@kungfu-tech/buildchain 3.0.4 → 3.0.5-alpha.1

package/scripts/aws-macos-jit-job-controller.mjs

@@ -0,0 +1,401 @@
+// SPDX-License-Identifier: Apache-2.0
+
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { AWS_MACOS_JIT_CONTROLLER_CONTRACT } from "./aws-macos-jit-controller-core.mjs";
+import {
+  assertOwnership,
+  awsArgs,
+  commandResult,
+  ghJson,
+  jsonResult,
+  requireSuccess,
+} from "./aws-macos-jit-controller-runtime.mjs";
+import { renderMacosJitBootstrap } from "./aws-macos-jit-core.mjs";
+
+function assertExactJobPreflight(plan, profile) {
+  const run = ghJson(
+    ["api", `repos/${plan.repository}/actions/runs/${plan.github.runId}`],
+    undefined,
+    "GitHub run preflight",
+  );
+  if (
+    run.event !== plan.github.event ||
+    run.head_sha !== plan.source.sha ||
+    run.head_repository?.full_name !== plan.repository ||
+    !["queued", "in_progress"].includes(run.status)
+  ) {
+    throw new Error("GitHub run is not the trusted exact-source dispatch");
+  }
+  const job = ghJson(
+    ["api", `repos/${plan.repository}/actions/jobs/${plan.github.jobId}`],
+    undefined,
+    "GitHub job preflight",
+  );
+  if (job.status !== "queued") {
+    throw new Error(
+      `GitHub job must be queued, observed ${job.status || "unknown"}`,
+    );
+  }
+  if (
+    !Array.isArray(job.labels) ||
+    !plan.runner.labels.every((label) => job.labels.includes(label))
+  ) {
+    throw new Error("GitHub job labels do not match the macOS JIT job plan");
+  }
+  const host = jsonResult(
+    commandResult(
+      "aws",
+      awsArgs(plan, profile, [
+        "ec2",
+        "describe-hosts",
+        "--host-ids",
+        plan.aws.hostId,
+        "--output",
+        "json",
+      ]),
+    ),
+    "macOS campaign host preflight",
+  ).Hosts?.[0];
+  if (
+    !host ||
+    host.State !== "available" ||
+    host.AvailabilityZone !== plan.aws.availabilityZone ||
+    host.HostProperties?.InstanceType !== plan.aws.instanceType
+  ) {
+    throw new Error("macOS campaign host identity or state mismatch");
+  }
+  assertOwnership(host.Tags, plan);
+  const instance = jsonResult(
+    commandResult(
+      "aws",
+      awsArgs(plan, profile, [
+        "ec2",
+        "describe-instances",
+        "--instance-ids",
+        plan.aws.instanceId,
+        "--output",
+        "json",
+      ]),
+    ),
+    "macOS campaign instance preflight",
+  ).Reservations?.[0]?.Instances?.[0];
+  if (
+    !instance ||
+    instance.State?.Name !== "running" ||
+    instance.Placement?.HostId !== plan.aws.hostId ||
+    instance.ImageId !== plan.aws.amiId ||
+    instance.InstanceType !== plan.aws.instanceType
+  ) {
+    throw new Error("macOS campaign instance identity or state mismatch");
+  }
+  assertOwnership(instance.Tags, plan);
+  const parameters = jsonResult(
+    commandResult(
+      "aws",
+      awsArgs(plan, profile, [
+        "ssm",
+        "describe-parameters",
+        "--parameter-filters",
+        `Key=Name,Option=Equals,Values=${plan.aws.jitParameterName}`,
+        "--output",
+        "json",
+      ]),
+    ),
+    "macOS JIT parameter preflight",
+  );
+  if ((parameters.Parameters || []).length !== 0) {
+    throw new Error("macOS JIT parameter already exists");
+  }
+  return {
+    runStatus: run.status,
+    jobStatus: job.status,
+    hostState: host.State,
+    instanceState: instance.State.Name,
+  };
+}
+
+function deleteRunnerRegistration(plan) {
+  const runners = ghJson(
+    ["api", `repos/${plan.repository}/actions/runners?per_page=100`],
+    undefined,
+    "GitHub runner cleanup lookup",
+  ).runners;
+  const runner = (runners || []).find(
+    (entry) => entry.name === plan.runner.name,
+  );
+  if (!runner) return false;
+  requireSuccess(
+    commandResult("gh", [
+      "api",
+      "--method",
+      "DELETE",
+      `repos/${plan.repository}/actions/runners/${runner.id}`,
+    ]),
+    "GitHub runner cleanup",
+  );
+  return true;
+}
+
+function waitForSsmOnline(plan, profile, timeoutMs = 15 * 60 * 1000) {
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    const response = jsonResult(
+      commandResult(
+        "aws",
+        awsArgs(plan, profile, [
+          "ssm",
+          "describe-instance-information",
+          "--filters",
+          `Key=InstanceIds,Values=${plan.aws.instanceId}`,
+          "--output",
+          "json",
+        ]),
+      ),
+      "macOS SSM online preflight",
+    );
+    const found = (response.InstanceInformationList || []).find(
+      (entry) =>
+        entry.InstanceId === plan.aws.instanceId &&
+        entry.PingStatus === "Online",
+    );
+    if (found) return found;
+    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 5000);
+  }
+  throw new Error("macOS campaign instance did not become SSM Online in time");
+}
+
+function cleanupFailedCommand(plan, profile, parameterCreated) {
+  const failures = [];
+  const attempt = (cleanup) => {
+    try {
+      cleanup();
+    } catch (error) {
+      failures.push(error.message || String(error));
+    }
+  };
+  if (parameterCreated) {
+    attempt(() =>
+      requireSuccess(
+        commandResult(
+          "aws",
+          awsArgs(plan, profile, [
+            "ssm",
+            "delete-parameter",
+            "--name",
+            plan.aws.jitParameterName,
+          ]),
+        ),
+        "macOS JIT parameter cleanup",
+      ),
+    );
+  }
+  attempt(() => deleteRunnerRegistration(plan));
+  return failures;
+}
+
+function createJitParameter(plan, profile, parameterInputPath) {
+  const jit = ghJson(
+    [
+      "api",
+      "--method",
+      "POST",
+      `repos/${plan.repository}/actions/runners/generate-jitconfig`,
+      "--input",
+      "-",
+    ],
+    JSON.stringify({
+      name: plan.runner.name,
+      runner_group_id: 1,
+      labels: plan.runner.labels,
+      work_folder: "_work",
+    }),
+    "GitHub JIT configuration",
+  ).encoded_jit_config;
+  if (!jit || typeof jit !== "string") {
+    throw new Error("GitHub JIT configuration was empty");
+  }
+  fs.writeFileSync(
+    parameterInputPath,
+    JSON.stringify({
+      Name: plan.aws.jitParameterName,
+      Description: `One-shot macOS GitHub Actions JIT config for ${plan.repository} run ${plan.github.runId}`,
+      Type: "SecureString",
+      Tier: "Advanced",
+      Value: jit,
+      Tags: [
+        { Key: "kungfu:owner", Value: "buildchain" },
+        { Key: "kungfu:plane", Value: "aws-us-elastic-runner-burst" },
+        { Key: "kungfu:provider", Value: "macos-ec2-jit" },
+        { Key: "kungfu:campaign-id", Value: plan.campaign.id },
+        { Key: "kungfu:github-run-id", Value: plan.github.runId },
+        { Key: "kungfu:qualification-id", Value: plan.github.qualificationId },
+      ],
+    }),
+    { mode: 0o600 },
+  );
+  requireSuccess(
+    commandResult(
+      "aws",
+      awsArgs(plan, profile, [
+        "ssm",
+        "put-parameter",
+        "--cli-input-json",
+        `file://${parameterInputPath}`,
+        "--output",
+        "json",
+      ]),
+    ),
+    "macOS JIT parameter creation",
+  );
+}
+
+function sendBootstrap(plan, profile, { bootstrapPath, commandInputPath }) {
+  fs.writeFileSync(
+    bootstrapPath,
+    renderMacosJitBootstrap(
+      fs.readFileSync(
+        path.resolve(
+          "infra/aws-us-elastic-runner-burst-plane/macos-jit-bootstrap.sh",
+        ),
+        "utf8",
+      ),
+      {
+        region: plan.aws.region,
+        jitParameterName: plan.aws.jitParameterName,
+        evidenceBucket: plan.aws.evidenceBucket,
+        runnerLabel: plan.runner.label,
+        sourceSha: plan.source.sha,
+        githubRunId: plan.github.runId,
+        githubRunAttempt: plan.github.runAttempt,
+        amiId: plan.aws.amiId,
+        amiName: plan.aws.amiName,
+        hostId: plan.aws.hostId,
+        instanceType: plan.aws.instanceType,
+        hostAllocatedAt: plan.aws.hostAllocatedAt,
+      },
+    ),
+    { mode: 0o600 },
+  );
+  const ssm = waitForSsmOnline(plan, profile);
+  const remotePath = `/private/tmp/kungfu-macos-jit-${plan.github.runId}-${plan.github.qualificationId}.sh`;
+  const bootstrapBase64 = fs.readFileSync(bootstrapPath).toString("base64");
+  fs.writeFileSync(
+    commandInputPath,
+    JSON.stringify({
+      DocumentName: "AWS-RunShellScript",
+      InstanceIds: [plan.aws.instanceId],
+      Comment: `kungfu macOS JIT ${plan.campaign.id} ${plan.github.qualificationId}`,
+      TimeoutSeconds: 10800,
+      Parameters: {
+        commands: [
+          `printf '%s' '${bootstrapBase64}' | base64 --decode > '${remotePath}'`,
+          `chmod 700 '${remotePath}'`,
+          `sudo /bin/bash '${remotePath}'`,
+          `status=$?; rm -f '${remotePath}'; exit $status`,
+        ],
+        executionTimeout: ["10800"],
+      },
+    }),
+    { mode: 0o600 },
+  );
+  const sent = jsonResult(
+    commandResult(
+      "aws",
+      awsArgs(plan, profile, [
+        "ssm",
+        "send-command",
+        "--cli-input-json",
+        `file://${commandInputPath}`,
+        "--output",
+        "json",
+      ]),
+    ),
+    "macOS JIT SSM command",
+  );
+  const commandId = sent.Command?.CommandId;
+  if (!/^[0-9a-f-]{36}$/.test(String(commandId || ""))) {
+    throw new Error("SSM SendCommand returned no command identity");
+  }
+  return { commandId, ssmAgentVersion: ssm.AgentVersion };
+}
+
+function dispatchMacosJitJob(plan, profile, files, state) {
+  createJitParameter(plan, profile, files.parameterInputPath);
+  state.parameterCreated = true;
+  requireSuccess(
+    commandResult(
+      "aws",
+      awsArgs(plan, profile, [
+        "ec2",
+        "create-tags",
+        "--resources",
+        plan.aws.instanceId,
+        "--tags",
+        `Key=kungfu:jit-parameter,Value=${plan.aws.jitParameterName}`,
+      ]),
+    ),
+    "macOS campaign instance JIT tag update",
+  );
+  return sendBootstrap(plan, profile, files);
+}
+
+export function executeMacosJitJob(plan, { profile = "" } = {}) {
+  if (
+    plan?.contract !== AWS_MACOS_JIT_CONTROLLER_CONTRACT ||
+    plan.kind !== "job-run-plan"
+  ) {
+    throw new Error("macOS JIT job plan contract is invalid");
+  }
+  const preflight = assertExactJobPreflight(plan, profile);
+  const tempRoot = fs.mkdtempSync(
+    path.join(os.tmpdir(), "buildchain-macos-jit-controller-"),
+  );
+  fs.chmodSync(tempRoot, 0o700);
+  const files = {
+    parameterInputPath: path.join(tempRoot, "ssm-parameter.json"),
+    bootstrapPath: path.join(tempRoot, "bootstrap.sh"),
+    commandInputPath: path.join(tempRoot, "ssm-command.json"),
+  };
+  const state = { parameterCreated: false };
+  try {
+    const sent = dispatchMacosJitJob(plan, profile, files, state);
+    return {
+      schemaVersion: 1,
+      contract: AWS_MACOS_JIT_CONTROLLER_CONTRACT,
+      kind: "job-command-result",
+      status: "command-sent",
+      campaign: plan.campaign,
+      source: plan.source,
+      github: plan.github,
+      runner: plan.runner,
+      aws: {
+        region: plan.aws.region,
+        hostId: plan.aws.hostId,
+        instanceId: plan.aws.instanceId,
+        ...sent,
+        jitParameterName: plan.aws.jitParameterName,
+      },
+      preflight,
+      planDigest: plan.digest,
+    };
+  } catch (error) {
+    const failures = cleanupFailedCommand(
+      plan,
+      profile,
+      state.parameterCreated,
+    );
+    if (failures.length) {
+      throw new Error(
+        `${error.message || error}; cleanup failed: ${failures.join("; ")}`,
+      );
+    }
+    throw error;
+  } finally {
+    for (const file of Object.values(files)) {
+      if (fs.existsSync(file)) fs.unlinkSync(file);
+    }
+    fs.rmdirSync(tempRoot);
+  }
+}

package/scripts/capture-package-release-propagation.mjs

@@ -0,0 +1,240 @@
+#!/usr/bin/env node
+
+import crypto from "node:crypto";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { execFileSync } from "node:child_process";
+import { fileURLToPath } from "node:url";
+import {
+  createPackageReleasePropagationCapture,
+  normalizePackageReleasePropagationConfig,
+} from "../packages/core/release-propagation-capture.js";
+import { stableJson } from "../packages/core/release-propagation-common.js";
+
+function parseArgs(argv) {
+  const args = {};
+  for (let index = 0; index < argv.length; index += 1) {
+    const token = argv[index];
+    if (!token.startsWith("--")) throw new Error(`unexpected argument: ${token}`);
+    const key = token.slice(2);
+    const value = argv[index + 1];
+    if (!value || value.startsWith("--")) throw new Error(`${token} requires a value`);
+    args[key] = value;
+    index += 1;
+  }
+  return args;
+}
+
+function required(args, key) {
+  const value = String(args[key] || "").trim();
+  if (!value) throw new Error(`--${key} is required`);
+  return value;
+}
+
+function sha256(bytes) {
+  return crypto.createHash("sha256").update(bytes).digest("hex");
+}
+
+function commandJson(command, args, options = {}) {
+  const text = execFileSync(command, args, { encoding: "utf8", ...options });
+  return JSON.parse(text);
+}
+
+function assertSourcePath(value) {
+  const sourcePath = String(value || "").trim();
+  if (!sourcePath || path.isAbsolute(sourcePath) || sourcePath.split("/").includes("..") || /[\r\n]/.test(sourcePath)) {
+    throw new Error("release propagation config path must be a safe repository-relative path");
+  }
+  return sourcePath;
+}
+
+function readConfigAtSource(sourceSha, configPath, cwd) {
+  const bytes = execFileSync("git", ["show", `${sourceSha}:${configPath}`], {
+    cwd,
+    encoding: "utf8",
+  });
+  const parsed = JSON.parse(bytes);
+  return { bytes, parsed, normalized: normalizePackageReleasePropagationConfig(parsed) };
+}
+
+function resolveTagTarget(repository, tag) {
+  let object = commandJson("gh", ["api", `repos/${repository}/git/ref/tags/${tag}`]).object;
+  for (let depth = 0; depth < 8 && object?.type === "tag"; depth += 1) {
+    object = commandJson("gh", ["api", `repos/${repository}/git/tags/${object.sha}`]).object;
+  }
+  if (object?.type !== "commit" || !/^[0-9a-f]{40}$/i.test(object.sha || "")) {
+    throw new Error(`release tag ${tag} does not resolve to one exact commit`);
+  }
+  return object.sha.toLowerCase();
+}
+
+function resolvePackageFact(packageName, version) {
+  const fact = commandJson("npm", [
+    "view",
+    `${packageName}@${version}`,
+    "version",
+    "dist.integrity",
+    "gitHead",
+    "--json",
+    "--registry=https://registry.npmjs.org/",
+  ]);
+  return {
+    name: packageName,
+    version: String(fact.version || ""),
+    integrity: String(fact.dist?.integrity || fact["dist.integrity"] || ""),
+    gitHead: String(fact.gitHead || "").toLowerCase(),
+  };
+}
+
+function verifyPublicReleasePassport({ repository, tag, localPath }) {
+  const temporary = fs.mkdtempSync(path.join(os.tmpdir(), "buildchain-release-passport-"));
+  try {
+    execFileSync("gh", [
+      "release", "download", tag,
+      "--repo", repository,
+      "--pattern", "buildchain.release.json",
+      "--dir", temporary,
+    ], { stdio: ["ignore", "pipe", "pipe"] });
+    const localBytes = fs.readFileSync(localPath);
+    const remotePath = path.join(temporary, "buildchain.release.json");
+    const remoteBytes = fs.readFileSync(remotePath);
+    const localDigest = sha256(localBytes);
+    const remoteDigest = sha256(remoteBytes);
+    if (localDigest !== remoteDigest) {
+      throw new Error("public release passport bytes disagree with finalized local passport");
+    }
+    return {
+      url: `https://github.com/${repository}/releases/download/${tag}/buildchain.release.json`,
+      sha256: remoteDigest,
+    };
+  } finally {
+    fs.rmSync(temporary, { recursive: true, force: true });
+  }
+}
+
+function resolveBaseShas(config) {
+  return Object.fromEntries(config.targets.map((targetId) => {
+    const node = config.graph.nodes.find((entry) => entry.id === targetId);
+    if (!node?.baseRef) throw new Error(`configured propagation target ${targetId} has no baseRef`);
+    const response = commandJson("gh", ["api", `repos/${node.repository}/commits/${node.baseRef}`]);
+    const sha = String(response.sha || "").toLowerCase();
+    if (!/^[0-9a-f]{40}$/.test(sha)) {
+      throw new Error(`configured propagation target ${targetId} baseRef did not resolve exactly`);
+    }
+    return [targetId, sha];
+  }));
+}
+
+function writeOutput(name, value) {
+  if (!process.env.GITHUB_OUTPUT) return;
+  fs.appendFileSync(process.env.GITHUB_OUTPUT, `${name}=${value}\n`);
+}
+
+export function capturePackageReleasePropagation({
+  config,
+  upstreamRelease,
+  expectedBaseShas,
+  outputDir,
+  configBytes = "",
+} = {}) {
+  const captured = createPackageReleasePropagationCapture({
+    config,
+    upstreamRelease,
+    expectedBaseShas,
+  });
+  fs.mkdirSync(outputDir, { recursive: true });
+  fs.writeFileSync(
+    path.join(outputDir, "config.json"),
+    configBytes || stableJson(captured.config),
+  );
+  fs.writeFileSync(path.join(outputDir, "upstream-release.json"), stableJson(captured.upstreamRelease));
+  fs.writeFileSync(path.join(outputDir, "plan.json"), stableJson(captured.plan));
+  for (const item of captured.works) {
+    const targetDir = path.join(outputDir, "work", item.propagationKey);
+    fs.mkdirSync(targetDir, { recursive: true });
+    fs.writeFileSync(path.join(targetDir, "work.json"), stableJson(item.work));
+    fs.writeFileSync(path.join(targetDir, "status.json"), stableJson(item.status));
+  }
+  return captured;
+}
+
+export function main(argv = process.argv.slice(2)) {
+  const args = parseArgs(argv);
+  const repository = required(args, "repository");
+  const channel = required(args, "channel");
+  const sourceSha = required(args, "source-sha").toLowerCase();
+  const tag = required(args, "tag");
+  const configPath = assertSourcePath(required(args, "config-path"));
+  const releasePassportPath = path.resolve(required(args, "release-passport-path"));
+  const outputDir = path.resolve(required(args, "output-dir"));
+  if (!/^[0-9a-f]{40}$/.test(sourceSha)) throw new Error("--source-sha must be an exact commit SHA");
+  if (tag !== `v${tag.replace(/^v/, "")}`) throw new Error("--tag must be an exact v-prefixed release tag");
+  const version = tag.slice(1);
+  const configSource = readConfigAtSource(sourceSha, configPath, process.cwd());
+  const sourceNode = configSource.normalized.graph.nodes.find(
+    (node) => node.id === configSource.normalized.sourceNode,
+  );
+  const packageFact = resolvePackageFact(sourceNode.package, version);
+  const tagTargetSha = resolveTagTarget(repository, tag);
+  const releasePassport = verifyPublicReleasePassport({
+    repository,
+    tag,
+    localPath: releasePassportPath,
+  });
+  const upstreamRelease = {
+    repository,
+    channel,
+    tag,
+    sourceSha,
+    tagTargetSha,
+    package: packageFact,
+    releasePassport,
+  };
+  const expectedBaseShas = resolveBaseShas(configSource.normalized);
+  const captured = capturePackageReleasePropagation({
+    config: configSource.parsed,
+    configBytes: configSource.bytes,
+    upstreamRelease,
+    expectedBaseShas,
+    outputDir,
+  });
+  const artifactName = `package-propagation-work-${version}-${sourceSha}`;
+  const workRoots = captured.works.map((item) => item.work.contentRoot);
+  writeOutput("configured", "true");
+  writeOutput("artifact-name", artifactName);
+  writeOutput("work-roots-json", JSON.stringify(workRoots));
+  process.stdout.write(stableJson({
+    schemaVersion: 1,
+    contract: "kungfu-buildchain-package-release-propagation-capture-result",
+    artifactName,
+    release: {
+      repository,
+      channel,
+      tag,
+      sourceSha,
+      tagTargetSha,
+      package: packageFact,
+      releasePassport,
+    },
+    workCount: captured.works.length,
+    works: captured.works.map((item) => ({
+      target: item.target,
+      repository: item.repository,
+      propagationKey: item.propagationKey,
+      workId: item.work.workId,
+      workRoot: item.work.contentRoot,
+      nextAction: item.status.nextAction,
+    })),
+  }));
+}
+
+const isMain = process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url);
+if (isMain) {
+  try {
+    main();
+  } catch (error) {
+    console.error(error.message);
+    process.exitCode = 1;
+  }
+}