@kungfu-tech/buildchain 4.0.1 → 4.0.2-alpha.2

package/contracts/v4-release-invocation-v1.schema.json

@@ -0,0 +1,86 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://buildchain.libkungfu.dev/schema/v4-release-invocation-v1.schema.json",
+  "title": "Buildchain v4 canonical ReleaseInvocation",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schema",
+    "publisher",
+    "runtime",
+    "candidate",
+    "target",
+    "authority"
+  ],
+  "properties": {
+    "schema": { "const": "kungfu-buildchain-v4-release-invocation/v1" },
+    "publisher": { "$ref": "#/$defs/publisher" },
+    "runtime": { "$ref": "#/$defs/runtime" },
+    "candidate": { "$ref": "#/$defs/candidate" },
+    "target": { "$ref": "#/$defs/target" },
+    "authority": { "$ref": "#/$defs/authority" }
+  },
+  "$defs": {
+    "sha": { "type": "string", "pattern": "^[0-9a-f]{40}$" },
+    "root": { "type": "string", "pattern": "^sha256:[0-9a-f]{64}$" },
+    "publisher": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["repository", "workflow", "workflowSha", "job"],
+      "properties": {
+        "repository": { "const": "kungfu-systems/buildchain" },
+        "workflow": {
+          "const": ".github/workflows/.release-candidate-promote.yml"
+        },
+        "workflowSha": { "$ref": "#/$defs/sha" },
+        "job": { "const": "apply" }
+      }
+    },
+    "runtime": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["repository", "commit", "tree"],
+      "properties": {
+        "repository": { "const": "kungfu-systems/buildchain" },
+        "commit": { "$ref": "#/$defs/sha" },
+        "tree": { "$ref": "#/$defs/sha" }
+      }
+    },
+    "candidate": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["repository", "commit", "tree", "version"],
+      "properties": {
+        "repository": { "type": "string", "pattern": "^[ -~]+$" },
+        "commit": { "$ref": "#/$defs/sha" },
+        "tree": { "$ref": "#/$defs/sha" },
+        "version": { "type": "string", "pattern": "^[ -~]+$" }
+      }
+    },
+    "target": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["channel", "tag", "expectedOldSha"],
+      "properties": {
+        "channel": { "enum": ["alpha", "stable"] },
+        "tag": {
+          "type": "string",
+          "pattern": "^v[0-9]+\\.[0-9]+\\.[0-9]+(?:-[0-9A-Za-z.-]+)?$"
+        },
+        "expectedOldSha": {
+          "oneOf": [{ "$ref": "#/$defs/sha" }, { "type": "null" }]
+        }
+      }
+    },
+    "authority": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["policyRoot", "qualificationRoot", "warrantRoot"],
+      "properties": {
+        "policyRoot": { "$ref": "#/$defs/root" },
+        "qualificationRoot": { "$ref": "#/$defs/root" },
+        "warrantRoot": { "$ref": "#/$defs/root" }
+      }
+    }
+  }
+}

package/dist/site/buildchain-contract.json

@@ -4,7 +4,7 @@
   "product": {
     "name": "Buildchain",
     "package": "@kungfu-tech/buildchain",
-    "version": "4.0.1",
+    "version": "4.0.2-alpha.2",
     "repository": "https://github.com/kungfu-systems/buildchain"
   },
   "majorLine": "v4",
@@ -1492,7 +1492,7 @@
         "durable consumers call the public floating workflow and may route a train or exact runtime only through trusted non-persistent dispatch input"
       ],
       "breakingDigest": "sha256:21b65d0746d2e8b3e8a7df4c6fab295a85c8fd42cc405ec3bc5df5cdab0421f0",
-      "auditDigest": "sha256:bcfd872260c754e68cabe183c8c1c3acb2b2196e1601208bf7bc846b8e32af74"
+      "auditDigest": "sha256:adbe8a9e29cd30db5b2e9685864ea36bf88ab959fb151b65d1b00e87a2dea144"
     },
     {
       "contractVersion": 1,
@@ -1591,7 +1591,7 @@
         "GitHub Release passport and evidence publication is delegated to promote-buildchain-ref after the semver release transaction completes"
       ],
       "breakingDigest": "sha256:5f10c81d3f80cb417960be682921884639c40b6d875f1a3b1ffae7e652c3f468",
-      "auditDigest": "sha256:d9821bf071e83386e596e1d460c1adc46808451fce44b6586ae26fb11e535991"
+      "auditDigest": "sha256:e74c133c5cc71e47f26046241523604050de8ec78a7807e790dddc8ada673331"
     },
     {
       "contractVersion": 1,
@@ -1646,7 +1646,7 @@
         "resume-from-candidate-run is fail-closed and uses a fresh caller event instead of rerunning a frozen startup graph"
       ],
       "breakingDigest": "sha256:9db8dd07152855d03ff30f9c571438593c689d3e8139fa45431d000f548242f5",
-      "auditDigest": "sha256:1b505fd44a452b01e0516c9da45994cf7edb33c7f4c3bc01b2f3155ed3d3feb0",
+      "auditDigest": "sha256:f37525da5b47da39d1b86b1efa94e4839663210e819c49012a1d1341632d0ea4",
       "compatibleBreakingDigests": [
         "sha256:aa30f22e3af0a89841310bdbdc900844dd95a66974db173fa140a71bbd7e82c0"
       ],
@@ -1863,7 +1863,7 @@
         "no consumer command, script, shell, checkout, or executable tail hook is accepted"
       ],
       "breakingDigest": "sha256:9229eb3a000fb408feb6b8793c209c77afbf9327026467d68954470e22e4f8f4",
-      "auditDigest": "sha256:83fd394419851e6da877c50018e879b447497db52b0ac871dfd83e074f5459a8"
+      "auditDigest": "sha256:5693994b0cbfe831332f9ad71649811d2e5f70e3c8fe7f194047eb7dc460b976"
     },
     {
       "contractVersion": 1,
@@ -2257,7 +2257,7 @@
         "manual entries carry source file digests so downstream sites and agents can detect stale hand-written documentation"
       ],
       "breakingDigest": "sha256:7d0d2819e3a3e72989d9c57b5efe9d0bc0a79bc0f2c82a0c7b9d6c5a211a91f2",
-      "auditDigest": "sha256:dd80914275c60efcf95b29d44e861aeba5075ee7da9094adaa5cdb5714b59bf6"
+      "auditDigest": "sha256:a99c7387e403b8c471987e976bf02673664290d9621181ecfaa34169b8c2f8f2"
     },
     {
       "contractVersion": 1,
@@ -2279,7 +2279,7 @@
         "agents can discover supported Node APIs without importing internal file paths"
       ],
       "breakingDigest": "sha256:48f925608d3e2131d90936b07dc2a30341204cae3e6e785c0f77d61ad755c945",
-      "auditDigest": "sha256:dab7be33bf7d0c36fd59b55f74b3cb964ae24f348b95cd863f276c70e6d3db6e"
+      "auditDigest": "sha256:03c6dbaab4b981366a18934a265447542999ac57b62ffa2688da2dfab1979938"
     },
     {
       "contractVersion": 1,
@@ -5173,7 +5173,7 @@
         "missing receipts are non-qualifying and must not be represented as a successful controller run"
       ],
       "breakingDigest": "sha256:015d8de793adbd4c539416be7d7512e18cc92097e629b0203fa06d2c183e98bd",
-      "auditDigest": "sha256:1b505fd44a452b01e0516c9da45994cf7edb33c7f4c3bc01b2f3155ed3d3feb0"
+      "auditDigest": "sha256:f37525da5b47da39d1b86b1efa94e4839663210e819c49012a1d1341632d0ea4"
     },
     {
       "contractVersion": 1,
@@ -5399,5 +5399,5 @@
   "compatibilityFactCutRoot": "sha256:f61b975d4a96c921cc4bd37fb3ed9a0596b47004fe34dc7219979d697e3707f9",
   "compatibilityProofRegistryRoot": "sha256:b7194b811e4d3af2df4390bc4d1731e16a86215bd64ee18cb630dd5492f4fb63",
   "compatibilityDigest": "sha256:20411029d83211dff426fb6535a608902129844a5ccb4788db77d3f81becb839",
-  "contractDigest": "sha256:766fa56a71450d75897ca1040098b5acce8851cb3f1ab76dadc7abc2364bd763"
+  "contractDigest": "sha256:1cc571cc9a4167b78d7944de2029f2dd2674ca2c2823a2da65fbe8d842e968e0"
 }