@kungfu-tech/buildchain 3.0.5-alpha.4 → 3.0.5-alpha.6
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/actions/macos-credential-island/README.md +8 -0
- package/dist/site/buildchain-contract.json +4 -4
- package/dist/site/buildchain-site.json +14 -14
- package/dist/site/kfd-claims.json +2 -2
- package/dist/site/kfd-upstream-aggregate.json +1 -1
- package/dist/site/manual-registry.json +2 -2
- package/dist/site/node-api-registry.json +11 -11
- package/dist/site/page-registry.json +8 -8
- package/dist/site/public-surface-audit.json +1 -1
- package/dist/site/publication-registry.json +4 -4
- package/dist/site/site-manifest.json +6 -6
- package/docs/aws-us-elastic-runner-burst-plane.md +29 -10
- package/docs/node-api-reference.md +27 -27
- package/docs/release-governance.md +32 -0
- package/package.json +1 -1
- package/packages/core/public-surface-audit.js +4 -35
- package/packages/core/release-propagation-work.js +7 -3
- package/packages/core/workflow-call-contract.js +308 -0
- package/packages/core/workflow-yaml-contract.js +272 -0
- package/scripts/aws-windows-jit-campaign-core.mjs +65 -10
- package/scripts/aws-windows-jit-campaign.mjs +40 -5
- package/scripts/aws-windows-jit-core.mjs +3 -3
- package/scripts/capture-package-release-propagation.mjs +24 -1
- package/scripts/finalize-native-artifact-signing-result.mjs +37 -15
- package/scripts/workflow-call-contract.mjs +133 -0
|
@@ -7,6 +7,14 @@ exact Developer ID Application identity into a temporary keychain, signs the
|
|
|
7
7
|
application, submits Apple notarization, staples the application and DMG,
|
|
8
8
|
verifies Gatekeeper, and writes bounded JSON evidence.
|
|
9
9
|
|
|
10
|
+
DMG assembly uses a unique execution- and attempt-bound image path and volume
|
|
11
|
+
name. Only the exact `hdiutil: create failed - Resource busy` failure is retried,
|
|
12
|
+
with three attempts and a total retry delay of seven seconds. Certificate,
|
|
13
|
+
entitlement, signature, notarization, provenance, and policy failures remain
|
|
14
|
+
terminal. Attempt artifacts stay below the owned temporary root, and successful
|
|
15
|
+
evidence binds the request, unsigned archive, runtime, runner attempt, toolchain,
|
|
16
|
+
retry history, cleanup result, and signed output digests.
|
|
17
|
+
|
|
10
18
|
The reusable Buildchain workflow invokes this action from a job bound to the
|
|
11
19
|
caller's protected GitHub Environment. The job downloads the exact sealed
|
|
12
20
|
Buildchain input and immutable action runtime, then uploads the signed payload
|
|
@@ -4,7 +4,7 @@
|
|
|
4
4
|
"product": {
|
|
5
5
|
"name": "Buildchain",
|
|
6
6
|
"package": "@kungfu-tech/buildchain",
|
|
7
|
-
"version": "3.0.5-alpha.
|
|
7
|
+
"version": "3.0.5-alpha.6",
|
|
8
8
|
"repository": "https://github.com/kungfu-systems/buildchain"
|
|
9
9
|
},
|
|
10
10
|
"majorLine": "v3",
|
|
@@ -709,7 +709,7 @@
|
|
|
709
709
|
"manual entries carry source file digests so downstream sites and agents can detect stale hand-written documentation"
|
|
710
710
|
],
|
|
711
711
|
"breakingDigest": "sha256:7d0d2819e3a3e72989d9c57b5efe9d0bc0a79bc0f2c82a0c7b9d6c5a211a91f2",
|
|
712
|
-
"auditDigest": "sha256:
|
|
712
|
+
"auditDigest": "sha256:da035e1a7b51adedfb9c06f59959dd08de3f066b563dff865cc87c8498f68c18"
|
|
713
713
|
},
|
|
714
714
|
{
|
|
715
715
|
"contractVersion": 1,
|
|
@@ -731,7 +731,7 @@
|
|
|
731
731
|
"agents can discover supported Node APIs without importing internal file paths"
|
|
732
732
|
],
|
|
733
733
|
"breakingDigest": "sha256:48f925608d3e2131d90936b07dc2a30341204cae3e6e785c0f77d61ad755c945",
|
|
734
|
-
"auditDigest": "sha256:
|
|
734
|
+
"auditDigest": "sha256:77635b2759c316e9a2c42f0b5aca8e032037609661003455683cae969241048a"
|
|
735
735
|
},
|
|
736
736
|
{
|
|
737
737
|
"contractVersion": 1,
|
|
@@ -3548,5 +3548,5 @@
|
|
|
3548
3548
|
}
|
|
3549
3549
|
],
|
|
3550
3550
|
"compatibilityDigest": "sha256:3bbcaf835844260ed98414d3bd176667245d12131e13fc748e4c2fae12399691",
|
|
3551
|
-
"contractDigest": "sha256:
|
|
3551
|
+
"contractDigest": "sha256:23e268fdeea59397e457cb27783d1b69ede401566e63ddc7ea975d54c22f0786"
|
|
3552
3552
|
}
|