@kungfu-tech/buildchain 4.1.3-alpha.2 → 4.1.3-alpha.3

package/packages/core/dev-delivery/commands/project-cut-merge-queue-admission.mjs

@@ -61,19 +61,32 @@ function git(
   {
     env = {},
     input = undefined,
+    inputFile = undefined,
+    outputFile = undefined,
     encoding = "utf8",
     reason = "git-failed",
   } = {},
 ) {
-  const result = spawnSync("git", args, {
-    cwd,
-    env: { ...process.env, ...env },
-    input,
-    encoding,
-    maxBuffer: 64 * 1024 * 1024,
-  });
+  let result, inputDescriptor, outputDescriptor;
+  try {
+    if (inputFile) inputDescriptor = fs.openSync(inputFile, "r");
+    if (outputFile) outputDescriptor = fs.openSync(outputFile, "w");
+    result = spawnSync("git", args, {
+      cwd,
+      env: { ...process.env, ...env },
+      input,
+      encoding,
+      stdio: [inputDescriptor ?? "pipe", outputDescriptor ?? "pipe", "pipe"],
+      maxBuffer: 64 * 1024 * 1024,
+    });
+  } finally {
+    for (const descriptor of [inputDescriptor, outputDescriptor])
+      if (descriptor !== undefined) fs.closeSync(descriptor);
+  }
   if (result.status !== 0) {
-    const detail = String(result.stderr || result.stdout || "").trim();
+    const detail = String(
+      result.stderr || result.error?.message || result.stdout || "",
+    ).trim();
     throw new ProjectCutAdmissionError(
       reason,
       `git ${args.join(" ")} failed${detail ? `: ${detail}` : ""}`,
@@ -135,7 +148,7 @@ function linearSourceCommits(cwd, fork, head) {
 
 function patchId(cwd, patch) {
   const output = git(cwd, ["patch-id", "--stable"], {
-    input: patch,
+    inputFile: patch,
     encoding: "utf8",
     reason: "patch-id-failed",
   });
@@ -184,30 +197,41 @@ function replayProjectCut(cwd, base, head) {
       env: indexEnvironment,
       reason: "base-tree-unreadable",
     });
-    const sourcePatch = git(
+    // Generated bundles can exceed the metadata-output bound. Git streams the
+    // exact patches through private files; patch identity and replay stay intact.
+    const sourcePatch = path.join(temporary, "source.patch");
+    git(
       cwd,
       ["diff", "--binary", "--full-index", "--no-ext-diff", fork, head],
       {
-        encoding: null,
+        outputFile: sourcePatch,
         reason: "source-patch-unreadable",
       },
     );
-    const emptySourcePatch = sourcePatch.length === 0;
+    const emptySourcePatch = fs.statSync(sourcePatch).size === 0;
     if (emptySourcePatch && commits.length !== 1)
-      throw new ProjectCutAdmissionError("empty-source-composition", "an empty source composition must be exactly one linear commit");
-    if (!emptySourcePatch) git(cwd, ["apply", "--cached", "--3way", "--whitespace=nowarn", "-"], {
-        env: indexEnvironment, input: sourcePatch, encoding: "utf8", reason: "project-cut-conflict",
+      throw new ProjectCutAdmissionError(
+        "empty-source-composition",
+        "an empty source composition must be exactly one linear commit",
+      );
+    if (!emptySourcePatch)
+      git(cwd, ["apply", "--cached", "--3way", "--whitespace=nowarn", "-"], {
+        env: indexEnvironment,
+        inputFile: sourcePatch,
+        encoding: "utf8",
+        reason: "project-cut-conflict",
       });
     const candidateTreeOid = git(cwd, ["write-tree"], {
       env: indexEnvironment,
       reason: "candidate-tree-unreadable",
     });
-    const replayPatch = git(
+    const replayPatch = path.join(temporary, "replay.patch");
+    git(
       cwd,
       ["diff", "--cached", "--binary", "--full-index", "--no-ext-diff", base],
       {
         env: indexEnvironment,
-        encoding: null,
+        outputFile: replayPatch,
         reason: "replay-patch-unreadable",
       },
     );
@@ -226,9 +250,12 @@ function replayProjectCut(cwd, base, head) {
         reason: "replay-paths-unreadable",
       },
     );
-    const compositionDrifted = emptySourcePatch ? replayPatch.length !== 0 ||
-      sourceNames !== "" || replayNames !== "" : patchId(cwd, sourcePatch) !==
-      patchId(cwd, replayPatch) || sourceNames !== replayNames;
+    const compositionDrifted = emptySourcePatch
+      ? fs.statSync(replayPatch).size !== 0 ||
+        sourceNames !== "" ||
+        replayNames !== ""
+      : patchId(cwd, sourcePatch) !== patchId(cwd, replayPatch) ||
+        sourceNames !== replayNames;
     if (compositionDrifted) {
       throw new ProjectCutAdmissionError(
         "composition-drift",

package/packages/core/governance/buildchain-publication-authority.js

@@ -43,6 +43,7 @@ const DESCRIPTORS = Object.freeze([
   [".github/workflows/public-ops-recover.yml", "product-publication", true, ["npm-publish", "github-release", "channel-ref"], "trusted-publishing", "none", "fixed", "fixed", ".github/workflows/.release-pipeline-products.yml"],
   [".github/workflows/.ops-pipeline-execute.yml", "product-publication", true, ["npm-publish", "github-release", "channel-ref"], "trusted-publishing", "none", "fixed", "fixed", ".github/workflows/.release-pipeline-products.yml"],
   [".github/workflows/.release-pipeline-products.yml", "product-publication", true, ["npm-publish", "github-release", "channel-ref"], "trusted-publishing", "none", "fixed", "fixed"],
+  [".github/workflows/.release-pipeline-version.yml", "governance-write"],
   [".github/workflows/.ops-pipeline-delivery.yml", "governance-write"],
   [".github/workflows/self-ops-housekeeping-daily.yml", "governance-write"],
   [".github/workflows/self-ops-housekeeping-monthly.yml", "governance-write"],

package/packages/core/providers/github/pipeline-entry-runs.js

@@ -0,0 +1,203 @@
+import { createHash } from "node:crypto";
+import { runtimeSelector } from "../../runtime/entry/selection.js";
+import { pipelineRunEntry, readPipelineCaller } from "./pipeline-run-entry.js";
+import { recordDigest } from "../../release/discussion/envelope.js";
+
+export async function pipelineEntryRuns(host, publishedAt) {
+  const created = encodeURIComponent(
+    `>=${new Date(publishedAt).toISOString()}`,
+  );
+  const prefix = `/repos/${host.repository}/actions/workflows/buildchain.yml/runs`;
+  const runs = [],
+    ids = new Set();
+  for (let page = 1; page <= 10; page++) {
+    const result = await host.request(
+      `${prefix}?event=pull_request&status=completed&created=${created}&per_page=100&page=${page}`,
+      { allow404: true },
+    );
+    if (!result && page === 1) return [];
+    if (
+      !Array.isArray(result?.workflow_runs) ||
+      result.workflow_runs.length > 100
+    )
+      throw new Error("Published entry run inventory is incomplete");
+    for (const run of result.workflow_runs) {
+      if (
+        !Number.isSafeInteger(run.id) ||
+        run.id < 1 ||
+        ids.has(run.id) ||
+        !Number.isSafeInteger(run.run_attempt) ||
+        run.run_attempt < 1 ||
+        !Number.isFinite(Date.parse(run.created_at))
+      )
+        throw new Error(
+          "Published entry run inventory has ambiguous coordinates",
+        );
+      ids.add(run.id);
+      runs.push(run);
+    }
+    if (result.workflow_runs.length < 100)
+      return runs.sort(
+        (a, b) =>
+          Date.parse(b.created_at) - Date.parse(a.created_at) || b.id - a.id,
+      );
+  }
+  throw new Error(
+    "Published entry run inventory exceeds its complete-read bound",
+  );
+}
+
+async function sourceLock(host, source, channel) {
+  const pathname =
+    channel === "v4-alpha"
+      ? ".buildchain/alpha-contract-lock.json"
+      : ".buildchain/contract-lock.json";
+  const file = await host.request(
+    `/repos/${host.repository}/contents/${pathname}?ref=${source.commit}`,
+    { allow404: true },
+  );
+  if (!file) return { value: undefined, evidence: null };
+  if (
+    file.type !== "file" ||
+    file.encoding !== "base64" ||
+    !Number.isSafeInteger(file.size) ||
+    file.size < 1 ||
+    file.size > 1024 * 1024 ||
+    typeof file.content !== "string" ||
+    file.content.length > 2 * 1024 * 1024
+  )
+    throw new Error("Published entry runtime lock exceeds its source boundary");
+  const bytes = Buffer.from(file.content, "base64");
+  const blob = createHash("sha1")
+    .update(`blob ${bytes.length}\0`)
+    .update(bytes)
+    .digest("hex");
+  if (bytes.length !== file.size || blob !== file.sha)
+    throw new Error("Published entry runtime lock bytes changed");
+  const value = JSON.parse(
+    new TextDecoder("utf-8", { fatal: true }).decode(bytes),
+  );
+  if (
+    value.schema === "buildchain.consumer-contract-lock/v2" &&
+    value.configDigest !== source.configDigest
+  )
+    throw new Error(
+      "Published entry runtime lock belongs to another consumer configuration",
+    );
+  return {
+    value,
+    evidence: {
+      path: pathname,
+      blob,
+      digest: `sha256:${createHash("sha256").update(bytes).digest("hex")}`,
+    },
+  };
+}
+
+export async function pipelineEntryRun(run, plan, source, host) {
+  if (
+    run.event !== "pull_request" ||
+    run.status !== "completed" ||
+    run.repository?.full_name !== host.repository ||
+    run.head_repository?.full_name !== host.repository ||
+    run.path?.split("@")[0] !== ".github/workflows/buildchain.yml" ||
+    !Number.isFinite(Date.parse(run.created_at)) ||
+    Date.parse(run.created_at) < Date.parse(source.candidate.publishedAt)
+  )
+    return null;
+  const entry = pipelineRunEntry(run);
+  if (entry.recovery || entry.definition.sha !== source.candidate.sha)
+    return null;
+  const consumer = await host.source.source(
+    run.head_sha,
+    plan.source.configPath,
+  );
+  if (recordDigest(consumer.plan) !== plan.contractRoot) return null;
+  if (
+    consumer.identity.commit !== run.head_sha ||
+    consumer.identity.configPath !== plan.source.configPath ||
+    consumer.identity.repository !== host.repository
+  )
+    throw new Error("Published entry consumer source changed during readback");
+  await readPipelineCaller(
+    run,
+    consumer.identity.configPath,
+    host.request,
+    host.repository,
+  );
+  const lock = await sourceLock(host, consumer.identity, entry.channel);
+  const selection = runtimeSelector({
+    lock: lock.value,
+    workflowSha: entry.definition.sha,
+  });
+  if (selection.ref !== source.candidate.sha) return null;
+  return {
+    source: consumer.identity,
+    entry: entry.definition,
+    selection,
+    lock: lock.evidence,
+  };
+}
+
+export async function pipelineEntryCheck(run, host) {
+  const checks = [],
+    ids = new Set();
+  const prefix = `/repos/${host.repository}/commits/${run.head_sha}/check-runs`;
+  for (let page = 1; page <= 10; page++) {
+    const result = await host.request(
+      `${prefix}?check_name=check&filter=all&per_page=100&page=${page}`,
+    );
+    if (!Array.isArray(result?.check_runs) || result.check_runs.length > 100)
+      throw new Error("Published entry check inventory is incomplete");
+    for (const check of result.check_runs) {
+      if (!Number.isSafeInteger(check.id) || check.id < 1 || ids.has(check.id))
+        throw new Error(
+          "Published entry check inventory has ambiguous identities",
+        );
+      ids.add(check.id);
+      checks.push(check);
+    }
+    if (result.check_runs.length < 100)
+      return exactCheck(checks, run, host.repository);
+  }
+  throw new Error(
+    "Published entry check inventory exceeds its complete-read bound",
+  );
+}
+
+function exactCheck(checks, run, repository) {
+  const url = `https://github.com/${repository}/actions/runs/${run.id}/attempts/${run.run_attempt}`;
+  const matches = checks.filter(
+    (check) => check.name === "check" && check.details_url === url,
+  );
+  if (!matches.length) return null;
+  const values = matches.map((check) => {
+    const parsed =
+      /^buildchain:(attempt-[0-9a-f]{64}):([1-9][0-9]*):([1-9][0-9]*)$/u.exec(
+        check.external_id || "",
+      );
+    if (
+      !parsed ||
+      Number(parsed[2]) !== run.id ||
+      Number(parsed[3]) !== run.run_attempt ||
+      check.head_sha !== run.head_sha ||
+      check.status !== "completed" ||
+      !["success", "failure"].includes(check.conclusion) ||
+      check.app?.slug !== "github-actions"
+    )
+      throw new Error(
+        "Published entry check does not bind its exact native attempt",
+      );
+    return {
+      attempt: parsed[1],
+      outcome: check.conclusion,
+      summary: check.output?.summary || "",
+    };
+  });
+  if (values.some((value) => recordDigest(value) !== recordDigest(values[0])))
+    throw new Error("Published entry checks disagree about the same execution");
+  return {
+    ...values[0],
+    ids: matches.map(({ id }) => id).sort((a, b) => a - b),
+  };
+}

package/packages/core/providers/github/pipeline-release-evidence.js

@@ -0,0 +1,111 @@
+import { createHash } from "node:crypto";
+import { recordDigest } from "../../release/discussion/envelope.js";
+
+const NAMES = [
+  "plan",
+  "qualification",
+  "capsules",
+  "invocation",
+  "attestation",
+  "release",
+];
+const LIMIT = 8 * 1024 * 1024;
+
+async function inventory(request, prefix) {
+  const assets = [],
+    ids = new Set(),
+    names = new Set();
+  for (let page = 1; page <= 20; page++) {
+    const values = await request(`${prefix}/assets?per_page=100&page=${page}`);
+    if (!Array.isArray(values) || values.length > 100)
+      throw new Error("Published evidence asset inventory is incomplete");
+    for (const value of values) {
+      if (
+        !Number.isSafeInteger(value.id) ||
+        value.id < 1 ||
+        typeof value.name !== "string" ||
+        !value.name ||
+        ids.has(value.id) ||
+        names.has(value.name)
+      )
+        throw new Error("Published evidence asset inventory is ambiguous");
+      ids.add(value.id);
+      names.add(value.name);
+      assets.push(value);
+    }
+    if (values.length < 100) return assets;
+  }
+  throw new Error(
+    "Published evidence inventory exceeds its complete-read bound",
+  );
+}
+
+function selectedAssets(assets) {
+  return NAMES.map((id) => {
+    const name = `buildchain.${id}.json`;
+    const asset = assets.find((value) => value.name === name);
+    if (!asset) return { name, missing: true };
+    if (
+      asset.state !== "uploaded" ||
+      !Number.isSafeInteger(asset.size) ||
+      asset.size < 1 ||
+      asset.size > LIMIT ||
+      !/^sha256:[0-9a-f]{64}$/u.test(asset.digest || "")
+    )
+      throw new Error("Published evidence asset lacks bounded immutable bytes");
+    return { id: asset.id, name, size: asset.size, digest: asset.digest };
+  });
+}
+
+// Download only fixed evidence names from the exact already-observed release.
+// There is no caller-supplied URL, artifact selector or provider write here.
+export async function readPipelineReleaseEvidence(host, candidate) {
+  const repository = host.repository;
+  if (
+    !/^[\w.-]+\/[\w.-]+$/u.test(repository || "") ||
+    !Number.isSafeInteger(candidate.id) ||
+    candidate.id < 1
+  )
+    throw new Error("Published evidence requires exact release coordinates");
+  const prefix = `/repos/${repository}/releases/${candidate.id}`;
+  const selected = selectedAssets(await inventory(host.request, prefix));
+  const missing = selected
+    .filter((value) => value.missing)
+    .map(({ name }) => name);
+  if (missing.length) return { status: "missing", missing };
+  const [owner, repo] = repository.split("/");
+  const values = {};
+  let bundle;
+  for (const asset of selected) {
+    const result = await host.github.rest.repos.getReleaseAsset({
+      owner,
+      repo,
+      asset_id: asset.id,
+      headers: { accept: "application/octet-stream" },
+    });
+    const bytes = Buffer.from(result.data);
+    if (
+      bytes.length !== asset.size ||
+      bytes.length > LIMIT ||
+      `sha256:${createHash("sha256").update(bytes).digest("hex")}` !==
+        asset.digest
+    )
+      throw new Error(
+        "Published evidence download differs from provider bytes",
+      );
+    const id = asset.name.slice("buildchain.".length, -".json".length);
+    if (id === "attestation") bundle = bytes;
+    else
+      values[id] = JSON.parse(
+        new TextDecoder("utf-8", { fatal: true }).decode(bytes),
+      );
+  }
+  if (
+    recordDigest(selectedAssets(await inventory(host.request, prefix))) !==
+    recordDigest(selected)
+  )
+    throw new Error(
+      "Published evidence assets changed during provider readback",
+    );
+  return { status: "present", values, bundle, assets: selected };
+}