@kungfu-tech/buildchain 3.0.9-alpha.9 → 4.0.0-alpha.0

package/scripts/init-repo.mjs

@@ -3,35 +3,15 @@ import fs from "node:fs";
 import path from "node:path";
 import { pathToFileURL } from "node:url";
 import { BUILDCHAIN_CONFIG_PATH } from "../packages/core/buildchain-layout.js";
-import {
-  detectPackageManager,
-  assertPackageManager,
-} from "../packages/core/package-manager.js";
-import {
-  PUBLICATION_REHEARSAL_WORKFLOW_PATH,
-  appendPublicationRehearsalToml,
-  mergePublicationRehearsalAgentInstructions,
-  publicationRehearsalWorkflow,
-} from "../packages/core/publication-rehearsal-projection.js";
-import {
-  appendNextDevelopmentToml,
-  mergeNextDevelopmentAgentInstructions,
-  nextDevelopmentWorkflowHeader,
-} from "../packages/core/next-development-projection.js";
-
-const BUILDCHAIN_WORKFLOW_REF =
-  "kungfu-systems/buildchain/.github/workflows/.build.yml@v3";
-const DEFAULT_PUBLICATION_LATEX_IMAGE =
-  "ghcr.io/kungfu-systems/build-images/latex-pdf-builder";
-const DEFAULT_PUBLICATION_LATEX_DIGEST =
-  "sha256:c20f3809e96836c1c78e97c76939d12f1de3fed0ea9b7c40c43332ec2ea480f8";
-const DEFAULT_PUBLICATION_LATEX_COMMAND =
-  "latexmk -pdf -outdir=_build paper/main.tex";
+import { detectPackageManager, assertPackageManager } from "../packages/core/package-manager.js";
+
+const BUILDCHAIN_WORKFLOW_REF = "kungfu-systems/buildchain/.github/workflows/.build.yml@v4";
+const DEFAULT_PUBLICATION_LATEX_IMAGE = "ghcr.io/kungfu-systems/build-images/latex-pdf-builder";
+const DEFAULT_PUBLICATION_LATEX_DIGEST = "sha256:c20f3809e96836c1c78e97c76939d12f1de3fed0ea9b7c40c43332ec2ea480f8";
+const DEFAULT_PUBLICATION_LATEX_COMMAND = "latexmk -pdf -outdir=_build paper/main.tex";
 
 function posixPath(value) {
-  return String(value || "")
-    .split(path.sep)
-    .join("/");
+  return String(value || "").split(path.sep).join("/");
 }
 
 function repoName(cwd) {
@@ -296,42 +276,34 @@ command = "make check"
 }
 
 function infraContractDesiredJson(cwd) {
-  return `${JSON.stringify(
-    {
-      service: repoName(cwd),
-      environment: "staging",
-      resources: [
-        {
-          kind: "static-site",
-          name: repoName(cwd),
-          desiredState: {
-            hostname: "staging.example.com",
-            accessControl: "managed-network",
-            owner: "platform",
-          },
+  return `${JSON.stringify({
+    service: repoName(cwd),
+    environment: "staging",
+    resources: [
+      {
+        kind: "static-site",
+        name: repoName(cwd),
+        desiredState: {
+          hostname: "staging.example.com",
+          accessControl: "managed-network",
+          owner: "platform",
         },
-      ],
-    },
-    null,
-    2,
-  )}\n`;
+      },
+    ],
+  }, null, 2)}\n`;
 }
 
 function infraContractOutputsJson(cwd) {
-  return `${JSON.stringify(
-    {
-      service: repoName(cwd),
-      environment: "staging",
-      observedMode: "manual-observed",
-      outputs: {
-        hostname: "staging.example.com",
-        distributionId: "observed-distribution-id",
-        bucket: "observed-bucket-name",
-      },
+  return `${JSON.stringify({
+    service: repoName(cwd),
+    environment: "staging",
+    observedMode: "manual-observed",
+    outputs: {
+      hostname: "staging.example.com",
+      distributionId: "observed-distribution-id",
+      bucket: "observed-bucket-name",
     },
-    null,
-    2,
-  )}\n`;
+  }, null, 2)}\n`;
 }
 
 function workflowArtifactPaths(type) {
@@ -355,7 +327,7 @@ function workflowArtifactPaths(type) {
 }
 
 function publicationWorkflowYaml() {
-  return `${nextDevelopmentWorkflowHeader()}name: Build
+  return `name: Build
 
 on:
   workflow_dispatch:
@@ -377,7 +349,7 @@ permissions:
 
 jobs:
   publication:
-    uses: kungfu-systems/buildchain/.github/workflows/publication-artifact.yml@v3
+    uses: kungfu-systems/buildchain/.github/workflows/publication-artifact.yml@v4
     with:
       buildchain-ref: \${{ inputs.buildchain-ref || '' }}
       toolchain-type: config
@@ -387,7 +359,9 @@ jobs:
 }
 
 function workflowYaml({ type, runnerPreset, artifactName }) {
-  return `${nextDevelopmentWorkflowHeader()}name: Build
+  return `# Buildchain v4 lifecycle checkpoints are governed by architecture/v4-platform-stage-checkpoints.json.
+# Do not add undeclared runner-only inputs, outputs, environment, or provider effects.
+name: Build
 
 on:
   workflow_dispatch:
@@ -420,32 +394,15 @@ jobs:
 `;
 }
 
-function devDeliveryWorkflowYaml() {
-  return fs.readFileSync(
-    new URL("../templates/native-dev-delivery.yml", import.meta.url),
-    "utf8",
-  );
-}
 function writeIfAllowed(filePath, content, { force }) {
   if (fs.existsSync(filePath) && !force) {
-    throw new Error(
-      `${posixPath(filePath)} already exists; pass --force to overwrite`,
-    );
+    throw new Error(`${posixPath(filePath)} already exists; pass --force to overwrite`);
   }
   fs.mkdirSync(path.dirname(filePath), { recursive: true });
   fs.writeFileSync(filePath, content);
   return filePath;
 }
 
-function writeManagedAgentEntry(filePath, current) {
-  const content = mergeNextDevelopmentAgentInstructions(
-    mergePublicationRehearsalAgentInstructions(current),
-  );
-  fs.mkdirSync(path.dirname(filePath), { recursive: true });
-  fs.writeFileSync(filePath, content);
-  return filePath;
-}
-
 export function initBuildchainRepo({
   cwd = process.cwd(),
   type = "package",
@@ -456,43 +413,30 @@ export function initBuildchainRepo({
 } = {}) {
   const resolvedCwd = path.resolve(cwd);
   const manager = detectOrDefaultPackageManager(resolvedCwd, packageManager);
-  const toml = appendNextDevelopmentToml(
-    appendPublicationRehearsalToml(
-      (() => {
-        if (type === "package") {
-          return packageToml(resolvedCwd, manager);
-        }
-        if (type === "native") {
-          return nativeToml(resolvedCwd);
-        }
-        if (type === "web-surface") {
-          return webSurfaceToml(resolvedCwd);
-        }
-        if (type === "infra-contract") {
-          return infraContractToml(resolvedCwd);
-        }
-        if (type === "publication-artifact") {
-          return publicationArtifactToml(resolvedCwd);
-        }
-        if (type === "anchored-package") {
-          return anchoredPackageToml(resolvedCwd, manager);
-        }
-        throw new Error(
-          "init --type must be one of package, native, web-surface, infra-contract, publication-artifact, or anchored-package",
-        );
-      })(),
-    ),
-  );
-
-  const agentsPath = path.join(resolvedCwd, "AGENTS.md");
-  const currentAgents = fs.existsSync(agentsPath)
-    ? fs.readFileSync(agentsPath, "utf8")
-    : "";
+  const toml = (() => {
+    if (type === "package") {
+      return packageToml(resolvedCwd, manager);
+    }
+    if (type === "native") {
+      return nativeToml(resolvedCwd);
+    }
+    if (type === "web-surface") {
+      return webSurfaceToml(resolvedCwd);
+    }
+    if (type === "infra-contract") {
+      return infraContractToml(resolvedCwd);
+    }
+    if (type === "publication-artifact") {
+      return publicationArtifactToml(resolvedCwd);
+    }
+    if (type === "anchored-package") {
+      return anchoredPackageToml(resolvedCwd, manager);
+    }
+    throw new Error("init --type must be one of package, native, web-surface, infra-contract, publication-artifact, or anchored-package");
+  })();
 
   const written = [
-    writeIfAllowed(path.join(resolvedCwd, BUILDCHAIN_CONFIG_PATH), toml, {
-      force,
-    }),
+    writeIfAllowed(path.join(resolvedCwd, BUILDCHAIN_CONFIG_PATH), toml, { force }),
     writeIfAllowed(
       path.join(resolvedCwd, ".github", "workflows", "build.yml"),
       type === "publication-artifact"
@@ -504,49 +448,16 @@ export function initBuildchainRepo({
           }),
       { force },
     ),
-    writeIfAllowed(
-      path.join(resolvedCwd, PUBLICATION_REHEARSAL_WORKFLOW_PATH),
-      publicationRehearsalWorkflow("v3"),
-      { force },
-    ),
-    writeManagedAgentEntry(agentsPath, currentAgents),
   ];
 
-  if (type === "native") {
-    written.push(
-      writeIfAllowed(
-        path.join(resolvedCwd, ".github", "workflows", "dev-delivery.yml"),
-        devDeliveryWorkflowYaml(),
-        { force },
-      ),
-    );
-  }
-
-  if (
-    type === "anchored-package" &&
-    !fs.existsSync(path.join(resolvedCwd, "release.json"))
-  ) {
-    written.push(
-      writeIfAllowed(
-        path.join(resolvedCwd, "release.json"),
-        '{\n  "upstream": "",\n  "version": "0.0.0"\n}\n',
-        { force },
-      ),
-    );
+  if (type === "anchored-package" && !fs.existsSync(path.join(resolvedCwd, "release.json"))) {
+    written.push(writeIfAllowed(path.join(resolvedCwd, "release.json"), "{\n  \"upstream\": \"\",\n  \"version\": \"0.0.0\"\n}\n", { force }));
   }
 
   if (type === "infra-contract") {
     written.push(
-      writeIfAllowed(
-        path.join(resolvedCwd, "infra", "desired.json"),
-        infraContractDesiredJson(resolvedCwd),
-        { force },
-      ),
-      writeIfAllowed(
-        path.join(resolvedCwd, "infra", "outputs.json"),
-        infraContractOutputsJson(resolvedCwd),
-        { force },
-      ),
+      writeIfAllowed(path.join(resolvedCwd, "infra", "desired.json"), infraContractDesiredJson(resolvedCwd), { force }),
+      writeIfAllowed(path.join(resolvedCwd, "infra", "outputs.json"), infraContractOutputsJson(resolvedCwd), { force }),
     );
   }
 
@@ -556,9 +467,7 @@ export function initBuildchainRepo({
     cwd: resolvedCwd,
     packageManager: manager,
     workflowRef: BUILDCHAIN_WORKFLOW_REF,
-    written: written.map((filePath) =>
-      posixPath(path.relative(resolvedCwd, filePath)),
-    ),
+    written: written.map((filePath) => posixPath(path.relative(resolvedCwd, filePath))),
   };
 }
 
@@ -570,11 +479,7 @@ function readArg(name, fallback = "") {
   return process.argv[index + 1] || "";
 }
 
-if (
-  !process.env.BUILDCHAIN_EMBEDDED_ENTRYPOINT &&
-  process.argv[1] &&
-  import.meta.url === pathToFileURL(process.argv[1]).href
-) {
+if (!process.env.BUILDCHAIN_EMBEDDED_ENTRYPOINT && process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
   try {
     const result = initBuildchainRepo({
       cwd: readArg("cwd", process.cwd()),

package/scripts/inspect-artifact-signing-requests.mjs

@@ -82,10 +82,6 @@ export function inspectArtifactSigningRequests({
       if (seen.has(key))
         throw new Error(`duplicate artifact signing request: ${key}`);
       seen.add(key);
-      const {
-        entitlementsProfile = "none",
-        entitlementsPaths = [],
-      } = request.signature;
       const item = {
         id: request.artifact.id,
         slug: safeId(request.artifact.id),
@@ -108,8 +104,6 @@ export function inspectArtifactSigningRequests({
         sourceSha: request.source.sha,
         sourceTreeSha: request.source.treeSha,
         transportFormat: request.artifact.transport?.format || "",
-        entitlementsProfile,
-        entitlementsPaths: entitlementsPaths.join(","),
       };
       if (request.signature.profile === "detached-signature-v1")
         matrices.detached.push(item);

package/scripts/locked-source-checkout.mjs

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-import { execFileSync } from "node:child_process";
 import crypto from "node:crypto";
 import fs from "node:fs";
 import path from "node:path";
@@ -113,12 +112,12 @@ function ensureCheckoutTarget(targetPath, workspace) {
 function git(args, { cwd, env = {}, timeoutMs = 60000, stdio = ["ignore", "pipe", "pipe"] } = {}) {
   try {
     const commandEnv = { ...process.env, ...env };
-    const output = args[0] === "fetch" ? runGitFetchSync({ args, cwd, env: commandEnv, timeoutMs, stdio }) : execFileSync("git", args, {
+    const output = runGitFetchSync({
+      args,
       cwd,
       env: commandEnv,
-      encoding: "utf8",
+      timeoutMs,
       stdio,
-      timeout: timeoutMs,
     });
     return output ? String(output).trim() : "";
   } catch (error) {

package/scripts/maintainability-metrics.mjs

@@ -11,6 +11,7 @@ import {
 } from "./check-internal-architecture.mjs";
 
 const JS_EXTENSIONS = new Set([".js", ".mjs", ".cjs"]);
+const HAND_MAINTAINED_EXTENSIONS = new Set([...JS_EXTENSIONS, ".rs"]);
 const GENERATED_PATTERN = /^actions\/[^/]+\/dist\/.*\.js$/u;
 
 function gitText(root, args, encoding = "utf8") {
@@ -50,7 +51,7 @@ function isGeneratedFile(file) {
 
 function isHandMaintainedSource(file) {
   return (
-    JS_EXTENSIONS.has(path.extname(file)) &&
+    HAND_MAINTAINED_EXTENSIONS.has(path.extname(file)) &&
     !isTestFile(file) &&
     !isGeneratedFile(file)
   );
@@ -260,7 +261,12 @@ function collectMaintainabilityMetrics({
   const sourceMetrics = Object.fromEntries(
     sourceFiles.map((file) => {
       const source = readTrackedFile(root, file, revision);
-      return [file, analyzeJavaScript(file, source)];
+      return [
+        file,
+        JS_EXTENSIONS.has(path.extname(file))
+          ? analyzeJavaScript(file, source)
+          : { lines: lineCount(source), complexity: 0, functions: [] },
+      ];
     }),
   );
   const sumLines = (entries) =>

package/scripts/npm-publish-dry-run.mjs

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
-import { spawnSync } from "node:child_process";
 import fs from "node:fs";
 import path from "node:path";
 import { pathToFileURL } from "node:url";
+import { spawnSyncCommand } from "../packages/core/spawn-command.js";
 
 const EXACT_TAG_PATTERN = /^v\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/;
 
@@ -27,7 +27,7 @@ function hasFlag(argv, name) {
 }
 
 function runCommand({ cwd, cmd, args }) {
-  const result = spawnSync(cmd, args, {
+  const result = spawnSyncCommand(cmd, args, {
     cwd,
     env: process.env,
     encoding: "utf8",

package/scripts/npm-publish-transaction.mjs

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
-import { spawnSync } from "node:child_process";
 import crypto from "node:crypto";
 import fs from "node:fs";
 import path from "node:path";
 import { pathToFileURL } from "node:url";
+import { spawnSyncCommand } from "../packages/core/spawn-command.js";
 
 const EXACT_TAG_PATTERN = /^v\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/;
 
@@ -24,7 +24,7 @@ function readEnv(name, fallback = "") {
 }
 
 function runNpm({ cwd, args, allowFailure = false }) {
-  const result = spawnSync("npm", args, {
+  const result = spawnSyncCommand("npm", args, {
     cwd,
     env: process.env,
     encoding: "utf8",

package/scripts/publication-commit-evidence.mjs

@@ -7,12 +7,6 @@ import { pathToFileURL } from "node:url";
 
 const SCHEMA = "kungfu-buildchain-publication-commit-evidence/v1";
 const INSTALLER_BUNDLE_SCHEMA = "kungfu.installer-publication-bundle/v1";
-const RELEASE_REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308]);
-const RELEASE_REDIRECT_HOSTS = new Set([
-  "github.com",
-  "release-assets.githubusercontent.com",
-  "objects.githubusercontent.com",
-]);
 
 function requiredString(value, label) {
   if (typeof value !== "string" || value.trim() === "") {
@@ -110,7 +104,7 @@ function validateInstallerBundle(evidence, expected) {
   }
   if (
     exactSha(bundle.sourceCommit, "installerBundle.sourceCommit") !==
-      expected.candidateSourceSha ||
+      expected.sourceSha ||
     !["alpha", "stable"].includes(bundle.channel)
   ) {
     throw new Error("installer bundle release identity mismatch");
@@ -234,7 +228,6 @@ function validateInstallerBundle(evidence, expected) {
   return {
     schema: bundle.schema,
     bundleRoot,
-    sourceCommit: bundle.sourceCommit,
     manifestDigest: bundle.manifestDigest,
     channel: bundle.channel,
     channelPayloadRoot: bundle.channelPayloadRoot,
@@ -245,9 +238,10 @@ function validateInstallerBundle(evidence, expected) {
     assets: bundle.assets,
   };
 }
+
 export function validatePublicationCommitEvidence(
   evidence,
-  { version, sourceSha, candidateSourceSha, releaseSha, releaseTag } = {},
+  { version, sourceSha, releaseSha, releaseTag } = {},
 ) {
   if (!evidence || typeof evidence !== "object" || Array.isArray(evidence)) {
     throw new Error("publication commit evidence must be an object");
@@ -270,17 +264,6 @@ export function validatePublicationCommitEvidence(
       throw new Error(`publication commit evidence ${field} mismatch`);
     }
   }
-  expected.candidateSourceSha = exactSha(
-    candidateSourceSha ?? identity.candidateSourceSha ?? expected.sourceSha,
-    "expected candidateSourceSha",
-  );
-  if (
-    identity.candidateSourceSha !== undefined &&
-    exactSha(identity.candidateSourceSha, "identity.candidateSourceSha") !==
-      expected.candidateSourceSha
-  ) {
-    throw new Error("publication commit evidence candidateSourceSha mismatch");
-  }
   const publicUrl = publicHttps(evidence.publication?.url, "publication.url");
   const payloadRoot = sha256Root(
     evidence.publication?.payloadRoot,
@@ -330,47 +313,15 @@ export async function verifyInstallerBundleReadback(
   if (typeof fetchImpl !== "function") {
     throw new Error("installer bundle read-back requires fetch");
   }
-  const fetchReleaseReadback = async (url, label) => {
-    let current = url;
-    for (let hop = 0; hop <= 3; hop += 1) {
-      const response = await fetchImpl(current, {
-        redirect: "manual",
-        cache: "no-store",
-      });
-      if (response.status === 200) return response;
-      if (!RELEASE_REDIRECT_STATUSES.has(response.status)) {
-        throw new Error(`${label} failed: HTTP ${response.status}`);
-      }
-      if (hop === 3) {
-        throw new Error(`${label} exceeded the bounded redirect limit`);
-      }
-      const location = response.headers?.get?.("location");
-      if (!location) {
-        throw new Error(`${label} redirect omitted Location`);
-      }
-      const redirect = new URL(location, current);
-      if (
-        redirect.protocol !== "https:" ||
-        redirect.username ||
-        redirect.password ||
-        !RELEASE_REDIRECT_HOSTS.has(redirect.hostname) ||
-        (redirect.hostname === "github.com" &&
-          !redirect.pathname.startsWith(
-            "/kungfu-systems/kungfu/releases/download/",
-          ))
-      ) {
-        throw new Error(
-          `${label} redirected outside trusted GitHub release storage`,
-        );
-      }
-      current = redirect.href;
-    }
-    throw new Error(`${label} failed without a terminal response`);
-  };
-  const manifestResponse = await fetchReleaseReadback(
-    result.publicUrl,
-    "installer bundle manifest read-back",
-  );
+  const manifestResponse = await fetchImpl(result.publicUrl, {
+    redirect: "manual",
+    cache: "no-store",
+  });
+  if (manifestResponse.status !== 200) {
+    throw new Error(
+      `installer bundle manifest read-back failed: HTTP ${manifestResponse.status}`,
+    );
+  }
   const manifestBytes = Buffer.from(await manifestResponse.arrayBuffer());
   if (digest(manifestBytes) !== bundle.manifestDigest) {
     throw new Error("installer bundle manifest digest mismatch");
@@ -385,7 +336,7 @@ export async function verifyInstallerBundleReadback(
     semanticRoot(unsigned) !== bundle.bundleRoot ||
     manifest.package?.name !== "@kungfu-tech/site" ||
     typeof manifest.package?.version !== "string" ||
-    manifest.identity?.sourceCommit !== result.identity.candidateSourceSha ||
+    manifest.identity?.sourceCommit !== result.identity.sourceSha ||
     manifest.identity?.releaseSha !== result.identity.releaseSha ||
     manifest.identity?.releaseTag !== result.identity.releaseTag ||
     manifest.identity?.version !== result.identity.version ||
@@ -414,10 +365,15 @@ export async function verifyInstallerBundleReadback(
   for (const asset of bundle.assets) {
     let observation = byUrl.get(asset.releaseUrl);
     if (!observation) {
-      const response = await fetchReleaseReadback(
-        asset.releaseUrl,
-        "installer bundle asset read-back",
-      );
+      const response = await fetchImpl(asset.releaseUrl, {
+        redirect: "manual",
+        cache: "no-store",
+      });
+      if (response.status !== 200) {
+        throw new Error(
+          `installer bundle asset read-back failed: HTTP ${response.status}`,
+        );
+      }
       const bytes = Buffer.from(await response.arrayBuffer());
       observation = {
         releaseUrl: asset.releaseUrl,
@@ -438,7 +394,7 @@ export async function verifyInstallerBundleReadback(
     schema: "kungfu-buildchain-installer-publication-bundle-seal/v1",
     bundleRoot: bundle.bundleRoot,
     manifestDigest: bundle.manifestDigest,
-    sourceCommit: result.identity.candidateSourceSha,
+    sourceCommit: result.identity.sourceSha,
     releaseTag: result.identity.releaseTag,
     releasePassport: bundle.releasePassport,
     observations,
@@ -453,8 +409,6 @@ async function main(args) {
     if (value === "--evidence") options.evidence = args[++index];
     else if (value === "--version") options.version = args[++index];
     else if (value === "--source-sha") options.sourceSha = args[++index];
-    else if (value === "--candidate-source-sha")
-      options.candidateSourceSha = args[++index];
     else if (value === "--release-sha") options.releaseSha = args[++index];
     else if (value === "--release-tag") options.releaseTag = args[++index];
     else throw new Error(`unknown argument: ${value}`);

package/scripts/release-candidate-resolver.mjs

@@ -291,7 +291,7 @@ function readNpmPackageJsonFromTarball(tarballPath) {
   const errors = [];
   for (const candidate of candidates) {
     try {
-      return JSON.parse(execFileSync("tar", ["-xOf", tarballPath, candidate], { encoding: "utf8" }));
+      return JSON.parse(execFileSync("tar", ["-xOf", path.basename(tarballPath), candidate], { cwd: path.dirname(tarballPath), encoding: "utf8" }));
     } catch (error) {
       errors.push(error.stderr?.toString?.().trim() || error.message);
     }
@@ -351,22 +351,16 @@ export function generatePublishRequiredArtifacts({
     const files = Array.isArray(manifest.files) ? manifest.files : [];
     return files
       .filter((file) => file?.sha256)
-      .map((file) => {
-        const name = String(file.path || file.name || manifest.artifactName || platform)
-          .replaceAll("\\", "/")
-          .replace(/^\.\//, "");
-        return {
-          ...(platform ? { group: platform } : {}),
-          kind,
-          name,
-          ref,
-          digest: String(file.sha256).startsWith("sha256:")
-            ? String(file.sha256)
-            : `sha256:${file.sha256}`,
-          role: "platform",
-          platform,
-        };
-      });
+      .map((file) => ({
+        kind,
+        name: packageNameFromArtifactPath(file.path || file.name || manifest.artifactName || platform),
+        ref,
+        digest: String(file.sha256).startsWith("sha256:")
+          ? String(file.sha256)
+          : `sha256:${file.sha256}`,
+        role: "platform",
+        platform,
+      }));
   });
 }