@kungfu-tech/buildchain 4.0.0 → 4.0.1-alpha.10

package/scripts/npm-publish-transaction.mjs

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
 import crypto from "node:crypto";
 import fs from "node:fs";
+import os from "node:os";
 import path from "node:path";
 import { pathToFileURL } from "node:url";
 import { spawnSyncCommand } from "../packages/core/spawn-command.js";
@@ -105,6 +106,20 @@ function sealedPackResult() {
   };
 }
 
+function materializedPackResult({ cwd, registry }) {
+  const temporaryRoot = fs.mkdtempSync(path.join(os.tmpdir(), "buildchain-npm-pack-"));
+  try {
+    const pack = parsePackResult(runNpm({
+      cwd,
+      args: ["pack", "--json", "--pack-destination", temporaryRoot, `--registry=${registry}`],
+    }).stdout);
+    return { ...pack, tarballPath: path.join(temporaryRoot, pack.filename), temporaryRoot };
+  } catch (error) {
+    fs.rmSync(temporaryRoot, { recursive: true, force: true });
+    throw error;
+  }
+}
+
 function parseNpmView(stdout) {
   const raw = String(stdout || "").trim();
   if (!raw) {
@@ -113,8 +128,8 @@ function parseNpmView(stdout) {
   const parsed = JSON.parse(raw);
   const dist = parsed?.dist || parsed;
   return {
-    integrity: dist?.integrity || "",
-    shasum: dist?.shasum || "",
+    integrity: dist?.integrity || parsed?.["dist.integrity"] || "",
+    shasum: dist?.shasum || parsed?.["dist.shasum"] || "",
   };
 }
 
@@ -188,46 +203,11 @@ export function npmPublishTransaction({
   const exactTag = assertPackageVersion({ pkg, expectedVersion });
   const distTag = readEnv("BUILDCHAIN_NPM_DIST_TAG", pkg.version.includes("-") ? "alpha" : "latest");
 
-  const pack =
-    sealedPackResult() ||
-    parsePackResult(
-      runNpm({
-        cwd: resolvedCwd,
-        args: ["pack", "--dry-run", "--json", `--registry=${registry}`],
-      }).stdout,
-    );
+  const pack = sealedPackResult() || materializedPackResult({ cwd: resolvedCwd, registry });
   const digest = artifactDigest(pack);
 
-  const existingDigest = skipRegistryLookup
-    ? undefined
-    : publishedDigest({
-        cwd: resolvedCwd,
-        name: pkg.name,
-        version: pkg.version,
-        registry,
-      });
-  let publishAction = "already-published";
-  if (existingDigest) {
-    if (existingDigest !== digest) {
-      throw new Error(`artifact digest mismatch: npm:${pkg.name}@${pkg.version}`);
-    }
-  } else if (dryRunPublish) {
-    publishAction = "dry-run";
-  } else {
-    runNpm({
-      cwd: resolvedCwd,
-      args: [
-        "publish",
-        ...(pack.tarballPath ? [pack.tarballPath] : []),
-        "--access",
-        access,
-        "--tag",
-        distTag,
-        `--registry=${registry}`,
-      ],
-    });
-    publishAction = "published";
-    const registryDigest = skipRegistryLookup
+  try {
+    const existingDigest = skipRegistryLookup
       ? undefined
       : publishedDigest({
           cwd: resolvedCwd,
@@ -235,60 +215,92 @@ export function npmPublishTransaction({
           version: pkg.version,
           registry,
         });
-    if (registryDigest && registryDigest !== digest) {
-      throw new Error(`artifact digest mismatch: npm:${pkg.name}@${pkg.version}`);
+    let publishAction = "already-published";
+    if (existingDigest) {
+      if (existingDigest !== digest) {
+        throw new Error(`artifact digest mismatch: npm:${pkg.name}@${pkg.version}`);
+      }
+    } else if (dryRunPublish) {
+      publishAction = "dry-run";
+    } else {
+      runNpm({
+        cwd: resolvedCwd,
+        args: [
+          "publish",
+          ...(pack.tarballPath ? [pack.tarballPath] : []),
+          "--access",
+          access,
+          "--tag",
+          distTag,
+          `--registry=${registry}`,
+        ],
+      });
+      publishAction = "published";
+      const registryDigest = skipRegistryLookup
+        ? undefined
+        : publishedDigest({
+            cwd: resolvedCwd,
+            name: pkg.name,
+            version: pkg.version,
+            registry,
+          });
+      if (registryDigest && registryDigest !== digest) {
+        throw new Error(`artifact digest mismatch: npm:${pkg.name}@${pkg.version}`);
+      }
     }
-  }
 
-  const evidencePath = readEnv("BUILDCHAIN_PUBLISH_EVIDENCE");
-  if (!evidencePath) {
-    throw new Error("BUILDCHAIN_PUBLISH_EVIDENCE is required");
-  }
-  const evidence = {
-    schema: 1,
-    version: expectedVersion || pkg.version,
-    channel: readEnv("BUILDCHAIN_CHANNEL"),
-    source_sha: readEnv("BUILDCHAIN_SOURCE_SHA"),
-    release_sha: readEnv("BUILDCHAIN_RELEASE_SHA"),
-    target_ref: readEnv("BUILDCHAIN_TARGET_REF"),
-    release_material_sha: readEnv("BUILDCHAIN_RELEASE_MATERIAL_SHA", readEnv("BUILDCHAIN_RELEASE_SHA")),
-    publish_tooling_sha: readEnv("BUILDCHAIN_PUBLISH_TOOLING_SHA", readEnv("BUILDCHAIN_RELEASE_SHA")),
-    artifacts: [{
-      group: "node",
-      kind: "npm",
-      name: pkg.name,
-      ref: pkg.version,
-      digest,
-    }],
-  };
-  const resolvedEvidencePath = writeEvidence({
-    cwd: resolvedCwd,
-    evidencePath,
-    evidence,
-  });
-  writeGitHubOutputs({
-    version: pkg.version,
-    "exact-tag": exactTag,
-    "dist-tag": distTag,
-    "artifact-digest": digest,
-    "publish-action": publishAction,
-    "publish-evidence": resolvedEvidencePath,
-  });
-  return {
-    schemaVersion: 1,
-    package: {
-      name: pkg.name,
+    const evidencePath = readEnv("BUILDCHAIN_PUBLISH_EVIDENCE");
+    if (!evidencePath) {
+      throw new Error("BUILDCHAIN_PUBLISH_EVIDENCE is required");
+    }
+    const evidence = {
+      schema: 1,
+      version: expectedVersion || pkg.version,
+      channel: readEnv("BUILDCHAIN_CHANNEL"),
+      source_sha: readEnv("BUILDCHAIN_SOURCE_SHA"),
+      release_sha: readEnv("BUILDCHAIN_RELEASE_SHA"),
+      target_ref: readEnv("BUILDCHAIN_TARGET_REF"),
+      release_material_sha: readEnv("BUILDCHAIN_RELEASE_MATERIAL_SHA", readEnv("BUILDCHAIN_RELEASE_SHA")),
+      publish_tooling_sha: readEnv("BUILDCHAIN_PUBLISH_TOOLING_SHA", readEnv("BUILDCHAIN_RELEASE_SHA")),
+      artifacts: [{
+        group: "node",
+        kind: "npm",
+        name: pkg.name,
+        ref: pkg.version,
+        digest,
+      }],
+    };
+    const resolvedEvidencePath = writeEvidence({
+      cwd: resolvedCwd,
+      evidencePath,
+      evidence,
+    });
+    writeGitHubOutputs({
       version: pkg.version,
-    },
-    exactTag,
-    distTag,
-    registry,
-    publishAction,
-    pack,
-    sealedBundleRoot: readEnv("BUILDCHAIN_SEALED_BUNDLE_ROOT"),
-    evidencePath: resolvedEvidencePath,
-    evidence,
-  };
+      "exact-tag": exactTag,
+      "dist-tag": distTag,
+      "artifact-digest": digest,
+      "publish-action": publishAction,
+      "publish-evidence": resolvedEvidencePath,
+    });
+    return {
+      schemaVersion: 1,
+      package: {
+        name: pkg.name,
+        version: pkg.version,
+      },
+      exactTag,
+      distTag,
+      registry,
+      publishAction,
+      pack: { ...pack, temporaryRoot: undefined },
+      sealedBundleRoot: readEnv("BUILDCHAIN_SEALED_BUNDLE_ROOT"),
+      evidencePath: resolvedEvidencePath,
+      evidence,
+    };
+  } finally {
+    if (pack.temporaryRoot) fs.rmSync(pack.temporaryRoot, { recursive: true, force: true });
+  }
 }
 
 function usage() {

package/scripts/promotion-channel-router.mjs

@@ -66,8 +66,8 @@ export function resolvePromotionChannel({
   }
   const shellRef = intent.shellChannel === "alpha" ? `v${selected.major}-alpha` : `v${selected.major}`;
   return {
-    targetRef: intent.targetRef,
-    publicationChannel: intent.publicationChannel,
+    targetRef: intent.targetRef, publicationChannel: intent.publicationChannel,
+    routerRef: normalized(routerRef), routerSha: normalized(routerSha).toLowerCase(),
     channel: intent.shellChannel,
     major: selected.major,
     shellRef,
@@ -99,8 +99,8 @@ function readPackageVersion(cwd) {
 
 function writeOutputs(file, result) {
   const outputs = {
-    "target-ref": result.targetRef,
-    "publication-channel": result.publicationChannel,
+    "target-ref": result.targetRef, "publication-channel": result.publicationChannel,
+    "router-ref": result.routerRef, "router-sha": result.routerSha,
     channel: result.channel,
     major: String(result.major),
     "shell-ref": result.shellRef,

package/scripts/release-candidate-anchor-provenance.mjs

@@ -0,0 +1,99 @@
+import path from "node:path";
+
+export function resolveAnchorRecoveryRequest({ passport, buildSummary, transactionId = "" } = {}) {
+  if (Number(passport?.pullRequest?.number || 0)) return undefined;
+  if (passport?.target?.channel !== "anchor" || passport?.target?.ref !== "publish-gate/anchor") {
+    throw new Error("Release Candidate Passport has no PR identity");
+  }
+  let releaseManifest;
+  try {
+    releaseManifest = JSON.parse(buildSummary?.publishSource?.releaseManifest || "");
+  } catch {
+    throw new Error("anchored candidate release manifest is invalid");
+  }
+  const request = releaseManifest?.anchorRequest;
+  if (
+    releaseManifest?.sourceRef !== "publish-gate/anchor" ||
+    releaseManifest?.sourceSha !== passport.source?.headSha ||
+    request?.schema !== 1 ||
+    request?.contract !== "kungfu-buildchain-explicit-publish-anchor-request/v1" ||
+    !request.assignmentId ||
+    !/^native:[0-9a-f-]+$/u.test(String(request.attemptId || "")) ||
+    request.transactionId !== transactionId ||
+    request.source?.sha !== passport.source?.headSha ||
+    request.source?.tree !== passport.source?.treeHash ||
+    !/^\d+$/u.test(String(request.supersededCandidate?.workflowRunId || "")) ||
+    !/^[0-9a-f]{40}$/u.test(String(request.supersededCandidate?.sha || "")) ||
+    !/^sha256:[0-9a-f]{64}$/u.test(String(request.supersededCandidate?.root || "")) ||
+    request.runtime?.sha !== passport.buildchain?.sha
+  ) {
+    throw new Error("anchored candidate request does not bind the sealed recovery identity");
+  }
+  return request;
+}
+
+function normalizeRun(run, repository) {
+  return {
+    id: String(run.id), repository,
+    headRepository: run.head_repository?.full_name || "",
+    status: run.status, conclusion: run.conclusion,
+    event: run.event, path: run.path, name: run.name,
+    headSha: run.head_sha || "", headBranch: run.head_branch || "",
+    pullRequestNumbers: (run.pull_requests || []).map((entry) => Number(entry.number)),
+  };
+}
+
+export function normalizeCandidateRun(run, repository) {
+  return normalizeRun(run, repository);
+}
+
+export function normalizeAnchorProvenance(anchorProvenance, repository) {
+  if (!anchorProvenance) return undefined;
+  return {
+    request: anchorProvenance.request,
+    run: normalizeRun(anchorProvenance.run, repository),
+    workflow: {
+      path: anchorProvenance.workflow.path,
+      name: anchorProvenance.workflow.name,
+      state: anchorProvenance.workflow.state,
+    },
+    passport: anchorProvenance.passport,
+    buildSummary: anchorProvenance.buildSummary,
+  };
+}
+
+export async function recoverCandidateProvenance({
+  passport, buildSummary, transactionId, repoInfo, artifactName,
+  expectedWorkflowFile, expectedWorkflowName, channel, apiUrl, token,
+  fetchImpl, archiveDir, bundleRoot, githubJson, selectReleaseCandidateArtifacts,
+  downloadArtifact, readOnlyJson,
+}) {
+  const request = resolveAnchorRecoveryRequest({ passport, buildSummary, transactionId });
+  if (!request) {
+    return { anchorProvenance: undefined, provenancePassport: passport };
+  }
+  const runId = String(request.supersededCandidate.workflowRunId);
+  const run = await githubJson({ apiUrl, token, fetchImpl, path: `/repos/${repoInfo.owner}/${repoInfo.repo}/actions/runs/${runId}` });
+  const workflow = await githubJson({ apiUrl, token, fetchImpl, path: `/repos/${repoInfo.owner}/${repoInfo.repo}/actions/workflows/${run.workflow_id}` });
+  const artifactResponse = await githubJson({ apiUrl, token, fetchImpl, path: `/repos/${repoInfo.owner}/${repoInfo.repo}/actions/runs/${runId}/artifacts?per_page=100` });
+  const artifacts = Array.isArray(artifactResponse.artifacts) ? artifactResponse.artifacts : [];
+  if (Number(artifactResponse.total_count || artifacts.length) !== artifacts.length) throw new Error("superseded candidate run has more than 100 artifacts; complete pagination is required before recovery");
+  const selected = selectReleaseCandidateArtifacts({ artifacts, artifactName });
+  const provenanceRoot = path.join(bundleRoot, "anchored-provenance");
+  const passportDownload = await downloadArtifact({ artifact: selected.passport, repoInfo, apiUrl, token, archiveDir, bundleRoot: provenanceRoot, fetchImpl });
+  const summaryDownload = await downloadArtifact({ artifact: selected.summary, repoInfo, apiUrl, token, archiveDir, bundleRoot: provenanceRoot, fetchImpl });
+  const recoveredPassport = readOnlyJson(passportDownload.files.filter((file) => path.basename(file.path) === "release-candidate-passport.json"), "superseded release-candidate-passport.json");
+  const recoveredBuildSummary = readOnlyJson(summaryDownload.files.filter((file) => path.basename(file.path) === "build-summary.json"), "superseded build-summary.json");
+  if (
+    String(run.id) !== runId ||
+    recoveredPassport.workflow?.runId !== runId ||
+    recoveredPassport.workflow?.name !== expectedWorkflowName ||
+    String(workflow.path || run.path || "").split("@")[0].replace(/^\.github\/workflows\//u, "") !== expectedWorkflowFile.replace(/^\.github\/workflows\//u, "") ||
+    recoveredPassport.target?.channel !== channel ||
+    recoveredPassport.source?.headSha !== request.supersededCandidate.sha ||
+    recoveredPassport.source?.treeHash !== request.source.tree ||
+    `sha256:${recoveredPassport.candidateHash}` !== request.supersededCandidate.root
+  ) throw new Error("superseded candidate provenance does not match the anchored request");
+  const anchorProvenance = { request, run, workflow, passport: recoveredPassport, buildSummary: recoveredBuildSummary };
+  return { anchorProvenance, provenancePassport: recoveredPassport };
+}

package/scripts/release-tail.mjs

@@ -11,6 +11,10 @@ import {
   writeReleaseTailTransaction,
 } from "../packages/core/release-tail-provider-plane.js";
 import { diagnoseLegacyReleaseTailHooks } from "../packages/core/release-tail-compatibility.js";
+import {
+  V4_PUBLICATION_REHEARSAL_EVIDENCE_CONTRACT,
+  executeV4PublicationRehearsal,
+} from "../packages/core/v4-publication-rehearsal.js";
 
 function flag(args, name, fallback = "") {
   const index = args.indexOf(`--${name}`);
@@ -34,8 +38,52 @@ function output(value, filePath = "") {
   process.stdout.write(`${JSON.stringify(value, null, 2)}\n`);
 }
 
-export function runReleaseTailCli(args = process.argv.slice(2)) {
+export async function runReleaseTailCli(args = process.argv.slice(2)) {
   const [mode = "status", ...options] = args;
+  if (mode === "rehearse") {
+    const capsulePath = flag(options, "capsule");
+    const candidateRoot = flag(options, "candidate-root");
+    const statePath = flag(options, "state");
+    const evidencePath = flag(options, "evidence");
+    for (const [name, value] of Object.entries({
+      "--capsule": capsulePath,
+      "--candidate-root": candidateRoot,
+      "--state": statePath,
+      "--evidence": evidencePath,
+    }))
+      if (!value || !path.isAbsolute(value))
+        throw new Error(`${name} must be an explicit absolute path`);
+    const rehearsalMode = flag(options, "mode", "simulate");
+    if (!new Set(["simulate", "replay"]).has(rehearsalMode))
+      throw new Error(
+        "local rehearsal --mode must be simulate or replay; authorized provider rehearsal uses the reusable workflow",
+      );
+    try {
+      const result = await executeV4PublicationRehearsal({
+        capsule: readJson(capsulePath, "--capsule"),
+        candidateRoot,
+        mode: rehearsalMode,
+        checkpoint: (transaction) =>
+          writeReleaseTailTransaction(statePath, transaction),
+      });
+      writeReleaseTailTransaction(statePath, result.transaction);
+      output(result.evidence, evidencePath);
+      return result;
+    } catch (error) {
+      output(
+        {
+          schema: V4_PUBLICATION_REHEARSAL_EVIDENCE_CONTRACT,
+          status: "rejected",
+          code: error.code || "publication-rehearsal-runtime-error",
+          message: error.message,
+          productionAuthority: false,
+          releasePassport: null,
+        },
+        evidencePath,
+      );
+      throw error;
+    }
+  }
   if (mode === "plan") {
     const plan = compileReleaseTailDeclaration(
       readJson(flag(options, "declaration"), "--declaration"),
@@ -95,7 +143,7 @@ export function runReleaseTailCli(args = process.argv.slice(2)) {
     return report;
   }
   throw new Error(
-    "usage: buildchain release-tail <plan|init|status|verify|compat> [--declaration <json-or-path>] [--state <path>] [--hooks-json <json-or-path>] [--output <path>]",
+    "usage: buildchain release-tail <plan|init|status|verify|compat|rehearse> [--declaration <json-or-path>] [--capsule <absolute-path>] [--candidate-root <absolute-path>] [--mode <simulate|replay>] [--state <absolute-path>] [--evidence <absolute-path>] [--hooks-json <json-or-path>] [--output <path>]",
   );
 }
 
@@ -105,7 +153,7 @@ if (
   import.meta.url === pathToFileURL(process.argv[1]).href
 ) {
   try {
-    runReleaseTailCli();
+    await runReleaseTailCli();
   } catch (error) {
     console.error(`release-tail: ${error.message}`);
     process.exitCode = 1;