@kungfu-tech/buildchain 4.0.9 → 4.1.0-alpha.0

package/scripts/check-release-topology.mjs

@@ -1,17 +1,18 @@
 #!/usr/bin/env node
 
 import assert from "node:assert/strict";
+import { inspectWorkflowJob, readWorkflow } from "./workflow-action-graph.mjs";
 import crypto from "node:crypto";
 import fs from "node:fs";
 import ts from "typescript";
-import { workflowCompatibilityIdentity } from "./workflow-taxonomy.mjs";
+
 import path from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 
 import {
   parseWorkflowDocument,
   parseYamlUses,
-} from "../packages/core/workflow-yaml-contract.js";
+} from "../packages/core/contracts/workflow-yaml-contract.js";
 
 const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 const ledgerPath = path.join(root, "architecture/release-topology.json");
@@ -22,11 +23,11 @@ function read(relative) {
 
 const LOCAL_MODULE_EXTENSIONS = ["", ".js", ".mjs", ".cjs"];
 const PRIVILEGED_ENTRYPOINTS = [
-  "actions/release-candidate-promote/index.js",
-  "scripts/binary-publication-evidence.mjs",
-  "scripts/next-development-review.mjs",
-  "scripts/oci-compose-preview.mjs",
-  "scripts/publication-settlement.mjs",
+  "packages/core/release/promote-candidate/action.js",
+  "packages/core/publication/binary/action.js",
+  "packages/core/release/next-development/actions.js",
+  "packages/core/publication/oci/preview-actions.js",
+  "packages/core/publication/settlement/actions.js",
 ];
 
 export function localModuleSpecifiers(source) {
@@ -160,14 +161,14 @@ export function discoverReleaseAuthorityClosure() {
     /(?:createReleaseReceipt|release-receipt\.json|RELEASE_RECEIPT_CONTRACT)/u,
   );
   const privilegedModules = discoverStaticModuleClosure(PRIVILEGED_ENTRYPOINTS);
-  const rustWasmArtifact = "packages/core/buildchain-domain.wasm";
+  const rustWasmArtifact = "packages/core/runtime/buildchain-domain.wasm";
   const rustWasmDistributions = [
-    "actions/promote-buildchain-ref/dist/buildchain-domain.wasm",
-    "actions/release-tail/dist/buildchain-domain.wasm",
-    "actions/release-candidate-promote/dist/buildchain-domain.wasm",
+    "actions/release/promotion/ref/dist/buildchain-domain.wasm",
+    "actions/release/tail/settle/dist/buildchain-domain.wasm",
+    "actions/release/promotion/candidate/dist/buildchain-domain.wasm",
   ];
-  const legacyEngineModules = productionFiles(
-    "actions/promote-buildchain-ref",
+  const excludedRefPromotionModules = productionFiles(
+    "packages/core/release/promote-ref",
     [".js", ".mjs", ".cjs"],
   )
     .filter((relative) =>
@@ -180,11 +181,11 @@ export function discoverReleaseAuthorityClosure() {
     providerAdapters: [
       ...new Set([
         ...providerPlane,
-        "packages/core/release-tail-provider-plane.js",
+        "packages/core/release/release-tail-provider-plane.js",
       ]),
     ].sort(),
     runtimeSelectors,
-    runtimeEngines: ["actions/release-candidate-promote/index.js"],
+    runtimeEngines: ["packages/core/release/promote-candidate/action.js"],
     terminalProjections,
     privilegedExecutableClosure: {
       entrypoints: PRIVILEGED_ENTRYPOINTS,
@@ -192,8 +193,8 @@ export function discoverReleaseAuthorityClosure() {
       root: rootedPathSet(privilegedModules),
     },
     rustWasmAuthority: {
-      loader: "packages/core/domain-wasm.js",
-      metadata: "packages/core/domain-wasm-artifact.js",
+      loader: "packages/core/runtime/domain-wasm.js",
+      metadata: "packages/core/runtime/domain-wasm-artifact.js",
       artifact: rustWasmArtifact,
       artifactRoot: fileSha256(rustWasmArtifact),
       distributedArtifacts: rustWasmDistributions,
@@ -202,7 +203,7 @@ export function discoverReleaseAuthorityClosure() {
       ),
       fallbackWriterCount: 0,
     },
-    legacyEngineModules,
+    excludedRefPromotionModules,
   };
 }
 
@@ -227,42 +228,44 @@ function permission(block, name) {
 }
 
 function workflowSnapshot(relative) {
+  const workflow = readWorkflow(relative, root);
   const source = read(relative);
-  const document = parseWorkflowDocument(source);
-  const jobs = document.jobs
-    .filter((job) => job.id !== "universal-bootstrap")
-    .map((job) => {
-      const block = jobBlock(source, job.id);
-      const uses = job.uses || null;
-      // A built-in publisher still requires mutation authority when the caller supplies its envelope.
+  const jobs = Object.keys(workflow.jobs)
+    .sort()
+    .map((id) => {
+      const graph = inspectWorkflowJob(relative, id, root);
+      const job = graph.job;
+      const block = JSON.stringify({ job, steps: graph.steps });
+      const permissions = job.permissions || workflow.permissions || {};
       const inheritedPublisher =
-        !/^    permissions:/mu.test(block) &&
-        /uses:.*actions\/release-candidate-promote/u.test(block);
+        typeof permissions !== "string" &&
+        !Object.keys(permissions).length &&
+        graph.steps.some((step) =>
+          /actions\/release\/promotion\/candidate$/.test(step.uses || ""),
+        );
+      const contents =
+        permissions.contents || (inheritedPublisher ? "inherited" : null);
+      const idToken =
+        permissions["id-token"] || (inheritedPublisher ? "inherited" : null);
       return {
-        id: job.id,
-        kind: uses ? "reusable-call" : "runner",
-        uses,
-        permissions: {
-          contents:
-            permission(block, "contents") ||
-            (inheritedPublisher ? "inherited" : null),
-          idToken:
-            permission(block, "id-token") ||
-            (inheritedPublisher ? "inherited" : null),
-        },
+        id,
+        kind: job.uses ? "reusable-call" : "runner",
+        uses: job.uses || null,
+        permissions: { contents, idToken },
         carriers: {
-          artifactDownload: /uses:\s+actions\/download-artifact@/u.test(block),
-          artifactUpload: /uses:\s+actions\/upload-artifact@/u.test(block),
-          jobOutput: /GITHUB_OUTPUT/u.test(block),
+          artifactDownload: graph.steps.some((step) =>
+            step.uses?.startsWith("actions/download-artifact@"),
+          ),
+          artifactUpload: graph.steps.some((step) =>
+            step.uses?.startsWith("actions/upload-artifact@"),
+          ),
+          jobOutput: Object.keys(job.outputs || {}).length > 0,
         },
         mutationSignals: [
-          (/contents:\s*write/u.test(block) || inheritedPublisher) &&
-            "contents-write",
-          (/id-token:\s*write/u.test(block) || inheritedPublisher) &&
-            "oidc-write",
-          /(?:promote-buildchain-ref|actions\/release-candidate-promote)/u.test(
-            block,
-          ) && "promotion-runtime",
+          ["write", "inherited"].includes(contents) && "contents-write",
+          ["write", "inherited"].includes(idToken) && "oidc-write",
+          /actions\/release\/promotion\/(?:candidate|ref)/u.test(block) &&
+            "promotion-runtime",
           /(?:git push|npm publish|gh release (?:create|upload))/u.test(
             block,
           ) && "direct-publication-command",
@@ -271,12 +274,10 @@ function workflowSnapshot(relative) {
     });
   return {
     path: relative,
-    triggers: document.triggers,
+    triggers: Object.keys(workflow.on || {}).sort(),
     jobs,
-    reusableEdges: parseYamlUses(source)
-      .map(({ value }) => value)
-      .filter((value) => /\.github\/workflows\//u.test(value))
-      .filter((value) => !/\/bootstrap\.yml(?:@v4)?$/u.test(value))
+    reusableEdges: Object.values(workflow.jobs)
+      .flatMap((job) => (job.uses ? [job.uses] : []))
       .sort(),
   };
 }
@@ -376,16 +377,11 @@ export function findUnknownReleaseTopology(
 ) {
   const declared = new Set(workflowPaths);
   return allWorkflowPaths
-    .filter(
-      (relative) =>
-        !declared.has(
-          workflowCompatibilityIdentity(root, relative, readWorkflow(relative)),
-        ),
-    )
+    .filter((relative) => !declared.has(relative))
     .filter((relative) => {
       const source = readWorkflow(relative);
       const usesReleaseAuthority = parseYamlUses(source).some(({ value }) =>
-        /(?:release-candidate-promote|promote-buildchain-ref|release-tail)/u.test(
+        /(?:release-candidate-promote|promote-buildchain-ref|release-tail|actions\/release\/promotion\/(?:candidate|ref)|\.github\/workflows\/(?:public-release-promote|\.release-promote))/u.test(
           value,
         ),
       );
@@ -425,7 +421,7 @@ function assertAuthorityClosure(ledger) {
     "runtimeSelectors",
     "runtimeEngines",
     "terminalProjections",
-    "legacyEngineModules",
+    "excludedRefPromotionModules",
   ]) {
     assert.ok(
       Array.isArray(closure[className]) && closure[className].length > 0,
@@ -453,48 +449,76 @@ function assertAuthorityClosure(ledger) {
     closure.privilegedExecutableClosure.root,
     /^sha256:[0-9a-f]{64}$/u,
   );
-  const reachableLegacyEngines = closure.legacyEngineModules.filter(
-    (relative) =>
+  const reachableRefPromotionEngines =
+    closure.excludedRefPromotionModules.filter((relative) =>
       closure.privilegedExecutableClosure.modules.includes(relative),
-  );
+    );
   assert.deepEqual(
-    reachableLegacyEngines,
+    reachableRefPromotionEngines,
     [],
-    `legacy release engines remain reachable from APPLY: ${reachableLegacyEngines.join(", ")}`,
+    `separate ref-promotion engines remain reachable from APPLY: ${reachableRefPromotionEngines.join(", ")}`,
   );
   assert.deepEqual(closure.runtimeEngines, [
-    "actions/release-candidate-promote/index.js",
+    "packages/core/release/promote-candidate/action.js",
   ]);
   assert.equal(
     closure.freshEntry,
-    ".github/workflows/release-candidate-promote.yml",
+    ".github/workflows/public-release-promote.yml",
   );
   assert.equal(
     closure.recoveryEntry,
     ".github/workflows/self-ops-promotion-recovery.yml",
   );
   const engineSurface = [
-    ".github/workflows/.release-candidate-promote.yml",
+    ".github/workflows/.release-promote.yml",
     ...closure.privilegedExecutableClosure.modules,
   ]
     .map(read)
     .join("\n");
-  for (const pattern of closure.forbiddenLegacyEnginePatterns)
+  for (const pattern of closure.forbiddenPublisherPatterns)
     assert.doesNotMatch(
       engineSurface,
       new RegExp(pattern, "u"),
       `legacy release engine remains reachable: ${pattern}`,
     );
-  const canonicalWorkflow = read(
-    ".github/workflows/.release-candidate-promote.yml",
+  const canonicalWorkflow = read(".github/workflows/.release-promote.yml");
+  const qualify = inspectWorkflowJob(
+    ".github/workflows/.release-promote.yml",
+    "qualify",
+    root,
+  );
+  assert.ok(
+    qualify.modules.has("packages/core/release/promotion/qualification.js"),
+  );
+  const apply = inspectWorkflowJob(
+    ".github/workflows/.release-promote.yml",
+    "apply",
+    root,
+  );
+  assert.ok(
+    apply.modules.has("packages/core/release/promote-candidate/action.js"),
   );
   assert.match(
-    canonicalWorkflow,
-    /scripts\/release-candidate-adapter\.mjs/u,
+    apply.modules.get(
+      "packages/core/release/promote-candidate/release-documents.js",
+    ),
+    /release-invocation\.json[\s\S]*release-transaction\.json/,
+  );
+  assert.match(
+    apply.modules.get(
+      "packages/core/release/promote-candidate/provider-settlement.js",
+    ),
+    /release-receipt\.json/,
+  );
+  const settle = inspectWorkflowJob(
+    ".github/workflows/.release-promote.yml",
+    "settle",
+    root,
   );
+  assert.ok(settle.actions.has("actions/publication/settlement/verify"));
   assert.match(
-    canonicalWorkflow,
-    /release-invocation\.json[\s\S]*release-transaction\.json[\s\S]*release-receipt\.json/u,
+    settle.modules.get("packages/core/publication/settlement/actions.js"),
+    /verifyPublicationSettlement/,
   );
 }
 
@@ -532,7 +556,7 @@ export function checkReleaseTopology() {
     assert.equal(actual.semanticMetrics.oidcWriteJobCount, 1);
     const publisher = actual.workflows.find(
       ({ path: workflowPath }) =>
-        workflowPath === ".github/workflows/.release-candidate-promote.yml",
+        workflowPath === ".github/workflows/.release-promote.yml",
     );
     assert.deepEqual(
       publisher.jobs.map((job) => job.split("|", 1)[0]),

package/scripts/check-runtime-semantic-closure.mjs

@@ -77,7 +77,7 @@ function validateEvidence(root, mechanism, capability, issues) {
 }
 
 function validateResidualClosure(mechanism, capability, issues) {
-  const sourceResiduals = mechanism.unresolved || [];
+  const sourceResiduals = mechanism.closedRequirements || [];
   const closed = capability.resolvedResiduals || [];
   if (
     !sameMembers(
@@ -113,7 +113,7 @@ function validateImplementation(root, mechanism, capability, issues) {
   }
   if (!boundToReverseScan)
     issues.push(
-      `${capability.id}: implementation is not bound to a reverse-scanned v3 mechanism route`,
+      `${capability.id}: implementation is not bound to a reverse-scanned current mechanism route`,
     );
 }
 
@@ -160,10 +160,7 @@ function validateAuthority(capability, stateMachine, issues) {
 export function validateRuntimeSemanticClosure({
   root = process.cwd(),
   manifest = loadJson(root, RUNTIME_SEMANTIC_CLOSURE_PATH),
-  v3Inventory: baselineInventory = loadJson(
-    root,
-    "architecture/baseline-core-mechanism-inventory.json",
-  ),
+  mechanismInventory = loadJson(root, "architecture/core-mechanisms.json"),
   v4Manifest: domainManifest = loadJson(
     root,
     "architecture/capability-state-machine-manifest.json",
@@ -181,7 +178,7 @@ export function validateRuntimeSemanticClosure({
     issues.push("runtime semantic closure evidence dimensions drifted");
 
   const mechanisms = new Map(
-    (baselineInventory.mechanisms || []).map((entry) => [entry.id, entry]),
+    (mechanismInventory.mechanisms || []).map((entry) => [entry.id, entry]),
   );
   const domainCapabilities = new Map(
     (domainManifest.capabilities || []).map((entry) => [entry.id, entry]),
@@ -199,7 +196,7 @@ export function validateRuntimeSemanticClosure({
     )
   )
     issues.push(
-      "runtime semantic closure does not cover every v3 mechanism exactly once",
+      "runtime semantic closure does not cover every current mechanism exactly once",
     );
   if (
     !sameMembers(

package/scripts/check-source-bindings.mjs

@@ -0,0 +1,54 @@
+#!/usr/bin/env node
+import path from "node:path";
+import { execFileSync } from "node:child_process";
+import { pathToFileURL } from "node:url";
+import ts from "typescript";
+
+export function checkSourceBindings({ root = process.cwd(), files } = {}) {
+  const sources =
+    files ||
+    execFileSync(
+      "git",
+      ["ls-files", "--cached", "--others", "--exclude-standard"],
+      { cwd: root, encoding: "utf8" },
+    )
+      .trim()
+      .split("\n")
+      .filter(
+        (file) => file.startsWith("packages/core/") && /\.(m?js)$/.test(file),
+      );
+  const resolved = new Set(sources.map((file) => path.resolve(root, file)));
+  const program = ts.createProgram([...resolved], {
+    allowJs: true,
+    checkJs: true,
+    noEmit: true,
+    target: ts.ScriptTarget.ESNext,
+    module: ts.ModuleKind.NodeNext,
+    moduleResolution: ts.ModuleResolutionKind.NodeNext,
+    skipLibCheck: true,
+    types: ["node"],
+  });
+  const issues = program
+    .getSemanticDiagnostics()
+    .filter(
+      (issue) =>
+        [2304, 2305, 2459, 2552].includes(issue.code) &&
+        issue.file &&
+        resolved.has(path.resolve(issue.file.fileName)),
+    )
+    .map((issue) => ({
+      file: path.relative(root, issue.file.fileName),
+      line: issue.file.getLineAndCharacterOfPosition(issue.start).line + 1,
+      message: ts.flattenDiagnosticMessageText(issue.messageText, " "),
+    }));
+  return { files: resolved.size, issues };
+}
+
+if (
+  process.argv[1] &&
+  import.meta.url === pathToFileURL(path.resolve(process.argv[1])).href
+) {
+  const report = checkSourceBindings();
+  console.log(JSON.stringify(report));
+  if (report.issues.length) process.exitCode = 1;
+}