@kungfu-tech/buildchain 3.0.6-alpha.0 → 3.0.6-alpha.10
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +4 -4
- package/actions/promote-buildchain-ref/README.md +13 -1
- package/bin/buildchain.mjs +13 -1
- package/contracts/auditable-demo-scenario-v1.schema.json +52 -0
- package/contracts/release-candidate-recovery-v1.schema.json +104 -0
- package/dist/site/buildchain-contract.json +134 -34
- package/dist/site/buildchain-site.json +178 -47
- package/dist/site/capability-registry.json +5 -5
- package/dist/site/cli-registry.json +40 -4
- package/dist/site/controller-registry.json +60 -4
- package/dist/site/kfd-claims.json +190 -20
- package/dist/site/kfd-upstream-aggregate.json +9 -9
- package/dist/site/manual-registry.json +10 -10
- package/dist/site/node-api-registry.json +1295 -80
- package/dist/site/page-registry.json +164 -33
- package/dist/site/public-surface-audit.json +428 -21
- package/dist/site/publication-authority-registry.json +66 -1
- package/dist/site/publication-registry.json +4 -4
- package/dist/site/release-provenance.json +2 -0
- package/dist/site/site-manifest.json +14 -14
- package/dist/site/workflow-registry.json +203 -15
- package/docs/MAP.md +2 -0
- package/docs/auditable-demo.md +58 -11
- package/docs/aws-us-elastic-runner-burst-plane.md +114 -80
- package/docs/cli-reference.md +154 -0
- package/docs/dev-alpha-candidate-patrol.md +13 -5
- package/docs/dev-delivery-warrant.md +158 -0
- package/docs/node-api-reference.md +105 -44
- package/docs/publication-authority.md +11 -0
- package/docs/publish-transaction.md +10 -1
- package/docs/release-candidate.md +140 -12
- package/docs/release-governance.md +66 -1
- package/docs/reusable-build-surface.md +11 -1
- package/docs/shifu-gate-profiles.md +12 -1
- package/docs/versioning.md +2 -0
- package/package.json +5 -2
- package/packages/core/buildchain-contract.js +30 -2
- package/packages/core/buildchain-publication-authority.js +3 -1
- package/packages/core/channel-candidate.js +2 -21
- package/packages/core/channel-promotion-baseline.js +199 -0
- package/packages/core/dev-delivery-candidate-identity.js +94 -0
- package/packages/core/dev-delivery-common.js +73 -0
- package/packages/core/dev-delivery-proof.js +252 -0
- package/packages/core/dev-delivery-warrant-cancellation.js +94 -0
- package/packages/core/dev-delivery-warrant-settlement.js +73 -0
- package/packages/core/dev-delivery-warrant.js +591 -0
- package/packages/core/index.js +7 -0
- package/packages/core/publication-sealed-bundle.js +10 -1
- package/packages/core/release-candidate-recovery.js +539 -0
- package/scripts/audit-publication-control-plane.mjs +12 -4
- package/scripts/auditable-demo-bundle-verification.mjs +148 -0
- package/scripts/auditable-demo-platform.mjs +86 -50
- package/scripts/auditable-demo-presentation.mjs +83 -0
- package/scripts/auditable-demo-renditions.mjs +264 -0
- package/scripts/auditable-demo.mjs +24 -30
- package/scripts/aws-windows-jit-campaign-core.mjs +7 -8
- package/scripts/aws-windows-jit-controller.mjs +1 -0
- package/scripts/aws-windows-jit-core.mjs +1 -1
- package/scripts/build-contract-core.mjs +58 -3
- package/scripts/buildchain-cli-help.mjs +8 -0
- package/scripts/buildchain-patrol.mjs +9 -0
- package/scripts/check-inventory.mjs +25 -3
- package/scripts/dev-alpha-candidate-patrol.mjs +45 -48
- package/scripts/dev-delivery-proof.mjs +193 -0
- package/scripts/dev-delivery-warrant.mjs +426 -0
- package/scripts/dev-pr-auto-merge.mjs +497 -55
- package/scripts/dev-pr-delivery-warrant.mjs +209 -0
- package/scripts/dispatch-artifact-signing-authority.mjs +2 -4
- package/scripts/gate-profile-core.mjs +24 -0
- package/scripts/generate-channel-promotion-workflow.mjs +30 -14
- package/scripts/generate-site-bundle.mjs +2 -2
- package/scripts/git-fetch-process-tree.mjs +142 -0
- package/scripts/lifecycle-substage-evidence.mjs +274 -0
- package/scripts/locked-source-checkout.mjs +6 -3
- package/scripts/publication-candidate-sealer.mjs +104 -0
- package/scripts/release-candidate-resolver.mjs +91 -5
- package/scripts/resolve-artifact-transfer-mode.mjs +9 -0
- package/scripts/resolve-build-contract.mjs +7 -0
- package/scripts/resume-from-candidate-run.mjs +598 -0
- package/scripts/route-offline-runners.mjs +1 -0
- package/scripts/run-lifecycle-core.mjs +9 -9
- package/scripts/shifu-gate-profile.mjs +10 -16
- package/scripts/site-capability-metadata.mjs +15 -0
|
@@ -271,6 +271,19 @@
|
|
|
271
271
|
"runnerPolicy": "unqualified",
|
|
272
272
|
"notes": ""
|
|
273
273
|
},
|
|
274
|
+
{
|
|
275
|
+
"workflowPath": ".github/workflows/buildchain-dev-delivery.yml",
|
|
276
|
+
"authorityClass": "governance-write",
|
|
277
|
+
"publicationCapable": false,
|
|
278
|
+
"capabilityIds": [],
|
|
279
|
+
"credentialMode": "none",
|
|
280
|
+
"publisherWorkflowMode": "fixed",
|
|
281
|
+
"publisherWorkflowPath": ".github/workflows/buildchain-dev-delivery.yml",
|
|
282
|
+
"environment": "",
|
|
283
|
+
"environmentMode": "fixed",
|
|
284
|
+
"runnerPolicy": "unqualified",
|
|
285
|
+
"notes": ""
|
|
286
|
+
},
|
|
274
287
|
{
|
|
275
288
|
"workflowPath": ".github/workflows/buildchain-patrol-daily.yml",
|
|
276
289
|
"authorityClass": "governance-write",
|
|
@@ -362,6 +375,32 @@
|
|
|
362
375
|
"runnerPolicy": "unqualified",
|
|
363
376
|
"notes": ""
|
|
364
377
|
},
|
|
378
|
+
{
|
|
379
|
+
"workflowPath": ".github/workflows/dev-delivery-warrant-cancel.yml",
|
|
380
|
+
"authorityClass": "governance-write",
|
|
381
|
+
"publicationCapable": false,
|
|
382
|
+
"capabilityIds": [],
|
|
383
|
+
"credentialMode": "none",
|
|
384
|
+
"publisherWorkflowMode": "fixed",
|
|
385
|
+
"publisherWorkflowPath": ".github/workflows/dev-delivery-warrant-cancel.yml",
|
|
386
|
+
"environment": "",
|
|
387
|
+
"environmentMode": "fixed",
|
|
388
|
+
"runnerPolicy": "unqualified",
|
|
389
|
+
"notes": ""
|
|
390
|
+
},
|
|
391
|
+
{
|
|
392
|
+
"workflowPath": ".github/workflows/dev-delivery-warrant-close.yml",
|
|
393
|
+
"authorityClass": "governance-write",
|
|
394
|
+
"publicationCapable": false,
|
|
395
|
+
"capabilityIds": [],
|
|
396
|
+
"credentialMode": "none",
|
|
397
|
+
"publisherWorkflowMode": "fixed",
|
|
398
|
+
"publisherWorkflowPath": ".github/workflows/dev-delivery-warrant-close.yml",
|
|
399
|
+
"environment": "",
|
|
400
|
+
"environmentMode": "fixed",
|
|
401
|
+
"runnerPolicy": "unqualified",
|
|
402
|
+
"notes": ""
|
|
403
|
+
},
|
|
365
404
|
{
|
|
366
405
|
"workflowPath": ".github/workflows/dev-merge-queue-governance.yml",
|
|
367
406
|
"authorityClass": "governance-write",
|
|
@@ -795,6 +834,18 @@
|
|
|
795
834
|
],
|
|
796
835
|
"classified": true
|
|
797
836
|
},
|
|
837
|
+
{
|
|
838
|
+
"path": ".github/workflows/buildchain-candidate-recovery-dogfood-failure.yml",
|
|
839
|
+
"signals": [],
|
|
840
|
+
"classified": false
|
|
841
|
+
},
|
|
842
|
+
{
|
|
843
|
+
"path": ".github/workflows/buildchain-dev-delivery.yml",
|
|
844
|
+
"signals": [
|
|
845
|
+
"write-permission"
|
|
846
|
+
],
|
|
847
|
+
"classified": true
|
|
848
|
+
},
|
|
798
849
|
{
|
|
799
850
|
"path": ".github/workflows/buildchain-patrol-daily.yml",
|
|
800
851
|
"signals": [
|
|
@@ -860,6 +911,20 @@
|
|
|
860
911
|
],
|
|
861
912
|
"classified": true
|
|
862
913
|
},
|
|
914
|
+
{
|
|
915
|
+
"path": ".github/workflows/dev-delivery-warrant-cancel.yml",
|
|
916
|
+
"signals": [
|
|
917
|
+
"write-permission"
|
|
918
|
+
],
|
|
919
|
+
"classified": true
|
|
920
|
+
},
|
|
921
|
+
{
|
|
922
|
+
"path": ".github/workflows/dev-delivery-warrant-close.yml",
|
|
923
|
+
"signals": [
|
|
924
|
+
"write-permission"
|
|
925
|
+
],
|
|
926
|
+
"classified": true
|
|
927
|
+
},
|
|
863
928
|
{
|
|
864
929
|
"path": ".github/workflows/dev-merge-queue-governance.yml",
|
|
865
930
|
"signals": [],
|
|
@@ -1019,5 +1084,5 @@
|
|
|
1019
1084
|
"classified": false
|
|
1020
1085
|
}
|
|
1021
1086
|
],
|
|
1022
|
-
"registryDigest": "
|
|
1087
|
+
"registryDigest": "fd4b5def78f58e64badfd6d9d4cce801cab3c15ae81aa89357ef02d15f7ad99d"
|
|
1023
1088
|
}
|
|
@@ -1,8 +1,8 @@
|
|
|
1
1
|
{
|
|
2
2
|
"schemaVersion": 1,
|
|
3
3
|
"contract": "kungfu-buildchain-publication-release-registry",
|
|
4
|
-
"generatedAt": "2026-08-
|
|
5
|
-
"publishedAt": "2026-08-
|
|
4
|
+
"generatedAt": "2026-08-06T12:16:07.764Z",
|
|
5
|
+
"publishedAt": "2026-08-06T12:16:07.764Z",
|
|
6
6
|
"reproducible": true,
|
|
7
7
|
"timestampPolicy": "ci-injected",
|
|
8
8
|
"deterministicInputs": [
|
|
@@ -19,7 +19,7 @@
|
|
|
19
19
|
"declared Buildchain surface manifest contract"
|
|
20
20
|
],
|
|
21
21
|
"sourceDateEpoch": "0",
|
|
22
|
-
"sourceRevision": "
|
|
22
|
+
"sourceRevision": "363bd785fe7d81a08ea2419bc54ccc5a0fbce869",
|
|
23
23
|
"timestampPolicyDetails": {
|
|
24
24
|
"contract": "kungfu-buildchain-surface-timestamp-policy",
|
|
25
25
|
"timestampFields": [
|
|
@@ -32,7 +32,7 @@
|
|
|
32
32
|
},
|
|
33
33
|
"package": {
|
|
34
34
|
"name": "@kungfu-tech/buildchain",
|
|
35
|
-
"version": "3.0.6-alpha.
|
|
35
|
+
"version": "3.0.6-alpha.10",
|
|
36
36
|
"versionSource": "package.json#version"
|
|
37
37
|
},
|
|
38
38
|
"sourceKind": "package-site-bundle",
|
|
@@ -25,6 +25,7 @@
|
|
|
25
25
|
"./cache-evidence": "./packages/core/cache-evidence.js",
|
|
26
26
|
"./controller-evidence": "./packages/core/controller-evidence.js",
|
|
27
27
|
"./diagnostics": "./packages/core/diagnostics.js",
|
|
28
|
+
"./dev-delivery-warrant": "./packages/core/dev-delivery-warrant.js",
|
|
28
29
|
"./homebrew": "./packages/core/homebrew.js",
|
|
29
30
|
"./issue-reporting": "./packages/core/issue-reporting.js",
|
|
30
31
|
"./kfd": "./packages/core/kfd.js",
|
|
@@ -47,6 +48,7 @@
|
|
|
47
48
|
"./github-governance-authority": "./packages/core/github-governance-authority.js",
|
|
48
49
|
"./kfd-gate": "./packages/core/kfd-gate.js",
|
|
49
50
|
"./release-candidate": "./packages/core/release-candidate.js",
|
|
51
|
+
"./release-candidate-recovery": "./packages/core/release-candidate-recovery.js",
|
|
50
52
|
"./stable-candidate-ledger": "./packages/core/stable-candidate-ledger.js",
|
|
51
53
|
"./release-passport": "./packages/core/release-passport.js",
|
|
52
54
|
"./release-passport-contract": "./packages/core/release-passport-contract.js",
|
|
@@ -1,8 +1,8 @@
|
|
|
1
1
|
{
|
|
2
2
|
"schemaVersion": 1,
|
|
3
3
|
"contract": "kungfu-buildchain-site-manifest",
|
|
4
|
-
"generatedAt": "2026-08-
|
|
5
|
-
"publishedAt": "2026-08-
|
|
4
|
+
"generatedAt": "2026-08-06T12:16:07.764Z",
|
|
5
|
+
"publishedAt": "2026-08-06T12:16:07.764Z",
|
|
6
6
|
"reproducible": true,
|
|
7
7
|
"timestampPolicy": "ci-injected",
|
|
8
8
|
"deterministicInputs": [
|
|
@@ -19,7 +19,7 @@
|
|
|
19
19
|
"declared Buildchain surface manifest contract"
|
|
20
20
|
],
|
|
21
21
|
"sourceDateEpoch": "0",
|
|
22
|
-
"sourceRevision": "
|
|
22
|
+
"sourceRevision": "363bd785fe7d81a08ea2419bc54ccc5a0fbce869",
|
|
23
23
|
"timestampPolicyDetails": {
|
|
24
24
|
"contract": "kungfu-buildchain-surface-timestamp-policy",
|
|
25
25
|
"timestampFields": [
|
|
@@ -37,7 +37,7 @@
|
|
|
37
37
|
},
|
|
38
38
|
"package": {
|
|
39
39
|
"name": "@kungfu-tech/buildchain",
|
|
40
|
-
"version": "3.0.6-alpha.
|
|
40
|
+
"version": "3.0.6-alpha.10",
|
|
41
41
|
"versionSource": "package.json#version"
|
|
42
42
|
},
|
|
43
43
|
"entrypoint": "buildchain-site.json",
|
|
@@ -53,7 +53,7 @@
|
|
|
53
53
|
"path": "docs/MAP.md",
|
|
54
54
|
"plane": "use",
|
|
55
55
|
"exists": true,
|
|
56
|
-
"digest": "sha256:
|
|
56
|
+
"digest": "sha256:d76416d8cd04dcdb560b7d06fef287fa22d6b186a729cb92cd4cf71cebbac1e9"
|
|
57
57
|
},
|
|
58
58
|
{
|
|
59
59
|
"id": "getting-started",
|
|
@@ -69,7 +69,7 @@
|
|
|
69
69
|
"path": "docs/auditable-demo.md",
|
|
70
70
|
"plane": "verify",
|
|
71
71
|
"exists": true,
|
|
72
|
-
"digest": "sha256:
|
|
72
|
+
"digest": "sha256:c49e734fdfe3b74d317e23a523e198f1194b2c7cd16cca87e8e3a3ffc7bf589f"
|
|
73
73
|
},
|
|
74
74
|
{
|
|
75
75
|
"id": "install",
|
|
@@ -109,7 +109,7 @@
|
|
|
109
109
|
"path": "docs/publication-authority.md",
|
|
110
110
|
"plane": "verify",
|
|
111
111
|
"exists": true,
|
|
112
|
-
"digest": "sha256:
|
|
112
|
+
"digest": "sha256:a1650158943d95b979d164ca98a73d7919fda577d648e4a4a9d04588ec698796"
|
|
113
113
|
},
|
|
114
114
|
{
|
|
115
115
|
"id": "github-governance-authority",
|
|
@@ -125,7 +125,7 @@
|
|
|
125
125
|
"path": "docs/release-candidate.md",
|
|
126
126
|
"plane": "verify",
|
|
127
127
|
"exists": true,
|
|
128
|
-
"digest": "sha256:
|
|
128
|
+
"digest": "sha256:d76bbd75aab3c4dd94756c1c64562a125e74369c7c8b97342dbcacc5d7561602"
|
|
129
129
|
},
|
|
130
130
|
{
|
|
131
131
|
"id": "release-propagation",
|
|
@@ -229,7 +229,7 @@
|
|
|
229
229
|
"path": "docs/cli-reference.md",
|
|
230
230
|
"plane": "use",
|
|
231
231
|
"exists": true,
|
|
232
|
-
"digest": "sha256:
|
|
232
|
+
"digest": "sha256:2365e125d38e43b68a4af277a91be7aca708a8bf785954ed4589dbd9a5d8db97"
|
|
233
233
|
},
|
|
234
234
|
{
|
|
235
235
|
"id": "node-api-reference",
|
|
@@ -237,7 +237,7 @@
|
|
|
237
237
|
"path": "docs/node-api-reference.md",
|
|
238
238
|
"plane": "use",
|
|
239
239
|
"exists": true,
|
|
240
|
-
"digest": "sha256:
|
|
240
|
+
"digest": "sha256:f5592359584e98ab4283d56b0262fdcf9c5da61f48033cecad1b0404aa95bd2e"
|
|
241
241
|
},
|
|
242
242
|
{
|
|
243
243
|
"id": "build-facts",
|
|
@@ -277,7 +277,7 @@
|
|
|
277
277
|
"path": "docs/reusable-build-surface.md",
|
|
278
278
|
"plane": "use",
|
|
279
279
|
"exists": true,
|
|
280
|
-
"digest": "sha256:
|
|
280
|
+
"digest": "sha256:7bc04f658d7e298872756278c60143d8edf5dfb841d0b0d3ea62af8028735b54"
|
|
281
281
|
},
|
|
282
282
|
{
|
|
283
283
|
"id": "publish-transaction",
|
|
@@ -285,7 +285,7 @@
|
|
|
285
285
|
"path": "docs/publish-transaction.md",
|
|
286
286
|
"plane": "verify",
|
|
287
287
|
"exists": true,
|
|
288
|
-
"digest": "sha256:
|
|
288
|
+
"digest": "sha256:72466943bb459f6857f23ac6f92bcf4714dcd2f535c38a9f0e34864b36404e06"
|
|
289
289
|
},
|
|
290
290
|
{
|
|
291
291
|
"id": "release-governance",
|
|
@@ -293,7 +293,7 @@
|
|
|
293
293
|
"path": "docs/release-governance.md",
|
|
294
294
|
"plane": "why",
|
|
295
295
|
"exists": true,
|
|
296
|
-
"digest": "sha256:
|
|
296
|
+
"digest": "sha256:34fb81d1dd9f913cbed6ee76ac9f0bdb095669e55c1bee67389601fd494470cf"
|
|
297
297
|
},
|
|
298
298
|
{
|
|
299
299
|
"id": "release-flow",
|
|
@@ -317,7 +317,7 @@
|
|
|
317
317
|
"path": "docs/versioning.md",
|
|
318
318
|
"plane": "why",
|
|
319
319
|
"exists": true,
|
|
320
|
-
"digest": "sha256:
|
|
320
|
+
"digest": "sha256:793db9414d11aeb314ff2d37a52481826ca5f636d08eaf93772d37962a51484f"
|
|
321
321
|
},
|
|
322
322
|
{
|
|
323
323
|
"id": "web-surface-deployments",
|
|
@@ -176,9 +176,10 @@
|
|
|
176
176
|
"shifu-cache-profile-ref",
|
|
177
177
|
"untrusted-policy",
|
|
178
178
|
"verify-command",
|
|
179
|
+
"verify-substage-evidence-path",
|
|
179
180
|
"working-directory"
|
|
180
181
|
],
|
|
181
|
-
"inputCount":
|
|
182
|
+
"inputCount": 86,
|
|
182
183
|
"secrets": [
|
|
183
184
|
"BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN",
|
|
184
185
|
"BUILDCHAIN_ARTIFACT_RELAY_S3_ROLE_ARN",
|
|
@@ -283,12 +284,13 @@
|
|
|
283
284
|
"materialize",
|
|
284
285
|
"materialize-base-ref",
|
|
285
286
|
"media-profile",
|
|
287
|
+
"render-failure-advisory",
|
|
286
288
|
"render-media",
|
|
287
289
|
"renderer-image",
|
|
288
290
|
"scenario-path",
|
|
289
291
|
"source-ref"
|
|
290
292
|
],
|
|
291
|
-
"inputCount":
|
|
293
|
+
"inputCount": 12,
|
|
292
294
|
"secrets": [
|
|
293
295
|
"DEMO_UPDATE_TOKEN"
|
|
294
296
|
],
|
|
@@ -299,9 +301,10 @@
|
|
|
299
301
|
"evidence-artifact-digest",
|
|
300
302
|
"evidence-artifact-name",
|
|
301
303
|
"publication-pr-url",
|
|
304
|
+
"render-result",
|
|
302
305
|
"source-sha"
|
|
303
306
|
],
|
|
304
|
-
"outputCount":
|
|
307
|
+
"outputCount": 7,
|
|
305
308
|
"surface": "declarative-auditable-demo",
|
|
306
309
|
"capabilityGroup": "api-cli-reference",
|
|
307
310
|
"status": "preview",
|
|
@@ -392,6 +395,10 @@
|
|
|
392
395
|
"auto-no-gate",
|
|
393
396
|
"buildchain-ref",
|
|
394
397
|
"buildchain-repository",
|
|
398
|
+
"consumer-gate-command",
|
|
399
|
+
"consumer-gate-controller-sha",
|
|
400
|
+
"consumer-gate-evidence-source-sha",
|
|
401
|
+
"consumer-gate-evidence-source-tree",
|
|
395
402
|
"consumer-predicate-digest",
|
|
396
403
|
"consumer-predicate-id",
|
|
397
404
|
"consumer-qualification-required",
|
|
@@ -419,7 +426,7 @@
|
|
|
419
426
|
"target-ref",
|
|
420
427
|
"used-nonces-json"
|
|
421
428
|
],
|
|
422
|
-
"inputCount":
|
|
429
|
+
"inputCount": 37,
|
|
423
430
|
"secrets": [
|
|
424
431
|
"KUNGFU_GOVERNANCE_AUDITOR_APP_PRIVATE_KEY"
|
|
425
432
|
],
|
|
@@ -491,6 +498,8 @@
|
|
|
491
498
|
"publication-control-plane-audit-json",
|
|
492
499
|
"publication-expected-json",
|
|
493
500
|
"publication-gate-aggregate-json",
|
|
501
|
+
"publication-gate-command",
|
|
502
|
+
"publication-gate-controller-sha",
|
|
494
503
|
"publication-package-name",
|
|
495
504
|
"publication-product",
|
|
496
505
|
"publication-publisher-workflow-path",
|
|
@@ -514,6 +523,7 @@
|
|
|
514
523
|
"release-candidate-family-evidence-required",
|
|
515
524
|
"release-candidate-family-evidence-root",
|
|
516
525
|
"release-candidate-family-initiative-id",
|
|
526
|
+
"release-candidate-wait-seconds",
|
|
517
527
|
"release-candidate-workflow-file",
|
|
518
528
|
"release-candidate-workflow-name",
|
|
519
529
|
"release-passport",
|
|
@@ -538,13 +548,22 @@
|
|
|
538
548
|
"release-propagation-config-path",
|
|
539
549
|
"required-artifact-count",
|
|
540
550
|
"required-status-check",
|
|
551
|
+
"resume-buildchain-runtime-sha",
|
|
552
|
+
"resume-candidate-repository",
|
|
553
|
+
"resume-candidate-run-id",
|
|
554
|
+
"resume-expected-candidate-root",
|
|
555
|
+
"resume-expected-candidate-runtime-sha",
|
|
556
|
+
"resume-expected-source-tree",
|
|
557
|
+
"resume-expected-workflow-file",
|
|
558
|
+
"resume-expected-workflow-name",
|
|
559
|
+
"resume-transaction-id",
|
|
541
560
|
"runner-preset",
|
|
542
561
|
"standalone-binary-distribution",
|
|
543
562
|
"target-ref",
|
|
544
563
|
"target-sha",
|
|
545
564
|
"trusted-publishing"
|
|
546
565
|
],
|
|
547
|
-
"inputCount":
|
|
566
|
+
"inputCount": 107,
|
|
548
567
|
"secrets": [
|
|
549
568
|
"BUILDCHAIN_ISSUE_APP_ID",
|
|
550
569
|
"BUILDCHAIN_ISSUE_APP_PRIVATE_KEY",
|
|
@@ -577,10 +596,13 @@
|
|
|
577
596
|
"publication-commit-evidence-path",
|
|
578
597
|
"publication-commit-payload-root",
|
|
579
598
|
"publication-commit-url",
|
|
599
|
+
"release-candidate-action",
|
|
580
600
|
"release-candidate-artifact",
|
|
601
|
+
"release-candidate-recovery-receipt-artifact",
|
|
602
|
+
"release-candidate-recovery-root",
|
|
581
603
|
"release-propagation-work-artifact"
|
|
582
604
|
],
|
|
583
|
-
"outputCount":
|
|
605
|
+
"outputCount": 23,
|
|
584
606
|
"surface": "reusable-workflow",
|
|
585
607
|
"capabilityGroup": "api-cli-reference",
|
|
586
608
|
"status": "active",
|
|
@@ -1271,9 +1293,10 @@
|
|
|
1271
1293
|
"shifu-cache-profile-ref",
|
|
1272
1294
|
"untrusted-policy",
|
|
1273
1295
|
"verify-command",
|
|
1296
|
+
"verify-substage-evidence-path",
|
|
1274
1297
|
"working-directory"
|
|
1275
1298
|
],
|
|
1276
|
-
"inputCount":
|
|
1299
|
+
"inputCount": 89,
|
|
1277
1300
|
"secrets": [
|
|
1278
1301
|
"BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN",
|
|
1279
1302
|
"BUILDCHAIN_ARTIFACT_RELAY_S3_ROLE_ARN",
|
|
@@ -1367,6 +1390,48 @@
|
|
|
1367
1390
|
"sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
|
|
1368
1391
|
"nonDuplicationRationale": "Existing workflow identity retained for caller compatibility and repository orchestration."
|
|
1369
1392
|
},
|
|
1393
|
+
{
|
|
1394
|
+
"id": "buildchain-candidate-recovery-dogfood-failure",
|
|
1395
|
+
"path": ".github/workflows/buildchain-candidate-recovery-dogfood-failure.yml",
|
|
1396
|
+
"reusable": false,
|
|
1397
|
+
"inputs": [],
|
|
1398
|
+
"inputCount": 0,
|
|
1399
|
+
"secrets": [],
|
|
1400
|
+
"secretCount": 0,
|
|
1401
|
+
"outputs": [],
|
|
1402
|
+
"outputCount": 0,
|
|
1403
|
+
"surface": "repository-workflow",
|
|
1404
|
+
"capabilityGroup": "api-cli-reference",
|
|
1405
|
+
"status": "active",
|
|
1406
|
+
"owner": "buildchain-workflows",
|
|
1407
|
+
"maturity": "active",
|
|
1408
|
+
"introducedVersion": "pre-3.0.2-alpha.4",
|
|
1409
|
+
"compatibilityPromise": "preserved-through-the-v3-major-line",
|
|
1410
|
+
"deprecationReplacement": "",
|
|
1411
|
+
"sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
|
|
1412
|
+
"nonDuplicationRationale": "Existing workflow identity retained for caller compatibility and repository orchestration."
|
|
1413
|
+
},
|
|
1414
|
+
{
|
|
1415
|
+
"id": "buildchain-dev-delivery",
|
|
1416
|
+
"path": ".github/workflows/buildchain-dev-delivery.yml",
|
|
1417
|
+
"reusable": false,
|
|
1418
|
+
"inputs": [],
|
|
1419
|
+
"inputCount": 0,
|
|
1420
|
+
"secrets": [],
|
|
1421
|
+
"secretCount": 0,
|
|
1422
|
+
"outputs": [],
|
|
1423
|
+
"outputCount": 0,
|
|
1424
|
+
"surface": "dev-governance",
|
|
1425
|
+
"capabilityGroup": "governance-versioning",
|
|
1426
|
+
"status": "active",
|
|
1427
|
+
"owner": "buildchain-workflows",
|
|
1428
|
+
"maturity": "active",
|
|
1429
|
+
"introducedVersion": "pre-3.0.2-alpha.4",
|
|
1430
|
+
"compatibilityPromise": "preserved-through-the-v3-major-line",
|
|
1431
|
+
"deprecationReplacement": "",
|
|
1432
|
+
"sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
|
|
1433
|
+
"nonDuplicationRationale": "Existing workflow identity retained for caller compatibility and repository orchestration."
|
|
1434
|
+
},
|
|
1370
1435
|
{
|
|
1371
1436
|
"id": "buildchain-patrol-daily",
|
|
1372
1437
|
"path": ".github/workflows/buildchain-patrol-daily.yml",
|
|
@@ -1647,6 +1712,87 @@
|
|
|
1647
1712
|
"sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
|
|
1648
1713
|
"nonDuplicationRationale": "Existing workflow identity retained for caller compatibility and repository orchestration."
|
|
1649
1714
|
},
|
|
1715
|
+
{
|
|
1716
|
+
"id": "dev-delivery-warrant-cancel",
|
|
1717
|
+
"path": ".github/workflows/dev-delivery-warrant-cancel.yml",
|
|
1718
|
+
"reusable": true,
|
|
1719
|
+
"inputs": [
|
|
1720
|
+
"buildchain-ref",
|
|
1721
|
+
"buildchain-repository",
|
|
1722
|
+
"event-action",
|
|
1723
|
+
"expected-candidate-id",
|
|
1724
|
+
"expected-old-state-root",
|
|
1725
|
+
"expected-pr-number",
|
|
1726
|
+
"expected-source-head-sha",
|
|
1727
|
+
"observed-source-head-sha",
|
|
1728
|
+
"outcome",
|
|
1729
|
+
"reason",
|
|
1730
|
+
"target-branch",
|
|
1731
|
+
"terminal-evidence-root"
|
|
1732
|
+
],
|
|
1733
|
+
"inputCount": 12,
|
|
1734
|
+
"secrets": [
|
|
1735
|
+
"github-token"
|
|
1736
|
+
],
|
|
1737
|
+
"secretCount": 1,
|
|
1738
|
+
"outputs": [
|
|
1739
|
+
"cancellation-action",
|
|
1740
|
+
"cancellation-receipt-root",
|
|
1741
|
+
"final-state-root"
|
|
1742
|
+
],
|
|
1743
|
+
"outputCount": 3,
|
|
1744
|
+
"surface": "repository-workflow",
|
|
1745
|
+
"capabilityGroup": "governance-versioning",
|
|
1746
|
+
"status": "active",
|
|
1747
|
+
"owner": "buildchain-workflows",
|
|
1748
|
+
"maturity": "active",
|
|
1749
|
+
"introducedVersion": "pre-3.0.2-alpha.4",
|
|
1750
|
+
"compatibilityPromise": "preserved-through-the-v3-major-line",
|
|
1751
|
+
"deprecationReplacement": "",
|
|
1752
|
+
"sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
|
|
1753
|
+
"nonDuplicationRationale": "Existing workflow identity retained for caller compatibility and repository orchestration."
|
|
1754
|
+
},
|
|
1755
|
+
{
|
|
1756
|
+
"id": "dev-delivery-warrant-close",
|
|
1757
|
+
"path": ".github/workflows/dev-delivery-warrant-close.yml",
|
|
1758
|
+
"reusable": true,
|
|
1759
|
+
"inputs": [
|
|
1760
|
+
"buildchain-ref",
|
|
1761
|
+
"buildchain-repository",
|
|
1762
|
+
"current-base-sha",
|
|
1763
|
+
"expected-head-sha",
|
|
1764
|
+
"expected-pr-number",
|
|
1765
|
+
"merge-group-head-sha",
|
|
1766
|
+
"merge-group-tree-sha",
|
|
1767
|
+
"outcome",
|
|
1768
|
+
"reason",
|
|
1769
|
+
"replay-tree-sha",
|
|
1770
|
+
"required-context-roots-json",
|
|
1771
|
+
"target-branch",
|
|
1772
|
+
"terminal-evidence-root"
|
|
1773
|
+
],
|
|
1774
|
+
"inputCount": 13,
|
|
1775
|
+
"secrets": [
|
|
1776
|
+
"github-token"
|
|
1777
|
+
],
|
|
1778
|
+
"secretCount": 1,
|
|
1779
|
+
"outputs": [
|
|
1780
|
+
"close-receipt-root",
|
|
1781
|
+
"final-state-root",
|
|
1782
|
+
"integration-proof-root"
|
|
1783
|
+
],
|
|
1784
|
+
"outputCount": 3,
|
|
1785
|
+
"surface": "repository-workflow",
|
|
1786
|
+
"capabilityGroup": "governance-versioning",
|
|
1787
|
+
"status": "active",
|
|
1788
|
+
"owner": "buildchain-workflows",
|
|
1789
|
+
"maturity": "active",
|
|
1790
|
+
"introducedVersion": "pre-3.0.2-alpha.4",
|
|
1791
|
+
"compatibilityPromise": "preserved-through-the-v3-major-line",
|
|
1792
|
+
"deprecationReplacement": "",
|
|
1793
|
+
"sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
|
|
1794
|
+
"nonDuplicationRationale": "Existing workflow identity retained for caller compatibility and repository orchestration."
|
|
1795
|
+
},
|
|
1650
1796
|
{
|
|
1651
1797
|
"id": "dev-merge-queue-governance",
|
|
1652
1798
|
"path": ".github/workflows/dev-merge-queue-governance.yml",
|
|
@@ -1673,34 +1819,60 @@
|
|
|
1673
1819
|
"path": ".github/workflows/dev-pr-auto-merge.yml",
|
|
1674
1820
|
"reusable": true,
|
|
1675
1821
|
"inputs": [
|
|
1822
|
+
"affected-paths-json",
|
|
1676
1823
|
"allowed-head-prefixes",
|
|
1824
|
+
"assignment-root",
|
|
1677
1825
|
"block-labels",
|
|
1678
1826
|
"buildchain-ref",
|
|
1679
1827
|
"buildchain-repository",
|
|
1828
|
+
"closure-root",
|
|
1829
|
+
"delivery-class",
|
|
1830
|
+
"delivery-priority",
|
|
1831
|
+
"delivery-warrant-mode",
|
|
1832
|
+
"dependency-root",
|
|
1833
|
+
"diagnostic-context",
|
|
1680
1834
|
"dry-run",
|
|
1835
|
+
"expected-head-sha",
|
|
1836
|
+
"expected-pr-number",
|
|
1837
|
+
"initiative-root",
|
|
1681
1838
|
"landing-mode",
|
|
1682
1839
|
"max-merges",
|
|
1683
1840
|
"merge-method",
|
|
1841
|
+
"plan-root",
|
|
1842
|
+
"project-cut-proof-json",
|
|
1843
|
+
"queue-admission-context",
|
|
1684
1844
|
"ready-label",
|
|
1685
1845
|
"require-approval",
|
|
1686
1846
|
"required-status-checks",
|
|
1687
1847
|
"same-repository-only",
|
|
1688
|
-
"
|
|
1689
|
-
|
|
1690
|
-
|
|
1848
|
+
"shard-evidence-roots-json",
|
|
1849
|
+
"source-identity-root",
|
|
1850
|
+
"source-patch-root",
|
|
1851
|
+
"target-branch",
|
|
1852
|
+
"toolchain-root",
|
|
1853
|
+
"warrant-lease-seconds"
|
|
1854
|
+
],
|
|
1855
|
+
"inputCount": 32,
|
|
1691
1856
|
"secrets": [
|
|
1692
1857
|
"github-token"
|
|
1693
1858
|
],
|
|
1694
1859
|
"secretCount": 1,
|
|
1695
1860
|
"outputs": [
|
|
1696
1861
|
"action-count",
|
|
1862
|
+
"admission-receipt-root",
|
|
1863
|
+
"admission-state",
|
|
1697
1864
|
"enqueued-count",
|
|
1698
1865
|
"evaluated-count",
|
|
1699
1866
|
"final-base-sha",
|
|
1700
1867
|
"merged-count",
|
|
1701
|
-
"
|
|
1868
|
+
"project-cut-proof-root",
|
|
1869
|
+
"skipped-count",
|
|
1870
|
+
"source-proof-root",
|
|
1871
|
+
"warrant-receipt-root",
|
|
1872
|
+
"warrant-state-commit",
|
|
1873
|
+
"warrant-state-root"
|
|
1702
1874
|
],
|
|
1703
|
-
"outputCount":
|
|
1875
|
+
"outputCount": 13,
|
|
1704
1876
|
"surface": "dev-governance",
|
|
1705
1877
|
"capabilityGroup": "governance-versioning",
|
|
1706
1878
|
"status": "active",
|
|
@@ -2219,6 +2391,8 @@
|
|
|
2219
2391
|
"publication-control-plane-audit-json",
|
|
2220
2392
|
"publication-expected-json",
|
|
2221
2393
|
"publication-gate-aggregate-json",
|
|
2394
|
+
"publication-gate-command",
|
|
2395
|
+
"publication-gate-controller-sha",
|
|
2222
2396
|
"publication-package-name",
|
|
2223
2397
|
"publication-product",
|
|
2224
2398
|
"publication-publisher-workflow-path",
|
|
@@ -2242,6 +2416,7 @@
|
|
|
2242
2416
|
"release-candidate-family-evidence-required",
|
|
2243
2417
|
"release-candidate-family-evidence-root",
|
|
2244
2418
|
"release-candidate-family-initiative-id",
|
|
2419
|
+
"release-candidate-wait-seconds",
|
|
2245
2420
|
"release-candidate-workflow-file",
|
|
2246
2421
|
"release-candidate-workflow-name",
|
|
2247
2422
|
"release-passport",
|
|
@@ -2266,13 +2441,22 @@
|
|
|
2266
2441
|
"release-propagation-config-path",
|
|
2267
2442
|
"required-artifact-count",
|
|
2268
2443
|
"required-status-check",
|
|
2444
|
+
"resume-buildchain-runtime-sha",
|
|
2445
|
+
"resume-candidate-repository",
|
|
2446
|
+
"resume-candidate-run-id",
|
|
2447
|
+
"resume-expected-candidate-root",
|
|
2448
|
+
"resume-expected-candidate-runtime-sha",
|
|
2449
|
+
"resume-expected-source-tree",
|
|
2450
|
+
"resume-expected-workflow-file",
|
|
2451
|
+
"resume-expected-workflow-name",
|
|
2452
|
+
"resume-transaction-id",
|
|
2269
2453
|
"runner-preset",
|
|
2270
2454
|
"standalone-binary-distribution",
|
|
2271
2455
|
"target-ref",
|
|
2272
2456
|
"target-sha",
|
|
2273
2457
|
"trusted-publishing"
|
|
2274
2458
|
],
|
|
2275
|
-
"inputCount":
|
|
2459
|
+
"inputCount": 99,
|
|
2276
2460
|
"secrets": [
|
|
2277
2461
|
"BUILDCHAIN_ISSUE_APP_ID",
|
|
2278
2462
|
"BUILDCHAIN_ISSUE_APP_PRIVATE_KEY",
|
|
@@ -2317,10 +2501,13 @@
|
|
|
2317
2501
|
"publication-commit-evidence-path",
|
|
2318
2502
|
"publication-commit-payload-root",
|
|
2319
2503
|
"publication-commit-url",
|
|
2504
|
+
"release-candidate-action",
|
|
2320
2505
|
"release-candidate-artifact",
|
|
2506
|
+
"release-candidate-recovery-receipt-artifact",
|
|
2507
|
+
"release-candidate-recovery-root",
|
|
2321
2508
|
"release-propagation-work-artifact"
|
|
2322
2509
|
],
|
|
2323
|
-
"outputCount":
|
|
2510
|
+
"outputCount": 35,
|
|
2324
2511
|
"surface": "release-governance",
|
|
2325
2512
|
"capabilityGroup": "reusable-build",
|
|
2326
2513
|
"status": "active",
|
|
@@ -2835,10 +3022,11 @@
|
|
|
2835
3022
|
"required",
|
|
2836
3023
|
"sample-process-tree",
|
|
2837
3024
|
"stage",
|
|
3025
|
+
"substage-evidence-path",
|
|
2838
3026
|
"summary-path",
|
|
2839
3027
|
"timeout-minutes"
|
|
2840
3028
|
],
|
|
2841
|
-
"inputCount":
|
|
3029
|
+
"inputCount": 22,
|
|
2842
3030
|
"capabilityGroup": "reusable-build",
|
|
2843
3031
|
"status": "active",
|
|
2844
3032
|
"owner": "buildchain-actions",
|
package/docs/MAP.md
CHANGED
|
@@ -111,6 +111,7 @@ replace them.
|
|
|
111
111
|
| Why does Buildchain use branch-driven release governance? | [`release-governance.md`](release-governance.md) | why | stable |
|
|
112
112
|
| How do protected dev branches and scheduled ready-PR merging work? | [`release-governance.md`](release-governance.md#protected-dev-branches) | use | stable |
|
|
113
113
|
| How do slow required checks land reliably on a busy dev channel? | [`release-governance.md`](release-governance.md#protected-dev-branches) + [`cli.md`](cli.md#commands) | use | preview |
|
|
114
|
+
| How does the durable fair Dev Delivery Warrant Queue prevent slow-candidate starvation? | [`dev-delivery-warrant.md`](dev-delivery-warrant.md) | use/verify | preview |
|
|
114
115
|
| How do I coalesce rapid Dev changes, preserve release runner priority, and retry only transient failed jobs? | [`dev-qualification-patrol.md`](dev-qualification-patrol.md) | use/verify | preview |
|
|
115
116
|
| How do I run daily, weekly, or monthly repository patrols? | [`release-governance.md`](release-governance.md#buildchain-patrol) | use | stable |
|
|
116
117
|
| How does Buildchain decide patch, minor, and major release lines? | [`versioning.md`](versioning.md) | why | stable |
|
|
@@ -152,6 +153,7 @@ replace them.
|
|
|
152
153
|
| How do I automatically qualify alpha candidates and publish the newest non-revoked qualified candidate at a fixed window? | [`stable-candidate-patrol.md`](stable-candidate-patrol.md) | use | preview |
|
|
153
154
|
| How do I deploy a site/app preview, staging, or production surface? | [`web-surface-deployments.md`](web-surface-deployments.md) | use | stable |
|
|
154
155
|
| How do I publish observed infrastructure contracts for downstream consumers? | [`infra-contract.md`](infra-contract.md) | use | preview |
|
|
156
|
+
| How do I operate a repeatable, disabled-by-default, budget-fail-closed AWS Windows JIT campaign? | [`aws-us-elastic-runner-burst-plane.md`](aws-us-elastic-runner-burst-plane.md#phase-2-operator-workflow) | use/verify | preview |
|
|
155
157
|
| How do I use the active actions directly? | [`../actions/validate-config/README.md`](../actions/validate-config/README.md), [`../actions/run-lifecycle/README.md`](../actions/run-lifecycle/README.md), [`../actions/promote-buildchain-ref/README.md`](../actions/promote-buildchain-ref/README.md), [`../actions/report-buildchain-issue/README.md`](../actions/report-buildchain-issue/README.md), [`../actions/github-artifact-attestation/README.md`](../actions/github-artifact-attestation/README.md), [`../actions/macos-credential-island/README.md`](../actions/macos-credential-island/README.md); `dist/site/workflow-registry.json#actions` is authoritative for the six-entry inventory. | use | stable |
|
|
156
158
|
| How can a consumer workflow report a Buildchain-owned failure back to Buildchain? | [`consumer-issue-reporting.md`](consumer-issue-reporting.md) + [`../actions/report-buildchain-issue/README.md`](../actions/report-buildchain-issue/README.md) | use | stable |
|
|
157
159
|
| What do the fixture repositories demonstrate? | [`../fixtures/libnode-shaped/README.md`](../fixtures/libnode-shaped/README.md), [`../fixtures/publish-transaction-shaped/README.md`](../fixtures/publish-transaction-shaped/README.md), [`../fixtures/web-surface-shaped/README.md`](../fixtures/web-surface-shaped/README.md), [`../fixtures/publication-artifact-shaped/README.md`](../fixtures/publication-artifact-shaped/README.md) | verify | stable |
|