@kungfu-tech/buildchain 3.0.5-alpha.7 → 3.0.5

package/scripts/finalize-native-artifact-signing-result.mjs

@@ -12,7 +12,6 @@ import {
   artifactSigningEvidenceDigest,
   createArtifactSigningResult,
 } from "../packages/core/artifact-signing-result.js";
-import { acceptedMacosCredentialEvidence } from "../actions/macos-credential-island/dmg-assembly.js";
 import { writeGitHubOutputs } from "./build-contract-core.mjs";
 
 function required(value, label) {
@@ -33,39 +32,15 @@ function resolveBelow(root, relative, label) {
   return target;
 }
 
-function expectedCredentialExecution(
-  appBundleResult,
-  expectedRunId,
-  expectedRunAttempt,
-) {
-  if (!appBundleResult) return null;
-  return {
-    runId: required(expectedRunId, "credential execution run id"),
-    runAttempt: required(
-      expectedRunAttempt,
-      "credential execution run attempt",
-    ),
-  };
-}
-
-function acceptedProviderEvidence(evidence, request, expectedExecution) {
-  return expectedExecution
-    ? acceptedMacosCredentialEvidence(evidence, request, expectedExecution)
-    : evidence.status === "passed" &&
-        evidence.provider === request.signature.provider;
-}
-
 export function finalizeNativeArtifactSigningResult({
   requestRoot = process.env.BUILDCHAIN_SIGNING_REQUEST_ROOT,
   requestPath = process.env.BUILDCHAIN_SIGNING_REQUEST_PATH,
   signedPayload = process.env.BUILDCHAIN_SIGNED_PAYLOAD,
   evidencePath = process.env.BUILDCHAIN_SIGNING_EVIDENCE,
-  credentialArtifactRoot = process.env
-    .BUILDCHAIN_SIGNING_CREDENTIAL_ARTIFACT_ROOT,
+  credentialArtifactRoot =
+    process.env.BUILDCHAIN_SIGNING_CREDENTIAL_ARTIFACT_ROOT,
   outputRoot = process.env.BUILDCHAIN_SIGNING_RESULT_ROOT,
   checks = process.env.BUILDCHAIN_SIGNING_VERIFICATION_CHECKS,
-  expectedRunId = process.env.GITHUB_RUN_ID,
-  expectedRunAttempt = process.env.GITHUB_RUN_ATTEMPT,
 } = {}) {
   const requests = path.resolve(required(requestRoot, "signing request root"));
   const request = JSON.parse(
@@ -102,16 +77,19 @@ export function finalizeNativeArtifactSigningResult({
   fs.copyFileSync(evidenceSource, evidenceOutput, fs.constants.COPYFILE_EXCL);
   const evidenceDocument = JSON.parse(fs.readFileSync(evidenceOutput, "utf8"));
   const appBundleResult = request.artifact.kind === "app-bundle";
-  const expectedExecution = expectedCredentialExecution(
-    appBundleResult,
-    expectedRunId,
-    expectedRunAttempt,
-  );
-  const providerEvidencePassed = acceptedProviderEvidence(
-    evidenceDocument,
-    request,
-    expectedExecution,
-  );
+  const providerEvidencePassed = appBundleResult
+    ? evidenceDocument.schema ===
+        "buildchain.macos-credential-island-evidence/v1" &&
+      evidenceDocument.status === "accepted" &&
+      evidenceDocument.source?.repository === request.source.repository &&
+      evidenceDocument.source?.sha === request.source.sha &&
+      evidenceDocument.source?.treeSha === request.source.treeSha &&
+      evidenceDocument.buildchain?.runtimeSha === request.runtime.sha &&
+      evidenceDocument.app?.architecture === request.artifact.arch &&
+      evidenceDocument.notarization?.application?.status === "Accepted" &&
+      evidenceDocument.notarization?.diskImage?.status === "Accepted"
+    : evidenceDocument.status === "passed" &&
+      evidenceDocument.provider === request.signature.provider;
   if (!providerEvidencePassed) {
     throw new Error(
       "provider evidence does not prove the requested native signature",

package/scripts/generate-site-bundle.mjs

@@ -767,7 +767,6 @@ function buildSiteBundle() {
         ["build", "channel-build-router"],
         [".build", "reusable-build"],
         [".auditable-demo", "auditable-demo"],
-        [".declarative-auditable-demo", "declarative-auditable-demo"],
         ["web-surface", "site-app-deployment"],
         ["buildchain-ref-promotion", "release-governance"],
         ["release-line-bootstrap", "release-governance"],
@@ -794,7 +793,6 @@ function buildSiteBundle() {
       ]);
       const statusById = new Map([
         [".auditable-demo", "preview"],
-        [".declarative-auditable-demo", "preview"],
         ["release-propagation", "preview"],
         ["candidate-lab", "repository-internal"],
         ["build-surface-fixture", "repository-internal"],

package/scripts/locked-source-checkout.mjs

@@ -46,14 +46,6 @@ function normalizeFallback(value = "github") {
   return fallback;
 }
 
-function normalizeHistoryMode(value = "shallow") {
-  const mode = String(value || "shallow").trim().toLowerCase() || "shallow";
-  if (!["shallow", "full"].includes(mode)) {
-    throw new Error(`checkout-history-mode must be shallow or full; got ${value}`);
-  }
-  return mode;
-}
-
 function splitRepository(repository) {
   const match = String(repository || "").trim().match(/^([^/\s]+)\/([^/\s]+)$/);
   if (!match) {
@@ -245,25 +237,19 @@ export function fetchSourceCommit({
   sourceTreeSha = "",
   timeoutMs,
   env = {},
-  historyMode = readEnv("BUILDCHAIN_CHECKOUT_HISTORY_MODE", "shallow"),
   allowFullFetchRetry = false,
   runGit = git,
   containsCommit = hasCommit,
 }) {
-  const normalizedHistoryMode = normalizeHistoryMode(historyMode);
   const fetchEnv = isolatedGitFetchEnv(env, targetPath);
   const fetch = (refspec) => {
     const options = { cwd: targetPath, timeoutMs, env: fetchEnv };
-    const fetchArgs = ["fetch", "--no-tags"];
-    if (normalizedHistoryMode === "shallow") fetchArgs.push("--depth=1");
-    fetchArgs.push(remoteName, refspec);
     try {
-      runGit(fetchArgs, options);
-      return normalizedHistoryMode;
+      runGit(["fetch", "--no-tags", "--depth=1", remoteName, refspec], options);
+      return "shallow";
     } catch (error) {
       if (
-        normalizedHistoryMode !== "shallow"
-        || !allowFullFetchRetry
+        !allowFullFetchRetry
         || !/dumb http transport does not support shallow capabilities/i.test(
           String(error?.message || error || ""),
         )

package/scripts/release-propagation.mjs

@@ -1,7 +1,6 @@
 #!/usr/bin/env node
 import fs from "node:fs";
 import path from "node:path";
-import { execFileSync } from "node:child_process";
 import { pathToFileURL } from "node:url";
 import {
   claimReleasePropagationWork,
@@ -16,10 +15,6 @@ import {
   resumeReleasePropagationWork,
   verifyReleasePropagationWork,
   writeReleasePropagationLock,
-  createManualUpstreamPickupCapture,
-  createManualUpstreamPickupPlan,
-  normalizeManualUpstreamPickupConfig,
-  resolveNpmRegistryRelease,
 } from "../packages/core/release-propagation.js";
 
 function usage() {
@@ -66,15 +61,6 @@ function usage() {
                                               --completion-decision <json-or-path>
                                               --expected-work-root <sha256:...>
                                               [--output <file>] [--json]
-  buildchain release-propagation pickup plan --config <json-or-path>
-                                            --source-id <id> --channel <alpha|release>
-                                            --current-version <version>
-                                            [--output <file>] [--json]
-  buildchain release-propagation pickup create --config <json-or-path>
-                                              --source-id <id> --channel <alpha|release>
-                                              --current-version <version>
-                                              --expected-downstream-base-sha <git-sha>
-                                              [--output <file>] [--json]
 `;
 }
 
@@ -185,61 +171,7 @@ function runWorkCli(args) {
   throw new Error(`unsupported release-propagation work command: ${mode}`);
 }
 
-async function resolvePickupPlan(args) {
-  const config = normalizeManualUpstreamPickupConfig(readJsonFlag(args, "config"));
-  const sourceId = readFlag(args, "source-id");
-  const channel = readFlag(args, "channel");
-  const source = config.sources.find((entry) => entry.id === sourceId);
-  if (!source) throw new Error(`manual pickup source is not configured: ${sourceId}`);
-  const distTag = source.distTags[channel];
-  if (!distTag) throw new Error("manual pickup channel must be alpha or release");
-  const packageMetadata = args.includes("--package-metadata")
-    ? readJsonFlag(args, "package-metadata")
-    : JSON.parse(execFileSync("npm", ["view", `${source.package}@${distTag}`, "--json", "--registry=https://registry.npmjs.org/"], {
-        encoding: "utf8",
-        maxBuffer: 16 * 1024 * 1024,
-      }));
-  const attestationUrl = packageMetadata.dist?.attestations?.url;
-  if (!attestationUrl) throw new Error("published npm package does not expose an attestation URL");
-  let attestations;
-  if (args.includes("--attestations")) {
-    attestations = readJsonFlag(args, "attestations");
-  } else {
-    const response = await fetch(attestationUrl, { headers: { accept: "application/json" } });
-    if (!response.ok) throw new Error(`npm attestation lookup failed: HTTP ${response.status}`);
-    attestations = await response.json();
-  }
-  const upstreamRelease = resolveNpmRegistryRelease({ source, channel, packageMetadata, attestations });
-  return createManualUpstreamPickupPlan({
-    config,
-    sourceId,
-    channel,
-    currentVersion: readFlag(args, "current-version"),
-    upstreamRelease,
-  });
-}
-
-async function runPickupCli(args) {
-  const [mode = "", ...pickupArgs] = args;
-  if (!mode || mode === "--help" || mode === "-h") {
-    process.stdout.write(usage());
-    return;
-  }
-  if (mode !== "plan" && mode !== "create") throw new Error(`unsupported release-propagation pickup command: ${mode}`);
-  const plan = await resolvePickupPlan(pickupArgs);
-  const result = mode === "create"
-    ? createManualUpstreamPickupCapture({
-        plan,
-        expectedDownstreamBaseSha: readFlag(pickupArgs, "expected-downstream-base-sha"),
-      })
-    : plan;
-  writeOutput(readFlag(pickupArgs, "output", ""), result);
-  if (hasFlag(pickupArgs, "json")) printJson(result);
-  else if (mode === "plan") process.stdout.write(`manual upstream pickup: ${plan.source.id} ${plan.currentVersion} -> ${plan.resolvedVersion} (${plan.status})\n`);
-  else process.stdout.write(`manual upstream pickup next action: ${result.nextAction}\n`);
-}
-
-export async function runReleasePropagationCli(argv = process.argv.slice(2)) {
+export function runReleasePropagationCli(argv = process.argv.slice(2)) {
   const [mode = "", ...args] = argv;
   if (!mode || mode === "--help" || mode === "-h") {
     process.stdout.write(usage());
@@ -274,10 +206,6 @@ export async function runReleasePropagationCli(argv = process.argv.slice(2)) {
     runWorkCli(args);
     return;
   }
-  if (mode === "pickup") {
-    await runPickupCli(args);
-    return;
-  }
   if (mode === "write-lock") {
     const plan = readReleasePropagationJson(readFlag(args, "plan"), {
       label: "--plan",
@@ -331,8 +259,5 @@ export async function runReleasePropagationCli(argv = process.argv.slice(2)) {
 }
 
 if (!process.env.BUILDCHAIN_EMBEDDED_ENTRYPOINT && process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
-  runReleasePropagationCli().catch((error) => {
-    console.error(`buildchain release-propagation: ${error.message}`);
-    process.exitCode = 1;
-  });
+  runReleasePropagationCli();
 }

package/contracts/auditable-demo-scenario-v1.schema.json

@@ -1,153 +0,0 @@
-{
-  "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://buildchain.libkungfu.dev/contracts/auditable-demo-scenario-v1.schema.json",
-  "title": "Buildchain declarative binary auditable demo",
-  "type": "object",
-  "additionalProperties": false,
-  "required": ["schema", "product", "artifact", "execution", "renditions", "demos", "publication", "authority"],
-  "properties": {
-    "schema": {"const": "buildchain.declarative-binary-demo/v1"},
-    "product": {
-      "type": "object",
-      "additionalProperties": false,
-      "required": ["id", "displayName", "binaryName"],
-      "properties": {
-        "id": {"type": "string", "pattern": "^[a-z0-9][a-z0-9._-]{0,63}$"},
-        "displayName": {"type": "string", "minLength": 1, "maxLength": 80},
-        "binaryName": {"type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$"}
-      }
-    },
-    "artifact": {
-      "type": "object",
-      "additionalProperties": false,
-      "required": ["platformId", "binaryPath", "metadataPath", "metadataContract", "runtimeDependencies"],
-      "properties": {
-        "platformId": {"const": "linux-x64"},
-        "binaryPath": {"type": "string", "minLength": 1},
-        "metadataPath": {"type": "string", "minLength": 1},
-        "metadataContract": {"type": "string", "minLength": 1},
-        "runtimeDependencies": {"type": "array", "maxItems": 0}
-      }
-    },
-    "execution": {
-      "type": "object",
-      "additionalProperties": false,
-      "required": ["deterministic", "network", "secrets", "totalTimeoutSeconds", "environment"],
-      "properties": {
-        "deterministic": {"const": true},
-        "network": {"const": "none"},
-        "secrets": {"const": "none"},
-        "durationClass": {"type": "string", "enum": ["standard", "long-form"]},
-        "totalTimeoutSeconds": {"type": "integer", "minimum": 1},
-        "environment": {
-          "type": "object",
-          "propertyNames": {"pattern": "^[A-Z][A-Z0-9_]{0,63}$"},
-          "additionalProperties": {"type": "string", "maxLength": 256}
-        }
-      }
-    },
-    "renditions": {
-      "const": [
-        {"id": "1080p", "role": "primary", "columns": 150, "rows": 36, "width": 1920, "height": 1080},
-        {"id": "720p", "role": "responsive", "columns": 100, "rows": 28, "width": 1280, "height": 720}
-      ]
-    },
-    "demos": {
-      "type": "array",
-      "minItems": 1,
-      "maxItems": 8,
-      "items": {
-        "type": "object",
-        "additionalProperties": false,
-        "required": ["id", "title", "claimBoundary", "steps"],
-        "properties": {
-          "id": {"type": "string", "pattern": "^[a-z0-9][a-z0-9._-]{0,63}$"},
-          "title": {"type": "string", "minLength": 1, "maxLength": 120},
-          "claimBoundary": {"type": "string", "minLength": 1, "maxLength": 500},
-          "steps": {
-            "type": "array",
-            "minItems": 1,
-            "maxItems": 12,
-            "items": {
-              "type": "object",
-              "additionalProperties": false,
-              "required": ["id", "argv", "timeoutSeconds", "expectedExitCodes", "stdoutIncludes", "fileAssertions"],
-              "properties": {
-                "id": {"type": "string", "pattern": "^[a-z0-9][a-z0-9._-]{0,63}$"},
-                "argv": {"type": "array", "minItems": 1, "maxItems": 64, "items": {"type": "string", "maxLength": 512}},
-                "timeoutSeconds": {"type": "integer", "minimum": 1, "maximum": 180},
-                "expectedExitCodes": {"type": "array", "minItems": 1, "maxItems": 4, "items": {"type": "integer", "minimum": 0, "maximum": 255}},
-                "stdoutIncludes": {"type": "array", "maxItems": 32, "items": {"type": "string", "minLength": 1, "maxLength": 256}},
-                "fileAssertions": {
-                  "type": "array",
-                  "maxItems": 32,
-                  "items": {
-                    "type": "object",
-                    "additionalProperties": false,
-                    "required": ["path", "jsonEquals"],
-                    "properties": {
-                      "path": {"type": "string", "minLength": 1},
-                      "jsonEquals": {"type": "object"}
-                    }
-                  }
-                }
-              }
-            }
-          }
-        }
-      }
-    },
-    "publication": {
-      "type": "object",
-      "additionalProperties": false,
-      "required": ["evidencePath", "readmePath", "marker"],
-      "properties": {
-        "evidencePath": {"type": "string", "minLength": 1},
-        "readmePath": {"type": "string", "minLength": 1},
-        "marker": {"type": "string", "pattern": "^[a-z0-9][a-z0-9._:-]{0,79}$"}
-      }
-    },
-    "authority": {
-      "type": "object",
-      "additionalProperties": false,
-      "required": ["grants", "nonAuthorities"],
-      "properties": {
-        "grants": {"type": "array", "maxItems": 0},
-        "nonAuthorities": {"type": "array", "minItems": 8, "uniqueItems": true, "items": {"type": "string"}}
-      }
-    }
-  },
-  "allOf": [
-    {
-      "if": {
-        "properties": {
-          "execution": {
-            "required": ["durationClass"],
-            "properties": {"durationClass": {"const": "long-form"}}
-          }
-        }
-      },
-      "then": {
-        "properties": {
-          "execution": {"properties": {"totalTimeoutSeconds": {"maximum": 180}}}
-        }
-      },
-      "else": {
-        "properties": {
-          "execution": {"properties": {"totalTimeoutSeconds": {"maximum": 60}}},
-          "demos": {
-            "items": {
-              "properties": {
-                "steps": {
-                  "items": {
-                    "properties": {"timeoutSeconds": {"maximum": 60}}
-                  }
-                }
-              }
-            }
-          }
-        }
-      }
-    }
-  ]
-}