@kungfu-tech/buildchain 4.0.1-alpha.2 → 4.0.1-alpha.21

package/packages/core/v4-floating-consumer-policy.js

@@ -1,6 +1,10 @@
 import crypto from "node:crypto";
 import fs from "node:fs";
 import path from "node:path";
+import {
+  createBuildchainContractWorld,
+  evaluateBuildchainContractLock,
+} from "./buildchain-contract.js";
 import { parseYamlUses } from "./workflow-yaml-contract.js";
 import {
   V4_FLOATING_CONSUMER_POLICY,
@@ -22,6 +26,11 @@ const EXACT_SHA = /^[0-9a-f]{40}$/u;
 const SHA256_ROOT = /^sha256:[0-9a-f]{64}$/u;
 const BUILDCHAIN_REPOSITORY = "kungfu-systems/buildchain";
 const CHANNELS = Object.freeze({ v4: "stable", "v4-alpha": "alpha" });
+const ALPHA_RECOVERY_BOOTSTRAP = Object.freeze({
+  selector: "alpha/v4/v4.0",
+  sourcePath: ".github/workflows/buildchain-ref-promotion-recovery.yml",
+  workflow: ".github/workflows/.release-candidate-promote.yml",
+});
 const DEFAULT_STABLE_LOCK_PATH = ".buildchain/contract-lock.json";
 const DEFAULT_ALPHA_LOCK_PATH = ".buildchain/alpha-contract-lock.json";
 const TRANSIENT_ACTION =
@@ -29,6 +38,7 @@ const TRANSIENT_ACTION =
 const SCANNER_PATHS = Object.freeze([
   "architecture/v4-floating-consumer-policy.json",
   "contracts/v4-floating-consumer-policy-receipt-v1.schema.json",
+  "packages/core/buildchain-contract.js",
   "packages/core/v4-floating-consumer-policy.js",
   "packages/core/workflow-yaml-contract.js",
   "scripts/v4-consumer-policy.mjs",
@@ -272,7 +282,7 @@ function readContractLock(root, relative, expectedRef, label, failures) {
   }
 }
 
-function classifyBuildchainUses(records, failures) {
+function classifyBuildchainUses(records, failures, { repository } = {}) {
   const uses = [];
   for (const record of records) {
     const parsed = coordinate(record.uses);
@@ -281,15 +291,27 @@ function classifyBuildchainUses(records, failures) {
       parsed.selector === "v4" ||
       parsed.selector === "v4-alpha" ||
       /^v4(?:[./-]|$)/u.test(parsed.selector) ||
+      parsed.selector === ALPHA_RECOVERY_BOOTSTRAP.selector ||
       EXACT_SHA.test(parsed.selector.toLowerCase()) ||
       parsed.selector.includes("${{");
     if (!v4Candidate) continue;
-    const channel = CHANNELS[parsed.selector] || "";
+    const protectedBootstrap =
+      repository === BUILDCHAIN_REPOSITORY &&
+      normalizeWorkflowPath(parsed.path) ===
+        ALPHA_RECOVERY_BOOTSTRAP.workflow &&
+      record.sourcePath === ALPHA_RECOVERY_BOOTSTRAP.sourcePath &&
+      parsed.selector === ALPHA_RECOVERY_BOOTSTRAP.selector;
+    const channel =
+      CHANNELS[parsed.selector] || (protectedBootstrap ? "alpha" : "");
     uses.push({
       ...record,
       ...parsed,
       channel,
-      selectorClass: channel ? "floating" : "rejected",
+      selectorClass: protectedBootstrap
+        ? "protected-bootstrap"
+        : channel
+          ? "floating"
+          : "rejected",
     });
     if (!channel) failures.push(selectorFailure(record, parsed.selector));
   }
@@ -315,8 +337,97 @@ function selectInvocation(uses, workflow, failures, source = "", channel = "") {
   return { expectedWorkflow, selected: invocations[0] };
 }
 
+function scanInvocationSource({
+  sourceRoot,
+  invocationRoot,
+  sourceScan,
+  sourceUses,
+  failures,
+  repository,
+}) {
+  if (invocationRoot === sourceRoot)
+    return { invocationScan: sourceScan, invocationUses: sourceUses };
+  try {
+    const invocationScan = enumerateUses(invocationRoot);
+    return {
+      invocationScan,
+      invocationUses: classifyBuildchainUses(invocationScan.records, failures, {
+        repository,
+      }),
+    };
+  } catch (error) {
+    failures.push({
+      code: "invocation-source-scan-failed",
+      message: error.message,
+    });
+    return {
+      invocationScan: { files: [], records: [] },
+      invocationUses: [],
+    };
+  }
+}
+
+function sourceScanRoot({
+  sourceRoot,
+  invocationRoot,
+  sourceScan,
+  invocationScan,
+  invocationUses,
+}) {
+  const material =
+    invocationRoot === sourceRoot
+      ? sourceScan
+      : {
+          source: sourceScan,
+          invocation: {
+            files: invocationScan.files,
+            invocations: invocationUses,
+          },
+        };
+  return sha256(stableJson(material));
+}
+
+function verifySelectedLock({
+  selected,
+  stable,
+  alpha,
+  workflowSha,
+  failures,
+}) {
+  const selectedLock = selected?.channel === "alpha" ? alpha : stable;
+  if (!selected?.channel || !selectedLock) return;
+  const authorityRef =
+    selected.selectorClass === "protected-bootstrap"
+      ? "v4-alpha"
+      : selected.selector;
+  try {
+    const compatibility = evaluateBuildchainContractLock({
+      lock: selectedLock,
+      current: createBuildchainContractWorld({ root: defaultRuntimeRoot() }),
+      runtimeRef: authorityRef,
+      runtimeSha: workflowSha,
+      runtimeClass: selected.channel,
+      workflowShellRef: authorityRef,
+      expectedChannel: selected.channel,
+      expectedMajor: "v4",
+    });
+    if (!compatibility.ok) {
+      failures.push({
+        code: "selected-lock-runtime-incompatible",
+        message: `${selected.channel} contract lock rejects resolved workflow shell ${workflowSha}: ${compatibility.reasons?.join("; ") || compatibility.status}`,
+      });
+    }
+  } catch (error) {
+    failures.push({
+      code: "selected-lock-contract-world-invalid",
+      message: `cannot evaluate ${selected.channel} contract lock against the resolved workflow shell: ${error.message}`,
+    });
+  }
+}
+
 export function scanV4FloatingConsumerPolicy({
   root = process.cwd(),
+  invocationRoot = root,
   repository = "",
   sourceSha = "",
   invokedWorkflow = "",
@@ -330,6 +441,7 @@ export function scanV4FloatingConsumerPolicy({
   scannerRoot = "",
 } = {}) {
   const resolvedRoot = path.resolve(root);
+  const resolvedInvocationRoot = path.resolve(invocationRoot);
   if (!policy || policy.contract !== V4_FLOATING_CONSUMER_POLICY) {
     throw new Error(`policy must use ${V4_FLOATING_CONSUMER_POLICY}`);
   }
@@ -369,28 +481,34 @@ export function scanV4FloatingConsumerPolicy({
   } catch (error) {
     failures.push({ code: "source-scan-failed", message: error.message });
   }
-  const buildchainUses = classifyBuildchainUses(scanned.records, failures);
+  const buildchainUses = classifyBuildchainUses(scanned.records, failures, {
+    repository,
+  });
+  const { invocationScan, invocationUses } = scanInvocationSource({
+    sourceRoot: resolvedRoot,
+    invocationRoot: resolvedInvocationRoot,
+    sourceScan: scanned,
+    sourceUses: buildchainUses,
+    failures,
+    repository,
+  });
   const sourcePath = String(invocationSourcePath || "")
     .split("@")[0]
     .replace(`${repository}/`, "");
   const { expectedWorkflow, selected } = selectInvocation(
-    buildchainUses,
+    invocationUses,
     invokedWorkflow,
     failures,
     sourcePath,
     expectedInvocationChannel,
   );
-  const selectedLock = selected?.channel === "alpha" ? alpha : stable;
-  if (
-    selected?.channel &&
-    selectedLock?.buildchain?.resolvedSha?.toLowerCase() !==
-      normalizedWorkflowSha
-  ) {
-    failures.push({
-      code: "selected-lock-runtime-mismatch",
-      message: `${selected.channel} contract lock does not bind resolved workflow shell ${normalizedWorkflowSha}`,
-    });
-  }
+  verifySelectedLock({
+    selected,
+    stable,
+    alpha,
+    workflowSha: normalizedWorkflowSha,
+    failures,
+  });
 
   const policyRoot = sha256(stableJson(policy));
   const resolvedScannerRoot = scannerRoot || policyRoot;
@@ -404,9 +522,14 @@ export function scanV4FloatingConsumerPolicy({
     stable: stable ? sha256(stableJson(stable)) : "",
     alpha: alpha ? sha256(stableJson(alpha)) : "",
   };
-  const scanRoot = sha256(
-    stableJson({ files: scanned.files, invocations: buildchainUses }),
-  );
+  const sourceScan = { files: scanned.files, invocations: buildchainUses };
+  const scanRoot = sourceScanRoot({
+    sourceRoot: resolvedRoot,
+    invocationRoot: resolvedInvocationRoot,
+    sourceScan,
+    invocationScan,
+    invocationUses,
+  });
   const receipt = {
     schema: V4_FLOATING_CONSUMER_RECEIPT,
     status: failures.length ? "failed" : "passed",
@@ -439,7 +562,7 @@ export function scanV4FloatingConsumerPolicy({
     ok: failures.length === 0,
     failures,
     scannedFiles: scanned.files,
-    invocations: buildchainUses,
+    invocations: invocationUses,
     receipt,
     receiptRoot,
   };

package/packages/core/v4-floating-consumer-release-passport.js

@@ -6,7 +6,6 @@ import {
 } from "./v4-floating-consumer-evidence.js";
 
 const SHA256_ROOT = /^sha256:[0-9a-f]{64}$/u;
-
 export function isV4PromotionRouting(value = undefined) {
   return [
     value?.router?.ref,
@@ -76,11 +75,33 @@ function normalizeCertification(value, expected) {
   }
   return { certificationRoot: verification.certificationRoot, certification };
 }
-
+export function resolveV4ConsumerPolicyCertificationIdentity({
+  release = {},
+  routing = {},
+  runtimeResume = undefined,
+  sourceSha = "",
+} = {}) {
+  const builtSourceSha =
+    release?.builtSourceSha || release?.built_source_sha || "";
+  const certification =
+    release?.certification?.certification || release?.certification;
+  const retainsCaller = certification?.caller?.sourceSha === sourceSha;
+  return {
+    sourceSha:
+      release?.treeEquivalent === true && builtSourceSha && !retainsCaller
+        ? builtSourceSha
+        : sourceSha,
+    runtimeSha:
+      runtimeResume?.lineage?.attempts?.build?.runtimeSha ||
+      routing?.runtime?.resolvedSha ||
+      "",
+  };
+}
 export function requireV4ConsumerPolicyCertification({
   value,
   repository,
   sourceSha,
+  runtimeSha = "",
   routing,
   cwd,
   certificationRoot,
@@ -100,7 +121,7 @@ export function requireV4ConsumerPolicyCertification({
   return normalizeCertification(value, {
     repository,
     sourceSha,
-    runtimeSha: routing?.runtime?.resolvedSha || "",
+    runtimeSha: runtimeSha || routing?.runtime?.resolvedSha || "",
     certificationRoot,
     ...(v4Routing ? resolveV4FloatingConsumerCallerLocks(value, cwd) : {}),
   });
@@ -112,12 +133,18 @@ export function releasePassportCertificationVerificationOptions({
   routing,
 }) {
   const authority = evidence?.certification?.authority || {};
+  const identity = resolveV4ConsumerPolicyCertificationIdentity({
+    release: { ...passport?.release, certification: evidence?.certification },
+    routing,
+    runtimeResume: passport?.v4RuntimeResume,
+    sourceSha: passport?.release?.sourceSha || "",
+  });
   return {
     certification: evidence?.certification,
     certificationRoot: evidence?.certificationRoot,
     repository: passport?.product?.repository || "",
-    sourceSha: passport?.release?.sourceSha || "",
-    resolvedRuntimeSha: routing?.runtime?.resolvedSha || "",
+    sourceSha: identity.sourceSha,
+    resolvedRuntimeSha: identity.runtimeSha,
     stableLockRoot: authority.contractLocks?.stable?.root || "",
     alphaLockRoot: authority.contractLocks?.alpha?.root || "",
     stableLockPath: authority.contractLocks?.stable?.path || "",