@kungfu-tech/buildchain 4.1.3-alpha.0 → 4.1.3-alpha.10

package/packages/core/providers/github/pipeline-events.js

@@ -0,0 +1,131 @@
+import { readBusinessAttempt } from "../../workflow/attempt/reader.js";
+
+// The current provider timeline survives webhook/runtime handoff. Compare it
+// with this candidate's lifetime so an earlier removal cannot cancel recovery.
+export function githubPipelineQueueExit(graphql, repository) {
+  if (!/^[\w.-]+\/[\w.-]+$/u.test(repository || ""))
+    throw new Error("Invalid pipeline queue repository");
+  const [owner, repo] = repository.split("/");
+  return async (current, candidate) => {
+    if (!candidate || candidate.terminal) return null;
+    const started = Date.parse(candidate.enqueuedAt);
+    if (!Number.isFinite(started))
+      throw new Error("Queue candidate timestamp is missing");
+    const number = current.intent.source.pullRequest;
+    const result = await graphql(
+      `
+        query ($owner: String!, $repo: String!, $number: Int!) {
+          repository(owner: $owner, name: $repo) {
+            pullRequest(number: $number) {
+              number
+              headRefOid
+              baseRefName
+              state
+              mergeQueueEntry {
+                id
+              }
+              timelineItems(
+                last: 2
+                itemTypes: [
+                  ADDED_TO_MERGE_QUEUE_EVENT
+                  REMOVED_FROM_MERGE_QUEUE_EVENT
+                ]
+              ) {
+                nodes {
+                  __typename
+                  ... on AddedToMergeQueueEvent {
+                    id
+                    createdAt
+                  }
+                  ... on RemovedFromMergeQueueEvent {
+                    id
+                    createdAt
+                  }
+                }
+              }
+            }
+          }
+        }
+      `,
+      { owner, repo, number },
+    );
+    const pr = result.repository?.pullRequest;
+    if (
+      pr?.number !== number ||
+      pr.headRefOid !== current.generation.source.commit ||
+      pr.baseRefName !== current.intent.source.targetBranch
+    )
+      throw new Error("Queue exit source identity changed; reobserve");
+    if (pr.state !== "OPEN" || pr.mergeQueueEntry) return null;
+    const nodes = pr.timelineItems?.nodes;
+    if (!Array.isArray(nodes) || nodes.length > 2)
+      throw new Error("Queue exit timeline readback is missing or ambiguous");
+    const event = nodes.at(-1);
+    if (event?.__typename !== "RemovedFromMergeQueueEvent") return null;
+    const queued = nodes.at(-2);
+    if (queued?.__typename !== "AddedToMergeQueueEvent")
+      throw new Error("Queue removal has no matching admission readback");
+    const removed = Date.parse(event.createdAt);
+    const entered = Date.parse(queued.createdAt);
+    if (
+      !event.id ||
+      !queued.id ||
+      !Number.isFinite(removed) ||
+      !Number.isFinite(entered) ||
+      entered > removed
+    )
+      throw new Error("Queue removal identity or timestamp is missing");
+    return entered > started ? event : null;
+  };
+}
+
+// Branch/terminal notifications wake existing intents only. They cannot create
+// historical releases or infer an execution request from an untracked old PR.
+export function githubPipelineEvents(request, journal, repository) {
+  if (!/^[\w.-]+\/[\w.-]+$/u.test(repository || ""))
+    throw new Error("Invalid pipeline event repository");
+  const base = `/repos/${repository}`;
+  async function list(url) {
+    const rows = [];
+    for (let page = 1; page <= 100; page++) {
+      const entries = await request(
+        `${url}${url.includes("?") ? "&" : "?"}per_page=100&page=${page}`,
+      );
+      if (!Array.isArray(entries))
+        throw new Error("Invalid pipeline PR event readback");
+      rows.push(...entries);
+      if (entries.length < 100) return rows;
+    }
+    throw new Error("Pipeline PR event readback exceeds its bound");
+  }
+  async function branch(branch, commit = "") {
+    if (
+      !/^(?:dev|alpha|release|publish-gate)\/[A-Za-z0-9/._-]+$/u.test(
+        branch || "",
+      ) ||
+      branch.includes("..")
+    )
+      throw new Error("Invalid pipeline branch event");
+    const pulls = await list(
+      `${base}/pulls?state=open&base=${encodeURIComponent(branch)}`,
+    );
+    if (commit) {
+      if (!/^[0-9a-f]{40}$/u.test(commit))
+        throw new Error("Branch wake requires exact source commit");
+      pulls.push(...(await list(`${base}/commits/${commit}/pulls`)));
+    }
+    const result = new Set();
+    for (const number of [
+      ...new Set(
+        pulls.filter((pr) => pr.base?.ref === branch).map((pr) => pr.number),
+      ),
+    ]) {
+      const retained = await journal.lookup(repository, number, branch);
+      if (!retained) continue;
+      const state = readBusinessAttempt(retained.snapshot);
+      if (state.attempt) result.add(state.attempt);
+    }
+    return [...result];
+  }
+  return { branch };
+}

package/packages/core/providers/github/pipeline-integration.js

@@ -0,0 +1,95 @@
+import { recordDigest } from "../../release/discussion/envelope.js";
+import { pipelinePlatforms } from "../../workflow/pipeline/platforms.js";
+
+export function githubPipelineIntegration(request, repository, source, runs) {
+  const base = `/repos/${repository}`;
+  async function observe(current) {
+    const number = current.intent.source.pullRequest;
+    const branch = current.intent.source.targetBranch;
+    const pr = await request(`${base}/pulls/${number}`);
+    if (
+      !pr.merged ||
+      pr.head?.sha !== current.generation.source.commit ||
+      pr.base?.ref !== branch ||
+      pr.head?.repo?.full_name !== repository ||
+      pr.base?.repo?.full_name !== repository ||
+      !/^[0-9a-f]{40}$/u.test(pr.merge_commit_sha || "")
+    )
+      throw new Error(
+        "Integration needs the exact source PR merged into its protected target",
+      );
+    const mergeCommit = pr.merge_commit_sha;
+    const protectedHead = await source.branchHead(branch);
+    const ancestry = await request(
+      `${base}/compare/${mergeCommit}...${protectedHead}`,
+    );
+    if (
+      !["identical", "ahead"].includes(ancestry.status) ||
+      ancestry.merge_base_commit?.sha !== mergeCommit
+    )
+      throw new Error(
+        "Exact merge commit is not contained in the protected branch",
+      );
+    const commits = await source.source(
+      mergeCommit,
+      current.generation.source.configPath,
+    );
+    const response = await request(
+      `${base}/actions/runs?event=merge_group&head_sha=${mergeCommit}&per_page=100`,
+    );
+    if (!Array.isArray(response.workflow_runs) || response.total_count > 100)
+      throw new Error(
+        "Exact merge-group run inventory is unavailable or ambiguous",
+      );
+    const candidates = response.workflow_runs.filter(
+      (run) =>
+        run.status === "completed" &&
+        run.conclusion === "success" &&
+        run.path?.split("@")[0] === ".github/workflows/buildchain.yml",
+    );
+    if (!candidates.length)
+      throw new Error(
+        "Exact merged commit has no successful normal pipeline merge-group run",
+      );
+    const chosen = candidates.sort((a, b) => b.id - a.id)[0];
+    const { run } = await runs.read(chosen.id, chosen.run_attempt);
+    if (
+      run.status !== "completed" ||
+      run.conclusion !== "success" ||
+      run.event !== "merge_group" ||
+      run.head_sha !== mergeCommit
+    )
+      throw new Error("Integration merge-group execution changed");
+    const build = await runs.build(
+      run.id,
+      run.run_attempt,
+      commits.identity,
+      pipelinePlatforms(commits.plan).map((item) => item.platform),
+    );
+    if (build.outcome !== "success")
+      throw new Error("Exact merged tree product verification failed");
+    const again = await request(`${base}/pulls/${number}`);
+    if (
+      !again.merged ||
+      again.merge_commit_sha !== mergeCommit ||
+      again.head.sha !== pr.head.sha ||
+      again.base.ref !== branch
+    )
+      throw new Error("Integration provider source changed during readback");
+    const body = {
+      schema: "buildchain.pipeline-integration-readback/v1",
+      repository,
+      pullRequest: number,
+      sourceHead: pr.head.sha,
+      branch,
+      protectedHead,
+      mergeCommit,
+      mergeTree: commits.identity.tree,
+      run,
+      build,
+      ancestry,
+    };
+    return { ...body, root: recordDigest(body) };
+  }
+  return { observe };
+}

package/packages/core/providers/github/pipeline-policy.js

@@ -0,0 +1,240 @@
+import { recordDigest } from "../../release/discussion/envelope.js";
+
+const QUERY = `query PipelinePolicy($owner:String!,$name:String!,$number:Int!){repository(owner:$owner,name:$name){pullRequest(number:$number){id number headRefOid baseRefName isDraft reviewDecision author{login}}}}`;
+const BRANCH_QUERY = `query PipelineBranchPolicy($owner:String!,$name:String!,$branch:String!,$ref:String!){repository(owner:$owner,name:$name){ref(qualifiedName:$ref){refUpdateRule{requiredApprovingReviewCount requiresCodeOwnerReviews requiredStatusCheckContexts}}mergeQueue(branch:$branch){id}}}`;
+
+async function classicPolicy(request, owner, name, branch) {
+  // Read viewer-enforced rules and the ordinary Contents:read branch projection.
+  // Administrative branchProtectionRule and /protection queries are not needed.
+  const result = await request("/graphql", {
+    method: "POST",
+    body: {
+      query: BRANCH_QUERY,
+      variables: { owner, name, branch, ref: `refs/heads/${branch}` },
+    },
+  });
+  const repository = result.data?.repository;
+  if (!repository?.ref)
+    throw new Error("Protected branch metadata is unavailable");
+  const rule = repository.ref.refUpdateRule;
+  const observed = await request(
+    `/repos/${owner}/${name}/branches/${encodeURIComponent(branch)}`,
+  );
+  const status = observed.protection?.required_status_checks;
+  const contexts = status?.contexts;
+  const checks = status?.checks;
+  if (
+    observed.name !== branch ||
+    !Array.isArray(contexts) ||
+    !Array.isArray(checks) ||
+    checks.some(
+      (check) =>
+        typeof check.context !== "string" ||
+        !check.context ||
+        !Object.hasOwn(check, "app_id") ||
+        !(
+          check.app_id === null ||
+          check.app_id === -1 ||
+          (Number.isSafeInteger(check.app_id) && check.app_id > 0)
+        ),
+    ) ||
+    contexts.some(
+      (context) => !checks.some((check) => check.context === context),
+    ) ||
+    checks.some((check) => !contexts.includes(check.context)) ||
+    (rule?.requiredStatusCheckContexts || []).some(
+      (context) => !contexts.includes(context),
+    )
+  )
+    throw new Error("Protected branch check identity metadata is incomplete");
+  return {
+    required_merge_queue: Boolean(repository.mergeQueue?.id),
+    required_pull_request_reviews:
+      rule?.requiredApprovingReviewCount > 0
+        ? {
+            require_code_owner_reviews: rule.requiresCodeOwnerReviews,
+            required_approving_review_count: rule.requiredApprovingReviewCount,
+          }
+        : null,
+    required_status_checks: {
+      checks,
+    },
+  };
+}
+
+async function inventory(request, url, key = "") {
+  const rows = [];
+  for (let page = 1; page <= 100; page++) {
+    const response = await request(
+      `${url}${url.includes("?") ? "&" : "?"}per_page=100&page=${page}`,
+    );
+    const entries = key ? response[key] : response;
+    if (!Array.isArray(entries))
+      throw new Error("Missing protected policy inventory");
+    rows.push(...entries);
+    if (entries.length < 100) return rows;
+  }
+  throw new Error("Protected policy inventory exceeds its bound");
+}
+
+function protections(rules, classic, policy) {
+  const reviews = rules
+    .filter((rule) => rule.type === "pull_request")
+    .map((rule) => rule.parameters);
+  if (classic?.required_pull_request_reviews)
+    reviews.push({
+      ...classic.required_pull_request_reviews,
+      require_code_owner_review:
+        classic.required_pull_request_reviews.require_code_owner_reviews,
+    });
+  if (
+    !reviews.some((rule) => rule?.require_code_owner_review === true) ||
+    !reviews.some(
+      (rule) =>
+        rule?.required_approving_review_count >= policy.minimum_approvals,
+    ) ||
+    !(
+      classic?.required_merge_queue ||
+      rules.some((rule) => rule.type === "merge_queue")
+    )
+  )
+    throw new Error(
+      "Protected branch must enforce declared approvals, code owners and merge queue",
+    );
+  const contexts = rules
+    .filter((rule) => rule.type === "required_status_checks")
+    .flatMap((rule) => rule.parameters?.required_status_checks || []);
+  for (const check of classic?.required_status_checks?.checks || [])
+    contexts.push({ context: check.context, integration_id: check.app_id });
+  if (!contexts.length || contexts.some((check) => !check.context))
+    throw new Error(
+      "Protected pipeline requires provider-enforced status checks",
+    );
+  return contexts;
+}
+
+function approved(pr, reviews, minimum) {
+  const latest = new Map();
+  for (const review of [...reviews].sort((a, b) => a.id - b.id)) {
+    if (
+      review.user?.login &&
+      ["APPROVED", "CHANGES_REQUESTED", "DISMISSED"].includes(review.state)
+    )
+      latest.set(review.user.login, review);
+  }
+  const independent = [...latest.values()].filter(
+    (review) => review.user.login !== pr.author?.login,
+  );
+  return (
+    pr.reviewDecision === "APPROVED" &&
+    !independent.some((review) => review.state === "CHANGES_REQUESTED") &&
+    independent.filter(
+      (review) =>
+        review.state === "APPROVED" && review.commit_id === pr.headRefOid,
+    ).length >= minimum
+  );
+}
+
+function checksPass(contexts, checks, statuses) {
+  return contexts.every(({ context, integration_id: app }) => {
+    const candidates = checks.filter(
+      (check) =>
+        check.name === context && (!app || app === -1 || check.app?.id === app),
+    );
+    const latest = candidates.sort((a, b) => b.id - a.id)[0];
+    if (latest)
+      return (
+        latest.status === "completed" &&
+        ["success", "neutral", "skipped"].includes(latest.conclusion)
+      );
+    if (app && app !== -1) return false;
+    return (
+      statuses
+        .filter((status) => status.context === context)
+        .sort((a, b) => b.id - a.id)[0]?.state === "success"
+    );
+  });
+}
+
+export function githubPipelinePolicy(request, repository) {
+  const [owner, name] = repository.split("/");
+  const base = `/repos/${repository}`;
+  async function pull(number) {
+    const response = await request("/graphql", {
+      method: "POST",
+      body: { query: QUERY, variables: { owner, name, number } },
+    });
+    const pr = response.data?.repository?.pullRequest;
+    if (!pr?.id || pr.number !== number)
+      throw new Error("Protected PR policy identity is unavailable");
+    return pr;
+  }
+  async function observe(current, policy, integratedHead) {
+    const { source, baseCommit } = current.generation;
+    const number = current.intent.source.pullRequest,
+      branch = current.intent.source.targetBranch;
+    const pr = await pull(number);
+    if (pr.headRefOid !== source.commit || pr.baseRefName !== branch)
+      throw new Error("Protected PR policy source drift");
+    const branchPath = encodeURIComponent(branch);
+    const rules = await inventory(
+      request,
+      `${base}/rules/branches/${branchPath}`,
+    );
+    const classic = await classicPolicy(request, owner, name, branch);
+    const contexts = protections(rules, classic, policy);
+    const reviews = await inventory(request, `${base}/pulls/${number}/reviews`);
+    const checks = await inventory(
+      request,
+      `${base}/commits/${source.commit}/check-runs?filter=latest`,
+      "check_runs",
+    );
+    const statuses = await inventory(
+      request,
+      `${base}/commits/${source.commit}/statuses`,
+    );
+    const again = await pull(number);
+    const ref = await request(`${base}/git/ref/heads/${branch}`);
+    if (
+      recordDigest(pr) !== recordDigest(again) ||
+      ref.object?.sha !== (integratedHead || baseCommit)
+    )
+      throw new Error("Protected policy changed during readback");
+    const body = {
+      schema: "buildchain.pipeline-policy-readback/v1",
+      source,
+      baseCommit,
+      pr,
+      rules,
+      classic: classic || null,
+      reviews,
+      checks,
+      statuses,
+      contexts,
+      review: !pr.isDraft && approved(pr, reviews, policy.minimum_approvals),
+      checksPassing: checksPass(contexts, checks, statuses),
+      ...(integratedHead ? { integratedHead } : {}),
+    };
+    return { ...body, root: recordDigest(body) };
+  }
+  async function observeMerged(current, policy, integration) {
+    const { root, ...body } = integration;
+    if (
+      root !== recordDigest(body) ||
+      body.schema !== "buildchain.pipeline-integration-readback/v1" ||
+      body.repository !== repository ||
+      body.sourceHead !== current.generation.source.commit ||
+      body.branch !== current.intent.source.targetBranch ||
+      body.pullRequest !== current.intent.source.pullRequest ||
+      !/^[0-9a-f]{40}$/u.test(body.protectedHead || "")
+    )
+      throw new Error(
+        "Merged review qualification requires exact protected integration evidence",
+      );
+    return observe(current, policy, body.protectedHead);
+  }
+  return {
+    observe: (current, policy) => observe(current, policy),
+    observeMerged,
+  };
+}

package/packages/core/providers/github/pipeline-product-payload.js

@@ -0,0 +1,50 @@
+import { createHash } from "node:crypto";
+import { canonicalJson } from "../../release/discussion/envelope.js";
+import {
+  publicationFile,
+  publicationPath,
+} from "../../publication/pipeline/files.js";
+const sha256 = (bytes) =>
+  `sha256:${createHash("sha256").update(bytes).digest("hex")}`;
+
+export function pipelineProductPayload({
+  qualified,
+  documents,
+  directory,
+  evidence,
+}) {
+  const payload = (effect) => {
+    if (effect.product.startsWith("evidence:")) {
+      const asset = evidence.find(
+        (entry) => `evidence:${entry.id}` === effect.product,
+      );
+      if (
+        !asset ||
+        sha256(asset.bytes) !== effect.digest ||
+        asset.bytes.length !== effect.size
+      )
+        throw new Error(
+          "Release evidence differs from admitted immutable bytes",
+        );
+      return asset.bytes;
+    }
+    if (effect.product === "release-passport")
+      return Buffer.from(`${canonicalJson(documents.passport)}\n`);
+    const artifact = qualified.artifacts.find(
+      (entry) => entry.id === effect.product,
+    );
+    if (
+      !artifact ||
+      artifact.digest !== effect.digest ||
+      artifact.size !== effect.size
+    )
+      throw new Error(
+        "GitHub Release payload does not match qualified product",
+      );
+    const file = publicationFile(publicationPath(directory, artifact.file));
+    if (file.digest !== artifact.digest || file.size !== artifact.size)
+      throw new Error("GitHub Release payload bytes changed");
+    return file.bytes;
+  };
+  return payload;
+}