@kungfu-tech/buildchain 3.0.5 → 3.0.6-alpha.0

package/scripts/aws-windows-jit-core.mjs

@@ -10,9 +10,9 @@ export const WINDOWS_EC2_JIT = Object.freeze({
   instanceType: "c7i.4xlarge",
   pricePerHourUsd: 1.45,
   maximumInstanceLifetimeMinutes: 180,
-  maxConcurrentInstances: 2,
-  maxAcceptedInstances: 6,
-  budgetLimitUsd: 40,
+  maxConcurrentInstances: 1,
+  maxAcceptedInstances: 5,
+  budgetLimitUsd: 80,
   minimumSmokeJobs: 1,
   minimumFullJobs: 3,
   maximumCleanupLatencySeconds: 900,
@@ -75,6 +75,14 @@ export function windowsJitRunnerLabels(value) {
   return ["self-hosted", "Windows", "X64", windowsJitRunnerLabel(value)];
 }
 
+export function windowsJitCampaignId(value) {
+  const campaign = String(value || "").trim();
+  if (!/^win-[a-z0-9][a-z0-9-]{2,15}$/.test(campaign)) {
+    throw new Error("campaignId must be a bounded Windows campaign id");
+  }
+  return campaign;
+}
+
 export function renderWindowsJitBootstrap(template, values = {}) {
   const runnerLabel = windowsJitRunnerLabel(values.runnerLabel);
   const jitParameterName = String(values.jitParameterName || "").trim();
@@ -86,6 +94,7 @@ export function renderWindowsJitBootstrap(template, values = {}) {
   }
   const bounded = {
     REGION: String(values.region || WINDOWS_EC2_JIT.region),
+    CAMPAIGN_ID: String(values.campaignId || ""),
     JIT_PARAMETER_NAME: jitParameterName,
     EVIDENCE_BUCKET: String(values.evidenceBucket || ""),
     RUNNER_LABEL: runnerLabel,
@@ -99,6 +108,7 @@ export function renderWindowsJitBootstrap(template, values = {}) {
   };
   const patterns = {
     REGION: /^us-[a-z]+-\d$/,
+    CAMPAIGN_ID: /^win-[a-z0-9][a-z0-9-]{2,43}$/,
     EVIDENCE_BUCKET: /^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$/,
     GITHUB_RUN_ID: /^\d+$/,
     GITHUB_RUN_ATTEMPT: /^\d+$/,
@@ -184,6 +194,7 @@ export function windowsEc2JitPlan(overrides = {}) {
 
 export function createWindowsJitEvidence({
   repository,
+  campaignId,
   sourceSha,
   sourceRef,
   githubRunId,
@@ -235,6 +246,7 @@ export function createWindowsJitEvidence({
     phase: WINDOWS_EC2_JIT.phase,
     provider: "aws-ec2",
     repository,
+    campaign: { id: windowsJitCampaignId(campaignId) },
     source: {
       sha: exactSha(sourceSha, "sourceSha"),
       ref: String(sourceRef || "").trim(),
@@ -286,6 +298,7 @@ export function createWindowsJitEvidence({
 }
 
 export function verifyWindowsEc2JitQualification({
+  campaignId,
   jobs = [],
   cancellationCleanup = {},
   timeoutCleanup = {},
@@ -299,6 +312,7 @@ export function verifyWindowsEc2JitQualification({
 } = {}) {
   const plan = windowsEc2JitPlan();
   const issues = [];
+  const campaign = windowsJitCampaignId(campaignId);
   const accepted = jobs.filter(
     (job) =>
       job?.trusted === true &&
@@ -308,6 +322,9 @@ export function verifyWindowsEc2JitQualification({
   );
   const smokeJobs = accepted.filter((job) => job.kind === "smoke");
   const fullJobs = accepted.filter((job) => job.kind === "full");
+  if (accepted.some((job) => job.campaignId !== campaign)) {
+    issues.push("accepted-jobs-not-bound-to-campaign");
+  }
   if (smokeJobs.length < plan.config.minimumSmokeJobs) {
     issues.push("runner-profile-smoke-missing");
   }
@@ -349,6 +366,7 @@ export function verifyWindowsEc2JitQualification({
     contract: AWS_WINDOWS_JIT_CONTRACT,
     kind: "phase-verification",
     phase: plan.config.phase,
+    campaign: { id: campaign },
     status: issues.length ? "failed" : "passed",
     qualifying: issues.length === 0,
     metrics: {

package/scripts/aws-windows-jit.mjs

@@ -35,6 +35,7 @@ export function main() {
   if (mode === "evidence") {
     const result = createWindowsJitEvidence({
       repository: process.env.GITHUB_REPOSITORY,
+      campaignId: process.env.AWS_EC2_CAMPAIGN_ID,
       sourceSha:
         process.env.BUILDCHAIN_EXPECTED_SOURCE_SHA || process.env.GITHUB_SHA,
       sourceRef:
@@ -77,6 +78,7 @@ export function main() {
       fs.readFileSync(path.resolve(template), "utf8"),
       {
         region: arg("region", "us-east-1"),
+        campaignId: arg("campaign-id"),
         jitParameterName: arg("jit-parameter"),
         evidenceBucket: arg("evidence-bucket"),
         runnerLabel: arg("runner-label"),

package/scripts/build-standalone-binary.mjs

@@ -346,13 +346,19 @@ export function buildStandaloneBinary({
       phase: "archive",
     });
   }
+  const binarySha256 = crypto.createHash("sha256").update(fs.readFileSync(binaryPath)).digest("hex");
   const manifest = {
     schemaVersion: 1,
     contract: "kungfu-buildchain-standalone-binary",
     name,
     version,
     platform: triple,
+    platformId: process.platform === "linux" && process.arch === "x64" ? "linux-x64" : triple,
     binary: relativePath(cwd, binaryPath),
+    sha256: binarySha256,
+    executableFiles: [{ path: path.basename(binaryPath), sha256: binarySha256 }],
+    sourceSha: sourceSha(cwd),
+    runtimeDependencies: [],
     archive: relativePath(cwd, archivePath),
     node: process.version,
     observability: {

package/scripts/buildchain-cli-help.mjs

@@ -208,7 +208,7 @@ export const BUILDCHAIN_USAGE = `Usage:
                           [--execute] [--json]
   buildchain paper status [--cwd <dir>] [--json]
   buildchain paper resume [--cwd <dir>] [--buildchain-ref <ref>] [--execute] [--json]
-  buildchain release-propagation <plan|write-lock> ...
+  buildchain release-propagation <plan|write-lock|work|entry|pickup> ...
   buildchain badges readme [--cwd <dir>] [--readme <path>] [--check] [--write] [--json]
   buildchain badges bundle [--cwd <dir>] [--readme <path>] [--claims <csv>] [--check] [--write] [--json]
   buildchain homebrew update-formula --package <name> --release-passport <file-or-url> [--write] [--json]
@@ -246,6 +246,7 @@ Examples:
   buildchain paper preflight --json
   buildchain paper status --json
   buildchain release-propagation plan --graph graph.json --upstream-release release.json --json
+  buildchain release-propagation pickup plan --config manual-upstreams.json --source-id buildchain --channel release --current-version 3.0.3 --json
   buildchain kfd status --json
   buildchain kfd schema list --json
   buildchain kfd 1 witness --json

package/scripts/capture-package-release-propagation.mjs

@@ -49,7 +49,30 @@ function assertSourcePath(value) {
   return sourcePath;
 }
 
-function readConfigAtSource(sourceSha, configPath, cwd) {
+function hasCommit(sourceSha, cwd) {
+  try {
+    execFileSync("git", ["cat-file", "-e", `${sourceSha}^{commit}`], {
+      cwd,
+      stdio: "ignore",
+    });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+export function readConfigAtSource(sourceSha, configPath, cwd) {
+  if (!hasCommit(sourceSha, cwd)) {
+    try {
+      execFileSync("git", ["fetch", "--no-tags", "--depth=1", "origin", sourceSha], {
+        cwd,
+        stdio: ["ignore", "pipe", "pipe"],
+      });
+    } catch (error) {
+      const detail = String(error.stderr || error.message || "unknown git fetch failure").trim();
+      throw new Error(`exact release source ${sourceSha} is unavailable from origin: ${detail}`);
+    }
+  }
   const bytes = execFileSync("git", ["show", `${sourceSha}:${configPath}`], {
     cwd,
     encoding: "utf8",

package/scripts/check-inventory.mjs

@@ -73,6 +73,7 @@ const requiredPaths = [
   "docs/github-artifact-attestation.md",
   "docs/shifu-gate-profiles.md",
   "docs/auditable-demo.md",
+  "contracts/auditable-demo-scenario-v1.schema.json",
   "contracts/auditable-demo-media-profiles-v1.json",
   "contracts/evidence/auditable-demo-web-delivery-v1.json",
   "contracts/evidence/auditable-demo-responsive-web-delivery-v1.json",
@@ -103,6 +104,9 @@ const requiredPaths = [
   "scripts/seal-macos-credential-input.mjs",
   "scripts/shifu-gate-profile.mjs",
   "scripts/auditable-demo.mjs",
+  "scripts/auditable-demo-platform.mjs",
+  "scripts/auditable-demo-transport-smoke.mjs",
+  "scripts/auditable-demo-capture.py",
   "scripts/resolve-artifact-coordinates.mjs",
   "scripts/artifact-relay-s3.mjs",
   "scripts/anchored-version-material.mjs",
@@ -154,6 +158,8 @@ const requiredPaths = [
   ".github/workflows/.build.yml",
   ".github/workflows/.gate-profile.yml",
   ".github/workflows/.auditable-demo.yml",
+  ".github/workflows/.declarative-auditable-demo.yml",
+  ".github/workflows/auditable-demo.yml",
   ".github/workflows/build.yml",
   ".github/workflows/build-surface-fixture.yml",
   ".github/workflows/candidate-lab.yml",

package/scripts/compiler-cache-evidence.mjs

@@ -7,6 +7,12 @@ import { fileURLToPath } from "node:url";
 export const BUILDCHAIN_COMPILER_CACHE_PREPARATION_CONTRACT =
   "kungfu-buildchain-compiler-cache-preparation";
 
+const SCCACHE_COMPILER_BINDINGS = Object.freeze({
+  RUSTC_WRAPPER: "sccache",
+  CMAKE_C_COMPILER_LAUNCHER: "sccache",
+  CMAKE_CXX_COMPILER_LAUNCHER: "sccache",
+});
+
 const DIGEST_RE = /^sha256:[0-9a-f]{64}$/;
 
 function stableValue(value) {
@@ -76,6 +82,33 @@ function appendGithubEnv(filePath, values) {
   );
 }
 
+function sumCounters(value) {
+  if (typeof value === "number" && Number.isFinite(value)) return value;
+  if (!value || typeof value !== "object") return 0;
+  return Object.values(value).reduce((total, entry) => total + sumCounters(entry), 0);
+}
+
+function readSccacheStats({ cwd, env, runCommand }) {
+  const result = runCommand(
+    "sccache",
+    ["--show-stats", "--stats-format", "json"],
+    { cwd, env },
+  );
+  assertCommandSucceeded(result, "sccache current-run stats probe");
+  let payload;
+  try {
+    payload = JSON.parse(cleanText(result.stdout));
+  } catch {
+    throw new Error("sccache current-run stats probe returned invalid JSON");
+  }
+  const stats = payload?.stats || payload;
+  return {
+    compileRequests: sumCounters(stats?.compile_requests),
+    cacheHits: sumCounters(stats?.cache_hits),
+    cacheMisses: sumCounters(stats?.cache_misses),
+  };
+}
+
 function readToolEvidence({ cwd, env, expectedRoot }) {
   const configured = cleanText(
     env.BUILDCHAIN_COMPILER_CACHE_TOOL_EVIDENCE_PATH,
@@ -178,6 +211,7 @@ export function prepareCompilerCacheEvidence({
     action: {
       statsReset: true,
       command: ["sccache", "--zero-stats"],
+      compilerBindings: SCCACHE_COMPILER_BINDINGS,
     },
     bindings,
   };
@@ -191,25 +225,74 @@ export function prepareCompilerCacheEvidence({
     BUILDCHAIN_COMPILER_CACHE_ACTIVE_PROVIDER: provider,
     BUILDCHAIN_COMPILER_CACHE_PREPARATION_PATH: outputPath,
     BUILDCHAIN_COMPILER_CACHE_PREPARATION_ROOT: receipt.root,
+    ...SCCACHE_COMPILER_BINDINGS,
   });
   return receipt;
 }
 
+export function verifyCompilerCacheActivity({
+  cwd = process.cwd(),
+  env = process.env,
+  runCommand = defaultRunCommand,
+} = {}) {
+  const provider = cleanText(
+    env.BUILDCHAIN_COMPILER_CACHE_ACTIVE_PROVIDER ||
+      env.BUILDCHAIN_COMPILER_CACHE_PROVIDER ||
+      "none",
+  ).toLowerCase();
+  const required = cleanText(env.BUILDCHAIN_COMPILER_CACHE_REQUIRED).toLowerCase() === "true";
+  if (provider !== "sccache") {
+    if (required) {
+      throw new Error(`required compiler cache provider must be sccache, received ${provider || "empty"}`);
+    }
+    return undefined;
+  }
+
+  const stats = readSccacheStats({ cwd, env, runCommand });
+  const cacheableRequests = stats.cacheHits + stats.cacheMisses;
+  if (required && stats.compileRequests < 1) {
+    throw new Error(
+      "required sccache observed zero compile requests; compiler launcher bindings were not effective",
+    );
+  }
+  if (required && cacheableRequests < 1) {
+    throw new Error(
+      "required sccache observed no cacheable compiler requests",
+    );
+  }
+  return {
+    ...stats,
+    cacheableRequests,
+  };
+}
+
 function main() {
   const command = process.argv[2] || "";
-  if (command !== "prepare") {
-    throw new Error("usage: node scripts/compiler-cache-evidence.mjs prepare");
+  if (!new Set(["prepare", "verify"]).has(command)) {
+    throw new Error("usage: node scripts/compiler-cache-evidence.mjs <prepare|verify>");
   }
-  const receipt = prepareCompilerCacheEvidence();
-  if (receipt) {
-    console.log(`compiler_cache_provider=${receipt.provider}`);
-    console.log(`compiler_cache_preparation_root=${receipt.root}`);
+  if (command === "prepare") {
+    const receipt = prepareCompilerCacheEvidence();
+    if (receipt) {
+      console.log(`compiler_cache_provider=${receipt.provider}`);
+      console.log(`compiler_cache_preparation_root=${receipt.root}`);
+    } else {
+      console.log("compiler_cache_provider=none");
+    }
   } else {
-    console.log("compiler_cache_provider=none");
+    const activity = verifyCompilerCacheActivity();
+    if (activity) {
+      console.log(`compiler_cache_compile_requests=${activity.compileRequests}`);
+      console.log(`compiler_cache_hits=${activity.cacheHits}`);
+      console.log(`compiler_cache_misses=${activity.cacheMisses}`);
+    } else {
+      console.log("compiler_cache_activity=not-applicable");
+    }
   }
 }
 
 const isMain = process.argv[1] &&
+  path.basename(process.argv[1]) === "compiler-cache-evidence.mjs" &&
   path.resolve(process.argv[1]) === fileURLToPath(import.meta.url);
 if (isMain) {
   try {

package/scripts/dev-alpha-candidate-patrol.mjs

@@ -24,6 +24,16 @@ function bool(value, fallback = false) {
   return ["1", "true", "yes", "on"].includes(text(value).toLowerCase());
 }
 
+function autoMergeMethod(value, fallback = "merge") {
+  const normalized = text(value || fallback).toLowerCase();
+  if (!["merge", "squash", "rebase"].includes(normalized)) {
+    throw new Error(
+      `mergeMethod must be merge, squash, or rebase, got ${value || "<empty>"}`,
+    );
+  }
+  return normalized;
+}
+
 function repository(value) {
   const normalized = text(value);
   if (!/^[^/\s]+\/[^/\s]+$/.test(normalized))
@@ -169,6 +179,8 @@ export function managedCandidateFromPullRequest(pullRequest, targetBranch) {
     }
     return {
       number: Number(pullRequest.number),
+      nodeId: text(pullRequest.node_id),
+      autoMerge: pullRequest.auto_merge || null,
       url: text(pullRequest.html_url),
       body,
       sourceSha,
@@ -191,6 +203,8 @@ export function managedCandidateFromPullRequest(pullRequest, targetBranch) {
     );
   return {
     number: Number(pullRequest.number),
+    nodeId: text(pullRequest.node_id),
+    autoMerge: pullRequest.auto_merge || null,
     url: text(pullRequest.html_url),
     body,
     sourceSha,
@@ -282,6 +296,14 @@ export function normalizeDevAlphaPatrolOptions(options = {}) {
         process.env.BUILDCHAIN_CHANNEL_PATROL_SETTLEMENT_AUTHORIZED,
       createPullRequest,
     ),
+    autoMerge: bool(
+      options.autoMerge ?? process.env.BUILDCHAIN_CHANNEL_PATROL_AUTO_MERGE,
+      false,
+    ),
+    mergeMethod: autoMergeMethod(
+      options.mergeMethod ??
+        process.env.BUILDCHAIN_CHANNEL_PATROL_MERGE_METHOD,
+    ),
     dryRun: bool(
       options.dryRun ?? process.env.BUILDCHAIN_CHANNEL_PATROL_DRY_RUN,
       true,
@@ -541,12 +563,50 @@ function pullRequestBody({
         `- ${row.workflowName}: [run ${row.runId} attempt ${row.runAttempt}](${row.url})`,
     ),
     "",
-    "The source-lock branch must continue to point at the exact source SHA. This patrol never merges the PR, publishes a package, creates a tag, or creates a release.",
+    "The source-lock branch must continue to point at the exact source SHA. This patrol never directly merges the PR, publishes a package, creates a tag, or creates a release. Repository policy may arm GitHub auto-merge while every protected branch gate remains authoritative.",
     "",
     candidateStateMarker(state),
   ].join("\n");
 }
 
+async function armCandidateAutoMerge(
+  options,
+  controllerState,
+  pullRequest,
+  client,
+) {
+  if (
+    !options.autoMerge ||
+    !options.settlementAuthorized ||
+    options.dryRun ||
+    controllerState !== "active" ||
+    !pullRequest
+  ) {
+    return {
+      requested: options.autoMerge,
+      enabled: false,
+      mergeMethod: options.mergeMethod,
+    };
+  }
+  if (!pullRequest.auto_merge) {
+    await client.enableAutoMerge(pullRequest, options.mergeMethod);
+  }
+  return {
+    requested: true,
+    enabled: true,
+    mergeMethod: options.mergeMethod,
+  };
+}
+
+function activePullRequest(candidate) {
+  return {
+    number: candidate.number,
+    node_id: candidate.nodeId,
+    auto_merge: candidate.autoMerge,
+    html_url: candidate.url,
+  };
+}
+
 export async function runDevAlphaCandidatePatrol(
   optionsInput = {},
   clientInput,
@@ -793,10 +853,7 @@ export async function runDevAlphaCandidatePatrol(
             : "retain-next-candidate"
           : "reconcile-active-candidate";
       }
-      pullRequest = {
-        number: activeCandidate.number,
-        html_url: activeCandidate.url,
-      };
+      pullRequest = activePullRequest(activeCandidate);
     } else if (decision.eligible) {
       await client.ensureImmutableBranch(decision.sourceLockRef, sourceSha);
       state = candidateStateBody({
@@ -870,11 +927,13 @@ export async function runDevAlphaCandidatePatrol(
       }
     }
   }
+  const autoMerge = await armCandidateAutoMerge(options, controllerState, pullRequest, client);
   return {
     schema: "kungfu-buildchain-dev-alpha-candidate-patrol/v1",
     dryRun: options.dryRun,
     createPullRequest: options.createPullRequest,
     settlementAuthorized: options.settlementAuthorized,
+    autoMerge,
     decision,
     controller: {
       schema: DEV_ALPHA_CANDIDATE_STATE_SCHEMA,
@@ -1031,6 +1090,22 @@ export function createGitHubChannelCandidateClient({
         body: { head, base, title, body },
       });
     },
+    async enableAutoMerge(pullRequest, mergeMethod) {
+      if (!text(pullRequest.node_id)) {
+        throw new Error("candidate pull request has no GraphQL node id");
+      }
+      const query = `mutation($id:ID!,$mergeMethod:PullRequestMergeMethod!){enablePullRequestAutoMerge(input:{pullRequestId:$id,mergeMethod:$mergeMethod}){pullRequest{url}}}`;
+      return api("/graphql", {
+        method: "POST",
+        body: {
+          query,
+          variables: {
+            id: pullRequest.node_id,
+            mergeMethod: autoMergeMethod(mergeMethod).toUpperCase(),
+          },
+        },
+      });
+    },
     async updatePullRequestBody(
       number,
       body,

package/scripts/dev-pr-auto-merge.mjs

@@ -152,11 +152,11 @@ function summarizeChecks({ statuses = [], checkRuns = [] } = {}, requiredChecks
   };
 }
 
-function mergeableAccepted(pr) {
+function mergeableAccepted(pr, landingMode = "direct") {
   if (pr.mergeable === false) return false;
   const state = String(pr.mergeable_state || pr.mergeStateStatus || "").toLowerCase();
   if (!state) return pr.mergeable === true;
-  return ["clean", "has_hooks", "unstable", "unknown"].includes(state);
+  return ["clean", "has_hooks", "unstable", "unknown", ...(landingMode === "queue" && pr.mergeable === true ? ["blocked"] : [])].includes(state);
 }
 
 function skip(reason, details = {}) {
@@ -189,7 +189,7 @@ export async function evaluatePullRequest(pr, options, client) {
       observedBaseRef: detailed.base.ref,
     });
   }
-  if (!mergeableAccepted(detailed)) {
+  if (!mergeableAccepted(detailed, options.landingMode)) {
     return skip("not-mergeable", {
       mergeable: detailed.mergeable,
       mergeableState: detailed.mergeable_state || detailed.mergeStateStatus || "",
@@ -629,7 +629,7 @@ export async function runDevPrAutoMerge(optionsInput = {}, clientInput) {
       } else if (observedHeadSha !== expectedHeadSha) {
         admissionDecision = "rejected";
         admissionReason = "head-sha-drift";
-      } else if (!mergeableAccepted(observedPullRequest)) {
+      } else if (!mergeableAccepted(observedPullRequest, landingMode)) {
         admissionDecision = "rejected";
         admissionReason = "not-mergeable-on-admission-recheck";
       }