@kungfu-tech/buildchain 4.0.9 → 4.1.0-alpha.0

package/packages/core/build/runner/matrix.js

@@ -0,0 +1,266 @@
+import { RUNNER_PRESETS } from "./presets.js";
+import { LINUX_CONTAINER_PRESETS } from "./presets.js";
+import { parseJsonArray } from "../../contracts/structured-values.js";
+import { macosJitRunnerLabel } from "../../providers/commands/aws-macos-jit-core.mjs";
+import { windowsJitRunnerLabel } from "../../providers/commands/aws-windows-jit-core.mjs";
+export function normalizeRunnerPreset(value) {
+  const preset = String(value || "github-hosted").trim() || "github-hosted";
+  return preset;
+}
+
+export function normalizeLinuxContainerPreset(value) {
+  const preset = String(value || "").trim();
+  return preset;
+}
+
+export function resolveLinuxContainer({
+  linuxContainerPreset = "",
+  linuxContainerImage = "",
+} = {}) {
+  const explicitImage = String(linuxContainerImage || "").trim();
+  const preset = normalizeLinuxContainerPreset(linuxContainerPreset);
+  if (explicitImage) {
+    if (preset && preset !== "custom") {
+      throw new Error(
+        "linux-container-image cannot be combined with a named linux-container-preset",
+      );
+    }
+    return {
+      enabled: true,
+      preset: preset || "custom",
+      image: explicitImage,
+      source: "linux-container-image",
+    };
+  }
+  if (!preset) {
+    return {
+      enabled: false,
+      preset: "",
+      image: "",
+      source: "none",
+    };
+  }
+  const resolved = LINUX_CONTAINER_PRESETS[preset];
+  if (!resolved) {
+    throw new Error(`unsupported linux-container-preset: ${preset}`);
+  }
+  return {
+    enabled: true,
+    preset,
+    image: resolved.image,
+    source: "linux-container-preset",
+  };
+}
+
+export function platformIsLinux(platform) {
+  const id = String(platform?.id || "").toLowerCase();
+  const name = String(platform?.name || "").toLowerCase();
+  if (id.includes("linux") || name.includes("linux")) {
+    return true;
+  }
+  const runnerLabels = parseJsonArray(
+    String(platform?.runner || "[]"),
+    "platform.runner",
+  ).map((label) => String(label || "").toLowerCase());
+  return runnerLabels.some(
+    (label) => label.includes("linux") || label.includes("ubuntu"),
+  );
+}
+
+export function platformUsesGitHubHostedRunner(platform, index) {
+  if (platform?.githubHosted !== undefined) {
+    if (typeof platform.githubHosted !== "boolean") {
+      throw new Error(
+        `platforms-json[${index}].githubHosted must be a boolean`,
+      );
+    }
+    return platform.githubHosted;
+  }
+  if (String(platform?.provider || "").trim()) {
+    return false;
+  }
+  const runnerLabels = parseJsonArray(
+    String(platform?.runner || "[]"),
+    `platforms-json[${index}].runner`,
+  ).map((label) => String(label || "").toLowerCase());
+  if (runnerLabels.includes("self-hosted") || runnerLabels.length !== 1) {
+    return false;
+  }
+  return /^(ubuntu-(latest|20\.04|22\.04|24\.04|24\.04-arm)|windows-(latest|2019|2022|2025|11-arm)|macos-(latest|13|14|15|26)(-intel)?)$/.test(
+    runnerLabels[0],
+  );
+}
+
+export function bindRunnerHosting(platforms) {
+  return platforms.map((platform, index) => ({
+    ...platform,
+    githubHosted: platformUsesGitHubHostedRunner(platform, index),
+  }));
+}
+
+export function runnerHostingSummary(platforms) {
+  const githubHostedPlatforms = platforms.filter(
+    (platform) => platform.githubHosted,
+  );
+  const relayPlatforms = platforms.filter((platform) => !platform.githubHosted);
+  return {
+    githubHostedPlatforms,
+    githubHostedPlatformsJson: JSON.stringify(githubHostedPlatforms),
+    githubHostedPlatformIdsJson: JSON.stringify(
+      githubHostedPlatforms.map((platform) => platform.id),
+    ),
+    githubHostedPlatformCount: githubHostedPlatforms.length,
+    relayPlatforms,
+    relayPlatformsJson: JSON.stringify(relayPlatforms),
+    relayPlatformCount: relayPlatforms.length,
+  };
+}
+
+export function normalizePlatform(platform, index) {
+  const id = String(platform?.id || "").trim();
+  const name = String(platform?.name || id).trim();
+  const runner = String(platform?.runner || "").trim();
+  if (!id) {
+    throw new Error(`platforms-json[${index}].id is required`);
+  }
+  if (!name) {
+    throw new Error(`platforms-json[${index}].name is required`);
+  }
+  if (!runner) {
+    throw new Error(`platforms-json[${index}].runner is required`);
+  }
+  parseJsonArray(runner, `platforms-json[${index}].runner`);
+  const capabilities =
+    platform?.capabilities === undefined
+      ? ["node"]
+      : parseJsonArray(
+          JSON.stringify(platform.capabilities),
+          `platforms-json[${index}].capabilities`,
+        ).map((capability) => String(capability || "").trim());
+  if (
+    capabilities.some((capability) => !capability) ||
+    new Set(capabilities).size !== capabilities.length
+  ) {
+    throw new Error(
+      `platforms-json[${index}].capabilities must contain unique non-empty strings`,
+    );
+  }
+  const normalized = { id, name, runner };
+  if (platform?.platform !== undefined)
+    normalized.platform = String(platform.platform || "").trim();
+  if (platform?.provider !== undefined)
+    normalized.provider = String(platform.provider || "").trim();
+  if (platform?.project !== undefined)
+    normalized.project = String(platform.project || "").trim();
+  if (platform?.githubHosted !== undefined)
+    normalized.githubHosted = platform.githubHosted;
+  normalized.capabilities = capabilities.sort();
+  if (platform?.environment !== undefined)
+    normalized.environment = platform.environment;
+  if (platform?.required === false) normalized.required = false;
+  return normalized;
+}
+
+export function resolveRunnerMatrix({
+  runnerPreset = "github-hosted",
+  platformsJson = "",
+  awsCodeBuildProject = "",
+  awsEc2WindowsRunnerLabel = "",
+  awsEc2MacosRunnerLabel = "",
+  linuxContainerPreset = "",
+  linuxContainerImage = "",
+} = {}) {
+  const customPlatformsJson = String(platformsJson || "").trim();
+  const linuxContainer = resolveLinuxContainer({
+    linuxContainerPreset,
+    linuxContainerImage,
+  });
+  if (customPlatformsJson) {
+    const platforms = bindRunnerHosting(
+      parseJsonArray(customPlatformsJson, "platforms-json").map(
+        normalizePlatform,
+      ),
+    );
+    if (platforms.length === 0) {
+      throw new Error("platforms-json must include at least one platform");
+    }
+    const containerPlatforms = linuxContainer.enabled
+      ? platforms.filter(platformIsLinux)
+      : [];
+    const nativePlatforms = linuxContainer.enabled
+      ? platforms.filter((platform) => !platformIsLinux(platform))
+      : platforms;
+    return {
+      source: "platforms-json",
+      runnerPreset: "custom",
+      platforms,
+      platformsJson: JSON.stringify(platforms),
+      platformCount: platforms.length,
+      nativePlatforms,
+      nativePlatformsJson: JSON.stringify(nativePlatforms),
+      nativePlatformCount: nativePlatforms.length,
+      containerPlatforms,
+      containerPlatformsJson: JSON.stringify(containerPlatforms),
+      containerPlatformCount: containerPlatforms.length,
+      linuxContainer,
+      ...runnerHostingSummary(platforms),
+    };
+  }
+
+  const preset = normalizeRunnerPreset(runnerPreset);
+  if (preset === "custom") {
+    throw new Error("runner-preset=custom requires platforms-json");
+  }
+  const platforms = RUNNER_PRESETS[preset];
+  if (!platforms) {
+    throw new Error(`unsupported runner-preset: ${preset}`);
+  }
+  let resolvedPlatforms = platforms;
+  if (preset === "aws-us-codebuild-linux") {
+    const project = String(awsCodeBuildProject || "").trim();
+    if (!/^[A-Za-z0-9][A-Za-z0-9_-]{1,149}$/.test(project)) {
+      throw new Error(
+        "runner-preset=aws-us-codebuild-linux requires a valid aws-codebuild-project",
+      );
+    }
+    resolvedPlatforms = platforms.map((platform) => ({ ...platform, project }));
+  }
+  if (preset === "aws-us-ec2-windows-jit") {
+    const runnerLabel = windowsJitRunnerLabel(awsEc2WindowsRunnerLabel);
+    resolvedPlatforms = platforms.map((platform) => ({
+      ...platform,
+      runnerLabel,
+      runner: JSON.stringify(["self-hosted", "Windows", "X64", runnerLabel]),
+    }));
+  }
+  if (preset === "aws-us-ec2-macos-jit") {
+    const runnerLabel = macosJitRunnerLabel(awsEc2MacosRunnerLabel);
+    resolvedPlatforms = platforms.map((platform) => ({
+      ...platform,
+      runnerLabel,
+      runner: JSON.stringify(["self-hosted", "macOS", "ARM64", runnerLabel]),
+    }));
+  }
+  resolvedPlatforms = bindRunnerHosting(resolvedPlatforms);
+  const containerPlatforms = linuxContainer.enabled
+    ? resolvedPlatforms.filter(platformIsLinux)
+    : [];
+  const nativePlatforms = linuxContainer.enabled
+    ? resolvedPlatforms.filter((platform) => !platformIsLinux(platform))
+    : resolvedPlatforms;
+  return {
+    source: "runner-preset",
+    runnerPreset: preset,
+    platforms: resolvedPlatforms,
+    platformsJson: JSON.stringify(resolvedPlatforms),
+    platformCount: resolvedPlatforms.length,
+    nativePlatforms,
+    nativePlatformsJson: JSON.stringify(nativePlatforms),
+    nativePlatformCount: nativePlatforms.length,
+    containerPlatforms,
+    containerPlatformsJson: JSON.stringify(containerPlatforms),
+    containerPlatformCount: containerPlatforms.length,
+    linuxContainer,
+    ...runnerHostingSummary(resolvedPlatforms),
+  };
+}

package/packages/core/build/runner/presets.js

@@ -0,0 +1,115 @@
+export const RUNNER_PRESETS = Object.freeze({
+  "github-hosted": [
+    {
+      id: "linux-x64",
+      name: "Linux x64",
+      platform: "linux",
+      runner: '["ubuntu-24.04"]',
+      capabilities: ["node"],
+    },
+    {
+      id: "macos",
+      name: "macOS",
+      platform: "macos",
+      runner: '["macos-latest"]',
+      capabilities: ["node"],
+    },
+    {
+      id: "windows-x64",
+      name: "Windows x64",
+      platform: "windows",
+      runner: '["windows-2022"]',
+      capabilities: ["node"],
+    },
+  ],
+  "kungfu-v4-self-hosted": [
+    {
+      id: "linux-x64",
+      name: "Linux x64",
+      platform: "linux",
+      runner: '["self-hosted","Linux","X64","kungfu-build-v4-linux-x64"]',
+      capabilities: ["node", "native-toolchain", "product-artifacts", "rust"],
+    },
+    {
+      id: "macos-arm64",
+      name: "macOS ARM64",
+      platform: "macos",
+      runner: '["self-hosted","macOS","ARM64","kungfu-build-v4-macos-arm64"]',
+      capabilities: ["node", "native-toolchain", "product-artifacts", "rust"],
+    },
+    {
+      id: "windows-x64",
+      name: "Windows x64",
+      platform: "windows",
+      runner: '["self-hosted","Windows","X64","kungfu-build-v4-windows-x64"]',
+      capabilities: ["node", "native-toolchain", "product-artifacts", "rust"],
+    },
+  ],
+  "kungfu-v4-native": [
+    {
+      id: "linux-x64",
+      name: "Linux x64",
+      platform: "linux",
+      runner: '["self-hosted","Linux","X64","kungfu-build-v4-linux-x64"]',
+      capabilities: ["node", "native-toolchain", "product-artifacts", "rust"],
+    },
+    {
+      id: "linux-arm64",
+      name: "Linux ARM64",
+      platform: "linux",
+      runner: '["ubuntu-24.04-arm"]',
+      capabilities: ["node", "native-toolchain", "product-artifacts", "rust"],
+    },
+    {
+      id: "macos-arm64",
+      name: "macOS ARM64",
+      platform: "macos",
+      runner: '["self-hosted","macOS","ARM64","kungfu-build-v4-macos-arm64"]',
+      capabilities: ["node", "native-toolchain", "product-artifacts", "rust"],
+    },
+    {
+      id: "windows-x64",
+      name: "Windows x64",
+      platform: "windows",
+      runner: '["self-hosted","Windows","X64","kungfu-build-v4-windows-x64"]',
+      capabilities: ["node", "native-toolchain", "product-artifacts", "rust"],
+    },
+  ],
+  "aws-us-codebuild-linux": [
+    {
+      id: "linux-x64",
+      name: "Linux x64 (AWS CodeBuild burst)",
+      platform: "linux",
+      provider: "aws-codebuild",
+      runner: '["aws-codebuild-dynamic"]',
+      capabilities: ["node", "native-toolchain", "product-artifacts", "rust"],
+    },
+  ],
+  "aws-us-ec2-windows-jit": [
+    {
+      id: "windows-x64",
+      name: "Windows x64 (AWS EC2 one-job JIT)",
+      platform: "windows",
+      provider: "aws-ec2-windows-jit",
+      runner: '["self-hosted","Windows","X64","aws-ec2-jit-dynamic"]',
+      capabilities: ["node", "native-toolchain", "product-artifacts", "rust"],
+    },
+  ],
+  "aws-us-ec2-macos-jit": [
+    {
+      id: "macos-arm64",
+      name: "macOS ARM64 (AWS EC2 Dedicated Host one-job JIT)",
+      platform: "macos",
+      provider: "aws-ec2-macos-jit",
+      runner: '["self-hosted","macOS","ARM64","aws-ec2-jit-dynamic"]',
+      capabilities: ["node", "native-toolchain", "product-artifacts", "rust"],
+    },
+  ],
+});
+
+export const LINUX_CONTAINER_PRESETS = Object.freeze({
+  "kungfu-verify": {
+    image:
+      "ghcr.io/kungfu-systems/build-images/kungfu-verify@sha256:11f0ba64267ce88174a4f73a9bf833ff4e9c59cd16ec3d08a6432a06c2be6fb1",
+  },
+});

package/packages/core/build/signing/actions.js

@@ -0,0 +1,54 @@
+import { buildSigningConsumerEnvironment } from "./environment.js";
+import path from "node:path";
+import { buildArtifactActionContext } from "../artifact/actions.js";
+import { command } from "../../runtime/action-process.mjs";
+import { runLifecycle } from "../lifecycle/transaction.js";
+import { dispatchArtifactSigningAuthority } from "./dispatch.js";
+import { createBuildSigningService } from "./transaction.js";
+
+function service(core, env) {
+  const context = buildArtifactActionContext(core, env);
+  if (!context.platform)
+    throw new Error("Build signing requires a declared platform");
+  const controlToken = core.getInput("control-token");
+  return createBuildSigningService(
+    {
+      ...context,
+      sourceRoot: path.join(context.workspace, "source"),
+      controller: { job: env.GITHUB_JOB, runnerOs: env.RUNNER_OS },
+      consumerEnvironment: buildSigningConsumerEnvironment(
+        env,
+        core.getInput("token", { required: true }),
+      ),
+    },
+    {
+      controlToken,
+      dispatch: (request) =>
+        dispatchArtifactSigningAuthority({ ...request, token: controlToken }),
+      executeLifecycle: runLifecycle,
+      executeConsumer: ({ command: script, cwd, env: environment }) =>
+        command(
+          process.platform === "win32" ? "pwsh" : "bash",
+          process.platform === "win32"
+            ? ["-NoProfile", "-NonInteractive", "-Command", script]
+            : ["--noprofile", "--norc", "-e", "-o", "pipefail", "-c", script],
+          { cwd, env: environment },
+        ),
+    },
+  );
+}
+export async function completeBuildSigningAction(core, env) {
+  core.setOutput("artifact", await service(core, env).completeSigning());
+}
+export async function admitBuildCredentialAction(core, env) {
+  core.setOutput(
+    "bundle-id",
+    (await service(core, env).prepareCredential()).bundleId,
+  );
+}
+export async function retainBuildCredentialAction(core, env) {
+  await service(core, env).publishCredential({
+    manifestPath: core.getInput("manifest-path", { required: true }),
+    artifactRoot: core.getInput("artifact-root", { required: true }),
+  });
+}

package/packages/core/build/signing/authority-actions.js

@@ -0,0 +1,147 @@
+import fs from "node:fs";
+import path from "node:path";
+import { installationRoot } from "../../runtime/installation-root.js";
+import { verifyCheckoutIdentity } from "../../runtime/checkout-identity.js";
+import { inspectArtifactSigningRequests } from "./intake.js";
+import { signDetachedArtifactRequests } from "./detached.js";
+import { finalizeNativeArtifactSigningResult } from "./native-result.js";
+import {
+  signNativeRequest,
+  qualifySigningDelivery,
+} from "./authority-transaction.js";
+import { safeSigningId } from "./files.js";
+const get = (core, name) => core.getInput(name, { required: true });
+function context(core, env, needsItem = false) {
+  const workspace = path.resolve(env.GITHUB_WORKSPACE),
+    runtimeRoot = installationRoot(import.meta.url);
+  if (fs.realpathSync(workspace) !== fs.realpathSync(runtimeRoot))
+    throw new Error(
+      "Signing authority must execute its checked-out source implementation",
+    );
+  verifyCheckoutIdentity({
+    directory: runtimeRoot,
+    sha: env.GITHUB_SHA,
+    label: "Signing authority source",
+  });
+  const request = JSON.parse(get(core, "request-json")),
+    item = needsItem ? JSON.parse(get(core, "item-json")) : undefined;
+  if (item && item.slug !== safeSigningId(item.id))
+    throw new Error(
+      "Signing matrix slug differs from its sealed artifact identifier",
+    );
+  return {
+    workspace,
+    runtimeRoot,
+    request,
+    item,
+    requestRoot: path.join(workspace, ".buildchain/authority-intake"),
+    ...(item
+      ? {
+          outputRoot: path.join(
+            workspace,
+            ".buildchain/provider-results",
+            item.slug,
+          ),
+          workRoot: path.join(workspace, ".buildchain/native-work", item.slug),
+        }
+      : {}),
+  };
+}
+export function admitSigningRequestsAction(core, env) {
+  const { requestRoot, request } = context(core, env);
+  const matrices = inspectArtifactSigningRequests({
+    inputRoot: requestRoot,
+    expectedRepository: request["source-repository"],
+    expectedRuntimeSha: request["expected-runtime-sha"],
+    expectedRequestRoot: request["expected-request-root"],
+  });
+  for (const [key, value] of Object.entries(matrices))
+    core.setOutput(`${key}-matrix`, JSON.stringify(value));
+  core.setOutput(
+    "request-count",
+    String(
+      Object.values(matrices).reduce(
+        (count, entries) => count + entries.length,
+        0,
+      ),
+    ),
+  );
+}
+export function signDetachedRequestsAction(core, env) {
+  const { requestRoot, outputRoot, item } = context(core, env, true);
+  if (
+    typeof item.indexRoot !== "string" ||
+    path.isAbsolute(item.indexRoot) ||
+    item.indexRoot.split(/[\\/]/).includes("..")
+  )
+    throw new Error("Detached request index escapes authority intake");
+  return signDetachedArtifactRequests({
+    inputRoot: path.join(requestRoot, item.indexRoot),
+    outputRoot,
+    artifactId: item.id,
+    privateKeyBase64: get(core, "private-key-base64"),
+    keyId: get(core, "key-id"),
+  });
+}
+function nativeInput(core, env, profile) {
+  const input = context(core, env, true);
+  return {
+    ...input,
+    requestPath: input.item.request,
+    artifactId: input.item.id,
+    profile,
+    environment: env,
+    expectedRunId: env.GITHUB_RUN_ID,
+    expectedRunAttempt: env.GITHUB_RUN_ATTEMPT,
+  };
+}
+export async function signMacosRequestAction(core, env) {
+  if (process.platform !== "darwin")
+    throw new Error("Apple signing requires a macOS runner");
+  return signNativeRequest({
+    ...nativeInput(core, env, "apple-developer-id"),
+    credentials: {
+      certificateBase64: get(core, "certificate-base64"),
+      certificatePassword: get(core, "certificate-password"),
+      certificateSha1: get(core, "certificate-sha1"),
+      teamId: get(core, "team-id"),
+      notaryKeyBase64: get(core, "notary-key-base64"),
+      notaryKeyId: get(core, "notary-key-id"),
+      notaryIssuer: get(core, "notary-issuer"),
+    },
+  });
+}
+export async function signWindowsRequestAction(core, env) {
+  if (process.platform !== "win32")
+    throw new Error("Authenticode signing requires a Windows runner");
+  return signNativeRequest({
+    ...nativeInput(core, env, "windows-authenticode"),
+    credentials: {
+      certificateBase64: get(core, "certificate-base64"),
+      certificatePassword: get(core, "certificate-password"),
+      certificateSha1: get(core, "certificate-sha1"),
+      timestampUrl: get(core, "timestamp-url"),
+    },
+  });
+}
+export function sealNativeResultAction(core, env) {
+  const { requestRoot, outputRoot, item } = context(core, env, true);
+  return finalizeNativeArtifactSigningResult({
+    requestRoot,
+    requestPath: item.request,
+    outputRoot,
+    signedPayload: get(core, "signed-payload"),
+    evidencePath: get(core, "evidence-path"),
+    credentialArtifactRoot: get(core, "credential-artifact-root"),
+    expectedRunId: env.GITHUB_RUN_ID,
+    expectedRunAttempt: env.GITHUB_RUN_ATTEMPT,
+  });
+}
+export function qualifySigningDeliveryAction(core, env) {
+  const { workspace, requestRoot } = context(core, env);
+  return qualifySigningDelivery({
+    requestRoot,
+    inputRoot: path.join(workspace, ".buildchain/provider-results"),
+    outputRoot: path.join(workspace, ".buildchain/authority-result"),
+  });
+}

package/packages/core/build/signing/authority-transaction.js

@@ -0,0 +1,82 @@
+import path from "node:path";
+import { materializeArtifactSigningRequest } from "./materialize.js";
+import { finalizeNativeArtifactSigningResult } from "./native-result.js";
+import { mergeArtifactSigningResults } from "./merge-results.js";
+import { verifyArtifactSigningResults } from "./verify-results.js";
+import {
+  signMacosPayload,
+  signWindowsPayload,
+} from "../../providers/signing/native.js";
+export async function signNativeRequest(
+  {
+    requestRoot,
+    requestPath,
+    outputRoot,
+    workRoot,
+    runtimeRoot,
+    profile,
+    artifactId,
+    credentials,
+    environment,
+    expectedRunId,
+    expectedRunAttempt,
+  },
+  {
+    materialize = materializeArtifactSigningRequest,
+    macos = signMacosPayload,
+    windows = signWindowsPayload,
+    seal = finalizeNativeArtifactSigningResult,
+  } = {},
+) {
+  const providers = {
+      "apple-developer-id": macos,
+      "windows-authenticode": windows,
+    },
+    provider = providers[profile];
+  if (!provider) throw new Error("Unsupported native signing profile");
+  const payload = path.join(
+      workRoot,
+      profile === "windows-authenticode"
+        ? "signed-payload.exe"
+        : "signed-payload",
+    ),
+    evidencePath = path.join(workRoot, "provider-evidence.json");
+  const { request } = materialize({
+    requestRoot,
+    requestPath,
+    expectedProfile: profile,
+    outputPath: payload,
+  });
+  if (request.artifact.id !== artifactId)
+    throw new Error(
+      "Native signing request differs from its admitted artifact",
+    );
+  await provider({
+    runtimeRoot,
+    payload,
+    evidencePath,
+    artifact: request.artifact,
+    signature: request.signature,
+    credentials,
+    environment,
+  });
+  return seal({
+    requestRoot,
+    requestPath,
+    signedPayload: payload,
+    evidencePath,
+    outputRoot,
+    expectedRunId,
+    expectedRunAttempt,
+  });
+}
+export function qualifySigningDelivery(
+  { requestRoot, inputRoot, outputRoot },
+  {
+    merge = mergeArtifactSigningResults,
+    verify = verifyArtifactSigningResults,
+  } = {},
+) {
+  merge({ inputRoot, outputRoot });
+  return verify({ requestRoot, resultRoot: outputRoot });
+}