@kungfu-tech/buildchain 4.1.0-alpha.0 → 4.1.0-alpha.2

package/packages/core/contracts/runtime-contract-action.js

@@ -1,48 +0,0 @@
-import fs from "node:fs";
-import path from "node:path";
-import {
-  inspectRuntimeContract,
-  assertRuntimeContractAccepted,
-} from "./runtime-contract-inspection.js";
-import { resolveBuildchainContractLockPath } from "./buildchain-layout.js";
-
-export function runtimeContractAction(core, env) {
-  const workspace = env.GITHUB_WORKSPACE;
-  if (!path.isAbsolute(workspace || ""))
-    throw new Error("Runtime contract check requires the runner workspace");
-  const input = JSON.parse(core.getInput("request-json", { required: true }));
-  const runtimeRoot = path.join(workspace, ".buildchain/runtime");
-  const result = inspectRuntimeContract({
-    lockPath: path.resolve(
-      workspace,
-      input["buildchain-contract-lock-path"] ||
-        resolveBuildchainContractLockPath(workspace),
-    ),
-    currentContractPath: path.join(
-      runtimeRoot,
-      "dist/site/buildchain-contract.json",
-    ),
-    runtimeRoot,
-    runtimeRef: core.getInput("runtime-ref"),
-    runtimeSha: core.getInput("runtime-sha"),
-    runtimeClass: core.getInput("runtime-class"),
-    workflowShellRef: core.getInput("workflow-ref"),
-    allowOpaqueRuntime: core.getBooleanInput("runtime-override"),
-    compatibilityPolicy: input["buildchain-contract-compatibility-policy"],
-    expectedChannel: input["buildchain-contract-expected-channel"],
-    expectedMajor: input["buildchain-contract-expected-major"],
-    issueMode: input["buildchain-contract-drift-issue-mode"],
-    issueBodyPath: path.join(
-      workspace,
-      ".buildchain/contract-drift/issue-body.md",
-    ),
-    repository: env.GITHUB_REPOSITORY,
-    workflow: env.GITHUB_WORKFLOW,
-    runUrl: `${env.GITHUB_SERVER_URL}/${env.GITHUB_REPOSITORY}/actions/runs/${env.GITHUB_RUN_ID}`,
-  });
-  if (env.GITHUB_STEP_SUMMARY)
-    fs.appendFileSync(env.GITHUB_STEP_SUMMARY, result.summary + "\n\n");
-  for (const [key, value] of Object.entries(result.outputs))
-    core.setOutput(key, value);
-  assertRuntimeContractAccepted(result);
-}

package/packages/core/release/commands/promotion-identity-resolver.mjs

@@ -1,77 +0,0 @@
-#!/usr/bin/env node
-import fs from "node:fs";
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-import { resolvePromotionIdentities } from "../promotion/identities.js";
-const normalized = value => String(value ?? "").trim();
-function parseArgs(argv) {
-  const values = {};
-  for (let index = 0; index < argv.length; index += 1) {
-    const token = argv[index];
-    if (!token.startsWith("--")) throw new Error(`unexpected argument: ${token}`);
-    const value = argv[index + 1];
-    if (value === undefined || value.startsWith("--")) throw new Error(`missing value for ${token}`);
-    values[token.slice(2)] = value;
-    index += 1;
-  }
-  return values;
-}
-
-function repositoryParts(value) {
-  const match = normalized(value).match(/^([^/]+)\/([^/]+)$/);
-  if (!match) throw new Error("repository must use owner/name form");
-  return { owner: match[1], repo: match[2] };
-}
-
-async function githubCommitResolver({ repository, token }) {
-  const { owner, repo } = repositoryParts(repository);
-  return async (ref) => {
-    const response = await fetch(
-      `https://api.github.com/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}/commits/${encodeURIComponent(ref)}`,
-      {
-        headers: {
-          Accept: "application/vnd.github+json",
-          Authorization: `Bearer ${token}`,
-          "X-GitHub-Api-Version": "2022-11-28",
-          "User-Agent": "kungfu-buildchain-promotion-router",
-        },
-      },
-    );
-    if (!response.ok) throw new Error(`unable to resolve ${ref}: GitHub API returned ${response.status}`);
-    return (await response.json()).sha;
-  };
-}
-
-function writeOutputs(file, identities) {
-  const outputs = {
-    "router-sha": identities.routerSha,
-    "shell-call-ref": identities.shellCallRef,
-    "shell-sha": identities.shellSha,
-    "runtime-sha": identities.runtimeSha,
-  };
-  fs.appendFileSync(file, Object.entries(outputs).map(([key, value]) => `${key}=${value}\n`).join(""));
-}
-
-async function main() {
-  const args = parseArgs(process.argv.slice(2));
-  const token = normalized(process.env.GITHUB_TOKEN);
-  if (!token) throw new Error("GITHUB_TOKEN is required to resolve floating promotion refs");
-  const identities = await resolvePromotionIdentities({
-    routerRef: args["router-ref"],
-    routerSha: args["router-sha"],
-    shellRef: args["shell-ref"],
-    shellCallRef: args["shell-call-ref"],
-    runtimeRef: args["runtime-ref"],
-    resolveRef: await githubCommitResolver({ repository: args.repository, token }),
-  });
-  if (process.env.GITHUB_OUTPUT) writeOutputs(process.env.GITHUB_OUTPUT, identities);
-  process.stdout.write(`${JSON.stringify(identities, null, 2)}\n`);
-}
-
-const isMain = process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url);
-if (isMain) {
-  main().catch((error) => {
-    console.error(`promotion-identity-resolver: ${error.message}`);
-    process.exitCode = 1;
-  });
-}

package/packages/core/release/commands/verify-promotion-router-binding.sh

@@ -1,36 +0,0 @@
-#!/bin/bash
-set -euo pipefail
-
-for name in ROUTER_REF ROUTER_SHA SHELL_REF SHELL_SHA RUNTIME_REF RUNTIME_SHA LOCK_PATH LOCK_DIGEST PUBLICATION_CHANNEL ROUTED_TARGET_REF; do
-  if [[ -z "${!name}" ]]; then
-    echo "::error::Incomplete promotion router binding: ${name} is empty"
-    exit 1
-  fi
-done
-
-router_sha="$(git -C .buildchain/promotion-router rev-parse HEAD)"
-shell_sha="$(git -C .buildchain/runtime/promotion-shell rev-parse HEAD)"
-runtime_sha="$(git -C .buildchain/runtime rev-parse HEAD)"
-expected_router_sha="${ROUTER_SHA:-}"
-expected_shell_sha="${SHELL_SHA:-}"
-expected_runtime_sha="${RUNTIME_SHA:-}"
-expected_lock_digest="${LOCK_DIGEST:-}"
-lock_file=".buildchain/promotion-source/${LOCK_PATH}"
-if [[ ! -f "${lock_file}" ]]; then
-  echo "::error::Selected promotion contract lock is missing: ${LOCK_PATH}"
-  exit 1
-fi
-lock_digest="sha256:$(shasum -a 256 "${lock_file}" | awk '{print $1}')"
-[[ "${router_sha}" = "${expected_router_sha}" ]] || { echo "::error::Promotion router SHA mismatch"; exit 1; }
-[[ "${shell_sha}" = "${expected_shell_sha}" ]] || { echo "::error::Promotion shell SHA mismatch"; exit 1; }
-[[ "${runtime_sha}" = "${expected_runtime_sha}" ]] || { echo "::error::Promotion runtime SHA mismatch"; exit 1; }
-[[ "${lock_digest}" = "${expected_lock_digest}" ]] || { echo "::error::Promotion contract-lock digest mismatch"; exit 1; }
-[[ "${ACTUAL_RUNTIME_SHA}" = "${RUNTIME_SHA}" ]] || { echo "::error::Promotion runtime SHA mismatch"; exit 1; }
-[[ "${ACTUAL_LOCK_PATH}" = "${LOCK_PATH}" ]] || { echo "::error::Promotion contract-lock path mismatch"; exit 1; }
-[[ "${ACTUAL_CHANNEL}" = "${PUBLICATION_CHANNEL}" ]] || { echo "::error::Promotion publication channel mismatch"; exit 1; }
-[[ "${ACTUAL_TARGET_REF}" = "${ROUTED_TARGET_REF}" ]] || { echo "::error::Promotion target ref mismatch"; exit 1; }
-[[ "${CALLED_WORKFLOW_SHA}" = "${SHELL_SHA}" ]] || { echo "::error::Called promotion shell SHA mismatch"; exit 1; }
-called_ref="${CALLED_WORKFLOW_REF##*@}"
-called_ref="${called_ref#refs/heads/}"
-called_ref="${called_ref#refs/tags/}"
-[[ "${called_ref}" = "${SHELL_REF}" ]] || { echo "::error::Called promotion shell ref ${called_ref} does not match ${SHELL_REF}"; exit 1; }

package/packages/core/release/promotion/identities.js

@@ -1,56 +0,0 @@
-const SHA_PATTERN = /^[0-9a-f]{40}$/i;
-
-function normalized(value) {
-  return String(value ?? "").trim();
-}
-
-function requireSha(value, label) {
-  const sha = normalized(value).toLowerCase();
-  if (!SHA_PATTERN.test(sha))
-    throw new Error(`${label} must be an exact 40-character SHA`);
-  return sha;
-}
-
-export async function resolvePromotionIdentities({
-  routerRef,
-  routerSha,
-  shellRef,
-  shellCallRef,
-  runtimeRef,
-  resolveRef,
-} = {}) {
-  const requested = {
-    router: normalized(routerRef),
-    shell: normalized(shellRef),
-    shellCall: normalized(shellCallRef),
-    runtime: normalized(runtimeRef),
-  };
-  if (Object.values(requested).some((value) => !value)) {
-    throw new Error("router, shell, shell call, and runtime refs are required");
-  }
-  if (typeof resolveRef !== "function")
-    throw new Error("resolveRef must be a function");
-
-  const immutableRouterSha = requireSha(routerSha, "router SHA");
-  const resolved = new Map([[requested.router, immutableRouterSha]]);
-  const resolveOnce = async (ref) => {
-    if (SHA_PATTERN.test(ref)) return ref.toLowerCase();
-    if (!resolved.has(ref)) {
-      resolved.set(
-        ref,
-        requireSha(await resolveRef(ref), `resolved SHA for ${ref}`),
-      );
-    }
-    return resolved.get(ref);
-  };
-
-  return {
-    routerRef: requested.router,
-    routerSha: immutableRouterSha,
-    shellRef: requested.shell,
-    shellCallRef: requested.shellCall,
-    shellSha: await resolveOnce(requested.shellCall),
-    runtimeRef: requested.runtime,
-    runtimeSha: await resolveOnce(requested.runtime),
-  };
-}

package/packages/core/release/runtime-override-authorization.js

@@ -1,242 +0,0 @@
-import fs from "node:fs";
-import path from "node:path";
-import { execFileSync } from "node:child_process";
-import * as runtime from "../consumer/runtime-ref-resume-authority.js";
-
-const EXACT_SHA = /^[0-9a-f]{40}$/u;
-const OFFICIAL_REF = /^v4(?:-alpha)?$/u;
-const GOVERNED_REF = /^(?:train|authority)\/v4\/v4\.\d+\/[A-Za-z0-9._/-]+$/u;
-
-function normalizeRef(value) {
-  return String(value || "")
-    .trim()
-    .replace(/^refs\/(?:heads|tags)\//u, "");
-}
-
-async function readProviderRef({ github, owner, repo, ref }) {
-  let response;
-  for (const namespace of ["heads", "tags"]) {
-    try {
-      response = await github.rest.git.getRef({
-        owner,
-        repo,
-        ref: `${namespace}/${ref}`,
-      });
-      break;
-    } catch (error) {
-      if (error?.status !== 404) throw error;
-    }
-  }
-  if (!response) return undefined;
-  return {
-    ref,
-    sha: String(response.data.object.sha || "").toLowerCase(),
-    providerRef: response.data.ref || `refs/heads/${ref}`,
-  };
-}
-
-async function containsCommit({ github, owner, repo, headSha, runtimeSha }) {
-  if (headSha === runtimeSha) return true;
-  const comparison = await github.rest.repos.compareCommitsWithBasehead({
-    owner,
-    repo,
-    basehead: `${runtimeSha}...${headSha}`,
-  });
-  return ["ahead", "identical"].includes(comparison.data.status);
-}
-
-function permissionLevel(permission) {
-  const declaredLevel = permission.data.permission;
-  const userPermissions = permission.data.user?.permissions;
-  return (
-    (typeof declaredLevel === "string" && declaredLevel) ||
-    (typeof userPermissions === "string" && userPermissions) ||
-    (userPermissions?.admin && "admin") ||
-    (userPermissions?.maintain && "maintain") ||
-    (userPermissions?.push && "write") ||
-    (userPermissions?.triage && "triage") ||
-    (userPermissions?.pull && "read") ||
-    "none"
-  );
-}
-
-async function requireTrustedActor({ github, context }) {
-  if (context.eventName !== "workflow_dispatch") {
-    throw new Error(
-      "promotion runtime override is only allowed for trusted workflow_dispatch runs",
-    );
-  }
-  const permission = await github.rest.repos.getCollaboratorPermissionLevel({
-    owner: context.repo.owner,
-    repo: context.repo.repo,
-    username: context.actor,
-  });
-  const level = permissionLevel(permission);
-  if (!["write", "maintain", "admin"].includes(level)) {
-    throw new Error(
-      `promotion runtime override requires write, maintain, or admin permission; actor has ${level}`,
-    );
-  }
-  return { actor: context.actor, permission: level };
-}
-
-function normalizeRequestedSelection(request) {
-  const requestedRef = normalizeRef(request.requestedRef);
-  const runtimeSha = String(request.resolvedRuntimeSha || "")
-    .trim()
-    .toLowerCase();
-  if (!EXACT_SHA.test(runtimeSha)) {
-    throw new Error("resolved runtime must be an exact 40-character Git SHA");
-  }
-  if (
-    !EXACT_SHA.test(requestedRef.toLowerCase()) &&
-    !OFFICIAL_REF.test(requestedRef) &&
-    !GOVERNED_REF.test(requestedRef)
-  ) {
-    throw new Error(
-      "requested runtime ref is outside the v4 authority boundary",
-    );
-  }
-  return { requestedRef, runtimeSha };
-}
-
-function normalizeRuntimeRepository(request, context) {
-  const repository = String(
-    request.runtimeRepository || `${context.repo.owner}/${context.repo.repo}`,
-  ).split("/");
-  if (
-    repository.length !== 2 ||
-    repository.some((part) => !/^[A-Za-z0-9_.-]+$/u.test(part))
-  ) {
-    throw new Error("runtimeRepository must be owner/repository");
-  }
-  return { owner: repository[0], repo: repository[1] };
-}
-
-async function approvedRuntimeRefReadbacks({
-  github,
-  runtime,
-  runtimeRepository,
-  requestedRef,
-  runtimeSha,
-}) {
-  const refs = new Set(["v4", "v4-alpha"]);
-  if (GOVERNED_REF.test(requestedRef)) refs.add(requestedRef);
-  const approvedRefReadbacks = [];
-  for (const ref of [...refs].sort()) {
-    const readback = await readProviderRef({
-      github,
-      ...runtimeRepository,
-      ref,
-    });
-    if (!readback) continue;
-    const containsRuntimeSha = await containsCommit({
-      github,
-      ...runtimeRepository,
-      headSha: readback.sha,
-      runtimeSha,
-    });
-    approvedRefReadbacks.push({
-      ref,
-      sha: readback.sha,
-      containsRuntimeSha,
-      readbackRoot: runtime.runtimeResumeDocumentRoot({
-        provider: "github",
-        repository: `${runtimeRepository.owner}/${runtimeRepository.repo}`,
-        providerRef: readback.providerRef,
-        sha: readback.sha,
-        runtimeSha,
-        containsRuntimeSha,
-      }),
-    });
-  }
-  return approvedRefReadbacks;
-}
-
-function writeAuthorization(outputPath, authorization) {
-  if (!outputPath) return;
-  const output = path.resolve(outputPath);
-  fs.mkdirSync(path.dirname(output), { recursive: true });
-  fs.writeFileSync(output, `${JSON.stringify(authorization, null, 2)}\n`);
-}
-
-function trackedRuntimePersistencePaths(consumerRoot) {
-  return execFileSync(
-    "git",
-    [
-      "-C",
-      consumerRoot,
-      "ls-files",
-      "--",
-      ".github/workflows",
-      "actions",
-      ".buildchain",
-    ],
-    { encoding: "utf8" },
-  )
-    .split(/\r?\n/u)
-    .filter((entry) => /\.(?:json|toml|ya?ml)$/u.test(entry));
-}
-
-export async function authorizePromotionRuntimeOverride({
-  github,
-  context,
-  request = undefined,
-}) {
-  const actor = await requireTrustedActor({ github, context });
-  if (!request) return actor;
-
-  const { requestedRef, runtimeSha } = normalizeRequestedSelection(request);
-  const consumerRoot = path.resolve(request.consumerRoot || process.cwd());
-  const policyDocument = JSON.parse(
-    fs.readFileSync(path.resolve(request.consumerPolicyReceiptPath), "utf8"),
-  );
-  const policyReceipt = policyDocument.receipt || policyDocument;
-  const persistenceScan = runtime.scanRuntimeSelectorPersistence({
-    root: consumerRoot,
-    paths: trackedRuntimePersistencePaths(consumerRoot),
-  });
-  if (persistenceScan.status !== "passed") {
-    throw new Error(
-      "runtime selector persistence scan rejected the consumer source",
-    );
-  }
-
-  const runtimeRepository = normalizeRuntimeRepository(request, context);
-  const approvedRefReadbacks = await approvedRuntimeRefReadbacks({
-    github,
-    runtime,
-    runtimeRepository,
-    requestedRef,
-    runtimeSha,
-  });
-  const sourceTreeSha = String(
-    request.sourceTreeSha ||
-      execFileSync("git", ["-C", consumerRoot, "rev-parse", "HEAD^{tree}"], {
-        encoding: "utf8",
-      }),
-  )
-    .trim()
-    .toLowerCase();
-  const authorization = runtime.authorizeRuntimeSelection({
-    repository: `${context.repo.owner}/${context.repo.repo}`,
-    eventName: context.eventName,
-    mode: request.mode || "dispatch",
-    actor: context.actor,
-    actorPermission: actor.permission,
-    reason: request.reason,
-    authorizedAt: request.authorizedAt || new Date().toISOString(),
-    sourceSha: request.sourceSha || context.sha,
-    sourceTreeSha,
-    requestedRef,
-    resolvedRuntimeSha: runtimeSha,
-    approvedRefReadbacks,
-    stableContractLockRoot: policyReceipt.contractLocks?.stable?.root,
-    alphaContractLockRoot: policyReceipt.contractLocks?.alpha?.root,
-    consumerPolicyReceiptRoot:
-      request.consumerPolicyReceiptRoot || policyDocument.receiptRoot,
-    persistenceScan,
-  });
-  writeAuthorization(request.outputPath, authorization);
-  return { ...actor, ...authorization, persistenceScan };
-}

package/packages/core/runtime/commands/runtime-ref-core.mjs

@@ -1,171 +0,0 @@
-import { parseBuildchainRefIdentity } from "../../consumer/buildchain-channel-identity.js";
-
-const EXACT_SHA_RE = /^[0-9a-f]{40}$/i;
-const TRAIN_REF_RE = /^train\/v\d+\/v\d+\.\d+\/[A-Za-z0-9._/-]+$/;
-const AUTHORITY_REF_RE = /^authority\/v\d+\/v\d+\.\d+\/[A-Za-z0-9._/-]+$/;
-const OFFICIAL_CHANNEL_REF_RE = /^v\d+(?:\.\d+)?(?:-alpha)?$/;
-
-export function parseWorkflowShellRef(workflowRef = "", fallback = "v3", buildchainRepository = "kungfu-systems/buildchain") {
-  const value = String(workflowRef || "");
-  const expectedPrefix = `${buildchainRepository}/.github/workflows/`;
-  if (!value.startsWith(expectedPrefix)) {
-    return fallback;
-  }
-  const ref = value.split("@").pop()?.trim();
-  return (ref || fallback).replace(/^refs\/(?:heads|tags)\//, "");
-}
-
-export function classifyBuildchainRuntimeRef(ref = "") {
-  const identity = parseBuildchainRefIdentity(ref);
-  return identity.channel || (identity.kind === "missing" ? "development" : identity.kind);
-}
-
-export function isOfficialBuildchainChannelRef(ref = "") {
-  const value = String(ref || "").trim().replace(/^refs\/tags\//, "");
-  return OFFICIAL_CHANNEL_REF_RE.test(value);
-}
-
-export function normalizeRequestedRuntimeRef(requestedRef = "") {
-  const requested = String(requestedRef || "").trim();
-  if (!requested) {
-    return { ref: "", fullRef: "", class: "", exactSha: false, officialChannel: false };
-  }
-  if (isOfficialBuildchainChannelRef(requested)) {
-    const channelRef = requested.replace(/^refs\/tags\//, "");
-    return {
-      ref: channelRef,
-      fullRef: channelRef,
-      class: classifyBuildchainRuntimeRef(channelRef),
-      exactSha: false,
-      officialChannel: true,
-    };
-  }
-  if (EXACT_SHA_RE.test(requested)) {
-    return {
-      ref: requested,
-      fullRef: requested,
-      class: "exact-sha",
-      exactSha: true,
-      officialChannel: false,
-    };
-  }
-  const protectedRef = requested.replace(/^refs\/heads\//, "");
-  if (!TRAIN_REF_RE.test(protectedRef) && !AUTHORITY_REF_RE.test(protectedRef)) {
-    throw new Error(
-      "buildchain-ref override must be train/vN/vN.M/<capability>, refs/heads/train/vN/vN.M/<capability>, authority/vN/vN.M/<capability>, refs/heads/authority/vN/vN.M/<capability>, or an exact 40-character SHA",
-    );
-  }
-  return {
-    ref: protectedRef,
-    fullRef: `refs/heads/${protectedRef}`,
-    class: AUTHORITY_REF_RE.test(protectedRef) ? "authority" : "train",
-    exactSha: false,
-    officialChannel: false,
-  };
-}
-
-export function resolveRuntimeSelection({
-  requestedRef = "",
-  workflowRef = "",
-  defaultStableRef = "v3",
-  buildchainRepository = "kungfu-systems/buildchain",
-} = {}) {
-  const requested = String(requestedRef || "").trim();
-  const workflowShellRef = parseWorkflowShellRef(workflowRef, defaultStableRef, buildchainRepository);
-  if (!requested) {
-    return {
-      requestedRef: "",
-      runtimeRef: workflowShellRef || defaultStableRef,
-      runtimeFullRef: workflowShellRef || defaultStableRef,
-      runtimeClass: classifyBuildchainRuntimeRef(workflowShellRef || defaultStableRef),
-      runtimeOverride: false,
-      workflowShellRef: workflowShellRef || defaultStableRef,
-      rollbackRef: workflowShellRef || defaultStableRef,
-      trustDecision: "stable-default",
-    };
-  }
-  const normalized = normalizeRequestedRuntimeRef(requested);
-  const sameRepositoryWorkflow = String(workflowRef || "").startsWith(
-    `${buildchainRepository}/.github/workflows/`,
-  );
-  const pinnedSelfRuntime =
-    sameRepositoryWorkflow &&
-    normalized.exactSha &&
-    EXACT_SHA_RE.test(workflowShellRef) &&
-    normalized.ref.toLowerCase() === workflowShellRef.toLowerCase();
-  const runtimeOverride = !normalized.officialChannel && !pinnedSelfRuntime;
-  return {
-    requestedRef: requested,
-    runtimeRef: normalized.ref,
-    runtimeFullRef: normalized.fullRef,
-    runtimeClass: normalized.class,
-    runtimeOverride,
-    workflowShellRef: workflowShellRef || defaultStableRef,
-    rollbackRef: workflowShellRef || defaultStableRef,
-    trustDecision: normalized.officialChannel
-      ? "official-channel"
-      : pinnedSelfRuntime
-        ? "pinned-self"
-        : "override-requested",
-  };
-}
-
-export function validateRuntimeOverrideTrust({
-  requestedRef = "",
-  eventName = "",
-  eventAction = "",
-  actorPermission = "",
-  sameRepositoryPullRequest = false,
-  sameRepositoryWorkflow = false,
-  pullRequestHeadSha = "",
-  workflowShellSha = "",
-} = {}) {
-  if (!String(requestedRef || "").trim()) {
-    return { ok: true, decision: "stable-default" };
-  }
-  if (isOfficialBuildchainChannelRef(requestedRef)) {
-    return { ok: true, decision: "official-channel" };
-  }
-  const normalizedRequested = String(requestedRef || "").trim().toLowerCase();
-  const normalizedHeadSha = String(pullRequestHeadSha || "").trim().toLowerCase();
-  const normalizedWorkflowShellSha = String(workflowShellSha || "").trim().toLowerCase();
-  if (
-    sameRepositoryWorkflow === true &&
-    EXACT_SHA_RE.test(normalizedRequested) &&
-    EXACT_SHA_RE.test(normalizedWorkflowShellSha) &&
-    normalizedRequested === normalizedWorkflowShellSha
-  ) {
-    return { ok: true, decision: "pinned-self" };
-  }
-  if (
-    eventName === "pull_request" &&
-    eventAction === "closed" &&
-    EXACT_SHA_RE.test(normalizedRequested) &&
-    normalizedRequested === normalizedWorkflowShellSha
-  ) {
-    return { ok: true, decision: "closed-release-pr-shell-runtime" };
-  }
-  if (
-    eventName === "pull_request" &&
-    sameRepositoryPullRequest === true &&
-    EXACT_SHA_RE.test(normalizedRequested) &&
-    normalizedRequested === normalizedHeadSha
-  ) {
-    return { ok: true, decision: "same-repository-pr-head" };
-  }
-  if (eventName !== "workflow_dispatch") {
-    return {
-      ok: false,
-      decision: "rejected-untrusted-event",
-      reason: "buildchain-ref override is only allowed for trusted workflow_dispatch runs",
-    };
-  }
-  if (!new Set(["admin", "maintain", "write"]).has(String(actorPermission || ""))) {
-    return {
-      ok: false,
-      decision: "rejected-insufficient-permission",
-      reason: "buildchain-ref override requires actor write, maintain, or admin permission",
-    };
-  }
-  return { ok: true, decision: "override-accepted" };
-}

package/packages/core/runtime/provider-closure.js

@@ -1,60 +0,0 @@
-import { command, requireValue } from "./action-process.mjs";
-import fs from "node:fs";
-import path from "node:path";
-import { installLockedDependencies } from "./locked-dependencies.js";
-export function verify(env, execute = command) {
-  for (const name of ["RUNTIME_SHA", "RUNTIME_TREE"])
-    requireValue(
-      /^[0-9a-f]{40}$/u.test(env[name] || ""),
-      `${name} must be an immutable 40-hex identity`,
-    );
-  for (const [revision, expected] of [
-    ["HEAD", env.RUNTIME_SHA],
-    ["HEAD^{tree}", env.RUNTIME_TREE],
-  ]) {
-    const actual = execute(
-      "git",
-      ["-C", ".buildchain/runtime", "rev-parse", revision],
-      { stdio: ["ignore", "pipe", "inherit"] },
-    ).trim();
-    requireValue(
-      actual === expected,
-      `Admitted runtime ${revision} does not match the checked-out closure`,
-    );
-  }
-}
-
-export function exposeProviderDependencies(workspace = process.cwd()) {
-  const target = path.resolve(workspace, ".buildchain/runtime/node_modules");
-  const link = path.resolve(workspace, "node_modules");
-  requireValue(
-    fs.statSync(target).isDirectory(),
-    "Verified provider dependencies are missing",
-  );
-  // Existing source-owned dependencies must never be replaced by this boundary.
-  fs.symlinkSync(
-    target,
-    link,
-    process.platform === "win32" ? "junction" : "dir",
-  );
-}
-
-export function activateProviderClosure(identity, ports = {}) {
-  (ports.verify || verify)({
-    RUNTIME_SHA: identity.sha,
-    RUNTIME_TREE: identity.tree,
-  });
-  (ports.install || installLockedDependencies)({
-    directory: ".buildchain/runtime",
-    production: false,
-    ignoreScripts: true,
-  });
-  (ports.expose || exposeProviderDependencies)();
-}
-
-export function providerClosureAction(core) {
-  activateProviderClosure({
-    sha: core.getInput("sha", { required: true }),
-    tree: core.getInput("tree", { required: true }),
-  });
-}