@kungfu-tech/buildchain 4.0.9 → 4.1.0-alpha.0

package/scripts/generate-site-bundle.mjs

@@ -1,48 +1,47 @@
 #!/usr/bin/env node
-import { readWorkflowTaxonomy, workflowPath } from "./workflow-taxonomy.mjs";
+import { actionSurfaceAudit } from "./site-action-audit.mjs";
+import { actionInventory } from "../packages/core/contracts/action-inventory.js";
+import { readWorkflowTaxonomy, workflowPath } from "../packages/core/workflow/workflow-taxonomy.mjs";
 import fs from "node:fs";
 import path from "node:path";
 import crypto from "node:crypto";
 import { pathToFileURL } from "node:url";
 import { createRequire } from "node:module";
-import { createBuildchainContractWorld } from "../packages/core/buildchain-contract.js";
-import { createControllerRegistry } from "../packages/core/controller-evidence.js";
-import { createBuildchainPublicationAuthorityRegistry } from "../packages/core/buildchain-publication-authority.js";
+import { createBuildchainContractWorld } from "../packages/core/contracts/buildchain-contract.js";
+import { createControllerRegistry } from "../packages/core/observability/controller-evidence.js";
+import { createBuildchainPublicationAuthorityRegistry } from "../packages/core/governance/buildchain-publication-authority.js";
 import {
   BUILDCHAIN_AGENT_MANUALS,
   createBuildchainKfdClaimRegistry,
-} from "../packages/core/buildchain-kfd-claims.js";
+} from "../packages/core/adoption/buildchain-kfd-claims.js";
 import {
   collectKfdUpstreamFacts,
-} from "../packages/core/kfd.js";
-import { KFD_AGENT_HUB_ADOPTION_SCHEMA } from "../packages/core/kfd-agent-hub.js";
-import { KFD_PRODUCT_GATE_INPUT_SCHEMA } from "../packages/core/kfd-product-gates.js";
+} from "../packages/core/adoption/kfd.js";
+import { KFD_AGENT_HUB_ADOPTION_SCHEMA } from "../packages/core/adoption/kfd-agent-hub.js";
+import { KFD_PRODUCT_GATE_INPUT_SCHEMA } from "../packages/core/adoption/kfd-product-gates.js";
 import {
   createReadmeBadgeEndpointRegistry,
-} from "../packages/core/readme-badges.js";
+} from "../packages/core/web/readme-badges.js";
 import {
   RELEASE_PASSPORT_SCHEMA,
   createReleasePassportCheckManifest,
-} from "../packages/core/release-passport-contract.js";
+} from "../packages/core/release/release-passport-contract.js";
 import {
   collectPublicSurfaceReverseAudit,
   enumerateActionInputs,
   enumerateCliCommandsFromBin,
   enumerateWorkflowInputs,
-} from "../packages/core/public-surface-audit.js";
-import { createSurfaceTimestampPolicy } from "../packages/core/surface-manifest.js";
+} from "../packages/core/contracts/public-surface-audit.js";
+import { createSurfaceTimestampPolicy } from "../packages/core/contracts/surface-manifest.js";
 import { cliCommandMeta, nodeApiMeta } from "./site-capability-metadata.mjs";
 import { projectHomepageIntro } from "./site-bundle-homepage.mjs";
-import { BUILDCHAIN_USAGE } from "./buildchain-cli-help.mjs";
-import {
-  cliReferenceById,
-  createCliReference,
-} from "./public-reference.mjs";
+import { BUILDCHAIN_USAGE } from "../packages/core/workflow/commands/buildchain-cli-help.mjs";
+import { cliReferenceById, createCliReference } from "../packages/core/contracts/cli-reference.js";
 import { createSiteNodeApiRegistry } from "./site-reference-registry.mjs";
 import {
   BUILDCHAIN_COMMAND_REGISTRY,
   resolveBuildchainCommand,
-} from "../bin/internal/command-registry.mjs";
+} from "../packages/core/contracts/command-registry.mjs";
 
 const SITE_BUNDLE_CONTRACT = "kungfu-buildchain-site-bundle";
 const PUBLICATION_RELEASE_REGISTRY_CONTRACT = "kungfu-buildchain-publication-release-registry";
@@ -380,15 +379,15 @@ function publicSurfaceLifecycle({
   owner,
   maturity,
   nonDuplicationRationale,
-  introducedVersion = "pre-3.0.2-alpha.4",
+  introducedVersion = "4.1.0-alpha.0",
 }) {
   return {
     owner,
     maturity,
     introducedVersion,
-    compatibilityPromise: "preserved-through-the-v3-major-line",
+    compatibilityPromise: "current-contract-only",
     deprecationReplacement: "",
-    sunsetCondition: "explicit-breaking-change-review-in-a-future-major-line",
+    sunsetCondition: "explicit-contract-change-review",
     nonDuplicationRationale,
   };
 }
@@ -500,7 +499,7 @@ function createCliRegistry(packageJson) {
     contract: "kungfu-buildchain-cli-registry",
     binary: "buildchain",
     npmPackage: packageJson.name,
-    commandSource: "bin/internal/command-registry.mjs plus bin/buildchain.mjs help enumeration",
+    commandSource: "packages/core/contracts/command-registry.mjs plus bin/buildchain.mjs help enumeration",
     commands: commands.map((entry) => {
       const meta = cliCommandMeta(entry.id);
       return {
@@ -585,17 +584,27 @@ function workflowCapabilityGroup(entry) {
 }
 
 function actionCapabilityGroup(id) {
-  if (id === "github-artifact-attestation") return capabilityGroup("release-passport-trust");
-  if (id === "release-tail") return capabilityGroup("release-passport-trust");
-  if (id === "promote-buildchain-ref") return capabilityGroup("release-passport-trust");
-  if (id.startsWith("build-") || id === "run-lifecycle" || id === "validate-config") return capabilityGroup("reusable-build");
-  if (id === "report-buildchain-issue") return capabilityGroup("observability-diagnostics");
-  return capabilityGroup("api-cli-reference");
+  const owner = id.split("/")[0];
+  const groups = {
+    build: "reusable-build", release: "release-passport-trust",
+    publication: "release-passport-trust", governance: "observability-diagnostics",
+    "dev-delivery": "release-passport-trust", runtime: "api-cli-reference",
+    providers: "api-cli-reference", workflow: "api-cli-reference",
+    adoption: "reusable-build", paper: "reusable-build", web: "site-and-propagation",
+    observability: "observability-diagnostics", consumer: "governance-versioning", contracts: "api-cli-reference",
+  };
+  if (!groups[owner]) throw new Error(`action capability has no site group: ${owner}`);
+  return capabilityGroup(groups[owner]);
 }
 
 function buildSitePages() {
   const docsPages = listMarkdownFiles("docs").map((relPath) => sitePage(relPath, "manual", "/docs"));
-  const actionPages = immediateReadmes("actions").map((relPath) => sitePage(relPath, "action", "/actions"));
+  const actionPages = actionInventory(root)
+    .map(({ directory, capability, group, node }) => ({ file: `${directory}/README.md`, capability, group, node }))
+    .filter(({ file }) => fs.existsSync(path.join(root, file)))
+    .map(({ file, capability, group, node }) => sitePage(file, "action", "/actions", {
+      id: `action:${capability}/${group}/${node}`, slug: `${capability}/${group}/${node}`, route: `/actions/${capability}/${group}/${node}`,
+    }));
   const fixturePages = immediateReadmes("fixtures").map((relPath) => sitePage(relPath, "fixture", "/fixtures"));
   const apiPages = [
     sitePage("packages/core/README.md", "api", "/api", {
@@ -747,7 +756,7 @@ function buildSiteBundle() {
     deterministicInputs: [
       "README.md",
       "docs/*.md",
-      "actions/*/README.md",
+      "actions/*/*/*/README.md",
       "fixtures/*/README.md",
       "packages/core/README.md",
       "package.json#exports",
@@ -893,22 +902,12 @@ function buildSiteBundle() {
           introducedVersion: engineeringHousekeeper ? packageJson.version : undefined,
           nonDuplicationRationale: engineeringHousekeeper
             ? "One reusable policy and evidence boundary owns Engineering Housekeeper execution; scheduled callers contain cadence values only."
-            : "Existing workflow identity retained for caller compatibility and repository orchestration.",
+            : "Canonical workflow owns one declared API or orchestration responsibility.",
         }),
       };
     }),
-    actionSource: "actions/*/action.yml reverse input enumeration",
-    actions: enumerateActionInputs({ root }).map((entry) => ({
-      ...entry,
-      capabilityGroup: actionCapabilityGroup(entry.id),
-      status: "active",
-      ...publicSurfaceLifecycle({
-        owner: "buildchain-actions",
-        maturity: "stable",
-        introducedVersion: entry.id.startsWith("build-") ? "4.0.9-alpha.0" : undefined,
-        nonDuplicationRationale: "Existing action identity retained as the canonical composite or JavaScript action boundary.",
-      }),
-    })),
+    actionSource: "actions/*/*/*/action.yml reverse input enumeration",
+    actions: actionSurfaceAudit({ root, actionCapabilityGroup, publicSurfaceLifecycle }),
   };
   const controllerRegistry = createControllerRegistry({ workflows: workflowRegistry.workflows });
   const publicationAuthorityRegistry = createBuildchainPublicationAuthorityRegistry({ root });

package/scripts/generate-tail-reseal-fixture.mjs

@@ -0,0 +1,108 @@
+#!/usr/bin/env node
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+import {
+  scanFloatingConsumerPolicy,
+  consumerPolicyScannerRoot,
+} from "../packages/core/consumer/floating-consumer-policy.js";
+const repositoryRoot = path.resolve(import.meta.dirname, "..");
+const fixturePath = path.join(
+  repositoryRoot,
+  "contracts/fixtures/v4-tail-reseal-v1/valid.json",
+);
+export function tailResealFixturePolicyReceipt(fixture, policy) {
+  const root = fs.mkdtempSync(
+    path.join(os.tmpdir(), "buildchain-tail-policy-"),
+  );
+  try {
+    fs.mkdirSync(path.join(root, ".github/workflows"), { recursive: true });
+    fs.writeFileSync(
+      path.join(root, ".github/workflows/build.yml"),
+      "jobs:\n  build:\n    uses: kungfu-systems/buildchain/.github/workflows/public-build-stage-capsule-canary.yml@v4-alpha\n",
+    );
+    fs.mkdirSync(path.join(root, ".buildchain"), { recursive: true });
+    for (const [file, ref, resolvedSha] of [
+      ["contract-lock.json", "v4", "e".repeat(40)],
+      ["alpha-contract-lock.json", "v4-alpha", fixture.runtime.sha],
+    ]) {
+      const lock = {
+        schemaVersion: 1,
+        contract: "kungfu-buildchain-contract-lock",
+        buildchain: {
+          ref,
+          resolvedSha,
+          contract: "kungfu-buildchain-runtime-contract-world",
+          contractDigest: fixture.runtime.contractRoot,
+          compatibilityDigest: fixture.runtime.contractRoot,
+          majorLine: "v4",
+          compatibilityPolicy: "major-compatible",
+          acceptedAt: "2026-08-15T03:00:00.000Z",
+          surfaces: [],
+        },
+      };
+      fs.writeFileSync(
+        path.join(root, ".buildchain", file),
+        `${JSON.stringify(lock)}\n`,
+      );
+    }
+    const result = scanFloatingConsumerPolicy({
+      root,
+      repository: fixture.repository,
+      sourceSha: fixture.source.sha,
+      invokedWorkflow: "public-build-stage-capsule-canary.yml",
+      expectedInvocationChannel: "alpha",
+      resolvedRuntimeSha: fixture.runtime.sha,
+      policy,
+      scannerRoot: consumerPolicyScannerRoot(),
+    });
+    if (!result.ok)
+      throw Error(
+        `Synthetic fixture admission failed: ${result.failures.map((x) => x.code).join(", ")}`,
+      );
+    return { receipt: result.receipt, receiptRoot: result.receiptRoot };
+  } finally {
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+}
+export function generateTailResealFixture({ check = false } = {}) {
+  const fixture = JSON.parse(fs.readFileSync(fixturePath, "utf8"));
+  const policy = JSON.parse(
+    fs.readFileSync(
+      path.join(repositoryRoot, "architecture/floating-consumer-policy.json"),
+      "utf8",
+    ),
+  );
+  const { receiptRoot } = tailResealFixturePolicyReceipt(fixture, policy);
+  const previousRoot = fixture.runtime.consumerPolicyReceiptRoot;
+  if (check && receiptRoot !== previousRoot)
+    throw Error(
+      "Current tail-reseal synthetic policy receipt fixture is stale",
+    );
+  if (!check && receiptRoot !== previousRoot) {
+    fixture.runtime.consumerPolicyReceiptRoot = receiptRoot;
+    fs.writeFileSync(fixturePath, `${JSON.stringify(fixture, null, 2)}\n`);
+  }
+  return {
+    fixture: "contracts/fixtures/v4-tail-reseal-v1/valid.json",
+    previousRoot,
+    receiptRoot,
+    check,
+  };
+}
+if (
+  process.argv[1] &&
+  import.meta.url === pathToFileURL(process.argv[1]).href
+) {
+  try {
+    console.log(
+      JSON.stringify(
+        generateTailResealFixture({ check: process.argv.includes("--check") }),
+      ),
+    );
+  } catch (error) {
+    console.error(error.message);
+    process.exitCode = 1;
+  }
+}

package/scripts/generate-workflow-taxonomy.mjs

@@ -7,7 +7,7 @@ import {
   TAXONOMY_DOC,
   workflowPath,
   writeWorkflowSource,
-} from "./workflow-taxonomy.mjs";
+} from "../packages/core/workflow/workflow-taxonomy.mjs";
 
 const root = process.cwd();
 const policy = readWorkflowTaxonomy(root);
@@ -21,5 +21,5 @@ for (const entry of policy.entries) {
 }
 fs.writeFileSync(path.join(root, TAXONOMY_DOC), renderWorkflowCatalog(policy));
 process.stdout.write(
-  `Generated ${policy.entries.length} canonical workflow declarations and their exact compatibility projections.\n`,
+  `Generated ${policy.entries.length} canonical workflow declarations.\n`,
 );

package/scripts/inventory/binary.mjs

@@ -0,0 +1,36 @@
+import assert from "node:assert/strict";
+import { inspectWorkflowJob, readWorkflow } from "../workflow-action-graph.mjs";
+
+export function assertBinaryInventory(root) {
+  const file = ".github/workflows/self-build-binary-distribution.yml";
+  const workflow = readWorkflow(file, root);
+  assert.equal(workflow.name, "Binary Distribution");
+  assert.deepEqual(Object.keys(workflow.jobs), ["preflight", "binary", "passport", "dispatch-publication"]);
+  const graphs = Object.keys(workflow.jobs).map(id => inspectWorkflowJob(file, id, root));
+  for (const graph of graphs) {
+    assert.equal(graph.job.permissions.contents, "read");
+    assert.notEqual(graph.job.permissions["id-token"], "write");
+    assert.ok(!JSON.stringify(graph.job["runs-on"]).includes("self-hosted"));
+    for (const step of graph.steps) assert.ok(!/gh release (?:upload|create)/u.test(step.run || ""));
+    assert.ok(graph.actions.has(`actions/build/binary/${["preflight", "build", "passport", "dispatch-publication"][graphs.indexOf(graph)]}`));
+  }
+  const binary = graphs[1];
+  assert.deepEqual(binary.job.strategy.matrix.include.map(entry => entry.os).sort(), ["macos-latest", "ubuntu-24.04", "windows-2022"]);
+  const passport = graphs[2];
+  const executable = passport.modules.get("packages/core/build/binary/distribution.js");
+  for (const command of ["verifyBuildchainLogEvents", "verifyReleasePassport", "verifyArtifactPassport", "createReleaseEvidenceBundle", "buildchain-log-events", "buildchain-log-summary"])
+    assert.ok(executable.includes(command), `Binary evidence is missing ${command}`);
+  assert.ok(passport.actions.has("actions/build/binary/qualify"));
+  const publish = inspectWorkflowJob(".github/workflows/.release-binary-assets.yml", "publish", root);
+  assert.equal(publish.workflow.jobs["publication-authority"].uses, "./.github/workflows/.release-authority.yml");
+  assert.equal(publish.job.needs, "publication-authority");
+  assert.equal(publish.job.environment, "buildchain-release-assets");
+  assert.equal(publish.job.permissions.contents, "write");
+  assert.ok(publish.actions.has("actions/release/binary/publish"));
+  const effect = publish.steps.find(step => step.uses?.endsWith("/publication/binary/publish"));
+  assert.ok(effect);
+  assert.equal(effect["continue-on-error"], undefined);
+  const transaction = publish.modules.get("packages/core/publication/binary/transaction.js");
+  assert.match(transaction, /validateBinaryCapability\([\s\S]*await client.publish\(/, "Binary effects must follow capability admission");
+  assert.match(publish.modules.get("packages/core/publication/binary/action.js"), /verifySourceRuntimeCheckouts\([\s\S]*await publishBinaryAssets\(/);
+}

package/scripts/inventory/promotion.mjs

@@ -0,0 +1,72 @@
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import path from "node:path";
+import YAML from "yaml";
+import { inspectWorkflowJob } from "../workflow-action-graph.mjs";
+import { generateChannelPromotionWorkflow } from "../generate-channel-promotion-workflow.mjs";
+
+export function assertPromotionInventory(root) {
+  const read = (file) => fs.readFileSync(path.join(root, file), "utf8");
+  const publicPath = ".github/workflows/public-release-promote.yml";
+  const api = YAML.parse(read(publicPath));
+  assert.equal(
+    read(publicPath),
+    generateChannelPromotionWorkflow(
+      read(".github/workflows/.release-promote.yml"),
+    ),
+  );
+  assert.deepEqual(Object.keys(api.on.workflow_call.inputs), ["request-json"]);
+  assert.equal(
+    api.jobs.invoke.uses,
+    "./.github/workflows/.release-promote.yml",
+  );
+  assert.deepEqual(api.jobs.invoke.with, {
+    "request-json": "${{ needs.consumer-admission.outputs.invocation-json }}",
+  });
+  const request = JSON.parse(
+    read("contracts/promotion-request-v1.schema.json"),
+  );
+  assert.equal(request.additionalProperties, false);
+  for (const key of [
+    "promotion-router-sha",
+    "promotion-runtime-authorization-json",
+    "branch-protection-bypass-users",
+    "publish-command",
+  ])
+    assert.ok(!request.properties[key]);
+  for (const file of [
+    "self-release-promote",
+    "self-release-tail-dogfood",
+    "self-ops-promotion-recovery",
+  ]) {
+    const caller = YAML.parse(read(`.github/workflows/${file}.yml`));
+    const calls = Object.values(caller.jobs).filter(
+      (job) => job.uses === `./${publicPath}`,
+    );
+    assert.equal(calls.length, 1, file);
+    assert.deepEqual(Object.keys(calls[0].with), ["request-json"]);
+  }
+  const component = ".github/workflows/.release-promote.yml";
+  const expected = {
+    qualify: "promotion/qualify",
+    apply: "promotion/apply",
+    settle: "promotion/settle",
+  };
+  for (const [job, node] of Object.entries(expected)) {
+    const graph = inspectWorkflowJob(component, job, root);
+    assert.ok(
+      graph.actions.has(`actions/release/${node}`),
+      `${job} must reach its owned node`,
+    );
+    if (job !== "apply")
+      assert.notEqual(graph.job.permissions?.contents, "write");
+    if (job === "apply")
+      assert.ok(graph.actions.has("actions/release/promotion/candidate"));
+    assert.ok(
+      [...graph.modules.keys()].every(
+        (file) => !file.startsWith("packages/core/release/promote-ref/"),
+      ),
+      "canonical publisher cannot reach the separate ref-promotion engine",
+    );
+  }
+}

package/scripts/maintainability-domain-metrics.mjs

@@ -1,4 +1,4 @@
-import { parseWorkflowDocument } from "../packages/core/workflow-yaml-contract.js";
+import { parseWorkflowDocument } from "../packages/core/contracts/workflow-yaml-contract.js";
 
 function lineCount(source) {
   const text = String(source || "");

package/scripts/maintainability-metrics.mjs

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-import { projectWorkflowIdentities } from "./workflow-taxonomy.mjs";
 
 import fs from "node:fs";
 import path from "node:path";
@@ -17,7 +16,7 @@ import {
 
 const JS_EXTENSIONS = new Set([".js", ".mjs", ".cjs"]);
 const HAND_MAINTAINED_EXTENSIONS = new Set([...JS_EXTENSIONS, ".rs"]);
-const GENERATED_PATTERN = /^actions\/[^/]+\/dist\/.*\.js$/u;
+const GENERATED_PATTERN = /^actions\/(?:[^/]+\/)+dist\/.*\.js$/u;
 
 function gitText(root, args, encoding = "utf8") {
   return execFileSync("git", args, {
@@ -51,7 +50,10 @@ function isTestFile(file) {
 }
 
 function isGeneratedFile(file) {
-  return GENERATED_PATTERN.test(file);
+  return (
+    GENERATED_PATTERN.test(file) ||
+    file.startsWith("templates/bootstrap-recovery/")
+  );
 }
 
 function isHandMaintainedSource(file) {
@@ -243,15 +245,16 @@ function architectureSummary(root, revision = "") {
   };
 }
 
-function selectedFunction(files, file, name) {
-  const entry = files[file];
-  const matches =
-    entry?.functions.filter((candidate) => candidate.name === name) || [];
-  if (matches.length !== 1) {
+function selectedFunction(files, name) {
+  const matches = Object.entries(files).flatMap(([file, entry]) =>
+    (entry.functions || [])
+      .filter((candidate) => candidate.name === name)
+      .map((candidate) => ({ file, ...candidate })),
+  );
+  if (matches.length !== 1)
     throw new Error(
-      `${file} must contain exactly one ${name} function; found ${matches.length}`,
+      `source revision must contain exactly one ${name} function; found ${matches.length}`,
     );
-  }
   return matches[0];
 }
 
@@ -267,6 +270,9 @@ function collectMaintainabilityMetrics({
   const workflowFiles = files.filter((file) =>
     /^\.github\/workflows\/.*\.ya?ml$/u.test(file),
   );
+  const actionDefinitions = files.filter((file) =>
+    /(?:^|\/)action\.ya?ml$/u.test(file),
+  );
   const generatedFiles = files.filter(isGeneratedFile);
   const documentationFiles = files.filter((file) => file.endsWith(".md"));
   const sourceMetrics = Object.fromEntries(
@@ -285,9 +291,7 @@ function collectMaintainabilityMetrics({
     path: file,
     text: readTrackedFile(root, file, revision),
   }));
-  const logicalWorkflows = revision
-    ? physicalWorkflows
-    : projectWorkflowIdentities(root, physicalWorkflows);
+  const logicalWorkflows = physicalWorkflows;
   const workflowMetrics = Object.fromEntries(
     logicalWorkflows.map((entry) => [
       entry.path,
@@ -310,6 +314,12 @@ function collectMaintainabilityMetrics({
   const reverseAudit = JSON.parse(
     readTrackedFile(root, "dist/site/public-surface-audit.json", revision),
   );
+  const sourceLines = Object.values(sourceMetrics).reduce(
+    (total, entry) => total + entry.lines,
+    0,
+  );
+  const workflowLines = sumLines(workflowFiles);
+  const actionDefinitionLines = sumLines(actionDefinitions);
   const head = revision || gitText(root, ["rev-parse", "HEAD"]).trim();
   return {
     schemaVersion: 1,
@@ -318,17 +328,15 @@ function collectMaintainabilityMetrics({
     repository: {
       trackedFiles: files.length,
       handMaintainedSourceFiles: sourceFiles.length,
-      handMaintainedSourceLines: Object.values(sourceMetrics).reduce(
-        (total, entry) => total + entry.lines,
-        0,
-      ),
+      handMaintainedSourceLines: sourceLines,
       testFiles: testFiles.length,
       testLines: sumLines(testFiles),
       workflowFiles: logicalWorkflows.length,
-      workflowLines: logicalWorkflows.reduce(
-        (total, entry) => total + lineCount(entry.text),
-        0,
-      ),
+      workflowLines,
+      actionDefinitions: actionDefinitions.length,
+      actionDefinitionLines,
+      automationImplementationLines:
+        sourceLines + workflowLines + actionDefinitionLines,
       documentationFiles: documentationFiles.length,
       documentationLines: sumLines(documentationFiles),
       generatedFiles: generatedFiles.length,
@@ -357,22 +365,14 @@ function collectMaintainabilityMetrics({
     },
     architecture: architectureSummary(root, revision),
     hotspots: {
-      promoteBuildchainRefs: {
-        file: "actions/promote-buildchain-ref/lib.js",
-        ...selectedFunction(
-          sourceMetrics,
-          "actions/promote-buildchain-ref/lib.js",
-          "promoteBuildchainRefs",
-        ),
-      },
-      createReleaseCheckReport: {
-        file: "packages/core/release-passport.js",
-        ...selectedFunction(
-          sourceMetrics,
-          "packages/core/release-passport.js",
-          "createReleaseCheckReport",
-        ),
-      },
+      promoteBuildchainRefs: selectedFunction(
+        sourceMetrics,
+        "promoteBuildchainRefs",
+      ),
+      createReleaseCheckReport: selectedFunction(
+        sourceMetrics,
+        "createReleaseCheckReport",
+      ),
     },
     files: sourceMetrics,
     tests: testMetrics,