@kungfu-tech/buildchain 4.0.9 → 4.1.0-alpha.0

package/packages/core/publication/candidate/package.js

@@ -0,0 +1,50 @@
+import fs from "node:fs";
+import path from "node:path";
+import { command } from "../../runtime/action-process.mjs";
+import { packNpmArtifact } from "../npm/package.js";
+import { sealPackageCandidate } from "./package-binding.js";
+export function packageCandidateArtifact({
+  sourceRoot,
+  passportPath,
+  outputRoot,
+  environment,
+}) {
+  const passport = JSON.parse(fs.readFileSync(passportPath, "utf8"));
+  const tree = command("git", ["show", "-s", "--format=%T", "HEAD"], {
+    cwd: sourceRoot,
+    env: environment,
+    stdio: ["ignore", "pipe", "inherit"],
+  }).trim();
+  if (tree !== passport.source.treeHash)
+    throw new Error(
+      "Source tree must match the candidate Passport before packing",
+    );
+  const outputDir = path.join(outputRoot, "payload");
+  const packed = packNpmArtifact({
+    cwd: sourceRoot,
+    env: environment,
+    outputDirectory: outputDir,
+    ignoreScripts: true,
+  });
+  fs.writeFileSync(path.join(outputRoot, "npm-pack.json"), packed.rawResult);
+  return sealPackageCandidate({ passport, tree, outputDir });
+}
+export function packageCandidateArtifactAction(core, env) {
+  const sourceRoot = path.resolve(env.GITHUB_WORKSPACE);
+  const outputRoot = path.join(
+    sourceRoot,
+    ".buildchain/buildchain-package-candidate",
+  );
+  const manifest = packageCandidateArtifact({
+    sourceRoot,
+    passportPath: path.join(
+      outputRoot,
+      "passport/release-candidate-passport.json",
+    ),
+    outputRoot,
+    environment: Object.fromEntries(
+      Object.entries(env).filter(([key]) => !key.startsWith("INPUT_")),
+    ),
+  });
+  core.setOutput("artifact-name", manifest.artifactName);
+}

package/packages/core/publication/candidate/paper-package.js

@@ -0,0 +1,120 @@
+import fs from "node:fs";
+import path from "node:path";
+import { runNpm } from "../npm/registry.js";
+
+export async function bindQualifiedPackage(
+  {
+    cwd,
+    packageName = "",
+    targetRef = "",
+    publishDistTag = "",
+    repository,
+    sourceSha,
+    env,
+  },
+  execute = runNpm,
+) {
+  fs.mkdirSync(path.join(cwd, ".buildchain/paper-release"), {
+    recursive: true,
+  });
+
+  const receipt = JSON.parse(
+    fs.readFileSync(
+      path.join(cwd, ".buildchain/publication/reproducibility-receipt.json"),
+      "utf8",
+    ),
+  );
+  if (receipt.status !== "passed" || receipt.qualifying !== true) {
+    throw new Error(
+      `publication reproducibility receipt is not qualifying: ${receipt.status}`,
+    );
+  }
+  const qualified = receipt.builds?.[0];
+  const packageDir = path.resolve(cwd, ".buildchain/publication/npm-package");
+  const packageJson = JSON.parse(
+    fs.readFileSync(path.join(packageDir, "package.json"), "utf8"),
+  );
+  if (packageName && packageName !== packageJson.name) {
+    throw new Error(
+      `qualified package name mismatch: expected ${packageName}, got ${packageJson.name}`,
+    );
+  }
+  const pack = execute({
+    cwd: packageDir,
+    env,
+    args: [
+      "pack",
+      "--dry-run",
+      "--json",
+      "--registry=https://registry.npmjs.org/",
+    ],
+  });
+  if (pack.error || pack.status !== 0) {
+    const error = new Error("npm pack --dry-run failed");
+    error.status = pack.status || 1;
+    throw error;
+  }
+  const packResult = JSON.parse(pack.stdout);
+  if (!Array.isArray(packResult) || packResult.length !== 1)
+    throw new Error("npm pack must report exactly one qualified package");
+  const first = packResult[0];
+  if (!first?.integrity)
+    throw new Error("npm pack --dry-run did not report sha512 integrity");
+  if (first.integrity !== qualified?.npmPackage?.integrity) {
+    throw new Error(
+      `qualified npm integrity changed: ${qualified?.npmPackage?.integrity || "(missing)"} != ${first.integrity}`,
+    );
+  }
+  const channel = targetRef.startsWith("release/") ? "release" : "alpha";
+  const distTag =
+    publishDistTag || (channel === "release" ? "latest" : "alpha");
+  const requiredArtifacts = [
+    {
+      group: "node",
+      kind: "npm",
+      name: packageJson.name,
+      ref: packageJson.version,
+      digest: first.integrity,
+      integrity: first.integrity,
+      role: "main",
+    },
+  ];
+  fs.writeFileSync(
+    path.join(cwd, ".buildchain/paper-release/publish-required-artifacts.json"),
+    `${JSON.stringify(requiredArtifacts, null, 2)}\n`,
+  );
+  fs.writeFileSync(
+    path.join(cwd, ".buildchain/paper-release/build-summary.json"),
+    `${JSON.stringify(
+      {
+        schemaVersion: 1,
+        contract: "kungfu-buildchain-paper-release-build-summary",
+        repository: repository,
+        sourceSha: sourceSha,
+        package: { name: packageJson.name, version: packageJson.version },
+        reproducibility: {
+          receiptPath: ".buildchain/publication/reproducibility-receipt.json",
+          receiptDigest: receipt.receiptDigest,
+          npmIntegrity: qualified.npmPackage.integrity,
+          npmSha256: qualified.npmPackage.sha256,
+        },
+        publication: {
+          manifestPath: qualified.publication.manifestPath,
+          passportPath: qualified.publication.passportPath,
+          registryPath: qualified.publication.registryPath || "",
+          primaryArtifact: qualified.artifacts?.[0]?.path || "",
+        },
+        platforms: [
+          { id: "paper", manifestPath: qualified.publication.manifestPath },
+        ],
+      },
+      null,
+      2,
+    )}\n`,
+  );
+  return {
+    "package-name": packageJson.name,
+    "package-version": packageJson.version,
+    "dist-tag": distTag,
+  };
+}

package/packages/core/publication/candidate/passport.js

@@ -0,0 +1,36 @@
+import fs from "node:fs";
+import path from "node:path";
+import {
+  createReleaseCandidatePassport,
+  validateReleaseCandidatePassport,
+} from "../../release/release-candidate.js";
+import { writeReleaseCandidateStageCapsules } from "./stage-capsules.js";
+
+export function writeReleaseCandidatePassport({
+  request,
+  outputPath,
+  coordinatesPath,
+  workspace,
+}) {
+  const passport = createReleaseCandidatePassport(request);
+  const validation = validateReleaseCandidatePassport({
+    passport,
+    repository: request.repository,
+    sourceHeadSha: request.sourceHeadSha,
+    buildSummary: request.buildSummary,
+  });
+  if (!validation.ok)
+    throw new Error(
+      `release candidate passport invalid: ${validation.errors.join("; ")}`,
+    );
+  fs.mkdirSync(path.dirname(outputPath), { recursive: true });
+  fs.writeFileSync(outputPath, `${JSON.stringify(passport, null, 2)}\n`);
+  const stageCapsules = writeReleaseCandidateStageCapsules({
+    passport,
+    buildSummary: request.buildSummary,
+    outputPath,
+    coordinatesPath,
+    workspace,
+  });
+  return { passport, stageCapsules };
+}

package/packages/core/publication/candidate/qualification-action.js

@@ -0,0 +1,41 @@
+import path from "node:path";
+import { installationRoot } from "../../runtime/installation-root.js";
+import { verifyCheckoutIdentity } from "../../runtime/checkout-identity.js";
+import { qualifyPublicationCandidate } from "./qualification.js";
+export async function qualifyPublicationCandidateAction(core, env) {
+  const input = JSON.parse(core.getInput("request-json", { required: true }));
+  const workspace = path.resolve(env.GITHUB_WORKSPACE),
+    cwd = path.resolve(workspace, input["working-directory"] || ".");
+  if (path.relative(workspace, cwd).split(path.sep).includes(".."))
+    throw new Error(
+      "Publication working directory escapes its admitted source",
+    );
+  verifyCheckoutIdentity({
+    directory: installationRoot(import.meta.url),
+    sha: core.getInput("runtime-sha", { required: true }),
+    label: "Publication runtime",
+  });
+  const request = {
+    cwd,
+    env,
+    sourceSha: env.GITHUB_SHA,
+    repository: env.GITHUB_REPOSITORY,
+    preparePaperPackage: input["prepare-paper-package"] === true,
+    packageName: input["package-name"],
+    publishDistTag: input["publish-dist-tag"],
+    targetRef: input["target-ref"] || env.GITHUB_REF_NAME,
+    toolchainType: input["toolchain-type"],
+    toolchainImage: input["toolchain-image"],
+    toolchainDigest: input["toolchain-digest"],
+    toolchainCommand: input["toolchain-command"],
+    buildCommand: input["build-command"],
+    verifyCommand: input["verify-command"],
+  };
+  return qualifyPublicationCandidate(request, {
+    observe: ({ outcomes, manifest, package: pkg }) => {
+      core.setOutput("outcomes-json", JSON.stringify(outcomes));
+      for (const [key, value] of Object.entries({ ...manifest, ...pkg }))
+        core.setOutput(key, value);
+    },
+  });
+}

package/packages/core/publication/candidate/qualification.js

@@ -0,0 +1,56 @@
+import { resolvePublicationToolchain } from "./toolchain.js";
+import { hydratePublishedPublicationRegistry } from "./registry-hydration.js";
+import { provePublicationReproducibility } from "./reproducibility.js";
+import { readQualifiedManifest } from "./manifest.js";
+import { bindQualifiedPackage } from "./paper-package.js";
+import { consumerCommandSession } from "../../runtime/consumer-shell.js";
+export async function qualifyPublicationCandidate(
+  request,
+  {
+    resolve = resolvePublicationToolchain,
+    hydrate = hydratePublishedPublicationRegistry,
+    prove = provePublicationReproducibility,
+    manifest = readQualifiedManifest,
+    bind = bindQualifiedPackage,
+    session = consumerCommandSession(request.env),
+    observe = () => {},
+  } = {},
+) {
+  const outcomes = {
+    build: "skipped",
+    verify: "skipped",
+    manifest: "skipped",
+    package: "skipped",
+  };
+  let manifestResult = {},
+    packageResult = {};
+  try {
+    const toolchain = await resolve(request);
+    if (request.preparePaperPackage) await hydrate({ cwd: request.cwd });
+    if (toolchain.command) {
+      outcomes.build = "failure";
+      await prove({ ...request, toolchain });
+      outcomes.build = "success";
+    }
+    if (request.verifyCommand) {
+      outcomes.verify = "failure";
+      await session.run({
+        cwd: request.cwd,
+        script: request.verifyCommand,
+        strict: true,
+      });
+      outcomes.verify = "success";
+    }
+    outcomes.manifest = "failure";
+    manifestResult = await manifest(request);
+    outcomes.manifest = "success";
+    if (request.preparePaperPackage) {
+      outcomes.package = "failure";
+      packageResult = await bind({ ...request, env: session.environment });
+      outcomes.package = "success";
+    }
+    return { outcomes, manifest: manifestResult, package: packageResult };
+  } finally {
+    observe({ outcomes, manifest: manifestResult, package: packageResult });
+  }
+}

package/packages/core/publication/candidate/registry-hydration.js

@@ -0,0 +1,204 @@
+import { execFileSync } from "node:child_process";
+import fs from "node:fs";
+import path from "node:path";
+import { loadBuildchainConfig } from "../../consumer/buildchain-config.js";
+
+const DEFAULT_REGISTRY = "https://registry.npmjs.org/";
+
+function semverParts(value) {
+  const match = String(value || "")
+    .trim()
+    .match(/^(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?$/);
+  if (!match) return undefined;
+  return {
+    core: match.slice(1, 4).map(Number),
+    prerelease: match[4] ? match[4].split(".") : [],
+  };
+}
+
+export function compareSemver(left, right) {
+  const a = semverParts(left);
+  const b = semverParts(right);
+  if (!a || !b) throw new Error(`invalid semver comparison: ${left}, ${right}`);
+  for (let index = 0; index < 3; index += 1) {
+    if (a.core[index] !== b.core[index]) return a.core[index] - b.core[index];
+  }
+  if (a.prerelease.length === 0 || b.prerelease.length === 0) {
+    return a.prerelease.length === b.prerelease.length
+      ? 0
+      : a.prerelease.length === 0
+        ? 1
+        : -1;
+  }
+  const length = Math.max(a.prerelease.length, b.prerelease.length);
+  for (let index = 0; index < length; index += 1) {
+    const av = a.prerelease[index];
+    const bv = b.prerelease[index];
+    if (av === undefined || bv === undefined) return av === undefined ? -1 : 1;
+    if (av === bv) continue;
+    const an = /^\d+$/.test(av);
+    const bn = /^\d+$/.test(bv);
+    if (an && bn) return Number(av) - Number(bv);
+    if (an !== bn) return an ? -1 : 1;
+    return av.localeCompare(bv);
+  }
+  return 0;
+}
+
+function run(command, args, options = {}) {
+  return execFileSync(command, args, {
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "pipe"],
+    ...options,
+  }).trim();
+}
+
+function packageVersions(packageName, registry, commandRunner) {
+  try {
+    const output = commandRunner("npm", [
+      "view",
+      packageName,
+      "versions",
+      "--json",
+      `--registry=${registry}`,
+    ]);
+    const parsed = JSON.parse(output || "[]");
+    return Array.isArray(parsed) ? parsed : parsed ? [parsed] : [];
+  } catch (error) {
+    const detail = [error?.message, error?.stderr, error?.stdout]
+      .filter(Boolean)
+      .join("\n");
+    if (/E404|404 Not Found|is not in this registry/i.test(detail)) {
+      return [];
+    }
+    throw error;
+  }
+}
+
+export function hydratePublishedPublicationRegistry({
+  cwd = process.cwd(),
+  outputDir = ".buildchain/publication/registry-inputs",
+  evidencePath = ".buildchain/publication/registry-hydration.json",
+  registry = DEFAULT_REGISTRY,
+  commandRunner = run,
+} = {}) {
+  const resolvedCwd = path.resolve(cwd);
+  const config = loadBuildchainConfig(resolvedCwd).config;
+  const packageName =
+    config.publish?.package || config.publish?.mainPackage || "";
+  const currentVersion = config.publication?.version || "";
+  const registryPath = config.publication?.archive?.registryPath || "";
+  const resolvedOutputDir = path.resolve(resolvedCwd, outputDir);
+  fs.rmSync(resolvedOutputDir, { recursive: true, force: true });
+  fs.mkdirSync(resolvedOutputDir, { recursive: true });
+  if (!packageName || !currentVersion || !registryPath) {
+    return {
+      status: "not-configured",
+      packageName,
+      currentVersion,
+      inputDir: path
+        .relative(resolvedCwd, resolvedOutputDir)
+        .split(path.sep)
+        .join("/"),
+      sources: [],
+    };
+  }
+  const publishedVersions = packageVersions(
+    packageName,
+    registry,
+    commandRunner,
+  )
+    .filter(
+      (version) =>
+        semverParts(version) && compareSemver(version, currentVersion) < 0,
+    )
+    .sort(compareSemver);
+  const sources = [];
+  for (const version of publishedVersions) {
+    const packageDir = path.join(resolvedOutputDir, `.package-${version}`);
+    fs.mkdirSync(packageDir, { recursive: true });
+    const packed = JSON.parse(
+      commandRunner(
+        "npm",
+        [
+          "pack",
+          `${packageName}@${version}`,
+          "--json",
+          "--ignore-scripts",
+          "--pack-destination",
+          packageDir,
+          `--registry=${registry}`,
+        ],
+        { cwd: resolvedCwd },
+      ),
+    );
+    const pack = Array.isArray(packed) ? packed[0] : packed;
+    if (!pack?.filename || !pack?.integrity) {
+      throw new Error(
+        `npm pack did not report filename and integrity for ${packageName}@${version}`,
+      );
+    }
+    const tarball = path.resolve(packageDir, pack.filename);
+    const archiveRegistryPath = `package/${registryPath}`;
+    const archiveEntries = commandRunner("tar", ["-tzf", tarball]).split(
+      /\r?\n/,
+    );
+    if (!archiveEntries.includes(archiveRegistryPath)) {
+      sources.push({
+        package: packageName,
+        version,
+        integrity: pack.integrity,
+        status: "registry-not-present",
+      });
+      continue;
+    }
+    const target = path.join(resolvedOutputDir, `${version}.json`);
+    const registryJson = commandRunner("tar", [
+      "-xOzf",
+      tarball,
+      archiveRegistryPath,
+    ]);
+    fs.writeFileSync(target, `${registryJson}\n`);
+    sources.push({
+      package: packageName,
+      version,
+      integrity: pack.integrity,
+      status: "accepted-input",
+      registryPath: path
+        .relative(resolvedCwd, target)
+        .split(path.sep)
+        .join("/"),
+    });
+  }
+  for (const entry of fs.readdirSync(resolvedOutputDir)) {
+    if (entry.startsWith(".package-")) {
+      fs.rmSync(path.join(resolvedOutputDir, entry), {
+        recursive: true,
+        force: true,
+      });
+    }
+  }
+  const evidence = {
+    schemaVersion: 1,
+    contract: "kungfu-buildchain-publication-registry-hydration",
+    status: sources.some((source) => source.status === "accepted-input")
+      ? "hydrated"
+      : "bootstrap",
+    authentication: "npm-registry-https-plus-package-integrity",
+    registry,
+    packageName,
+    currentVersion,
+    inputDir: path
+      .relative(resolvedCwd, resolvedOutputDir)
+      .split(path.sep)
+      .join("/"),
+    sources,
+  };
+  const resolvedEvidencePath = path.resolve(resolvedCwd, evidencePath);
+  fs.mkdirSync(path.dirname(resolvedEvidencePath), { recursive: true });
+  fs.writeFileSync(
+    resolvedEvidencePath,
+    `${JSON.stringify(evidence, null, 2)}\n`,
+  );
+  return evidence;
+}

package/packages/core/publication/candidate/reproducibility.js

@@ -0,0 +1,29 @@
+import fs from "node:fs";
+import path from "node:path";
+import { requireValue } from "../../runtime/action-process.mjs";
+import { verifyPublicationReproducibility } from "../publication-reproducibility.js";
+export function provePublicationReproducibility(
+  { cwd, sourceSha, preparePaperPackage, packageName = "", toolchain },
+  verify = verifyPublicationReproducibility,
+) {
+  const qualifying = preparePaperPackage;
+  const result = verify({
+    cwd,
+    toolchain,
+    sourceSha: sourceSha,
+    output: ".buildchain/publication/reproducibility-receipt.json",
+    promote: true,
+    packageName: packageName,
+    allowUnpinnedToolchain: !qualifying,
+  });
+  fs.mkdirSync(path.join(cwd, ".buildchain"), { recursive: true });
+  fs.writeFileSync(
+    path.join(cwd, ".buildchain/publication-reproducibility-result.json"),
+    JSON.stringify(result, null, 2) + "\n",
+  );
+  requireValue(
+    result.status === "passed" && (!qualifying || result.qualifying === true),
+    "Publication reproducibility did not produce qualifying evidence",
+  );
+  return result;
+}