@kungfu-tech/buildchain 4.0.9 → 4.1.0-alpha.0

package/packages/core/release/promote-ref/internal/github-adapter.js

@@ -0,0 +1,312 @@
+import { sha256Content } from "../../version-state.js";
+
+function notFound(error) {
+  const status = error?.status || error?.response?.status;
+  const message = error?.response?.data?.message || error?.message || "";
+  return (
+    status === 404 ||
+    (status === 422 && /Reference does not exist/i.test(message))
+  );
+}
+
+function referenceAlreadyExists(error) {
+  const status = error?.status || error?.response?.status;
+  const message = error?.response?.data?.message || error?.message || "";
+  return status === 422 && /Reference already exists/i.test(message);
+}
+
+function nonFastForwardUpdateRejected(error) {
+  const status = error?.status || error?.response?.status;
+  const message = error?.response?.data?.message || error?.message || "";
+  return status === 422 && /Update is not a fast forward/i.test(message);
+}
+
+function decodeGitBlobBuffer(blob) {
+  const content = blob?.content || "";
+  return Buffer.from(
+    content.replace(/\n/g, ""),
+    blob?.encoding === "base64" ? "base64" : "utf8",
+  );
+}
+
+function decodeGitBlob(blob) {
+  return decodeGitBlobBuffer(blob).toString("utf8");
+}
+
+function transientGitHubReadError(error) {
+  const status = Number(error?.status || error?.response?.status || 0);
+  const code = String(error?.code || error?.cause?.code || "");
+  const message = String(error?.message || "");
+  return (
+    status >= 500 ||
+    [
+      "ECONNRESET",
+      "ETIMEDOUT",
+      "UND_ERR_SOCKET",
+      "UND_ERR_HEADERS_TIMEOUT",
+      "UND_ERR_BODY_TIMEOUT",
+    ].includes(code) ||
+    /other side closed|socket|timeout|temporarily unavailable/i.test(message)
+  );
+}
+
+function wait(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+function githubRetryDelayMs() {
+  const raw = process.env.BUILDCHAIN_GITHUB_RETRY_DELAY_MS;
+  if (raw === undefined || raw === "") {
+    return 1000;
+  }
+  const configured = Number(raw);
+  return Number.isFinite(configured) && configured >= 0 ? configured : 1000;
+}
+
+async function retryGitHubOperation(
+  label,
+  operation,
+  { attempts = 4, delayMs = githubRetryDelayMs() } = {},
+) {
+  let lastError;
+  for (let attempt = 1; attempt <= attempts; attempt += 1) {
+    try {
+      return await operation();
+    } catch (error) {
+      lastError = error;
+      if (attempt >= attempts || !transientGitHubReadError(error)) {
+        throw error;
+      }
+      console.warn(
+        `${label} failed with transient GitHub API error (${error.message}); retry ${attempt}/${attempts - 1}`,
+      );
+      await wait(delayMs * attempt);
+    }
+  }
+  throw lastError;
+}
+
+async function getGitRefOrUndefined({ octokit, owner, repo, ref }) {
+  try {
+    const { data } = await retryGitHubOperation(
+      `git.getRef ${ref}`,
+      () => octokit.rest.git.getRef({ owner, repo, ref }),
+    );
+    return data;
+  } catch (error) {
+    if (notFound(error)) {
+      return undefined;
+    }
+    throw error;
+  }
+}
+
+async function getGitCommitWithRetry({ octokit, owner, repo, commitSha }) {
+  return retryGitHubOperation(`git.getCommit ${commitSha}`, () =>
+    octokit.rest.git.getCommit({
+      owner,
+      repo,
+      commit_sha: commitSha,
+    }),
+  );
+}
+
+async function collectRemoteVersionMaterial({
+  octokit,
+  owner,
+  repo,
+  commitSha,
+  paths,
+}) {
+  const commit = await getGitCommitWithRetry({
+    octokit,
+    owner,
+    repo,
+    commitSha,
+  });
+  const tree = await retryGitHubOperation(
+    `git.getTree ${commitSha} recursive`,
+    () =>
+      octokit.rest.git.getTree({
+        owner,
+        repo,
+        tree_sha: commit.data.tree.sha,
+        recursive: "1",
+      }),
+  );
+  const entries = new Map(
+    (tree.data.tree || [])
+      .filter((entry) => entry.type === "blob")
+      .map((entry) => [entry.path, entry]),
+  );
+  return Promise.all(
+    paths.map(async (filePath) => {
+      const entry = entries.get(filePath);
+      if (!entry) {
+        return {
+          path: filePath,
+          present: false,
+          bytes: 0,
+          sha256: "",
+        };
+      }
+      const blob = await retryGitHubOperation(
+        `git.getBlob ${commitSha}:${filePath}`,
+        () =>
+          octokit.rest.git.getBlob({
+            owner,
+            repo,
+            file_sha: entry.sha,
+          }),
+      );
+      const content =
+        blob.data.encoding === "base64"
+          ? Buffer.from(
+              String(blob.data.content || "").replace(/\s/g, ""),
+              "base64",
+            )
+          : Buffer.from(String(blob.data.content || ""), "utf8");
+      return {
+        path: filePath,
+        present: true,
+        bytes: content.length,
+        sha256: sha256Content(content),
+      };
+    }),
+  );
+}
+
+async function remoteVersionStateFilesMatch({
+  octokit,
+  owner,
+  repo,
+  currentSha,
+  generatedSha,
+  paths,
+}) {
+  if (
+    !currentSha ||
+    !generatedSha ||
+    !paths?.length ||
+    typeof octokit.rest.git.getBlob !== "function"
+  ) {
+    return false;
+  }
+  let current;
+  let generated;
+  try {
+    [current, generated] = await Promise.all([
+      collectRemoteVersionMaterial({ octokit, owner, repo, commitSha: currentSha, paths }),
+      collectRemoteVersionMaterial({ octokit, owner, repo, commitSha: generatedSha, paths }),
+    ]);
+  } catch (error) {
+    if (
+      error?.status === 404 ||
+      error?.response?.status === 404 ||
+      error?.response?.data?.message === "Reference does not exist"
+    ) {
+      return false;
+    }
+    throw error;
+  }
+  return current.every((entry, index) => {
+    const expected = generated[index];
+    return (
+      entry.path === expected?.path &&
+      entry.present === true &&
+      expected.present === true &&
+      entry.bytes === expected.bytes &&
+      entry.sha256 === expected.sha256
+    );
+  });
+}
+
+async function collectPromotionVersionMaterial(
+  context,
+  releaseCommit,
+  releaseSha,
+  sourceAlphaMaterial,
+) {
+  if (
+    !(releaseCommit.derivedVersionMaterial?.length > 0) ||
+    !sourceAlphaMaterial?.sha
+  ) {
+    return undefined;
+  }
+  const allowedPaths = releaseCommit.releaseTreeAllowedPaths || releaseCommit.files;
+  const [alphaCommit, releaseCommitInfo, alphaMaterial, releaseMaterial] =
+    await Promise.all([
+      context.getCommitInfo(context.octokit, context.owner, context.repo, sourceAlphaMaterial.sha),
+      context.getCommitInfo(context.octokit, context.owner, context.repo, releaseSha),
+      collectRemoteVersionMaterial({
+        octokit: context.octokit,
+        owner: context.owner,
+        repo: context.repo,
+        commitSha: sourceAlphaMaterial.sha,
+        paths: allowedPaths,
+      }),
+      collectRemoteVersionMaterial({
+        octokit: context.octokit,
+        owner: context.owner,
+        repo: context.repo,
+        commitSha: releaseSha,
+        paths: allowedPaths,
+      }),
+    ]);
+  return {
+    schemaVersion: 1,
+    contract: "kungfu-buildchain-anchored-version-material/v1",
+    strategy: releaseCommit.versionStrategy,
+    alpha: {
+      ref: sourceAlphaMaterial.tag,
+      commit: sourceAlphaMaterial.sha,
+      tree: alphaCommit.treeSha,
+      material: alphaMaterial,
+    },
+    release: {
+      ref: context.targetRef,
+      commit: releaseSha,
+      tree: releaseCommitInfo.treeSha,
+      material: releaseMaterial,
+    },
+    allowedPaths,
+    versionFiles: releaseCommit.files,
+    manifest: releaseCommit.anchorManifest?.path || "",
+    derivedPaths: releaseCommit.derivedVersionMaterial.map((file) => file.path),
+    derivedFiles: releaseCommit.derivedVersionMaterial,
+  };
+}
+
+async function listPullRequestsAssociatedWithCommitWithRetry({
+  octokit,
+  owner,
+  repo,
+  commitSha,
+}) {
+  return retryGitHubOperation(
+    `repos.listPullRequestsAssociatedWithCommit ${commitSha}`,
+    () =>
+      octokit.rest.repos.listPullRequestsAssociatedWithCommit({
+        owner,
+        repo,
+        commit_sha: commitSha,
+      }),
+  );
+}
+
+export {
+  collectPromotionVersionMaterial,
+  collectRemoteVersionMaterial,
+  remoteVersionStateFilesMatch,
+  decodeGitBlob,
+  decodeGitBlobBuffer,
+  getGitCommitWithRetry,
+  getGitRefOrUndefined,
+  githubRetryDelayMs,
+  listPullRequestsAssociatedWithCommitWithRetry,
+  nonFastForwardUpdateRejected,
+  notFound,
+  referenceAlreadyExists,
+  retryGitHubOperation,
+  wait,
+};

package/packages/core/release/promote-ref/internal/npm-distribution.js

@@ -0,0 +1,185 @@
+import path from "node:path";
+import fs from "node:fs";
+import { readJsonFileIfExists, writeJsonFile } from "./passport-files.js";
+import { spawnSyncCommand } from "../../../runtime/spawn-command.js";
+import { npmPackageSpec } from "./publish-contract.js";
+export function resolveMaybeRelative(cwd, filePath) {
+  return path.isAbsolute(filePath) ? filePath : path.resolve(cwd, filePath);
+}
+export function existingFiles(paths = [], cwd = process.cwd()) {
+  return paths
+    .map((filePath) => resolveMaybeRelative(cwd, filePath))
+    .filter((filePath) => fs.existsSync(filePath));
+}
+export function platformManifestPathsFromBuildSummary(
+  buildSummaryPath,
+  cwd = process.cwd(),
+) {
+  const summary = readJsonFileIfExists(buildSummaryPath);
+  if (!summary) {
+    return [];
+  }
+  return (Array.isArray(summary.platforms) ? summary.platforms : [])
+    .map((platform) => platform.manifestPath)
+    .filter(Boolean)
+    .map((manifestPath) => resolveMaybeRelative(cwd, manifestPath))
+    .filter((manifestPath) => fs.existsSync(manifestPath));
+}
+export function packageSetFromArtifacts({
+  artifacts = [],
+  contract = {},
+  registry = "https://registry.npmjs.org/",
+} = {}) {
+  if (
+    !artifacts.length ||
+    contract.packageSetOrder !== "platforms-first-main-last"
+  ) {
+    return undefined;
+  }
+  const normalized = artifacts.map((artifact) => ({
+    name: artifact.name,
+    version: artifact.ref || artifact.version || "",
+    distTag: contract.distTag || "",
+    digest: artifact.digest || "",
+    registry,
+    platform: artifact.platform || "",
+    action: artifact.action || "",
+  }));
+  const mainPackage = contract.mainPackage || "";
+  const mainIndex = normalized.findIndex(
+    (artifact) => artifact.name === mainPackage,
+  );
+  if (mainIndex < 0) {
+    return undefined;
+  }
+  const [main] = normalized.splice(mainIndex, 1);
+  return {
+    order: contract.packageSetOrder || "",
+    registry,
+    main,
+    platforms: normalized,
+  };
+}
+export function writeDistTagPromotionEvidence({
+  evidencePath,
+  mode,
+  auth,
+  distTag,
+  source,
+  artifacts = [],
+}) {
+  const outputPath = path.join(
+    path.dirname(evidencePath),
+    "dist-tag-evidence.json",
+  );
+  return writeJsonFile(outputPath, {
+    schema: 1,
+    contract: "kungfu-buildchain-dist-tag-promotion-evidence",
+    mode,
+    auth,
+    distTag,
+    source,
+    packages: artifacts.map((artifact) => ({
+      name: artifact.name,
+      version: artifact.ref || artifact.version || "",
+      distTag,
+      role: artifact.role || "",
+      digest: artifact.digest || "",
+    })),
+  });
+}
+export function findTransactionEvidencePath({
+  cwd,
+  transaction,
+  fallbackName,
+}) {
+  for (const entry of transaction?.evidence || []) {
+    const normalized = String(entry || "");
+    if (normalized.endsWith(fallbackName)) {
+      return path.resolve(cwd, normalized);
+    }
+  }
+  return "";
+}
+export function npmTokenLooksConfigured() {
+  return Boolean(
+    process.env.NODE_AUTH_TOKEN ||
+    process.env.NPM_TOKEN ||
+    process.env.npm_config__authToken,
+  );
+}
+export function execNpmSync(args, options) {
+  const result = spawnSyncCommand("npm", args, options);
+  if (result.error) throw result.error;
+  if (result.status !== 0 || result.signal) {
+    const error = new Error(`npm exited with status ${result.status ?? ""}`);
+    error.status = result.status ?? 1;
+    error.signal = result.signal || "";
+    error.stdout = result.stdout;
+    error.stderr = result.stderr;
+    throw error;
+  }
+  return result.stdout;
+}
+export function preflightNpmTokenAuth({
+  cwd,
+  registry = "https://registry.npmjs.org/",
+} = {}) {
+  if (!npmTokenLooksConfigured()) {
+    throw new Error(
+      "promote-existing-version requires npm token auth before dist-tag promotion; set NODE_AUTH_TOKEN or NPM_TOKEN",
+    );
+  }
+  try {
+    execNpmSync(["whoami", `--registry=${registry}`], {
+      cwd,
+      env: process.env,
+      stdio: ["ignore", "pipe", "pipe"],
+    });
+  } catch (error) {
+    const message = error.stderr?.toString?.().trim() || error.message;
+    throw new Error(
+      `promote-existing-version npm token preflight failed: npm whoami failed: ${message}`,
+    );
+  }
+}
+export function npmDistTagAlreadyPoints({ cwd, artifact, distTag }) {
+  try {
+    const output = execNpmSync(
+      ["view", artifact.name, `dist-tags.${distTag}`, "--json"],
+      {
+        cwd,
+        env: process.env,
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "pipe"],
+      },
+    ).trim();
+    if (!output) {
+      return false;
+    }
+    return JSON.parse(output) === artifact.ref;
+  } catch {
+    return false;
+  }
+}
+export function promoteExistingNpmArtifacts({ cwd, artifacts, distTag }) {
+  const promoted = new Set();
+  for (const artifact of artifacts) {
+    const spec = npmPackageSpec(artifact);
+    const key = `${spec}\0${distTag}`;
+    if (promoted.has(key)) {
+      continue;
+    }
+    if (npmDistTagAlreadyPoints({ cwd, artifact, distTag })) {
+      promoted.add(key);
+      continue;
+    }
+    execNpmSync(["dist-tag", "add", spec, distTag], {
+      cwd,
+      env: process.env,
+      stdio: "inherit",
+    });
+    promoted.add(key);
+  }
+  return "existing-npm-artifacts";
+}

package/packages/core/release/promote-ref/internal/npm-existing-evidence.js

@@ -0,0 +1,61 @@
+import { npmPackageSpec } from "./publish-contract.js";
+import { execNpmSync } from "./npm-distribution.js";
+import fs from "node:fs";
+import path from "node:path";
+export function readExistingNpmIntegrity({ cwd, artifact }) {
+  const spec = npmPackageSpec(artifact);
+  try {
+    const output = execNpmSync(["view", spec, "dist.integrity", "--json"], {
+      cwd,
+      env: process.env,
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "pipe"],
+    }).trim();
+    if (!output) {
+      throw new Error("empty dist.integrity");
+    }
+    return JSON.parse(output);
+  } catch (error) {
+    const message = error.stderr?.toString?.().trim() || error.message;
+    throw new Error(
+      `existing npm artifact is required for release promotion: ${spec}: ${message}`,
+    );
+  }
+}
+export function resolveExistingNpmArtifacts({ cwd, requiredArtifacts }) {
+  return requiredArtifacts.map((artifact) => ({
+    ...artifact,
+    digest: readExistingNpmIntegrity({ cwd, artifact }),
+  }));
+}
+export function writeExistingNpmEvidence({
+  evidencePath,
+  version,
+  channel,
+  sourceSha,
+  releaseSha,
+  targetRef,
+  releaseMaterialSha,
+  publishToolingSha,
+  artifacts,
+}) {
+  fs.mkdirSync(path.dirname(evidencePath), { recursive: true });
+  fs.writeFileSync(
+    evidencePath,
+    `${JSON.stringify(
+      {
+        schema: 1,
+        version,
+        channel,
+        source_sha: sourceSha,
+        release_sha: releaseSha,
+        target_ref: targetRef,
+        release_material_sha: releaseMaterialSha,
+        publish_tooling_sha: publishToolingSha,
+        artifacts,
+      },
+      null,
+      2,
+    )}\n`,
+  );
+}

package/packages/core/release/promote-ref/internal/passport-files.js

@@ -0,0 +1,116 @@
+import fs from "node:fs";
+import path from "node:path";
+import { verifyReleasePassport } from "../../release-passport.js";
+export function writeJsonFile(filePath, value) {
+  fs.mkdirSync(path.dirname(filePath), { recursive: true });
+  fs.writeFileSync(filePath, `${JSON.stringify(value, null, 2)}\n`);
+  return filePath;
+}
+export function toRepoRelative(cwd, filePath) {
+  return path.relative(cwd, filePath).split(path.sep).join("/");
+}
+export function readJsonFileIfExists(filePath) {
+  if (!filePath || !fs.existsSync(filePath)) {
+    return undefined;
+  }
+  try {
+    return JSON.parse(fs.readFileSync(filePath, "utf8"));
+  } catch {
+    return undefined;
+  }
+}
+export function existingJsonObjectFile(filePath) {
+  const content = readJsonFileIfExists(filePath);
+  return content && typeof content === "object" && !Array.isArray(content)
+    ? filePath
+    : "";
+}
+export function releasePassportArtifactFiles(outputDir) {
+  if (!outputDir || !fs.existsSync(outputDir)) {
+    return [];
+  }
+  const durableTextExtensions = new Set([
+    ".json",
+    ".jsonl",
+    ".md",
+    ".sha256",
+    ".txt",
+    ".yaml",
+    ".yml",
+  ]);
+  return fs
+    .readdirSync(outputDir, { withFileTypes: true })
+    .filter(
+      (entry) =>
+        entry.isFile() &&
+        (entry.name === "SHA256SUMS" ||
+          durableTextExtensions.has(path.extname(entry.name).toLowerCase())),
+    )
+    .map((entry) => {
+      const filePath = path.join(outputDir, entry.name);
+      return {
+        path: `release-passport/${entry.name}`,
+        content: fs.readFileSync(filePath, "utf8"),
+      };
+    })
+    .sort((left, right) => left.path.localeCompare(right.path));
+}
+export function backfillReleasePassportStateSha(outputDir, releaseStateSha) {
+  if (!outputDir || !releaseStateSha) {
+    return undefined;
+  }
+  const passportPath = path.join(outputDir, "buildchain.release.json");
+  const passport = readJsonFileIfExists(passportPath);
+  if (!passport || typeof passport !== "object" || Array.isArray(passport)) {
+    return undefined;
+  }
+  passport.release =
+    passport.release &&
+    typeof passport.release === "object" &&
+    !Array.isArray(passport.release)
+      ? passport.release
+      : {};
+  passport.release.releaseStateSha = releaseStateSha;
+  writeJsonFile(passportPath, passport);
+  return passportPath;
+}
+export function summarizeReleasePassportIssues(report) {
+  return (Array.isArray(report?.issues) ? report.issues : [])
+    .filter((entry) => entry?.level === "error")
+    .map((entry) => {
+      const code = entry?.code || "unknown";
+      const message = entry?.message || "release passport verification error";
+      return `${code}: ${message}`;
+    })
+    .join("; ");
+}
+export async function verifyCollectedReleasePassport({
+  collected,
+  cwd,
+  phase = "generated",
+}) {
+  const passportPath = path.join(
+    collected.outputDir,
+    "buildchain.release.json",
+  );
+  const relativePassportPath = path
+    .relative(cwd, passportPath)
+    .split(path.sep)
+    .join("/");
+  if (collected.checkReport?.ok !== true) {
+    const issues = summarizeReleasePassportIssues(collected.checkReport);
+    throw new Error(
+      `Release passport ${phase} check failed for ${relativePassportPath}${issues ? `: ${issues}` : ""}`,
+    );
+  }
+  const report = await verifyReleasePassport({
+    passportLocation: passportPath,
+  });
+  if (report.ok !== true) {
+    const issues = summarizeReleasePassportIssues(report);
+    throw new Error(
+      `Release passport ${phase} verification failed for ${relativePassportPath}${issues ? `: ${issues}` : ""}`,
+    );
+  }
+  return report;
+}