@kungfu-tech/buildchain 4.0.2-alpha.17 → 4.0.2-alpha.19

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kungfu-tech/buildchain",
-  "version": "4.0.2-alpha.17",
+  "version": "4.0.2-alpha.19",
   "private": false,
   "description": "Buildchain Release Passport, release governance, CLI toolkit, and site facts.",
   "repository": "https://github.com/kungfu-systems/buildchain",

package/packages/core/buildchain-publication-authority.js

@@ -10,11 +10,9 @@ const DESCRIPTORS = Object.freeze([
   [".github/workflows/.release-candidate-promote.yml", "product-publication", true, ["npm-publish", "github-release", "channel-ref"], "trusted-publishing", "none", "fixed", "caller-bound"],
   [".github/workflows/.publication-authority.yml", "evidence-publication"],
   [".github/workflows/.release-verify.yml", "governance-write"],
-  [".github/workflows/.sam-release.yml", "retired-deny"],
   [".github/workflows/.sam-verify.yml", "retired-deny"],
   [".github/workflows/.sync-remote-git.yml", "governance-write"],
   [".github/workflows/.web-surface.yml", "product-publication", true, ["web-production"], "oidc", "consumer-defined", "caller-bound", "caller-bound"],
-  [".github/workflows/.wheel-release.yml", "retired-deny"],
   [".github/workflows/.wheel-verify.yml", "retired-deny"],
   [".github/workflows/.binary-release-assets.yml", "product-publication", true, ["github-release"], "github-token", "buildchain-release-assets"],
   [".github/workflows/binary-distribution.yml", "evidence-publication"],

package/packages/core/v4-universal-workflow-bootstrap.js

@@ -266,7 +266,6 @@ export function validateV4UniversalWorkflowRequest(value) {
     payload: canonical(value.payload),
   };
 }
-
 export function v4UniversalWorkflowRequestRoot(value) {
   return documentRoot(
     "universal-workflow-request",
@@ -274,9 +273,10 @@ export function v4UniversalWorkflowRequestRoot(value) {
   );
 }
 export function v4ProductStateVersion(value, requestedSha) { const sourceSha = exactSha(requestedSha, "requestedSha"), ref = nonEmpty(value?.ref, "productStateRef.ref"), prefix = `refs/heads/buildchain/v4-product-state/${sourceSha}-`; if (!ref.startsWith(prefix)) fail("recovery-state-mismatch", "release recovery product state does not bind the requested source"); const match = ref.slice(prefix.length).match(/^(\d+)-(\d+)-(\d+)(?:-alpha-(\d+))?$/u); if (!match) fail("invalid-recovery-version", "release recovery product state version is invalid"); return `${match[1]}.${match[2]}.${match[3]}${match[4] === undefined ? "" : `-alpha.${match[4]}`}`; }
+export function selectV4FinalizedProductPublicationVersion(value) { const requestedSha = exactSha(value.requestedSha, "requestedSha"), requestedTree = exactSha(value.requestedTree, "requestedTree"), lane = nonEmpty(value.targetRef, "targetRef").match(/^(alpha|release)\/v(\d+)\/v(\d+)\.(\d+)$/u); if (!lane || lane[2] !== lane[3]) fail("invalid-finalization-lane", "product publication finalization target is not a release lane"); const expectedAlpha = lane[1] === "alpha", versions = []; for (const row of Array.isArray(value.recoveryStates) ? value.recoveryStates : []) { const stateRef = row?.stateRef, match = String(stateRef?.ref || "").match(/^refs\/heads\/buildchain\/v4-product-state\/([0-9a-f]{40})-(\d+)-(\d+)-(\d+)(?:-alpha-(\d+))?$/u); if (!match || match[2] !== lane[2] || match[3] !== lane[4]) continue; const stateTree = exactSha(row?.stateCommit?.tree?.sha, "productStateCommit.tree.sha"); if (stateTree !== requestedTree || !new Set(["ahead", "identical"]).has(row.headComparisonStatus)) continue; const sourceSha = exactSha(match[1], "productStateRef.sourceSha"), version = v4ProductStateVersion(stateRef, sourceSha), parsed = version.match(/^(\d+)\.(\d+)\.(\d+)(?:-alpha\.(\d+))?$/u); if ((parsed[4] !== undefined) !== expectedAlpha) continue; if (stateRef?.object?.type !== "commit" || exactSha(stateRef?.object?.sha, "productStateRef.object.sha") !== exactSha(row?.stateCommit?.sha, "productStateCommit.sha") || row.stateCommit.parents?.length !== 1 || exactSha(row.stateCommit.parents[0]?.sha, "productStateCommit.parents[0].sha") !== sourceSha) fail("finalization-state-mismatch", "product publication finalization state does not bind its source"); if (row.exactTagRef && (row.exactTagRef.ref !== `refs/tags/v${version}` || row.exactTagRef.object?.type !== "commit" || exactSha(row.exactTagRef.object?.sha, "exactTagRef.object.sha") !== sourceSha)) fail("finalization-tag-mismatch", "product publication finalization tag does not bind its source"); versions.push(version); } const selected = [...new Set(versions)].sort(); if (selected.length > 1) fail("finalization-state-ambiguous", `publication head ${requestedSha} matches multiple product versions`); return selected[0] || ""; }
 export function selectV4RecoveredProductPublicationVersion(value) {
   if (value.routeDecision !== "Resume") return ""; const version = nonEmpty(value.candidateVersion, "candidateVersion"), sourceSha = exactSha(value.requestedSha, "requestedSha"), candidate = version.match(/^(\d+)\.(\d+)\.(\d+)(?:-alpha\.(\d+))?$/u); if (!candidate) fail("invalid-recovery-version", "release recovery candidate version is invalid"); if (value.explicitResume) return version;
-  const states = Array.isArray(value.recoveryStates) ? value.recoveryStates : []; if (states.length) { const recovered = states.map(({ stateRef, stateCommit, exactTagRef }) => { const selected = v4ProductStateVersion(stateRef, sourceSha), parsed = selected.match(/^(\d+)\.(\d+)\.(\d+)(?:-alpha\.(\d+))?$/u), parents = stateCommit?.parents || []; if (stateRef?.object?.type !== "commit" || exactSha(stateRef?.object?.sha, "productStateRef.object.sha") !== exactSha(stateCommit?.sha, "productStateCommit.sha") || parents.length !== 1 || exactSha(parents[0]?.sha, "productStateCommit.parents[0].sha") !== sourceSha) fail("recovery-state-mismatch", "release recovery product state commit does not bind the requested source"); if (exactTagRef && (exactTagRef.ref !== `refs/tags/v${selected}` || exactTagRef.object?.type !== "commit" || exactSha(exactTagRef.object?.sha, "exactTagRef.object.sha") !== sourceSha)) fail("recovery-tag-mismatch", "release recovery exact tag does not bind the requested source"); if (parsed[1] !== candidate[1] || parsed[2] !== candidate[2] || parsed[3] !== candidate[3] || (parsed[4] === undefined) !== (candidate[4] === undefined)) fail("recovery-state-mismatch", "release recovery product state is outside the candidate release line"); return selected; }); recovered.sort((left, right) => Number(left.match(/(?:-alpha\.)?(\d+)$/u)[1]) - Number(right.match(/(?:-alpha\.)?(\d+)$/u)[1])); return recovered.at(-1); }
+  const states = Array.isArray(value.recoveryStates) ? value.recoveryStates : []; if (states.length) { const recovered = [...new Set(states.map(({ stateRef, stateCommit, exactTagRef }) => { const selected = v4ProductStateVersion(stateRef, sourceSha), parsed = selected.match(/^(\d+)\.(\d+)\.(\d+)(?:-alpha\.(\d+))?$/u), parents = stateCommit?.parents || []; if (stateRef?.object?.type !== "commit" || exactSha(stateRef?.object?.sha, "productStateRef.object.sha") !== exactSha(stateCommit?.sha, "productStateCommit.sha") || parents.length !== 1 || exactSha(parents[0]?.sha, "productStateCommit.parents[0].sha") !== sourceSha) fail("recovery-state-mismatch", "release recovery product state commit does not bind the requested source"); if (exactTagRef && (exactTagRef.ref !== `refs/tags/v${selected}` || exactTagRef.object?.type !== "commit" || exactSha(exactTagRef.object?.sha, "exactTagRef.object.sha") !== sourceSha)) fail("recovery-tag-mismatch", "release recovery exact tag does not bind the requested source"); if (parsed[1] !== candidate[1] || parsed[2] !== candidate[2] || parsed[3] !== candidate[3] || (parsed[4] === undefined) !== (candidate[4] === undefined)) fail("recovery-state-mismatch", "release recovery product state is outside the candidate release line"); return selected; }))]; if (recovered.length !== 1) fail("recovery-state-ambiguous", "release recovery requires one exact product publication state; provide an exact transaction identity"); return recovered[0]; }
   if (!value.exactTagRef) fail("recovery-tag-missing", "release recovery requires an exact partial-publication tag"); if (value.exactTagRef.ref !== `refs/tags/v${version}` || value.exactTagRef.object?.type !== "commit" || exactSha(value.exactTagRef.object?.sha, "exactTagRef.object.sha") !== sourceSha) fail("recovery-tag-mismatch", "release recovery exact tag does not bind the requested source");
   return version;
 }
@@ -345,69 +345,55 @@ function validatePolicy(value) {
 }
 
 function validateReviewEvidence(value) {
-  exactKeys(
-    value,
-    [
-      "repository",
-      "pullRequest",
-      "headSha",
-      "baseRef",
-      "approvals",
-      "checks",
-      "observedAt",
-    ],
-    "reviewEvidence",
-  );
+  const hasBinding = Object.hasOwn(value || {}, "runtimeBinding");
+  exactKeys(value, ["repository", "pullRequest", "headSha", "baseRef", "approvals", "checks", "observedAt", ...(hasBinding ? ["runtimeBinding"] : [])], "reviewEvidence");
   const approvals = value.approvals.map((approval, index) => {
-    exactKeys(
-      approval,
-      ["reviewer", "commitSha", "submittedAt"],
-      `reviewEvidence.approvals[${index}]`,
-    );
+    exactKeys(approval, ["reviewer", "commitSha", "submittedAt"], `reviewEvidence.approvals[${index}]`);
     return {
-      reviewer: nonEmpty(
-        approval.reviewer,
-        `reviewEvidence.approvals[${index}].reviewer`,
-      ),
-      commitSha: exactSha(
-        approval.commitSha,
-        `reviewEvidence.approvals[${index}].commitSha`,
-      ),
-      submittedAt: timestamp(
-        approval.submittedAt,
-        `reviewEvidence.approvals[${index}].submittedAt`,
-      ),
+      reviewer: nonEmpty(approval.reviewer, `reviewEvidence.approvals[${index}].reviewer`),
+      commitSha: exactSha(approval.commitSha, `reviewEvidence.approvals[${index}].commitSha`),
+      submittedAt: timestamp(approval.submittedAt, `reviewEvidence.approvals[${index}].submittedAt`),
     };
   });
   const checks = value.checks.map((check, index) => {
-    exactKeys(
-      check,
-      ["name", "status", "conclusion"],
-      `reviewEvidence.checks[${index}]`,
-    );
+    const hasCommit = Object.hasOwn(check || {}, "commitSha");
+    exactKeys(check, ["name", "status", "conclusion", ...(hasCommit ? ["commitSha"] : [])], `reviewEvidence.checks[${index}]`);
     return {
       name: nonEmpty(check.name, `reviewEvidence.checks[${index}].name`),
       status: nonEmpty(check.status, `reviewEvidence.checks[${index}].status`),
-      conclusion: nonEmpty(
-        check.conclusion,
-        `reviewEvidence.checks[${index}].conclusion`,
-      ),
+      conclusion: nonEmpty(check.conclusion, `reviewEvidence.checks[${index}].conclusion`),
+      ...(hasCommit ? { commitSha: exactSha(check.commitSha, `reviewEvidence.checks[${index}].commitSha`) } : {}),
     };
   });
+  let runtimeBinding;
+  if (hasBinding) {
+    exactKeys(value.runtimeBinding, ["kind", "runtimeSha", "parentShas", "mergedAt"], "reviewEvidence.runtimeBinding");
+    const kind = nonEmpty(value.runtimeBinding.kind, "reviewEvidence.runtimeBinding.kind");
+    if (!new Set(["reviewed-head", "protected-alpha-merge"]).has(kind)) fail("invalid-runtime-binding", "review evidence runtime binding kind is unsupported");
+    const parentShas = value.runtimeBinding.parentShas.map((parent, index) => exactSha(parent, `reviewEvidence.runtimeBinding.parentShas[${index}]`));
+    if (new Set(parentShas).size !== parentShas.length) fail("invalid-runtime-binding", "review evidence runtime parents must be duplicate-free");
+    runtimeBinding = { kind, runtimeSha: exactSha(value.runtimeBinding.runtimeSha, "reviewEvidence.runtimeBinding.runtimeSha"), parentShas, mergedAt: value.runtimeBinding.mergedAt === null ? null : timestamp(value.runtimeBinding.mergedAt, "reviewEvidence.runtimeBinding.mergedAt") };
+  }
   return {
     repository: repository(value.repository, "reviewEvidence.repository"),
-    pullRequest: positiveInteger(
-      value.pullRequest,
-      "reviewEvidence.pullRequest",
-    ),
+    pullRequest: positiveInteger(value.pullRequest, "reviewEvidence.pullRequest"),
     headSha: exactSha(value.headSha, "reviewEvidence.headSha"),
     baseRef: nonEmpty(value.baseRef, "reviewEvidence.baseRef"),
-    approvals,
-    checks,
+    approvals, checks,
     observedAt: timestamp(value.observedAt, "reviewEvidence.observedAt"),
+    ...(runtimeBinding ? { runtimeBinding } : {}),
   };
 }
 
+function reviewedRuntimeSha(request, policy, evidence, runtimeSha) {
+  const binding = evidence.runtimeBinding || { kind: "reviewed-head", runtimeSha: evidence.headSha, parentShas: [], mergedAt: null };
+  if (binding.runtimeSha !== runtimeSha) fail("review-runtime-mismatch", "review evidence runtime binding does not match the candidate");
+  const direct = binding.kind === "reviewed-head" && evidence.headSha === runtimeSha && evidence.baseRef === policy.targetRef && binding.mergedAt === null;
+  const alphaMerge = binding.kind === "protected-alpha-merge" && request.mode === "alpha" && evidence.baseRef === "alpha/v4/v4.0" && binding.parentShas.length === 2 && binding.parentShas.includes(evidence.headSha) && binding.mergedAt !== null && Date.parse(binding.mergedAt) <= Date.parse(evidence.observedAt);
+  if (!direct && !alphaMerge) fail("review-identity-mismatch", "review evidence does not bind the candidate runtime");
+  return evidence.headSha;
+}
+
 export function v4UniversalWorkflowAdmissionRoot(value) {
   return documentRoot("universal-workflow-admission", validatePolicy(value));
 }
@@ -478,17 +464,16 @@ export function admitV4UniversalWorkflow({
   const reviewEvidence = validateReviewEvidence(reviewEvidenceValue);
   if (
     reviewEvidence.repository !== request.candidate.repository ||
-    reviewEvidence.pullRequest !== request.candidate.reviewPullRequest ||
-    reviewEvidence.headSha !== runtimeSha ||
-    reviewEvidence.baseRef !== policy.targetRef
+    reviewEvidence.pullRequest !== request.candidate.reviewPullRequest
   )
     fail(
       "review-identity-mismatch",
       "review evidence does not bind the candidate",
     );
+  const reviewedSha = reviewedRuntimeSha(request, policy, reviewEvidence, runtimeSha);
   const approvedReviewers = new Set(
     reviewEvidence.approvals
-      .filter((approval) => approval.commitSha === runtimeSha)
+      .filter((approval) => approval.commitSha === reviewedSha)
       .map((approval) => approval.reviewer),
   );
   const admittedApprovalCount = policy.allowedReviewers.filter((reviewer) =>
@@ -512,7 +497,8 @@ export function admitV4UniversalWorkflow({
         checks.length === 0 ||
         checks.some(
           (check) =>
-            check.status !== "completed" || check.conclusion !== "success",
+            check.status !== "completed" || check.conclusion !== "success" ||
+            (check.commitSha !== undefined && check.commitSha !== runtimeSha),
         )
       );
     })

package/scripts/check-inventory.mjs

@@ -1043,8 +1043,8 @@ for (const requiredSnippet of [
   "actions: write",
   "uses: kungfu-systems/buildchain/.github/workflows/.release-candidate-promote.yml@v4-alpha",
   "github.event.workflow_run.event == 'push'",
-  "!startsWith(github.event.workflow_run.display_title, 'chore(release): prepare v')",
-  "!startsWith(github.event.workflow_run.display_title, 'chore(release): release v')",
+  "name: Classify generated product-state finalization",
+  "selectV4FinalizedProductPublicationVersion",
   "resume-candidate-run-id:",
   "resume-expected-source-tree:",
   "resume-buildchain-runtime-ref:",
@@ -1056,12 +1056,19 @@ for (const requiredSnippet of [
     throw new Error(`buildchain ref promotion workflow missing npm transaction snippet: ${requiredSnippet}`);
   }
 }
+if (buildchainRefPromotionWorkflow.includes("workflow_run.display_title")) {
+  throw new Error(
+    "buildchain ref promotion must classify finalization from rooted product state, not a display title",
+  );
+}
 const releaseCandidatePromoteWorkflow = fs.readFileSync(path.join(root, ".github/workflows/.release-candidate-promote.yml"), "utf8");
 for (const requiredSnippet of [
   "name: QUALIFY canonical v4 release invocation inputs",
   "name: APPLY one rooted provider transaction",
   "name: SETTLE terminal ReleaseReceipt projection",
   "uses: ./.buildchain/runtime/actions/v4-release-candidate-promote",
+  "name: Resolve one exact product publication recovery",
+  "selectV4RecoveredProductPublicationVersion",
   "publisher-workflow-sha:",
   "runtime-commit:",
   "runtime-tree:",
@@ -1101,31 +1108,15 @@ for (const workflowFile of fs.readdirSync(workflowDir).filter((entry) => entry.e
   }
 }
 for (const retiredWorkflow of [
+  ".release-docker.yml",
   ".release-new-version.yml",
   ".release-elastic-beanstalk.yml",
   ".sam-release.yml",
   ".wheel-release.yml",
+  "schedule-purge-artifacts.yml",
 ]) {
-  const retiredSource = fs.readFileSync(path.join(workflowDir, retiredWorkflow), "utf8");
-  for (const requiredSnippet of [
-    "release path is retired",
-    "release-candidate-promote.yml@v3",
-    "publish-gate source-lock enforcement",
-  ]) {
-    if (!retiredSource.includes(requiredSnippet)) {
-      throw new Error(`${retiredWorkflow} must fail closed and point callers at the source-locked release-candidate-promote model: ${requiredSnippet}`);
-    }
-  }
-  for (const forbiddenSnippet of [
-    "npm publish --access=public",
-    "actions/publish-prebuilt@v2",
-    "actions/bump-version@v2",
-    "beanstalk-deploy@",
-    "sam deploy",
-  ]) {
-    if (retiredSource.includes(forbiddenSnippet)) {
-      throw new Error(`${retiredWorkflow} must not keep retired publish side effects: ${forbiddenSnippet}`);
-    }
+  if (fs.existsSync(path.join(workflowDir, retiredWorkflow))) {
+    throw new Error(`${retiredWorkflow} is fully retired and must remain deleted`);
   }
 }
 const promoteBuildchainRefAction = fs.readFileSync(path.join(root, "actions/promote-buildchain-ref/action.yml"), "utf8");

package/scripts/check-v4-universal-workflow-bootstrap.mjs

@@ -118,6 +118,10 @@ assert.equal(contract.bootstrap.consumerSourceMutationPerIncident, false);
 assert.equal(contract.bootstrap.buildchainReleasePromotionPerIncident, false);
 assert.equal(contract.bootstrap.selfDogfoodUsesPublicContract, true);
 assert.equal(contract.bootstrap.recoveryDependsOnPublishedBuildchain, false);
+assert.equal(
+  contract.bootstrap.reviewRuntimeBinding,
+  "reviewed-head-or-protected-alpha-merge-to-exact-runtime",
+);
 assert.deepEqual(
   contract.capabilityAdapters.map(({ id }) => id).sort(),
   [...admissionPolicy.allowedCapabilities].sort(),
@@ -168,6 +172,10 @@ assert.match(
   bootstrapSource,
   /ascii_downcase\) == "kungfu-origin"[\s\S]*\.name == "check"[\s\S]*map\(select\(\.status == "completed" and \(\.conclusion \/\/ ""\) != ""\)\)[\s\S]*candidate\/architecture\/v4-universal-workflow-train-admission\.json/u,
 );
+assert.match(
+  bootstrapSource,
+  /CANDIDATE_MODE:[\s\S]*\.merged == true[\s\S]*\.merge_commit_sha == \$expected[\s\S]*\.base\.ref == "alpha\/v4\/v4\.0"[\s\S]*commitSha: \$expected[\s\S]*runtimeBinding:/u,
+);
 const consumerTemplate = fs.readFileSync(
   path.join(root, contract.bootstrap.consumerTemplate),
   "utf8",