@kungfu-tech/buildchain 4.1.3-alpha.1 → 4.1.3-alpha.2

package/packages/core/workflow/pipeline/settlement.js

@@ -0,0 +1,137 @@
+import {
+  createIntegrationDeliveryProof,
+  verifyIntegrationDeliveryProof,
+} from "../../dev-delivery/dev-delivery-warrant.js";
+import { readBusinessAttempt } from "../attempt/reader.js";
+import { pipelineCandidate } from "./reconcile.js";
+
+async function qualifyWarrant(session, current, queue, materials) {
+  if (current.phases.warrant?.payload.state === "success") return;
+  if (queue.activeWarrant?.phase !== "qualified")
+    throw new Error("Merged pipeline has no qualified active Warrant");
+  const reference = await materials.retain(
+    `warrant/qualified-${queue.stateRoot.slice(7)}`,
+    queue,
+    "provider-readback",
+  );
+  await session.progress.progress({
+    attempt: current.identity.id,
+    phase: "warrant",
+    state: "success",
+    eventKey: `qualified:${queue.stateRoot}`,
+    materials: [reference],
+  });
+}
+
+async function integrationProof(session, fresh, host, materials) {
+  const { queue, current } = fresh;
+  const candidate = pipelineCandidate(queue, current);
+  if (!candidate)
+    throw new Error("Merged pipeline candidate authority is missing");
+  if (candidate.status === "merged") {
+    const reference =
+      current.materials[
+        `merge/proof-${candidate.terminal.evidenceRoot.slice(7)}`
+      ];
+    if (!reference)
+      throw new Error(
+        "Merged Warrant has no retained pre-effect integration proof",
+      );
+    const proof = await materials.read(reference);
+    if (
+      !verifyIntegrationDeliveryProof(proof, {
+        sourceProofRoot: candidate.sourceProofRoot,
+        warrantCandidateId: candidate.candidateId,
+      }).ok
+    )
+      throw new Error("Retained integration proof is invalid");
+    return { candidate, proof, reference };
+  }
+  if (candidate.candidateId !== queue.activeWarrant?.candidateId)
+    throw new Error("Merged candidate is not the active Warrant");
+  await qualifyWarrant(session, current, queue, materials);
+  const readback = await host.integration.observe(current);
+  const proof = createIntegrationDeliveryProof({
+    repository: host.repository,
+    protectedBase: session.intent.source.targetBranch,
+    sourceProofRoot: candidate.sourceProofRoot,
+    warrant: queue.activeWarrant,
+    currentBase: readback.mergeCommit,
+    replayTree: readback.mergeTree,
+    mergeGroupHead: readback.mergeCommit,
+    mergeGroupTree: readback.mergeTree,
+    requiredContextRoots: [readback.build.root, readback.root],
+    verifiedAt: new Date().toISOString(),
+  });
+  const reference = await materials.retain(
+    `merge/proof-${proof.proofRoot.slice(7)}`,
+    proof,
+  );
+  const provider = await materials.retain(
+    `merge/provider-${readback.root.slice(7)}`,
+    readback,
+    "provider-readback",
+  );
+  await session.progress.progress({
+    attempt: current.identity.id,
+    phase: "merge",
+    state: "waiting",
+    eventKey: `merge-request:${proof.proofRoot}`,
+    materials: [reference, provider],
+  });
+  return { candidate, proof, reference };
+}
+
+export async function settlePipeline(session, fresh, delivery, host) {
+  const materials = host.materialStore(session);
+  const { candidate, proof, reference } = await integrationProof(
+    session,
+    fresh,
+    host,
+    materials,
+  );
+  const warrant = fresh.queue.activeWarrant;
+  const result = await delivery.service.settle({
+    expectedOldStateRoot: fresh.queue.stateRoot,
+    pullRequestNumber: candidate.pullRequestNumber,
+    expectedSourceHead: candidate.sourceHead,
+    outcome: "merged",
+    reason: "exact-protected-pipeline-integration",
+    evidenceRoot: proof.proofRoot,
+    execute: true,
+    ...(warrant?.candidateId === candidate.candidateId
+      ? {
+          fencingToken: warrant.fencingToken,
+          leaseGeneration: warrant.generation,
+        }
+      : {}),
+  });
+  if (result.observation.activeWarrant?.candidateId === candidate.candidateId)
+    throw new Error("Merged settlement retained its active Warrant");
+  const receipt = await materials.retain(
+    `merge/settlement-${result.receiptRoot.slice(7)}`,
+    result,
+  );
+  await session.progress.progress({
+    attempt: fresh.attempt,
+    phase: "merge",
+    state: "success",
+    eventKey: `merged:${result.receiptRoot}`,
+    materials: [reference, receipt],
+  });
+  await host.notifyTerminal?.(session);
+  const successor = result.receipt.successorWake;
+  if (successor) {
+    const next = await host.provider.lookup(
+      host.repository,
+      successor.pullRequestNumber,
+      session.intent.source.targetBranch,
+    );
+    if (next) await host.wake(readBusinessAttempt(next.snapshot).attempt);
+  }
+  return {
+    operation: "wait",
+    reason: "protected-delivery-settled",
+    attempt: fresh.attempt,
+  };
+}

package/packages/core/workflow/pipeline/wake.js

@@ -0,0 +1,38 @@
+import { githubJsonClient } from "../../providers/github/json-client.js";
+import { githubAttemptJournal } from "../../providers/github/attempt-journal.js";
+import { readBusinessAttempt } from "../attempt/reader.js";
+import { pipelineCandidateRoot } from "./reconcile.js";
+
+export async function wakePipelineCandidate(candidate, connection, ports = {}) {
+  const repository = connection.repository;
+  const request =
+    ports.request ||
+    githubJsonClient({
+      token: connection.token,
+      userAgent: "buildchain-pipeline-wake",
+    });
+  const provider = ports.provider || githubAttemptJournal(request);
+  const branch = candidate.protectedBase || connection.branch;
+  const loaded = await provider.lookup(
+    repository,
+    candidate.pullRequestNumber,
+    branch,
+  );
+  if (!loaded)
+    throw new Error("Warrant handoff has no admitted business intent");
+  const observed = readBusinessAttempt(loaded.snapshot);
+  const current = { ...observed.history.at(-1), intent: observed.intent };
+  if (
+    candidate.sourceHead !== current.generation.source.commit ||
+    candidate.sourceRoot !== pipelineCandidateRoot(current)
+  )
+    throw new Error("Warrant handoff changed its admitted business attempt");
+  await request(`/repos/${repository}/dispatches`, {
+    method: "POST",
+    body: {
+      event_type: "buildchain-attempt-wake",
+      client_payload: { attempt: observed.attempt },
+    },
+  });
+  return observed.attempt;
+}

package/packages/core/workflow/pipeline/web-status.js

@@ -0,0 +1,108 @@
+const labels = {
+  admission: "Source admission",
+  build: "Product verification",
+  review: "Protected review",
+  warrant: "Delivery qualification",
+  merge: "Protected integration",
+  publish: "Product publication",
+  distribution: "Distribution",
+  "next-development": "Next development version",
+};
+const safe = (value) =>
+  String(value || "")
+    .replace(/[\r\n|]/gu, " ")
+    .replaceAll("&", "&")
+    .replaceAll("<", "&lt;")
+    .replaceAll(">", "&gt;")
+    .replace(/[\\`*_[\]()]/gu, (character) => `\\${character}`)
+    .slice(0, 1000);
+
+export function pipelineWebStatus(observed, discussionUrl = "") {
+  const { intent, attempt } = observed;
+  const repositoryUrl = `https://github.com/${intent.repository}`;
+  const current = observed.history.at(-1);
+  if (!current) throw new Error("Pipeline status requires an admitted attempt");
+  const table = [
+    "| Step | State |",
+    "| --- | --- |",
+    ...intent.expectedNodes.map(
+      (phase) =>
+        `| ${labels[phase]} | ${safe(observed.phases[phase]?.payload.state || "pending")} |`,
+    ),
+  ].join("\n");
+  const lines = [
+    `## Buildchain · PR #${intent.source.pullRequest}`,
+    `Status: **${safe(observed.status)}**. ${safe(observed.reason)}`,
+    `Attempt: \`${attempt}\``,
+    `[Pull request](${repositoryUrl}/pull/${intent.source.pullRequest}) · ` +
+      `[Source ${current.generation.source.commit.slice(0, 7)}](${repositoryUrl}/commit/${current.generation.source.commit})`,
+    table,
+  ];
+  const publisher = [...observed.history]
+    .reverse()
+    .find(
+      (item) =>
+        item.generation.id === current.generation.id &&
+        item.phases.publish?.payload.state === "success",
+    );
+  const published = Boolean(publisher);
+  if (published && observed.missing.length)
+    lines.push(
+      `Publication succeeded and its immutable results remain preserved. The whole attempt is incomplete: ${observed.missing.map((phase) => labels[phase]).join(", ")}.`,
+    );
+  if (publisher && publisher.identity.id !== current.identity.id)
+    lines.push(
+      `Publication succeeded in predecessor \`${publisher.identity.id}\`. Current qualification and remaining steps are shown separately above.`,
+    );
+  if (current.identity.predecessor)
+    lines.push(
+      `Recovered from \`${current.identity.predecessor}\`; its original evidence remains in history.`,
+    );
+  if (observed.status !== "complete")
+    lines.push(
+      `[Recover this attempt](${repositoryUrl}/actions/workflows/buildchain-recover.yml): choose Run workflow and enter the exact attempt above. Select a repaired runtime only when needed.`,
+    );
+  lines.push(
+    "Execution links provide the provider's ordinary cancellation control. Cancellation stops remaining work; it does not undo completed publication.",
+  );
+  const runs = [
+    ...new Map(
+      current.runs.map((run) => [`${run.runId}:${run.runAttempt}`, run]),
+    ).values(),
+  ];
+  for (const run of runs.slice(-10))
+    lines.push(
+      `[Execution ${run.runId}, attempt ${run.runAttempt}](${repositoryUrl}/actions/runs/${run.runId}/attempts/${run.runAttempt})`,
+    );
+  if (discussionUrl) {
+    const url = new URL(discussionUrl);
+    if (
+      url.origin !== "https://github.com" ||
+      !url.pathname.startsWith(`/${intent.repository}/discussions/`) ||
+      !/\/discussions\/[1-9][0-9]*$/u.test(url.pathname) ||
+      url.search ||
+      url.hash ||
+      url.username ||
+      url.password
+    )
+      throw new Error(
+        "Pipeline evidence link belongs to another provider or repository",
+      );
+    lines.push(`[Retained evidence](${discussionUrl})`);
+  }
+  return `${lines.join("\n\n")}\n`;
+}
+
+export async function projectPipelineStatus(session, { project, core }) {
+  let result;
+  try {
+    result = await project(session);
+  } catch {
+    core.warning(
+      "Discussion projection unavailable; canonical attempt evidence remains retained.",
+    );
+  }
+  const observed = await session.journal.read();
+  await core.summary.addRaw(pipelineWebStatus(observed, result?.url)).write();
+  return result || { url: "", journalHead: observed.head };
+}

package/scripts/build-release-discussion-reader.mjs

@@ -10,25 +10,29 @@ try {
   await build({
     entry: {
       "release-discussion": "packages/core/release/discussion/reader-entry.js",
+      "business-attempt": "packages/core/workflow/attempt/reader-entry.js",
     },
     outDir: output,
     format: ["cjs"],
     target: "node24",
     platform: "node",
     splitting: false,
+    noExternal: ["smol-toml"],
     sourcemap: false,
     minify: false,
     clean: false,
     outExtension: () => ({ js: ".cjs" }),
     silent: true,
   });
-  if (
-    check &&
-    !fs
-      .readFileSync(path.join(output, "release-discussion.cjs"))
-      .equals(fs.readFileSync("dist/readers/release-discussion.cjs"))
-  )
-    throw new Error("Historical release reader bundle is stale");
+  if (check)
+    for (const name of ["release-discussion", "business-attempt"]) {
+      if (
+        !fs
+          .readFileSync(path.join(output, `${name}.cjs`))
+          .equals(fs.readFileSync(`dist/readers/${name}.cjs`))
+      )
+        throw new Error(`Historical ${name} reader bundle is stale`);
+    }
 } finally {
   if (check) fs.rmSync(output, { recursive: true, force: true });
 }

package/scripts/check-pipeline-publication-topology.mjs

@@ -0,0 +1,36 @@
+import assert from "node:assert/strict";
+import { inspectWorkflowJob } from "./workflow-action-graph.mjs";
+
+export function assertPipelinePublicationTopology(
+  ledger,
+  discoverReleaseTopology,
+  root,
+) {
+  const pipeline = ledger.pipelinePublicationScope;
+  assert.deepEqual(pipeline.workflowPaths, [
+    ".github/workflows/.release-pipeline-products.yml",
+    ".github/workflows/public-ops-pipeline.yml",
+    ".github/workflows/public-ops-recover.yml",
+    ".github/workflows/.ops-pipeline-execute.yml",
+  ]);
+  const pipelineTopology = discoverReleaseTopology(
+    pipeline.workflowPaths,
+    pipeline.workflowPaths,
+  );
+  assert.deepEqual(pipeline.observedTopology, pipelineTopology);
+  for (const [name, ceiling] of Object.entries(pipeline.maximumMetrics))
+    assert.ok(
+      pipelineTopology.metrics[name] <= ceiling,
+      `pipeline publication exceeds ${name}`,
+    );
+  for (const [job, module] of [
+    ["qualify", "packages/core/publication/pipeline/qualify.js"],
+    ["apply", "packages/core/publication/pipeline/apply.js"],
+    ["settle", "packages/core/publication/pipeline/settle.js"],
+  ])
+    assert.ok(
+      inspectWorkflowJob(pipeline.workflowPaths[0], job, root).modules.has(
+        module,
+      ),
+    );
+}

package/scripts/check-release-topology.mjs

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
 
 import assert from "node:assert/strict";
+import { assertPipelinePublicationTopology } from "./check-pipeline-publication-topology.mjs";
 import { inspectWorkflowJob, readWorkflow } from "./workflow-action-graph.mjs";
 import crypto from "node:crypto";
 import fs from "node:fs";
@@ -28,6 +29,7 @@ const PRIVILEGED_ENTRYPOINTS = [
   "packages/core/release/next-development/actions.js",
   "packages/core/publication/oci/preview-actions.js",
   "packages/core/publication/settlement/actions.js",
+  "packages/core/publication/pipeline/actions.js",
 ];
 
 export function localModuleSpecifiers(source) {
@@ -150,7 +152,9 @@ export function discoverReleaseAuthorityClosure() {
     [".js", ".mjs", ".cjs"],
     /(?:release-tail-provider-(?:adapters|plane)|create(?:GitHubReleaseAssets|SignedStaticChannel|SiteReleaseActivation|ReleasedEvidence)Adapter)/u,
   );
-  const runtimeSelectors = productionFiles("packages/core/runtime/entry", [".js"]).sort();
+  const runtimeSelectors = productionFiles("packages/core/runtime/entry", [
+    ".js",
+  ]).sort();
   const terminalProjections = matchingProductionFiles(
     [".github/workflows", "actions", "packages/core", "scripts"],
     [".yml", ".yaml", ".js", ".mjs", ".cjs"],
@@ -523,6 +527,7 @@ export function checkReleaseTopology() {
   assert.equal(ledger.contract, "kungfu-buildchain-v4-release-topology/v1");
   assertClosedWorld(ledger.closedWorld.workflowPaths);
   assertAuthorityClosure(ledger);
+  assertPipelinePublicationTopology(ledger, discoverReleaseTopology, root);
   const preview = ledger.postPublicationScope;
   assert.deepEqual(preview.workflowPaths, [
     ".github/workflows/public-release-oci-compose-preview.yml",

package/scripts/generate-minimal-consumer-contract.mjs

@@ -0,0 +1,155 @@
+import fs from "node:fs";
+import path from "node:path";
+import { execFileSync } from "node:child_process";
+import { parse as yaml } from "yaml";
+import { format } from "prettier";
+import { standardConsumerExample } from "../packages/core/consumer/contract/examples.js";
+import { inspectConsumerContract } from "../packages/core/consumer/contract/inspection.js";
+import { workflowPath } from "../packages/core/workflow/workflow-taxonomy.mjs";
+
+const root = process.cwd(),
+  check = process.argv.includes("--check");
+const tracked = execFileSync("git", ["ls-files", "-z"], { encoding: "utf8" })
+  .split("\0")
+  .filter(Boolean);
+
+function output(file, value) {
+  const target = path.join(root, file);
+  if (check) {
+    if (!fs.existsSync(target) || fs.readFileSync(target, "utf8") !== value)
+      throw new Error(`${file}: generated contract drift`);
+  } else {
+    fs.mkdirSync(path.dirname(target), { recursive: true });
+    fs.writeFileSync(target, value);
+  }
+}
+
+function destination(name) {
+  if (name === "config-path") return "normal-entry.config-path";
+  if (name === "runtime-ref") return "recovery-entry.runtime-ref";
+  if (/token|secret|private-key|app-id/u.test(name))
+    return "setup.provider-authority";
+  if (/run|resume|recover|transaction|discussion|attempt/u.test(name))
+    return "attempt.material-index";
+  if (/root|proof|nonce|warrant|fence|generation|candidate/u.test(name))
+    return "attempt.internal-authority";
+  return "internal.plan-derived-input";
+}
+
+function workflowInventory() {
+  const taxonomy = JSON.parse(
+    fs.readFileSync("architecture/workflow-taxonomy.json", "utf8"),
+  );
+  return taxonomy.entries
+    .filter((entry) => ["public", "self"].includes(entry.role))
+    .map((entry) => {
+      const file = workflowPath(entry),
+        document = yaml(fs.readFileSync(file, "utf8"));
+      return {
+        path: file,
+        role: entry.role,
+        events: Object.keys(document.on || {}).sort(),
+        secrets: Object.keys(document.on?.workflow_call?.secrets || {}).sort(),
+        outputs: Object.keys(document.on?.workflow_call?.outputs || {}).sort(),
+        destination:
+          entry.role === "self"
+            ? "self-dogfood.two-callers-or-internal-component"
+            : "internal-component.behind-pipeline-or-recovery",
+        interfaces: ["workflow_call", "workflow_dispatch"].flatMap((trigger) =>
+          Object.entries(document.on?.[trigger]?.inputs || {}).map(
+            ([name, definition]) => ({
+              trigger,
+              name,
+              definition,
+              destination: destination(name),
+            }),
+          ),
+        ),
+        calls: Object.entries(document.jobs || {})
+          .filter(([, job]) => job.uses)
+          .map(([id, job]) => ({
+            id,
+            uses: job.uses,
+            inputs: Object.keys(job.with || {}).sort(),
+            destination: "internal.workflow-composition",
+          })),
+      };
+    })
+    .sort((a, b) => a.path.localeCompare(b.path));
+}
+
+function consumerSourceInventory() {
+  return tracked
+    .filter(
+      (file) =>
+        (/^(?:templates|fixtures|\.buildchain)\//u.test(file) ||
+          file === "package.json") &&
+        /\.(?:ya?ml|toml|json|[cm]?js|sh|py|ps1)$/u.test(file) &&
+        !file.startsWith("templates/minimal-consumer/"),
+    )
+    .map((file) => {
+      const bytes = fs.readFileSync(file, "utf8");
+      const kind = /\.ya?ml$/u.test(file)
+        ? "caller"
+        : /\.toml$/u.test(file)
+          ? "config"
+          : "consumer-source";
+      return {
+        path: file,
+        kind,
+        destination:
+          kind === "caller"
+            ? "replace-with-shared-pair"
+            : kind === "config"
+              ? "closed-toml-plan"
+              : "retain-product-source; move-orchestration-into-runtime",
+        commandReferences: [
+          ...new Set(
+            bytes.match(
+              /(?:packages\/core|scripts)\/[A-Za-z0-9_./-]+\.(?:[cm]?js|sh|py|ps1)/gu,
+            ) || [],
+          ),
+        ].sort(),
+      };
+    });
+}
+
+for (const type of ["npm", "binary", "paper"]) {
+  const files = standardConsumerExample(type);
+  if (check) {
+    const directory = `templates/minimal-consumer/${type}`;
+    for (const entry of fs.readdirSync(directory, {
+      recursive: true,
+      withFileTypes: true,
+    })) {
+      if (entry.isDirectory()) continue;
+      const file = path
+        .relative(directory, path.join(entry.parentPath, entry.name))
+        .split(path.sep)
+        .join("/");
+      if (!entry.isFile() || !Object.hasOwn(files, file))
+        throw new Error(
+          `${directory}/${file}: undeclared generated consumer file`,
+        );
+    }
+  }
+  const inspection = inspectConsumerContract(files);
+  if (!inspection.ok) throw new Error(inspection.issues.join("\n"));
+  for (const [file, bytes] of Object.entries(files))
+    output(`templates/minimal-consumer/${type}/${file}`, bytes);
+}
+output(
+  "architecture/minimal-consumer-migration.json",
+  await format(
+    JSON.stringify({
+      schema: "buildchain.consumer-migration/v1",
+      stage: "contract-defined; execution-entry-not-yet-published",
+      workflows: workflowInventory(),
+      consumerSources: consumerSourceInventory(),
+    }),
+    { parser: "json" },
+  ),
+);
+console.log(
+  "Minimal consumer contract: three shared-caller examples and complete migration inventory verified.",
+);

package/scripts/verify-golden-path.mjs

@@ -1,5 +1,6 @@
 #!/usr/bin/env node
 import fs from "node:fs";
+import { readNpmPackResult } from "../packages/core/publication/npm/pack-result.js";
 import os from "node:os";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
@@ -44,7 +45,10 @@ export function verifyGoldenPath() {
       ["pack", "--json", "--pack-destination", packDir],
       { cwd: root, json: true },
     );
-    const tarball = path.join(packDir, packed[0].filename);
+    const tarball = path.join(
+      packDir,
+      readNpmPackResult(JSON.stringify(packed)).filename,
+    );
     fs.writeFileSync(
       path.join(consumer, "package.json"),
       `${JSON.stringify(

package/templates/minimal-consumer/binary/.buildchain/buildchain.toml

@@ -0,0 +1,45 @@
+schema = 2
+
+[[products]]
+id = "main"
+type = "binary"
+platforms = ["linux-x64"]
+build = ["node src/build.mjs"]
+verify = ["node src/verify.mjs"]
+
+[[products.artifacts]]
+id = "main"
+path = "dist/hello.tar.gz"
+kind = "archive"
+
+[[products.targets]]
+provider = "github-release"
+artifacts = ["main"]
+
+[version]
+strategy = "semver"
+
+[[version.files]]
+path = "package.json"
+format = "json"
+key = "version"
+
+[[channels]]
+from = "feature/*"
+to = "dev/v1/v1.0"
+operation = "develop"
+
+[[channels]]
+from = "dev/v1/v1.0"
+to = "alpha/v1/v1.0"
+operation = "alpha"
+
+[[channels]]
+from = "alpha/v1/v1.0"
+to = "release/v1/v1.0"
+operation = "stable"
+
+[review]
+minimum_approvals = 1
+code_owners = true
+merge_queue = true

package/templates/minimal-consumer/binary/.github/workflows/buildchain-recover.yml

@@ -0,0 +1,30 @@
+name: Buildchain recovery
+on:
+  workflow_dispatch:
+    inputs:
+      attempt:
+        description: Exact Buildchain attempt to recover
+        required: true
+        type: string
+      runtime-ref:
+        description: Optional repaired runtime
+        required: false
+        type: string
+permissions:
+  contents: read
+jobs:
+  buildchain:
+    uses: kungfu-systems/buildchain/.github/workflows/public-ops-recover.yml@v4
+    with:
+      attempt: ${{ inputs.attempt }}
+      runtime-ref: ${{ inputs.runtime-ref }}
+    secrets: inherit
+    permissions:
+      actions: write
+      attestations: write
+      checks: write
+      contents: write
+      discussions: write
+      id-token: write
+      pull-requests: write
+      statuses: write

package/templates/minimal-consumer/binary/.github/workflows/buildchain.yml

@@ -0,0 +1,28 @@
+name: Buildchain pipeline
+on:
+  pull_request:
+    types: [opened, reopened, synchronize, ready_for_review, converted_to_draft, closed, labeled, unlabeled, edited, enqueued, dequeued]
+  pull_request_review:
+    types: [submitted, dismissed]
+  pull_request_target:
+    types: [closed]
+  merge_group:
+    types: [checks_requested]
+  push:
+  repository_dispatch:
+    types: [buildchain-attempt-wake]
+permissions:
+  contents: read
+jobs:
+  buildchain:
+    uses: kungfu-systems/buildchain/.github/workflows/public-ops-pipeline.yml@v4
+    secrets: inherit
+    permissions:
+      actions: write
+      attestations: write
+      checks: write
+      contents: write
+      discussions: write
+      id-token: write
+      pull-requests: write
+      statuses: write

package/templates/minimal-consumer/binary/package.json

@@ -0,0 +1,6 @@
+{
+  "name": "minimal-binary",
+  "private": true,
+  "version": "1.0.0-alpha.1",
+  "type": "module"
+}