@kungfu-tech/buildchain 3.0.5-alpha.1 → 3.0.5-alpha.2

package/scripts/aws-windows-jit-controller-core.mjs

@@ -3,12 +3,13 @@
 import { digest } from "./aws-runner-burst-core.mjs";
 import {
   WINDOWS_EC2_JIT,
+  windowsJitCampaignId,
   windowsJitRunnerLabel,
   windowsJitRunnerLabels,
 } from "./aws-windows-jit-core.mjs";
 
 export const AWS_WINDOWS_JIT_CONTROLLER_CONTRACT =
-  "kungfu-buildchain-aws-windows-jit-controller/v1";
+  "kungfu-buildchain-aws-windows-jit-controller/v2";
 
 function exact(value, pattern, label) {
   const normalized = String(value || "").trim();
@@ -59,8 +60,9 @@ export function createWindowsJitLaunchPlan(values = {}) {
   );
   const jobId = exact(values.jobId, /^\d+$/, "jobId");
   const qualification = qualificationId(values.qualificationId);
+  const campaign = windowsJitCampaignId(values.campaignId);
   const runnerLabel = windowsJitRunnerLabel(values.runnerLabel);
-  const expectedLabel = `${WINDOWS_EC2_JIT.labelPrefix}${qualification}`;
+  const expectedLabel = `${WINDOWS_EC2_JIT.labelPrefix}${campaign}-${qualification}`;
   if (runnerLabel !== expectedLabel) {
     throw new Error(`runnerLabel must be ${expectedLabel}`);
   }
@@ -109,6 +111,11 @@ export function createWindowsJitLaunchPlan(values = {}) {
     /^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$/,
     "evidenceBucket",
   );
+  const stateTable = exact(
+    values.stateTable,
+    /^kungfu-buildchain-windows-jit(?:-[A-Za-z0-9_.-]+)?$/,
+    "stateTable",
+  );
   const launchedAt = iso(values.launchedAt, "launchedAt");
   const clientToken = `kungfu-${runId}-${runAttempt}-${qualification}`;
   const jitParameterName =
@@ -125,6 +132,7 @@ export function createWindowsJitLaunchPlan(values = {}) {
     tag("kungfu:owner", "buildchain"),
     tag("kungfu:plane", "aws-us-elastic-runner-burst"),
     tag("kungfu:provider", "windows-ec2-jit"),
+    tag("kungfu:campaign-id", campaign),
     tag("kungfu:github-run-id", runId),
     tag("kungfu:github-run-attempt", runAttempt),
     tag("kungfu:qualification-id", qualification),
@@ -141,6 +149,7 @@ export function createWindowsJitLaunchPlan(values = {}) {
     contract: AWS_WINDOWS_JIT_CONTROLLER_CONTRACT,
     kind: "launch-plan",
     repository,
+    campaign: { id: campaign },
     source: { sha: sourceSha, ref: sourceRef },
     github: {
       runId,
@@ -148,6 +157,7 @@ export function createWindowsJitLaunchPlan(values = {}) {
       jobId,
       qualificationId: qualification,
       event: "workflow_dispatch",
+      displayTitle: `AWS Windows JIT ${campaign} ${qualification}`,
     },
     runner: {
       name: runnerName,
@@ -164,6 +174,7 @@ export function createWindowsJitLaunchPlan(values = {}) {
       securityGroupId,
       instanceProfileName,
       evidenceBucket,
+      stateTable,
       jitParameterName,
       launchedAt,
       clientToken,
@@ -188,6 +199,13 @@ export function createWindowsJitLaunchPlan(values = {}) {
       exactSourceRequired: true,
       queuedJobRequired: true,
       activeInstanceCeiling: WINDOWS_EC2_JIT.maxConcurrentInstances,
+      campaignAcceptedInstanceCeiling: WINDOWS_EC2_JIT.maxAcceptedInstances,
+      campaignReservationUsd:
+        (WINDOWS_EC2_JIT.pricePerHourUsd *
+          WINDOWS_EC2_JIT.maximumInstanceLifetimeMinutes) /
+        60,
+      campaignBudgetLimitUsd: WINDOWS_EC2_JIT.budgetLimitUsd,
+      persistentCampaignLedgerRequired: true,
       awsDryRunRequiredBeforeLaunch: true,
       userDataTransport: "fileb://rendered-bootstrap",
       jitConfigTransport: "0600-temporary-file-to-ssm-secure-string",

package/scripts/aws-windows-jit-controller.mjs

@@ -11,6 +11,10 @@ import {
   createWindowsJitLaunchPlan,
   windowsRunInstancesArgs,
 } from "./aws-windows-jit-controller-core.mjs";
+import {
+  windowsCampaignMarkLaunchedArgs,
+  windowsCampaignReservationItems,
+} from "./aws-windows-jit-campaign-core.mjs";
 import { renderWindowsJitBootstrap } from "./aws-windows-jit-core.mjs";
 
 function arg(name, fallback = "") {
@@ -75,6 +79,7 @@ function assertLivePreflight(plan, profile) {
   );
   if (
     run.event !== plan.github.event ||
+    run.display_title !== plan.github.displayTitle ||
     run.head_sha !== plan.source.sha ||
     run.head_repository?.full_name !== plan.repository ||
     !["queued", "in_progress"].includes(run.status)
@@ -267,6 +272,169 @@ function cleanupFailedLaunch(
   return failures;
 }
 
+function generateJitConfiguration(plan) {
+  const jit = ghJson(
+    [
+      "api",
+      "--method",
+      "POST",
+      `repos/${plan.repository}/actions/runners/generate-jitconfig`,
+      "--input",
+      "-",
+    ],
+    JSON.stringify({
+      name: plan.runner.name,
+      runner_group_id: 1,
+      labels: plan.runner.labels,
+      work_folder: "_work",
+    }),
+    "GitHub JIT configuration",
+  ).encoded_jit_config;
+  if (!jit || typeof jit !== "string") {
+    throw new Error("GitHub JIT configuration was empty");
+  }
+  return jit;
+}
+
+function createJitParameter(plan, profile, parameterInputPath, jit) {
+  fs.writeFileSync(
+    parameterInputPath,
+    JSON.stringify({
+      Name: plan.aws.jitParameterName,
+      Description: `One-shot GitHub Actions JIT config for ${plan.repository} run ${plan.github.runId} attempt ${plan.github.runAttempt}`,
+      Type: "SecureString",
+      Tier: "Advanced",
+      Value: jit,
+      Tags: [
+        { Key: "kungfu:owner", Value: "buildchain" },
+        { Key: "kungfu:plane", Value: "aws-us-elastic-runner-burst" },
+        { Key: "kungfu:provider", Value: "windows-ec2-jit" },
+        { Key: "kungfu:campaign-id", Value: plan.campaign.id },
+        { Key: "kungfu:github-run-id", Value: plan.github.runId },
+        {
+          Key: "kungfu:qualification-id",
+          Value: plan.github.qualificationId,
+        },
+      ],
+    }),
+    { mode: 0o600 },
+  );
+  requireSuccess(
+    commandResult(
+      "aws",
+      awsArgs(plan, profile, [
+        "ssm",
+        "put-parameter",
+        "--cli-input-json",
+        `file://${parameterInputPath}`,
+        "--output",
+        "json",
+      ]),
+    ),
+    "SSM JIT parameter creation",
+  );
+}
+
+function writeBootstrap(plan, bootstrapPath) {
+  const template = fs.readFileSync(
+    path.resolve(
+      "infra/aws-us-elastic-runner-burst-plane/windows-jit-bootstrap.ps1",
+    ),
+    "utf8",
+  );
+  fs.writeFileSync(
+    bootstrapPath,
+    renderWindowsJitBootstrap(template, {
+      region: plan.aws.region,
+      campaignId: plan.campaign.id,
+      jitParameterName: plan.aws.jitParameterName,
+      evidenceBucket: plan.aws.evidenceBucket,
+      runnerLabel: plan.runner.label,
+      sourceSha: plan.source.sha,
+      githubRunId: plan.github.runId,
+      githubRunAttempt: plan.github.runAttempt,
+      amiId: plan.aws.amiId,
+      amiName: plan.aws.amiName,
+      instanceType: plan.aws.instanceType,
+      launchedAt: plan.aws.launchedAt,
+    }),
+    { mode: 0o600 },
+  );
+}
+
+function assertLaunchDryRun(plan, profile, bootstrapPath) {
+  const dryRun = commandResult(
+    "aws",
+    awsArgs(
+      plan,
+      profile,
+      windowsRunInstancesArgs(plan, { bootstrapPath, dryRun: true }),
+    ),
+  );
+  if (
+    dryRun.status === 0 ||
+    !/DryRunOperation/.test(`${dryRun.stdout}\n${dryRun.stderr}`)
+  ) {
+    throw new Error("EC2 RunInstances DryRun did not return DryRunOperation");
+  }
+}
+
+function reserveCampaign(plan, profile) {
+  requireSuccess(
+    commandResult(
+      "aws",
+      awsArgs(plan, profile, [
+        "dynamodb",
+        "transact-write-items",
+        "--transact-items",
+        JSON.stringify(
+          windowsCampaignReservationItems(plan, new Date().toISOString()),
+        ),
+        "--output",
+        "json",
+      ]),
+    ),
+    "Windows campaign atomic reservation",
+  );
+}
+
+function launchInstance(plan, profile, bootstrapPath) {
+  const launched = jsonResult(
+    commandResult(
+      "aws",
+      awsArgs(
+        plan,
+        profile,
+        windowsRunInstancesArgs(plan, { bootstrapPath, dryRun: false }),
+      ),
+    ),
+    "EC2 RunInstances",
+  );
+  const instance = launched.Instances?.[0];
+  if (!/^i-[0-9a-f]+$/.test(String(instance?.InstanceId || ""))) {
+    throw new Error("EC2 RunInstances returned no instance identity");
+  }
+  return instance;
+}
+
+function markCampaignLaunched(plan, profile, instanceId) {
+  requireSuccess(
+    commandResult(
+      "aws",
+      awsArgs(
+        plan,
+        profile,
+        windowsCampaignMarkLaunchedArgs(
+          plan,
+          instanceId,
+          new Date().toISOString(),
+        ),
+      ),
+    ),
+    "Windows campaign launch ledger update",
+  );
+}
+
 export function executeWindowsJitLaunch(plan, { profile = "" } = {}) {
   if (plan?.contract !== AWS_WINDOWS_JIT_CONTROLLER_CONTRACT) {
     throw new Error("Windows JIT launch plan contract is invalid");
@@ -285,124 +453,23 @@ export function executeWindowsJitLaunch(plan, { profile = "" } = {}) {
   let failure;
   const cleanupFailures = [];
   try {
-    const jit = ghJson(
-      [
-        "api",
-        "--method",
-        "POST",
-        `repos/${plan.repository}/actions/runners/generate-jitconfig`,
-        "--input",
-        "-",
-      ],
-      JSON.stringify({
-        name: plan.runner.name,
-        runner_group_id: 1,
-        labels: plan.runner.labels,
-        work_folder: "_work",
-      }),
-      "GitHub JIT configuration",
-    ).encoded_jit_config;
-    if (!jit || typeof jit !== "string") {
-      throw new Error("GitHub JIT configuration was empty");
-    }
-    fs.writeFileSync(
-      parameterInputPath,
-      JSON.stringify({
-        Name: plan.aws.jitParameterName,
-        Description: `One-shot GitHub Actions JIT config for ${plan.repository} run ${plan.github.runId} attempt ${plan.github.runAttempt}`,
-        Type: "SecureString",
-        Tier: "Advanced",
-        Value: jit,
-        Tags: [
-          { Key: "kungfu:owner", Value: "buildchain" },
-          { Key: "kungfu:plane", Value: "aws-us-elastic-runner-burst" },
-          { Key: "kungfu:provider", Value: "windows-ec2-jit" },
-          { Key: "kungfu:github-run-id", Value: plan.github.runId },
-          {
-            Key: "kungfu:qualification-id",
-            Value: plan.github.qualificationId,
-          },
-        ],
-      }),
-      { mode: 0o600 },
-    );
-    requireSuccess(
-      commandResult(
-        "aws",
-        awsArgs(plan, profile, [
-          "ssm",
-          "put-parameter",
-          "--cli-input-json",
-          `file://${parameterInputPath}`,
-          "--output",
-          "json",
-        ]),
-      ),
-      "SSM JIT parameter creation",
-    );
+    const jit = generateJitConfiguration(plan);
+    createJitParameter(plan, profile, parameterInputPath, jit);
     parameterCreated = true;
-    fs.writeFileSync(
-      bootstrapPath,
-      renderWindowsJitBootstrap(
-        fs.readFileSync(
-          path.resolve(
-            "infra/aws-us-elastic-runner-burst-plane/windows-jit-bootstrap.ps1",
-          ),
-          "utf8",
-        ),
-        {
-          region: plan.aws.region,
-          jitParameterName: plan.aws.jitParameterName,
-          evidenceBucket: plan.aws.evidenceBucket,
-          runnerLabel: plan.runner.label,
-          sourceSha: plan.source.sha,
-          githubRunId: plan.github.runId,
-          githubRunAttempt: plan.github.runAttempt,
-          amiId: plan.aws.amiId,
-          amiName: plan.aws.amiName,
-          instanceType: plan.aws.instanceType,
-          launchedAt: plan.aws.launchedAt,
-        },
-      ),
-      { mode: 0o600 },
-    );
-    const dryRun = commandResult(
-      "aws",
-      awsArgs(
-        plan,
-        profile,
-        windowsRunInstancesArgs(plan, { bootstrapPath, dryRun: true }),
-      ),
-    );
-    if (
-      dryRun.status === 0 ||
-      !/DryRunOperation/.test(`${dryRun.stdout}\n${dryRun.stderr}`)
-    ) {
-      throw new Error("EC2 RunInstances DryRun did not return DryRunOperation");
-    }
+    writeBootstrap(plan, bootstrapPath);
+    assertLaunchDryRun(plan, profile, bootstrapPath);
+    reserveCampaign(plan, profile);
     launchAttempted = true;
-    const launched = jsonResult(
-      commandResult(
-        "aws",
-        awsArgs(
-          plan,
-          profile,
-          windowsRunInstancesArgs(plan, { bootstrapPath, dryRun: false }),
-        ),
-      ),
-      "EC2 RunInstances",
-    );
-    const instance = launched.Instances?.[0];
-    if (!/^i-[0-9a-f]+$/.test(String(instance?.InstanceId || ""))) {
-      throw new Error("EC2 RunInstances returned no instance identity");
-    }
+    const instance = launchInstance(plan, profile, bootstrapPath);
     launchSucceeded = true;
+    markCampaignLaunched(plan, profile, instance.InstanceId);
     result = {
       schemaVersion: 1,
       contract: AWS_WINDOWS_JIT_CONTROLLER_CONTRACT,
       kind: "launch-result",
       status: "launched",
       source: plan.source,
+      campaign: plan.campaign,
       github: plan.github,
       runner: plan.runner,
       aws: {
@@ -452,6 +519,7 @@ function planFromArgs(execute) {
     runAttempt: arg("run-attempt", "1"),
     jobId: arg("job-id"),
     qualificationId: arg("qualification-id"),
+    campaignId: arg("campaign-id"),
     runnerLabel: arg("runner-label"),
     runnerName: arg("runner-name"),
     sourceSha: arg("source-sha"),
@@ -464,6 +532,7 @@ function planFromArgs(execute) {
     securityGroupId: arg("security-group-id"),
     instanceProfileName: arg("instance-profile-name"),
     evidenceBucket: arg("evidence-bucket"),
+    stateTable: arg("state-table"),
     jitParameterName: arg("jit-parameter"),
     launchedAt: arg("launched-at", new Date().toISOString()),
   });
@@ -482,6 +551,12 @@ export function main() {
   if (arg("confirm-run-id") !== plan.github.runId) {
     throw new Error("--confirm-run-id must equal the exact GitHub run id");
   }
+  if (arg("confirm-campaign-id") !== plan.campaign.id) {
+    throw new Error("--confirm-campaign-id must equal the campaign id");
+  }
+  if (arg("confirm-state-table") !== plan.aws.stateTable) {
+    throw new Error("--confirm-state-table must equal the campaign state table");
+  }
   const result = executeWindowsJitLaunch(plan, {
     profile: arg("aws-profile"),
   });

package/scripts/aws-windows-jit-core.mjs

@@ -75,6 +75,14 @@ export function windowsJitRunnerLabels(value) {
   return ["self-hosted", "Windows", "X64", windowsJitRunnerLabel(value)];
 }
 
+export function windowsJitCampaignId(value) {
+  const campaign = String(value || "").trim();
+  if (!/^win-[a-z0-9][a-z0-9-]{2,15}$/.test(campaign)) {
+    throw new Error("campaignId must be a bounded Windows campaign id");
+  }
+  return campaign;
+}
+
 export function renderWindowsJitBootstrap(template, values = {}) {
   const runnerLabel = windowsJitRunnerLabel(values.runnerLabel);
   const jitParameterName = String(values.jitParameterName || "").trim();
@@ -86,6 +94,7 @@ export function renderWindowsJitBootstrap(template, values = {}) {
   }
   const bounded = {
     REGION: String(values.region || WINDOWS_EC2_JIT.region),
+    CAMPAIGN_ID: String(values.campaignId || ""),
     JIT_PARAMETER_NAME: jitParameterName,
     EVIDENCE_BUCKET: String(values.evidenceBucket || ""),
     RUNNER_LABEL: runnerLabel,
@@ -99,6 +108,7 @@ export function renderWindowsJitBootstrap(template, values = {}) {
   };
   const patterns = {
     REGION: /^us-[a-z]+-\d$/,
+    CAMPAIGN_ID: /^win-[a-z0-9][a-z0-9-]{2,43}$/,
     EVIDENCE_BUCKET: /^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$/,
     GITHUB_RUN_ID: /^\d+$/,
     GITHUB_RUN_ATTEMPT: /^\d+$/,
@@ -184,6 +194,7 @@ export function windowsEc2JitPlan(overrides = {}) {
 
 export function createWindowsJitEvidence({
   repository,
+  campaignId,
   sourceSha,
   sourceRef,
   githubRunId,
@@ -235,6 +246,7 @@ export function createWindowsJitEvidence({
     phase: WINDOWS_EC2_JIT.phase,
     provider: "aws-ec2",
     repository,
+    campaign: { id: windowsJitCampaignId(campaignId) },
     source: {
       sha: exactSha(sourceSha, "sourceSha"),
       ref: String(sourceRef || "").trim(),
@@ -286,6 +298,7 @@ export function createWindowsJitEvidence({
 }
 
 export function verifyWindowsEc2JitQualification({
+  campaignId,
   jobs = [],
   cancellationCleanup = {},
   timeoutCleanup = {},
@@ -299,6 +312,7 @@ export function verifyWindowsEc2JitQualification({
 } = {}) {
   const plan = windowsEc2JitPlan();
   const issues = [];
+  const campaign = windowsJitCampaignId(campaignId);
   const accepted = jobs.filter(
     (job) =>
       job?.trusted === true &&
@@ -308,6 +322,9 @@ export function verifyWindowsEc2JitQualification({
   );
   const smokeJobs = accepted.filter((job) => job.kind === "smoke");
   const fullJobs = accepted.filter((job) => job.kind === "full");
+  if (accepted.some((job) => job.campaignId !== campaign)) {
+    issues.push("accepted-jobs-not-bound-to-campaign");
+  }
   if (smokeJobs.length < plan.config.minimumSmokeJobs) {
     issues.push("runner-profile-smoke-missing");
   }
@@ -349,6 +366,7 @@ export function verifyWindowsEc2JitQualification({
     contract: AWS_WINDOWS_JIT_CONTRACT,
     kind: "phase-verification",
     phase: plan.config.phase,
+    campaign: { id: campaign },
     status: issues.length ? "failed" : "passed",
     qualifying: issues.length === 0,
     metrics: {

package/scripts/aws-windows-jit.mjs

@@ -35,6 +35,7 @@ export function main() {
   if (mode === "evidence") {
     const result = createWindowsJitEvidence({
       repository: process.env.GITHUB_REPOSITORY,
+      campaignId: process.env.AWS_EC2_CAMPAIGN_ID,
       sourceSha:
         process.env.BUILDCHAIN_EXPECTED_SOURCE_SHA || process.env.GITHUB_SHA,
       sourceRef:
@@ -77,6 +78,7 @@ export function main() {
       fs.readFileSync(path.resolve(template), "utf8"),
       {
         region: arg("region", "us-east-1"),
+        campaignId: arg("campaign-id"),
         jitParameterName: arg("jit-parameter"),
         evidenceBucket: arg("evidence-bucket"),
         runnerLabel: arg("runner-label"),

package/scripts/locked-source-checkout.mjs

@@ -46,6 +46,14 @@ function normalizeFallback(value = "github") {
   return fallback;
 }
 
+function normalizeHistoryMode(value = "shallow") {
+  const mode = String(value || "shallow").trim().toLowerCase() || "shallow";
+  if (!["shallow", "full"].includes(mode)) {
+    throw new Error(`checkout-history-mode must be shallow or full; got ${value}`);
+  }
+  return mode;
+}
+
 function splitRepository(repository) {
   const match = String(repository || "").trim().match(/^([^/\s]+)\/([^/\s]+)$/);
   if (!match) {
@@ -237,19 +245,25 @@ export function fetchSourceCommit({
   sourceTreeSha = "",
   timeoutMs,
   env = {},
+  historyMode = readEnv("BUILDCHAIN_CHECKOUT_HISTORY_MODE", "shallow"),
   allowFullFetchRetry = false,
   runGit = git,
   containsCommit = hasCommit,
 }) {
+  const normalizedHistoryMode = normalizeHistoryMode(historyMode);
   const fetchEnv = isolatedGitFetchEnv(env, targetPath);
   const fetch = (refspec) => {
     const options = { cwd: targetPath, timeoutMs, env: fetchEnv };
+    const fetchArgs = ["fetch", "--no-tags"];
+    if (normalizedHistoryMode === "shallow") fetchArgs.push("--depth=1");
+    fetchArgs.push(remoteName, refspec);
     try {
-      runGit(["fetch", "--no-tags", "--depth=1", remoteName, refspec], options);
-      return "shallow";
+      runGit(fetchArgs, options);
+      return normalizedHistoryMode;
     } catch (error) {
       if (
-        !allowFullFetchRetry
+        normalizedHistoryMode !== "shallow"
+        || !allowFullFetchRetry
         || !/dumb http transport does not support shallow capabilities/i.test(
           String(error?.message || error || ""),
         )