
+    const output = arg("output");
+    if (!output) throw new Error("render-bootstrap requires --output");
+    const result = renderWindowsJitBootstrap(
+      fs.readFileSync(path.resolve(template), "utf8"),
+      {
+        region: arg("region", "us-east-1"),
+        jitParameterName: arg("jit-parameter"),
+        evidenceBucket: arg("evidence-bucket"),
+        runnerLabel: arg("runner-label"),
+        sourceSha: arg("source-sha"),
+        githubRunId: arg("github-run-id"),
+        githubRunAttempt: arg("github-run-attempt", "1"),
+        amiId: arg("ami-id"),
+        amiName: arg("ami-name"),
+        instanceType: arg("instance-type", "c7i.4xlarge"),
+        launchedAt: arg("launched-at"),
+      },
+    );
+    const resolved = path.resolve(output);
+    fs.mkdirSync(path.dirname(resolved), { recursive: true });
+    fs.writeFileSync(resolved, result);
+    process.stdout.write(`${resolved}\n`);
+    return resolved;
+  }
+  if (mode === "verify") {
+    const input = arg("input");
+    if (!input) throw new Error("verify requires --input");
+    const result = verifyWindowsEc2JitQualification(readJson(input));
+    const output = arg("output");
+    if (output) writeJson(output, result);
+    process.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
+    if (!result.qualifying) process.exitCode = 1;
+    return result;
+  }
+  throw new Error(`unsupported aws-windows-jit mode: ${mode}`);
+}
+
+if (
+  process.argv[1] &&
+  import.meta.url === pathToFileURL(process.argv[1]).href
+) {
+  try {
+    main();
+  } catch (error) {
+    console.error(`::error::${error.message || error}`);
+    process.exitCode = 1;
+  }
+}

package/scripts/build-contract-core.mjs

@@ -1,6 +1,8 @@
 import crypto from "node:crypto";
 import fs from "node:fs";
 import path from "node:path";
+import { macosJitRunnerLabel } from "./aws-macos-jit-core.mjs";
+import { windowsJitRunnerLabel } from "./aws-windows-jit-core.mjs";
 
 export const RUNNER_PRESETS = Object.freeze({
   "github-hosted": [
@@ -61,6 +63,36 @@ export const RUNNER_PRESETS = Object.freeze({
       capabilities: ["node", "native-toolchain", "product-artifacts", "rust"],
     },
   ],
+  "aws-us-codebuild-linux": [
+    {
+      id: "linux-x64",
+      name: "Linux x64 (AWS CodeBuild burst)",
+      platform: "linux",
+      provider: "aws-codebuild",
+      runner: '["aws-codebuild-dynamic"]',
+      capabilities: ["node", "native-toolchain", "product-artifacts", "rust"],
+    },
+  ],
+  "aws-us-ec2-windows-jit": [
+    {
+      id: "windows-x64",
+      name: "Windows x64 (AWS EC2 one-job JIT)",
+      platform: "windows",
+      provider: "aws-ec2-windows-jit",
+      runner: '["self-hosted","Windows","X64","aws-ec2-jit-dynamic"]',
+      capabilities: ["node", "native-toolchain", "product-artifacts", "rust"],
+    },
+  ],
+  "aws-us-ec2-macos-jit": [
+    {
+      id: "macos-arm64",
+      name: "macOS ARM64 (AWS EC2 Dedicated Host one-job JIT)",
+      platform: "macos",
+      provider: "aws-ec2-macos-jit",
+      runner: '["self-hosted","macOS","ARM64","aws-ec2-jit-dynamic"]',
+      capabilities: ["node", "native-toolchain", "product-artifacts", "rust"],
+    },
+  ],
 });
 
 export const LINUX_CONTAINER_PRESETS = Object.freeze({
@@ -759,6 +791,8 @@ function normalizePlatform(platform, index) {
   }
   const normalized = { id, name, runner };
   if (platform?.platform !== undefined) normalized.platform = String(platform.platform || "").trim();
+  if (platform?.provider !== undefined) normalized.provider = String(platform.provider || "").trim();
+  if (platform?.project !== undefined) normalized.project = String(platform.project || "").trim();
   normalized.capabilities = capabilities.sort();
   if (platform?.required === false) normalized.required = false;
   return normalized;
@@ -767,6 +801,9 @@ function normalizePlatform(platform, index) {
 export function resolveRunnerMatrix({
   runnerPreset = "github-hosted",
   platformsJson = "",
+  awsCodeBuildProject = "",
+  awsEc2WindowsRunnerLabel = "",
+  awsEc2MacosRunnerLabel = "",
   linuxContainerPreset = "",
   linuxContainerImage = "",
 } = {}) {
@@ -812,18 +849,44 @@ export function resolveRunnerMatrix({
   if (!platforms) {
     throw new Error(`unsupported runner-preset: ${preset}`);
   }
+  let resolvedPlatforms = platforms;
+  if (preset === "aws-us-codebuild-linux") {
+    const project = String(awsCodeBuildProject || "").trim();
+    if (!/^[A-Za-z0-9][A-Za-z0-9_-]{1,149}$/.test(project)) {
+      throw new Error(
+        "runner-preset=aws-us-codebuild-linux requires a valid aws-codebuild-project",
+      );
+    }
+    resolvedPlatforms = platforms.map((platform) => ({ ...platform, project }));
+  }
+  if (preset === "aws-us-ec2-windows-jit") {
+    const runnerLabel = windowsJitRunnerLabel(awsEc2WindowsRunnerLabel);
+    resolvedPlatforms = platforms.map((platform) => ({
+      ...platform,
+      runnerLabel,
+      runner: JSON.stringify(["self-hosted", "Windows", "X64", runnerLabel]),
+    }));
+  }
+  if (preset === "aws-us-ec2-macos-jit") {
+    const runnerLabel = macosJitRunnerLabel(awsEc2MacosRunnerLabel);
+    resolvedPlatforms = platforms.map((platform) => ({
+      ...platform,
+      runnerLabel,
+      runner: JSON.stringify(["self-hosted", "macOS", "ARM64", runnerLabel]),
+    }));
+  }
   const containerPlatforms = linuxContainer.enabled
-    ? platforms.filter(platformIsLinux)
+    ? resolvedPlatforms.filter(platformIsLinux)
     : [];
   const nativePlatforms = linuxContainer.enabled
-    ? platforms.filter((platform) => !platformIsLinux(platform))
-    : platforms;
+    ? resolvedPlatforms.filter((platform) => !platformIsLinux(platform))
+    : resolvedPlatforms;
   return {
     source: "runner-preset",
     runnerPreset: preset,
-    platforms,
-    platformsJson: JSON.stringify(platforms),
-    platformCount: platforms.length,
+    platforms: resolvedPlatforms,
+    platformsJson: JSON.stringify(resolvedPlatforms),
+    platformCount: resolvedPlatforms.length,
     nativePlatforms,
     nativePlatformsJson: JSON.stringify(nativePlatforms),
     nativePlatformCount: nativePlatforms.length,

package/scripts/build-standalone-binary.mjs

@@ -149,9 +149,29 @@ function packageVersion(cwd) {
   return packageJson.version;
 }
 
+function sourceSha(cwd) {
+  const result = spawnSync("git", ["rev-parse", "HEAD"], {
+    cwd,
+    encoding: "utf8",
+  });
+  const value = String(result.stdout || "").trim();
+  if (result.status !== 0 || !/^[0-9a-f]{40}$/i.test(value)) {
+    throw new Error("standalone binary requires an exact Buildchain source SHA");
+  }
+  return value;
+}
+
 function bundleCli({ cwd, tempDir, version, logger }) {
   const outDir = path.join(tempDir, "bundle");
   const configPath = path.join(tempDir, "tsup.config.mjs");
+  const embeddedContractWorld = fs.readFileSync(
+    path.join(cwd, "dist", "site", "buildchain-contract.json"),
+    "utf8",
+  );
+  const embeddedLicenseText = fs.readFileSync(
+    path.join(cwd, "LICENSE"),
+    "utf8",
+  );
   fs.writeFileSync(configPath, `export default {
   entry: {
     buildchain: ${JSON.stringify(path.join(cwd, "bin", "buildchain.mjs"))},
@@ -169,6 +189,9 @@ function bundleCli({ cwd, tempDir, version, logger }) {
   noExternal: ["smol-toml", /^@kungfu-tech\\/kfd(?:\\/|$)/],
   define: {
     "process.env.BUILDCHAIN_EMBEDDED_PACKAGE_VERSION": ${JSON.stringify(JSON.stringify(version || packageVersion(cwd)))},
+    "process.env.BUILDCHAIN_EMBEDDED_SOURCE_SHA": ${JSON.stringify(JSON.stringify(sourceSha(cwd)))},
+    "process.env.BUILDCHAIN_EMBEDDED_CONTRACT_WORLD": ${JSON.stringify(JSON.stringify(embeddedContractWorld))},
+    "process.env.BUILDCHAIN_EMBEDDED_LICENSE_TEXT": ${JSON.stringify(JSON.stringify(embeddedLicenseText))},
     "process.env.BUILDCHAIN_EMBEDDED_ENTRYPOINT": ${JSON.stringify(JSON.stringify("1"))},
   },
 };

package/scripts/buildchain-contract-lock.mjs

@@ -131,7 +131,7 @@ export function writeBuildchainContractLock({
   output = env("BUILDCHAIN_CONTRACT_LOCK_PATH", BUILDCHAIN_CONTRACT_LOCK_PATH),
   currentContractPath = env("BUILDCHAIN_CONTRACT_CURRENT_PATH", "dist/site/buildchain-contract.json"),
   runtimeRoot = env("BUILDCHAIN_RUNTIME_ROOT", process.cwd()),
-  buildchainRef = env("BUILDCHAIN_RUNTIME_REF", "v2"),
+  buildchainRef = env("BUILDCHAIN_RUNTIME_REF", "v3"),
   resolvedSha = env("BUILDCHAIN_RUNTIME_SHA"),
   compatibilityPolicy = env("BUILDCHAIN_CONTRACT_COMPATIBILITY_POLICY", "major-compatible"),
   acceptedAt = env("BUILDCHAIN_CONTRACT_ACCEPTED_AT") || new Date().toISOString(),

package/scripts/buildchain-patrol.mjs

@@ -49,7 +49,7 @@ function normalizeRepository(value) {
 function normalizeTargetBranch(value) {
   const branch = String(value || process.env.GITHUB_REF_NAME || DEFAULT_TARGET_BRANCH).replace(/^refs\/heads\//, "");
   if (!/^dev\/v\d+\/v\d+\.\d+$/.test(branch)) {
-    throw new Error(`target-branch must be a semver dev branch such as dev/v2/v2.N, got: ${branch || "<empty>"}`);
+    throw new Error(`target-branch must be a semver dev branch such as dev/v3/v3.N, got: ${branch || "<empty>"}`);
   }
   return branch;
 }