@kungfu-tech/buildchain 4.0.0 → 4.0.1-alpha.2

package/contracts/fixtures/v4-floating-consumer-policy-v1/cases.json

@@ -0,0 +1,53 @@
+{
+  "schemaVersion": 1,
+  "contract": "kungfu-buildchain-v4-floating-consumer-policy-fixtures/v1",
+  "cases": [
+    {
+      "id": "stable-floating-dual-lock",
+      "selector": "v4",
+      "expected": "passed"
+    },
+    {
+      "id": "alpha-floating-dual-lock",
+      "selector": "v4-alpha",
+      "expected": "passed"
+    },
+    {
+      "id": "persistent-exact-sha",
+      "selector": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+      "expectedCode": "persistent-exact-sha-selector"
+    },
+    {
+      "id": "repository-variable-indirection",
+      "selector": "${{ vars.BUILDCHAIN_REF }}",
+      "expectedCode": "persistent-selector-indirection"
+    },
+    {
+      "id": "input-default-indirection",
+      "selector": "${{ inputs.buildchain-ref }}",
+      "expectedCode": "persistent-selector-indirection"
+    },
+    {
+      "id": "wrong-channel",
+      "selector": "v4.0",
+      "expectedCode": "unapproved-v4-selector"
+    },
+    {
+      "id": "missing-alpha-lock",
+      "selector": "v4",
+      "remove": ".buildchain/alpha-contract-lock.json",
+      "expectedCode": "alpha-lock-missing"
+    },
+    {
+      "id": "stale-selected-lock",
+      "selector": "v4-alpha",
+      "stale": "alpha",
+      "expectedCode": "selected-lock-runtime-mismatch"
+    },
+    {
+      "id": "nested-composite-exact-sha",
+      "selector": "local-composite",
+      "expectedCode": "persistent-exact-sha-selector"
+    }
+  ]
+}

package/contracts/fixtures/v4-runtime-ref-resume-authority-v1/scenario.json

@@ -0,0 +1,15 @@
+{
+  "schemaVersion": 1,
+  "scenario": "floating-ref-moves-after-late-platform-failure",
+  "sourceSha": "cccccccccccccccccccccccccccccccccccccccc",
+  "sourceTreeSha": "dddddddddddddddddddddddddddddddddddddddd",
+  "buildAttempt": "attempt-build-17",
+  "resumeAttempt": "attempt-resume-18",
+  "buildRuntimeSha": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+  "resumeRuntimeSha": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
+  "floatingRef": "v4-alpha",
+  "requiredPlatforms": ["linux-x64", "macos-arm64", "windows-x64"],
+  "reusedPlatforms": ["linux-x64", "macos-arm64"],
+  "rebuildPlatforms": ["windows-x64"],
+  "rerunFailedJobs": false
+}

package/contracts/v4-floating-consumer-policy-receipt-v1.schema.json

@@ -0,0 +1,105 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://buildchain.kungfu-tech.com/schemas/v4-floating-consumer-policy-receipt-v1.schema.json",
+  "title": "Buildchain v4 floating consumer policy receipt",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schema",
+    "status",
+    "caller",
+    "invocation",
+    "contractLocks",
+    "policy",
+    "failures"
+  ],
+  "properties": {
+    "schema": {
+      "const": "kungfu-buildchain-v4-floating-consumer-policy-receipt/v1"
+    },
+    "status": { "enum": ["passed", "failed"] },
+    "caller": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["repository", "sourceSha"],
+      "properties": {
+        "repository": { "type": "string", "pattern": "^[^/]+/[^/]+$" },
+        "sourceSha": { "type": "string", "pattern": "^[0-9a-f]{40}$" }
+      }
+    },
+    "invocation": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "workflow",
+        "sourcePath",
+        "sourceLine",
+        "visibleSelector",
+        "selectorClass",
+        "channel",
+        "resolvedWorkflowSha",
+        "resolvedRuntimeSha"
+      ],
+      "properties": {
+        "workflow": {
+          "type": "string",
+          "pattern": "^\\.github/workflows/.+\\.ya?ml$"
+        },
+        "sourcePath": { "type": "string" },
+        "sourceLine": { "type": "integer", "minimum": 0 },
+        "visibleSelector": { "enum": ["", "v4", "v4-alpha"] },
+        "selectorClass": { "enum": ["", "floating", "rejected"] },
+        "channel": { "enum": ["", "stable", "alpha"] },
+        "resolvedWorkflowSha": {
+          "type": "string",
+          "pattern": "^[0-9a-f]{40}$"
+        },
+        "resolvedRuntimeSha": { "type": "string", "pattern": "^[0-9a-f]{40}$" }
+      }
+    },
+    "contractLocks": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["stable", "alpha"],
+      "properties": {
+        "stable": { "$ref": "#/$defs/lock" },
+        "alpha": { "$ref": "#/$defs/lock" }
+      }
+    },
+    "policy": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["version", "root", "scannerRoot", "sourceScanRoot"],
+      "properties": {
+        "version": { "type": "string", "minLength": 1 },
+        "root": { "$ref": "#/$defs/root" },
+        "scannerRoot": { "$ref": "#/$defs/root" },
+        "sourceScanRoot": { "$ref": "#/$defs/root" }
+      }
+    },
+    "failures": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["code", "message"],
+        "properties": {
+          "code": { "type": "string", "minLength": 1 },
+          "message": { "type": "string", "minLength": 1 }
+        }
+      }
+    }
+  },
+  "$defs": {
+    "root": { "type": "string", "pattern": "^sha256:[0-9a-f]{64}$" },
+    "lock": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["path", "root"],
+      "properties": {
+        "path": { "type": "string", "minLength": 1 },
+        "root": { "anyOf": [{ "$ref": "#/$defs/root" }, { "const": "" }] }
+      }
+    }
+  }
+}

package/contracts/v4-runtime-ref-resume-authority-v1.schema.json

@@ -0,0 +1,235 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://buildchain.libkungfu.dev/schema/v4-runtime-ref-resume-authority-v1.schema.json",
+  "title": "Buildchain v4 transient runtime authorization and resume lineage evidence",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["authorizationRoot", "authorization", "lineageRoot", "lineage"],
+  "properties": {
+    "authorizationRoot": { "$ref": "#/$defs/root" },
+    "authorization": { "$ref": "#/$defs/authorization" },
+    "lineageRoot": { "$ref": "#/$defs/root" },
+    "lineage": { "$ref": "#/$defs/lineage" }
+  },
+  "$defs": {
+    "root": { "type": "string", "pattern": "^sha256:[0-9a-f]{64}$" },
+    "sha": { "type": "string", "pattern": "^[0-9a-f]{40}$" },
+    "token": { "type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/-]*$" },
+    "authorization": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "schemaVersion",
+        "contract",
+        "status",
+        "mode",
+        "eventName",
+        "repository",
+        "actor",
+        "reason",
+        "authorizedAt",
+        "source",
+        "request",
+        "runtime",
+        "contractLocks",
+        "consumerPolicyReceiptRoot",
+        "persistenceScanRoot"
+      ],
+      "properties": {
+        "schemaVersion": { "const": 1 },
+        "contract": {
+          "const": "kungfu-buildchain-v4-runtime-authorization/v1"
+        },
+        "status": { "const": "authorized" },
+        "mode": { "enum": ["dispatch", "resume", "rescue"] },
+        "eventName": { "const": "workflow_dispatch" },
+        "repository": { "type": "string", "minLength": 3 },
+        "actor": { "$ref": "#/$defs/actor" },
+        "reason": { "type": "string", "minLength": 1 },
+        "authorizedAt": {
+          "type": "string",
+          "pattern": "^(?!0000)\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}(?:\\.\\d{3})?Z$"
+        },
+        "source": { "$ref": "#/$defs/source" },
+        "request": { "$ref": "#/$defs/request" },
+        "runtime": { "$ref": "#/$defs/runtime" },
+        "contractLocks": { "$ref": "#/$defs/contractLocks" },
+        "consumerPolicyReceiptRoot": { "$ref": "#/$defs/root" },
+        "persistenceScanRoot": { "$ref": "#/$defs/root" }
+      }
+    },
+    "lineage": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "schemaVersion",
+        "contract",
+        "status",
+        "authorizationRoot",
+        "source",
+        "consumerPolicyReceiptRoot",
+        "attempts",
+        "floatingRefMovement",
+        "continuation",
+        "stageCapsules",
+        "finalPublicReadbackRoot"
+      ],
+      "properties": {
+        "schemaVersion": { "const": 1 },
+        "contract": {
+          "const": "kungfu-buildchain-v4-runtime-resume-lineage/v1"
+        },
+        "status": { "const": "qualified" },
+        "authorizationRoot": { "$ref": "#/$defs/root" },
+        "source": { "$ref": "#/$defs/source" },
+        "consumerPolicyReceiptRoot": { "$ref": "#/$defs/root" },
+        "attempts": { "$ref": "#/$defs/attempts" },
+        "floatingRefMovement": { "$ref": "#/$defs/floatingRefMovement" },
+        "continuation": { "$ref": "#/$defs/continuation" },
+        "stageCapsules": { "$ref": "#/$defs/stageCapsules" },
+        "finalPublicReadbackRoot": { "$ref": "#/$defs/root" }
+      }
+    },
+    "actor": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["login", "permission"],
+      "properties": {
+        "login": { "type": "string", "minLength": 1 },
+        "permission": { "enum": ["write", "maintain", "admin"] }
+      }
+    },
+    "source": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["sha", "treeSha"],
+      "properties": {
+        "sha": { "$ref": "#/$defs/sha" },
+        "treeSha": { "$ref": "#/$defs/sha" }
+      }
+    },
+    "request": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["ref", "class"],
+      "properties": {
+        "ref": { "type": "string", "minLength": 1 },
+        "class": { "enum": ["exact-sha", "floating", "train", "authority"] }
+      }
+    },
+    "readback": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["ref", "sha", "containsRuntimeSha", "readbackRoot"],
+      "properties": {
+        "ref": { "type": "string", "minLength": 1 },
+        "sha": { "$ref": "#/$defs/sha" },
+        "containsRuntimeSha": { "type": "boolean" },
+        "readbackRoot": { "$ref": "#/$defs/root" }
+      }
+    },
+    "runtime": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["sha", "reachableFrom"],
+      "properties": {
+        "sha": { "$ref": "#/$defs/sha" },
+        "reachableFrom": {
+          "type": "array",
+          "minItems": 1,
+          "uniqueItems": true,
+          "items": { "$ref": "#/$defs/readback" }
+        }
+      }
+    },
+    "contractLocks": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["stableRoot", "alphaRoot"],
+      "properties": {
+        "stableRoot": { "$ref": "#/$defs/root" },
+        "alphaRoot": { "$ref": "#/$defs/root" }
+      }
+    },
+    "attempt": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["id", "runtimeSha"],
+      "properties": {
+        "id": { "$ref": "#/$defs/token" },
+        "runtimeSha": { "$ref": "#/$defs/sha" }
+      }
+    },
+    "attempts": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["build", "resume"],
+      "properties": {
+        "build": { "$ref": "#/$defs/attempt" },
+        "resume": { "$ref": "#/$defs/attempt" }
+      }
+    },
+    "refReadback": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["ref", "sha"],
+      "properties": {
+        "ref": { "enum": ["v4", "v4-alpha"] },
+        "sha": { "$ref": "#/$defs/sha" }
+      }
+    },
+    "floatingRefMovement": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["before", "after"],
+      "properties": {
+        "before": { "$ref": "#/$defs/refReadback" },
+        "after": { "$ref": "#/$defs/refReadback" }
+      }
+    },
+    "continuation": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["mechanism", "rerunFailedJobs", "resumePlanRoot"],
+      "properties": {
+        "mechanism": { "const": "new-governed-attempt" },
+        "rerunFailedJobs": { "const": false },
+        "resumePlanRoot": { "$ref": "#/$defs/root" }
+      }
+    },
+    "capsule": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["platform", "capsuleRoot", "identityRoot", "artifactDigest"],
+      "properties": {
+        "platform": { "$ref": "#/$defs/token" },
+        "capsuleRoot": { "$ref": "#/$defs/root" },
+        "identityRoot": { "$ref": "#/$defs/root" },
+        "artifactDigest": { "$ref": "#/$defs/root" }
+      }
+    },
+    "stageCapsules": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["requiredPlatforms", "reused", "rebuildPlatforms"],
+      "properties": {
+        "requiredPlatforms": {
+          "type": "array",
+          "minItems": 1,
+          "uniqueItems": true,
+          "items": { "$ref": "#/$defs/token" }
+        },
+        "reused": {
+          "type": "array",
+          "uniqueItems": true,
+          "items": { "$ref": "#/$defs/capsule" }
+        },
+        "rebuildPlatforms": {
+          "type": "array",
+          "uniqueItems": true,
+          "items": { "$ref": "#/$defs/token" }
+        }
+      }
+    }
+  }
+}