@kungfu-tech/buildchain 3.0.2 → 3.0.3-alpha.1

package/scripts/run-lifecycle-core.mjs

@@ -130,6 +130,16 @@ function collectArtifactFiles(root, patterns) {
   return [...files].sort();
 }
 
+function signingArtifactPathsForPlatform({ loadedConfig, cwd, platformId }) {
+  const declarations = loadedConfig?.config?.signing?.artifacts || [];
+  return declarations
+    .filter(
+      (entry) =>
+        entry.platforms.length === 0 || entry.platforms.includes(platformId),
+    )
+    .map((entry) => path.resolve(cwd, entry.path));
+}
+
 function readProcessSummaryArtifact(filePath) {
   if (!filePath) {
     return undefined;
@@ -435,11 +445,35 @@ export function runLifecycle({
   const resolvedDiagnosticsProcessSamplesPath = path.join(diagnosticsDir, "process-samples.jsonl");
   const resolvedSourceCheckoutPath = path.resolve(resolvedWorkspace, ".buildchain/diagnostics/source-checkout.json");
   const resolvedDiagnosticsSourceCheckoutPath = path.join(diagnosticsDir, "source-checkout.json");
+  const resolvedCompilerCachePreparationPath = path.resolve(
+    resolvedWorkspace,
+    process.env.BUILDCHAIN_COMPILER_CACHE_PREPARATION_PATH ||
+      ".buildchain/diagnostics/compiler-cache-preparation.json",
+  );
+  const compilerCachePreparationRelative = path.relative(
+    resolvedWorkspace,
+    resolvedCompilerCachePreparationPath,
+  );
+  if (
+    compilerCachePreparationRelative.startsWith("..") ||
+    path.isAbsolute(compilerCachePreparationRelative)
+  ) {
+    throw new Error(
+      "BUILDCHAIN_COMPILER_CACHE_PREPARATION_PATH must remain inside the workflow workspace",
+    );
+  }
+  const resolvedDiagnosticsCompilerCachePreparationPath = path.join(
+    diagnosticsDir,
+    "compiler-cache-preparation.json",
+  );
   const resolvedDiagnosticsManifestPath = path.join(diagnosticsDir, "diagnostics-manifest.json");
   const relativeDiagnosticsEventsPath = toPosix(path.relative(resolvedWorkspace, resolvedDiagnosticsEventsPath));
   const relativeDiagnosticsProcessSummaryPath = toPosix(path.relative(resolvedWorkspace, resolvedDiagnosticsProcessSummaryPath));
   const relativeDiagnosticsProcessSamplesPath = toPosix(path.relative(resolvedWorkspace, resolvedDiagnosticsProcessSamplesPath));
   const relativeDiagnosticsSourceCheckoutPath = toPosix(path.relative(resolvedWorkspace, resolvedDiagnosticsSourceCheckoutPath));
+  const relativeDiagnosticsCompilerCachePreparationPath = toPosix(
+    path.relative(resolvedWorkspace, resolvedDiagnosticsCompilerCachePreparationPath),
+  );
   const relativeDiagnosticsManifestPath = toPosix(path.relative(resolvedWorkspace, resolvedDiagnosticsManifestPath));
   const logRunId = crypto.randomUUID();
   const frameworkLog = createBuildchainLogger({
@@ -622,9 +656,22 @@ export function runLifecycle({
   const sourceCheckoutArtifact = fs.existsSync(resolvedSourceCheckoutPath)
     ? JSON.parse(fs.readFileSync(resolvedSourceCheckoutPath, "utf8"))
     : undefined;
+  const compilerCachePreparationArtifact = fs.existsSync(resolvedCompilerCachePreparationPath)
+    ? JSON.parse(fs.readFileSync(resolvedCompilerCachePreparationPath, "utf8"))
+    : undefined;
   fs.mkdirSync(path.dirname(resolvedManifestPath), { recursive: true });
   const scanStartedAt = Date.now();
-  const files = collectArtifactFiles(resolvedWorkspace, artifactPaths);
+  const signingArtifactPaths = stageName === "build"
+    ? signingArtifactPathsForPlatform({
+        loadedConfig,
+        cwd: resolvedCwd,
+        platformId,
+      })
+    : [];
+  const files = collectArtifactFiles(resolvedWorkspace, [
+    ...artifactPaths,
+    ...signingArtifactPaths,
+  ]);
   const manifestFiles = files.map((file) => {
     const stat = fs.statSync(file);
     return {
@@ -743,6 +790,7 @@ export function runLifecycle({
       lifecycleObservability,
       processSummary: processSummaryArtifact?.summary,
       sourceCheckout: sourceCheckoutArtifact,
+      compilerCachePreparation: compilerCachePreparationArtifact,
       links: {
         artifactName,
         platformId,
@@ -757,6 +805,9 @@ export function runLifecycle({
         ...(processSummaryArtifact ? { diagnosticsProcessSummary: relativeDiagnosticsProcessSummaryPath } : {}),
         ...(processSummaryArtifact?.samplesPath ? { diagnosticsProcessSamples: relativeDiagnosticsProcessSamplesPath } : {}),
         ...(sourceCheckoutArtifact ? { sourceCheckout: relativeDiagnosticsSourceCheckoutPath } : {}),
+        ...(compilerCachePreparationArtifact
+          ? { compilerCachePreparation: relativeDiagnosticsCompilerCachePreparationPath }
+          : {}),
       },
     }),
   );
@@ -778,6 +829,12 @@ export function runLifecycle({
   if (sourceCheckoutArtifact) {
     copyIfExists(resolvedSourceCheckoutPath, resolvedDiagnosticsSourceCheckoutPath);
   }
+  if (compilerCachePreparationArtifact) {
+    copyIfExists(
+      resolvedCompilerCachePreparationPath,
+      resolvedDiagnosticsCompilerCachePreparationPath,
+    );
+  }
   writeDiagnosticsSidecarManifest(resolvedDiagnosticsManifestPath, {
     workspace: resolvedWorkspace,
     artifactName,
@@ -789,6 +846,10 @@ export function runLifecycle({
       { kind: "process-summary", filePath: resolvedDiagnosticsProcessSummaryPath },
       { kind: "process-samples", filePath: resolvedDiagnosticsProcessSamplesPath },
       { kind: "source-checkout", filePath: resolvedDiagnosticsSourceCheckoutPath },
+      {
+        kind: "compiler-cache-preparation",
+        filePath: resolvedDiagnosticsCompilerCachePreparationPath,
+      },
     ],
   });
   console.log(`buildchain_manifest=${path.relative(resolvedWorkspace, resolvedManifestPath)}`);

package/scripts/runtime-ref-core.mjs

@@ -3,7 +3,7 @@ const TRAIN_REF_RE = /^train\/v\d+\/v\d+\.\d+\/[A-Za-z0-9._/-]+$/;
 const AUTHORITY_REF_RE = /^authority\/v\d+\/v\d+\.\d+\/[A-Za-z0-9._/-]+$/;
 const OFFICIAL_CHANNEL_REF_RE = /^v\d+(?:\.\d+)?(?:-alpha)?$/;
 
-export function parseWorkflowShellRef(workflowRef = "", fallback = "v2", buildchainRepository = "kungfu-systems/buildchain") {
+export function parseWorkflowShellRef(workflowRef = "", fallback = "v3", buildchainRepository = "kungfu-systems/buildchain") {
   const value = String(workflowRef || "");
   const expectedPrefix = `${buildchainRepository}/.github/workflows/`;
   if (!value.startsWith(expectedPrefix)) {
@@ -80,7 +80,7 @@ export function normalizeRequestedRuntimeRef(requestedRef = "") {
 export function resolveRuntimeSelection({
   requestedRef = "",
   workflowRef = "",
-  defaultStableRef = "v2",
+  defaultStableRef = "v3",
   buildchainRepository = "kungfu-systems/buildchain",
 } = {}) {
   const requested = String(requestedRef || "").trim();
@@ -98,7 +98,15 @@ export function resolveRuntimeSelection({
     };
   }
   const normalized = normalizeRequestedRuntimeRef(requested);
-  const runtimeOverride = !normalized.officialChannel;
+  const sameRepositoryWorkflow = String(workflowRef || "").startsWith(
+    `${buildchainRepository}/.github/workflows/`,
+  );
+  const pinnedSelfRuntime =
+    sameRepositoryWorkflow &&
+    normalized.exactSha &&
+    EXACT_SHA_RE.test(workflowShellRef) &&
+    normalized.ref.toLowerCase() === workflowShellRef.toLowerCase();
+  const runtimeOverride = !normalized.officialChannel && !pinnedSelfRuntime;
   return {
     requestedRef: requested,
     runtimeRef: normalized.ref,
@@ -107,16 +115,23 @@ export function resolveRuntimeSelection({
     runtimeOverride,
     workflowShellRef: workflowShellRef || defaultStableRef,
     rollbackRef: workflowShellRef || defaultStableRef,
-    trustDecision: normalized.officialChannel ? "official-channel" : "override-requested",
+    trustDecision: normalized.officialChannel
+      ? "official-channel"
+      : pinnedSelfRuntime
+        ? "pinned-self"
+        : "override-requested",
   };
 }
 
 export function validateRuntimeOverrideTrust({
   requestedRef = "",
   eventName = "",
+  eventAction = "",
   actorPermission = "",
   sameRepositoryPullRequest = false,
+  sameRepositoryWorkflow = false,
   pullRequestHeadSha = "",
+  workflowShellSha = "",
 } = {}) {
   if (!String(requestedRef || "").trim()) {
     return { ok: true, decision: "stable-default" };
@@ -126,6 +141,23 @@ export function validateRuntimeOverrideTrust({
   }
   const normalizedRequested = String(requestedRef || "").trim().toLowerCase();
   const normalizedHeadSha = String(pullRequestHeadSha || "").trim().toLowerCase();
+  const normalizedWorkflowShellSha = String(workflowShellSha || "").trim().toLowerCase();
+  if (
+    sameRepositoryWorkflow === true &&
+    EXACT_SHA_RE.test(normalizedRequested) &&
+    EXACT_SHA_RE.test(normalizedWorkflowShellSha) &&
+    normalizedRequested === normalizedWorkflowShellSha
+  ) {
+    return { ok: true, decision: "pinned-self" };
+  }
+  if (
+    eventName === "pull_request" &&
+    eventAction === "closed" &&
+    EXACT_SHA_RE.test(normalizedRequested) &&
+    normalizedRequested === normalizedWorkflowShellSha
+  ) {
+    return { ok: true, decision: "closed-release-pr-shell-runtime" };
+  }
   if (
     eventName === "pull_request" &&
     sameRepositoryPullRequest === true &&

package/scripts/seal-artifact-signing-requests.mjs

@@ -52,6 +52,31 @@ function assertInside(root, target, label) {
   }
 }
 
+function containsPath(root, target) {
+  const relative = path.relative(root, target);
+  return (
+    !relative || (!relative.startsWith("..") && !path.isAbsolute(relative))
+  );
+}
+
+function resetGeneratedOutputRoot({
+  workspace,
+  cwd,
+  outputRoot,
+  protectedPaths = [],
+}) {
+  const protectedRoots = [workspace, cwd, ...protectedPaths];
+  for (const protectedPath of protectedRoots) {
+    if (containsPath(outputRoot, protectedPath)) {
+      throw new Error(
+        "signing request output must not contain the workspace, working directory, manifest, or a declared artifact",
+      );
+    }
+  }
+  fs.rmSync(outputRoot, { recursive: true, force: true });
+  fs.mkdirSync(outputRoot, { recursive: true });
+}
+
 function walkSubject(subjectRoot) {
   const entries = [];
   function visit(current) {
@@ -208,18 +233,16 @@ function verifyLifecycleBinding({
   );
   const relativeSubject = toPosix(path.relative(workspace, subjectPath));
   const files = descriptor.entries.filter(
-    (entry) => entry.type !== "directory",
+    (entry) => entry.type !== "directory" && entry.type !== "symlink",
   );
+  let matchedFiles = 0;
   for (const entry of files) {
-    if (entry.type === "symlink") continue;
     const manifestPath = fs.statSync(subjectPath).isFile()
       ? relativeSubject
       : `${relativeSubject}/${entry.path}`;
     const observed = byPath.get(manifestPath);
-    if (!observed)
-      throw new Error(
-        `signed artifact file is absent from lifecycle manifest: ${manifestPath}`,
-      );
+    if (!observed) continue;
+    matchedFiles += 1;
     if (
       `sha256:${observed.sha256}` !== entry.digest ||
       Number(observed.size) !== entry.bytes
@@ -229,6 +252,15 @@ function verifyLifecycleBinding({
       );
     }
   }
+  // A signing declaration is an independent artifact inventory and must not
+  // require consumers to repeat its path in workflow artifact-paths. When the
+  // lifecycle manifest does cover the subject, require complete coverage so a
+  // truncated or stale manifest cannot weaken the exact descriptor binding.
+  if (matchedFiles !== 0 && matchedFiles !== files.length) {
+    throw new Error(
+      `signed artifact is only partially represented in lifecycle manifest: ${relativeSubject}`,
+    );
+  }
 }
 
 export function sealArtifactSigningRequests({
@@ -255,8 +287,12 @@ export function sealArtifactSigningRequests({
   );
   const resolvedOutputRoot = path.resolve(resolvedWorkspace, outputRoot);
   assertInside(resolvedWorkspace, resolvedOutputRoot, "signing request output");
-  fs.mkdirSync(resolvedOutputRoot, { recursive: true });
   if (selected.length === 0) {
+    resetGeneratedOutputRoot({
+      workspace: resolvedWorkspace,
+      cwd: resolvedCwd,
+      outputRoot: resolvedOutputRoot,
+    });
     const index = { schemaVersion: 1, contract: INDEX_CONTRACT, requests: [] };
     const indexPath = path.join(resolvedOutputRoot, "index.json");
     fs.writeFileSync(indexPath, `${JSON.stringify(index, null, 2)}\n`);
@@ -274,8 +310,7 @@ export function sealArtifactSigningRequests({
   assertInside(resolvedWorkspace, resolvedManifest, "artifact manifest");
   const manifest = JSON.parse(fs.readFileSync(resolvedManifest, "utf8"));
   const platform = normalizePlatform(manifest.platform?.os || process.platform);
-  const requests = [];
-  for (const declaration of selected) {
+  const prepared = selected.map((declaration) => {
     const subjectPath = path.resolve(resolvedCwd, declaration.path);
     assertInside(
       resolvedWorkspace,
@@ -288,7 +323,7 @@ export function sealArtifactSigningRequests({
       );
     const realSubject = fs.realpathSync(subjectPath);
     assertInside(
-      resolvedWorkspace,
+      fs.realpathSync(resolvedWorkspace),
       realSubject,
       `signing artifact ${declaration.id}`,
     );
@@ -299,8 +334,25 @@ export function sealArtifactSigningRequests({
       subjectPath,
       descriptor,
     });
-    const id = safeId(declaration.id);
-    const kind = inferKind(subjectPath, declaration.kind);
+    return {
+      declaration,
+      subjectPath,
+      descriptor,
+      id: safeId(declaration.id),
+      kind: inferKind(subjectPath, declaration.kind),
+    };
+  });
+  resetGeneratedOutputRoot({
+    workspace: resolvedWorkspace,
+    cwd: resolvedCwd,
+    outputRoot: resolvedOutputRoot,
+    protectedPaths: [
+      resolvedManifest,
+      ...prepared.map((entry) => entry.subjectPath),
+    ],
+  });
+  const requests = [];
+  for (const { declaration, subjectPath, descriptor, id, kind } of prepared) {
     const transport = archiveSubject({
       subjectPath,
       outputRoot: resolvedOutputRoot,

package/scripts/stable-candidate-qualification.mjs

@@ -41,6 +41,29 @@ function optionalSha(value, label) {
   return normalized;
 }
 
+export function resolveStableCandidateQualificationCandidate({ eventName, inputCandidateSha = "", selfDogfoodEvidence } = {}) {
+  if (text(eventName) === "workflow_dispatch") {
+    return optionalSha(inputCandidateSha, "candidate SHA");
+  }
+  if (text(eventName) !== "workflow_run") {
+    throw new Error(`qualification candidate resolver does not admit event ${eventName || "<empty>"}`);
+  }
+  const evidence = selfDogfoodEvidence;
+  if (
+    evidence?.contract !== "kungfu-buildchain-alpha-self-dogfood"
+    || evidence?.status !== "passed"
+    || evidence?.observed?.alpha?.ref !== "v3-alpha"
+  ) {
+    throw new Error("self-dogfood evidence is not a passing v3-alpha observation");
+  }
+  const observedSha = optionalSha(evidence.observed.alpha.sha, "observed v3-alpha SHA");
+  const expectedSha = optionalSha(evidence.observed.alpha.expectedSha, "expected v3-alpha SHA");
+  if (!observedSha || observedSha !== expectedSha) {
+    throw new Error("self-dogfood evidence does not bind observed and expected v3-alpha SHAs");
+  }
+  return observedSha;
+}
+
 function optionalRef(value, label) {
   const normalized = text(value);
   if (
@@ -91,8 +114,12 @@ async function ensureWorkflowEvidence({ client, repository, workflowFile, workfl
   let run = await client.findWorkflowRun({ repository, workflowFile, workflowName, headSha, runName, sourceSha });
   if (successful(run)) return { state: "existing", run };
 
+  let notBefore = "";
+  let excludeRunId = "";
   if (!active(run)) {
     if (options.dryRun) return { state: "planned", run };
+    notBefore = text(run?.created_at);
+    excludeRunId = text(run?.id);
     await client.dispatchWorkflow({ repository, workflowFile, ref, inputs: runName ? { buildchain_ref: headSha } : {} });
   }
 
@@ -104,6 +131,8 @@ async function ensureWorkflowEvidence({ client, repository, workflowFile, workfl
     headSha,
     runName,
     sourceSha,
+    notBefore,
+    excludeRunId,
     attempts: options.pollAttempts,
     intervalMs: options.pollIntervalMs,
   });
@@ -220,6 +249,8 @@ export function createGitHubQualificationClient({
           || (query.runName && (run.display_title === query.runName || run.name === query.runName))
         )
         && (!query.sourceSha || run.head_sha === query.sourceSha)
+        && (!query.notBefore || String(run.created_at || "") >= query.notBefore)
+        && (!query.excludeRunId || String(run.id || "") !== query.excludeRunId)
       ))
       .sort((left, right) => String(right.created_at).localeCompare(String(left.created_at)))[0];
   }
@@ -267,6 +298,25 @@ export function createGitHubQualificationClient({
 }
 
 async function main() {
+  if (bool(process.env.BUILDCHAIN_QUALIFICATION_RESOLVE_CANDIDATE, false)) {
+    let selfDogfoodEvidence;
+    if (text(process.env.BUILDCHAIN_QUALIFICATION_EVENT_NAME) === "workflow_run") {
+      const fs = await import("node:fs");
+      const evidencePath = text(process.env.BUILDCHAIN_QUALIFICATION_SELF_DOGFOOD_EVIDENCE);
+      selfDogfoodEvidence = JSON.parse(fs.readFileSync(evidencePath, "utf8"));
+    }
+    const sha = resolveStableCandidateQualificationCandidate({
+      eventName: process.env.BUILDCHAIN_QUALIFICATION_EVENT_NAME,
+      inputCandidateSha: process.env.BUILDCHAIN_QUALIFICATION_INPUT_CANDIDATE_SHA,
+      selfDogfoodEvidence,
+    });
+    process.stdout.write(`${sha}\n`);
+    if (process.env.GITHUB_OUTPUT) {
+      const fs = await import("node:fs");
+      fs.appendFileSync(process.env.GITHUB_OUTPUT, `sha=${sha}\n`);
+    }
+    return;
+  }
   const result = await runStableCandidateQualification();
   const output = `${JSON.stringify(result, null, 2)}\n`;
   process.stdout.write(output);

package/scripts/verify-artifact-signing-results.mjs

@@ -27,11 +27,36 @@ function resolveBelow(root, relative, label) {
   return target;
 }
 
+function walk(root, name, output = []) {
+  for (const entry of fs.readdirSync(root, { withFileTypes: true })) {
+    const child = path.join(root, entry.name);
+    if (entry.isDirectory()) walk(child, name, output);
+    else if (entry.isFile() && entry.name === name) output.push(child);
+  }
+  return output;
+}
+
+function resolveRequestRoot(root) {
+  const direct = path.join(root, "index.json");
+  if (fs.existsSync(direct)) return root;
+  const candidates = walk(root, "index.json").filter((candidate) => {
+    try {
+      return JSON.parse(fs.readFileSync(candidate, "utf8")).contract === "kungfu-buildchain-artifact-signing-request-index/v1";
+    } catch {
+      return false;
+    }
+  });
+  if (candidates.length !== 1) {
+    throw new Error(`expected exactly one artifact signing request index, found ${candidates.length}`);
+  }
+  return path.dirname(candidates[0]);
+}
+
 export function verifyArtifactSigningResults({
   requestRoot = process.env.BUILDCHAIN_SIGNING_REQUEST_ROOT,
   resultRoot = process.env.BUILDCHAIN_SIGNING_RESULT_ROOT,
 } = {}) {
-  const requests = path.resolve(required(requestRoot, "signing request root"));
+  const requests = resolveRequestRoot(path.resolve(required(requestRoot, "signing request root")));
   const results = path.resolve(required(resultRoot, "signing result root"));
   const requestIndex = JSON.parse(
     fs.readFileSync(path.join(requests, "index.json"), "utf8"),