@kungfu-tech/buildchain 4.0.1 → 4.0.2-alpha.2

package/scripts/generate-channel-promotion-workflow.mjs

@@ -74,7 +74,7 @@ function publicInputs(inputBlock) {
 function publicOutputs(outputBlock) {
   const forwarded = entries(outputBlock).map((entry) => entry.source.replace(
     /^        value:.*$/m,
-    `        value: \${{ jobs.alpha.outputs.${entry.name} || jobs.stable.outputs.${entry.name} }}`,
+    `        value: \${{ jobs.invoke.outputs.${entry.name} }}`,
   ));
   const routed = [
     ["buildchain-channel", "Selected promotion workflow-shell channel", "channel"],
@@ -292,7 +292,7 @@ export function generateChannelPromotionWorkflow(source, { major = 2, shellRouti
     },
   };
   const alphaRoute = validateWorkflowRoute("alpha", routes.alpha, `v${major}-alpha`);
-  const stableRoute = validateWorkflowRoute("stable", routes.stable, `v${major}`);
+  validateWorkflowRoute("stable", routes.stable, `v${major}`);
   const inputs = blockBetween(source, "    inputs:\n", "    secrets:\n");
   const secrets = blockBetween(source, "    secrets:\n", "    outputs:\n");
   const outputs = blockBetween(source, "    outputs:\n", "\nconcurrency:\n");
@@ -300,8 +300,7 @@ export function generateChannelPromotionWorkflow(source, { major = 2, shellRouti
   for (const required of ["buildchain-ref", "buildchain-contract-lock-path", "channel", "target-ref", ...internalInputs]) {
     if (!inputNames.includes(required)) throw new Error(`advanced promotion workflow missing input: ${required}`);
   }
-  const alphaForwarded = routedInputs(inputNames, alphaRoute, major);
-  const stableForwarded = routedInputs(inputNames, stableRoute, major);
+  const invokeForwarded = routedInputs(inputNames, alphaRoute, major);
   return `# Generated by scripts/generate-channel-promotion-workflow.mjs. Do not edit directly.
 name: Release Candidate Promote
 
@@ -336,7 +335,7 @@ jobs:
       target-ref: \${{ steps.route.outputs.target-ref }}
       router-ref: \${{ steps.router.outputs.ref }}
       router-sha: \${{ steps.router.outputs.sha }}
-      shell-ref: \${{ steps.route.outputs.shell-ref }}
+      shell-ref: \${{ steps.identities.outputs.shell-ref }}
       shell-call-ref: \${{ steps.identities.outputs.shell-call-ref }}
       shell-sha: \${{ steps.identities.outputs.shell-sha }}
       runtime-ref: \${{ steps.route.outputs.runtime-ref }}
@@ -425,32 +424,17 @@ jobs:
         shell: bash
         env:
           GITHUB_TOKEN: \${{ github.token }}
-          CHANNEL: \${{ steps.route.outputs.channel }}
-          SELECTED_SHELL_REF: \${{ steps.route.outputs.shell-ref }}
-          ALPHA_SHELL_REF: ${alphaRoute.logicalRef}
-          ALPHA_SHELL_CALL_REF: ${alphaRoute.callRef}
-          STABLE_SHELL_REF: ${stableRoute.logicalRef}
-          STABLE_SHELL_CALL_REF: ${stableRoute.callRef}
+          SELECTED_SHELL_REF: ${alphaRoute.logicalRef}
         run: |
           set -euo pipefail
-          if [[ "\${CHANNEL}" = "alpha" ]]; then
-            expected_ref="\${ALPHA_SHELL_REF}"
-            call_ref="\${ALPHA_SHELL_CALL_REF}"
-          else
-            expected_ref="\${STABLE_SHELL_REF}"
-            call_ref="\${STABLE_SHELL_CALL_REF}"
-          fi
-          if [[ "\${SELECTED_SHELL_REF}" != "\${expected_ref}" ]]; then
-            echo "::error::Selected promotion shell ref \${SELECTED_SHELL_REF} does not match configured \${expected_ref}"
-            exit 1
-          fi
           node .buildchain/router/scripts/promotion-identity-resolver.mjs \\
             --repository "\${{ steps.router.outputs.repository }}" \\
             --router-ref "\${{ steps.router.outputs.ref }}" \\
             --router-sha "\${{ steps.router.outputs.sha }}" \\
             --shell-ref "\${SELECTED_SHELL_REF}" \\
-            --shell-call-ref "\${call_ref}" \\
+            --shell-call-ref "\${SELECTED_SHELL_REF}" \\
             --runtime-ref "\${{ steps.route.outputs.runtime-ref }}"
+          echo "shell-ref=\${SELECTED_SHELL_REF}" >> "$GITHUB_OUTPUT"
 
       - name: Checkout selected promotion workflow shell
         uses: actions/checkout@v7.0.0
@@ -500,29 +484,21 @@ jobs:
       - name: Verify immutable promotion checkouts
         shell: bash
         env:
-          CHANNEL: \${{ steps.route.outputs.channel }}
-          ALPHA_SHELL_WORKFLOW_PATH: ${alphaRoute.workflowPath}
-          STABLE_SHELL_WORKFLOW_PATH: ${stableRoute.workflowPath}
+          SHELL_WORKFLOW_PATH: ${alphaRoute.workflowPath}
           ROUTER_SHA: \${{ steps.router.outputs.sha }}
           SHELL_SHA: \${{ steps.identities.outputs.shell-sha }}
           RUNTIME_SHA: \${{ steps.identities.outputs.runtime-sha }}
         run: |
           set -euo pipefail
-          if [[ "\${CHANNEL}" = "alpha" ]]; then
-            workflow_path="\${ALPHA_SHELL_WORKFLOW_PATH}"
-          else
-            workflow_path="\${STABLE_SHELL_WORKFLOW_PATH}"
-          fi
-          test -f ".buildchain/shell/\${workflow_path}"
+          test -f ".buildchain/shell/\${SHELL_WORKFLOW_PATH}"
           [[ "$(git -C .buildchain/router rev-parse HEAD)" = "\${ROUTER_SHA}" ]] || { echo "::error::Promotion router checkout moved"; exit 1; }
           [[ "$(git -C .buildchain/shell rev-parse HEAD)" = "\${SHELL_SHA}" ]] || { echo "::error::Promotion shell checkout moved"; exit 1; }
           [[ "$(git -C .buildchain/runtime rev-parse HEAD)" = "\${RUNTIME_SHA}" ]] || { echo "::error::Promotion runtime checkout moved"; exit 1; }
 
 ${consumerAdmissionJob()}
-  alpha:
-    name: Promote with alpha workflow shell
+  invoke:
+    name: Invoke the single v4 publisher adapter
     needs: [resolve-promotion, consumer-admission]
-    if: \${{ needs.resolve-promotion.outputs.channel == 'alpha' }}
     uses: kungfu-systems/buildchain/${alphaRoute.workflowPath}@${alphaRoute.callRef}
     permissions:
       actions: write
@@ -534,25 +510,7 @@ ${consumerAdmissionJob()}
       issues: write
       pull-requests: write
     with:
-${alphaForwarded}
-    secrets: inherit
-
-  stable:
-    name: Promote with stable workflow shell
-    needs: [resolve-promotion, consumer-admission]
-    if: \${{ needs.resolve-promotion.outputs.channel == 'stable' }}
-    uses: kungfu-systems/buildchain/${stableRoute.workflowPath}@${stableRoute.callRef}
-    permissions:
-      actions: write
-      artifact-metadata: write
-      attestations: write
-      checks: write
-      contents: write
-      id-token: write
-      issues: write
-      pull-requests: write
-    with:
-${stableForwarded}
+${invokeForwarded}
     secrets: inherit
 `;
 }

package/scripts/v3-v4-capability-catalog.mjs

@@ -23,6 +23,9 @@ const PLATFORM_MARKERS = Object.freeze({
   "self-hosted": /\bself-hosted\b/iu,
   windows: /\bwindows\b/iu,
 });
+const LIVE_V4_PROTECTED_BRANCH = "refs/heads/dev/v4/v4.0";
+const LIVE_V4_PROTECTED_LINEAGE_REF = "refs/remotes/origin/dev/v4/v4.0";
+const PROTECTED_LINEAGE_DEPTH = 256;
 
 export function sha256(value) {
   return `sha256:${crypto.createHash("sha256").update(value).digest("hex")}`;
@@ -47,6 +50,110 @@ export function git(root, args, { trim = true } = {}) {
   return trim ? output.trim() : output;
 }
 
+export function assertCapabilityCutAncestor({
+  root = process.cwd(),
+  revision,
+  descendant = "HEAD",
+  label = "capability cut",
+} = {}) {
+  try {
+    execFileSync("git", ["merge-base", "--is-ancestor", revision, descendant], {
+      cwd: root,
+      stdio: "ignore",
+    });
+  } catch {
+    throw new Error(
+      `${label} ${revision} must be an ancestor of ${descendant}; regenerate the cut after rebasing instead of relying on a retained local object`,
+    );
+  }
+}
+
+export function ensureCapabilityCutAncestor({
+  root = process.cwd(),
+  revision,
+  descendant = "HEAD",
+  label = "capability cut",
+} = {}) {
+  try {
+    assertCapabilityCutAncestor({ root, revision, descendant, label });
+    return;
+  } catch (error) {
+    if (git(root, ["rev-parse", "--is-shallow-repository"]) !== "true")
+      throw error;
+  }
+  const descendantCommit = git(root, ["rev-parse", `${descendant}^{commit}`]);
+  try {
+    execFileSync(
+      "git",
+      ["fetch", "--no-tags", "--depth=128", "origin", descendantCommit],
+      { cwd: root, stdio: "ignore" },
+    );
+  } catch {
+    throw new Error(
+      `${label} ${revision} ancestry could not be hydrated from ${descendantCommit} through a bounded origin fetch`,
+    );
+  }
+  assertCapabilityCutAncestor({ root, revision, descendant, label });
+}
+
+function protectedV4TreeWitness(root, descendant) {
+  try {
+    execFileSync(
+      "git",
+      [
+        "fetch",
+        "--no-tags",
+        `--depth=${PROTECTED_LINEAGE_DEPTH}`,
+        "origin",
+        `${LIVE_V4_PROTECTED_BRANCH}:${LIVE_V4_PROTECTED_LINEAGE_REF}`,
+      ],
+      { cwd: root, stdio: "ignore" },
+    );
+  } catch {
+    throw new Error(
+      `protected v4 lineage ${LIVE_V4_PROTECTED_BRANCH} could not be hydrated through a bounded origin fetch`,
+    );
+  }
+  const tree = git(root, ["rev-parse", `${descendant}^{tree}`]);
+  return (
+    git(root, [
+      "log",
+      `--max-count=${PROTECTED_LINEAGE_DEPTH}`,
+      "--format=%H %T",
+      LIVE_V4_PROTECTED_LINEAGE_REF,
+    ])
+      .split("\n")
+      .map((row) => row.split(" "))
+      .find(([, candidateTree]) => candidateTree === tree)?.[0] || ""
+  );
+}
+
+export function ensureCapabilityCutLineage({
+  root = process.cwd(),
+  revision,
+  descendant = "HEAD",
+  label = "capability cut",
+} = {}) {
+  try {
+    ensureCapabilityCutAncestor({ root, revision, descendant, label });
+    return { mode: "direct-ancestry", witness: descendant };
+  } catch (directError) {
+    const witness = protectedV4TreeWitness(root, descendant);
+    if (!witness)
+      throw new Error(
+        `${label} ${revision} is not an ancestor of ${descendant}, and ${descendant} has no tree-equivalent commit in the bounded protected v4 lineage`,
+        { cause: directError },
+      );
+    ensureCapabilityCutAncestor({
+      root,
+      revision,
+      descendant: witness,
+      label: `${label} protected-lineage witness`,
+    });
+    return { mode: "protected-tree-equivalent", witness };
+  }
+}
+
 function gitJson(root, revision, relPath) {
   return JSON.parse(
     git(root, ["show", `${revision}:${relPath}`], { trim: false }),

package/scripts/v4-declarative-promotion-admission.mjs

@@ -8,7 +8,10 @@ export function admitV4DeclarativePromotion({
   runtimeRef,
   declarative,
 }) {
-  if (!/^v4(?:$|[-./])/u.test(String(runtimeRef || ""))) {
+  if (
+    declarative !== true &&
+    !/^v4(?:$|[-./])/u.test(String(runtimeRef || ""))
+  ) {
     return Object.freeze({ mode: "legacy", admitted: true });
   }
   if (declarative !== true) {

package/scripts/capture-package-release-propagation.mjs

@@ -1,263 +0,0 @@
-#!/usr/bin/env node
-
-import crypto from "node:crypto";
-import fs from "node:fs";
-import os from "node:os";
-import path from "node:path";
-import { execFileSync } from "node:child_process";
-import { fileURLToPath } from "node:url";
-import {
-  createPackageReleasePropagationCapture,
-  normalizePackageReleasePropagationConfig,
-} from "../packages/core/release-propagation-capture.js";
-import { stableJson } from "../packages/core/release-propagation-common.js";
-
-function parseArgs(argv) {
-  const args = {};
-  for (let index = 0; index < argv.length; index += 1) {
-    const token = argv[index];
-    if (!token.startsWith("--")) throw new Error(`unexpected argument: ${token}`);
-    const key = token.slice(2);
-    const value = argv[index + 1];
-    if (!value || value.startsWith("--")) throw new Error(`${token} requires a value`);
-    args[key] = value;
-    index += 1;
-  }
-  return args;
-}
-
-function required(args, key) {
-  const value = String(args[key] || "").trim();
-  if (!value) throw new Error(`--${key} is required`);
-  return value;
-}
-
-function sha256(bytes) {
-  return crypto.createHash("sha256").update(bytes).digest("hex");
-}
-
-function commandJson(command, args, options = {}) {
-  const text = execFileSync(command, args, { encoding: "utf8", ...options });
-  return JSON.parse(text);
-}
-
-function assertSourcePath(value) {
-  const sourcePath = String(value || "").trim();
-  if (!sourcePath || path.isAbsolute(sourcePath) || sourcePath.split("/").includes("..") || /[\r\n]/.test(sourcePath)) {
-    throw new Error("release propagation config path must be a safe repository-relative path");
-  }
-  return sourcePath;
-}
-
-function hasCommit(sourceSha, cwd) {
-  try {
-    execFileSync("git", ["cat-file", "-e", `${sourceSha}^{commit}`], {
-      cwd,
-      stdio: "ignore",
-    });
-    return true;
-  } catch {
-    return false;
-  }
-}
-
-export function readConfigAtSource(sourceSha, configPath, cwd) {
-  if (!hasCommit(sourceSha, cwd)) {
-    try {
-      execFileSync("git", ["fetch", "--no-tags", "--depth=1", "origin", sourceSha], {
-        cwd,
-        stdio: ["ignore", "pipe", "pipe"],
-      });
-    } catch (error) {
-      const detail = String(error.stderr || error.message || "unknown git fetch failure").trim();
-      throw new Error(`exact release source ${sourceSha} is unavailable from origin: ${detail}`);
-    }
-  }
-  const bytes = execFileSync("git", ["show", `${sourceSha}:${configPath}`], {
-    cwd,
-    encoding: "utf8",
-  });
-  const parsed = JSON.parse(bytes);
-  return { bytes, parsed, normalized: normalizePackageReleasePropagationConfig(parsed) };
-}
-
-function resolveTagTarget(repository, tag) {
-  let object = commandJson("gh", ["api", `repos/${repository}/git/ref/tags/${tag}`]).object;
-  for (let depth = 0; depth < 8 && object?.type === "tag"; depth += 1) {
-    object = commandJson("gh", ["api", `repos/${repository}/git/tags/${object.sha}`]).object;
-  }
-  if (object?.type !== "commit" || !/^[0-9a-f]{40}$/i.test(object.sha || "")) {
-    throw new Error(`release tag ${tag} does not resolve to one exact commit`);
-  }
-  return object.sha.toLowerCase();
-}
-
-function resolvePackageFact(packageName, version) {
-  const fact = commandJson("npm", [
-    "view",
-    `${packageName}@${version}`,
-    "version",
-    "dist.integrity",
-    "gitHead",
-    "--json",
-    "--registry=https://registry.npmjs.org/",
-  ]);
-  return {
-    name: packageName,
-    version: String(fact.version || ""),
-    integrity: String(fact.dist?.integrity || fact["dist.integrity"] || ""),
-    gitHead: String(fact.gitHead || "").toLowerCase(),
-  };
-}
-
-function verifyPublicReleasePassport({ repository, tag, localPath }) {
-  const temporary = fs.mkdtempSync(path.join(os.tmpdir(), "buildchain-release-passport-"));
-  try {
-    execFileSync("gh", [
-      "release", "download", tag,
-      "--repo", repository,
-      "--pattern", "buildchain.release.json",
-      "--dir", temporary,
-    ], { stdio: ["ignore", "pipe", "pipe"] });
-    const localBytes = fs.readFileSync(localPath);
-    const remotePath = path.join(temporary, "buildchain.release.json");
-    const remoteBytes = fs.readFileSync(remotePath);
-    const localDigest = sha256(localBytes);
-    const remoteDigest = sha256(remoteBytes);
-    if (localDigest !== remoteDigest) {
-      throw new Error("public release passport bytes disagree with finalized local passport");
-    }
-    return {
-      url: `https://github.com/${repository}/releases/download/${tag}/buildchain.release.json`,
-      sha256: remoteDigest,
-    };
-  } finally {
-    fs.rmSync(temporary, { recursive: true, force: true });
-  }
-}
-
-function resolveBaseShas(config) {
-  return Object.fromEntries(config.targets.map((targetId) => {
-    const node = config.graph.nodes.find((entry) => entry.id === targetId);
-    if (!node?.baseRef) throw new Error(`configured propagation target ${targetId} has no baseRef`);
-    const response = commandJson("gh", ["api", `repos/${node.repository}/commits/${node.baseRef}`]);
-    const sha = String(response.sha || "").toLowerCase();
-    if (!/^[0-9a-f]{40}$/.test(sha)) {
-      throw new Error(`configured propagation target ${targetId} baseRef did not resolve exactly`);
-    }
-    return [targetId, sha];
-  }));
-}
-
-function writeOutput(name, value) {
-  if (!process.env.GITHUB_OUTPUT) return;
-  fs.appendFileSync(process.env.GITHUB_OUTPUT, `${name}=${value}\n`);
-}
-
-export function capturePackageReleasePropagation({
-  config,
-  upstreamRelease,
-  expectedBaseShas,
-  outputDir,
-  configBytes = "",
-} = {}) {
-  const captured = createPackageReleasePropagationCapture({
-    config,
-    upstreamRelease,
-    expectedBaseShas,
-  });
-  fs.mkdirSync(outputDir, { recursive: true });
-  fs.writeFileSync(
-    path.join(outputDir, "config.json"),
-    configBytes || stableJson(captured.config),
-  );
-  fs.writeFileSync(path.join(outputDir, "upstream-release.json"), stableJson(captured.upstreamRelease));
-  fs.writeFileSync(path.join(outputDir, "plan.json"), stableJson(captured.plan));
-  for (const item of captured.works) {
-    const targetDir = path.join(outputDir, "work", item.propagationKey);
-    fs.mkdirSync(targetDir, { recursive: true });
-    fs.writeFileSync(path.join(targetDir, "work.json"), stableJson(item.work));
-    fs.writeFileSync(path.join(targetDir, "status.json"), stableJson(item.status));
-  }
-  return captured;
-}
-
-export function main(argv = process.argv.slice(2)) {
-  const args = parseArgs(argv);
-  const repository = required(args, "repository");
-  const channel = required(args, "channel");
-  const sourceSha = required(args, "source-sha").toLowerCase();
-  const tag = required(args, "tag");
-  const configPath = assertSourcePath(required(args, "config-path"));
-  const releasePassportPath = path.resolve(required(args, "release-passport-path"));
-  const outputDir = path.resolve(required(args, "output-dir"));
-  if (!/^[0-9a-f]{40}$/.test(sourceSha)) throw new Error("--source-sha must be an exact commit SHA");
-  if (tag !== `v${tag.replace(/^v/, "")}`) throw new Error("--tag must be an exact v-prefixed release tag");
-  const version = tag.slice(1);
-  const configSource = readConfigAtSource(sourceSha, configPath, process.cwd());
-  const sourceNode = configSource.normalized.graph.nodes.find(
-    (node) => node.id === configSource.normalized.sourceNode,
-  );
-  const packageFact = resolvePackageFact(sourceNode.package, version);
-  const tagTargetSha = resolveTagTarget(repository, tag);
-  const releasePassport = verifyPublicReleasePassport({
-    repository,
-    tag,
-    localPath: releasePassportPath,
-  });
-  const upstreamRelease = {
-    repository,
-    channel,
-    tag,
-    sourceSha,
-    tagTargetSha,
-    package: packageFact,
-    releasePassport,
-  };
-  const expectedBaseShas = resolveBaseShas(configSource.normalized);
-  const captured = capturePackageReleasePropagation({
-    config: configSource.parsed,
-    configBytes: configSource.bytes,
-    upstreamRelease,
-    expectedBaseShas,
-    outputDir,
-  });
-  const artifactName = `package-propagation-work-${version}-${sourceSha}`;
-  const workRoots = captured.works.map((item) => item.work.contentRoot);
-  writeOutput("configured", "true");
-  writeOutput("artifact-name", artifactName);
-  writeOutput("work-roots-json", JSON.stringify(workRoots));
-  process.stdout.write(stableJson({
-    schemaVersion: 1,
-    contract: "kungfu-buildchain-package-release-propagation-capture-result",
-    artifactName,
-    release: {
-      repository,
-      channel,
-      tag,
-      sourceSha,
-      tagTargetSha,
-      package: packageFact,
-      releasePassport,
-    },
-    workCount: captured.works.length,
-    works: captured.works.map((item) => ({
-      target: item.target,
-      repository: item.repository,
-      propagationKey: item.propagationKey,
-      workId: item.work.workId,
-      workRoot: item.work.contentRoot,
-      nextAction: item.status.nextAction,
-    })),
-  }));
-}
-
-const isMain = process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url);
-if (isMain) {
-  try {
-    main();
-  } catch (error) {
-    console.error(error.message);
-    process.exitCode = 1;
-  }
-}