@kungfu-tech/buildchain 3.0.8 → 3.0.9-alpha.1

package/scripts/aws-macos-jit-source-rebind.mjs

@@ -0,0 +1,503 @@
+// SPDX-License-Identifier: Apache-2.0
+
+import { AWS_MACOS_JIT_CONTROLLER_CONTRACT } from "./aws-macos-jit-controller-core.mjs";
+import {
+  assertMacosBudgetLaunchGate,
+  assertOwnership,
+  awsArgs,
+  awsJson,
+  commandResult,
+  ghJson,
+  requireSuccess,
+} from "./aws-macos-jit-controller-runtime.mjs";
+
+const MACOS_JIT_RUNNER_LABEL_PREFIX = "aws-us-ec2-macos-jit-";
+
+function sourceRefName(ref) {
+  return ref.replace(/^refs\/heads\//, "");
+}
+
+function sourceRefApiPath(plan) {
+  return `repos/${plan.repository}/git/refs/heads/${sourceRefName(plan.source.ref)}`;
+}
+
+function priorOwnershipPlan(plan) {
+  return {
+    campaign: plan.campaign,
+    source: plan.previousSource,
+  };
+}
+
+function campaignRunsWithNoWork(plan) {
+  const branch = sourceRefName(plan.source.ref);
+  const response = ghJson(
+    [
+      "api",
+      `repos/${plan.repository}/actions/workflows/${plan.github.workflowId}/runs?event=workflow_dispatch&branch=${encodeURIComponent(branch)}&per_page=100`,
+    ],
+    undefined,
+    "macOS campaign workflow run lookup",
+  );
+  const matching = (response.workflow_runs || []).filter(
+    (run) => run.head_branch === branch,
+  );
+  if (Number(response.total_count || matching.length) !== matching.length) {
+    throw new Error("macOS campaign workflow run inventory is incomplete");
+  }
+  const receipts = [];
+  for (const run of matching) {
+    if (run.head_sha !== plan.previousSource.sha) {
+      throw new Error(
+        `macOS campaign run ${run.id} is bound to an unexpected source`,
+      );
+    }
+    const jobs = ghJson(
+      [
+        "api",
+        `repos/${plan.repository}/actions/runs/${run.id}/jobs?filter=all&per_page=100`,
+      ],
+      undefined,
+      `macOS campaign run ${run.id} job lookup`,
+    );
+    const artifacts = ghJson(
+      ["api", `repos/${plan.repository}/actions/runs/${run.id}/artifacts`],
+      undefined,
+      `macOS campaign run ${run.id} artifact lookup`,
+    );
+    const jobCount = Number(jobs.total_count || (jobs.jobs || []).length || 0);
+    const artifactCount = Number(
+      artifacts.total_count || (artifacts.artifacts || []).length || 0,
+    );
+    if (jobCount !== 0 || artifactCount !== 0) {
+      throw new Error(
+        `macOS campaign run ${run.id} already has jobs or artifacts`,
+      );
+    }
+    receipts.push({
+      runId: String(run.id),
+      status: String(run.status || "unknown"),
+      conclusion: String(run.conclusion || ""),
+      jobCount,
+      artifactCount,
+    });
+  }
+  return receipts;
+}
+
+function assertSourceLineage(plan) {
+  const currentRef = ghJson(
+    ["api", sourceRefApiPath(plan)],
+    undefined,
+    "macOS campaign source ref preflight",
+  );
+  if (currentRef.object?.sha !== plan.previousSource.sha) {
+    throw new Error("macOS campaign source ref is not at previousSourceSha");
+  }
+  const nextCommit = ghJson(
+    ["api", `repos/${plan.repository}/commits/${plan.source.sha}`],
+    undefined,
+    "macOS campaign replacement source preflight",
+  );
+  if (String(nextCommit.sha || "").toLowerCase() !== plan.source.sha) {
+    throw new Error("GitHub did not resolve the replacement source SHA");
+  }
+  const comparison = ghJson(
+    [
+      "api",
+      `repos/${plan.repository}/compare/${plan.previousSource.sha}...${plan.source.sha}`,
+    ],
+    undefined,
+    "macOS campaign forward-source preflight",
+  );
+  if (
+    comparison.status !== "ahead" ||
+    comparison.merge_base_commit?.sha !== plan.previousSource.sha
+  ) {
+    throw new Error(
+      "replacement source must be a strict descendant of previousSourceSha",
+    );
+  }
+  return {
+    currentRefSha: currentRef.object.sha,
+    comparisonStatus: comparison.status,
+  };
+}
+
+function readOwnedCampaignResources(plan, profile) {
+  const priorPlan = priorOwnershipPlan(plan);
+  const host = awsJson(
+    plan,
+    profile,
+    [
+      "ec2",
+      "describe-hosts",
+      "--host-ids",
+      plan.aws.hostId,
+      "--output",
+      "json",
+    ],
+    "macOS campaign source rebind host preflight",
+  ).Hosts?.[0];
+  if (!host || host.State !== "available") {
+    throw new Error("macOS campaign source rebind host is not available");
+  }
+  assertOwnership(host.Tags, priorPlan);
+  const instance = awsJson(
+    plan,
+    profile,
+    [
+      "ec2",
+      "describe-instances",
+      "--instance-ids",
+      plan.aws.instanceId,
+      "--output",
+      "json",
+    ],
+    "macOS campaign source rebind instance preflight",
+  ).Reservations?.[0]?.Instances?.[0];
+  if (
+    !instance ||
+    instance.State?.Name !== "running" ||
+    instance.Placement?.HostId !== plan.aws.hostId
+  ) {
+    throw new Error("macOS campaign source rebind instance identity mismatch");
+  }
+  assertOwnership(instance.Tags, priorPlan);
+  if (
+    (instance.Tags || []).some(
+      (entry) =>
+        entry.Key === "kungfu:jit-parameter" && String(entry.Value || ""),
+    )
+  ) {
+    throw new Error("macOS campaign instance already has JIT residue");
+  }
+  const volumeIds = (instance.BlockDeviceMappings || [])
+    .map((mapping) => mapping.Ebs?.VolumeId)
+    .filter(Boolean);
+  if (volumeIds.length !== 1) {
+    throw new Error("macOS campaign must have exactly one attached volume");
+  }
+  const volume = awsJson(
+    plan,
+    profile,
+    [
+      "ec2",
+      "describe-volumes",
+      "--volume-ids",
+      volumeIds[0],
+      "--output",
+      "json",
+    ],
+    "macOS campaign source rebind volume preflight",
+  ).Volumes?.[0];
+  if (!volume || volume.State !== "in-use" || volume.Encrypted !== true) {
+    throw new Error("macOS campaign source rebind volume identity mismatch");
+  }
+  assertOwnership(volume.Tags, priorPlan);
+  return { host, instance, volume };
+}
+
+function assertExactCampaignInventory(plan, profile, resources) {
+  const ownedHosts =
+    awsJson(
+      plan,
+      profile,
+      [
+        "ec2",
+        "describe-hosts",
+        "--filter",
+        `Name=tag:kungfu:campaign-id,Values=${plan.campaign.id}`,
+        "--output",
+        "json",
+      ],
+      "macOS campaign owned host inventory",
+    ).Hosts || [];
+  const ownedInstances = (
+    awsJson(
+      plan,
+      profile,
+      [
+        "ec2",
+        "describe-instances",
+        "--filters",
+        `Name=tag:kungfu:campaign-id,Values=${plan.campaign.id}`,
+        "Name=instance-state-name,Values=pending,running,stopping,stopped,shutting-down",
+        "--output",
+        "json",
+      ],
+      "macOS campaign owned instance inventory",
+    ).Reservations || []
+  ).flatMap((reservation) => reservation.Instances || []);
+  const ownedVolumes =
+    awsJson(
+      plan,
+      profile,
+      [
+        "ec2",
+        "describe-volumes",
+        "--filters",
+        `Name=tag:kungfu:campaign-id,Values=${plan.campaign.id}`,
+        "--output",
+        "json",
+      ],
+      "macOS campaign owned volume inventory",
+    ).Volumes || [];
+  if (
+    ownedHosts.length !== 1 ||
+    ownedHosts[0].HostId !== resources.host.HostId ||
+    ownedInstances.length !== 1 ||
+    ownedInstances[0].InstanceId !== resources.instance.InstanceId ||
+    ownedVolumes.length !== 1 ||
+    ownedVolumes[0].VolumeId !== resources.volume.VolumeId
+  ) {
+    throw new Error("macOS campaign resource inventory is not exact");
+  }
+}
+
+function assertZeroCampaignResidue(plan, profile) {
+  const parameters =
+    awsJson(
+      plan,
+      profile,
+      [
+        "ssm",
+        "describe-parameters",
+        "--parameter-filters",
+        `Key=Name,Option=BeginsWith,Values=/kungfu/burst/macos/${plan.campaign.id}/`,
+        "--output",
+        "json",
+      ],
+      "macOS campaign JIT parameter inventory",
+    ).Parameters || [];
+  if (parameters.length !== 0) {
+    throw new Error("macOS campaign already has SSM JIT parameters");
+  }
+  const runners =
+    ghJson(
+      ["api", `repos/${plan.repository}/actions/runners?per_page=100`],
+      undefined,
+      "macOS campaign runner inventory",
+    ).runners || [];
+  const matchingRunners = runners.filter((runner) =>
+    (runner.labels || []).some((label) =>
+      String(label.name || label).startsWith(MACOS_JIT_RUNNER_LABEL_PREFIX),
+    ),
+  );
+  if (matchingRunners.length !== 0) {
+    throw new Error("macOS campaign already has a registered JIT runner");
+  }
+  const evidenceObjectCounts = {};
+  for (const sourceSha of [plan.previousSource.sha, plan.source.sha]) {
+    const evidence = awsJson(
+      plan,
+      profile,
+      [
+        "s3api",
+        "list-objects-v2",
+        "--bucket",
+        plan.aws.evidenceBucket,
+        "--prefix",
+        `macos/${sourceSha}/`,
+        "--max-keys",
+        "1",
+        "--output",
+        "json",
+      ],
+      `macOS campaign evidence inventory for ${sourceSha}`,
+    );
+    const count = Number(
+      evidence.KeyCount || (evidence.Contents || []).length || 0,
+    );
+    if (count !== 0) {
+      throw new Error(
+        `macOS campaign source ${sourceSha} already has bootstrap evidence`,
+      );
+    }
+    evidenceObjectCounts[sourceSha] = count;
+  }
+  return {
+    priorRuns: campaignRunsWithNoWork(plan),
+    jitParameterCount: parameters.length,
+    runnerCount: matchingRunners.length,
+    evidenceObjectCounts,
+  };
+}
+
+function assertMacosJitSourceRebindPreflight(plan, profile) {
+  const controlPlane = assertMacosBudgetLaunchGate(plan, profile);
+  const source = assertSourceLineage(plan);
+  const resources = readOwnedCampaignResources(plan, profile);
+  assertExactCampaignInventory(plan, profile, resources);
+  const residue = assertZeroCampaignResidue(plan, profile);
+  return {
+    ...controlPlane,
+    ...source,
+    ...residue,
+    resourceIds: {
+      hostId: resources.host.HostId,
+      instanceId: resources.instance.InstanceId,
+      volumeId: resources.volume.VolumeId,
+    },
+  };
+}
+function setCampaignSourceTags(plan, profile, sourceSha) {
+  requireSuccess(
+    commandResult(
+      "aws",
+      awsArgs(plan, profile, [
+        "ec2",
+        "create-tags",
+        "--resources",
+        plan.aws.hostId,
+        plan.aws.instanceId,
+        plan.aws.volumeId,
+        "--tags",
+        `Key=kungfu:source-sha,Value=${sourceSha}`,
+      ]),
+    ),
+    `macOS campaign source tag update to ${sourceSha}`,
+  );
+}
+
+function updateCampaignSourceRef(plan, sourceSha, force) {
+  requireSuccess(
+    commandResult("gh", [
+      "api",
+      "--method",
+      "PATCH",
+      sourceRefApiPath(plan),
+      "-f",
+      `sha=${sourceSha}`,
+      "-F",
+      `force=${force ? "true" : "false"}`,
+    ]),
+    `macOS campaign source ref update to ${sourceSha}`,
+  );
+}
+
+function assertReboundResources(plan, profile) {
+  const resources = [
+    awsJson(
+      plan,
+      profile,
+      [
+        "ec2",
+        "describe-hosts",
+        "--host-ids",
+        plan.aws.hostId,
+        "--output",
+        "json",
+      ],
+      "macOS campaign rebound host readback",
+    ).Hosts?.[0],
+    awsJson(
+      plan,
+      profile,
+      [
+        "ec2",
+        "describe-instances",
+        "--instance-ids",
+        plan.aws.instanceId,
+        "--output",
+        "json",
+      ],
+      "macOS campaign rebound instance readback",
+    ).Reservations?.[0]?.Instances?.[0],
+    awsJson(
+      plan,
+      profile,
+      [
+        "ec2",
+        "describe-volumes",
+        "--volume-ids",
+        plan.aws.volumeId,
+        "--output",
+        "json",
+      ],
+      "macOS campaign rebound volume readback",
+    ).Volumes?.[0],
+  ];
+  for (const resource of resources) {
+    if (!resource)
+      throw new Error("macOS campaign source rebind readback failed");
+    assertOwnership(resource.Tags, plan);
+  }
+  const ref = ghJson(
+    ["api", sourceRefApiPath(plan)],
+    undefined,
+    "macOS campaign rebound source ref readback",
+  );
+  if (ref.object?.sha !== plan.source.sha) {
+    throw new Error("macOS campaign rebound source ref readback mismatch");
+  }
+}
+
+export function executeMacosJitSourceRebind(plan, { profile = "" } = {}) {
+  if (
+    plan?.contract !== AWS_MACOS_JIT_CONTROLLER_CONTRACT ||
+    plan.kind !== "campaign-source-rebind-plan"
+  ) {
+    throw new Error("macOS JIT source rebind plan contract is invalid");
+  }
+  const preflight = assertMacosJitSourceRebindPreflight(plan, profile);
+  const runtimePlan = {
+    ...plan,
+    aws: { ...plan.aws, volumeId: preflight.resourceIds.volumeId },
+  };
+  let tagsUpdated = false;
+  let refUpdated = false;
+  try {
+    setCampaignSourceTags(runtimePlan, profile, plan.source.sha);
+    tagsUpdated = true;
+    updateCampaignSourceRef(runtimePlan, plan.source.sha, false);
+    refUpdated = true;
+    assertReboundResources(runtimePlan, profile);
+  } catch (error) {
+    const rollbackFailures = [];
+    const rollback = (operation) => {
+      try {
+        operation();
+      } catch (rollbackError) {
+        rollbackFailures.push(rollbackError.message || String(rollbackError));
+      }
+    };
+    if (refUpdated) {
+      rollback(() =>
+        updateCampaignSourceRef(runtimePlan, plan.previousSource.sha, true),
+      );
+    }
+    if (tagsUpdated) {
+      rollback(() =>
+        setCampaignSourceTags(runtimePlan, profile, plan.previousSource.sha),
+      );
+    }
+    const detail = rollbackFailures.length
+      ? `; compensated rollback failed: ${rollbackFailures.join("; ")}`
+      : "; compensated rollback completed";
+    throw new Error(`${error.message || error}${detail}`);
+  }
+  return {
+    schemaVersion: 1,
+    contract: AWS_MACOS_JIT_CONTROLLER_CONTRACT,
+    kind: "campaign-source-rebind-result",
+    status: "rebound-zero-allocation",
+    repository: plan.repository,
+    campaign: plan.campaign,
+    previousSource: plan.previousSource,
+    source: plan.source,
+    github: {
+      workflowId: plan.github.workflowId,
+      workflowState: preflight.workflowState,
+      sourceRefUpdated: true,
+    },
+    aws: {
+      region: plan.aws.region,
+      ...preflight.resourceIds,
+      sourceTagsUpdated: true,
+    },
+    preflight,
+    paidCapacityCreated: false,
+    jobDispatched: false,
+    planDigest: plan.digest,
+  };
+}

package/scripts/buildchain-channel-router.mjs

@@ -105,8 +105,24 @@ export function resolveBuildchainChannel({
     if (channel !== "auto" && explicitRef.kind !== "override" && channel !== explicitRef.kind) {
       throw new Error(`buildchain-channel=${channel} conflicts with buildchain-ref=${explicitRef.ref}`);
     }
-    if (channel !== "auto" && explicitRef.kind === "override") {
-      throw new Error("train, authority, and exact-SHA buildchain-ref overrides require buildchain-channel=auto");
+    if (explicitRef.kind === "override") {
+      const lane = resolveBuildchainChannel({
+        requestedChannel: channel,
+        requestedRef: "",
+        publishChannel,
+        eventName,
+        gitRef,
+        releasePrerelease,
+        routerRef: `v${major}`,
+        packageVersion,
+      });
+      return {
+        ...lane,
+        major,
+        buildchainRef: explicitRef.ref,
+        selectionSource: "explicit-buildchain-ref+channel-evidence",
+        reason: `trusted runtime override ${explicitRef.ref} bound to ${lane.channel}`,
+      };
     }
     return {
       channel: explicitRef.kind,

package/scripts/buildchain-cli-help.mjs

@@ -67,6 +67,7 @@ export const BUILDCHAIN_USAGE = `Usage:
                                     [--kfd-3-prebuild-witness-json <json-or-path>]...
                                     [--kfd-3-artifact-witness-json <json-or-path>]...
                                     [--kfd-3-artifact-verify-cmd <command>]
+                                    [--kfd-adopter-manifest-json <json-or-path>]
                                     [--kfd-support-matrix-json <json-or-path>]
                                     [--kfd-product-gate-json <json-or-path>]...
                                     [--invariant-passport-json <json-or-path>]...
@@ -190,10 +191,11 @@ export const BUILDCHAIN_USAGE = `Usage:
   buildchain kfd 7 schema [--schema <name>] [--json]
   buildchain kfd 7 gate --input-json <file-or-json> [--cwd <dir>] [--output <file>] [--json]
   buildchain kfd 7 verify --gate-json <file-or-json> [--expected-source-sha <sha>] [--json]
-  buildchain kfd support project --matrix-json <file-or-json> --gate-json <file-or-json>...
+  buildchain kfd support project --manifest-json <file-or-json> --manifest-gate-json <file-or-json>
                                   [--expected-source-sha <sha>] [--checked-at <date-time>]
                                   [--output <file>] [--json]
-  buildchain kfd support verify --projection-json <file-or-json>
+  buildchain kfd support verify --projection-json <file-or-json> --manifest-json <file-or-json>
+                                  --manifest-gate-json <file-or-json>
                                   [--expected-source-sha <sha>] [--checked-at <date-time>] [--json]
   buildchain sample process-tree [--interval-ms <n>] [--label <name>]
                                  [--output <jsonl>] [--summary-output <json>]

package/scripts/buildchain-contract-lock.mjs

@@ -69,6 +69,10 @@ export function checkBuildchainContractLock({
   runtimeSha = env("BUILDCHAIN_RUNTIME_SHA"),
   runtimeClass = env("BUILDCHAIN_RUNTIME_CLASS"),
   compatibilityPolicy = env("BUILDCHAIN_CONTRACT_COMPATIBILITY_POLICY"),
+  workflowShellRef = env("BUILDCHAIN_WORKFLOW_SHELL_REF"),
+  expectedChannel = env("BUILDCHAIN_EXPECTED_CHANNEL"),
+  expectedMajor = env("BUILDCHAIN_EXPECTED_MAJOR"),
+  allowOpaqueRuntime = boolEnv("BUILDCHAIN_ALLOW_OPAQUE_RUNTIME"),
   issueMode = env("BUILDCHAIN_CONTRACT_DRIFT_ISSUE_MODE", "compatible-and-breaking"),
   issueBodyPath = env("BUILDCHAIN_CONTRACT_DRIFT_ISSUE_BODY", ".buildchain/contract-drift/issue-body.md"),
   repository = env("GITHUB_REPOSITORY"),
@@ -84,6 +88,10 @@ export function checkBuildchainContractLock({
     runtimeSha,
     runtimeClass,
     compatibilityPolicy,
+    workflowShellRef,
+    expectedChannel,
+    expectedMajor,
+    allowOpaqueRuntime,
   });
   const shouldIssue = issueModeAllows(issueMode, evaluation);
   if (shouldIssue) {
@@ -104,6 +112,8 @@ export function checkBuildchainContractLock({
     `- Compatible: \`${evaluation.compatible ? "true" : "false"}\``,
     `- Runtime ref: \`${runtimeRef || "(unknown)"}\``,
     `- Runtime SHA: \`${runtimeSha || "(unknown)"}\``,
+    `- Workflow shell ref: \`${workflowShellRef || "(unknown)"}\``,
+    evaluation.channelBinding ? `- Bound channel: \`${evaluation.channelBinding.channel || "(unknown)"}\`` : "",
     `- Contract digest: \`${current.contractDigest}\``,
     `- Compatibility digest: \`${current.compatibilityDigest}\``,
     `- Compatibility proof registry: \`${current.compatibilityProofRegistryRoot || "(legacy)"}\``,
@@ -128,7 +138,7 @@ export function checkBuildchainContractLock({
     "current-buildchain-sha": runtimeSha || "",
   });
   if (!evaluation.ok) {
-    throw new Error(`Buildchain contract drift is not compatible: ${(evaluation.reasons || []).join("; ")}`);
+    throw new Error(`Buildchain contract lock rejected: ${(evaluation.reasons || []).join("; ")}`);
   }
   return { evaluation, current, shouldIssue };
 }

package/scripts/check-inventory.mjs

@@ -215,7 +215,7 @@ const selfDogfoodAlphaEvaluation = evaluateBuildchainContractLock({
   }),
   runtimeRef: `v${selfDogfoodMajor}-alpha`,
   runtimeSha: "current-development-contract",
-  runtimeClass: "alpha",
+  runtimeClass: "alpha", workflowShellRef: `v${selfDogfoodMajor}-alpha`,
 });
 if (
   !canAdmitSelfDogfoodLockEvaluation({
@@ -304,7 +304,7 @@ if (!promotionOverrideAuthorization.includes("promotion runtime override is only
 }
 for (const requiredSnippet of [
   "buildchain-channel:",
-  "uses: ./.github/workflows/.build.yml",
+  "uses: kungfu-systems/buildchain/.github/workflows/.build.yml@v3-alpha", "uses: kungfu-systems/buildchain/.github/workflows/.build.yml@v3\n",
   "needs.resolve-channel.outputs.buildchain-ref",
   "needs.resolve-channel.outputs.contract-lock-path",
 ]) {
@@ -1019,8 +1019,8 @@ for (const requiredSnippet of [
   "release-passport-kfd-3-artifact-witness-jsons:",
   "release-passport-kfd-3-artifact-witness-jsons: ${{ inputs.release-passport-kfd-3-artifact-witness-jsons }}",
   "release-passport-kfd-3-artifact-verify-command:",
-  "release-passport-kfd-support-matrix-json:",
-  "release-passport-kfd-support-matrix-json: ${{ inputs.release-passport-kfd-support-matrix-json }}",
+  "release-passport-kfd-adopter-manifest-json:", "release-passport-kfd-adopter-manifest-json: ${{ inputs.release-passport-kfd-adopter-manifest-json }}",
+  "release-passport-kfd-support-matrix-json:", "release-passport-kfd-support-matrix-json: ${{ inputs.release-passport-kfd-support-matrix-json }}",
   "release-passport-kfd-product-gate-jsons:",
   "release-passport-kfd-product-gate-jsons: ${{ inputs.release-passport-kfd-product-gate-jsons }}",
   "release-passport-invariant-passport-jsons:",