@kungfu-tech/buildchain 3.0.4-alpha.2 → 3.0.4-alpha.3

package/packages/core/release-propagation.js

@@ -1,37 +1,23 @@
-import crypto from "node:crypto";
 import fs from "node:fs";
 import path from "node:path";
+import {
+  assertPlainObject,
+  assertString,
+  RELEASE_PROPAGATION_PLAN_CONTRACT,
+  normalizeChannel,
+  optionalString,
+  sha256Json,
+  stableJson,
+} from "./release-propagation-common.js";
+import { normalizeExecutionProfile } from "./release-propagation-execution-profile.js";
+import { normalizeUpstreamRelease } from "./release-propagation-release.js";
 
 export const RELEASE_PROPAGATION_GRAPH_CONTRACT = "kungfu-buildchain-release-propagation-graph";
-export const RELEASE_PROPAGATION_PLAN_CONTRACT = "kungfu-buildchain-release-propagation-plan";
+export { RELEASE_PROPAGATION_PLAN_CONTRACT };
 export const RELEASE_PROPAGATION_LOCK_CONTRACT = "kungfu-buildchain-release-propagation-lock";
 export const RELEASE_PROPAGATION_RECEIPT_CONTRACT = "kungfu-buildchain-release-propagation-receipt";
-
-const SUPPORTED_CHANNELS = new Set(["alpha", "release"]);
 const SUPPORTED_CHANNEL_POLICIES = new Set(["preserve", "explicit"]);
 
-function stableJson(value) {
-  return `${JSON.stringify(sortJson(value), null, 2)}\n`;
-}
-
-function sortJson(value) {
-  if (Array.isArray(value)) {
-    return value.map(sortJson);
-  }
-  if (!value || typeof value !== "object") {
-    return value;
-  }
-  return Object.fromEntries(
-    Object.entries(value)
-      .sort(([left], [right]) => left.localeCompare(right))
-      .map(([key, entry]) => [key, sortJson(entry)]),
-  );
-}
-
-function sha256Json(value) {
-  return crypto.createHash("sha256").update(stableJson(value)).digest("hex");
-}
-
 function releaseVersion(upstreamRelease) {
   return upstreamRelease.package?.version || upstreamRelease.publicationArtifact?.version || "";
 }
@@ -75,32 +61,6 @@ function propagationBranch({ upstreamRelease, targetNode }) {
   return `buildchain/release-propagation/${repository}/${version}-${upstreamRelease.channel}-${digest}`;
 }
 
-function assertPlainObject(value, label) {
-  if (!value || typeof value !== "object" || Array.isArray(value)) {
-    throw new Error(`${label} must be an object`);
-  }
-  return value;
-}
-
-function assertString(value, label) {
-  if (typeof value !== "string" || value.trim() === "") {
-    throw new Error(`${label} must be a non-empty string`);
-  }
-  return value.trim();
-}
-
-function optionalString(value) {
-  return value === undefined || value === null ? "" : String(value).trim();
-}
-
-function normalizeChannel(value, label) {
-  const channel = assertString(value, label);
-  if (!SUPPORTED_CHANNELS.has(channel)) {
-    throw new Error(`${label} must be alpha or release`);
-  }
-  return channel;
-}
-
 function normalizeChannelMap(edge, label) {
   const policy = edge.channelPolicy || "preserve";
   if (!SUPPORTED_CHANNEL_POLICIES.has(policy)) {
@@ -130,6 +90,7 @@ function normalizeNode(node, index) {
     lockPath: optionalString(node.lockPath || node.lock_path),
     baseRef: optionalString(node.baseRef || node.base_ref),
     workflow: optionalString(node.workflow),
+    executionProfile: normalizeExecutionProfile(node.executionProfile || node.execution_profile, `nodes[${index}].executionProfile`),
   };
   if (!/^[^/\s]+\/[^/\s]+$/.test(normalized.repository)) {
     throw new Error(`nodes[${index}].repository must be owner/repo`);
@@ -235,112 +196,6 @@ export function resolvePropagationChannel(edge, upstreamChannel) {
   return downstreamChannel ? normalizeChannel(downstreamChannel, `edge ${edge.id} downstream channel`) : "";
 }
 
-function normalizeReleasePassport(passport = {}) {
-  if (!passport || typeof passport !== "object" || Array.isArray(passport)) {
-    throw new Error("upstreamRelease.releasePassport must be an object");
-  }
-  return {
-    url: assertString(passport.url, "upstreamRelease.releasePassport.url"),
-    sha256: assertString(passport.sha256 || passport.digest, "upstreamRelease.releasePassport.sha256"),
-  };
-}
-
-function normalizePackageFact(pkg = {}) {
-  if (!pkg || typeof pkg !== "object" || Array.isArray(pkg)) {
-    throw new Error("upstreamRelease.package must be an object");
-  }
-  return {
-    name: assertString(pkg.name, "upstreamRelease.package.name"),
-    version: assertString(pkg.version, "upstreamRelease.package.version"),
-    integrity: assertString(pkg.integrity, "upstreamRelease.package.integrity"),
-  };
-}
-
-function normalizeDigestUrlFact(value = {}, label) {
-  if (!value || typeof value !== "object" || Array.isArray(value)) {
-    throw new Error(`${label} must be an object`);
-  }
-  return {
-    url: assertString(value.url, `${label}.url`),
-    sha256: assertString(value.sha256 || value.digest, `${label}.sha256`),
-  };
-}
-
-function normalizeOptionalPathDigestUrlFact(value = undefined, label) {
-  if (value === undefined || value === null) {
-    return undefined;
-  }
-  const normalized = normalizeDigestUrlFact(value, label);
-  return {
-    path: optionalString(value.path),
-    bytes: value.bytes === undefined ? undefined : Number(value.bytes),
-    ...normalized,
-  };
-}
-
-function normalizePublicationArtifactFact(value = undefined) {
-  if (value === undefined || value === null) {
-    return undefined;
-  }
-  const artifact = assertPlainObject(value, "upstreamRelease.publicationArtifact");
-  return {
-    id: optionalString(artifact.id),
-    kind: optionalString(artifact.kind),
-    version: assertString(artifact.version, "upstreamRelease.publicationArtifact.version"),
-    canonicalUrl: assertString(
-      artifact.canonicalUrl || artifact.canonical_url,
-      "upstreamRelease.publicationArtifact.canonicalUrl",
-    ),
-    latestUrl: assertString(
-      artifact.latestUrl || artifact.latest_url,
-      "upstreamRelease.publicationArtifact.latestUrl",
-    ),
-    latestEvidenceUrl: optionalString(artifact.latestEvidenceUrl || artifact.latest_evidence_url),
-    immutableVersionUrl: assertString(
-      artifact.immutableVersionUrl || artifact.immutable_version_url || artifact.immutableVersionPrefix || artifact.immutable_version_prefix,
-      "upstreamRelease.publicationArtifact.immutableVersionUrl",
-    ),
-    immutableVersionPrefix: optionalString(artifact.immutableVersionPrefix || artifact.immutable_version_prefix),
-    registry: normalizeDigestUrlFact(artifact.registry, "upstreamRelease.publicationArtifact.registry"),
-    manifest: normalizeDigestUrlFact(artifact.manifest, "upstreamRelease.publicationArtifact.manifest"),
-    passport: normalizeDigestUrlFact(artifact.passport, "upstreamRelease.publicationArtifact.passport"),
-    primaryArtifact: normalizeOptionalPathDigestUrlFact(
-      artifact.primaryArtifact || artifact.primary_artifact,
-      "upstreamRelease.publicationArtifact.primaryArtifact",
-    ),
-    sourceBundle: normalizeOptionalPathDigestUrlFact(
-      artifact.sourceBundle || artifact.source_bundle,
-      "upstreamRelease.publicationArtifact.sourceBundle",
-    ),
-  };
-}
-
-function normalizeUpstreamRelease(input) {
-  const release = assertPlainObject(input, "upstreamRelease");
-  const publicationArtifact = normalizePublicationArtifactFact(release.publicationArtifact || release.publication_artifact);
-  const packageFact = release.package === undefined ? undefined : normalizePackageFact(release.package);
-  if (!packageFact && !publicationArtifact) {
-    throw new Error("upstreamRelease requires package or publicationArtifact");
-  }
-  return {
-    repository: assertString(release.repository, "upstreamRelease.repository"),
-    channel: normalizeChannel(release.channel, "upstreamRelease.channel"),
-    tag: assertString(release.tag, "upstreamRelease.tag"),
-    sourceSha: assertString(release.sourceSha || release.source_sha, "upstreamRelease.sourceSha"),
-    package: packageFact,
-    publicationArtifact,
-    releasePassport: normalizeReleasePassport(release.releasePassport || release.release_passport),
-    siteBundle: release.siteBundle || release.site_bundle
-      ? {
-        manifestSha256: assertString(
-          release.siteBundle?.manifestSha256 || release.site_bundle?.manifest_sha256,
-          "upstreamRelease.siteBundle.manifestSha256",
-        ),
-      }
-      : undefined,
-  };
-}
-
 export function createReleasePropagationLock({
   graph,
   edge,
@@ -359,6 +214,7 @@ export function createReleasePropagationLock({
       repository: upstreamRelease.repository,
       channel: upstreamRelease.channel,
       tag: upstreamRelease.tag,
+      tagTargetSha: upstreamRelease.tagTargetSha,
       sourceSha: upstreamRelease.sourceSha,
       package: upstreamRelease.package,
       publicationArtifact: upstreamRelease.publicationArtifact,
@@ -371,6 +227,7 @@ export function createReleasePropagationLock({
       channel: downstreamChannel,
       baseRef: edge.prBaseRef || targetNode.baseRef,
       lockPath: edge.lockPath || targetNode.lockPath || ".buildchain/upstream-release.lock.json",
+      executionProfile: targetNode.executionProfile,
     },
     propagation: {
       graphContract: graph.contract,
@@ -423,6 +280,7 @@ export function planReleasePropagation({ graph: graphInput, upstreamRelease: rel
       channel: downstreamChannel,
       baseRef: lock.downstream.baseRef,
       lockPath: lock.downstream.lockPath,
+      executionProfile: lock.downstream.executionProfile,
       propagationKey: lock.propagation.propagationKey,
       branch: lock.propagation.branch,
       lock,
@@ -548,6 +406,7 @@ export function createReleasePropagationReceipt({
             name: upstreamRelease.package.name,
             version: upstreamRelease.package.version,
             integrity: upstreamRelease.package.integrity,
+            gitHead: upstreamRelease.package.gitHead,
           }
         : null,
     },
@@ -576,6 +435,7 @@ export function createReleasePropagationReceipt({
     upstream: {
       repository: upstreamRelease.repository,
       tag: upstreamRelease.tag,
+      tagTargetSha: upstreamRelease.tagTargetSha,
       sourceSha: upstreamRelease.sourceSha,
       releasePassport: upstreamRelease.releasePassport,
     },
@@ -595,3 +455,19 @@ export function createReleasePropagationReceipt({
     receiptSha256: sha256Json(body),
   };
 }
+
+export {
+  RELEASE_PROPAGATION_STAGE_RECEIPT_CONTRACT,
+  RELEASE_PROPAGATION_WORK_CONTRACT,
+  RELEASE_PROPAGATION_WORK_STAGES,
+  createReleasePropagationStageReceipt,
+  createReleasePropagationWork,
+  resumeReleasePropagationWork,
+  verifyReleasePropagationWork,
+} from "./release-propagation-work.js";
+export {
+  claimReleasePropagationWork,
+  completeReleasePropagationWork,
+  recordReleasePropagationStage,
+  repairReleasePropagationWork,
+} from "./release-propagation-work-transitions.js";

package/scripts/aws-windows-jit-controller-core.mjs

@@ -0,0 +1,269 @@
+// SPDX-License-Identifier: Apache-2.0
+
+import { digest } from "./aws-runner-burst-core.mjs";
+import {
+  WINDOWS_EC2_JIT,
+  windowsJitRunnerLabel,
+  windowsJitRunnerLabels,
+} from "./aws-windows-jit-core.mjs";
+
+export const AWS_WINDOWS_JIT_CONTROLLER_CONTRACT =
+  "kungfu-buildchain-aws-windows-jit-controller/v1";
+
+function exact(value, pattern, label) {
+  const normalized = String(value || "").trim();
+  if (!pattern.test(normalized)) {
+    throw new Error(`${label} is invalid`);
+  }
+  return normalized;
+}
+
+function exactSha(value) {
+  return exact(value, /^[0-9a-f]{40}$/i, "sourceSha").toLowerCase();
+}
+
+function iso(value, label) {
+  const parsed = new Date(value || "");
+  if (!Number.isFinite(parsed.getTime())) {
+    throw new Error(`${label} must be an ISO timestamp`);
+  }
+  return parsed.toISOString();
+}
+
+function qualificationId(value) {
+  return exact(
+    value,
+    /^win-(?:smoke|full-0[1-3]|cancel|timeout)$/,
+    "qualificationId",
+  );
+}
+
+function tag(key, value) {
+  return { Key: key, Value: String(value) };
+}
+
+export function createWindowsJitLaunchPlan(values = {}) {
+  const repository = exact(
+    values.repository || WINDOWS_EC2_JIT.repository,
+    /^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/,
+    "repository",
+  );
+  if (repository !== WINDOWS_EC2_JIT.repository) {
+    throw new Error(`repository must be ${WINDOWS_EC2_JIT.repository}`);
+  }
+  const runId = exact(values.runId, /^\d+$/, "runId");
+  const runAttempt = exact(
+    values.runAttempt || "1",
+    /^[1-9]\d*$/,
+    "runAttempt",
+  );
+  const jobId = exact(values.jobId, /^\d+$/, "jobId");
+  const qualification = qualificationId(values.qualificationId);
+  const runnerLabel = windowsJitRunnerLabel(values.runnerLabel);
+  const expectedLabel = `${WINDOWS_EC2_JIT.labelPrefix}${qualification}`;
+  if (runnerLabel !== expectedLabel) {
+    throw new Error(`runnerLabel must be ${expectedLabel}`);
+  }
+  const runnerName = exact(
+    values.runnerName,
+    /^[A-Za-z0-9][A-Za-z0-9._-]{0,79}$/,
+    "runnerName",
+  );
+  const sourceSha = exactSha(values.sourceSha);
+  const sourceRef = exact(
+    values.sourceRef,
+    /^refs\/heads\/[A-Za-z0-9._/-]+$/,
+    "sourceRef",
+  );
+  const region = exact(
+    values.region || WINDOWS_EC2_JIT.region,
+    /^us-[a-z]+-\d$/,
+    "region",
+  );
+  if (region !== WINDOWS_EC2_JIT.region) {
+    throw new Error(`region must be ${WINDOWS_EC2_JIT.region}`);
+  }
+  const instanceType = exact(
+    values.instanceType || WINDOWS_EC2_JIT.instanceType,
+    /^[a-z0-9.]+$/,
+    "instanceType",
+  );
+  if (instanceType !== WINDOWS_EC2_JIT.instanceType) {
+    throw new Error(`instanceType must be ${WINDOWS_EC2_JIT.instanceType}`);
+  }
+  const amiId = exact(values.amiId, /^ami-[0-9a-f]+$/, "amiId");
+  const amiName = exact(values.amiName, /^[A-Za-z0-9._-]+$/, "amiName");
+  const subnetId = exact(values.subnetId, /^subnet-[0-9a-f]+$/, "subnetId");
+  const securityGroupId = exact(
+    values.securityGroupId,
+    /^sg-[0-9a-f]+$/,
+    "securityGroupId",
+  );
+  const instanceProfileName = exact(
+    values.instanceProfileName,
+    /^[A-Za-z0-9+=,.@_-]{1,128}$/,
+    "instanceProfileName",
+  );
+  const evidenceBucket = exact(
+    values.evidenceBucket,
+    /^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$/,
+    "evidenceBucket",
+  );
+  const launchedAt = iso(values.launchedAt, "launchedAt");
+  const clientToken = `kungfu-${runId}-${runAttempt}-${qualification}`;
+  const jitParameterName =
+    String(values.jitParameterName || "").trim() ||
+    `${WINDOWS_EC2_JIT.jitParameterPrefix}${runId}/${runAttempt}/${qualification}`;
+  if (
+    !jitParameterName.startsWith(WINDOWS_EC2_JIT.jitParameterPrefix) ||
+    !/^\/[A-Za-z0-9._/-]+$/.test(jitParameterName)
+  ) {
+    throw new Error("jitParameterName must use the dedicated Windows prefix");
+  }
+
+  const ownershipTags = [
+    tag("kungfu:owner", "buildchain"),
+    tag("kungfu:plane", "aws-us-elastic-runner-burst"),
+    tag("kungfu:provider", "windows-ec2-jit"),
+    tag("kungfu:github-run-id", runId),
+    tag("kungfu:github-run-attempt", runAttempt),
+    tag("kungfu:qualification-id", qualification),
+    tag("kungfu:source-sha", sourceSha),
+    tag("kungfu:runner-label", runnerLabel),
+  ];
+  const instanceTags = [
+    ...ownershipTags,
+    tag("kungfu:jit-parameter", jitParameterName),
+  ];
+  const volumeTags = [...ownershipTags];
+  const plan = {
+    schemaVersion: 1,
+    contract: AWS_WINDOWS_JIT_CONTROLLER_CONTRACT,
+    kind: "launch-plan",
+    repository,
+    source: { sha: sourceSha, ref: sourceRef },
+    github: {
+      runId,
+      runAttempt,
+      jobId,
+      qualificationId: qualification,
+      event: "workflow_dispatch",
+    },
+    runner: {
+      name: runnerName,
+      label: runnerLabel,
+      labels: windowsJitRunnerLabels(runnerLabel),
+      oneJobJit: true,
+    },
+    aws: {
+      region,
+      instanceType,
+      amiId,
+      amiName,
+      subnetId,
+      securityGroupId,
+      instanceProfileName,
+      evidenceBucket,
+      jitParameterName,
+      launchedAt,
+      clientToken,
+      rootVolume: {
+        deviceName: "/dev/sda1",
+        deleteOnTermination: true,
+        encrypted: true,
+        volumeSizeGiB: 120,
+        volumeType: "gp3",
+      },
+      metadata: {
+        httpEndpoint: "enabled",
+        httpTokens: "required",
+        httpPutResponseHopLimit: 1,
+        instanceMetadataTags: "disabled",
+      },
+      instanceTags,
+      volumeTags,
+    },
+    safety: {
+      applyMode: values.execute === true ? "execute" : "dry-run",
+      exactSourceRequired: true,
+      queuedJobRequired: true,
+      activeInstanceCeiling: WINDOWS_EC2_JIT.maxConcurrentInstances,
+      awsDryRunRequiredBeforeLaunch: true,
+      userDataTransport: "fileb://rendered-bootstrap",
+      jitConfigTransport: "0600-temporary-file-to-ssm-secure-string",
+      jitConfigInUserData: false,
+      jitConfigInArgv: false,
+      cleanupOnLaunchFailure: [
+        "ec2-instance",
+        "ssm-parameter",
+        "github-runner-registration",
+      ],
+    },
+  };
+  return { ...plan, digest: digest(plan) };
+}
+
+export function windowsRunInstancesArgs(
+  plan,
+  { bootstrapPath = "<rendered-bootstrap>", dryRun = false } = {},
+) {
+  if (plan?.contract !== AWS_WINDOWS_JIT_CONTROLLER_CONTRACT) {
+    throw new Error("Windows JIT launch plan contract is invalid");
+  }
+  const resolvedBootstrap = exact(
+    bootstrapPath,
+    /^(?:<rendered-bootstrap>|\/[^\0]+)$/,
+    "bootstrapPath",
+  );
+  const args = [
+    "ec2",
+    "run-instances",
+    "--image-id",
+    plan.aws.amiId,
+    "--instance-type",
+    plan.aws.instanceType,
+    "--count",
+    "1",
+    "--client-token",
+    plan.aws.clientToken,
+    "--iam-instance-profile",
+    JSON.stringify({ Name: plan.aws.instanceProfileName }),
+    "--subnet-id",
+    plan.aws.subnetId,
+    "--security-group-ids",
+    plan.aws.securityGroupId,
+    "--associate-public-ip-address",
+    "--user-data",
+    `fileb://${resolvedBootstrap}`,
+    "--block-device-mappings",
+    JSON.stringify([
+      {
+        DeviceName: plan.aws.rootVolume.deviceName,
+        Ebs: {
+          DeleteOnTermination: plan.aws.rootVolume.deleteOnTermination,
+          Encrypted: plan.aws.rootVolume.encrypted,
+          VolumeSize: plan.aws.rootVolume.volumeSizeGiB,
+          VolumeType: plan.aws.rootVolume.volumeType,
+        },
+      },
+    ]),
+    "--metadata-options",
+    JSON.stringify({
+      HttpEndpoint: plan.aws.metadata.httpEndpoint,
+      HttpTokens: plan.aws.metadata.httpTokens,
+      HttpPutResponseHopLimit: plan.aws.metadata.httpPutResponseHopLimit,
+      InstanceMetadataTags: plan.aws.metadata.instanceMetadataTags,
+    }),
+    "--instance-initiated-shutdown-behavior",
+    "terminate",
+    "--tag-specifications",
+    JSON.stringify([
+      { ResourceType: "instance", Tags: plan.aws.instanceTags },
+      { ResourceType: "volume", Tags: plan.aws.volumeTags },
+    ]),
+    "--output",
+    "json",
+  ];
+  if (dryRun) args.splice(2, 0, "--dry-run");
+  return args;
+}