@kungfu-tech/buildchain 3.0.7-alpha.0 → 3.0.7

package/scripts/release-candidate-resolver.mjs

@@ -351,16 +351,22 @@ export function generatePublishRequiredArtifacts({
     const files = Array.isArray(manifest.files) ? manifest.files : [];
     return files
       .filter((file) => file?.sha256)
-      .map((file) => ({
-        kind,
-        name: packageNameFromArtifactPath(file.path || file.name || manifest.artifactName || platform),
-        ref,
-        digest: String(file.sha256).startsWith("sha256:")
-          ? String(file.sha256)
-          : `sha256:${file.sha256}`,
-        role: "platform",
-        platform,
-      }));
+      .map((file) => {
+        const name = String(file.path || file.name || manifest.artifactName || platform)
+          .replaceAll("\\", "/")
+          .replace(/^\.\//, "");
+        return {
+          ...(platform ? { group: platform } : {}),
+          kind,
+          name,
+          ref,
+          digest: String(file.sha256).startsWith("sha256:")
+            ? String(file.sha256)
+            : `sha256:${file.sha256}`,
+          role: "platform",
+          platform,
+        };
+      });
   });
 }
 

package/scripts/resume-from-candidate-run.mjs

@@ -95,12 +95,18 @@ function findFiles(root, predicate) {
   return collectFiles(root).filter((file) => predicate(file.path, file.absolutePath));
 }
 
+export function recoveredArtifactPathsByBasename(downloads, filename) {
+  return downloads.flatMap((download) => download.files
+    .filter((file) => path.basename(file.path) === filename)
+    .map((file) => outputPath(file.absolutePath)));
+}
+
 function readOnlyJson(files, label) {
   if (files.length !== 1) throw new Error(`expected exactly one ${label}, found ${files.length}`);
   return JSON.parse(fs.readFileSync(files[0].absolutePath, "utf8"));
 }
 
-async function readExistingTransaction({ repoInfo, apiUrl, token, fetchImpl, version }) {
+export async function readExistingTransaction({ repoInfo, apiUrl, token, fetchImpl, version }) {
   const stateRef = releaseTransactionStateRef(version);
   const response = await githubJson({
     apiUrl,
@@ -110,10 +116,31 @@ async function readExistingTransaction({ repoInfo, apiUrl, token, fetchImpl, ver
     path: `/repos/${repoInfo.owner}/${repoInfo.repo}/contents/state.json?ref=${encodeURIComponent(stateRef)}`,
   });
   if (!response) return undefined;
-  if (response.type !== "file" || response.encoding !== "base64" || !response.content) {
-    throw new Error(`durable transaction ${stateRef} did not expose a base64 state.json file`);
+  if (response.type !== "file") {
+    throw new Error(`durable transaction ${stateRef} did not expose a state.json file`);
+  }
+  let encoded = response.encoding === "base64" && response.content
+    ? response
+    : undefined;
+  if (!encoded) {
+    const blobSha = String(response.sha || "").trim();
+    if (!/^[0-9a-f]{40}$/i.test(blobSha)) {
+      throw new Error(`durable transaction ${stateRef} did not expose inline content or an exact blob identity`);
+    }
+    encoded = await githubJson({
+      apiUrl,
+      token,
+      fetchImpl,
+      path: `/repos/${repoInfo.owner}/${repoInfo.repo}/git/blobs/${blobSha}`,
+    });
+    if (String(encoded?.sha || "").trim() !== blobSha) {
+      throw new Error(`durable transaction ${stateRef} blob identity drifted from ${blobSha}`);
+    }
+  }
+  if (encoded?.encoding !== "base64" || !encoded.content) {
+    throw new Error(`durable transaction ${stateRef} did not expose base64 state.json content`);
   }
-  return JSON.parse(Buffer.from(String(response.content).replace(/\s/g, ""), "base64").toString("utf8"));
+  return JSON.parse(Buffer.from(String(encoded.content).replace(/\s/g, ""), "base64").toString("utf8"));
 }
 
 function outputPath(filePath) {
@@ -180,6 +207,7 @@ function candidateArtifactNames({ passport, selected, artifacts, artifactPattern
 
 export function normalizePlatformManifests(downloads, passport) {
   const manifests = [];
+  const paths = [];
   const evidenceByArtifact = new Map();
   const platformById = new Map((passport.platformMatrix || []).map((entry) => [String(entry.platformId || ""), entry]));
   const seenPlatformIds = new Set();
@@ -208,6 +236,7 @@ export function normalizePlatformManifests(downloads, passport) {
       manifest.artifactName = expectedPlatform.artifactName;
       seenPlatformIds.add(platformId);
       manifests.push(manifest);
+      paths.push(file.absolutePath);
       addEvidence(manifest.artifactName, download.record.files);
     }
     if (String(download.artifact.name).includes("-diagnostics-")) {
@@ -222,7 +251,7 @@ export function normalizePlatformManifests(downloads, passport) {
     artifactName,
     files: [...files.values()].sort((left, right) => left.path.localeCompare(right.path)),
   }));
-  return { manifests, evidence };
+  return { manifests, paths, evidence };
 }
 
 function normalizeControllerReceipts(downloads, passport) {
@@ -268,16 +297,53 @@ export function createRecoveredPublicationCandidate({
   return { ...payload, candidateDigest: publicationArtifactCandidateDigest(payload) };
 }
 
+export function deduplicateReleaseAssets(files = []) {
+  const assets = new Map();
+  for (const file of files) {
+    const name = path.basename(file.path);
+    const existing = assets.get(name);
+    if (!existing) {
+      assets.set(name, file);
+      continue;
+    }
+    const digest = String(file.sha256 || "").replace(/^sha256:/, "");
+    const existingDigest = String(existing.sha256 || "").replace(/^sha256:/, "");
+    if (digest !== existingDigest || Number(file.size) !== Number(existing.size)) {
+      throw new Error(
+        `recovered GitHub Release asset basename collision: ${name} maps to different sealed bytes`,
+      );
+    }
+    if (
+      String(file.path).length < String(existing.path).length ||
+      (String(file.path).length === String(existing.path).length &&
+        String(file.path).localeCompare(String(existing.path)) < 0)
+    ) {
+      assets.set(name, file);
+    }
+  }
+  return [...assets.values()].sort((left, right) =>
+    path.basename(left.path).localeCompare(path.basename(right.path)),
+  );
+}
+
 export function createRecoveredPublication({ downloads, bundleRoot, repository, passport, candidateRuntimeSha, publishArtifactKind, publishPackageMain, releasePatterns, platformManifests }) {
   const allFiles = downloads.flatMap((download) => download.files.map((file) => ({
     path: path.relative(bundleRoot, file.absolutePath).split(path.sep).join("/"),
     size: file.size,
     sha256: file.sha256.replace(/^sha256:/, ""),
     absolutePath: file.absolutePath,
+    artifactName: String(download.artifact?.name || ""),
   }))).sort((left, right) => left.path.localeCompare(right.path));
   const kind = String(publishArtifactKind || "npm");
   const releaseMatchers = splitPatterns(releasePatterns).map(patternMatcher);
-  const releaseAssets = allFiles.filter((file) => releaseMatchers.some((matcher) => matcher.test(path.basename(file.path))));
+  const platformArtifactNames = new Set(
+    platformManifests.map((manifest) => String(manifest.artifactName || "")).filter(Boolean),
+  );
+  const releaseAssetFiles = kind !== "npm" && platformArtifactNames.size > 0
+    ? allFiles.filter((file) => platformArtifactNames.has(file.artifactName))
+    : allFiles;
+  const releaseAssets = deduplicateReleaseAssets(releaseAssetFiles.filter((file) =>
+    releaseMatchers.some((matcher) => matcher.test(path.basename(file.path)))));
   if (kind !== "npm") {
     createRecoveredPublicationCandidate({ allFiles, repository, passport, candidateRuntimeSha });
     const version = String(passport.target?.version || "").trim();
@@ -367,6 +433,42 @@ async function recoverCandidateEvidence({
   };
 }
 
+export function exposeRecoveredPayloadRoot({ resolvedOutput, bundleRoot }) {
+  const recoveredPayloadRoot = path.join(bundleRoot, "artifacts");
+  if (!fs.existsSync(recoveredPayloadRoot) || !fs.statSync(recoveredPayloadRoot).isDirectory()) {
+    throw new Error(`recovered candidate payload root is missing: ${recoveredPayloadRoot}`);
+  }
+  const compatibilityRoot = path.join(resolvedOutput, "payloads");
+  try {
+    fs.lstatSync(compatibilityRoot);
+    if (fs.realpathSync(compatibilityRoot) !== fs.realpathSync(recoveredPayloadRoot)) {
+      throw new Error(`recovered candidate payload compatibility path is already occupied: ${compatibilityRoot}`);
+    }
+  } catch (error) {
+    if (error?.code !== "ENOENT") throw error;
+    fs.symlinkSync(path.relative(resolvedOutput, recoveredPayloadRoot), compatibilityRoot, "dir");
+  }
+  return compatibilityRoot;
+}
+
+export function exposeRecoveredPassportPath({ resolvedOutput, recoveredPassportPath }) {
+  if (!fs.existsSync(recoveredPassportPath) || !fs.statSync(recoveredPassportPath).isFile()) {
+    throw new Error(`recovered candidate passport is missing: ${recoveredPassportPath}`);
+  }
+  const recoveredPassportRoot = path.dirname(recoveredPassportPath);
+  const compatibilityRoot = path.join(resolvedOutput, "passport");
+  try {
+    fs.lstatSync(compatibilityRoot);
+    if (fs.realpathSync(compatibilityRoot) !== fs.realpathSync(recoveredPassportRoot)) {
+      throw new Error(`recovered candidate passport compatibility path is already occupied: ${compatibilityRoot}`);
+    }
+  } catch (error) {
+    if (error?.code !== "ENOENT") throw error;
+    fs.symlinkSync(path.relative(resolvedOutput, recoveredPassportRoot), compatibilityRoot, "dir");
+  }
+  return path.join(compatibilityRoot, path.basename(recoveredPassportPath));
+}
+
 async function resolveTargetAdvance({ observedTargetSha, targetSha, transactionId, existingTransaction, repoInfo, apiUrl, token, fetchImpl }) {
   if (observedTargetSha === targetSha || !transactionId || existingTransaction?.id !== transactionId) return undefined;
   const comparison = await githubJson({ apiUrl, token, fetchImpl, path: `/repos/${repoInfo.owner}/${repoInfo.repo}/compare/${targetSha}...${observedTargetSha}` });
@@ -494,7 +596,16 @@ export async function resumeFromCandidateRun({
     if (publication.manifest) fs.writeFileSync(sealedManifestPath, `${JSON.stringify(publication.manifest, null, 2)}\n`);
     const publishRequiredArtifacts = publication.publishRequiredArtifacts;
     fs.writeFileSync(requiredArtifactsPath, `${JSON.stringify(publishRequiredArtifacts, null, 2)}\n`);
+    const payloadRoot = exposeRecoveredPayloadRoot({ resolvedOutput, bundleRoot });
+    const recoveredPassportPath = initialDownloads[0].files.find(
+      (file) => path.basename(file.path) === "release-candidate-passport.json",
+    ).absolutePath;
+    const passportPath = exposeRecoveredPassportPath({ resolvedOutput, recoveredPassportPath });
     const tarballs = publication.npmArtifacts.map((entry) => outputPath(entry.file.absolutePath));
+    const githubArtifactAttestationPolicies = recoveredArtifactPathsByBasename(
+      downloads,
+      "github-artifact-attestation-policy.json",
+    );
     return {
       enabled: true,
       action: "reused",
@@ -507,10 +618,11 @@ export async function resumeFromCandidateRun({
       receipt: recovery.receipt,
       publishRequiredArtifacts,
       paths: {
-        passport: outputPath(initialDownloads[0].files.find((file) => path.basename(file.path) === "release-candidate-passport.json").absolutePath),
+        passport: outputPath(passportPath),
         buildSummary: outputPath(initialDownloads[1].files.find((file) => path.basename(file.path) === "build-summary.json").absolutePath),
-        payloads: outputPath(path.join(bundleRoot, "artifacts")),
-        platformManifests: downloads.flatMap((download) => download.files.filter((file) => path.basename(file.path) === "manifest.json").map((file) => outputPath(file.absolutePath))),
+        payloads: outputPath(payloadRoot),
+        platformManifests: platformManifestEvidence.paths.map(outputPath),
+        githubArtifactAttestationPolicies,
         npmTarballs: tarballs,
         releaseAssets: publication.releaseAssets.map((asset) => outputPath(asset.absolutePath)),
         publishRequiredArtifacts: outputPath(requiredArtifactsPath),
@@ -560,6 +672,8 @@ export async function resumeFromCandidateRunCli() {
       "release-candidate-payload-artifacts": result.artifacts.payloads.join(","),
       "release-candidate-payload-dir": result.paths.payloads,
       "release-candidate-platform-manifest-paths": result.paths.platformManifests.join(","),
+      "release-candidate-github-artifact-attestation-policy-paths": result.paths.githubArtifactAttestationPolicies.join(","),
+      "release-candidate-github-artifact-attestation-policy-count": String(result.paths.githubArtifactAttestationPolicies.length),
       "release-candidate-npm-tarball-paths": result.paths.npmTarballs.join(","),
       "release-candidate-github-release-artifact-paths": result.paths.releaseAssets.join("\n"),
       "publish-required-artifacts-json": JSON.stringify(result.publishRequiredArtifacts),

package/scripts/seal-artifact-signing-requests.mjs

@@ -376,6 +376,12 @@ export function sealArtifactSigningRequests({
       signature: {
         profile: declaration.profile,
         required: declaration.required,
+        ...(declaration.entitlementsProfile !== "none"
+          ? {
+              entitlementsProfile: declaration.entitlementsProfile,
+              entitlementsPaths: declaration.entitlementsPaths,
+            }
+          : {}),
       },
     });
     const check = validateArtifactSigningRequest(request);

package/scripts/site-capability-metadata.mjs

@@ -188,6 +188,8 @@ export function nodeApiMeta(exportName) {
     "./publication-control-plane-audit": { group: "release-passport-trust", summary: "Read-only publication control-plane snapshot evaluation APIs." },
     "./buildchain-publication-authority": { group: "release-passport-trust", summary: "Buildchain-owned closed-world publication authority descriptor registry." },
     "./github-governance-authority": { group: "governance-versioning", summary: "Fail-closed GitHub ownership, effective-policy, managed-zone admission, rollout-plan, and immutable receipt APIs." },
+    "./engineering-housekeeper": { group: "governance-versioning", summary: "Provider-neutral repository hygiene classification, deterministic plan and receipt, apply-time revalidation, and replay APIs." },
+    "./engineering-housekeeper-github": { group: "governance-versioning", summary: "Paginated GitHub repository hygiene inventory, default-dry-run execution, exact-head mutation fences, and rooted provider receipts." },
     "./artifact-passport": { group: "release-passport-trust", summary: "Artifact passport digest and evidence helper APIs." },
     "./artifact-verification-envelope": { group: "release-passport-trust", summary: "Sealed exact-root, lifecycle, identity, and existing KFD assessment inputs for KFX admission." },
     "./artifact-signing": { group: "reusable-build", summary: "Credential-free artifact signing declarations, source-bound requests, authority receipts, profile resolution, and fail-closed validation APIs." },

package/scripts/web-surface-core.mjs

@@ -1725,12 +1725,13 @@ async function fetchWithRetry(url, {
   attempts = 3,
   intervalMs = 5000,
   shouldRetry = () => false,
+  requestOptions = { redirect: "follow" },
 } = {}) {
   const maxAttempts = Math.max(1, Number(attempts) || 1);
   let lastError = null;
   for (let attempt = 1; attempt <= maxAttempts; attempt += 1) {
     try {
-      const response = await fetchImpl(url, { redirect: "follow" });
+      const response = await fetchImpl(url, requestOptions);
       if (attempt >= maxAttempts || !shouldRetry(response)) {
         return { response, attempts: attempt };
       }
@@ -1751,6 +1752,11 @@ function retryableHealthResponse(response) {
   return response.status === 403 || response.status === 404 || response.status >= 500;
 }
 
+function retryingHealthFetch(fetchImpl, attempts, intervalMs) {
+  return (url, requestOptions) => fetchWithRetry(url, { fetchImpl, attempts, intervalMs,
+    shouldRetry: retryableHealthResponse, requestOptions }).then(({ response }) => response);
+}
+
 const DEFAULT_HEALTH_HTTP_RETRY_ATTEMPTS = 12;
 const DEFAULT_HEALTH_HTTP_RETRY_INTERVAL_MS = 10000;
 
@@ -1984,7 +1990,7 @@ export async function checkWebSurfaceHealth({
       };
       const evidence = await verifyInstallerPublicReadback({
         publication: projected,
-        fetchImpl,
+        fetchImpl: retryingHealthFetch(fetchImpl, httpRetryAttempts, httpRetryIntervalMs),
       });
       checks.push({
         surface: "__installer__",

package/scripts/workflow-call-contract.mjs

@@ -6,7 +6,7 @@ import { pathToFileURL } from "node:url";
 import { evaluateWorkflowCallContract } from "../packages/core/workflow-call-contract.js";
 import { parseWorkflowDocument } from "../packages/core/workflow-yaml-contract.js";
 
-export const SELF_RELEASE_REF = "9a0cdf8d84aacf8c7daaac82efa43d1b34696a03";
+export const SELF_RELEASE_REF = "769b221bad7a6b9104afad4c2628d9dca396ab0f";
 export const SELF_RELEASE_PUBLIC_WORKFLOW = `kungfu-systems/buildchain/.github/workflows/release-candidate-promote.yml@${SELF_RELEASE_REF}`;
 
 function parityFailure(message) {