@kungfu-tech/buildchain 4.0.2-alpha.2 → 4.0.2-alpha.20

package/scripts/check-maintainability.mjs

@@ -19,6 +19,8 @@ import {
   evaluateTestBudgets,
   evaluateWorkflowBudgets,
 } from "./maintainability-governance.mjs";
+import { governUniversalFacadeWorkflowMetrics } from "./universal-facade-maintainability.mjs";
+import { evaluatePublicSurface } from "./maintainability-public-surface.mjs";
 
 function collectHotspots(
   root,
@@ -162,116 +164,6 @@ function selectedFunction(metrics, file, name) {
   return metrics.files[file]?.functions.find((entry) => entry.name === name);
 }
 
-function readJsonAtRevision(root, revision, file) {
-  return JSON.parse(gitOutput(root, ["show", `${revision}:${file}`]));
-}
-
-function publicSurfaceContract(entry, kind) {
-  if (kind === "cli") return { id: entry.id, usage: entry.usage };
-  if (kind === "node")
-    return {
-      export: entry.export,
-      specifier: entry.specifier,
-      target: entry.target,
-    };
-  return {
-    id: entry.id,
-    path: entry.path,
-    reusable: entry.reusable,
-    inputs: entry.inputs || [],
-    secrets: entry.secrets || [],
-    outputs: entry.outputs || [],
-  };
-}
-
-function evaluatePublicSurface({ root, revision, policy }) {
-  const issues = [];
-  const lifecycleFields = policy.publicSurfacePolicy.requiredLifecycleFields;
-  const capabilityGroups = new Set(
-    readJson(root, "dist/site/capability-registry.json").groups.map(
-      (entry) => entry.id,
-    ),
-  );
-  const definitions = [
-    {
-      file: "dist/site/cli-registry.json",
-      collection: "commands",
-      kind: "cli",
-      key: "id",
-    },
-    {
-      file: "dist/site/node-api-registry.json",
-      collection: "exports",
-      kind: "node",
-      key: "export",
-    },
-    {
-      file: "dist/site/workflow-registry.json",
-      collection: "workflows",
-      kind: "workflow",
-      key: "id",
-    },
-    {
-      file: "dist/site/workflow-registry.json",
-      collection: "actions",
-      kind: "action",
-      key: "id",
-    },
-  ];
-  for (const definition of definitions) {
-    const current =
-      readJson(root, definition.file)[definition.collection] || [];
-    const baseline =
-      readJsonAtRevision(root, revision, definition.file)[
-        definition.collection
-      ] || [];
-    const baselineByKey = new Map(
-      baseline.map((entry) => [entry[definition.key], entry]),
-    );
-    for (const entry of current) {
-      const label = `${definition.kind}:${entry[definition.key]}`;
-      for (const field of lifecycleFields) {
-        if (
-          !Object.prototype.hasOwnProperty.call(entry, field) ||
-          typeof entry[field] !== "string"
-        ) {
-          issues.push(`${label}: lifecycle field ${field} is missing`);
-        }
-      }
-      if (!capabilityGroups.has(entry.capabilityGroup)) {
-        issues.push(
-          `${label}: capability group ${entry.capabilityGroup || "<empty>"} is not registered`,
-        );
-      }
-      const previous = baselineByKey.get(entry[definition.key]);
-      const currentContract = publicSurfaceContract(entry, definition.kind);
-      if (
-        previous &&
-        JSON.stringify(currentContract) !==
-          JSON.stringify(publicSurfaceContract(previous, definition.kind))
-      ) {
-        const approval = policy.approvedPublicSurfaceTransitions?.[label];
-        const approved =
-          approval?.fromRevision === revision &&
-          String(approval?.rationale || "").trim() &&
-          JSON.stringify(approval?.contract) ===
-            JSON.stringify(currentContract);
-        if (!approved) {
-          issues.push(
-            `${label}: existing public contract drifted from ${revision}`,
-          );
-        }
-      }
-      if (!previous && !entry.nonDuplicationRationale) {
-        issues.push(
-          `${label}: new public surface requires a non-duplication rationale`,
-        );
-      }
-    }
-  }
-  return issues;
-}
-
 function evaluateAddedFunctionBudgets({
   file,
   metrics,
@@ -497,12 +389,18 @@ function checkMaintainability({ root = process.cwd() } = {}) {
     root,
     extendedCoverageRevision,
   );
+  const { governed: governedCurrent, migration: facadeMigration } =
+    governUniversalFacadeWorkflowMetrics({
+      root,
+      current,
+      workflowMetricsAtRevision,
+    });
   const issues = evaluateExceptionGovernance({ policy });
   issues.push(...evaluateExceptionBudget({ policy }));
   const hotspots = collectHotspots(root, current, 20, debt.hotspots || []);
   issues.push(
     ...evaluateDebtAuthority({
-      current,
+      current: governedCurrent,
       policy,
       debt,
       capabilityIds: new Set(
@@ -518,14 +416,19 @@ function checkMaintainability({ root = process.cwd() } = {}) {
   );
   issues.push(
     ...evaluateWorkflowBudgets({
-      current,
+      current: governedCurrent,
       baselineFiles: baselineWorkflows,
       policy,
     }),
   );
   issues.push(...evaluateRepositoryBudgets({ current, policy }));
   issues.push(
-    ...evaluatePublicSurface({ root, revision: enforcementRevision, policy }),
+    ...evaluatePublicSurface({
+      root,
+      revision: enforcementRevision,
+      policy,
+      migration: facadeMigration,
+    }),
   );
   if (issues.length > 0) {
     throw new Error(`maintainability check failed:\n- ${issues.join("\n- ")}`);

package/scripts/check-v4-release-topology.mjs

@@ -1,9 +1,10 @@
 #!/usr/bin/env node
 
 import assert from "node:assert/strict";
+import crypto from "node:crypto";
 import fs from "node:fs";
 import path from "node:path";
-import { fileURLToPath } from "node:url";
+import { fileURLToPath, pathToFileURL } from "node:url";
 
 import {
   parseWorkflowDocument,
@@ -12,13 +13,150 @@ import {
 
 const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 const ledgerPath = path.join(root, "architecture/v4-release-topology.json");
-const releaseMarker =
-  /(?:release-candidate-promote\.yml|promote-buildchain-ref|v4-release-candidate-promote|release-tail-runtime)/u;
 
 function read(relative) {
   return fs.readFileSync(path.join(root, relative), "utf8");
 }
 
+const LOCAL_MODULE_EXTENSIONS = ["", ".js", ".mjs", ".cjs"];
+const PRIVILEGED_ENTRYPOINTS = [
+  "actions/v4-release-candidate-promote/index.js",
+];
+
+function localModuleSpecifiers(source) {
+  const specifiers = [];
+  const expression =
+    /(?:\bfrom\s+|\bimport\s*\(\s*|\bimport\s+)["'](\.[^"']+)["']/gu;
+  for (const match of source.matchAll(expression)) specifiers.push(match[1]);
+  return [...new Set(specifiers)].sort();
+}
+
+function resolveLocalModule(importer, specifier) {
+  const unresolved = path.posix.normalize(
+    path.posix.join(path.posix.dirname(importer), specifier),
+  );
+  assert.ok(
+    !unresolved.startsWith("../") && !path.posix.isAbsolute(unresolved),
+    `local module import escapes the repository: ${importer} -> ${specifier}`,
+  );
+  const candidates = [
+    ...LOCAL_MODULE_EXTENSIONS.map((extension) => `${unresolved}${extension}`),
+    ...LOCAL_MODULE_EXTENSIONS.slice(1).map((extension) =>
+      path.posix.join(unresolved, `index${extension}`),
+    ),
+  ];
+  const matches = candidates.filter((relative) => {
+    const absolute = path.join(root, relative);
+    return fs.existsSync(absolute) && fs.statSync(absolute).isFile();
+  });
+  assert.equal(
+    matches.length,
+    1,
+    `local module import must resolve exactly once: ${importer} -> ${specifier}`,
+  );
+  return matches[0];
+}
+
+export function discoverStaticModuleClosure(entrypoints) {
+  const pending = [...entrypoints];
+  const visited = new Set();
+  while (pending.length > 0) {
+    const relative = pending.pop();
+    if (visited.has(relative)) continue;
+    assert.ok(
+      fs.statSync(path.join(root, relative)).isFile(),
+      `privileged entry is not a file: ${relative}`,
+    );
+    visited.add(relative);
+    for (const specifier of localModuleSpecifiers(read(relative))) {
+      const dependency = resolveLocalModule(relative, specifier);
+      if (!visited.has(dependency)) pending.push(dependency);
+    }
+  }
+  return [...visited].sort();
+}
+
+function rootedPathSet(paths) {
+  return `sha256:${crypto
+    .createHash("sha256")
+    .update(JSON.stringify([...paths].sort()))
+    .digest("hex")}`;
+}
+
+function productionFiles(relative, extensions) {
+  const absolute = path.join(root, relative);
+  if (!fs.existsSync(absolute)) return [];
+  const entries = fs.readdirSync(absolute, { withFileTypes: true });
+  return entries.flatMap((entry) => {
+    const child = path.posix.join(relative, entry.name);
+    if (
+      entry.isDirectory() &&
+      !["dist", "node_modules", ".git"].includes(entry.name)
+    )
+      return productionFiles(child, extensions);
+    if (
+      entry.isFile() &&
+      extensions.some((extension) => entry.name.endsWith(extension))
+    )
+      return [child];
+    return [];
+  });
+}
+
+function matchingProductionFiles(roots, extensions, pattern) {
+  return roots
+    .flatMap((relative) => productionFiles(relative, extensions))
+    .filter((relative) => relative !== "scripts/check-v4-release-topology.mjs")
+    .filter((relative) => pattern.test(read(relative)))
+    .sort();
+}
+
+export function discoverV4ReleaseAuthorityClosure() {
+  const providerPlane = matchingProductionFiles(
+    ["actions", "packages/core"],
+    [".js", ".mjs", ".cjs"],
+    /(?:release-tail-provider-(?:adapters|plane)|create(?:GitHubReleaseAssets|SignedStaticChannel|SiteReleaseActivation|ReleasedEvidence)Adapter)/u,
+  );
+  const runtimeSelectors = matchingProductionFiles(
+    [".github/workflows", "scripts", "packages/core"],
+    [".yml", ".yaml", ".js", ".mjs", ".cjs"],
+    /(?:promotion-runtime-sha|resume-buildchain-runtime-sha|BUILDCHAIN_(?:CURRENT_RUNTIME_SHA|RUNTIME_REF|RESUME_CANDIDATE_RUN_ID)|authorizeV4RuntimeSelection|scanV4RuntimeSelectorPersistence|v4-release-candidate-adapter)/u,
+  );
+  const terminalProjections = matchingProductionFiles(
+    [".github/workflows", "actions", "packages/core", "scripts"],
+    [".yml", ".yaml", ".js", ".mjs", ".cjs"],
+    /(?:createV4ReleaseReceipt|release-receipt\.json|V4_RELEASE_RECEIPT_CONTRACT)/u,
+  );
+  const privilegedModules = discoverStaticModuleClosure(PRIVILEGED_ENTRYPOINTS);
+  const legacyEngineModules = productionFiles(
+    "actions/promote-buildchain-ref",
+    [".js", ".mjs", ".cjs"],
+  )
+    .filter((relative) =>
+      /(?:^|\/)(?:lib|promote-(?:alpha|release|major)-channel|durable-transaction-operations)\.js$/u.test(
+        relative,
+      ),
+    )
+    .sort();
+  return {
+    providerAdapters: [
+      ...new Set([
+        ...providerPlane,
+        "packages/core/release-tail-provider-plane.js",
+      ]),
+    ].sort(),
+    runtimeSelectors,
+    runtimeEngines: ["actions/v4-release-candidate-promote/index.js"],
+    terminalProjections,
+    privilegedExecutableClosure: {
+      entrypoints: PRIVILEGED_ENTRYPOINTS,
+      modules: privilegedModules,
+      root: rootedPathSet(privilegedModules),
+    },
+    legacyEngineModules,
+  };
+}
+
 function jobBlock(source, jobId) {
   const escaped = jobId.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&");
   return (
@@ -42,7 +180,9 @@ function permission(block, name) {
 function workflowSnapshot(relative) {
   const source = read(relative);
   const document = parseWorkflowDocument(source);
-  const jobs = document.jobs.map((job) => {
+  const jobs = document.jobs
+    .filter((job) => job.id !== "universal-bootstrap")
+    .map((job) => {
     const block = jobBlock(source, job.id);
     const uses = job.uses || null;
     return {
@@ -68,7 +208,7 @@ function workflowSnapshot(relative) {
           "direct-publication-command",
       ].filter(Boolean),
     };
-  });
+    });
   return {
     path: relative,
     triggers: document.triggers,
@@ -76,6 +216,7 @@ function workflowSnapshot(relative) {
     reusableEdges: parseYamlUses(source)
       .map(({ value }) => value)
       .filter((value) => /\.github\/workflows\//u.test(value))
+      .filter((value) => !/\/bootstrap\.yml(?:@v4)?$/u.test(value))
       .sort(),
   };
 }
@@ -104,25 +245,27 @@ export function discoverV4ReleaseTopology(
       "carriers",
       "mutationSignals",
     ],
-    workflows: workflows.map((workflow) => ({
-      path: workflow.path,
-      triggers: workflow.triggers,
-      jobs: workflow.jobs.map((job) =>
-        [
-          job.id,
-          job.kind,
-          job.uses || "-",
-          job.permissions.contents || "-",
-          job.permissions.idToken || "-",
-          Object.entries(job.carriers)
-            .filter(([, present]) => present)
-            .map(([name]) => name)
-            .join(",") || "-",
-          job.mutationSignals.join(",") || "-",
-        ].join("|"),
-      ),
-      reusableEdges: workflow.reusableEdges,
-    })),
+    workflows: workflows
+      .filter((workflow) => semanticPaths.has(workflow.path))
+      .map((workflow) => ({
+        path: workflow.path,
+        triggers: workflow.triggers,
+        jobs: workflow.jobs.map((job) =>
+          [
+            job.id,
+            job.kind,
+            job.uses || "-",
+            job.permissions.contents || "-",
+            job.permissions.idToken || "-",
+            Object.entries(job.carriers)
+              .filter(([, present]) => present)
+              .map(([name]) => name)
+              .join(",") || "-",
+            job.mutationSignals.join(",") || "-",
+          ].join("|"),
+        ),
+        reusableEdges: workflow.reusableEdges,
+      })),
     metrics: {
       workflowCount: workflows.length,
       jobCount: jobs.length,
@@ -174,7 +317,26 @@ export function findUnknownV4ReleaseTopology(
   const declared = new Set(workflowPaths);
   return allWorkflowPaths
     .filter((relative) => !declared.has(relative))
-    .filter((relative) => releaseMarker.test(readWorkflow(relative)))
+    .filter((relative) => {
+      const source = readWorkflow(relative);
+      const usesReleaseAuthority = parseYamlUses(source).some(({ value }) =>
+        /(?:release-candidate-promote|promote-buildchain-ref|v4-release-candidate-promote|release-tail)/u.test(
+          value,
+        ),
+      );
+      const hasReleaseLanguage =
+        /(?:^|[-_ ])(?:release|publish|promotion|distribution|tag)(?:$|[-_ :])/imu.test(
+          source,
+        );
+      const hasMutationAuthority =
+        /(?:contents|id-token):\s*write/u.test(source) ||
+        /(?:git push|npm publish|gh release (?:create|upload)|createRef|updateRef)/u.test(
+          source,
+        );
+      return (
+        usesReleaseAuthority || (hasReleaseLanguage && hasMutationAuthority)
+      );
+    })
     .sort();
 }
 
@@ -187,10 +349,95 @@ function assertClosedWorld(workflowPaths) {
   );
 }
 
+function assertAuthorityClosure(ledger) {
+  const closure = ledger.authorityClosure;
+  assert.ok(
+    closure && typeof closure === "object",
+    "authority closure missing",
+  );
+  for (const className of [
+    "providerAdapters",
+    "runtimeSelectors",
+    "runtimeEngines",
+    "terminalProjections",
+    "legacyEngineModules",
+  ]) {
+    assert.ok(
+      Array.isArray(closure[className]) && closure[className].length > 0,
+      `authority closure class ${className} is empty`,
+    );
+    for (const relative of closure[className])
+      assert.ok(
+        fs.statSync(path.join(root, relative)).isFile(),
+        `authority closure path is not a file: ${relative}`,
+      );
+  }
+  const discovered = discoverV4ReleaseAuthorityClosure();
+  for (const className of Object.keys(discovered))
+    assert.deepEqual(
+      closure[className],
+      discovered[className],
+      `authority closure class drifted: ${className}`,
+    );
+  assert.deepEqual(
+    closure.privilegedExecutableClosure,
+    discovered.privilegedExecutableClosure,
+    "privileged executable transitive closure drifted",
+  );
+  assert.match(
+    closure.privilegedExecutableClosure.root,
+    /^sha256:[0-9a-f]{64}$/u,
+  );
+  const reachableLegacyEngines = closure.legacyEngineModules.filter(
+    (relative) =>
+      closure.privilegedExecutableClosure.modules.includes(relative),
+  );
+  assert.deepEqual(
+    reachableLegacyEngines,
+    [],
+    `legacy release engines remain reachable from APPLY: ${reachableLegacyEngines.join(", ")}`,
+  );
+  assert.deepEqual(closure.runtimeEngines, [
+    "actions/v4-release-candidate-promote/index.js",
+  ]);
+  assert.equal(
+    closure.freshEntry,
+    ".github/workflows/release-candidate-promote.yml",
+  );
+  assert.equal(
+    closure.recoveryEntry,
+    ".github/workflows/buildchain-ref-promotion-recovery.yml",
+  );
+  const engineSurface = [
+    ".github/workflows/.release-candidate-promote.yml",
+    ...closure.privilegedExecutableClosure.modules,
+  ]
+    .map(read)
+    .join("\n");
+  for (const pattern of closure.forbiddenLegacyEnginePatterns)
+    assert.doesNotMatch(
+      engineSurface,
+      new RegExp(pattern, "u"),
+      `legacy release engine remains reachable: ${pattern}`,
+    );
+  const canonicalWorkflow = read(
+    ".github/workflows/.release-candidate-promote.yml",
+  );
+  assert.match(
+    canonicalWorkflow,
+    /scripts\/v4-release-candidate-adapter\.mjs/u,
+  );
+  assert.match(
+    canonicalWorkflow,
+    /release-invocation\.json[\s\S]*release-transaction\.json[\s\S]*release-receipt\.json/u,
+  );
+}
+
 export function checkV4ReleaseTopology() {
   const ledger = JSON.parse(fs.readFileSync(ledgerPath, "utf8"));
   assert.equal(ledger.contract, "kungfu-buildchain-v4-release-topology/v1");
   assertClosedWorld(ledger.closedWorld.workflowPaths);
+  assertAuthorityClosure(ledger);
   const actual = discoverV4ReleaseTopology(
     ledger.closedWorld.workflowPaths,
     ledger.semanticScope.workflowPaths,
@@ -219,19 +466,28 @@ export function checkV4ReleaseTopology() {
   return actual;
 }
 
-if (process.argv.includes("--print")) {
-  const ledger = JSON.parse(fs.readFileSync(ledgerPath, "utf8"));
-  process.stdout.write(
-    `${JSON.stringify(
-      discoverV4ReleaseTopology(
-        ledger.closedWorld.workflowPaths,
-        ledger.semanticScope.workflowPaths,
-      ),
-      null,
-      2,
-    )}\n`,
-  );
-} else {
-  checkV4ReleaseTopology();
-  process.stdout.write("v4 release topology: ok\n");
+if (
+  process.argv[1] &&
+  import.meta.url === pathToFileURL(process.argv[1]).href
+) {
+  if (process.argv.includes("--print-closure")) {
+    process.stdout.write(
+      `${JSON.stringify(discoverV4ReleaseAuthorityClosure(), null, 2)}\n`,
+    );
+  } else if (process.argv.includes("--print")) {
+    const ledger = JSON.parse(fs.readFileSync(ledgerPath, "utf8"));
+    process.stdout.write(
+      `${JSON.stringify(
+        discoverV4ReleaseTopology(
+          ledger.closedWorld.workflowPaths,
+          ledger.semanticScope.workflowPaths,
+        ),
+        null,
+        2,
+      )}\n`,
+    );
+  } else {
+    checkV4ReleaseTopology();
+    process.stdout.write("v4 release topology: ok\n");
+  }
 }