@kungfu-tech/buildchain 3.0.5-alpha.4 → 3.0.5-alpha.5

package/scripts/aws-windows-jit-campaign.mjs

@@ -30,7 +30,9 @@ function aws(plan, serviceArgs) {
     const detail = String(result.stderr || result.stdout || "")
       .trim()
       .slice(0, 2000);
-    throw new Error(`AWS campaign mutation failed${detail ? `: ${detail}` : ""}`);
+    throw new Error(
+      `AWS campaign mutation failed${detail ? `: ${detail}` : ""}`,
+    );
   }
   return result.stdout ? JSON.parse(result.stdout) : {};
 }
@@ -43,10 +45,11 @@ function armPlan() {
     region: arg("region", "us-east-1"),
     armedAt: arg("armed-at", new Date().toISOString()),
     expiresAt: arg("expires-at"),
+    phaseSpendBaselineUsd: arg("phase-spend-baseline-usd"),
   });
 }
 
-function confirm(plan) {
+function confirm(plan, { phaseSpendBaseline = true } = {}) {
   if (arg("confirm-campaign-id") !== plan.campaign.id) {
     throw new Error("--confirm-campaign-id must equal the campaign id");
   }
@@ -54,7 +57,19 @@ function confirm(plan) {
     throw new Error("--confirm-source-sha must equal the exact source SHA");
   }
   if (arg("confirm-state-table") !== plan.aws.stateTable) {
-    throw new Error("--confirm-state-table must equal the campaign state table");
+    throw new Error(
+      "--confirm-state-table must equal the campaign state table",
+    );
+  }
+  if (
+    phaseSpendBaseline &&
+    (!arg("confirm-phase-spend-baseline-usd").trim() ||
+      Number(arg("confirm-phase-spend-baseline-usd")) !==
+        plan.limits.phaseSpendBaselineUsd)
+  ) {
+    throw new Error(
+      "--confirm-phase-spend-baseline-usd must equal the phase spend baseline",
+    );
   }
 }
 
@@ -65,7 +80,9 @@ function killSwitchTopic() {
       topic,
     )
   ) {
-    throw new Error("--kill-switch-topic must be the dedicated Windows JIT SNS ARN");
+    throw new Error(
+      "--kill-switch-topic must be the dedicated Windows JIT SNS ARN",
+    );
   }
   if (arg("confirm-kill-switch-topic") !== topic) {
     throw new Error(
@@ -113,8 +130,9 @@ export function main() {
       region: arg("region", "us-east-1"),
       armedAt: now.toISOString(),
       expiresAt: new Date(now.getTime() + 1000).toISOString(),
+      phaseSpendBaselineUsd: 0,
     });
-    confirm(plan);
+    confirm(plan, { phaseSpendBaseline: false });
     const topic = killSwitchTopic();
     aws(
       plan,

package/scripts/aws-windows-jit-core.mjs

@@ -10,9 +10,9 @@ export const WINDOWS_EC2_JIT = Object.freeze({
   instanceType: "c7i.4xlarge",
   pricePerHourUsd: 1.45,
   maximumInstanceLifetimeMinutes: 180,
-  maxConcurrentInstances: 2,
-  maxAcceptedInstances: 6,
-  budgetLimitUsd: 40,
+  maxConcurrentInstances: 1,
+  maxAcceptedInstances: 5,
+  budgetLimitUsd: 80,
   minimumSmokeJobs: 1,
   minimumFullJobs: 3,
   maximumCleanupLatencySeconds: 900,

package/scripts/capture-package-release-propagation.mjs

@@ -49,7 +49,30 @@ function assertSourcePath(value) {
   return sourcePath;
 }
 
-function readConfigAtSource(sourceSha, configPath, cwd) {
+function hasCommit(sourceSha, cwd) {
+  try {
+    execFileSync("git", ["cat-file", "-e", `${sourceSha}^{commit}`], {
+      cwd,
+      stdio: "ignore",
+    });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+export function readConfigAtSource(sourceSha, configPath, cwd) {
+  if (!hasCommit(sourceSha, cwd)) {
+    try {
+      execFileSync("git", ["fetch", "--no-tags", "--depth=1", "origin", sourceSha], {
+        cwd,
+        stdio: ["ignore", "pipe", "pipe"],
+      });
+    } catch (error) {
+      const detail = String(error.stderr || error.message || "unknown git fetch failure").trim();
+      throw new Error(`exact release source ${sourceSha} is unavailable from origin: ${detail}`);
+    }
+  }
   const bytes = execFileSync("git", ["show", `${sourceSha}:${configPath}`], {
     cwd,
     encoding: "utf8",

package/scripts/workflow-call-contract.mjs

@@ -0,0 +1,133 @@
+#!/usr/bin/env node
+import fs from "node:fs";
+import path from "node:path";
+import { execFileSync } from "node:child_process";
+import { pathToFileURL } from "node:url";
+import { evaluateWorkflowCallContract } from "../packages/core/workflow-call-contract.js";
+
+function usage() {
+  return `usage: node scripts/workflow-call-contract.mjs check \\
+  --caller-workflow <path> --job <id> --caller-repository <owner/repo> \\
+  --callee-root <checkout> --callee-workflow <path> --callee-repository <owner/repo> \\
+  --trusted-event <event[:type]> [--trusted-event ...] \\
+  [--expected-contract-root sha256:...] [--allow-dirty] [--output <path>]`;
+}
+
+function parseArgs(argv) {
+  const options = { trustedEvents: [] };
+  for (let index = 0; index < argv.length; index += 1) {
+    const arg = argv[index];
+    if (arg === "--allow-dirty") {
+      options.allowDirty = true;
+      continue;
+    }
+    if (!arg.startsWith("--") || !argv[index + 1])
+      throw new Error(`invalid argument: ${arg}`);
+    const value = argv[index + 1];
+    index += 1;
+    if (arg === "--trusted-event") options.trustedEvents.push(value);
+    else
+      options[
+        arg.slice(2).replace(/-([a-z])/g, (_, char) => char.toUpperCase())
+      ] = value;
+  }
+  return options;
+}
+
+function git(root, ...args) {
+  return execFileSync("git", ["-C", root, ...args], {
+    encoding: "utf8",
+  }).trim();
+}
+
+function required(options, names) {
+  const missing = names.filter((name) => !options[name]);
+  if (missing.length)
+    throw new Error(`missing required options: ${missing.join(", ")}`);
+}
+
+export function checkWorkflowCall(options) {
+  const callerRoot = path.resolve(options.callerRoot || process.cwd());
+  const calleeRoot = path.resolve(options.calleeRoot);
+  const callerStatus = git(
+    callerRoot,
+    "status",
+    "--porcelain",
+    "--untracked-files=no",
+  );
+  if (callerStatus && !options.allowDirty) {
+    throw new Error(
+      "caller checkout is dirty; use --allow-dirty only for local diagnostic validation",
+    );
+  }
+  const calleeStatus = git(
+    calleeRoot,
+    "status",
+    "--porcelain",
+    "--untracked-files=no",
+  );
+  if (calleeStatus) {
+    throw new Error("callee checkout is dirty; exact pinned-ref bytes are required");
+  }
+  const callerSha = git(callerRoot, "rev-parse", "HEAD");
+  const callerTree = git(callerRoot, "rev-parse", "HEAD^{tree}");
+  const calleeSha = git(calleeRoot, "rev-parse", "HEAD");
+  const report = evaluateWorkflowCallContract({
+    callerText: fs.readFileSync(
+      path.join(callerRoot, options.callerWorkflow),
+      "utf8",
+    ),
+    calleeText: fs.readFileSync(
+      path.join(calleeRoot, options.calleeWorkflow),
+      "utf8",
+    ),
+    callerRepository: options.callerRepository,
+    callerWorkflowPath: options.callerWorkflow,
+    callerSha,
+    callerTree,
+    callerSourceState: callerStatus ? "diagnostic-dirty" : "clean",
+    calleeRepository: options.calleeRepository,
+    calleeWorkflowPath: options.calleeWorkflow,
+    calleeSha,
+    jobId: options.job,
+    trustedEventClasses: options.trustedEvents,
+    expectedContractRoot: options.expectedContractRoot || "",
+  });
+  if (options.output) {
+    const output = path.resolve(callerRoot, options.output);
+    fs.mkdirSync(path.dirname(output), { recursive: true });
+    fs.writeFileSync(output, `${JSON.stringify(report, null, 2)}\n`);
+  }
+  return report;
+}
+
+function main(argv = process.argv.slice(2)) {
+  const command = argv.shift();
+  if (command !== "check") throw new Error(usage());
+  const options = parseArgs(argv);
+  required(options, [
+    "callerWorkflow",
+    "job",
+    "callerRepository",
+    "calleeRoot",
+    "calleeWorkflow",
+    "calleeRepository",
+  ]);
+  if (!options.trustedEvents.length)
+    throw new Error("at least one --trusted-event is required");
+  const report = checkWorkflowCall(options);
+  process.stdout.write(`${JSON.stringify(report, null, 2)}\n`);
+  if (!report.ok) process.exitCode = 1;
+}
+
+if (
+  process.argv[1] &&
+  import.meta.url === pathToFileURL(process.argv[1]).href
+) {
+  try {
+    main();
+  } catch (error) {
+    console.error(`workflow call contract: ${error.message}`);
+    process.exitCode = 1;
+  }
+}