@kungfu-tech/buildchain 4.0.2-alpha.7 → 4.0.2-alpha.8

package/scripts/check-v4-release-topology.mjs

@@ -1,9 +1,10 @@
 #!/usr/bin/env node
 
 import assert from "node:assert/strict";
+import crypto from "node:crypto";
 import fs from "node:fs";
 import path from "node:path";
-import { fileURLToPath } from "node:url";
+import { fileURLToPath, pathToFileURL } from "node:url";
 
 import {
   parseWorkflowDocument,
@@ -17,6 +18,71 @@ function read(relative) {
   return fs.readFileSync(path.join(root, relative), "utf8");
 }
 
+const LOCAL_MODULE_EXTENSIONS = ["", ".js", ".mjs", ".cjs"];
+const PRIVILEGED_ENTRYPOINTS = [
+  "actions/v4-release-candidate-promote/index.js",
+];
+
+function localModuleSpecifiers(source) {
+  const specifiers = [];
+  const expression =
+    /(?:\bfrom\s+|\bimport\s*\(\s*|\bimport\s+)["'](\.[^"']+)["']/gu;
+  for (const match of source.matchAll(expression)) specifiers.push(match[1]);
+  return [...new Set(specifiers)].sort();
+}
+
+function resolveLocalModule(importer, specifier) {
+  const unresolved = path.posix.normalize(
+    path.posix.join(path.posix.dirname(importer), specifier),
+  );
+  assert.ok(
+    !unresolved.startsWith("../") && !path.posix.isAbsolute(unresolved),
+    `local module import escapes the repository: ${importer} -> ${specifier}`,
+  );
+  const candidates = [
+    ...LOCAL_MODULE_EXTENSIONS.map((extension) => `${unresolved}${extension}`),
+    ...LOCAL_MODULE_EXTENSIONS.slice(1).map((extension) =>
+      path.posix.join(unresolved, `index${extension}`),
+    ),
+  ];
+  const matches = candidates.filter((relative) => {
+    const absolute = path.join(root, relative);
+    return fs.existsSync(absolute) && fs.statSync(absolute).isFile();
+  });
+  assert.equal(
+    matches.length,
+    1,
+    `local module import must resolve exactly once: ${importer} -> ${specifier}`,
+  );
+  return matches[0];
+}
+
+export function discoverStaticModuleClosure(entrypoints) {
+  const pending = [...entrypoints];
+  const visited = new Set();
+  while (pending.length > 0) {
+    const relative = pending.pop();
+    if (visited.has(relative)) continue;
+    assert.ok(
+      fs.statSync(path.join(root, relative)).isFile(),
+      `privileged entry is not a file: ${relative}`,
+    );
+    visited.add(relative);
+    for (const specifier of localModuleSpecifiers(read(relative))) {
+      const dependency = resolveLocalModule(relative, specifier);
+      if (!visited.has(dependency)) pending.push(dependency);
+    }
+  }
+  return [...visited].sort();
+}
+
+function rootedPathSet(paths) {
+  return `sha256:${crypto
+    .createHash("sha256")
+    .update(JSON.stringify([...paths].sort()))
+    .digest("hex")}`;
+}
+
 function productionFiles(relative, extensions) {
   const absolute = path.join(root, relative);
   if (!fs.existsSync(absolute)) return [];
@@ -61,6 +127,17 @@ export function discoverV4ReleaseAuthorityClosure() {
     [".yml", ".yaml", ".js", ".mjs", ".cjs"],
     /(?:createV4ReleaseReceipt|release-receipt\.json|V4_RELEASE_RECEIPT_CONTRACT)/u,
   );
+  const privilegedModules = discoverStaticModuleClosure(PRIVILEGED_ENTRYPOINTS);
+  const legacyEngineModules = productionFiles(
+    "actions/promote-buildchain-ref",
+    [".js", ".mjs", ".cjs"],
+  )
+    .filter((relative) =>
+      /(?:^|\/)(?:lib|promote-(?:alpha|release|major)-channel|durable-transaction-operations)\.js$/u.test(
+        relative,
+      ),
+    )
+    .sort();
   return {
     providerAdapters: [
       ...new Set([
@@ -71,6 +148,12 @@ export function discoverV4ReleaseAuthorityClosure() {
     runtimeSelectors,
     runtimeEngines: ["actions/v4-release-candidate-promote/index.js"],
     terminalProjections,
+    privilegedExecutableClosure: {
+      entrypoints: PRIVILEGED_ENTRYPOINTS,
+      modules: privilegedModules,
+      root: rootedPathSet(privilegedModules),
+    },
+    legacyEngineModules,
   };
 }
 
@@ -274,6 +357,7 @@ function assertAuthorityClosure(ledger) {
     "runtimeSelectors",
     "runtimeEngines",
     "terminalProjections",
+    "legacyEngineModules",
   ]) {
     assert.ok(
       Array.isArray(closure[className]) && closure[className].length > 0,
@@ -292,6 +376,24 @@ function assertAuthorityClosure(ledger) {
       discovered[className],
       `authority closure class drifted: ${className}`,
     );
+  assert.deepEqual(
+    closure.privilegedExecutableClosure,
+    discovered.privilegedExecutableClosure,
+    "privileged executable transitive closure drifted",
+  );
+  assert.match(
+    closure.privilegedExecutableClosure.root,
+    /^sha256:[0-9a-f]{64}$/u,
+  );
+  const reachableLegacyEngines = closure.legacyEngineModules.filter(
+    (relative) =>
+      closure.privilegedExecutableClosure.modules.includes(relative),
+  );
+  assert.deepEqual(
+    reachableLegacyEngines,
+    [],
+    `legacy release engines remain reachable from APPLY: ${reachableLegacyEngines.join(", ")}`,
+  );
   assert.deepEqual(closure.runtimeEngines, [
     "actions/v4-release-candidate-promote/index.js",
   ]);
@@ -305,7 +407,7 @@ function assertAuthorityClosure(ledger) {
   );
   const engineSurface = [
     ".github/workflows/.release-candidate-promote.yml",
-    ...closure.runtimeEngines,
+    ...closure.privilegedExecutableClosure.modules,
   ]
     .map(read)
     .join("\n");
@@ -361,23 +463,28 @@ export function checkV4ReleaseTopology() {
   return actual;
 }
 
-if (process.argv.includes("--print-closure")) {
-  process.stdout.write(
-    `${JSON.stringify(discoverV4ReleaseAuthorityClosure(), null, 2)}\n`,
-  );
-} else if (process.argv.includes("--print")) {
-  const ledger = JSON.parse(fs.readFileSync(ledgerPath, "utf8"));
-  process.stdout.write(
-    `${JSON.stringify(
-      discoverV4ReleaseTopology(
-        ledger.closedWorld.workflowPaths,
-        ledger.semanticScope.workflowPaths,
-      ),
-      null,
-      2,
-    )}\n`,
-  );
-} else {
-  checkV4ReleaseTopology();
-  process.stdout.write("v4 release topology: ok\n");
+if (
+  process.argv[1] &&
+  import.meta.url === pathToFileURL(process.argv[1]).href
+) {
+  if (process.argv.includes("--print-closure")) {
+    process.stdout.write(
+      `${JSON.stringify(discoverV4ReleaseAuthorityClosure(), null, 2)}\n`,
+    );
+  } else if (process.argv.includes("--print")) {
+    const ledger = JSON.parse(fs.readFileSync(ledgerPath, "utf8"));
+    process.stdout.write(
+      `${JSON.stringify(
+        discoverV4ReleaseTopology(
+          ledger.closedWorld.workflowPaths,
+          ledger.semanticScope.workflowPaths,
+        ),
+        null,
+        2,
+      )}\n`,
+    );
+  } else {
+    checkV4ReleaseTopology();
+    process.stdout.write("v4 release topology: ok\n");
+  }
 }

package/scripts/release-candidate-resolver.mjs

@@ -13,7 +13,6 @@ import { v4ContentRoot } from "../packages/core/v4-canonical-contracts.js";
 import { v4PublicationQualificationRoot, validateV4PublicationQualificationReceipt } from "../packages/core/v4-publication-qualification.js";
 
 const DEFAULT_WORKFLOW_FILE = "build-surface-fixture.yml";
-
 function env(name, fallback = "") {
   return process.env[name] || fallback;
 }
@@ -21,7 +20,6 @@ function env(name, fallback = "") {
 export function releaseCandidateDownloadEnabled(value = "true") {
   return String(value || "true").trim().toLowerCase() !== "false";
 }
-
 function splitRepository(repository) {
   const match = String(repository || "").trim().match(/^([^/\s]+)\/([^/\s]+)$/);
   if (!match) {
@@ -44,7 +42,9 @@ function assertSha(value, label = "sha") {
 
 export const releaseCandidateRuntimeSha = (passport) =>
   assertSha(passport?.buildchain?.sha, "release candidate Passport Buildchain runtime SHA").toLowerCase();
-
+export const resolveFreshPublicationVersion = ({ sealedBundle, candidateVersion = "" } = {}) =>
+  String(sealedBundle?.manifest?.npm?.version || candidateVersion || "").trim();
+const optionalText = (value) => String(value || "");
 function githubHeaders(token) {
   const headers = {
     accept: "application/vnd.github+json",
@@ -740,19 +740,17 @@ export async function resolveReleaseCandidateArtifacts({
         releaseAssetPaths,
       })
     : undefined;
-  const manifests = platformManifestPaths.map((manifestPath) => JSON.parse(fs.readFileSync(manifestPath, "utf8")));
+  const manifests = platformManifestPaths.map((manifestPath) => JSON.parse(fs.readFileSync(manifestPath, "utf8"))), publicationVersion = resolveFreshPublicationVersion({ sealedBundle, candidateVersion: passport.target?.version });
   const generatedRequiredArtifacts = generatePublishRequiredArtifacts({
     manifests,
-    version: [sealedBundle?.manifest?.npm?.version, passport.target?.version, ""].find(Boolean),
+    version: publicationVersion,
     kind: publishArtifactKind,
     tarballPaths: npmTarballPaths,
     mainPackage: publishPackageMain,
   });
   const requiredArtifactsPath = path.join(resolvedOutput, "publish-required-artifacts.json");
   fs.writeFileSync(requiredArtifactsPath, `${JSON.stringify(generatedRequiredArtifacts, null, 2)}\n`);
-  const sealedBundleManifestPath = sealedBundle
-    ? path.join(resolvedOutput, "sealed-bundle.json")
-    : "";
+  const sealedBundleManifestPath = sealedBundle ? path.join(resolvedOutput, "sealed-bundle.json") : "";
   if (sealedBundleManifestPath) {
     fs.writeFileSync(sealedBundleManifestPath, `${JSON.stringify(sealedBundle.manifest, null, 2)}\n`);
   }
@@ -772,6 +770,7 @@ export async function resolveReleaseCandidateArtifacts({
       sealedBundleManifest: sealedBundleManifestPath ? outputPath(sealedBundleManifestPath) : "",
     },
     version: passport.target?.version || "",
+    publicationVersion,
     candidateHash: passport.candidateHash || "",
     payloadCount: payloadArtifacts.length,
     platformManifestCount: platformManifestPaths.length,
@@ -811,6 +810,7 @@ export async function resolveReleaseCandidateArtifactsCli() {
     "release-candidate-publication-qualification-path": result.paths?.publicationQualification || "",
     "release-candidate-publication-qualification-root": result.publicationQualificationRoot || "",
     "release-candidate-version": result.version || "",
+    "release-candidate-publication-version": optionalText(result.publicationVersion),
     "release-candidate-source-sha": result.artifacts?.sourceSha || "",
     "release-candidate-artifact": result.artifacts?.passport || "",
     "release-candidate-build-summary-artifact": result.artifacts?.summary || "",
@@ -843,7 +843,6 @@ export async function resolveReleaseCandidateArtifactsCli() {
   console.log(JSON.stringify(result, null, 2));
   return result;
 }
-
 if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
   try {
     await resolveReleaseCandidateArtifactsCli();

package/scripts/v4-product-publication-intent.mjs

@@ -0,0 +1,114 @@
+#!/usr/bin/env node
+
+import fs from "node:fs";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+
+import { spawnSyncCommand } from "../packages/core/spawn-command.js";
+import { selectV4ProductPublicationIntent } from "../packages/core/v4-product-publication.js";
+import { v4ContentRoot } from "../packages/core/v4-canonical-contracts.js";
+
+function env(name, required = false) {
+  const value = String(process.env[name] || "").trim();
+  if (required && !value) throw new Error(`${name} is required`);
+  return value;
+}
+
+function readJson(file) {
+  return JSON.parse(fs.readFileSync(path.resolve(file), "utf8"));
+}
+
+function packageName() {
+  const declared = env("BUILDCHAIN_PUBLISH_PACKAGE_MAIN");
+  if (declared) return declared;
+  const manifestPath = env("BUILDCHAIN_SEALED_BUNDLE_MANIFEST", true);
+  const manifest = readJson(manifestPath);
+  const selected = String(manifest?.npm?.name || "").trim();
+  if (!selected)
+    throw new Error("sealed bundle manifest does not declare npm.name");
+  return selected;
+}
+
+function observedVersions(name) {
+  const result = spawnSyncCommand(
+    "npm",
+    [
+      "view",
+      name,
+      "versions",
+      "--json",
+      "--registry=https://registry.npmjs.org/",
+    ],
+    { encoding: "utf8" },
+  );
+  if (result.error) throw result.error;
+  if (result.status !== 0) {
+    const output = `${result.stdout || ""}\n${result.stderr || ""}`;
+    if (/\bE404\b|404 Not Found|is not in this registry/iu.test(output))
+      return [];
+    throw new Error(`npm version discovery failed: ${output.trim()}`);
+  }
+  const parsed = JSON.parse(String(result.stdout || "[]"));
+  return Array.isArray(parsed) ? parsed : [parsed].filter(Boolean);
+}
+
+function writeOutput(name, value) {
+  const output = env("GITHUB_OUTPUT");
+  if (!output) return;
+  fs.appendFileSync(output, `${name}=${String(value)}\n`);
+}
+
+export function resolveV4ProductPublicationIntent() {
+  const name = packageName();
+  const sourceSha = env("BUILDCHAIN_SOURCE_SHA", true);
+  const manifest = readJson(env("BUILDCHAIN_SEALED_BUNDLE_MANIFEST", true));
+  const requiredArtifacts = readJson(
+    env("BUILDCHAIN_REQUIRED_ARTIFACTS_PATH", true),
+  );
+  const channel = env("BUILDCHAIN_CHANNEL", true);
+  const intent = selectV4ProductPublicationIntent({
+    channel,
+    targetRef: env("BUILDCHAIN_TARGET_REF", true),
+    sourceSha,
+    sourceTimestamp: env("BUILDCHAIN_SOURCE_TIMESTAMP", true),
+    repository: env("BUILDCHAIN_REPOSITORY", true),
+    packageName: name,
+    distTag:
+      env("BUILDCHAIN_PUBLISH_DIST_TAG") ||
+      (channel === "alpha" ? "alpha" : "latest"),
+    sealedBundleRoot: manifest.root,
+    requiredArtifactsRoot: v4ContentRoot(
+      "v4-product-required-artifacts",
+      requiredArtifacts,
+    ),
+    candidateVersion: env("BUILDCHAIN_CANDIDATE_VERSION", true),
+    recoveredVersion: env("BUILDCHAIN_RECOVERED_PUBLICATION_VERSION"),
+    observedVersions: observedVersions(name),
+  });
+  const outputPath = path.resolve(
+    env("BUILDCHAIN_PRODUCT_PUBLICATION_INTENT_PATH") ||
+      ".buildchain/release-candidate/v4-product-publication-intent.json",
+  );
+  fs.mkdirSync(path.dirname(outputPath), { recursive: true });
+  fs.writeFileSync(outputPath, `${JSON.stringify(intent, null, 2)}\n`);
+  writeOutput("version", intent.version);
+  writeOutput("exact-tag", intent.exactTag);
+  writeOutput("intent-path", outputPath);
+  writeOutput("intent-root", intent.intentRoot);
+  return { name, intent, outputPath };
+}
+
+if (
+  process.argv[1] &&
+  import.meta.url === pathToFileURL(process.argv[1]).href
+) {
+  try {
+    const result = resolveV4ProductPublicationIntent();
+    process.stdout.write(
+      `v4 product publication intent: ${result.name}@${result.intent.version} (${result.intent.mode})\n`,
+    );
+  } catch (error) {
+    console.error(`v4-product-publication-intent: ${error.message}`);
+    process.exitCode = 1;
+  }
+}