@kungfu-tech/buildchain 4.1.3-alpha.2 → 4.1.3-alpha.3

package/packages/core/release/stable-release-gate.js

@@ -184,8 +184,19 @@ export function evaluateStableReleaseGate({
     "version-bound impact declares a summary and at least one surface",
     { summary: string(impact?.summary), surfaceIds: surfaceImpacts.map((entry) => string(entry?.id)).filter(Boolean) },
   ));
+  checks.push(check(
+    string(impact?.release?.version) === candidateTag.replace(/^v/, ""),
+    "stable.impact_version",
+    "product impact belongs to the exact candidate version",
+    { expectedVersion: candidateTag.replace(/^v/, ""), observedVersion: string(impact?.release?.version) },
+  ));
 
   const canaryById = new Map(canaries.map((canary) => [string(canary?.id), canary]));
+  checks.push(check(
+    canaryById.size === canaries.length,
+    "canary.evidence_inventory",
+    "each canary has one unambiguous observation",
+  ));
   const canaryCompletionTimes = [];
   for (const required of policy.requiredCanaries) {
     const evidence = canaryById.get(required.id);

package/packages/core/workflow/attempt/identity.js

@@ -67,7 +67,7 @@ export function pipelineIntent({
   });
 }
 
-export function sourceGeneration(intent, source, baseCommit) {
+export function validateConsumerSource(source, repository) {
   object(
     source,
     [
@@ -86,13 +86,18 @@ export function sourceGeneration(intent, source, baseCommit) {
   if (
     source.schema !== "buildchain.consumer-source/v1" ||
     source.contract !== CONSUMER_CONTRACT ||
-    source.repository !== intent.repository
+    source.repository !== repository
   )
     throw new Error("Generation requires the admitted consumer source");
   for (const key of ["commit", "tree", "configBlob"])
     text(source[key], `source.${key}`, /^[0-9a-f]{40}$/u);
   relativePath(source.configPath, "source.configPath");
   text(source.configDigest, "source.configDigest", ROOT);
+  return source;
+}
+
+export function sourceGeneration(intent, source, baseCommit) {
+  validateConsumerSource(source, intent.repository);
   text(baseCommit, "baseCommit", /^[0-9a-f]{40}$/u);
   const value = {
     schema: SOURCE_GENERATION,

package/packages/core/workflow/pipeline/actions.js

@@ -6,6 +6,7 @@ import { pipelineHost } from "./host.js";
 import { controlPipeline } from "./controller.js";
 import { buildPipelineSource } from "./build.js";
 import { recordPipelineBuild } from "./build-control.js";
+import { wakePipelineStableWait } from "../../publication/pipeline/stable-wait.js";
 import {
   RECOVERY_BUILD_CONTEXT,
   recordRecoveryBuild,
@@ -57,6 +58,18 @@ export async function recordPipelineBuildAction(core, env) {
 }
 
 export async function wakePipelineAction(core, env) {
-  const host = await pipelineHost(core, env, "Record delivery attempt");
+  const waiting = core.getInput("stable-wait");
+  const host = await pipelineHost(
+    core,
+    env,
+    waiting ? "Recheck stable publication" : "Record delivery attempt",
+  );
+  if (waiting) {
+    const wait = JSON.parse(waiting);
+    if (wait.attempt !== core.getInput("attempt", { required: true }))
+      throw new Error("Stable wake changed its exact business attempt");
+    core.info(JSON.stringify(await wakePipelineStableWait(wait, host)));
+    return;
+  }
   await host.wake(core.getInput("attempt", { required: true }));
 }

package/packages/core/workflow/pipeline/build.js

@@ -1,12 +1,57 @@
 import fs from "node:fs";
 import path from "node:path";
 import { execFileSync } from "node:child_process";
+import { createHash } from "node:crypto";
 import { bindConsumerSource } from "../../consumer/contract/identity.js";
 import { recordDigest } from "../../release/discussion/envelope.js";
 import { consumerCommandSession } from "../../runtime/consumer-shell.js";
 import { createNativeChildEnvironment } from "../../dev-delivery/native/execution.js";
 
-function sourceCheckout(cwd, expected) {
+function inspectTrackedBytes(cwd, tree) {
+  const root = fs.realpathSync(cwd);
+  const entries = execFileSync(
+    "git",
+    ["-C", root, "ls-tree", "-r", "-z", tree],
+    {
+      encoding: "utf8",
+      maxBuffer: 16 * 1024 * 1024,
+    },
+  )
+    .split("\0")
+    .filter(Boolean);
+  for (const entry of entries) {
+    const match =
+      /^(100644|100755|120000) blob ([0-9a-f]{40})\t([\s\S]+)$/u.exec(entry);
+    if (!match) throw new Error("Build source requires resolved tracked files");
+    const [, mode, blob, file] = match;
+    const absolute = path.join(root, file);
+    if (fs.realpathSync(path.dirname(absolute)) !== path.dirname(absolute))
+      throw new Error(`Build source parent became a symbolic link: ${file}`);
+    const stat = fs.lstatSync(absolute);
+    const link = mode === "120000";
+    if (link ? !stat.isSymbolicLink() : !stat.isFile())
+      throw new Error(`Build tracked source kind changed: ${file}`);
+    if (
+      !link &&
+      process.platform !== "win32" &&
+      Boolean(stat.mode & 0o111) !== (mode === "100755")
+    )
+      throw new Error(`Build tracked source executable mode changed: ${file}`);
+    const bytes = link
+      ? fs.readlinkSync(absolute, { encoding: "buffer" })
+      : fs.readFileSync(absolute);
+    const actual = createHash("sha1")
+      .update(`blob ${bytes.length}\0`)
+      .update(bytes)
+      .digest("hex");
+    if (actual !== blob)
+      throw new Error(
+        `Build tracked source bytes differ from the admitted tree: ${file}`,
+      );
+  }
+}
+
+export function inspectPipelineSource(cwd, expected) {
   const git = (...args) =>
     execFileSync("git", ["-C", cwd, ...args], {
       encoding: "utf8",
@@ -36,6 +81,8 @@ function sourceCheckout(cwd, expected) {
     throw new Error(
       "Build source has tracked modifications at its verification boundary",
     );
+  // Index flags and local Git filters cannot qualify different product bytes.
+  inspectTrackedBytes(cwd, expected.tree);
   return plan;
 }
 
@@ -54,7 +101,7 @@ function productDirectory(cwd, product) {
 // jobs must bind provider completion and exact artifacts before granting reuse.
 export async function buildPipelineSource(
   { cwd, source, platform, environment = process.env },
-  { inspect = sourceCheckout, session = consumerCommandSession } = {},
+  { inspect = inspectPipelineSource, session = consumerCommandSession } = {},
 ) {
   const plan = inspect(cwd, source);
   const result = await buildPipelineProducts(

package/scripts/check-pipeline-publication-topology.mjs

@@ -12,6 +12,7 @@ export function assertPipelinePublicationTopology(
     ".github/workflows/public-ops-pipeline.yml",
     ".github/workflows/public-ops-recover.yml",
     ".github/workflows/.ops-pipeline-execute.yml",
+    ".github/workflows/.release-pipeline-version.yml",
   ]);
   const pipelineTopology = discoverReleaseTopology(
     pipeline.workflowPaths,
@@ -33,4 +34,15 @@ export function assertPipelinePublicationTopology(
         module,
       ),
     );
+  const version = ".github/workflows/.release-pipeline-version.yml";
+  assert.ok(
+    inspectWorkflowJob(version, "build", root).modules.has(
+      "packages/core/publication/pipeline/version-build.js",
+    ),
+  );
+  assert.ok(
+    inspectWorkflowJob(version, "materialize", root).modules.has(
+      "packages/core/publication/pipeline/version-context.js",
+    ),
+  );
 }

package/scripts/check-release-topology.mjs

@@ -30,6 +30,7 @@ const PRIVILEGED_ENTRYPOINTS = [
   "packages/core/publication/oci/preview-actions.js",
   "packages/core/publication/settlement/actions.js",
   "packages/core/publication/pipeline/actions.js",
+  "packages/core/publication/pipeline/version-actions.js",
 ];
 
 export function localModuleSpecifiers(source) {

package/scripts/generate-site-bundle.mjs

@@ -1343,7 +1343,7 @@ function buildSiteBundle() {
     "badge-endpoint-registry.json": badgeEndpointRegistry,
     "publication-registry.json": publicationRegistry,
     "buildchain-contract.json": createBuildchainContractWorld({ root, controllerRegistry }),
-    "kfd-upstream-aggregate.json": collectKfdUpstreamFacts({ cwd: root, includeOwn: false }),
+    "kfd-upstream-aggregate.json": collectKfdUpstreamFacts({ cwd: root, components: readJson("architecture/product-upstreams.json"), includeOwn: false }),
     "kfd-claims.json": createBuildchainKfdClaimRegistry({ root }),
     "product-mechanism.json": productMechanism,
     "release-provenance.json": releaseProvenance,

package/scripts/verify-standalone-product.mjs

@@ -0,0 +1,42 @@
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import path from "node:path";
+import { execFileSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import {
+  platformTriple,
+  packageVersion,
+  sourceSha,
+} from "../packages/core/build/standalone/identity.js";
+
+const cwd = process.cwd();
+const manifest = JSON.parse(
+  fs.readFileSync(
+    path.join(cwd, "dist/binary", `buildchain-${platformTriple()}.json`),
+    "utf8",
+  ),
+);
+const version = packageVersion(cwd);
+assert.equal(manifest.version, version);
+assert.equal(manifest.sourceSha, sourceSha(cwd));
+assert.equal(manifest.platform, platformTriple());
+const binary = path.join(
+  cwd,
+  "dist/binary",
+  process.platform === "win32" ? "buildchain.exe" : "buildchain",
+);
+assert.equal(
+  createHash("sha256").update(fs.readFileSync(binary)).digest("hex"),
+  manifest.sha256,
+);
+assert.equal(
+  execFileSync(binary, ["--version"], { encoding: "utf8" }).trim(),
+  version,
+);
+assert.match(
+  execFileSync(binary, ["help"], { encoding: "utf8" }),
+  /^Usage:\s+buildchain --help/mu,
+);
+process.stdout.write(
+  `Verified standalone product ${platformTriple()} at ${version}\n`,
+);