@kungfu-tech/buildchain 4.0.8 → 4.0.9-alpha.0

package/scripts/generate-channel-build-workflow.mjs

@@ -1,429 +1,69 @@
 #!/usr/bin/env node
-
 import fs from "node:fs";
-import { writeWorkflowSource } from "./workflow-taxonomy.mjs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
-import { migrateUniversalWorkflowFacade } from "./generate-universal-workflow-facades.mjs";
-
-const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
-const sourcePath = path.join(root, ".github/workflows/.build.yml");
-const targetPath = path.join(root, ".github/workflows/build.yml");
-
-function blockBetween(source, start, end) {
-  const startIndex = source.indexOf(start);
-  const endIndex = source.indexOf(end, startIndex + start.length);
-  if (startIndex < 0 || endIndex < 0) throw new Error(`unable to locate workflow block: ${start.trim()}`);
-  return source.slice(startIndex + start.length, endIndex);
-}
-
-function inputNames(inputBlock) {
-  return [...inputBlock.matchAll(/^      ([a-z0-9-]+):$/gm)].map((match) => match[1]);
-}
-
-function routerInputs(inputBlock) {
-  const adjusted = inputBlock.replace(
-    /(      buildchain-contract-lock-path:\n(?:        .*\n)*?        default:) "buildchain\.contract-lock\.json"/,
-    '$1 ""',
-  );
-  return [
-    "      buildchain-channel:",
-    '        description: "Buildchain runtime channel: auto, alpha, or stable"',
-    '        default: "auto"',
-    "        type: string",
-    "        required: false",
-    "      buildchain-alpha-contract-lock-path:",
-    '        description: "Consumer-owned contract lock selected for the alpha channel"',
-    '        default: ".buildchain/alpha-contract-lock.json"',
-    "        type: string",
-    "        required: false",
-    "      buildchain-stable-contract-lock-path:",
-    '        description: "Consumer-owned contract lock selected for the stable channel"',
-    '        default: ".buildchain/contract-lock.json"',
-    "        type: string",
-    "        required: false",
-    adjusted.trimEnd(),
-  ].join("\n");
-}
-
-function routerOutputs(outputBlock) {
-  const forwarded = outputBlock
-    .replace(/^        value: \$\{\{ jobs\.[^.]+\.outputs\.([^ }]+) \}\}$/gm, "        value: ${{ jobs.override.outputs.$1 || jobs.alpha.outputs.$1 || jobs.stable.outputs.$1 }}")
-    .replaceAll("build-lifecycle", "build-channel-router")
-    .replace("value: ${{ jobs.override.outputs.controller-plan-artifact || jobs.alpha.outputs.controller-plan-artifact || jobs.stable.outputs.controller-plan-artifact }}", "value: ${{ jobs.controller-plan.outputs.controller-plan-artifact }}")
-    .replace("value: ${{ jobs.override.outputs.controller-plan-json || jobs.alpha.outputs.controller-plan-json || jobs.stable.outputs.controller-plan-json }}", "value: ${{ jobs.controller-plan.outputs.controller-plan-json }}")
-    .replace("value: ${{ jobs.override.outputs.controller-plan-digest || jobs.alpha.outputs.controller-plan-digest || jobs.stable.outputs.controller-plan-digest }}", "value: ${{ jobs.controller-plan.outputs.controller-plan-digest }}")
-    .replace("value: ${{ jobs.override.outputs.controller-receipt-artifact || jobs.alpha.outputs.controller-receipt-artifact || jobs.stable.outputs.controller-receipt-artifact }}", "value: ${{ jobs.controller-receipt.outputs.controller-receipt-artifact }}")
-    .replace("value: ${{ jobs.override.outputs.controller-receipt-json || jobs.alpha.outputs.controller-receipt-json || jobs.stable.outputs.controller-receipt-json }}", "value: ${{ jobs.controller-receipt.outputs.controller-receipt-json }}")
-    .replace("value: ${{ jobs.override.outputs.controller-receipt-digest || jobs.alpha.outputs.controller-receipt-digest || jobs.stable.outputs.controller-receipt-digest }}", "value: ${{ jobs.controller-receipt.outputs.controller-receipt-digest }}")
-    .replace("value: ${{ jobs.override.outputs.controller-receipt-status || jobs.alpha.outputs.controller-receipt-status || jobs.stable.outputs.controller-receipt-status }}", "value: ${{ jobs.controller-receipt.outputs.controller-receipt-status }}")
-    .replace(
-      /(      credential-island-macos-artifact:\n(?:        .*\n)*?        value:) \$\{\{ jobs\.override\.outputs\.artifact-name \|\| jobs\.alpha\.outputs\.artifact-name \|\| jobs\.stable\.outputs\.artifact-name \}\}/,
-      "$1 ${{ jobs.override.outputs.credential-island-macos-artifact || jobs.alpha.outputs.credential-island-macos-artifact || jobs.stable.outputs.credential-island-macos-artifact }}",
-    )
-    .replace(
-      /(      credential-island-macos-manifest-artifact:\n(?:        .*\n)*?        value:) \$\{\{ jobs\.override\.outputs\.manifest-artifact-name \|\| jobs\.alpha\.outputs\.manifest-artifact-name \|\| jobs\.stable\.outputs\.manifest-artifact-name \}\}/,
-      "$1 ${{ jobs.override.outputs.credential-island-macos-manifest-artifact || jobs.alpha.outputs.credential-island-macos-manifest-artifact || jobs.stable.outputs.credential-island-macos-manifest-artifact }}",
-    );
-  return [
-    "      buildchain-channel:",
-    '        description: "Resolved Buildchain channel: alpha or stable"',
-    "        value: ${{ jobs.resolve-channel.outputs.channel }}",
-    "      buildchain-channel-selection-source:",
-    '        description: "Evidence source used to select the Buildchain channel"',
-    "        value: ${{ jobs.resolve-channel.outputs.selection-source }}",
-    "      buildchain-channel-reason:",
-    '        description: "Human-readable Buildchain channel selection reason"',
-    "        value: ${{ jobs.resolve-channel.outputs.reason }}",
-    forwarded.trimEnd(),
-  ].join("\n");
-}
-
-function forwardedInputs(names) {
-  return names
-    .map((name) => {
-      if (name === "buildchain-ref") return `      buildchain-ref: \${{ needs.resolve-channel.outputs.buildchain-ref }}`;
-      if (name === "buildchain-expected-channel") {
-        return "      buildchain-expected-channel: ${{ needs.resolve-channel.outputs.channel }}";
-      }
-      if (name === "buildchain-expected-major") {
-        return "      buildchain-expected-major: ${{ needs.resolve-channel.outputs.major }}";
-      }
-      if (name === "buildchain-contract-lock-path") {
-        return "      buildchain-contract-lock-path: ${{ needs.resolve-channel.outputs.contract-lock-path }}";
-      }
-      if (name === "buildchain-visible-workflow") {
-        return "      buildchain-visible-workflow: .github/workflows/build.yml";
-      }
-      return `      ${name}: \${{ inputs.${name} }}`;
-    })
-    .join("\n");
-}
-
-function routerControllerPlanJob() {
-  return `  controller-plan:
-    name: Plan channel router controller evidence
-    needs: resolve-channel
-    runs-on: \${{ fromJSON(inputs.control-runner-json) }}
-    outputs:
-      controller-plan-artifact: \${{ steps.names.outputs.controller-plan-artifact }}
-      controller-plan-json: \${{ steps.plan.outputs.controller-plan-json }}
-      controller-plan-digest: \${{ steps.plan.outputs.controller-plan-digest }}
-      runtime-sha: \${{ steps.identities.outputs.runtime-sha }}
-    steps:
-      - name: Checkout Buildchain controller workflow shell
-        uses: actions/checkout@v7.0.0
-        with:
-          repository: \${{ needs.resolve-channel.outputs.router-repository }}
-          ref: \${{ needs.resolve-channel.outputs.router-sha }}
-          path: .buildchain/controller-runtime
-          persist-credentials: false
-
-      - name: Resolve controller workflow shell identity
-        id: identities
-        shell: bash
-        run: |
-          runtime_sha="$(git -C .buildchain/controller-runtime rev-parse HEAD)"
-          contract_digest="$(node -e 'const fs=require("fs"); const value=JSON.parse(fs.readFileSync(".buildchain/controller-runtime/dist/site/buildchain-contract.json","utf8")); process.stdout.write(value.contractDigest)')"
-          {
-            echo "runtime-sha=\${runtime_sha}"
-            echo "contract-digest=\${contract_digest}"
-          } >> "$GITHUB_OUTPUT"
-
-      - name: Create channel router controller plan
-        id: plan
-        run: node .buildchain/controller-runtime/scripts/controller-evidence.mjs --mode plan
-        env:
-          BUILDCHAIN_CONTROLLER_ID: build-channel-router
-          BUILDCHAIN_CONTROLLER_SOURCE_REPOSITORY: \${{ github.repository }}
-          BUILDCHAIN_CONTROLLER_SOURCE_SHA: \${{ github.sha }}
-          BUILDCHAIN_CONTROLLER_RUNTIME_REF: \${{ needs.resolve-channel.outputs.router-ref }}
-          BUILDCHAIN_CONTROLLER_RUNTIME_SHA: \${{ steps.identities.outputs.runtime-sha }}
-          BUILDCHAIN_CONTROLLER_CONTRACT_DIGEST: \${{ steps.identities.outputs.contract-digest }}
-          BUILDCHAIN_CONTROLLER_REGISTRY: .buildchain/controller-runtime/dist/site/controller-registry.json
-          BUILDCHAIN_CONTROLLER_INPUTS_JSON: \${{ toJSON(inputs) }}
-          BUILDCHAIN_CONTROLLER_INPUT_BOUNDARY: workflow-call
-          BUILDCHAIN_CONTROLLER_PLAN_PATH: .buildchain/controller/plan.json
-
-      - name: Resolve channel router controller plan artifact
-        id: names
-        run: echo "controller-plan-artifact=buildchain-channel-controller-plan-\${SOURCE_SHA}" >> "$GITHUB_OUTPUT"
-        env:
-          SOURCE_SHA: \${{ github.sha }}
-
-      - name: Upload channel router controller plan
-        uses: actions/upload-artifact@v7.0.1
-        with:
-          name: \${{ steps.names.outputs.controller-plan-artifact }}
-          path: .buildchain/controller/plan.json
-          if-no-files-found: error`;
-}
-
-function routerControllerReceiptJob() {
-  return `  controller-receipt:
-    name: Finalize channel router controller evidence
-    needs:
-      - resolve-channel
-      - controller-plan
-      - override
-      - alpha
-      - stable
-    if: \${{ always() && needs.controller-plan.result == 'success' }}
-    runs-on: \${{ fromJSON(inputs.control-runner-json) }}
-    outputs:
-      controller-receipt-artifact: \${{ steps.names.outputs.controller-receipt-artifact }}
-      controller-receipt-json: \${{ steps.receipt.outputs.controller-receipt-json }}
-      controller-receipt-digest: \${{ steps.receipt.outputs.controller-receipt-digest }}
-      controller-receipt-status: \${{ steps.receipt.outputs.controller-receipt-status }}
-    steps:
-      - name: Checkout Buildchain controller workflow shell
-        uses: actions/checkout@v7.0.0
-        with:
-          repository: \${{ needs.resolve-channel.outputs.router-repository }}
-          ref: \${{ needs.controller-plan.outputs.runtime-sha }}
-          path: .buildchain/controller-runtime
-          persist-credentials: false
-
-      - name: Download channel router controller plan
-        uses: actions/download-artifact@v7.0.0
-        with:
-          name: \${{ needs.controller-plan.outputs.controller-plan-artifact }}
-          path: .buildchain/controller
-
-      - name: Create channel router controller receipt
-        id: receipt
-        run: node .buildchain/controller-runtime/scripts/controller-evidence.mjs --mode receipt
-        env:
-          BUILDCHAIN_CONTROLLER_PLAN_PATH: .buildchain/controller/plan.json
-          BUILDCHAIN_CONTROLLER_STAGES_JSON: >-
-            [{"id":"resolve-channel","status":"\${{ needs.resolve-channel.result }}"},{"id":"override","status":"\${{ needs.override.result }}"},{"id":"alpha","status":"\${{ needs.alpha.result }}"},{"id":"stable","status":"\${{ needs.stable.result }}"},{"id":"aggregate","status":"\${{ needs.resolve-channel.outputs.runtime-override == 'true' && needs.override.result || needs.resolve-channel.outputs.channel == 'alpha' && needs.alpha.result || needs.stable.result }}"}]
-          BUILDCHAIN_CONTROLLER_EVIDENCE_JSON: \${{ (needs.override.outputs.controller-receipt-digest != '' || needs.alpha.outputs.controller-receipt-digest != '' || needs.stable.outputs.controller-receipt-digest != '') && format('[{{"kind":"nested-controller-receipt","digest":"{0}"}}]', needs.override.outputs.controller-receipt-digest || needs.alpha.outputs.controller-receipt-digest || needs.stable.outputs.controller-receipt-digest) || '[]' }}
-          BUILDCHAIN_CONTROLLER_REASON_CODE: \${{ ((needs.resolve-channel.outputs.runtime-override == 'true' && needs.override.result == 'success') || (needs.resolve-channel.outputs.runtime-override != 'true' && needs.resolve-channel.outputs.channel == 'alpha' && needs.alpha.result == 'success') || (needs.resolve-channel.outputs.runtime-override != 'true' && needs.resolve-channel.outputs.channel == 'stable' && needs.stable.result == 'success')) && '' || 'nested-build-incomplete' }}
-          BUILDCHAIN_CONTROLLER_REASON_SUMMARY: Nested build controller did not complete successfully
-          BUILDCHAIN_CONTROLLER_RECEIPT_ARTIFACT: buildchain-channel-controller-receipt-\${{ github.sha }}
-          BUILDCHAIN_CONTROLLER_RECEIPT_PATH: .buildchain/controller/receipt.json
-
-      - name: Resolve channel router controller receipt artifact
-        id: names
-        run: echo "controller-receipt-artifact=buildchain-channel-controller-receipt-\${SOURCE_SHA}" >> "$GITHUB_OUTPUT"
-        env:
-          SOURCE_SHA: \${{ github.sha }}
-
-      - name: Upload channel router controller receipt
-        if: \${{ always() && steps.receipt.outcome == 'success' }}
-        uses: actions/upload-artifact@v7.0.1
-        with:
-          name: \${{ steps.names.outputs.controller-receipt-artifact }}
-          path: .buildchain/controller/receipt.json
-          if-no-files-found: error
-
-      - name: Enforce qualifying channel router controller receipt
-        if: \${{ steps.receipt.outputs.controller-receipt-qualifying != 'true' }}
-        run: |
-          echo "::error::channel router controller receipt is not qualifying: \${{ steps.receipt.outputs.controller-receipt-status }}"
-          exit 1`;
-}
+import { writeWorkflowSource } from "./workflow-taxonomy.mjs";
 
-function routerAggregateJob() {
-  return `  summarize:
-    name: Summarize build contract
-    needs:
-      - resolve-channel
-      - override
-      - alpha
-      - stable
-      - controller-receipt
-    if: \${{ always() }}
-    runs-on: \${{ fromJSON(inputs.control-runner-json) }}
-    steps:
-      - name: Enforce public channel router aggregate
-        shell: bash
-        env:
-          CHANNEL: \${{ needs.resolve-channel.outputs.channel }}
-          RUNTIME_OVERRIDE: \${{ needs.resolve-channel.outputs.runtime-override }}
-          OVERRIDE_RESULT: \${{ needs.override.result }}
-          ALPHA_RESULT: \${{ needs.alpha.result }}
-          STABLE_RESULT: \${{ needs.stable.result }}
-          CONTROLLER_RECEIPT_RESULT: \${{ needs.controller-receipt.result }}
-        run: |
-          set -euo pipefail
-          selected_result="\${STABLE_RESULT}"
-          if [[ "\${RUNTIME_OVERRIDE}" = "true" ]]; then
-            selected_result="\${OVERRIDE_RESULT}"
-          elif [[ "\${CHANNEL}" = "alpha" ]]; then
-            selected_result="\${ALPHA_RESULT}"
-          fi
-          if [[ "\${selected_result}" != "success" || "\${CONTROLLER_RECEIPT_RESULT}" != "success" ]]; then
-            echo "::error::Buildchain channel router did not qualify: channel=\${CHANNEL} selected=\${selected_result} controller-receipt=\${CONTROLLER_RECEIPT_RESULT}"
-            exit 1
-          fi
-          echo "Buildchain channel router aggregate passed."`;
+const root = path.resolve(import.meta.dirname, "..");
+function block(source, start, end) {
+  const first = source.indexOf(start);
+  const last = source.indexOf(end, first + start.length);
+  if (first < 0 || last < 0) throw new Error(`Missing build contract block: ${start.trim()}`);
+  return source.slice(first + start.length, last).trimEnd();
 }
 
-function generateChannelBuildWorkflowBase(source) {
-  const inputs = blockBetween(source, "    inputs:\n", "    secrets:\n");
-  const secrets = blockBetween(source, "    secrets:\n", "    outputs:\n");
-  const outputs = blockBetween(source, "    outputs:\n", "\npermissions:\n");
-  const names = inputNames(inputs);
-  if (!names.includes("buildchain-ref") || !names.includes("publish-channel")) {
-    throw new Error("source build workflow is missing channel-router inputs");
+export function generateChannelBuildWorkflow(source) {
+  const inputs = block(source, "    inputs:\n", "    secrets:\n");
+  if (JSON.stringify([...inputs.matchAll(/^      ([a-z0-9-]+):$/gmu)].map((match) => match[1])) !== '["config-path"]') {
+    throw new Error("Ordinary builds expose only the optional configuration locator");
   }
-  return `# Generated by scripts/generate-channel-build-workflow.mjs. Do not edit directly.\nname: Buildchain Channel Build\n\non:\n  workflow_call:\n    inputs:\n${routerInputs(inputs)}\n    secrets:\n${secrets.trimEnd()}\n    outputs:\n${routerOutputs(outputs)}\n\npermissions:\n  contents: read\n  issues: write\n  id-token: write\n\njobs:\n  resolve-channel:\n    name: Resolve Buildchain channel\n    runs-on: ubuntu-24.04\n    outputs:\n      channel: \${{ steps.channel.outputs.channel }}\n      buildchain-ref: \${{ steps.channel.outputs.buildchain-ref }}\n      contract-lock-path: \${{ steps.lock.outputs.path }}\n      selection-source: \${{ steps.channel.outputs.selection-source }}\n      reason: \${{ steps.channel.outputs.reason }}\n    steps:\n      - name: Resolve router source\n        id: router\n        shell: bash\n        env:\n          BUILDCHAIN_ROUTER_WORKFLOW_REF: \${{ job.workflow_ref }}\n        run: |\n          set -euo pipefail\n          workflow_ref=\"\${BUILDCHAIN_ROUTER_WORKFLOW_REF}\"\n          repository=\"\${workflow_ref%%/.github/workflows/*}\"\n          ref=\"\${workflow_ref##*@}\"\n          ref=\"\${ref#refs/heads/}\"\n          ref=\"\${ref#refs/tags/}\"\n          if [[ -z \"\${repository}\" || \"\${repository}\" = \"\${workflow_ref}\" || -z \"\${ref}\" ]]; then\n            echo \"Unable to resolve Buildchain router source from job.workflow_ref=\${workflow_ref}\" >&2\n            exit 1\n          fi\n          {\n            echo \"repository=\${repository}\"\n            echo \"ref=\${ref}\"\n          } >> \"\${GITHUB_OUTPUT}\"\n\n      - name: Checkout Buildchain router\n        uses: actions/checkout@v7.0.0\n        with:\n          repository: \${{ steps.router.outputs.repository }}\n          ref: \${{ steps.router.outputs.ref }}\n          path: .buildchain/router\n          persist-credentials: false\n\n      - name: Resolve channel\n        id: channel\n        shell: bash\n        env:\n          BUILDCHAIN_CHANNEL: \${{ inputs.buildchain-channel }}\n          BUILDCHAIN_REQUESTED_REF: \${{ inputs.buildchain-ref }}\n          BUILDCHAIN_PUBLISH_CHANNEL: \${{ inputs.publish-channel }}\n          BUILDCHAIN_EVENT_NAME: \${{ github.event_name }}\n          BUILDCHAIN_GIT_REF: \${{ github.ref }}\n          BUILDCHAIN_RELEASE_PRERELEASE: \${{ github.event.release.prerelease }}\n          BUILDCHAIN_ROUTER_REF: \${{ steps.router.outputs.ref }}\n        run: |\n          node .buildchain/router/scripts/buildchain-channel-router.mjs \\\n            --cwd .buildchain/router \\\n            --channel \"\${BUILDCHAIN_CHANNEL}\" \\\n            --buildchain-ref \"\${BUILDCHAIN_REQUESTED_REF}\" \\\n            --publish-channel \"\${BUILDCHAIN_PUBLISH_CHANNEL}\" \\\n            --event-name \"\${BUILDCHAIN_EVENT_NAME}\" \\\n            --ref \"\${BUILDCHAIN_GIT_REF}\" \\\n            --release-prerelease \"\${BUILDCHAIN_RELEASE_PRERELEASE}\" \\\n            --router-ref \"\${BUILDCHAIN_ROUTER_REF}\"\n\n      - name: Select consumer contract lock\n        id: lock\n        shell: bash\n        env:\n          EXPLICIT_PATH: \${{ inputs.buildchain-contract-lock-path }}\n          ALPHA_PATH: \${{ inputs.buildchain-alpha-contract-lock-path }}\n          STABLE_PATH: \${{ inputs.buildchain-stable-contract-lock-path }}\n          CHANNEL: \${{ steps.channel.outputs.channel }}\n        run: |\n          set -euo pipefail\n          path=\"\${EXPLICIT_PATH}\"\n          if [[ -z \"\${path}\" ]]; then\n            if [[ \"\${CHANNEL}\" = \"alpha\" ]]; then\n              path=\"\${ALPHA_PATH}\"\n            else\n              path=\"\${STABLE_PATH}\"\n            fi\n          fi\n          echo \"path=\${path}\" >> \"\${GITHUB_OUTPUT}\"\n\n  build:\n    name: Build with resolved channel\n    needs: resolve-channel\n    uses: ./.github/workflows/.build.yml\n    permissions:\n      contents: read\n      issues: write\n      id-token: write\n    with:\n${forwardedInputs(names)}\n    secrets: inherit\n`;
-}
-
-function splitBuildJobsByChannel(workflow, names, major) {
-  const marker = "\n  build:\n";
-  const index = workflow.indexOf(marker);
-  if (index < 0) throw new Error("generated workflow is missing the build job");
-  const inputs = forwardedInputs(names);
-  const jobs = `
-  override:
-    name: Build trusted runtime override
-    needs:
-      - resolve-channel
-      - controller-plan
-    if: \${{ needs.resolve-channel.outputs.runtime-override == 'true' }}
-    uses: ./.github/workflows/.build.yml
-    permissions:
-      actions: read
-      contents: read
-      issues: write
-      id-token: write
-    with:
+  const secrets = block(source, "    secrets:\n", "    outputs:\n");
+  const outputs = block(source, "    outputs:\n", "\npermissions:\n")
+    .replace(/(^      ([a-z0-9-]+):\n(?:        description:.*\n)*)        value:.*$/gmu, "$1        value: ${{ jobs.build.outputs.$2 }}");
+  return `# Generated by scripts/generate-channel-build-workflow.mjs. Do not edit directly.
+name: Buildchain Build
+
+on:
+  workflow_call:
+    inputs:
 ${inputs}
-    secrets: inherit
-
-  alpha:
-    name: Build alpha channel
-    needs:
-      - resolve-channel
-      - controller-plan
-    if: \${{ needs.resolve-channel.outputs.runtime-override != 'true' && needs.resolve-channel.outputs.channel == 'alpha' }}
-    uses: ./.github/workflows/.build.yml
-    permissions:
-      actions: read
-      contents: read
-      issues: write
-      id-token: write
-    with:
-${inputs}
-    secrets: inherit
-
-  stable:
-    name: Build stable channel
-    needs:
-      - resolve-channel
-      - controller-plan
-    if: \${{ needs.resolve-channel.outputs.runtime-override != 'true' && needs.resolve-channel.outputs.channel == 'stable' }}
+    secrets:
+${secrets}
+    outputs:
+      buildchain-channel:
+        description: "Channel bound to the called workflow ref"
+        value: \${{ jobs.build.outputs.buildchain-runtime-class }}
+      buildchain-channel-selection-source:
+        description: "Runtime identity authority"
+        value: "called-workflow"
+      buildchain-channel-reason:
+        description: "Buildchain runtime is the exact called workflow"
+        value: \${{ jobs.build.outputs.buildchain-runtime-ref }}
+${outputs}
+
+permissions:
+  actions: read
+  contents: read
+  issues: write
+  id-token: write
+
+jobs:
+  build:
+    name: Build configured project
     uses: ./.github/workflows/.build.yml
-    permissions:
-      actions: read
-      contents: read
-      issues: write
-      id-token: write
     with:
-${inputs}
+      config-path: \${{ inputs.config-path }}
     secrets: inherit
 `;
-  return `${workflow.slice(0, index)}${jobs}`;
-}
-
-function bindRouterCheckoutToWorkflowSha(workflow) {
-  return workflow
-    .replace(
-      "          BUILDCHAIN_ROUTER_WORKFLOW_REF: ${{ job.workflow_ref }}\n",
-      [
-        "          BUILDCHAIN_ROUTER_WORKFLOW_REF: ${{ job.workflow_ref }}",
-        "          BUILDCHAIN_ROUTER_WORKFLOW_REPOSITORY: ${{ job.workflow_repository }}",
-        "          BUILDCHAIN_ROUTER_WORKFLOW_SHA: ${{ job.workflow_sha }}",
-        "",
-      ].join("\n"),
-    )
-    .replace(
-      [
-        '          repository="${workflow_ref%%/.github/workflows/*}"',
-        '          ref="${workflow_ref##*@}"',
-        '          ref="${ref#refs/heads/}"',
-        '          ref="${ref#refs/tags/}"',
-        '          if [[ -z "${repository}" || "${repository}" = "${workflow_ref}" || -z "${ref}" ]]; then',
-        '            echo "Unable to resolve Buildchain router source from job.workflow_ref=${workflow_ref}" >&2',
-        "            exit 1",
-        "          fi",
-      ].join("\n"),
-      [
-        '          repository="${BUILDCHAIN_ROUTER_WORKFLOW_REPOSITORY}"',
-        '          ref="${workflow_ref##*@}"',
-        '          ref="${ref#refs/heads/}"',
-        '          ref="${ref#refs/tags/}"',
-        '          parsed_repository="${workflow_ref%%/.github/workflows/*}"',
-        '          if [[ -z "${repository}" || "${repository}" != "${parsed_repository}" || -z "${ref}" ]]; then',
-        '            echo "::error::Unable to resolve Buildchain router source from job.workflow_ref=${workflow_ref}"',
-        "            exit 1",
-        "          fi",
-        '          if [[ ! "${BUILDCHAIN_ROUTER_WORKFLOW_SHA}" =~ ^[0-9a-fA-F]{40}$ ]]; then',
-        '            echo "::error::job.workflow_sha is not an exact commit SHA"',
-        "            exit 1",
-        "          fi",
-      ].join("\n"),
-    )
-    .replace(
-      '            echo "ref=${ref}"\n',
-      '            echo "ref=${ref}"\n            echo "sha=${BUILDCHAIN_ROUTER_WORKFLOW_SHA,,}"\n',
-    )
-    .replace(
-      "          ref: ${{ steps.router.outputs.ref }}\n          path: .buildchain/router",
-      "          ref: ${{ steps.router.outputs.sha }}\n          path: .buildchain/router",
-    );
-}
-
-export function generateChannelBuildWorkflow(source) {
-  const inputBlock = blockBetween(source, "    inputs:\n", "    secrets:\n");
-  const names = inputNames(inputBlock);
-  const packageVersion = JSON.parse(fs.readFileSync(path.join(root, "package.json"), "utf8")).version || "";
-  const major = Number(String(packageVersion).split(".")[0]);
-  if (!Number.isInteger(major) || major < 1) throw new Error("package.json version must declare a positive major");
-  const generated = bindRouterCheckoutToWorkflowSha(
-    splitBuildJobsByChannel(generateChannelBuildWorkflowBase(source), names, major),
-  )
-    .replaceAll("runs-on: ubuntu-24.04", "runs-on: ${{ fromJSON(inputs.control-runner-json) }}")
-    .replace(
-      "      buildchain-ref: ${{ steps.channel.outputs.buildchain-ref }}\n",
-      "      buildchain-ref: ${{ steps.channel.outputs.buildchain-ref }}\n      major: ${{ steps.channel.outputs.major }}\n      runtime-override: ${{ steps.channel.outputs.runtime-override }}\n",
-    )
-    .replace(
-      "\npermissions:\n  contents: read\n",
-      "\npermissions:\n  actions: read\n  contents: read\n",
-    )
-    .replace(
-      "      contract-lock-path: ${{ steps.lock.outputs.path }}\n",
-      [
-        "      contract-lock-path: ${{ steps.lock.outputs.path }}",
-        "      router-repository: ${{ steps.router.outputs.repository }}",
-        "      router-ref: ${{ steps.router.outputs.ref }}",
-        "      router-sha: ${{ steps.router.outputs.sha }}",
-        "",
-      ].join("\n"),
-    )
-    .replace("\n  alpha:\n", `\n${routerControllerPlanJob()}\n\n  alpha:\n`);
-  return migrateUniversalWorkflowFacade(
-    `${generated.trimEnd()}\n\n${routerControllerReceiptJob()}\n\n${routerAggregateJob()}\n`,
-    ".github/workflows/build.yml",
-  );
 }
 
 function main() {
-  const source = fs.readFileSync(sourcePath, "utf8");
-  const generated = generateChannelBuildWorkflow(source);
+  const generated = generateChannelBuildWorkflow(fs.readFileSync(path.join(root, ".github/workflows/.build.yml"), "utf8"));
+  const target = ".github/workflows/build.yml";
   if (process.argv.includes("--check")) {
-    const current = fs.existsSync(targetPath) ? fs.readFileSync(targetPath, "utf8") : "";
-    if (current !== generated) {
-      console.error(".github/workflows/build.yml is stale; run node scripts/generate-channel-build-workflow.mjs");
-      process.exitCode = 1;
+    if (fs.readFileSync(path.join(root, target), "utf8") !== generated) {
+      throw new Error("build.yml is stale; run node scripts/generate-channel-build-workflow.mjs");
     }
-    return;
-  }
-  writeWorkflowSource(root, path.relative(root, targetPath), generated);
+  } else writeWorkflowSource(root, target, generated);
 }
-
-const isMain = process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url);
-if (isMain) main();
+if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) main();

package/scripts/generate-site-bundle.mjs

@@ -588,7 +588,7 @@ function actionCapabilityGroup(id) {
   if (id === "github-artifact-attestation") return capabilityGroup("release-passport-trust");
   if (id === "release-tail") return capabilityGroup("release-passport-trust");
   if (id === "promote-buildchain-ref") return capabilityGroup("release-passport-trust");
-  if (id === "run-lifecycle" || id === "validate-config") return capabilityGroup("reusable-build");
+  if (id.startsWith("build-") || id === "run-lifecycle" || id === "validate-config") return capabilityGroup("reusable-build");
   if (id === "report-buildchain-issue") return capabilityGroup("observability-diagnostics");
   return capabilityGroup("api-cli-reference");
 }
@@ -905,6 +905,7 @@ function buildSiteBundle() {
       ...publicSurfaceLifecycle({
         owner: "buildchain-actions",
         maturity: "stable",
+        introducedVersion: entry.id.startsWith("build-") ? "4.0.9-alpha.0" : undefined,
         nonDuplicationRationale: "Existing action identity retained as the canonical composite or JavaScript action boundary.",
       }),
     })),

package/scripts/generate-universal-workflow-facades.mjs

@@ -53,6 +53,7 @@ function activeFacadePaths() {
     (relative) =>
       relative !== contract.bootstrap.publicWorkflow &&
       relative !== contract.bootstrap.consumerRecoveryWorkflow &&
+      !contract.configurationGovernedWorkflows.includes(relative) &&
       !retired.has(relative),
   );
 }

package/scripts/init-repo.mjs

@@ -10,7 +10,7 @@ import {
   nextDevelopmentWorkflowHeader,
 } from "../packages/core/next-development-projection.js";
 
-const BUILDCHAIN_WORKFLOW_REF = "kungfu-systems/buildchain/.github/workflows/.build.yml@v4";
+const BUILDCHAIN_WORKFLOW_REF = "kungfu-systems/buildchain/.github/workflows/build.yml@v4";
 const DEFAULT_PUBLICATION_LATEX_IMAGE = "ghcr.io/kungfu-systems/build-images/latex-pdf-builder";
 const DEFAULT_PUBLICATION_LATEX_DIGEST = "sha256:c20f3809e96836c1c78e97c76939d12f1de3fed0ea9b7c40c43332ec2ea480f8";
 const DEFAULT_PUBLICATION_LATEX_COMMAND = "latexmk -pdf -outdir=_build paper/main.tex";
@@ -365,41 +365,27 @@ jobs:
 `;
 }
 
-function workflowYaml({ type, runnerPreset, artifactName }) {
-  return `${nextDevelopmentWorkflowHeader()}# Buildchain v4 lifecycle checkpoints are governed by architecture/platform-stage-checkpoints.json.
-# Do not add undeclared runner-only inputs, outputs, environment, or provider effects.
-# Commit both .buildchain/contract-lock.json and .buildchain/alpha-contract-lock.json.
-# Persist only @v4 or @v4-alpha; pass temporary train/SHA runtimes through workflow_dispatch.
+function workflowYaml() {
+  return `${nextDevelopmentWorkflowHeader()}# Project build settings live only in .buildchain/buildchain.toml.
+# Commit .buildchain/contract-lock.json and .buildchain/alpha-contract-lock.json.
+# The called ref selects the runtime; architecture/platform-stage-checkpoints.json owns checkpoint projections.
 name: Build
 
 on:
   workflow_dispatch:
-    inputs:
-      buildchain-ref:
-        description: "Temporary Buildchain runtime ref for trusted manual validation"
-        required: false
-        default: ""
   pull_request:
   push:
-    branches:
-      - "dev/**"
-      - "alpha/**"
-      - "release/**"
-      - "publish-gate/**"
+    branches: ["dev/**", "alpha/**", "release/**"]
 
 permissions:
+  actions: read
   contents: read
+  issues: write
+  id-token: write
 
 jobs:
   build:
     uses: ${BUILDCHAIN_WORKFLOW_REF}
-    with:
-      working-directory: "."
-      buildchain-ref: \${{ inputs.buildchain-ref || '' }}
-      runner-preset: "${runnerPreset}"
-      artifact-name-template: "${artifactName}"
-      artifact-paths: |
-        ${workflowArtifactPaths(type)}
 `;
 }
 
@@ -425,11 +411,11 @@ export function initBuildchainRepo({
   force = false,
   packageManager = "",
   runnerPreset = "github-hosted",
-  artifactName = "{repo}-{version}-{platform}",
+  artifactName = "",
 } = {}) {
   const resolvedCwd = path.resolve(cwd);
   const manager = detectOrDefaultPackageManager(resolvedCwd, packageManager);
-  const toml = appendNextDevelopmentToml((() => {
+  let toml = appendNextDevelopmentToml((() => {
     if (type === "package") {
       return packageToml(resolvedCwd, manager);
     }
@@ -451,6 +437,19 @@ export function initBuildchainRepo({
     throw new Error("init --type must be one of package, native, web-surface, infra-contract, publication-artifact, or anchored-package");
   })());
 
+
+  if (type !== "publication-artifact") {
+    const paths = workflowArtifactPaths(type).split("\n").map((entry) => entry.trim());
+    toml += `
+[build]
+environment = ${JSON.stringify(runnerPreset)}
+
+[build.artifacts]
+name = ${JSON.stringify(artifactName || repoName(resolvedCwd))}
+paths = ${JSON.stringify(paths)}
+`;
+  }
+
   const agentsPath = path.join(resolvedCwd, "AGENTS.md");
   const currentAgents = fs.existsSync(agentsPath)
     ? fs.readFileSync(agentsPath, "utf8")
@@ -509,7 +508,7 @@ if (!process.env.BUILDCHAIN_EMBEDDED_ENTRYPOINT && process.argv[1] && import.met
       force: process.argv.includes("--force"),
       packageManager: readArg("package-manager", ""),
       runnerPreset: readArg("runner-preset", "github-hosted"),
-      artifactName: readArg("artifact-name", "{repo}-{version}-{platform}"),
+      artifactName: readArg("artifact-name", ""),
     });
     process.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
   } catch (error) {