@kungfu-tech/buildchain 3.0.5-alpha.4 → 3.0.5-alpha.6

package/scripts/aws-windows-jit-campaign-core.mjs

@@ -38,6 +38,34 @@ function number(value) {
   return { N: String(value) };
 }
 
+function money(value, label) {
+  const normalized = String(value ?? "").trim();
+  if (!normalized) {
+    throw new Error(`${label} is required`);
+  }
+  const parsed = Number(normalized);
+  if (!Number.isFinite(parsed) || parsed < 0) {
+    throw new Error(`${label} must be a non-negative finite number`);
+  }
+  return Math.round(parsed * 100_000_000) / 100_000_000;
+}
+
+function acceptedInstances(value) {
+  const normalized = String(value ?? "").trim();
+  if (!normalized) return WINDOWS_EC2_JIT.maxAcceptedInstances;
+  const parsed = Number(normalized);
+  if (
+    !Number.isInteger(parsed) ||
+    parsed < 1 ||
+    parsed > WINDOWS_EC2_JIT.maxAcceptedInstances
+  ) {
+    throw new Error(
+      `maxAcceptedInstances must be an integer from 1 through ${WINDOWS_EC2_JIT.maxAcceptedInstances}`,
+    );
+  }
+  return parsed;
+}
+
 function string(value) {
   return { S: String(value) };
 }
@@ -56,6 +84,22 @@ export function createWindowsJitCampaignArmPlan(values = {}) {
     (WINDOWS_EC2_JIT.pricePerHourUsd *
       WINDOWS_EC2_JIT.maximumInstanceLifetimeMinutes) /
     60;
+  const phaseSpendBaselineUsd = money(
+    values.phaseSpendBaselineUsd,
+    "phaseSpendBaselineUsd",
+  );
+  const maxAcceptedInstances = acceptedInstances(values.maxAcceptedInstances);
+  const campaignReservationCeilingUsd = reservationUsd * maxAcceptedInstances;
+  const campaignSafetyCeilingUsd =
+    campaignReservationCeilingUsd +
+    reservationUsd * WINDOWS_EC2_JIT.maxConcurrentInstances;
+  const remainingPhaseBudgetUsd =
+    WINDOWS_EC2_JIT.budgetLimitUsd - phaseSpendBaselineUsd;
+  if (campaignSafetyCeilingUsd >= remainingPhaseBudgetUsd) {
+    throw new Error(
+      "campaign safety envelope must remain below the remaining Windows phase budget",
+    );
+  }
   return {
     schemaVersion: 1,
     contract: AWS_WINDOWS_JIT_CAMPAIGN_CONTRACT,
@@ -75,9 +119,14 @@ export function createWindowsJitCampaignArmPlan(values = {}) {
       stateTable: tableName(values.stateTable),
     },
     limits: {
-      maxAcceptedInstances: WINDOWS_EC2_JIT.maxAcceptedInstances,
+      maxAcceptedInstances,
       reservationUsd,
       budgetLimitUsd: WINDOWS_EC2_JIT.budgetLimitUsd,
+      phaseSpendBaselineUsd,
+      remainingPhaseBudgetUsd,
+      campaignReservationCeilingUsd,
+      campaignSafetyCeilingUsd,
+      reservationLimitUsd: remainingPhaseBudgetUsd - reservationUsd,
     },
   };
 }
@@ -97,6 +146,8 @@ export function windowsCampaignArmItems(plan) {
           state: string("ARMED"),
           campaign_id: string(plan.campaign.id),
           source_sha: string(plan.source.sha),
+          phase_spend_baseline_usd: number(plan.limits.phaseSpendBaselineUsd),
+          budget_limit_usd: number(plan.limits.budgetLimitUsd),
           armed_at: number(plan.campaign.armedAt),
           expires_epoch: number(plan.campaign.expiresAt),
         },
@@ -115,6 +166,17 @@ export function windowsCampaignArmItems(plan) {
           max_accepted_instances: number(plan.limits.maxAcceptedInstances),
           reservation_usd: number(plan.limits.reservationUsd),
           budget_limit_usd: number(plan.limits.budgetLimitUsd),
+          phase_spend_baseline_usd: number(plan.limits.phaseSpendBaselineUsd),
+          remaining_phase_budget_usd: number(
+            plan.limits.remainingPhaseBudgetUsd,
+          ),
+          campaign_reservation_ceiling_usd: number(
+            plan.limits.campaignReservationCeilingUsd,
+          ),
+          campaign_safety_ceiling_usd: number(
+            plan.limits.campaignSafetyCeilingUsd,
+          ),
+          reservation_limit_usd: number(plan.limits.reservationLimitUsd),
           armed_at: number(plan.campaign.armedAt),
           expires_epoch: number(plan.campaign.expiresAt),
         },
@@ -128,7 +190,6 @@ export function windowsCampaignReservationItems(plan, observedAt) {
   const now = epoch(observedAt, "observedAt");
   const runPk = runKey(plan);
   const campaignPk = `CAMPAIGN#${plan.campaign.id}`;
-  const maxAccepted = plan.safety.campaignAcceptedInstanceCeiling;
   const reservation = plan.safety.campaignReservationUsd;
   return [
     {
@@ -171,17 +232,13 @@ export function windowsCampaignReservationItems(plan, observedAt) {
         UpdateExpression:
           "ADD accepted_instances :one, reserved_usd :reservation SET updated_at = :now",
         ConditionExpression:
-          "#state = :armed AND source_sha = :source AND accepted_instances < :max AND reserved_usd <= :remaining",
+          "#state = :armed AND source_sha = :source AND accepted_instances < max_accepted_instances AND reserved_usd <= reservation_limit_usd",
         ExpressionAttributeNames: { "#state": "state" },
         ExpressionAttributeValues: {
           ":armed": string("ARMED"),
           ":source": string(plan.source.sha),
           ":one": number(1),
           ":reservation": number(reservation),
-          ":max": number(maxAccepted),
-          ":remaining": number(
-            plan.safety.campaignBudgetLimitUsd - reservation,
-          ),
           ":now": number(now),
         },
       },
@@ -230,9 +287,7 @@ export function windowsCampaignKillArgs(stateTable, reason, observedAt) {
     "--expression-attribute-values",
     JSON.stringify({
       ":killed": string("KILLED"),
-      ":reason": string(
-        exact(reason, /^[a-z0-9][a-z0-9-]{2,63}$/, "reason"),
-      ),
+      ":reason": string(exact(reason, /^[a-z0-9][a-z0-9-]{2,63}$/, "reason")),
       ":now": number(epoch(observedAt, "observedAt")),
     }),
     "--output",

package/scripts/aws-windows-jit-campaign.mjs

@@ -30,7 +30,9 @@ function aws(plan, serviceArgs) {
     const detail = String(result.stderr || result.stdout || "")
       .trim()
       .slice(0, 2000);
-    throw new Error(`AWS campaign mutation failed${detail ? `: ${detail}` : ""}`);
+    throw new Error(
+      `AWS campaign mutation failed${detail ? `: ${detail}` : ""}`,
+    );
   }
   return result.stdout ? JSON.parse(result.stdout) : {};
 }
@@ -43,10 +45,15 @@ function armPlan() {
     region: arg("region", "us-east-1"),
     armedAt: arg("armed-at", new Date().toISOString()),
     expiresAt: arg("expires-at"),
+    phaseSpendBaselineUsd: arg("phase-spend-baseline-usd"),
+    maxAcceptedInstances: arg("max-accepted-instances"),
   });
 }
 
-function confirm(plan) {
+function confirm(
+  plan,
+  { phaseSpendBaseline = true, maxAcceptedInstances = true } = {},
+) {
   if (arg("confirm-campaign-id") !== plan.campaign.id) {
     throw new Error("--confirm-campaign-id must equal the campaign id");
   }
@@ -54,7 +61,29 @@ function confirm(plan) {
     throw new Error("--confirm-source-sha must equal the exact source SHA");
   }
   if (arg("confirm-state-table") !== plan.aws.stateTable) {
-    throw new Error("--confirm-state-table must equal the campaign state table");
+    throw new Error(
+      "--confirm-state-table must equal the campaign state table",
+    );
+  }
+  if (
+    phaseSpendBaseline &&
+    (!arg("confirm-phase-spend-baseline-usd").trim() ||
+      Number(arg("confirm-phase-spend-baseline-usd")) !==
+        plan.limits.phaseSpendBaselineUsd)
+  ) {
+    throw new Error(
+      "--confirm-phase-spend-baseline-usd must equal the phase spend baseline",
+    );
+  }
+  if (
+    maxAcceptedInstances &&
+    (!arg("confirm-max-accepted-instances").trim() ||
+      Number(arg("confirm-max-accepted-instances")) !==
+        plan.limits.maxAcceptedInstances)
+  ) {
+    throw new Error(
+      "--confirm-max-accepted-instances must equal the campaign slot ceiling",
+    );
   }
 }
 
@@ -65,7 +94,9 @@ function killSwitchTopic() {
       topic,
     )
   ) {
-    throw new Error("--kill-switch-topic must be the dedicated Windows JIT SNS ARN");
+    throw new Error(
+      "--kill-switch-topic must be the dedicated Windows JIT SNS ARN",
+    );
   }
   if (arg("confirm-kill-switch-topic") !== topic) {
     throw new Error(
@@ -113,8 +144,12 @@ export function main() {
       region: arg("region", "us-east-1"),
       armedAt: now.toISOString(),
       expiresAt: new Date(now.getTime() + 1000).toISOString(),
+      phaseSpendBaselineUsd: 0,
+    });
+    confirm(plan, {
+      phaseSpendBaseline: false,
+      maxAcceptedInstances: false,
     });
-    confirm(plan);
     const topic = killSwitchTopic();
     aws(
       plan,

package/scripts/aws-windows-jit-core.mjs

@@ -10,9 +10,9 @@ export const WINDOWS_EC2_JIT = Object.freeze({
   instanceType: "c7i.4xlarge",
   pricePerHourUsd: 1.45,
   maximumInstanceLifetimeMinutes: 180,
-  maxConcurrentInstances: 2,
-  maxAcceptedInstances: 6,
-  budgetLimitUsd: 40,
+  maxConcurrentInstances: 1,
+  maxAcceptedInstances: 5,
+  budgetLimitUsd: 80,
   minimumSmokeJobs: 1,
   minimumFullJobs: 3,
   maximumCleanupLatencySeconds: 900,

package/scripts/capture-package-release-propagation.mjs

@@ -49,7 +49,30 @@ function assertSourcePath(value) {
   return sourcePath;
 }
 
-function readConfigAtSource(sourceSha, configPath, cwd) {
+function hasCommit(sourceSha, cwd) {
+  try {
+    execFileSync("git", ["cat-file", "-e", `${sourceSha}^{commit}`], {
+      cwd,
+      stdio: "ignore",
+    });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+export function readConfigAtSource(sourceSha, configPath, cwd) {
+  if (!hasCommit(sourceSha, cwd)) {
+    try {
+      execFileSync("git", ["fetch", "--no-tags", "--depth=1", "origin", sourceSha], {
+        cwd,
+        stdio: ["ignore", "pipe", "pipe"],
+      });
+    } catch (error) {
+      const detail = String(error.stderr || error.message || "unknown git fetch failure").trim();
+      throw new Error(`exact release source ${sourceSha} is unavailable from origin: ${detail}`);
+    }
+  }
   const bytes = execFileSync("git", ["show", `${sourceSha}:${configPath}`], {
     cwd,
     encoding: "utf8",

package/scripts/finalize-native-artifact-signing-result.mjs

@@ -12,6 +12,7 @@ import {
   artifactSigningEvidenceDigest,
   createArtifactSigningResult,
 } from "../packages/core/artifact-signing-result.js";
+import { acceptedMacosCredentialEvidence } from "../actions/macos-credential-island/dmg-assembly.js";
 import { writeGitHubOutputs } from "./build-contract-core.mjs";
 
 function required(value, label) {
@@ -32,15 +33,39 @@ function resolveBelow(root, relative, label) {
   return target;
 }
 
+function expectedCredentialExecution(
+  appBundleResult,
+  expectedRunId,
+  expectedRunAttempt,
+) {
+  if (!appBundleResult) return null;
+  return {
+    runId: required(expectedRunId, "credential execution run id"),
+    runAttempt: required(
+      expectedRunAttempt,
+      "credential execution run attempt",
+    ),
+  };
+}
+
+function acceptedProviderEvidence(evidence, request, expectedExecution) {
+  return expectedExecution
+    ? acceptedMacosCredentialEvidence(evidence, request, expectedExecution)
+    : evidence.status === "passed" &&
+        evidence.provider === request.signature.provider;
+}
+
 export function finalizeNativeArtifactSigningResult({
   requestRoot = process.env.BUILDCHAIN_SIGNING_REQUEST_ROOT,
   requestPath = process.env.BUILDCHAIN_SIGNING_REQUEST_PATH,
   signedPayload = process.env.BUILDCHAIN_SIGNED_PAYLOAD,
   evidencePath = process.env.BUILDCHAIN_SIGNING_EVIDENCE,
-  credentialArtifactRoot =
-    process.env.BUILDCHAIN_SIGNING_CREDENTIAL_ARTIFACT_ROOT,
+  credentialArtifactRoot = process.env
+    .BUILDCHAIN_SIGNING_CREDENTIAL_ARTIFACT_ROOT,
   outputRoot = process.env.BUILDCHAIN_SIGNING_RESULT_ROOT,
   checks = process.env.BUILDCHAIN_SIGNING_VERIFICATION_CHECKS,
+  expectedRunId = process.env.GITHUB_RUN_ID,
+  expectedRunAttempt = process.env.GITHUB_RUN_ATTEMPT,
 } = {}) {
   const requests = path.resolve(required(requestRoot, "signing request root"));
   const request = JSON.parse(
@@ -77,19 +102,16 @@ export function finalizeNativeArtifactSigningResult({
   fs.copyFileSync(evidenceSource, evidenceOutput, fs.constants.COPYFILE_EXCL);
   const evidenceDocument = JSON.parse(fs.readFileSync(evidenceOutput, "utf8"));
   const appBundleResult = request.artifact.kind === "app-bundle";
-  const providerEvidencePassed = appBundleResult
-    ? evidenceDocument.schema ===
-        "buildchain.macos-credential-island-evidence/v1" &&
-      evidenceDocument.status === "accepted" &&
-      evidenceDocument.source?.repository === request.source.repository &&
-      evidenceDocument.source?.sha === request.source.sha &&
-      evidenceDocument.source?.treeSha === request.source.treeSha &&
-      evidenceDocument.buildchain?.runtimeSha === request.runtime.sha &&
-      evidenceDocument.app?.architecture === request.artifact.arch &&
-      evidenceDocument.notarization?.application?.status === "Accepted" &&
-      evidenceDocument.notarization?.diskImage?.status === "Accepted"
-    : evidenceDocument.status === "passed" &&
-      evidenceDocument.provider === request.signature.provider;
+  const expectedExecution = expectedCredentialExecution(
+    appBundleResult,
+    expectedRunId,
+    expectedRunAttempt,
+  );
+  const providerEvidencePassed = acceptedProviderEvidence(
+    evidenceDocument,
+    request,
+    expectedExecution,
+  );
   if (!providerEvidencePassed) {
     throw new Error(
       "provider evidence does not prove the requested native signature",

package/scripts/workflow-call-contract.mjs

@@ -0,0 +1,133 @@
+#!/usr/bin/env node
+import fs from "node:fs";
+import path from "node:path";
+import { execFileSync } from "node:child_process";
+import { pathToFileURL } from "node:url";
+import { evaluateWorkflowCallContract } from "../packages/core/workflow-call-contract.js";
+
+function usage() {
+  return `usage: node scripts/workflow-call-contract.mjs check \\
+  --caller-workflow <path> --job <id> --caller-repository <owner/repo> \\
+  --callee-root <checkout> --callee-workflow <path> --callee-repository <owner/repo> \\
+  --trusted-event <event[:type]> [--trusted-event ...] \\
+  [--expected-contract-root sha256:...] [--allow-dirty] [--output <path>]`;
+}
+
+function parseArgs(argv) {
+  const options = { trustedEvents: [] };
+  for (let index = 0; index < argv.length; index += 1) {
+    const arg = argv[index];
+    if (arg === "--allow-dirty") {
+      options.allowDirty = true;
+      continue;
+    }
+    if (!arg.startsWith("--") || !argv[index + 1])
+      throw new Error(`invalid argument: ${arg}`);
+    const value = argv[index + 1];
+    index += 1;
+    if (arg === "--trusted-event") options.trustedEvents.push(value);
+    else
+      options[
+        arg.slice(2).replace(/-([a-z])/g, (_, char) => char.toUpperCase())
+      ] = value;
+  }
+  return options;
+}
+
+function git(root, ...args) {
+  return execFileSync("git", ["-C", root, ...args], {
+    encoding: "utf8",
+  }).trim();
+}
+
+function required(options, names) {
+  const missing = names.filter((name) => !options[name]);
+  if (missing.length)
+    throw new Error(`missing required options: ${missing.join(", ")}`);
+}
+
+export function checkWorkflowCall(options) {
+  const callerRoot = path.resolve(options.callerRoot || process.cwd());
+  const calleeRoot = path.resolve(options.calleeRoot);
+  const callerStatus = git(
+    callerRoot,
+    "status",
+    "--porcelain",
+    "--untracked-files=no",
+  );
+  if (callerStatus && !options.allowDirty) {
+    throw new Error(
+      "caller checkout is dirty; use --allow-dirty only for local diagnostic validation",
+    );
+  }
+  const calleeStatus = git(
+    calleeRoot,
+    "status",
+    "--porcelain",
+    "--untracked-files=no",
+  );
+  if (calleeStatus) {
+    throw new Error("callee checkout is dirty; exact pinned-ref bytes are required");
+  }
+  const callerSha = git(callerRoot, "rev-parse", "HEAD");
+  const callerTree = git(callerRoot, "rev-parse", "HEAD^{tree}");
+  const calleeSha = git(calleeRoot, "rev-parse", "HEAD");
+  const report = evaluateWorkflowCallContract({
+    callerText: fs.readFileSync(
+      path.join(callerRoot, options.callerWorkflow),
+      "utf8",
+    ),
+    calleeText: fs.readFileSync(
+      path.join(calleeRoot, options.calleeWorkflow),
+      "utf8",
+    ),
+    callerRepository: options.callerRepository,
+    callerWorkflowPath: options.callerWorkflow,
+    callerSha,
+    callerTree,
+    callerSourceState: callerStatus ? "diagnostic-dirty" : "clean",
+    calleeRepository: options.calleeRepository,
+    calleeWorkflowPath: options.calleeWorkflow,
+    calleeSha,
+    jobId: options.job,
+    trustedEventClasses: options.trustedEvents,
+    expectedContractRoot: options.expectedContractRoot || "",
+  });
+  if (options.output) {
+    const output = path.resolve(callerRoot, options.output);
+    fs.mkdirSync(path.dirname(output), { recursive: true });
+    fs.writeFileSync(output, `${JSON.stringify(report, null, 2)}\n`);
+  }
+  return report;
+}
+
+function main(argv = process.argv.slice(2)) {
+  const command = argv.shift();
+  if (command !== "check") throw new Error(usage());
+  const options = parseArgs(argv);
+  required(options, [
+    "callerWorkflow",
+    "job",
+    "callerRepository",
+    "calleeRoot",
+    "calleeWorkflow",
+    "calleeRepository",
+  ]);
+  if (!options.trustedEvents.length)
+    throw new Error("at least one --trusted-event is required");
+  const report = checkWorkflowCall(options);
+  process.stdout.write(`${JSON.stringify(report, null, 2)}\n`);
+  if (!report.ok) process.exitCode = 1;
+}
+
+if (
+  process.argv[1] &&
+  import.meta.url === pathToFileURL(process.argv[1]).href
+) {
+  try {
+    main();
+  } catch (error) {
+    console.error(`workflow call contract: ${error.message}`);
+    process.exitCode = 1;
+  }
+}