@kungfu-tech/buildchain 4.0.1-alpha.6 → 4.0.1-alpha.9

package/scripts/check-ci-lane-change-budget.mjs

@@ -0,0 +1,100 @@
+#!/usr/bin/env node
+import crypto from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+import process from "node:process";
+import { execFileSync } from "node:child_process";
+import { evaluateCiLaneChangeBudget } from "../packages/core/ci-lane-change-budget.js";
+
+const root = process.cwd();
+const workflowRoot = path.join(root, ".github", "workflows");
+const policyPath = path.join(
+  root,
+  "architecture",
+  "ci-lane-change-budget.json",
+);
+
+const workflows = fs
+  .readdirSync(workflowRoot, { withFileTypes: true })
+  .filter((entry) => entry.isFile() && /\.(?:yaml|yml)$/u.test(entry.name))
+  .map((entry) => {
+    const workflowPath = path.posix.join(".github/workflows", entry.name);
+    return {
+      path: workflowPath,
+      text: fs.readFileSync(path.join(workflowRoot, entry.name), "utf8"),
+    };
+  })
+  .sort((left, right) => left.path.localeCompare(right.path));
+
+const policy = JSON.parse(fs.readFileSync(policyPath, "utf8"));
+const baselineRevision = String(policy.baseline?.gitRevision || "").trim();
+if (!/^[0-9a-f]{40}$/u.test(baselineRevision)) {
+  throw new Error("baseline.gitRevision must be an exact Git commit");
+}
+const embeddedBaselineLanes = policy.baseline?.lanes;
+if (
+  !Array.isArray(embeddedBaselineLanes) ||
+  embeddedBaselineLanes.length === 0
+) {
+  throw new Error("baseline.lanes must contain the exact offline lane set");
+}
+const embeddedLaneSetRoot = `sha256:${crypto
+  .createHash("sha256")
+  .update(`${JSON.stringify(embeddedBaselineLanes)}\n`)
+  .digest("hex")}`;
+if (embeddedLaneSetRoot !== policy.baseline?.laneSetRoot) {
+  throw new Error("baseline laneSetRoot does not match baseline.lanes");
+}
+
+let baselineWorkflows = null;
+try {
+  execFileSync("git", ["cat-file", "-e", `${baselineRevision}^{commit}`], {
+    cwd: root,
+    stdio: "ignore",
+  });
+  const baselinePaths = execFileSync(
+    "git",
+    [
+      "ls-tree",
+      "-r",
+      "--name-only",
+      baselineRevision,
+      "--",
+      ".github/workflows",
+    ],
+    { cwd: root, encoding: "utf8" },
+  )
+    .split(/\r?\n/u)
+    .filter((value) => /\.(?:yaml|yml)$/u.test(value))
+    .sort();
+  baselineWorkflows = baselinePaths.map((workflowPath) => ({
+    path: workflowPath,
+    text: execFileSync("git", ["show", `${baselineRevision}:${workflowPath}`], {
+      cwd: root,
+      encoding: "utf8",
+    }),
+  }));
+} catch {
+  // Shallow and exported source cuts may not contain the pinned commit object.
+  // The content-rooted embedded lane set remains the exact offline authority.
+}
+
+const embeddedEvaluation = evaluateCiLaneChangeBudget({
+  policy,
+  workflows,
+});
+const evaluation = baselineWorkflows
+  ? evaluateCiLaneChangeBudget({ policy, workflows, baselineWorkflows })
+  : embeddedEvaluation;
+if (
+  baselineWorkflows &&
+  (evaluation.baselineLaneCount !== embeddedEvaluation.baselineLaneCount ||
+    JSON.stringify(evaluation.newLanes) !==
+      JSON.stringify(embeddedEvaluation.newLanes))
+) {
+  throw new Error(
+    "embedded baseline lanes do not match the pinned baseline revision",
+  );
+}
+process.stdout.write(`${JSON.stringify(evaluation, null, 2)}\n`);
+if (!evaluation.ok) process.exitCode = 1;

package/scripts/check-inventory.mjs

@@ -1021,7 +1021,7 @@ for (const forbiddenSnippet of [
 for (const requiredSnippet of [
   "id-token: write",
   "actions: write",
-  "uses: kungfu-systems/buildchain/.github/workflows/.release-candidate-promote.yml@alpha/v4/v4.0",
+  "uses: kungfu-systems/buildchain/.github/workflows/release-candidate-promote.yml@v4-alpha",
   "github.event.workflow_run.event == 'push'",
   "!startsWith(github.event.workflow_run.display_title, 'chore(release): prepare v')",
   "!startsWith(github.event.workflow_run.display_title, 'chore(release): release v')",
@@ -1030,7 +1030,7 @@ for (const requiredSnippet of [
   "resume-buildchain-runtime-sha:",
   "uses: kungfu-systems/buildchain/.github/workflows/release-candidate-promote.yml@v4",
   "release-passport-buildchain-self-kfd: true",
-  "node .buildchain/router/scripts/promotion-identity-resolver.mjs",
+  "buildchain-channel: alpha",
   "release-passport-impact-json: .buildchain/release-impact.json",
 ]) {
   if (!buildchainRefPromotionWorkflow.includes(requiredSnippet)) {

package/scripts/check-v4-floating-consumer-policy-contract.mjs

@@ -52,8 +52,13 @@ function assertOrdered(relative, markers) {
 
 export function assertPromotionCertificationWiring(source) {
   for (const marker of [
-    ".buildchain/runtime/promotion-shell/scripts/v4-consumer-policy.mjs certify",
-    '--caller-root "${{ github.workspace }}"',
+    "path: .buildchain/runtime/candidate-policy-runtime",
+    "BUILDCHAIN_EXPECTED_RUNTIME_SHA: ${{ steps.v4-policy-caller.outputs.runtime-sha }}",
+    "policy_runtime=.buildchain/runtime",
+    'node "${policy_runtime}/scripts/v4-consumer-policy.mjs" certify',
+    "passport.consumerPolicy?.receipt?.caller?.sourceSha",
+    "path: .buildchain/runtime/policy-caller",
+    '--caller-root "${{ github.workspace }}/.buildchain/runtime/policy-caller"',
     '--stable-lock "${{ inputs.buildchain-stable-contract-lock-path }}"',
     '--alpha-lock "${{ inputs.buildchain-alpha-contract-lock-path }}"',
     "release-passport-v4-consumer-policy-certification-root: ${{ steps.v4-policy-certification.outputs.v4-consumer-policy-certification-root }}",
@@ -78,13 +83,22 @@ function assertPersistedSelectors() {
       );
       if (!match) continue;
       const selector = match[2];
+      const protectedBootstrap =
+        relative ===
+          ".github/workflows/buildchain-ref-promotion-recovery.yml" &&
+        match[1] === ".github/workflows/.release-candidate-promote.yml" &&
+        selector === "alpha/v4/v4.0";
       const isV4 =
         selector === "v4" ||
         selector === "v4-alpha" ||
         /^v4(?:[./-]|$)/u.test(selector) ||
         /^[0-9a-f]{40}$/iu.test(selector) ||
         selector.includes("${{");
-      if (isV4 && !["v4", "v4-alpha"].includes(selector)) {
+      if (
+        (isV4 || protectedBootstrap) &&
+        !["v4", "v4-alpha"].includes(selector) &&
+        !protectedBootstrap
+      ) {
         offenders.push(`${relative}:${node.line} @${selector}`);
       }
     }
@@ -112,7 +126,12 @@ export function checkV4FloatingConsumerPolicyContract() {
     "Enforce v4 floating consumer policy",
     "Validate consumer package manager contract",
   ]);
-  if (!read(".github/workflows/.build.yml").includes("BUILDCHAIN_EXPECTED_INVOCATION_CHANNEL: ${{ inputs.buildchain-expected-channel }}")) fail("channel builds must disambiguate dual-channel caller invocations");
+  if (
+    !read(".github/workflows/.build.yml").includes(
+      "BUILDCHAIN_EXPECTED_INVOCATION_CHANNEL: ${{ inputs.buildchain-expected-channel }}",
+    )
+  )
+    fail("channel builds must disambiguate dual-channel caller invocations");
   assertTrustGatedJobs(read(".github/workflows/.build.yml"), [
     "resolve-source",
     "resolve-contract",

package/scripts/dev-delivery-warrant-store.mjs

@@ -46,7 +46,7 @@ function decodeBlob(blob) {
   ).toString("utf8");
 }
 
-function validateStoredState(queue) {
+function validateStoredState(queue, { allowLegacyV3Readback = false } = {}) {
   const body = structuredClone(queue || {});
   const embeddedStateRoot = body.stateRoot;
   delete body.stateRoot;
@@ -59,7 +59,7 @@ function validateStoredState(queue) {
   ) {
     normalizeDevDeliveryAuthorityState(queue);
   } else {
-    normalizeDevDeliveryQueue(queue);
+    normalizeDevDeliveryQueue(queue, { allowLegacyV3Readback });
   }
   return queue;
 }
@@ -108,7 +108,7 @@ export class GitHubDevDeliveryStore {
     return data;
   }
 
-  async read({ stateRef, protectedBase, now }) {
+  async read({ stateRef, protectedBase, now, allowLegacyV3Readback = false }) {
     let ref;
     try {
       ref = await this.request(
@@ -128,11 +128,13 @@ export class GitHubDevDeliveryStore {
       };
     }
     const commitSha = exactSha(ref?.object?.sha, "state ref commit");
-    const readback = await this.readCommit(commitSha);
+    const readback = await this.readCommit(commitSha, {
+      allowLegacyV3Readback,
+    });
     return { exists: true, ...readback };
   }
 
-  async readCommit(commitShaInput) {
+  async readCommit(commitShaInput, { allowLegacyV3Readback = false } = {}) {
     const commitSha = exactSha(commitShaInput, "state commit");
     const commit = await this.request(
       "GET",
@@ -152,7 +154,9 @@ export class GitHubDevDeliveryStore {
       `/repos/${this.repository.fullName}/git/blobs/${entry.sha}`,
     );
     const bytes = decodeBlob(blob);
-    const queue = validateStoredState(JSON.parse(bytes));
+    const queue = validateStoredState(JSON.parse(bytes), {
+      allowLegacyV3Readback,
+    });
     return { commitSha, queue, bytes };
   }
 

package/scripts/dev-delivery-warrant.mjs

@@ -295,7 +295,10 @@ async function observeQueue(loaded, options) {
   const readMode = text(options.readMode || "v3").toLowerCase();
   if (!["v3", "v4"].includes(readMode))
     throw new Error("readMode must be v3 or v4");
-  let observation = observeDevDeliveryQueue(loaded.queue, { now: options.now });
+  let observation = observeDevDeliveryQueue(loaded.queue, {
+    now: options.now,
+    allowLegacyV3Readback: true,
+  });
   let readCandidate;
   if (readMode === "v4") {
     const qualification =
@@ -374,6 +377,7 @@ export async function runDevDeliveryCommand(optionsInput = {}, clientInput) {
     stateRef: options.stateRef,
     protectedBase: options.branch,
     now: options.now,
+    allowLegacyV3Readback: options.command === "observe",
   });
   if (
     options.expectedOldStateRoot &&

package/scripts/dev-pr-delivery-warrant.mjs

@@ -143,6 +143,7 @@ export async function readCurrentDeliveryQueueState(client, repository, targetBr
   const { queue } = await store.read({
     stateRef: defaultDevDeliveryStateRef(targetBranch),
     protectedBase: targetBranch,
+    allowLegacyV3Readback: true,
   });
   return queue;
 }

package/scripts/dev-qualification-patrol.mjs

@@ -501,16 +501,16 @@ export function createGitHubDevQualificationClient({
       sourceBranch,
       { activeOnly = false } = {},
     ) {
-      const query = sourceBranch
-        ? `?branch=${encodeURIComponent(sourceBranch)}`
-        : "";
-      const runs = await paged(
-        `/repos/${owner}/${repo}/actions/workflows/${encodeURIComponent(workflow)}/runs${query}`,
-        "workflow_runs",
+      const query = sourceBranch ? `branch=${encodeRef(sourceBranch)}&` : "";
+      const runs = await Promise.all(
+        [...(activeOnly ? ACTIVE_STATUSES : [""])].map((status) =>
+          paged(
+            `/repos/${owner}/${repo}/actions/workflows/${encodeURIComponent(workflow)}/runs?${query}${status ? `status=${status}` : ""}`,
+            "workflow_runs",
+          ),
+        ),
       );
-      return activeOnly
-        ? runs.filter((run) => ACTIVE_STATUSES.has(text(run.status)))
-        : runs;
+      return runs.flat();
     },
     async listRunJobs(runId, runAttempt) {
       return paged(

package/scripts/generate-channel-promotion-workflow.mjs

@@ -159,8 +159,8 @@ function validateWorkflowRoute(name, route, expectedLogicalRef) {
   if (!/^\.github\/workflows\/[.a-z0-9-]+\.ya?ml$/.test(route.workflowPath || "")) {
     throw new Error(`promotion shell ${name} workflowPath must name a reusable workflow`);
   }
-  if (!/^(?:v[0-9]+(?:-alpha)?|train\/[A-Za-z0-9._+\/-]+|[0-9a-f]{40})$/.test(route.callRef || "")) {
-    throw new Error(`promotion shell ${name} callRef must be an official channel ref, trusted train, or exact SHA`);
+  if (!/^(?:v[0-9]+(?:-alpha)?|(?:train|alpha|release)\/[A-Za-z0-9._+\/-]+|[0-9a-f]{40})$/.test(route.callRef || "")) {
+    throw new Error(`promotion shell ${name} callRef must be an official tag, protected channel ref, trusted train, or exact SHA`);
   }
   if (typeof route.forwardInternalInputs !== "boolean") {
     throw new Error(`promotion shell ${name} forwardInternalInputs must be boolean`);

package/scripts/promotion-channel-router.mjs

@@ -66,8 +66,8 @@ export function resolvePromotionChannel({
   }
   const shellRef = intent.shellChannel === "alpha" ? `v${selected.major}-alpha` : `v${selected.major}`;
   return {
-    targetRef: intent.targetRef,
-    publicationChannel: intent.publicationChannel,
+    targetRef: intent.targetRef, publicationChannel: intent.publicationChannel,
+    routerRef: normalized(routerRef), routerSha: normalized(routerSha).toLowerCase(),
     channel: intent.shellChannel,
     major: selected.major,
     shellRef,
@@ -99,8 +99,8 @@ function readPackageVersion(cwd) {
 
 function writeOutputs(file, result) {
   const outputs = {
-    "target-ref": result.targetRef,
-    "publication-channel": result.publicationChannel,
+    "target-ref": result.targetRef, "publication-channel": result.publicationChannel,
+    "router-ref": result.routerRef, "router-sha": result.routerSha,
     channel: result.channel,
     major: String(result.major),
     "shell-ref": result.shellRef,

package/scripts/release-candidate-anchor-provenance.mjs

@@ -0,0 +1,99 @@
+import path from "node:path";
+
+export function resolveAnchorRecoveryRequest({ passport, buildSummary, transactionId = "" } = {}) {
+  if (Number(passport?.pullRequest?.number || 0)) return undefined;
+  if (passport?.target?.channel !== "anchor" || passport?.target?.ref !== "publish-gate/anchor") {
+    throw new Error("Release Candidate Passport has no PR identity");
+  }
+  let releaseManifest;
+  try {
+    releaseManifest = JSON.parse(buildSummary?.publishSource?.releaseManifest || "");
+  } catch {
+    throw new Error("anchored candidate release manifest is invalid");
+  }
+  const request = releaseManifest?.anchorRequest;
+  if (
+    releaseManifest?.sourceRef !== "publish-gate/anchor" ||
+    releaseManifest?.sourceSha !== passport.source?.headSha ||
+    request?.schema !== 1 ||
+    request?.contract !== "kungfu-buildchain-explicit-publish-anchor-request/v1" ||
+    !request.assignmentId ||
+    !/^native:[0-9a-f-]+$/u.test(String(request.attemptId || "")) ||
+    request.transactionId !== transactionId ||
+    request.source?.sha !== passport.source?.headSha ||
+    request.source?.tree !== passport.source?.treeHash ||
+    !/^\d+$/u.test(String(request.supersededCandidate?.workflowRunId || "")) ||
+    !/^[0-9a-f]{40}$/u.test(String(request.supersededCandidate?.sha || "")) ||
+    !/^sha256:[0-9a-f]{64}$/u.test(String(request.supersededCandidate?.root || "")) ||
+    request.runtime?.sha !== passport.buildchain?.sha
+  ) {
+    throw new Error("anchored candidate request does not bind the sealed recovery identity");
+  }
+  return request;
+}
+
+function normalizeRun(run, repository) {
+  return {
+    id: String(run.id), repository,
+    headRepository: run.head_repository?.full_name || "",
+    status: run.status, conclusion: run.conclusion,
+    event: run.event, path: run.path, name: run.name,
+    headSha: run.head_sha || "", headBranch: run.head_branch || "",
+    pullRequestNumbers: (run.pull_requests || []).map((entry) => Number(entry.number)),
+  };
+}
+
+export function normalizeCandidateRun(run, repository) {
+  return normalizeRun(run, repository);
+}
+
+export function normalizeAnchorProvenance(anchorProvenance, repository) {
+  if (!anchorProvenance) return undefined;
+  return {
+    request: anchorProvenance.request,
+    run: normalizeRun(anchorProvenance.run, repository),
+    workflow: {
+      path: anchorProvenance.workflow.path,
+      name: anchorProvenance.workflow.name,
+      state: anchorProvenance.workflow.state,
+    },
+    passport: anchorProvenance.passport,
+    buildSummary: anchorProvenance.buildSummary,
+  };
+}
+
+export async function recoverCandidateProvenance({
+  passport, buildSummary, transactionId, repoInfo, artifactName,
+  expectedWorkflowFile, expectedWorkflowName, channel, apiUrl, token,
+  fetchImpl, archiveDir, bundleRoot, githubJson, selectReleaseCandidateArtifacts,
+  downloadArtifact, readOnlyJson,
+}) {
+  const request = resolveAnchorRecoveryRequest({ passport, buildSummary, transactionId });
+  if (!request) {
+    return { anchorProvenance: undefined, provenancePassport: passport };
+  }
+  const runId = String(request.supersededCandidate.workflowRunId);
+  const run = await githubJson({ apiUrl, token, fetchImpl, path: `/repos/${repoInfo.owner}/${repoInfo.repo}/actions/runs/${runId}` });
+  const workflow = await githubJson({ apiUrl, token, fetchImpl, path: `/repos/${repoInfo.owner}/${repoInfo.repo}/actions/workflows/${run.workflow_id}` });
+  const artifactResponse = await githubJson({ apiUrl, token, fetchImpl, path: `/repos/${repoInfo.owner}/${repoInfo.repo}/actions/runs/${runId}/artifacts?per_page=100` });
+  const artifacts = Array.isArray(artifactResponse.artifacts) ? artifactResponse.artifacts : [];
+  if (Number(artifactResponse.total_count || artifacts.length) !== artifacts.length) throw new Error("superseded candidate run has more than 100 artifacts; complete pagination is required before recovery");
+  const selected = selectReleaseCandidateArtifacts({ artifacts, artifactName });
+  const provenanceRoot = path.join(bundleRoot, "anchored-provenance");
+  const passportDownload = await downloadArtifact({ artifact: selected.passport, repoInfo, apiUrl, token, archiveDir, bundleRoot: provenanceRoot, fetchImpl });
+  const summaryDownload = await downloadArtifact({ artifact: selected.summary, repoInfo, apiUrl, token, archiveDir, bundleRoot: provenanceRoot, fetchImpl });
+  const recoveredPassport = readOnlyJson(passportDownload.files.filter((file) => path.basename(file.path) === "release-candidate-passport.json"), "superseded release-candidate-passport.json");
+  const recoveredBuildSummary = readOnlyJson(summaryDownload.files.filter((file) => path.basename(file.path) === "build-summary.json"), "superseded build-summary.json");
+  if (
+    String(run.id) !== runId ||
+    recoveredPassport.workflow?.runId !== runId ||
+    recoveredPassport.workflow?.name !== expectedWorkflowName ||
+    String(workflow.path || run.path || "").split("@")[0].replace(/^\.github\/workflows\//u, "") !== expectedWorkflowFile.replace(/^\.github\/workflows\//u, "") ||
+    recoveredPassport.target?.channel !== channel ||
+    recoveredPassport.source?.headSha !== request.supersededCandidate.sha ||
+    recoveredPassport.source?.treeHash !== request.source.tree ||
+    `sha256:${recoveredPassport.candidateHash}` !== request.supersededCandidate.root
+  ) throw new Error("superseded candidate provenance does not match the anchored request");
+  const anchorProvenance = { request, run, workflow, passport: recoveredPassport, buildSummary: recoveredBuildSummary };
+  return { anchorProvenance, provenancePassport: recoveredPassport };
+}

package/scripts/resume-from-candidate-run.mjs

@@ -7,6 +7,8 @@ import { execFileSync } from "node:child_process";
 import { pathToFileURL } from "node:url";
 
 import { writeGitHubOutputs } from "./build-contract-core.mjs";
+import { normalizeAnchorProvenance, normalizeCandidateRun, recoverCandidateProvenance } from "./release-candidate-anchor-provenance.mjs";
+export { resolveAnchorRecoveryRequest } from "./release-candidate-anchor-provenance.mjs";
 import {
   generatePublishRequiredArtifacts,
   githubDownload,
@@ -878,7 +880,13 @@ export async function resumeFromCandidateRun({
       repoInfo, runId, artifactName, artifactPatterns, requiredArtifactCount,
       outputDir, apiUrl, token, fetchImpl, archiveDir,
     });
-    const prNumber = Number(passport.pullRequest?.number || 0);
+    const { anchorProvenance, provenancePassport } = await recoverCandidateProvenance({
+      passport, buildSummary, transactionId, repoInfo, artifactName,
+      expectedWorkflowFile, expectedWorkflowName, channel, apiUrl, token,
+      fetchImpl, archiveDir, bundleRoot, githubJson, selectReleaseCandidateArtifacts,
+      downloadArtifact, readOnlyJson,
+    });
+    const prNumber = Number(provenancePassport.pullRequest?.number || 0);
     if (!prNumber) throw new Error("Release Candidate Passport has no PR identity");
     const pullRequest = await githubJson({ apiUrl, token, fetchImpl, path: `/repos/${repoInfo.owner}/${repoInfo.repo}/pulls/${prNumber}` });
     const targetCommit = await githubJson({ apiUrl, token, fetchImpl, path: `/repos/${repoInfo.owner}/${repoInfo.repo}/git/commits/${targetSha}` });
@@ -944,20 +952,9 @@ export async function resumeFromCandidateRun({
       expectedRuntimeSha: candidateRuntimeSha,
       expectedTransactionId: transactionId,
       existingTransaction,
-      run: {
-        id: String(run.id),
-        repository: repoInfo.fullName,
-        headRepository: run.head_repository?.full_name || "",
-        status: run.status,
-        conclusion: run.conclusion,
-        event: run.event,
-        path: run.path,
-        name: run.name,
-        headSha: run.head_sha || "",
-        headBranch: run.head_branch || "",
-        pullRequestNumbers: (run.pull_requests || []).map((entry) => Number(entry.number)),
-      },
+      run: normalizeCandidateRun(run, repoInfo.fullName),
       workflow: { path: workflow.path, name: workflow.name, state: workflow.state },
+      anchorProvenance: normalizeAnchorProvenance(anchorProvenance, repoInfo.fullName),
       pullRequest: {
         number: pullRequest.number,
         merged: pullRequest.merged === true,

package/scripts/site-capability-metadata.mjs

@@ -195,6 +195,7 @@ export function nodeApiMeta(exportName) {
     "./homebrew": { group: "distribution-indexes", summary: "Homebrew tap fact collection, Formula rendering, update, and check APIs." },
     "./build-facts": { group: "observability-diagnostics", summary: "Git source, version, module output, product artifact, and legacy Kungfu build fact APIs." },
     "./candidate-timeline": { group: "observability-diagnostics", summary: "Source-bound candidate event normalization, per-attempt critical-path-safe aggregation, and compact reporting APIs." },
+    "./ci-lane-change-budget": { group: "governance-versioning", summary: "Exact-baseline CI lane admission requiring authority, trigger, concurrency, runner, cancellation, and merge-critical SLO budgets." },
     "./channel-candidate": { group: "governance-versioning", summary: "Exact-source channel candidate decisions, same-SHA workflow evidence validation, and deterministic source-lock reference APIs." },
     "./dev-delivery-authority": { group: "governance-versioning", summary: "Opt-in bounded Qualification Lease, exclusive Landing Warrant, provider-attempt admission and heartbeat readback, terminal sealing, and expired-Landing verification APIs." },
     "./dev-delivery-warrant": { group: "governance-versioning", summary: "Durable fair Dev Delivery Warrant queue, fenced lease, and split source and integration proof APIs." },

package/scripts/v4-consumer-policy.mjs

@@ -41,6 +41,9 @@ export function scanCommand(options = {}) {
   const root = path.resolve(
     options.root || env("BUILDCHAIN_CONSUMER_ROOT", process.cwd()),
   );
+  const invocationRoot = path.resolve(
+    options.invocationRoot || env("BUILDCHAIN_INVOCATION_SOURCE_ROOT", root),
+  );
   const output = path.resolve(
     root,
     options.output ||
@@ -54,6 +57,7 @@ export function scanCommand(options = {}) {
   );
   const result = scanV4FloatingConsumerPolicy({
     root,
+    invocationRoot,
     repository: options.repository || env("GITHUB_REPOSITORY"),
     sourceSha: options.sourceSha || env("GITHUB_SHA"),
     invokedWorkflow: