@kungfu-tech/buildchain 3.0.6-alpha.0 → 3.0.6-alpha.10

package/scripts/lifecycle-substage-evidence.mjs

@@ -0,0 +1,274 @@
+#!/usr/bin/env node
+
+import crypto from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const ROOT_PATTERN = /^sha256:[0-9a-f]{64}$/u;
+const SHA_PATTERN = /^[0-9a-f]{40}$/u;
+
+function canonical(value) {
+  if (Array.isArray(value)) return value.map(canonical);
+  if (value && typeof value === "object") {
+    return Object.fromEntries(
+      Object.entries(value)
+        .sort(([left], [right]) => left.localeCompare(right))
+        .map(([key, item]) => [key, canonical(item)]),
+    );
+  }
+  return value;
+}
+
+function digest(value) {
+  return `sha256:${crypto
+    .createHash("sha256")
+    .update(JSON.stringify(canonical(value)))
+    .digest("hex")}`;
+}
+
+function withoutRoot(value, field = "evidenceRoot") {
+  const body = structuredClone(value);
+  Reflect.deleteProperty(body, field);
+  return body;
+}
+
+function requireIso(value, label) {
+  if (typeof value !== "string" || !Number.isFinite(Date.parse(value))) {
+    throw new Error(`${label} must be an ISO timestamp`);
+  }
+}
+
+function verifyEvidenceHeader(
+  evidence,
+  { lifecycleStage, sourceSha, sourceTree, platformId },
+) {
+  if (evidence?.schema !== "kungfu.lifecycle-substage-evidence/v1") {
+    throw new Error(
+      `unsupported lifecycle substage evidence schema: ${evidence?.schema || "missing"}`,
+    );
+  }
+  if (!ROOT_PATTERN.test(evidence.evidenceRoot || "")) {
+    throw new Error("lifecycle substage evidence root is invalid");
+  }
+  if (evidence.evidenceRoot !== digest(withoutRoot(evidence))) {
+    throw new Error("lifecycle substage evidence root mismatch");
+  }
+  if (lifecycleStage && evidence.lifecycleStage !== lifecycleStage) {
+    throw new Error(
+      `lifecycle stage mismatch: expected ${lifecycleStage}, got ${evidence.lifecycleStage}`,
+    );
+  }
+  if (
+    !SHA_PATTERN.test(evidence.source?.sha || "") ||
+    !SHA_PATTERN.test(evidence.source?.tree || "")
+  ) {
+    throw new Error("lifecycle substage source identity is invalid");
+  }
+  if (sourceSha && evidence.source.sha !== sourceSha) {
+    throw new Error(
+      `lifecycle substage source SHA mismatch: expected ${sourceSha}, got ${evidence.source.sha}`,
+    );
+  }
+  if (sourceTree && evidence.source.tree !== sourceTree) {
+    throw new Error(
+      `lifecycle substage source tree mismatch: expected ${sourceTree}, got ${evidence.source.tree}`,
+    );
+  }
+  if (platformId && evidence.platform?.id !== platformId) {
+    throw new Error(
+      `lifecycle substage platform mismatch: expected ${platformId}, got ${evidence.platform?.id}`,
+    );
+  }
+  if (!["passed", "failed"].includes(evidence.conclusion)) {
+    throw new Error("lifecycle substage conclusion must be passed or failed");
+  }
+  requireIso(evidence.startedAt, "lifecycle substage startedAt");
+  requireIso(evidence.completedAt, "lifecycle substage completedAt");
+  if (!Array.isArray(evidence.substages) || evidence.substages.length === 0) {
+    throw new Error("lifecycle substage evidence has no substages");
+  }
+}
+
+function verifySubstage(substage, index, names) {
+  if (typeof substage.stage !== "string" || !substage.stage) {
+    throw new Error(`substage ${index} has no name`);
+  }
+  if (names.has(substage.stage)) {
+    throw new Error(`duplicate lifecycle substage: ${substage.stage}`);
+  }
+  names.add(substage.stage);
+  requireIso(substage.startedAt, `${substage.stage}.startedAt`);
+  requireIso(substage.completedAt, `${substage.stage}.completedAt`);
+  if (
+    !Number.isFinite(substage.durationSeconds) ||
+    substage.durationSeconds < 0
+  ) {
+    throw new Error(`${substage.stage}.durationSeconds is invalid`);
+  }
+  if (
+    !Number.isInteger(substage.status) ||
+    !["passed", "failed"].includes(substage.conclusion)
+  ) {
+    throw new Error(`${substage.stage} result is invalid`);
+  }
+  if ((substage.status === 0) !== (substage.conclusion === "passed")) {
+    throw new Error(`${substage.stage} status and conclusion disagree`);
+  }
+  if (
+    !["platform-native", "exact-source-reuse"].includes(substage.executionMode)
+  ) {
+    throw new Error(`${substage.stage}.executionMode is invalid`);
+  }
+  if (
+    !ROOT_PATTERN.test(substage.evidenceRoot || "") ||
+    substage.evidenceRoot !== digest(withoutRoot(substage))
+  ) {
+    throw new Error(`${substage.stage} evidence root mismatch`);
+  }
+}
+
+function verifyAggregate(evidence) {
+  const failed = evidence.substages.some((substage) => substage.status !== 0);
+  const expectedFailureReason = failed
+    ? "substage-failed"
+    : evidence.conclusion === "failed"
+      ? "budget-exceeded"
+      : undefined;
+  if (
+    (failed && evidence.conclusion !== "failed") ||
+    (!failed && evidence.conclusion === "passed" && evidence.failureReason) ||
+    evidence.failureReason !== expectedFailureReason
+  ) {
+    throw new Error("lifecycle substage aggregate conclusion is inconsistent");
+  }
+}
+
+export function verifyLifecycleSubstageEvidence(
+  value,
+  {
+    lifecycleStage = "",
+    sourceSha = "",
+    sourceTree = "",
+    platformId = "",
+  } = {},
+) {
+  const evidence = value?.substageEvidence || value;
+  verifyEvidenceHeader(evidence, {
+    lifecycleStage,
+    sourceSha,
+    sourceTree,
+    platformId,
+  });
+  const names = new Set();
+  for (const [index, substage] of evidence.substages.entries()) {
+    verifySubstage(substage, index, names);
+  }
+  verifyAggregate(evidence);
+  return structuredClone(evidence);
+}
+
+export function lifecycleSubstageEvidenceContext({
+  substageEvidencePath = "",
+  cwd,
+  workspace,
+  diagnosticsDir,
+  lifecycleStage,
+  sourceSha = process.env.BUILDCHAIN_SOURCE_SHA || "",
+  sourceTree = process.env.BUILDCHAIN_SOURCE_TREE_SHA || "",
+  platformId,
+}) {
+  if (!substageEvidencePath) {
+    return {
+      evidence: undefined,
+      observability: {},
+      lifecycle: {},
+      links: {},
+      sourcePath: "",
+      targetPath: "",
+      sidecar: {},
+    };
+  }
+  const sourcePath = path.resolve(cwd, substageEvidencePath);
+  const targetPath = path.join(diagnosticsDir, "verify-substages.json");
+  const relativePath = path
+    .relative(workspace, targetPath)
+    .split(path.sep)
+    .join("/");
+  const evidence = readLifecycleSubstageEvidence(sourcePath, {
+    lifecycleStage,
+    sourceSha,
+    sourceTree,
+    platformId,
+  });
+  return {
+    evidence,
+    observability: {
+      substages: {
+        contract: evidence.schema,
+        evidenceRoot: evidence.evidenceRoot,
+        conclusion: evidence.conclusion,
+        path: relativePath,
+      },
+    },
+    lifecycle: { substageEvidence: evidence },
+    links: { lifecycleSubstages: relativePath },
+    sourcePath,
+    targetPath,
+    sidecar: {
+      kind: "lifecycle-substages",
+      filePath: targetPath,
+      required: true,
+    },
+  };
+}
+
+export function readLifecycleSubstageEvidence(file, options = {}) {
+  if (!file) return undefined;
+  const absolute = path.resolve(file);
+  if (!fs.existsSync(absolute))
+    throw new Error(`lifecycle substage evidence file not found: ${file}`);
+  return verifyLifecycleSubstageEvidence(
+    JSON.parse(fs.readFileSync(absolute, "utf8")),
+    options,
+  );
+}
+
+function parse(argv) {
+  const options = {};
+  for (let index = 0; index < argv.length; index += 2) {
+    const flag = argv[index];
+    if (!flag?.startsWith("--") || index + 1 >= argv.length)
+      throw new Error(`invalid option: ${flag || "missing"}`);
+    options[flag.slice(2)] = argv[index + 1];
+  }
+  return options;
+}
+
+function main(argv = process.argv.slice(2)) {
+  const options = parse(argv);
+  const evidence = readLifecycleSubstageEvidence(options.file, {
+    lifecycleStage: options.stage || "",
+    sourceSha: options["source-sha"] || "",
+    sourceTree: options["source-tree"] || "",
+    platformId: options["platform-id"] || "",
+  });
+  process.stdout.write(
+    `${JSON.stringify({ ok: true, evidenceRoot: evidence.evidenceRoot, conclusion: evidence.conclusion })}\n`,
+  );
+}
+
+if (
+  process.argv[1] &&
+  path.basename(process.argv[1]) === "lifecycle-substage-evidence.mjs" &&
+  fileURLToPath(import.meta.url) === path.resolve(process.argv[1])
+) {
+  try {
+    main();
+  } catch (error) {
+    console.error(
+      `[lifecycle-substages] ${error instanceof Error ? error.message : String(error)}`,
+    );
+    process.exit(1);
+  }
+}

package/scripts/locked-source-checkout.mjs

@@ -4,6 +4,7 @@ import crypto from "node:crypto";
 import fs from "node:fs";
 import path from "node:path";
 import { pathToFileURL } from "node:url";
+import { runGitFetchSync } from "./git-fetch-process-tree.mjs";
 
 export const LOCKED_SOURCE_CHECKOUT_CONTRACT = "kungfu-buildchain-locked-source-checkout-cache";
 export const ISOLATED_GIT_GLOBAL_CONFIG = process.platform === "win32" ? "NUL" : "/dev/null";
@@ -111,9 +112,10 @@ function ensureCheckoutTarget(targetPath, workspace) {
 
 function git(args, { cwd, env = {}, timeoutMs = 60000, stdio = ["ignore", "pipe", "pipe"] } = {}) {
   try {
-    const output = execFileSync("git", args, {
+    const commandEnv = { ...process.env, ...env };
+    const output = args[0] === "fetch" ? runGitFetchSync({ args, cwd, env: commandEnv, timeoutMs, stdio }) : execFileSync("git", args, {
       cwd,
-      env: { ...process.env, ...env },
+      env: commandEnv,
       encoding: "utf8",
       stdio,
       timeout: timeoutMs,
@@ -233,7 +235,8 @@ function checkoutFetchedCommit(targetPath, sha, timeoutMs) {
 function retryableGitFetchError(error) {
   const code = String(error?.code || "").toUpperCase();
   if (["ETIMEDOUT", "ECONNRESET", "ECONNREFUSED", "EAI_AGAIN", "ENETUNREACH", "EPIPE"].includes(code)) return true;
-  return /timed?\s*out|timeout|connection (?:reset|refused)|remote end hung up|early eof|rpc failed|http (?:429|5\d\d)|temporary failure|network is unreachable/i.test(String(error?.message || error || ""));
+  const commandOutput = [error?.stderr, error?.stdout].filter(Boolean).map(String).join("\n").trim();
+  return /timed?\s*out|timeout|connection (?:reset|refused)|remote end hung up|early eof|rpc failed|http (?:429|5\d\d)|temporary failure|network is unreachable/i.test(commandOutput || String(error?.message || error || ""));
 }
 
 export function fetchSourceCommit({

package/scripts/publication-candidate-sealer.mjs

@@ -0,0 +1,104 @@
+import crypto from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+
+import {
+  PUBLICATION_ARTIFACT_CANDIDATE_CONTRACT,
+  publicationArtifactCandidateDigest,
+} from "../packages/core/publication-artifact-candidate.js";
+import { createPublicationSealedBundle } from "../packages/core/publication-sealed-bundle.js";
+
+function requiredString(value, label) {
+  const normalized = String(value || "").trim();
+  if (!normalized) throw new Error(`${label} must be a non-empty string`);
+  return normalized;
+}
+
+function normalizeSha256(value, label) {
+  const digest = requiredString(value, label).replace(/^sha256:/, "").toLowerCase();
+  if (!/^[0-9a-f]{64}$/.test(digest)) throw new Error(`${label} must be a sha256 digest`);
+  return digest;
+}
+
+function assertGitSha(value, label) {
+  const sha = requiredString(value, label);
+  if (!/^[0-9a-f]{40}$/i.test(sha)) throw new Error(`${label} must be a 40-character Git SHA`);
+  return sha.toLowerCase();
+}
+
+function collectCandidateFiles(root) {
+  const resolvedRoot = path.resolve(requiredString(root, "bundleRoot"));
+  const files = [];
+  const stack = fs.existsSync(resolvedRoot) ? [resolvedRoot] : [];
+  while (stack.length) {
+    const current = stack.pop();
+    for (const entry of fs.readdirSync(current, { withFileTypes: true })) {
+      const absolutePath = path.join(current, entry.name);
+      if (entry.isDirectory()) {
+        stack.push(absolutePath);
+      } else if (entry.isFile()) {
+        files.push({
+          path: path.relative(resolvedRoot, absolutePath).split(path.sep).join("/"),
+          absolutePath,
+          size: fs.statSync(absolutePath).size,
+          sha256: crypto.createHash("sha256").update(fs.readFileSync(absolutePath)).digest("hex"),
+        });
+      }
+    }
+  }
+  return { resolvedRoot, files: files.sort((left, right) => left.path.localeCompare(right.path)) };
+}
+
+export function createResolvedPublicationSealedBundle({
+  bundleRoot,
+  repository,
+  sourceSha,
+  sourceTreeSha,
+  runtimeSha,
+  releaseCandidateRoot,
+  npmArtifacts = [],
+  releaseAssetPaths = [],
+} = {}) {
+  if (npmArtifacts.length === 0) return undefined;
+  const { resolvedRoot, files } = collectCandidateFiles(bundleRoot);
+  const byAbsolutePath = new Map(files.map((file) => [path.resolve(file.absolutePath), file]));
+  const resolvedNpmArtifacts = npmArtifacts.map((artifact, index) => {
+    const file = byAbsolutePath.get(path.resolve(requiredString(artifact.path, `npmArtifacts[${index}].path`)));
+    if (!file) throw new Error(`npmArtifacts[${index}].path is outside the sealed payload root`);
+    return { file, metadata: artifact };
+  });
+  const main = resolvedNpmArtifacts.find((entry) => entry.metadata.role === "main")
+    || (resolvedNpmArtifacts.length === 1 ? resolvedNpmArtifacts[0] : undefined);
+  if (!main) throw new Error("candidate npm payload set has no unique main package tarball");
+  const selectedReleaseAssets = (releaseAssetPaths.length > 0
+    ? releaseAssetPaths
+    : resolvedNpmArtifacts.map((entry) => entry.file.absolutePath))
+    .map((assetPath, index) => {
+      const file = byAbsolutePath.get(path.resolve(assetPath));
+      if (!file) throw new Error(`releaseAssetPaths[${index}] is outside the sealed payload root`);
+      return file;
+    });
+  const candidatePayload = {
+    schemaVersion: 1,
+    contract: PUBLICATION_ARTIFACT_CANDIDATE_CONTRACT,
+    repository: requiredString(repository, "repository"),
+    sourceSha: assertGitSha(sourceSha, "sourceSha"),
+    sourceTreeSha: assertGitSha(sourceTreeSha, "sourceTreeSha"),
+    runtimeSha: assertGitSha(runtimeSha, "runtimeSha"),
+    releaseCandidateRoot: `sha256:${normalizeSha256(releaseCandidateRoot, "releaseCandidateRoot")}`,
+    files: files.map(({ path: filePath, size, sha256 }) => ({ path: filePath, size, sha256 })),
+  };
+  const candidate = {
+    ...candidatePayload,
+    candidateDigest: publicationArtifactCandidateDigest(candidatePayload),
+  };
+  const manifest = createPublicationSealedBundle({
+    candidate,
+    packageName: main.metadata.name,
+    packageVersion: main.metadata.ref,
+    npmTarballPath: main.file.path,
+    npmIntegrity: main.metadata.integrity,
+    releaseAssetPaths: selectedReleaseAssets.map((file) => file.path),
+  });
+  return { root: resolvedRoot, manifest, npmArtifacts: resolvedNpmArtifacts, files };
+}

package/scripts/release-candidate-resolver.mjs

@@ -4,7 +4,10 @@ import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import { execFileSync } from "node:child_process";
+import { Readable } from "node:stream";
+import { pipeline } from "node:stream/promises";
 import { pathToFileURL } from "node:url";
+import { createResolvedPublicationSealedBundle } from "./publication-candidate-sealer.mjs";
 import { writeGitHubOutputs } from "./build-contract-core.mjs";
 
 const DEFAULT_WORKFLOW_FILE = "build-surface-fixture.yml";
@@ -37,6 +40,9 @@ function assertSha(value, label = "sha") {
   return sha;
 }
 
+export const releaseCandidateRuntimeSha = (passport) =>
+  assertSha(passport?.buildchain?.sha, "release candidate Passport Buildchain runtime SHA").toLowerCase();
+
 function githubHeaders(token) {
   const headers = {
     accept: "application/vnd.github+json",
@@ -49,7 +55,7 @@ function githubHeaders(token) {
   return headers;
 }
 
-async function githubJson({ apiUrl, token, method = "GET", path: requestPath, fetchImpl = globalThis.fetch }) {
+export async function githubJson({ apiUrl, token, method = "GET", path: requestPath, fetchImpl = globalThis.fetch, allowNotFound = false }) {
   if (typeof fetchImpl !== "function") {
     throw new Error("fetch is required to resolve release candidate artifacts");
   }
@@ -57,13 +63,14 @@ async function githubJson({ apiUrl, token, method = "GET", path: requestPath, fe
   const response = await fetchImpl(url, { method, headers: githubHeaders(token) });
   const text = await response.text();
   const body = text ? JSON.parse(text) : {};
+  if (allowNotFound && response.status === 404) return undefined;
   if (!response.ok) {
     throw new Error(`GitHub API ${method} ${requestPath} failed with ${response.status}: ${body.message || text}`);
   }
   return body;
 }
 
-async function githubDownload({ apiUrl, token, path: requestPath, outputPath, fetchImpl = globalThis.fetch }) {
+export async function githubDownload({ apiUrl, token, path: requestPath, outputPath, fetchImpl = globalThis.fetch }) {
   const url = `${String(apiUrl || "https://api.github.com").replace(/\/+$/, "")}${requestPath}`;
   const response = await fetchImpl(url, { headers: githubHeaders(token) });
   if (!response.ok) {
@@ -75,10 +82,32 @@ async function githubDownload({ apiUrl, token, path: requestPath, outputPath, fe
     }
     throw new Error(`GitHub artifact download ${requestPath} failed with ${response.status}${detail ? `: ${detail}` : ""}`);
   }
-  fs.writeFileSync(outputPath, Buffer.from(await response.arrayBuffer()));
+  try {
+    if (response.body && typeof response.body.getReader === "function") {
+      await pipeline(Readable.fromWeb(response.body), fs.createWriteStream(outputPath));
+    } else {
+      fs.writeFileSync(outputPath, Buffer.from(await response.arrayBuffer()));
+    }
+  } catch (error) {
+    fs.rmSync(outputPath, { force: true });
+    throw error;
+  }
   return outputPath;
 }
 
+function digestFileSync(filePath, algorithm, encoding) {
+  const hash = crypto.createHash(algorithm);
+  const descriptor = fs.openSync(filePath, "r");
+  const chunk = Buffer.allocUnsafe(8 * 1024 * 1024);
+  try {
+    let bytesRead = 0;
+    while ((bytesRead = fs.readSync(descriptor, chunk, 0, chunk.length, null)) > 0) hash.update(chunk.subarray(0, bytesRead));
+  } finally {
+    fs.closeSync(descriptor);
+  }
+  return hash.digest(encoding);
+}
+
 export function selectMergedChannelPullRequest({ pullRequests = [], targetRef, repository }) {
   const normalizedTarget = normalizeBranch(targetRef);
   const candidates = pullRequests.filter((pr) => {
@@ -254,7 +283,7 @@ function packageNameFromArtifactPath(filePath) {
 }
 
 function npmIntegrity(filePath) {
-  return `sha512-${crypto.createHash("sha512").update(fs.readFileSync(filePath)).digest("base64")}`;
+  return `sha512-${digestFileSync(filePath, "sha512", "base64")}`;
 }
 
 function readNpmPackageJsonFromTarball(tarballPath) {
@@ -357,7 +386,34 @@ export function selectReleaseCandidateArtifacts({ artifacts = [], artifactName =
   return { passport, summary: summaries[0], prefix, sourceSha: sha };
 }
 
-function unzip(zipPath, outputDir) {
+export function verifyArtifactArchive({ artifact, archivePath } = {}) {
+  const size = fs.statSync(archivePath).size;
+  const digest = `sha256:${digestFileSync(archivePath, "sha256", "hex")}`;
+  if (!artifact || artifact.expired === true) {
+    throw new Error(`candidate artifact is missing or expired: ${artifact?.name || "<unknown>"}`);
+  }
+  if (Number(artifact.size_in_bytes) !== size) {
+    throw new Error(`candidate artifact size mismatch for ${artifact.name}: expected ${artifact.size_in_bytes}, got ${size}`);
+  }
+  if (!/^sha256:[0-9a-f]{64}$/i.test(String(artifact.digest || ""))) {
+    throw new Error(`candidate artifact ${artifact.name} has no trusted sha256 digest metadata`);
+  }
+  if (String(artifact.digest).toLowerCase() !== digest) {
+    throw new Error(`candidate artifact digest mismatch for ${artifact.name}: expected ${artifact.digest}, got ${digest}`);
+  }
+  return { size, digest };
+}
+
+export function unzip(zipPath, outputDir) {
+  const entries = execFileSync("unzip", ["-Z1", zipPath], { encoding: "utf8" })
+    .split(/\r?\n/)
+    .filter(Boolean);
+  for (const entry of entries) {
+    const normalized = entry.replaceAll("\\", "/");
+    if (normalized.startsWith("/") || normalized.split("/").some((part) => part === "..")) {
+      throw new Error(`candidate artifact contains an unsafe zip entry: ${entry}`);
+    }
+  }
   fs.mkdirSync(outputDir, { recursive: true });
   execFileSync("unzip", ["-q", "-o", zipPath, "-d", outputDir], { stdio: "inherit" });
 }
@@ -392,6 +448,7 @@ export async function resolveReleaseCandidateArtifacts({
   requiredArtifactCount = 0,
   publishArtifactKind = "npm",
   publishPackageMain = "",
+  runtimeSha = "",
   outputDir = ".buildchain/release-candidate",
   fetchImpl = globalThis.fetch,
   download = true,
@@ -579,6 +636,7 @@ export async function resolveReleaseCandidateArtifacts({
     outputPath: passportZip,
     path: `/repos/${repoInfo.owner}/${repoInfo.repo}/actions/artifacts/${selected.passport.id}/zip`,
   });
+  verifyArtifactArchive({ artifact: selected.passport, archivePath: passportZip });
   await githubDownload({
     apiUrl,
     token,
@@ -586,6 +644,7 @@ export async function resolveReleaseCandidateArtifacts({
     outputPath: summaryZip,
     path: `/repos/${repoInfo.owner}/${repoInfo.repo}/actions/artifacts/${selected.summary.id}/zip`,
   });
+  verifyArtifactArchive({ artifact: selected.summary, archivePath: summaryZip });
   for (const artifact of payloadArtifacts) {
     const safeName = String(artifact.name || `artifact-${artifact.id}`).replace(/[^A-Za-z0-9._-]/g, "_");
     const payloadZip = path.join(tempDir, `${safeName}.zip`);
@@ -596,6 +655,7 @@ export async function resolveReleaseCandidateArtifacts({
       outputPath: payloadZip,
       path: `/repos/${repoInfo.owner}/${repoInfo.repo}/actions/artifacts/${artifact.id}/zip`,
     });
+    verifyArtifactArchive({ artifact, archivePath: payloadZip });
     unzip(payloadZip, path.join(payloadDir, safeName));
   }
   unzip(passportZip, passportDir);
@@ -636,6 +696,27 @@ export async function resolveReleaseCandidateArtifacts({
   });
   const requiredArtifactsPath = path.join(resolvedOutput, "publish-required-artifacts.json");
   fs.writeFileSync(requiredArtifactsPath, `${JSON.stringify(generatedRequiredArtifacts, null, 2)}\n`);
+  const sealedBundle = publishArtifactKind === "npm"
+    ? createResolvedPublicationSealedBundle({
+        bundleRoot: payloadDir,
+        repository: repoInfo.fullName,
+        sourceSha: passport.source?.headSha,
+        sourceTreeSha: passport.source?.treeHash,
+        runtimeSha: releaseCandidateRuntimeSha(passport),
+        releaseCandidateRoot: passport.candidateHash,
+        npmArtifacts: npmTarballPaths.map((tarballPath) => ({
+          path: tarballPath,
+          ...readNpmPackageArtifact({ tarballPath, mainPackage: publishPackageMain }),
+        })),
+        releaseAssetPaths,
+      })
+    : undefined;
+  const sealedBundleManifestPath = sealedBundle
+    ? path.join(resolvedOutput, "sealed-bundle.json")
+    : "";
+  if (sealedBundleManifestPath) {
+    fs.writeFileSync(sealedBundleManifestPath, `${JSON.stringify(sealedBundle.manifest, null, 2)}\n`);
+  }
   return {
     ...result,
     paths: {
@@ -647,6 +728,8 @@ export async function resolveReleaseCandidateArtifacts({
       npmTarballs: npmTarballPaths.map(outputPath),
       releaseAssets: releaseAssetPaths.map(outputPath),
       publishRequiredArtifacts: outputPath(requiredArtifactsPath),
+      sealedBundleRoot: sealedBundle ? outputPath(sealedBundle.root) : "",
+      sealedBundleManifest: sealedBundleManifestPath ? outputPath(sealedBundleManifestPath) : "",
     },
     version: passport.target?.version || "",
     candidateHash: passport.candidateHash || "",
@@ -673,6 +756,7 @@ export async function resolveReleaseCandidateArtifactsCli() {
     requiredArtifactCount: env("BUILDCHAIN_REQUIRED_ARTIFACT_COUNT", "0"),
     publishArtifactKind: env("BUILDCHAIN_PUBLISH_ARTIFACT_KIND", "npm"),
     publishPackageMain: env("BUILDCHAIN_PUBLISH_PACKAGE_MAIN"),
+    runtimeSha: env("BUILDCHAIN_CURRENT_RUNTIME_SHA", env("BUILDCHAIN_RUNTIME_SHA", env("BUILDCHAIN_TARGET_SHA"))),
     outputDir: env("BUILDCHAIN_RC_OUTPUT_DIR", ".buildchain/release-candidate"),
     download: releaseCandidateDownloadEnabled(env("BUILDCHAIN_RC_DOWNLOAD", "true")),
     waitSeconds: env("BUILDCHAIN_RC_WAIT_SECONDS", "600"),
@@ -703,6 +787,8 @@ export async function resolveReleaseCandidateArtifactsCli() {
     ).join("\n"),
     "publish-required-artifacts-json": JSON.stringify(result.publishRequiredArtifacts || []),
     "publish-required-artifacts-path": result.paths?.publishRequiredArtifacts || "",
+    "publish-sealed-bundle-root": result.paths?.sealedBundleRoot || "",
+    "publish-sealed-bundle-manifest": result.paths?.sealedBundleManifest || "",
     "release-candidate-run-id": result.run?.id || "",
     "release-candidate-run-url": result.run?.url || "",
     "release-candidate-pr": result.pullRequest?.number ? String(result.pullRequest.number) : "",

package/scripts/resolve-artifact-transfer-mode.mjs

@@ -26,6 +26,15 @@ function resolveArtifactTransferMode(env = process.env) {
       oidcAudience: "",
     };
   }
+  if (env.INPUT_RELAY_REQUIRED === "false") {
+    return {
+      mode: "github-artifacts",
+      s3Bucket: "",
+      s3Region: "",
+      s3Prefix: "",
+      oidcAudience: "",
+    };
+  }
   const s3Bucket = firstValue(env.INPUT_S3_BUCKET, env.VAR_S3_BUCKET);
   const s3Region = firstValue(env.INPUT_S3_REGION, env.VAR_S3_REGION);
   const s3Prefix = firstValue(

package/scripts/resolve-build-contract.mjs

@@ -41,6 +41,13 @@ export function resolveBuildContractCli() {
       "native-platform-count": String(resolved.nativePlatformCount),
       "container-platforms-json": resolved.containerPlatformsJson,
       "container-platform-count": String(resolved.containerPlatformCount),
+      "github-hosted-platforms-json": resolved.githubHostedPlatformsJson,
+      "github-hosted-platform-ids-json": resolved.githubHostedPlatformIdsJson,
+      "github-hosted-platform-count": String(
+        resolved.githubHostedPlatformCount,
+      ),
+      "relay-platforms-json": resolved.relayPlatformsJson,
+      "relay-platform-count": String(resolved.relayPlatformCount),
       "linux-container-enabled": String(resolved.linuxContainer.enabled),
       "linux-container-preset": resolved.linuxContainer.preset,
       "linux-container-image": resolved.linuxContainer.image,