@kungfu-tech/buildchain 3.0.8 → 3.0.9-alpha.1

package/packages/core/release-train.js

@@ -8,6 +8,8 @@ export const RELEASE_TRAIN_TRANSITION_CONTRACT =
   "kungfu-buildchain-release-train-transition/v1";
 export const RELEASE_TRAIN_OBSERVATION_CONTRACT =
   "kungfu-buildchain-release-train-observation/v1";
+export const RELEASE_BLOCKER_REPAIR_CONTRACT =
+  "kungfu-buildchain-release-blocker-repair/v1";
 export const LEGACY_DEV_ALPHA_CANDIDATE_STATE_SCHEMA =
   "kungfu-buildchain-dev-alpha-candidate-state/v1";
 
@@ -22,6 +24,7 @@ export const RELEASE_TRAIN_STATES = Object.freeze([
 ]);
 
 export const RELEASE_TRAIN_SUPERSESSION_CAUSES = Object.freeze([
+  "release-blocker-repair",
   "incompatible-semantics",
   "alpha-base-incompatibility",
   "invalid-authority",
@@ -518,3 +521,220 @@ export function readReleaseTrain(input) {
   }
   throw new Error("unsupported Release Train record");
 }
+
+function releaseBlockerLanding(input, label, { allowConflict = false } = {}) {
+  const status = text(input?.status, `${label}.status`);
+  if (status !== "landed" && !(allowConflict && status === "conflict")) {
+    throw new Error(
+      `${label}.status must be ${allowConflict ? "landed or conflict" : "landed"}`,
+    );
+  }
+  const landing = {
+    status,
+    baseSha: exactSha(input.baseSha, `${label}.baseSha`),
+    landedSha:
+      status === "landed"
+        ? exactSha(input.landedSha, `${label}.landedSha`)
+        : "",
+    patchRoot: contentRoot(input.patchRoot, `${label}.patchRoot`),
+    evidenceRoot: contentRoot(input.evidenceRoot, `${label}.evidenceRoot`),
+  };
+  return landing;
+}
+
+function releaseBlockerPublication(patchRoot, devLanding) {
+  const eligible =
+    devLanding.status === "landed" && devLanding.patchRoot === patchRoot;
+  const body = {
+    eligible,
+    reason:
+      devLanding.status === "conflict"
+        ? "dev-forward-port-conflict"
+        : eligible
+          ? "exact-cut-dev-patch-settled"
+          : "cut-dev-patch-root-mismatch",
+    requiredPatchRoot: patchRoot,
+    observedDevPatchRoot: devLanding.patchRoot,
+    devLandingStatus: devLanding.status,
+  };
+  return { ...body, gateRoot: releaseTrainRoot(body) };
+}
+
+function buildReleaseBlockerRepair(activeTrainInput, input = {}) {
+  const activeTrain = validateReleaseTrain(activeTrainInput);
+  if (activeTrain.state.status !== "repair-required") {
+    throw new Error(
+      "release-blocker repair requires the active train to be repair-required",
+    );
+  }
+  const expectedStateRoot = contentRoot(
+    input.expectedStateRoot,
+    "expectedStateRoot",
+  );
+  if (expectedStateRoot !== activeTrain.state.stateRoot) {
+    throw new Error("release-blocker repair compare-and-swap failed");
+  }
+  const patchRoot = contentRoot(input.patchRoot, "patchRoot");
+  const blockerRoot = contentRoot(input.blockerRoot, "blockerRoot");
+  const authorityRoots = sortedRoots(input.authorityRoots, "authorityRoots");
+  const createdAt = timestamp(input.createdAt, "createdAt");
+  const cutLanding = releaseBlockerLanding(
+    {
+      status: "landed",
+      baseSha: activeTrain.releaseCut.candidateSha,
+      landedSha: input.cutCandidateSha,
+      patchRoot: input.cutPatchRoot,
+      evidenceRoot: input.cutLandingEvidenceRoot,
+    },
+    "cutLanding",
+  );
+  if (cutLanding.patchRoot !== patchRoot) {
+    throw new Error(
+      "cut landing must preserve the declared release-blocker patch root",
+    );
+  }
+  const devLanding = releaseBlockerLanding(
+    {
+      status: input.devLandingStatus,
+      baseSha: input.devBaseSha,
+      landedSha: input.devLandingSha,
+      patchRoot: input.devPatchRoot,
+      evidenceRoot: input.devLandingEvidenceRoot,
+    },
+    "devLanding",
+    { allowConflict: true },
+  );
+  const priorCut = activeTrain.releaseCut;
+  const successorTrain = createReleaseTrain({
+    repository: priorCut.repository,
+    sourceBranch: priorCut.sourceBranch,
+    targetBranch: priorCut.targetBranch,
+    originDevSha: priorCut.originDevSha,
+    candidateSha: cutLanding.landedSha,
+    candidateTreeSha: exactSha(
+      input.cutCandidateTreeSha,
+      "cutCandidateTreeSha",
+    ),
+    alphaBaseSha: priorCut.alphaBaseSha,
+    buildchainRuntimeSha: priorCut.buildchainRuntimeSha,
+    generation: priorCut.generation + 1,
+    authorityRoots: [
+      ...new Set([...priorCut.authorityRoots, ...authorityRoots]),
+    ].sort(),
+    supersession: {
+      cause: "release-blocker-repair",
+      priorCutRoot: priorCut.cutRoot,
+    },
+    createdAt,
+  });
+  const supersededTrain = transitionReleaseTrain(activeTrain, {
+    to: "superseded",
+    expectedStateRoot,
+    event: "release-blocker-successor-cut",
+    reason:
+      "a rooted release-blocker repair advanced the active candidate generation",
+    authorityRoots,
+    supersessionCause: "release-blocker-repair",
+    replacementCutRoot: successorTrain.releaseCut.cutRoot,
+    replacementCandidateSha: successorTrain.releaseCut.candidateSha,
+    recordedAt: createdAt,
+  });
+  const publication = releaseBlockerPublication(patchRoot, devLanding);
+  const body = {
+    schemaVersion: 1,
+    contract: RELEASE_BLOCKER_REPAIR_CONTRACT,
+    blockerRoot,
+    patchRoot,
+    priorTrain: activeTrain,
+    supersededTrain,
+    successorTrain,
+    cutLanding,
+    devLanding,
+    candidateBuild: {
+      eligible: true,
+      candidateSha: successorTrain.releaseCut.candidateSha,
+      candidateTreeSha: successorTrain.releaseCut.candidateTreeSha,
+      generation: successorTrain.releaseCut.generation,
+      cutRoot: successorTrain.releaseCut.cutRoot,
+      reason: "rooted-cut-landing",
+    },
+    publication,
+    authorityRoots,
+    createdAt,
+  };
+  return { ...body, repairRoot: releaseTrainRoot(body) };
+}
+
+export function createReleaseBlockerRepair(activeTrainInput, input = {}) {
+  return buildReleaseBlockerRepair(activeTrainInput, input);
+}
+
+export function validateReleaseBlockerRepair(input) {
+  if (
+    input?.contract !== RELEASE_BLOCKER_REPAIR_CONTRACT ||
+    Number(input?.schemaVersion) !== 1
+  ) {
+    throw new Error(
+      `release-blocker repair must use ${RELEASE_BLOCKER_REPAIR_CONTRACT}`,
+    );
+  }
+  const rebuilt = buildReleaseBlockerRepair(input.priorTrain, {
+    expectedStateRoot: input.priorTrain?.state?.stateRoot,
+    blockerRoot: input.blockerRoot,
+    patchRoot: input.patchRoot,
+    cutCandidateSha: input.cutLanding?.landedSha,
+    cutCandidateTreeSha: input.successorTrain?.releaseCut?.candidateTreeSha,
+    cutPatchRoot: input.cutLanding?.patchRoot,
+    cutLandingEvidenceRoot: input.cutLanding?.evidenceRoot,
+    devLandingStatus: input.devLanding?.status,
+    devBaseSha: input.devLanding?.baseSha,
+    devLandingSha: input.devLanding?.landedSha,
+    devPatchRoot: input.devLanding?.patchRoot,
+    devLandingEvidenceRoot: input.devLanding?.evidenceRoot,
+    authorityRoots: input.authorityRoots,
+    createdAt: input.createdAt,
+  });
+  if (input.repairRoot !== rebuilt.repairRoot) {
+    throw new Error("release-blocker repair root does not match its content");
+  }
+  if (releaseTrainRoot(input) !== releaseTrainRoot(rebuilt)) {
+    throw new Error(
+      "release-blocker repair content drifted from its rooted contract",
+    );
+  }
+  return clone(input);
+}
+
+export function settleReleaseBlockerDevLanding(repairInput, input = {}) {
+  const repair = validateReleaseBlockerRepair(repairInput);
+  if (
+    contentRoot(input.expectedRepairRoot, "expectedRepairRoot") !==
+    repair.repairRoot
+  ) {
+    throw new Error(
+      "release-blocker repair settlement compare-and-swap failed",
+    );
+  }
+  const patchRoot = contentRoot(input.patchRoot, "patchRoot");
+  if (patchRoot !== repair.patchRoot) {
+    throw new Error(
+      "dev landing settlement must preserve the release-blocker patch root",
+    );
+  }
+  return buildReleaseBlockerRepair(repair.priorTrain, {
+    expectedStateRoot: repair.priorTrain.state.stateRoot,
+    blockerRoot: repair.blockerRoot,
+    patchRoot: repair.patchRoot,
+    cutCandidateSha: repair.cutLanding.landedSha,
+    cutCandidateTreeSha: repair.successorTrain.releaseCut.candidateTreeSha,
+    cutPatchRoot: repair.cutLanding.patchRoot,
+    cutLandingEvidenceRoot: repair.cutLanding.evidenceRoot,
+    devLandingStatus: "landed",
+    devBaseSha: input.devBaseSha,
+    devLandingSha: input.devLandingSha,
+    devPatchRoot: patchRoot,
+    devLandingEvidenceRoot: input.devLandingEvidenceRoot,
+    authorityRoots: repair.authorityRoots,
+    createdAt: repair.createdAt,
+  });
+}

package/scripts/aws-macos-jit-controller-core.mjs

@@ -56,6 +56,17 @@ function source(values) {
   };
 }
 
+function previousSource(values) {
+  return {
+    sha: exactSha(values.previousSourceSha),
+    ref: exact(
+      values.previousSourceRef || values.sourceRef,
+      /^refs\/heads\/[A-Za-z0-9._/-]+$/,
+      "previousSourceRef",
+    ),
+  };
+}
+
 function campaignId(value) {
   return exact(value, /^[a-z0-9][a-z0-9-]{2,47}$/, "campaignId");
 }
@@ -192,6 +203,71 @@ export function createMacosJitCampaignPlan(values = {}) {
   return { ...plan, digest: digest(plan) };
 }
 
+export function createMacosJitSourceRebindPlan(values = {}) {
+  const id = campaignId(values.campaignId);
+  const boundSource = source(values);
+  const priorSource = previousSource(values);
+  if (boundSource.sha === priorSource.sha) {
+    throw new Error("sourceSha must differ from previousSourceSha");
+  }
+  if (boundSource.ref !== priorSource.ref) {
+    throw new Error("sourceRef must remain unchanged during campaign rebind");
+  }
+  const aws = commonAws(values);
+  const regionConfig = macosJitRegionConfig(aws.region);
+  const workflowId = exact(values.workflowId, /^\d+$/, "workflowId");
+  if (workflowId !== MACOS_EC2_JIT.workflowId) {
+    throw new Error(`workflowId must be ${MACOS_EC2_JIT.workflowId}`);
+  }
+  const plan = {
+    schemaVersion: 1,
+    contract: AWS_MACOS_JIT_CONTROLLER_CONTRACT,
+    kind: "campaign-source-rebind-plan",
+    repository: repository(values.repository),
+    account: {
+      id: exact(values.accountId, /^\d{12}$/, "accountId"),
+    },
+    campaign: { id },
+    previousSource: priorSource,
+    source: boundSource,
+    github: {
+      workflowId,
+      requiredState: "disabled_manually",
+    },
+    aws: {
+      ...aws,
+      hostId: exact(values.hostId, /^h-[0-9a-f]+$/, "hostId"),
+      instanceId: exact(values.instanceId, /^i-[0-9a-f]+$/, "instanceId"),
+    },
+    safety: {
+      applyMode: values.execute === true ? "execute" : "dry-run",
+      noAllocation: true,
+      noDispatch: true,
+      forwardOnlySource: true,
+      sameSourceRefRequired: true,
+      workflowDisabledRequired: true,
+      zeroPriorJobsRequired: true,
+      zeroPriorArtifactsRequired: true,
+      zeroJitResidueRequired: true,
+      zeroEvidenceRequired: true,
+      exactCampaignResourcesRequired: true,
+      compensatedRollbackRequired: true,
+      budget: {
+        name: regionConfig.budgetName,
+        limitUsd: MACOS_EC2_JIT.budgetLimitUsd,
+        metrics: ["UnblendedCost"],
+        dimensionFilter: {
+          usageTypes: regionConfig.budgetUsageTypes,
+          operation: MACOS_EC2_JIT.budgetOperation,
+          regions: regionConfig.budgetRegions,
+        },
+        requiredActualThresholds: [80, 95],
+      },
+    },
+  };
+  return { ...plan, digest: digest(plan) };
+}
+
 export function macosAllocateHostsArgs(plan) {
   if (
     plan?.contract !== AWS_MACOS_JIT_CONTROLLER_CONTRACT ||

package/scripts/aws-macos-jit-controller.mjs

@@ -7,12 +7,14 @@ import {
   createMacosJitCampaignPlan,
   createMacosJitClosePlan,
   createMacosJitJobPlan,
+  createMacosJitSourceRebindPlan,
   macosAllocateHostsArgs,
   macosReleaseHostsArgs,
   macosRunInstancesArgs,
 } from "./aws-macos-jit-controller-core.mjs";
 import { MACOS_EC2_JIT_REGIONS } from "./aws-macos-jit-core.mjs";
 import { executeMacosJitJob } from "./aws-macos-jit-job-controller.mjs";
+import { executeMacosJitSourceRebind } from "./aws-macos-jit-source-rebind.mjs";
 import {
   assertDryRun,
   assertAllowedPolicySimulation,
@@ -498,6 +500,22 @@ function confirm(plan) {
   if (arg("confirm-campaign-id") !== plan.campaign.id) {
     throw new Error("--confirm-campaign-id must equal the campaign id");
   }
+  if (plan.kind === "campaign-source-rebind-plan") {
+    if (arg("confirm-previous-source-sha") !== plan.previousSource.sha) {
+      throw new Error(
+        "--confirm-previous-source-sha must equal previousSourceSha",
+      );
+    }
+    if (arg("confirm-host-id") !== plan.aws.hostId) {
+      throw new Error("--confirm-host-id must equal the exact host id");
+    }
+    if (arg("confirm-instance-id") !== plan.aws.instanceId) {
+      throw new Error("--confirm-instance-id must equal the exact instance id");
+    }
+    if (!flag("confirm-zero-allocation")) {
+      throw new Error("--confirm-zero-allocation is required");
+    }
+  }
 }
 
 function emit(plan, mode, execute, operation) {
@@ -523,6 +541,17 @@ export function main() {
       executeMacosJitCampaignLaunch(plan, { profile: arg("aws-profile") }),
     );
   }
+  if (["plan-rebind", "rebind-campaign"].includes(mode)) {
+    const plan = createMacosJitSourceRebindPlan({
+      ...commonValues(execute),
+      previousSourceSha: arg("previous-source-sha"),
+      previousSourceRef: arg("previous-source-ref"),
+      workflowId: arg("workflow-id"),
+      hostId: arg("host-id"),
+      instanceId: arg("instance-id"),
+    });
+    return emit(plan, mode, execute, () => executeMacosJitSourceRebind(plan, { profile: arg("aws-profile") }));
+  }
   if (["plan-job", "run-job"].includes(mode)) {
     const plan = createMacosJitJobPlan({
       ...commonValues(execute),