@kungfu-tech/buildchain 4.1.2 → 4.1.3-alpha.0

package/packages/core/release/discussion/reader.js

@@ -0,0 +1,168 @@
+import {
+  ENVELOPE_SCHEMA,
+  INTENT_SCHEMA,
+  PAYLOAD_SCHEMA,
+  decodeRecord,
+  recordDigest,
+  validateRuntime,
+} from "./envelope.js";
+
+// Pure historical reader: no provider access, writes or effect recovery.
+export function readReleaseDiscussion({ body, records }) {
+  const intent = decodeRecord(body);
+  if (intent?.schema !== INTENT_SCHEMA)
+    throw new Error("Missing release Discussion intent");
+  if (
+    intent.id !==
+    recordDigest({ repository: intent.repository, key: intent.key })
+  )
+    throw new Error("Release intent identity mismatch");
+  if (
+    !Array.isArray(intent.expectedNodes) ||
+    !intent.expectedNodes.length ||
+    new Set(intent.expectedNodes).size !== intent.expectedNodes.length
+  )
+    throw new Error("Missing or duplicate expected nodes");
+  const attempts = groupAttempts(validateRecords(intent, records));
+  if (!attempts.size)
+    return {
+      intent,
+      status: "pending",
+      attempts: [],
+      missingNodes: intent.expectedNodes,
+    };
+  const { head, lineage } = resolveLineage(attempts);
+  const nodes = currentNodes(attempts.get(head).events);
+  const missingNodes = intent.expectedNodes.filter((node) => !nodes[node]);
+  const complete = intent.expectedNodes.every(
+    (node) => nodes[node]?.status === "success",
+  );
+  const failed = Object.values(nodes).some((event) =>
+    ["failure", "cancelled"].includes(event.status),
+  );
+  return {
+    intent,
+    attempt: head,
+    attempts: lineage.reverse(),
+    nodes,
+    missingNodes,
+    status: complete ? "complete" : failed ? "failed" : "running",
+    handoff: {
+      schema: "buildchain.release-handoff/v1",
+      intent: intent.id,
+      predecessor: head,
+      completedNodes: intent.expectedNodes.filter(
+        (node) => nodes[node]?.status === "success",
+      ),
+    },
+  };
+}
+
+function validateRecords(intent, records) {
+  const events = new Map();
+  for (const raw of records) {
+    const event = typeof raw === "string" ? decodeRecord(raw) : raw;
+    if (!event) continue;
+    validateRuntime(event.runtime);
+    if (
+      !["progress", "checkpoint"].includes(event.kind) ||
+      !event.writer ||
+      !event.attempt ||
+      typeof event.predecessor !== "string"
+    )
+      throw new Error("Invalid record ownership");
+    const { id, ...content } = event;
+    if (
+      event.schema !== ENVELOPE_SCHEMA ||
+      event.payloadSchema !== PAYLOAD_SCHEMA
+    )
+      throw new Error("Record requires its historical runtime reader");
+    if (event.intent !== intent.id || id !== recordDigest(content))
+      throw new Error("Release record identity mismatch");
+    if (event.node !== "attempt" && !intent.expectedNodes.includes(event.node))
+      throw new Error("Undeclared release node");
+    if (
+      !["running", "success", "failure", "cancelled"].includes(event.status) ||
+      !Number.isSafeInteger(event.sequence) ||
+      event.sequence < 0
+    )
+      throw new Error("Invalid release progress");
+    events.set(id, event);
+  }
+  return events;
+}
+
+function groupAttempts(events) {
+  const attempts = new Map();
+  for (const event of events.values()) {
+    const attempt = attempts.get(event.attempt) || {
+      predecessor: event.predecessor,
+      events: [],
+    };
+    if (attempt.predecessor !== event.predecessor)
+      throw new Error("Conflicting workflow attempt identity");
+    attempt.events.push(event);
+    attempts.set(event.attempt, attempt);
+  }
+  return attempts;
+}
+
+function resolveLineage(attempts) {
+  const predecessors = new Set(
+    [...attempts.values()]
+      .map((attempt) => attempt.predecessor)
+      .filter(Boolean),
+  );
+  for (const predecessor of predecessors)
+    if (!attempts.has(predecessor))
+      throw new Error("Recovery predecessor is missing");
+  const heads = [...attempts.keys()].filter((id) => !predecessors.has(id));
+  if (heads.length !== 1)
+    throw new Error("Release attempt succession is ambiguous or cyclic");
+  const lineage = [];
+  let current = heads[0];
+  while (current) {
+    if (lineage.includes(current)) throw new Error("Cyclic recovery chain");
+    lineage.push(current);
+    current = attempts.get(current).predecessor;
+  }
+  if (lineage.length !== attempts.size)
+    throw new Error("Disconnected recovery chain");
+  return { head: heads[0], lineage };
+}
+
+function currentNodes(events) {
+  const nodes = {},
+    sequences = new Map();
+  // Reuse is explicit and independently qualified by the recovering runtime.
+  for (const event of events) {
+    if (event.kind === "checkpoint") continue;
+    const key = `${event.node}:${event.sequence}`;
+    if (sequences.has(key) && sequences.get(key) !== event.id)
+      throw new Error("Conflicting node progress at the same sequence");
+    sequences.set(key, event.id);
+    const old = nodes[event.node];
+    if (!old || old.sequence < event.sequence) nodes[event.node] = event;
+  }
+  return nodes;
+}
+
+// Workflow outputs carry a bounded projection, never the complete comment log.
+export function discussionStatus(state) {
+  return {
+    discussionId: state.discussion.id,
+    discussionUrl: state.discussion.url,
+    intent: state.intent.id,
+    status: state.status,
+    attempt: state.attempt || "",
+    attempts: state.attempts,
+    missingNodes: state.missingNodes,
+    handoff: state.handoff || null,
+    nodes: Object.fromEntries(
+      Object.entries(state.nodes || {}).map(([node, record]) => [
+        node,
+        { status: record.status, recordId: record.id, writer: record.writer },
+      ]),
+    ),
+  };
+}

package/packages/core/release/discussion/recovery.js

@@ -0,0 +1,132 @@
+import fs from "node:fs";
+import path from "node:path";
+import { getOctokit } from "@actions/github";
+import { decodeRecord } from "./envelope.js";
+import { releaseDiscussionStore } from "./store.js";
+import { discussionTransport } from "../../providers/github/discussions/transport.js";
+import { releaseCheckpoints, restoreRecoveryMaterials } from "./checkpoints.js";
+import { validateReleaseCandidatePassport } from "../release-candidate.js";
+import {
+  assertCandidateEvidenceBinding,
+  aggregateReleasePassport,
+  observeProtectedPublicationSource,
+} from "../promote-candidate/evidence-binding.js";
+
+export async function recoverDiscussionCandidate({
+  discussionId,
+  repository,
+  token,
+  outputDir,
+  targetSha,
+  targetRef,
+}) {
+  const octokit = getOctokit(token);
+  const transport = discussionTransport(octokit.graphql);
+  const discussion = await transport.get(discussionId);
+  const intent = decodeRecord(discussion.body);
+  if (
+    intent?.repository !== repository ||
+    discussion.author?.__typename !== "Bot" ||
+    discussion.author.login !== "github-actions"
+  )
+    throw new Error(
+      "Recovery requires the consumer workflow's original Discussion",
+    );
+  const session = { discussion, intent, writerId: discussion.author.id };
+  const store = releaseDiscussionStore(transport);
+  const observed = await store.read(session);
+  const snapshots = observed.records
+    .filter(
+      (record) =>
+        record.kind === "checkpoint" && record.node === "qualification",
+    )
+    .sort(
+      (a, b) =>
+        observed.attempts.indexOf(b.attempt) -
+          observed.attempts.indexOf(a.attempt) || b.sequence - a.sequence,
+    );
+  if (!snapshots.length)
+    throw new Error("Discussion has no retained qualified recovery material");
+  const retained = releaseCheckpoints({ session, store, octokit });
+  const manifest = await retained.readCheckpoint(snapshots[0]);
+  if (
+    manifest.source?.repository !== repository ||
+    manifest.source.version !== intent.key ||
+    manifest.source.targetRef !== targetRef
+  )
+    throw new Error("Recovery material belongs to a different release intent");
+  const workspace = path.resolve(outputDir, "../..");
+  const prefix =
+    path
+      .relative(workspace, path.resolve(outputDir))
+      .split(path.sep)
+      .join("/") + "/";
+  if (!manifest.files.every((file) => file.path.startsWith(prefix)))
+    throw new Error(
+      "Candidate recovery cannot restore files outside its evidence directory",
+    );
+  const inputs = await restoreRecoveryMaterials(
+    manifest,
+    workspace,
+    retained.materials,
+  );
+  const read = (file) => JSON.parse(fs.readFileSync(file, "utf8"));
+  const candidate = read(inputs["candidate-passport-path"]),
+    summary = read(inputs["candidate-build-summary-path"]);
+  const validation = validateReleaseCandidatePassport({
+    passport: candidate,
+    repository,
+    buildSummary: summary,
+  });
+  if (!validation.ok)
+    throw new Error(
+      `Recovered candidate is invalid: ${validation.errors.join("; ")}`,
+    );
+  const stageCapsules = read(inputs["stage-capsules-path"]),
+    qualification = read(inputs["publication-qualification-path"]);
+  assertCandidateEvidenceBinding({ candidate, stageCapsules, repository });
+  const sourceBinding = await observeProtectedPublicationSource({
+    octokit,
+    repository,
+    protectedSourceSha: targetSha,
+    candidate,
+  });
+  aggregateReleasePassport({
+    candidate,
+    stageCapsules,
+    qualification,
+    sourceBinding,
+    version: intent.key,
+    tag: `v${intent.key}`,
+    channel: manifest.source.channel,
+  });
+  // The shared candidate provider performs artifact-kind-specific sealed verification
+  // before effects; transport restoration verifies every retained file digest.
+  const paths = {
+    passport: inputs["candidate-passport-path"],
+    buildSummary: inputs["candidate-build-summary-path"],
+    stageCapsules: inputs["stage-capsules-path"],
+    publicationQualification: inputs["publication-qualification-path"],
+    sealedBundleRoot: inputs["sealed-bundle-root"],
+    sealedBundleManifest: inputs["sealed-bundle-manifest"],
+    publishRequiredArtifacts: inputs["required-artifacts-path"],
+    recoveryReceipt: inputs["recovery-receipt-path"] || "",
+    releaseAssets: (manifest.releaseAssets || []).map((file) =>
+      path.resolve(workspace, file),
+    ),
+  };
+  return {
+    enabled: true,
+    version: candidate.target.version,
+    publicationVersion: intent.key,
+    candidateVersion: candidate.target.version,
+    artifacts: {
+      sourceSha: candidate.source.headSha,
+      passport: `discussion-${discussion.number}`,
+    },
+    paths,
+    run: { id: snapshots[0].attempt.split(":")[0] },
+    discussionId,
+    handoff: observed.handoff,
+  };
+}

package/packages/core/release/discussion/session.js

@@ -0,0 +1,113 @@
+import fs from "node:fs";
+import path from "node:path";
+import { createHash } from "node:crypto";
+import { createIntent, createProgress } from "./envelope.js";
+import { releaseDiscussionStore } from "./store.js";
+import { discussionTransport } from "../../providers/github/discussions/transport.js";
+
+export const RELEASE_NODES = [
+  "qualification",
+  "publication",
+  "github-release",
+  "next-development",
+  "settlement",
+];
+
+export function selectedRecordRuntime(env) {
+  const selection = JSON.parse(env.BUILDCHAIN_RUNTIME_SELECTION || "{}");
+  const file = path.join(
+    env.BUILDCHAIN_RUNTIME_ROOT || "",
+    "dist/readers/release-discussion.cjs",
+  );
+  return {
+    repository: selection.repository,
+    sha: selection.sha,
+    readerPath: "dist/readers/release-discussion.cjs",
+    readerDigest: `sha256:${createHash("sha256").update(fs.readFileSync(file)).digest("hex")}`,
+  };
+}
+
+export async function openReleaseSession({
+  graphql,
+  repository,
+  key,
+  source,
+  runtime,
+  attempt,
+  discussionId = "",
+  predecessor = "",
+  dryRun = false,
+  recover = false,
+  expectedNodes = RELEASE_NODES,
+}) {
+  const intent = createIntent({
+    repository,
+    key,
+    source,
+    runtime,
+    expectedNodes,
+  });
+  const store = releaseDiscussionStore(discussionTransport(graphql));
+  const session = await store.initialize({ intent, discussionId, dryRun });
+  if (dryRun)
+    return {
+      session,
+      observe: async (_node, effect) => effect(),
+      record: async () => {},
+      read: async () => ({ dryRun: true }),
+    };
+  const current = await store.read(session);
+  const retained = current.records.find((event) => event.attempt === attempt);
+  const prior =
+    retained?.predecessor ??
+    (predecessor || (recover ? current.attempt || "" : ""));
+  if (
+    current.attempt &&
+    current.attempt !== attempt &&
+    prior !== current.attempt
+  )
+    throw new Error(
+      `Recovery requires predecessor ${current.attempt} in the same Discussion`,
+    );
+  session.attempt = attempt;
+  session.predecessor = prior;
+  session.runtime = runtime;
+  const record = async (node, status, payload = {}, sequence = 0) =>
+    store.append(
+      session,
+      createProgress({
+        intent: session.intent,
+        runtime,
+        attempt,
+        predecessor: prior,
+        node,
+        status,
+        payload,
+        sequence,
+      }),
+    );
+  await record("attempt", "running");
+  const observe = async (node, effect, summarize = () => ({})) => {
+    await record(node, "running");
+    let result;
+    try {
+      result = await effect();
+    } catch (error) {
+      // Preserve the original failure even when the diagnostic provider is down.
+      try {
+        await record(
+          node,
+          "failure",
+          { code: String(error.code || "execution-failed") },
+          1,
+        );
+      } catch (recordError) {
+        error.discussionRecordingError = recordError.message;
+      }
+      throw error;
+    }
+    await record(node, "success", summarize(result), 1);
+    return result;
+  };
+  return { session, store, observe, record, read: () => store.read(session) };
+}

package/packages/core/release/discussion/store.js

@@ -0,0 +1,169 @@
+import { collectDiscussionPages } from "../../providers/github/discussions/transport.js";
+import {
+  canonicalJson,
+  decodeRecord,
+  encodeRecord,
+  INTENT_SCHEMA,
+} from "./envelope.js";
+import { readReleaseDiscussion } from "./reader.js";
+
+function assertDiscussion(discussion, intent, writerId) {
+  if (
+    discussion.repository.nameWithOwner.toLowerCase() !==
+    intent.repository.toLowerCase()
+  )
+    throw new Error("Discussion belongs to a different consumer repository");
+  if (discussion.author?.id !== writerId || discussion.lastEditedAt)
+    throw new Error("Discussion intent has an untrusted author or was edited");
+  const existing = decodeRecord(discussion.body);
+  if (existing?.id !== intent.id || existing.schema !== INTENT_SCHEMA)
+    throw new Error("Discussion contains a different release intent");
+  if (
+    canonicalJson(existing.expectedNodes) !==
+      canonicalJson(intent.expectedNodes) ||
+    canonicalJson(existing.source) !== canonicalJson(intent.source)
+  )
+    throw new Error("Release intent changed during recovery");
+  return existing;
+}
+
+export function releaseDiscussionStore(
+  transport,
+  { sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms)) } = {},
+) {
+  async function observeAfterUnknown(readback, cause) {
+    if (
+      [401, 403].includes(cause.status) ||
+      cause.errors?.some((error) =>
+        ["FORBIDDEN", "UNAUTHORIZED"].includes(error.type),
+      )
+    )
+      throw new Error(
+        "Consumer workflow cannot write this Discussion; grant discussions: write and permit Announcements creation",
+        { cause },
+      );
+    for (let attempt = 0; attempt < 4; attempt++) {
+      const record = await readback();
+      if (record) return record;
+      if (attempt < 3) await sleep(250 * (attempt + 1));
+    }
+    throw new Error(
+      "Discussion mutation outcome is unknown; retry by reading the same intent before any further write",
+      { cause },
+    );
+  }
+  async function initialize({
+    intent,
+    discussionId = "",
+    category = "Announcements",
+    dryRun = false,
+  }) {
+    if (dryRun) return { dryRun: true, intent };
+    const repository = await transport.repository(intent.repository);
+    const writerId = repository.viewer.id;
+    if (discussionId) {
+      const discussion = await transport.get(discussionId);
+      const original = assertDiscussion(discussion, intent, writerId);
+      return { discussion, intent: original, writerId };
+    }
+    const selected = repository.discussionCategories.nodes.filter(
+      (entry) => entry.name === category,
+    );
+    if (selected.length !== 1)
+      throw new Error(
+        `Release Discussion category ${category} must exist exactly once`,
+      );
+    const find = async () => {
+      const candidates = await collectDiscussionPages((after) =>
+        transport.list(intent.repository, selected[0].id, after),
+      );
+      const matching = candidates.filter(
+        (discussion) =>
+          discussion.author?.id === writerId &&
+          decodeRecord(discussion.body)?.id === intent.id,
+      );
+      if (matching.length > 1)
+        throw new Error(
+          "Multiple Discussions own this release intent; refusing ambiguous recovery",
+        );
+      if (matching.length) assertDiscussion(matching[0], intent, writerId);
+      return matching[0];
+    };
+    let discussion = await find();
+    if (!discussion) {
+      try {
+        discussion = await transport.create({
+          repositoryId: repository.id,
+          categoryId: selected[0].id,
+          title: `Buildchain release: ${intent.key}`,
+          body: encodeRecord(
+            intent,
+            `Release transaction for ${intent.key}. Expected nodes: ${intent.expectedNodes.join(", ")}.`,
+          ),
+        });
+      } catch (error) {
+        discussion = await observeAfterUnknown(find, error);
+      }
+    }
+    const original = assertDiscussion(discussion, intent, writerId);
+    return { discussion, intent: original, writerId };
+  }
+  async function read(session) {
+    const discussion = await transport.get(session.discussion.id);
+    assertDiscussion(discussion, session.intent, session.writerId);
+    const comments = await collectDiscussionPages((after) =>
+      transport.comments(discussion.id, after),
+    );
+    const trusted = comments.filter(
+      (comment) => comment.author?.id === session.writerId,
+    );
+    if (
+      trusted.some(
+        (comment) => comment.lastEditedAt && decodeRecord(comment.body),
+      )
+    )
+      throw new Error(
+        "A transaction record was edited; historical facts are no longer intact",
+      );
+    const records = trusted
+      .map((comment) => decodeRecord(comment.body))
+      .filter(Boolean);
+    return {
+      discussion,
+      comments: trusted,
+      records,
+      ...readReleaseDiscussion({ body: discussion.body, records }),
+    };
+  }
+  async function append(session, record) {
+    if (session.dryRun) return { dryRun: true };
+    const body = encodeRecord(
+      record,
+      `${record.node}: ${record.status} (attempt ${record.attempt})`,
+    );
+    const find = async () => {
+      const observed = await read(session);
+      const existing = observed.comments.find(
+        (comment) => decodeRecord(comment.body)?.id === record.id,
+      );
+      if (!existing)
+        readReleaseDiscussion({
+          body: observed.discussion.body,
+          records: [...observed.records, record],
+        });
+      return existing;
+    };
+    const existing = await find();
+    if (existing) return existing;
+    try {
+      await transport.append(session.discussion.id, body);
+    } catch (error) {
+      return observeAfterUnknown(find, error);
+    }
+    return observeAfterUnknown(
+      find,
+      new Error("Discussion append requires provider readback"),
+    );
+  }
+  return { initialize, read, append };
+}

package/packages/core/release/github-release.js

@@ -302,6 +302,7 @@ export async function publishGitHubReleaseEvidence({
   declarationPath,
   qualificationRoot = "",
   failureAfterCapability = "",
+  checkpoint: retainCheckpoint,
 } = {}) {
   const assetPaths = collectGitHubReleaseEvidenceAssets({
     publishEvidencePath,
@@ -349,8 +350,9 @@ export async function publishGitHubReleaseEvidence({
       }),
       ...createGitHubProviderAdapters(octokit, materialized.documents),
     }),
-    checkpoint: (checkpoint) => {
+    checkpoint: async (checkpoint) => {
       writeReleaseTailTransaction(resolvedStatePath, checkpoint);
+      if (retainCheckpoint) await retainCheckpoint(checkpoint);
       if (
         failureAfterCapability &&
         checkpoint.receipts.some(

package/packages/core/release/promote-candidate/action.js

@@ -1,9 +1,89 @@
 import * as github from "@actions/github";
-import { promoteReleaseCandidate } from "./transaction.js";
+import { publishWithDiscussion } from "../discussion/publication.js";
+import { selectedRecordRuntime } from "../discussion/session.js";
 export async function candidatePublicationAction(core, env) {
-  const required = new Set(["candidate-build-summary-path", "required-artifacts-path", "target-ref", "target-sha", "candidate-passport-path", "channel", "product-publication-intent-path", "publication-qualification-path", "publisher-workflow-sha", "repository", "runtime-commit", "runtime-tree", "source-sha", "stage-capsules-path", "tag", "token", "version"]);
-  const request = Object.fromEntries(["recovery-receipt-path", "candidate-build-summary-path", "candidate-passport-path", "channel", "failure-after-capability", "mutation-token", "product-publication-intent-path", "publication-qualification-path", "publish-artifact-kind", "publish-auth", "publish-command", "publish-dist-tag", "publish-mode", "publish-package-main", "publish-package-set-order", "publisher-workflow-sha", "repository", "required-artifacts-path", "required-status-check", "resume-transaction-id", "runtime-commit", "runtime-tree", "sealed-bundle-manifest", "sealed-bundle-root", "source-sha", "stage-capsules-path", "state-path", "tag", "target-ref", "target-sha", "token", "version"].map(name => [name, core.getInput(name, { required: required.has(name) }).trim()]));
-  for (const name of ["publish-rematerialize-on-resume", "publish-transaction-override"]) request[name] = core.getBooleanInput(name);
-  request["artifact-paths"] = core.getMultilineInput("artifact-paths").filter(Boolean);
-  return promoteReleaseCandidate(request, { octokit: github.getOctokit(request.token), mutationOctokit: github.getOctokit(request["mutation-token"] || request.token), actor: env.GITHUB_ACTOR, runId: env.GITHUB_RUN_ID || "", observe: outputs => { for (const [key, value] of Object.entries(outputs)) core.setOutput(key, value); } });
+  const required = new Set([
+    "candidate-build-summary-path",
+    "required-artifacts-path",
+    "target-ref",
+    "target-sha",
+    "candidate-passport-path",
+    "channel",
+    "product-publication-intent-path",
+    "publication-qualification-path",
+    "publisher-workflow-sha",
+    "repository",
+    "runtime-commit",
+    "runtime-tree",
+    "source-sha",
+    "stage-capsules-path",
+    "tag",
+    "token",
+    "version",
+  ]);
+  const request = Object.fromEntries(
+    [
+      "recovery-receipt-path",
+      "candidate-build-summary-path",
+      "candidate-passport-path",
+      "channel",
+      "failure-after-capability",
+      "mutation-token",
+      "product-publication-intent-path",
+      "publication-qualification-path",
+      "publish-artifact-kind",
+      "publish-auth",
+      "publish-command",
+      "publish-dist-tag",
+      "publish-mode",
+      "publish-package-main",
+      "publish-package-set-order",
+      "publisher-workflow-sha",
+      "repository",
+      "required-artifacts-path",
+      "required-status-check",
+      "resume-transaction-id",
+      "resume-discussion-id",
+      "runtime-commit",
+      "runtime-tree",
+      "sealed-bundle-manifest",
+      "sealed-bundle-root",
+      "source-sha",
+      "stage-capsules-path",
+      "state-path",
+      "tag",
+      "target-ref",
+      "target-sha",
+      "token",
+      "version",
+    ].map((name) => [
+      name,
+      core.getInput(name, { required: required.has(name) }).trim(),
+    ]),
+  );
+  for (const name of [
+    "publish-rematerialize-on-resume",
+    "publish-transaction-override",
+    "standalone-binary-distribution",
+  ])
+    request[name] = core.getBooleanInput(name);
+  request["artifact-paths"] = core
+    .getMultilineInput("artifact-paths")
+    .filter(Boolean);
+  return publishWithDiscussion(request, {
+    octokit: github.getOctokit(request.token),
+    mutationOctokit: github.getOctokit(
+      request["mutation-token"] || request.token,
+    ),
+    actor: env.GITHUB_ACTOR,
+    runId: env.GITHUB_RUN_ID,
+    attempt: `${env.GITHUB_RUN_ID}:${env.GITHUB_RUN_ATTEMPT}:${env.GITHUB_ACTION}`,
+    runtime: selectedRecordRuntime(env),
+    workspace: env.GITHUB_WORKSPACE,
+    runtimeRoot: env.BUILDCHAIN_RUNTIME_ROOT,
+    observe: (outputs) => {
+      for (const [key, value] of Object.entries(outputs))
+        core.setOutput(key, value);
+    },
+  });
 }