@kungfu-tech/buildchain 4.0.2-alpha.9 → 4.0.3-alpha.0

package/scripts/dev-delivery-warrant-store.mjs

@@ -7,6 +7,7 @@ import {
 import { normalizeDevDeliveryAuthorityState } from "../packages/core/dev-delivery-authority-state.js";
 
 const STATE_PATH = "queue.json";
+const READ_ATTEMPTS = 3;
 
 function text(value = "") {
   return String(value ?? "").trim();
@@ -20,6 +21,14 @@ function exactSha(value, label) {
   return normalized;
 }
 
+function positiveInteger(value, label) {
+  const parsed = Number(value);
+  if (!Number.isInteger(parsed) || parsed < 1) {
+    throw new Error(`${label} must be a positive integer`);
+  }
+  return parsed;
+}
+
 function normalizeRepository(value) {
   const normalized = text(value);
   const match = normalized.match(/^([^/\s]+)\/([^/\s]+)$/);
@@ -35,18 +44,20 @@ function encodeRef(ref) {
   return ref.split("/").map(encodeURIComponent).join("/");
 }
 
-function decodeBlob(blob) {
-  if (blob.encoding !== "base64")
-    throw new Error(
-      `unsupported Git blob encoding ${blob.encoding || "<empty>"}`,
-    );
+function decodeGitHubBlobEnvelope(raw) {
+  if (!/"encoding"\s*:\s*"base64"/.test(raw)) return raw;
+  const blob = JSON.parse(raw);
+  if (blob?.encoding !== "base64") return raw;
   return Buffer.from(
     String(blob.content || "").replace(/\s+/g, ""),
     "base64",
   ).toString("utf8");
 }
 
-function validateStoredState(queue, { allowLegacyV3Readback = false } = {}) {
+function validateStoredState(
+  queue,
+  { allowLegacyBaselineReadback = false } = {},
+) {
   const body = structuredClone(queue || {});
   const embeddedStateRoot = body.stateRoot;
   delete body.stateRoot;
@@ -59,7 +70,7 @@ function validateStoredState(queue, { allowLegacyV3Readback = false } = {}) {
   ) {
     normalizeDevDeliveryAuthorityState(queue);
   } else {
-    normalizeDevDeliveryQueue(queue, { allowLegacyV3Readback });
+    normalizeDevDeliveryQueue(queue, { allowLegacyBaselineReadback });
   }
   return queue;
 }
@@ -71,6 +82,7 @@ export class GitHubDevDeliveryStore {
     apiUrl = "https://api.github.com",
     fetchImpl = globalThis.fetch,
     createInitialState = createDevDeliveryQueue,
+    readAttempts = READ_ATTEMPTS,
   } = {}) {
     this.repository = normalizeRepository(repository);
     if (!fetchImpl) throw new Error("fetch is required");
@@ -82,6 +94,22 @@ export class GitHubDevDeliveryStore {
     this.apiUrl = apiUrl.replace(/\/+$/, "");
     this.fetch = fetchImpl;
     this.createInitialState = createInitialState;
+    this.readAttempts = positiveInteger(readAttempts, "readAttempts");
+  }
+
+  async retryParseableRead(operation) {
+    let failure;
+    for (let attempt = 1; attempt <= this.readAttempts; attempt += 1) {
+      try {
+        return await operation();
+      } catch (error) {
+        failure = error;
+        if (!(error instanceof SyntaxError) || attempt === this.readAttempts) {
+          throw error;
+        }
+      }
+    }
+    throw failure;
   }
 
   async request(method, requestPath, body) {
@@ -108,7 +136,52 @@ export class GitHubDevDeliveryStore {
     return data;
   }
 
-  async read({ stateRef, protectedBase, now, allowLegacyV3Readback = false }) {
+  async requestRaw(method, requestPath) {
+    const response = await this.fetch(`${this.apiUrl}${requestPath}`, {
+      method,
+      headers: {
+        accept: "application/vnd.github.raw+json",
+        authorization: `Bearer ${this.token}`,
+        "x-github-api-version": "2022-11-28",
+      },
+    });
+    const raw = await response.text();
+    if (!response.ok) {
+      let message = raw || `${method} ${requestPath} failed`;
+      try {
+        message = JSON.parse(raw)?.message || message;
+      } catch {
+        // Raw blob responses are not required to be JSON.
+      }
+      const error = new Error(message);
+      error.status = response.status;
+      throw error;
+    }
+    return raw;
+  }
+
+  async read({
+    stateRef,
+    protectedBase,
+    now,
+    allowLegacyBaselineReadback = false,
+  }) {
+    return this.retryParseableRead(async () =>
+      this.readOnce({
+        stateRef,
+        protectedBase,
+        now,
+        allowLegacyBaselineReadback,
+      }),
+    );
+  }
+
+  async readOnce({
+    stateRef,
+    protectedBase,
+    now,
+    allowLegacyBaselineReadback = false,
+  }) {
     let ref;
     try {
       ref = await this.request(
@@ -129,12 +202,24 @@ export class GitHubDevDeliveryStore {
     }
     const commitSha = exactSha(ref?.object?.sha, "state ref commit");
     const readback = await this.readCommit(commitSha, {
-      allowLegacyV3Readback,
+      allowLegacyBaselineReadback,
     });
     return { exists: true, ...readback };
   }
 
-  async readCommit(commitShaInput, { allowLegacyV3Readback = false } = {}) {
+  async readCommit(
+    commitShaInput,
+    { allowLegacyBaselineReadback = false } = {},
+  ) {
+    return this.retryParseableRead(async () =>
+      this.readCommitOnce(commitShaInput, { allowLegacyBaselineReadback }),
+    );
+  }
+
+  async readCommitOnce(
+    commitShaInput,
+    { allowLegacyBaselineReadback = false } = {},
+  ) {
     const commitSha = exactSha(commitShaInput, "state commit");
     const commit = await this.request(
       "GET",
@@ -149,13 +234,13 @@ export class GitHubDevDeliveryStore {
     );
     if (!entry?.sha)
       throw new Error(`${commitSha} does not contain ${STATE_PATH}`);
-    const blob = await this.request(
+    const raw = await this.requestRaw(
       "GET",
       `/repos/${this.repository.fullName}/git/blobs/${entry.sha}`,
     );
-    const bytes = decodeBlob(blob);
+    const bytes = decodeGitHubBlobEnvelope(raw);
     const queue = validateStoredState(JSON.parse(bytes), {
-      allowLegacyV3Readback,
+      allowLegacyBaselineReadback,
     });
     return { commitSha, queue, bytes };
   }

package/scripts/dev-delivery-warrant-transition.mjs

@@ -0,0 +1,109 @@
+import { recoverExpiredDevDeliveryWarrant } from "../packages/core/dev-delivery-warrant.js";
+
+async function recoverExpiredLeaseBeforeReselection({
+  store,
+  options,
+  loaded,
+  initialLoaded,
+}) {
+  const recovery = recoverExpiredDevDeliveryWarrant(loaded.queue, {
+    now: options.now,
+  });
+  if (recovery.receipt.expectedOldStateRoot !== loaded.queue.stateRoot) {
+    throw new Error(
+      "expired Warrant recovery receipt expected-old root does not match the loaded authority",
+    );
+  }
+  await store.write({
+    stateRef: options.stateRef,
+    queue: recovery.queue,
+    expectedCommitSha: loaded.commitSha,
+    expectedStateRoot: loaded.queue.stateRoot,
+    receiptRoot: recovery.receiptRoot,
+  });
+  const reloaded = await store.read({
+    stateRef: options.stateRef,
+    protectedBase: options.branch,
+    now: options.now,
+  });
+  return {
+    loaded: reloaded,
+    concurrencyRecovery: {
+      schema: "kungfu.buildchain.dev-delivery-concurrency-recovery/v1",
+      action: "expired-lease-recovered-before-reselection",
+      initialCommitSha: initialLoaded.commitSha,
+      recoveredStateRoot: recovery.queue.stateRoot,
+      observedCommitSha: reloaded.commitSha,
+      observedStateRoot: reloaded.queue.stateRoot,
+    },
+  };
+}
+
+export async function persistDevDeliveryTransition({
+  store,
+  options,
+  loaded,
+  initialLoaded,
+  changed,
+  transitionFor,
+}) {
+  let concurrencyRecovery = null;
+  if (
+    options.execute &&
+    options.command === "select" &&
+    changed.recoveryReceipt?.action === "recovered-expired-lease"
+  ) {
+    const recovery = await recoverExpiredLeaseBeforeReselection({
+      store,
+      options,
+      loaded,
+      initialLoaded,
+    });
+    loaded = recovery.loaded;
+    changed = transitionFor(options.command, loaded.queue, options);
+    concurrencyRecovery = recovery.concurrencyRecovery;
+  }
+  if (!options.execute || changed.queue.stateRoot === loaded.queue.stateRoot)
+    return { loaded, changed, write: null, concurrencyRecovery };
+  if (changed.receipt.expectedOldStateRoot !== loaded.queue.stateRoot) {
+    throw new Error(
+      "transition receipt expected-old root does not match the loaded authority",
+    );
+  }
+  try {
+    const write = await store.write({
+      stateRef: options.stateRef,
+      queue: changed.queue,
+      expectedCommitSha: loaded.commitSha,
+      expectedStateRoot: loaded.queue.stateRoot,
+      receiptRoot: changed.receiptRoot,
+    });
+    return { loaded, changed, write, concurrencyRecovery };
+  } catch (error) {
+    if (options.command !== "settle" || options.expectedOldStateRoot)
+      throw error;
+    const latest = await store.read({
+      stateRef: options.stateRef,
+      protectedBase: options.branch,
+      now: options.now,
+    });
+    const reconciled = transitionFor(options.command, latest.queue, options);
+    if (
+      reconciled.queue.stateRoot !== latest.queue.stateRoot ||
+      reconciled.receipt.action !== "duplicate-terminal-event-noop"
+    )
+      throw error;
+    return {
+      loaded: latest,
+      changed: reconciled,
+      write: null,
+      concurrencyRecovery: {
+        schema: "kungfu.buildchain.dev-delivery-concurrency-recovery/v1",
+        action: "terminal-settlement-race-noop",
+        initialCommitSha: initialLoaded.commitSha,
+        observedCommitSha: latest.commitSha,
+        observedStateRoot: latest.queue.stateRoot,
+      },
+    };
+  }
+}

package/scripts/dev-delivery-warrant.mjs

@@ -10,16 +10,17 @@ import {
   heartbeatDevDeliveryWarrant,
   observeDevDeliveryQueue,
   qualifyDevDeliveryWarrant,
-  recoverExpiredDevDeliveryWarrant,
   reconcileDevDeliveryTerminalEvidence,
   selectDevDeliveryWarrant,
   settleDevDeliveryTerminalEvent,
   submitDevDeliveryCandidate,
 } from "../packages/core/dev-delivery-warrant.js";
 import { recoverLegacyTerminalDevDeliveryQueue } from "../packages/core/dev-delivery-warrant-legacy-recovery.js";
-import { runV4DeliveryWarrantReadCandidate } from "../packages/core/v4-delivery-warrant-read-candidate.js";
+import { reuseExactActiveDevDeliverySourceProof } from "../packages/core/dev-delivery-candidate-identity.js";
+import { runDeliveryWarrantReadCandidate } from "../packages/core/delivery-warrant-read-candidate.js";
 
 import { GitHubDevDeliveryStore } from "./dev-delivery-warrant-store.mjs";
+import { persistDevDeliveryTransition } from "./dev-delivery-warrant-transition.mjs";
 import { devDeliveryCliOptions } from "./dev-delivery-warrant-options.mjs";
 export { GitHubDevDeliveryStore, devDeliveryCliOptions };
 
@@ -199,54 +200,60 @@ function transitionFor(command, queue, options) {
         "native command contract root does not match native-command",
       );
     }
+    const input = {
+      pullRequestNumber: positiveInteger(
+        options.pullRequestNumber,
+        "pullRequestNumber",
+      ),
+      sourceHead: exactSha(options.sourceHead, "sourceHead"),
+      ...(options.sourceRoot ? { sourceRoot: options.sourceRoot } : {}),
+      ...(options.assignmentRoot
+        ? { assignmentRoot: options.assignmentRoot }
+        : {}),
+      ...(options.initiativeRoot
+        ? { initiativeRoot: options.initiativeRoot }
+        : {}),
+      sourceIdentityRoot: exactRoot(
+        options.sourceIdentityRoot,
+        "sourceIdentityRoot",
+      ),
+      sourcePatchRoot: exactRoot(options.sourcePatchRoot, "sourcePatchRoot"),
+      sourceProofRoot: exactRoot(options.sourceProofRoot, "sourceProofRoot"),
+      planRoot: exactRoot(options.planRoot, "planRoot"),
+      closureRoot: exactRoot(options.closureRoot, "closureRoot"),
+      dependencyRoot: exactRoot(options.dependencyRoot, "dependencyRoot"),
+      toolchainRoot: exactRoot(options.toolchainRoot, "toolchainRoot"),
+      ...(options.environmentRoot
+        ? {
+            environmentRoot: exactRoot(
+              options.environmentRoot,
+              "environmentRoot",
+            ),
+          }
+        : {}),
+      ...(nativeCommandContract ? { nativeCommandContract } : {}),
+      affectedPaths: jsonList(options.affectedPaths, "affected paths"),
+      shardEvidenceRoots: jsonList(
+        options.shardEvidenceRoots,
+        "shard evidence roots",
+      ),
+      sourceWorkflowRunId: options.sourceWorkflowRunId
+        ? positiveInteger(options.sourceWorkflowRunId, "sourceWorkflowRunId")
+        : 0,
+      deliveryClass: options.deliveryClass,
+      priority: options.priority || "ordinary",
+      ...(options.releaseBlockerPriority
+        ? {
+            releaseBlockerPriority: jsonObject(
+              options.releaseBlockerPriority,
+              "release blocker priority",
+            ),
+          }
+        : {}),
+    };
     return submitDevDeliveryCandidate(
       queue,
-      {
-        pullRequestNumber: positiveInteger(
-          options.pullRequestNumber,
-          "pullRequestNumber",
-        ),
-        sourceHead: exactSha(options.sourceHead, "sourceHead"),
-        assignmentRoot: exactRoot(options.assignmentRoot, "assignmentRoot"),
-        initiativeRoot: exactRoot(options.initiativeRoot, "initiativeRoot"),
-        sourceIdentityRoot: exactRoot(
-          options.sourceIdentityRoot,
-          "sourceIdentityRoot",
-        ),
-        sourcePatchRoot: exactRoot(options.sourcePatchRoot, "sourcePatchRoot"),
-        sourceProofRoot: exactRoot(options.sourceProofRoot, "sourceProofRoot"),
-        planRoot: exactRoot(options.planRoot, "planRoot"),
-        closureRoot: exactRoot(options.closureRoot, "closureRoot"),
-        dependencyRoot: exactRoot(options.dependencyRoot, "dependencyRoot"),
-        toolchainRoot: exactRoot(options.toolchainRoot, "toolchainRoot"),
-        ...(options.environmentRoot
-          ? {
-              environmentRoot: exactRoot(
-                options.environmentRoot,
-                "environmentRoot",
-              ),
-            }
-          : {}),
-        ...(nativeCommandContract ? { nativeCommandContract } : {}),
-        affectedPaths: jsonList(options.affectedPaths, "affected paths"),
-        shardEvidenceRoots: jsonList(
-          options.shardEvidenceRoots,
-          "shard evidence roots",
-        ),
-        sourceWorkflowRunId: options.sourceWorkflowRunId
-          ? positiveInteger(options.sourceWorkflowRunId, "sourceWorkflowRunId")
-          : 0,
-        deliveryClass: options.deliveryClass,
-        priority: options.priority || "ordinary",
-        ...(options.releaseBlockerPriority
-          ? {
-              releaseBlockerPriority: jsonObject(
-                options.releaseBlockerPriority,
-                "release blocker priority",
-              ),
-            }
-          : {}),
-      },
+      reuseExactActiveDevDeliverySourceProof(queue.activeWarrant, input),
       { now: options.now },
     );
   }
@@ -356,7 +363,7 @@ async function observeQueue(loaded, options) {
     throw new Error("readMode must be v3 or v4");
   let observation = observeDevDeliveryQueue(loaded.queue, {
     now: options.now,
-    allowLegacyV3Readback: true,
+    allowLegacyBaselineReadback: true,
   });
   let readCandidate;
   if (readMode === "v4") {
@@ -377,7 +384,7 @@ async function observeQueue(loaded, options) {
         );
         return { receiptRoot: evidence.evidenceRoot };
       });
-    readCandidate = await runV4DeliveryWarrantReadCandidate(loaded.queue, {
+    readCandidate = await runDeliveryWarrantReadCandidate(loaded.queue, {
       qualification,
       expectedQualificationRoot: options.readQualificationRoot,
       expectedSources: {
@@ -437,7 +444,7 @@ export async function runDevDeliveryCommand(optionsInput = {}, clientInput) {
     stateRef: options.stateRef,
     protectedBase: options.branch,
     now: options.now,
-    allowLegacyV3Readback: ["observe", "recover-legacy-terminal"].includes(
+    allowLegacyBaselineReadback: ["observe", "recover-legacy-terminal"].includes(
       options.command,
     ),
   });
@@ -461,51 +468,16 @@ export async function runDevDeliveryCommand(optionsInput = {}, clientInput) {
   }
   if (options.command === "observe") return observeQueue(loaded, options);
   const initialLoaded = loaded;
-  let changed = transitionFor(options.command, loaded.queue, options);
-  let mutates = changed.queue.stateRoot !== loaded.queue.stateRoot;
-  let write = null;
-  if (options.execute && mutates) {
-    if (changed.receipt.expectedOldStateRoot !== loaded.queue.stateRoot) {
-      throw new Error(
-        "transition receipt expected-old root does not match the loaded authority",
-      );
-    }
-    try {
-      write = await store.write({
-        stateRef: options.stateRef,
-        queue: changed.queue,
-        expectedCommitSha: loaded.commitSha,
-        expectedStateRoot: loaded.queue.stateRoot,
-        receiptRoot: changed.receiptRoot,
-      });
-    } catch (error) {
-      if (options.command !== "settle" || options.expectedOldStateRoot)
-        throw error;
-      const latest = await store.read({
-        stateRef: options.stateRef,
-        protectedBase: options.branch,
-        now: options.now,
-      });
-      const reconciled = transitionFor(options.command, latest.queue, options);
-      const reconciledMutates =
-        reconciled.queue.stateRoot !== latest.queue.stateRoot;
-      if (
-        reconciledMutates ||
-        reconciled.receipt.action !== "duplicate-terminal-event-noop"
-      )
-        throw error;
-      loaded = latest;
-      changed = reconciled;
-      mutates = false;
-      concurrencyRecovery = {
-        schema: "kungfu.buildchain.dev-delivery-concurrency-recovery/v1",
-        action: "terminal-settlement-race-noop",
-        initialCommitSha: initialLoaded.commitSha,
-        observedCommitSha: latest.commitSha,
-        observedStateRoot: latest.queue.stateRoot,
-      };
-    }
-  }
+  const persisted = await persistDevDeliveryTransition({
+    store,
+    options,
+    loaded,
+    initialLoaded,
+    changed: transitionFor(options.command, loaded.queue, options),
+    transitionFor,
+  });
+  loaded = persisted.loaded;
+  concurrencyRecovery = persisted.concurrencyRecovery || concurrencyRecovery;
   return {
     schema: "kungfu.buildchain.dev-delivery-command-result/v1",
     ok: true,
@@ -514,16 +486,21 @@ export async function runDevDeliveryCommand(optionsInput = {}, clientInput) {
     stateRef: options.stateRef,
     before: { commitSha: loaded.commitSha, stateRoot: loaded.queue.stateRoot },
     after: {
-      commitSha: write?.commitSha || loaded.commitSha,
-      stateRoot: changed.queue.stateRoot,
+      commitSha: persisted.write?.commitSha || loaded.commitSha,
+      stateRoot: persisted.changed.queue.stateRoot,
     },
     mutationAuthorized: options.execute,
-    mutationApplied: Boolean(write),
+    mutationApplied: Boolean(persisted.write),
     concurrencyRecovery,
-    receipt: changed.receipt,
-    receiptRoot: changed.receiptRoot,
-    warrant: changed.warrant || changed.queue.activeWarrant || null,
-    observation: observeDevDeliveryQueue(changed.queue, { now: options.now }),
+    receipt: persisted.changed.receipt,
+    receiptRoot: persisted.changed.receiptRoot,
+    warrant:
+      persisted.changed.warrant ||
+      persisted.changed.queue.activeWarrant ||
+      null,
+    observation: observeDevDeliveryQueue(persisted.changed.queue, {
+      now: options.now,
+    }),
   };
 }
 

package/scripts/dev-pr-auto-merge.mjs

@@ -723,7 +723,6 @@ function renderAdmissionComment(receipt, receiptRoot) {
     "GitHub auto-merge state is observed evidence only; it is not Buildchain admission authority.",
   ].join("\n");
 }
-
 async function publishAdmissionDiagnostic(client, options, receipt, receiptRoot) {
   const marker = `<!-- ${AGENT_ADMISSION_MARKER} pr=${receipt.pullRequestNumber} head=${receipt.expectedHeadSha} -->`;
   const body = renderAdmissionComment(receipt, receiptRoot);
@@ -743,7 +742,6 @@ async function publishAdmissionDiagnostic(client, options, receipt, receiptRoot)
   }
   return { commentId: comment?.id || null, commentUrl: comment?.html_url || "", statusPublished: Boolean(status) };
 }
-
 function createAdmissionReceipt({ options, pr = {}, state, reason, readiness, decision = {}, queue = null, warrant = null }) {
   return createDevPrAdmissionReceipt({ options, pr, state, reason, readiness, decision, queue, warrant, labels: labelsOf(pr), nextAction: nextAdmissionAction });
 }
@@ -751,16 +749,21 @@ function createAdmissionReceipt({ options, pr = {}, state, reason, readiness, de
 function targetedFailure({ options, pr, state, reason, readiness, decision, queue }) {
   const receipt = createAdmissionReceipt({ options, pr, state, reason, readiness, decision, queue });
   return {
-    schema: AGENT_ADMISSION_RESULT_SCHEMA,
-    ok: false,
-    mode: options.dryRun ? "plan" : "execute",
-    outcome: "targeted-admission-failed",
-    receipt,
-    receiptRoot: contentRoot(receipt),
-    diagnostic: null,
+    schema: AGENT_ADMISSION_RESULT_SCHEMA, ok: false, mode: options.dryRun ? "plan" : "execute",
+    outcome: "targeted-admission-failed", receipt, receiptRoot: contentRoot(receipt), diagnostic: null,
   };
 }
-
+async function readTargetPullRequest(client, number, options) {
+  let { pollMergeableAttempts: attempts, pollMergeableDelayMs: delayMs } = options;
+  for (; attempts > 1; attempts -= 1) {
+    try {
+      return await client.getPullRequest(number, { attempts, delayMs });
+    } catch {
+      await delay(delayMs);
+    }
+  }
+  return client.getPullRequest(number, { attempts, delayMs });
+}
 export async function runDevPrAdmission(optionsInput = {}, clientInput) {
   const options = normalizeOptions(optionsInput);
   if (!options.targetBranch) throw new Error("target branch is required");
@@ -776,12 +779,9 @@ export async function runDevPrAdmission(optionsInput = {}, clientInput) {
 
   let pr;
   try {
-    pr = await client.getPullRequest(options.targetPullRequestNumber, {
-      attempts: options.pollMergeableAttempts,
-      delayMs: options.pollMergeableDelayMs,
-    });
+    pr = await readTargetPullRequest(client, options.targetPullRequestNumber, options);
   } catch (error) {
-    return targetedFailure({ options, pr: {}, state: "missing", reason: "pull-request-not-found" });
+    return targetedFailure({ options, pr: {}, state: "blocked", reason: "pull-request-read-failed" });
   }
 
   const readinessFence = createPreReadinessQueueFence({ client, options, sleep: delay });

package/scripts/dev-pr-delivery-warrant.mjs

@@ -143,7 +143,7 @@ export async function readCurrentDeliveryQueueState(client, repository, targetBr
   const { queue } = await store.read({
     stateRef: defaultDevDeliveryStateRef(targetBranch),
     protectedBase: targetBranch,
-    allowLegacyV3Readback: true,
+    allowLegacyBaselineReadback: true,
   });
   return queue;
 }

package/scripts/generate-channel-build-workflow.mjs

@@ -1,8 +1,10 @@
 #!/usr/bin/env node
 
 import fs from "node:fs";
+import { writeWorkflowSource } from "./workflow-taxonomy.mjs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
+import { migrateUniversalWorkflowFacade } from "./generate-universal-workflow-facades.mjs";
 
 const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 const sourcePath = path.join(root, ".github/workflows/.build.yml");
@@ -403,7 +405,10 @@ export function generateChannelBuildWorkflow(source) {
       ].join("\n"),
     )
     .replace("\n  alpha:\n", `\n${routerControllerPlanJob()}\n\n  alpha:\n`);
-  return `${generated.trimEnd()}\n\n${routerControllerReceiptJob()}\n\n${routerAggregateJob()}\n`;
+  return migrateUniversalWorkflowFacade(
+    `${generated.trimEnd()}\n\n${routerControllerReceiptJob()}\n\n${routerAggregateJob()}\n`,
+    ".github/workflows/build.yml",
+  );
 }
 
 function main() {
@@ -417,7 +422,7 @@ function main() {
     }
     return;
   }
-  fs.writeFileSync(targetPath, generated);
+  writeWorkflowSource(root, path.relative(root, targetPath), generated);
 }
 
 const isMain = process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url);