@kungfu-tech/buildchain 4.1.3-alpha.2 → 4.1.3-alpha.4

package/packages/core/dev-delivery/commands/project-cut-merge-queue-admission.mjs

@@ -61,19 +61,32 @@ function git(
   {
     env = {},
     input = undefined,
+    inputFile = undefined,
+    outputFile = undefined,
     encoding = "utf8",
     reason = "git-failed",
   } = {},
 ) {
-  const result = spawnSync("git", args, {
-    cwd,
-    env: { ...process.env, ...env },
-    input,
-    encoding,
-    maxBuffer: 64 * 1024 * 1024,
-  });
+  let result, inputDescriptor, outputDescriptor;
+  try {
+    if (inputFile) inputDescriptor = fs.openSync(inputFile, "r");
+    if (outputFile) outputDescriptor = fs.openSync(outputFile, "w");
+    result = spawnSync("git", args, {
+      cwd,
+      env: { ...process.env, ...env },
+      input,
+      encoding,
+      stdio: [inputDescriptor ?? "pipe", outputDescriptor ?? "pipe", "pipe"],
+      maxBuffer: 64 * 1024 * 1024,
+    });
+  } finally {
+    for (const descriptor of [inputDescriptor, outputDescriptor])
+      if (descriptor !== undefined) fs.closeSync(descriptor);
+  }
   if (result.status !== 0) {
-    const detail = String(result.stderr || result.stdout || "").trim();
+    const detail = String(
+      result.stderr || result.error?.message || result.stdout || "",
+    ).trim();
     throw new ProjectCutAdmissionError(
       reason,
       `git ${args.join(" ")} failed${detail ? `: ${detail}` : ""}`,
@@ -135,7 +148,7 @@ function linearSourceCommits(cwd, fork, head) {
 
 function patchId(cwd, patch) {
   const output = git(cwd, ["patch-id", "--stable"], {
-    input: patch,
+    inputFile: patch,
     encoding: "utf8",
     reason: "patch-id-failed",
   });
@@ -184,30 +197,41 @@ function replayProjectCut(cwd, base, head) {
       env: indexEnvironment,
       reason: "base-tree-unreadable",
     });
-    const sourcePatch = git(
+    // Generated bundles can exceed the metadata-output bound. Git streams the
+    // exact patches through private files; patch identity and replay stay intact.
+    const sourcePatch = path.join(temporary, "source.patch");
+    git(
       cwd,
       ["diff", "--binary", "--full-index", "--no-ext-diff", fork, head],
       {
-        encoding: null,
+        outputFile: sourcePatch,
         reason: "source-patch-unreadable",
       },
     );
-    const emptySourcePatch = sourcePatch.length === 0;
+    const emptySourcePatch = fs.statSync(sourcePatch).size === 0;
     if (emptySourcePatch && commits.length !== 1)
-      throw new ProjectCutAdmissionError("empty-source-composition", "an empty source composition must be exactly one linear commit");
-    if (!emptySourcePatch) git(cwd, ["apply", "--cached", "--3way", "--whitespace=nowarn", "-"], {
-        env: indexEnvironment, input: sourcePatch, encoding: "utf8", reason: "project-cut-conflict",
+      throw new ProjectCutAdmissionError(
+        "empty-source-composition",
+        "an empty source composition must be exactly one linear commit",
+      );
+    if (!emptySourcePatch)
+      git(cwd, ["apply", "--cached", "--3way", "--whitespace=nowarn", "-"], {
+        env: indexEnvironment,
+        inputFile: sourcePatch,
+        encoding: "utf8",
+        reason: "project-cut-conflict",
       });
     const candidateTreeOid = git(cwd, ["write-tree"], {
       env: indexEnvironment,
       reason: "candidate-tree-unreadable",
     });
-    const replayPatch = git(
+    const replayPatch = path.join(temporary, "replay.patch");
+    git(
       cwd,
       ["diff", "--cached", "--binary", "--full-index", "--no-ext-diff", base],
       {
         env: indexEnvironment,
-        encoding: null,
+        outputFile: replayPatch,
         reason: "replay-patch-unreadable",
       },
     );
@@ -226,9 +250,12 @@ function replayProjectCut(cwd, base, head) {
         reason: "replay-paths-unreadable",
       },
     );
-    const compositionDrifted = emptySourcePatch ? replayPatch.length !== 0 ||
-      sourceNames !== "" || replayNames !== "" : patchId(cwd, sourcePatch) !==
-      patchId(cwd, replayPatch) || sourceNames !== replayNames;
+    const compositionDrifted = emptySourcePatch
+      ? fs.statSync(replayPatch).size !== 0 ||
+        sourceNames !== "" ||
+        replayNames !== ""
+      : patchId(cwd, sourcePatch) !== patchId(cwd, replayPatch) ||
+        sourceNames !== replayNames;
     if (compositionDrifted) {
       throw new ProjectCutAdmissionError(
         "composition-drift",

package/packages/core/governance/buildchain-publication-authority.js

@@ -43,6 +43,7 @@ const DESCRIPTORS = Object.freeze([
   [".github/workflows/public-ops-recover.yml", "product-publication", true, ["npm-publish", "github-release", "channel-ref"], "trusted-publishing", "none", "fixed", "fixed", ".github/workflows/.release-pipeline-products.yml"],
   [".github/workflows/.ops-pipeline-execute.yml", "product-publication", true, ["npm-publish", "github-release", "channel-ref"], "trusted-publishing", "none", "fixed", "fixed", ".github/workflows/.release-pipeline-products.yml"],
   [".github/workflows/.release-pipeline-products.yml", "product-publication", true, ["npm-publish", "github-release", "channel-ref"], "trusted-publishing", "none", "fixed", "fixed"],
+  [".github/workflows/.release-pipeline-version.yml", "governance-write"],
   [".github/workflows/.ops-pipeline-delivery.yml", "governance-write"],
   [".github/workflows/self-ops-housekeeping-daily.yml", "governance-write"],
   [".github/workflows/self-ops-housekeeping-monthly.yml", "governance-write"],

package/packages/core/providers/github/discussions/materials.js

@@ -10,10 +10,13 @@ export function discussionMaterials({
   octokit,
   repository,
   intentId,
+  partition = "",
   authorityDescription = "The associated Discussion owns transaction state.",
 }) {
   const [owner, repo] = repository.split("/");
-  const tag = `buildchain-records/${intentId.replace("sha256:", "")}`;
+  if (partition && !/^[1-9][0-9]*-[1-9][0-9]*-[1-9][0-9]*$/u.test(partition))
+    throw new Error("Invalid material archive writer partition");
+  const tag = `buildchain-records/${intentId.replace("sha256:", "")}${partition ? `/${partition}` : ""}`;
   const repos = octokit.rest.repos;
   let retainedArchive;
   async function findArchive() {
@@ -32,8 +35,7 @@ export function discussionMaterials({
       throw new Error("Ambiguous transaction material archive");
     return matches[0];
   }
-  async function archive() {
-    if (retainedArchive) return retainedArchive;
+  async function createArchive() {
     let release = await findArchive();
     if (!release) {
       try {
@@ -60,9 +62,15 @@ export function discussionMaterials({
     }
     if (!release.draft || release.tag_name !== tag)
       throw new Error("Transaction material archive identity mismatch");
-    retainedArchive = release;
     return release;
   }
+  function archive() {
+    // Concurrent puts in one writer share the same creation, including readback.
+    return (retainedArchive ||= createArchive().catch((error) => {
+      retainedArchive = undefined;
+      throw error;
+    }));
+  }
   async function read(handle) {
     const response = await repos.getReleaseAsset({
       owner,

package/packages/core/providers/github/pipeline-entry-runs.js

@@ -0,0 +1,203 @@
+import { createHash } from "node:crypto";
+import { runtimeSelector } from "../../runtime/entry/selection.js";
+import { pipelineRunEntry, readPipelineCaller } from "./pipeline-run-entry.js";
+import { recordDigest } from "../../release/discussion/envelope.js";
+
+export async function pipelineEntryRuns(host, publishedAt) {
+  const created = encodeURIComponent(
+    `>=${new Date(publishedAt).toISOString()}`,
+  );
+  const prefix = `/repos/${host.repository}/actions/workflows/buildchain.yml/runs`;
+  const runs = [],
+    ids = new Set();
+  for (let page = 1; page <= 10; page++) {
+    const result = await host.request(
+      `${prefix}?event=pull_request&status=completed&created=${created}&per_page=100&page=${page}`,
+      { allow404: true },
+    );
+    if (!result && page === 1) return [];
+    if (
+      !Array.isArray(result?.workflow_runs) ||
+      result.workflow_runs.length > 100
+    )
+      throw new Error("Published entry run inventory is incomplete");
+    for (const run of result.workflow_runs) {
+      if (
+        !Number.isSafeInteger(run.id) ||
+        run.id < 1 ||
+        ids.has(run.id) ||
+        !Number.isSafeInteger(run.run_attempt) ||
+        run.run_attempt < 1 ||
+        !Number.isFinite(Date.parse(run.created_at))
+      )
+        throw new Error(
+          "Published entry run inventory has ambiguous coordinates",
+        );
+      ids.add(run.id);
+      runs.push(run);
+    }
+    if (result.workflow_runs.length < 100)
+      return runs.sort(
+        (a, b) =>
+          Date.parse(b.created_at) - Date.parse(a.created_at) || b.id - a.id,
+      );
+  }
+  throw new Error(
+    "Published entry run inventory exceeds its complete-read bound",
+  );
+}
+
+async function sourceLock(host, source, channel) {
+  const pathname =
+    channel === "v4-alpha"
+      ? ".buildchain/alpha-contract-lock.json"
+      : ".buildchain/contract-lock.json";
+  const file = await host.request(
+    `/repos/${host.repository}/contents/${pathname}?ref=${source.commit}`,
+    { allow404: true },
+  );
+  if (!file) return { value: undefined, evidence: null };
+  if (
+    file.type !== "file" ||
+    file.encoding !== "base64" ||
+    !Number.isSafeInteger(file.size) ||
+    file.size < 1 ||
+    file.size > 1024 * 1024 ||
+    typeof file.content !== "string" ||
+    file.content.length > 2 * 1024 * 1024
+  )
+    throw new Error("Published entry runtime lock exceeds its source boundary");
+  const bytes = Buffer.from(file.content, "base64");
+  const blob = createHash("sha1")
+    .update(`blob ${bytes.length}\0`)
+    .update(bytes)
+    .digest("hex");
+  if (bytes.length !== file.size || blob !== file.sha)
+    throw new Error("Published entry runtime lock bytes changed");
+  const value = JSON.parse(
+    new TextDecoder("utf-8", { fatal: true }).decode(bytes),
+  );
+  if (
+    value.schema === "buildchain.consumer-contract-lock/v2" &&
+    value.configDigest !== source.configDigest
+  )
+    throw new Error(
+      "Published entry runtime lock belongs to another consumer configuration",
+    );
+  return {
+    value,
+    evidence: {
+      path: pathname,
+      blob,
+      digest: `sha256:${createHash("sha256").update(bytes).digest("hex")}`,
+    },
+  };
+}
+
+export async function pipelineEntryRun(run, plan, source, host) {
+  if (
+    run.event !== "pull_request" ||
+    run.status !== "completed" ||
+    run.repository?.full_name !== host.repository ||
+    run.head_repository?.full_name !== host.repository ||
+    run.path?.split("@")[0] !== ".github/workflows/buildchain.yml" ||
+    !Number.isFinite(Date.parse(run.created_at)) ||
+    Date.parse(run.created_at) < Date.parse(source.candidate.publishedAt)
+  )
+    return null;
+  const entry = pipelineRunEntry(run);
+  if (entry.recovery || entry.definition.sha !== source.candidate.sha)
+    return null;
+  const consumer = await host.source.source(
+    run.head_sha,
+    plan.source.configPath,
+  );
+  if (recordDigest(consumer.plan) !== plan.contractRoot) return null;
+  if (
+    consumer.identity.commit !== run.head_sha ||
+    consumer.identity.configPath !== plan.source.configPath ||
+    consumer.identity.repository !== host.repository
+  )
+    throw new Error("Published entry consumer source changed during readback");
+  await readPipelineCaller(
+    run,
+    consumer.identity.configPath,
+    host.request,
+    host.repository,
+  );
+  const lock = await sourceLock(host, consumer.identity, entry.channel);
+  const selection = runtimeSelector({
+    lock: lock.value,
+    workflowSha: entry.definition.sha,
+  });
+  if (selection.ref !== source.candidate.sha) return null;
+  return {
+    source: consumer.identity,
+    entry: entry.definition,
+    selection,
+    lock: lock.evidence,
+  };
+}
+
+export async function pipelineEntryCheck(run, host) {
+  const checks = [],
+    ids = new Set();
+  const prefix = `/repos/${host.repository}/commits/${run.head_sha}/check-runs`;
+  for (let page = 1; page <= 10; page++) {
+    const result = await host.request(
+      `${prefix}?check_name=check&filter=all&per_page=100&page=${page}`,
+    );
+    if (!Array.isArray(result?.check_runs) || result.check_runs.length > 100)
+      throw new Error("Published entry check inventory is incomplete");
+    for (const check of result.check_runs) {
+      if (!Number.isSafeInteger(check.id) || check.id < 1 || ids.has(check.id))
+        throw new Error(
+          "Published entry check inventory has ambiguous identities",
+        );
+      ids.add(check.id);
+      checks.push(check);
+    }
+    if (result.check_runs.length < 100)
+      return exactCheck(checks, run, host.repository);
+  }
+  throw new Error(
+    "Published entry check inventory exceeds its complete-read bound",
+  );
+}
+
+function exactCheck(checks, run, repository) {
+  const url = `https://github.com/${repository}/actions/runs/${run.id}/attempts/${run.run_attempt}`;
+  const matches = checks.filter(
+    (check) => check.name === "check" && check.details_url === url,
+  );
+  if (!matches.length) return null;
+  const values = matches.map((check) => {
+    const parsed =
+      /^buildchain:(attempt-[0-9a-f]{64}):([1-9][0-9]*):([1-9][0-9]*)$/u.exec(
+        check.external_id || "",
+      );
+    if (
+      !parsed ||
+      Number(parsed[2]) !== run.id ||
+      Number(parsed[3]) !== run.run_attempt ||
+      check.head_sha !== run.head_sha ||
+      check.status !== "completed" ||
+      !["success", "failure"].includes(check.conclusion) ||
+      check.app?.slug !== "github-actions"
+    )
+      throw new Error(
+        "Published entry check does not bind its exact native attempt",
+      );
+    return {
+      attempt: parsed[1],
+      outcome: check.conclusion,
+      summary: check.output?.summary || "",
+    };
+  });
+  if (values.some((value) => recordDigest(value) !== recordDigest(values[0])))
+    throw new Error("Published entry checks disagree about the same execution");
+  return {
+    ...values[0],
+    ids: matches.map(({ id }) => id).sort((a, b) => a - b),
+  };
+}

package/packages/core/providers/github/pipeline-policy.js

@@ -1,11 +1,11 @@
 import { recordDigest } from "../../release/discussion/envelope.js";
 
 const QUERY = `query PipelinePolicy($owner:String!,$name:String!,$number:Int!){repository(owner:$owner,name:$name){pullRequest(number:$number){id number headRefOid baseRefName isDraft reviewDecision author{login}}}}`;
-const BRANCH_QUERY = `query PipelineBranchPolicy($owner:String!,$name:String!,$branch:String!,$ref:String!){repository(owner:$owner,name:$name){ref(qualifiedName:$ref){branchProtectionRule{requiresApprovingReviews requiredApprovingReviewCount requiresCodeOwnerReviews requiresStatusChecks requiredStatusChecks{context app{databaseId}}}}mergeQueue(branch:$branch){id}}}`;
+const BRANCH_QUERY = `query PipelineBranchPolicy($owner:String!,$name:String!,$branch:String!,$ref:String!){repository(owner:$owner,name:$name){ref(qualifiedName:$ref){refUpdateRule{requiredApprovingReviewCount requiresCodeOwnerReviews requiredStatusCheckContexts}}mergeQueue(branch:$branch){id}}}`;
 
 async function classicPolicy(request, owner, name, branch) {
-  // REST /branches/:branch/protection requires Administration:read. Ordinary
-  // workflow credentials instead read effective rules and GraphQL metadata.
+  // Read viewer-enforced rules and the ordinary Contents:read branch projection.
+  // Administrative branchProtectionRule and /protection queries are not needed.
   const result = await request("/graphql", {
     method: "POST",
     body: {
@@ -14,23 +14,50 @@ async function classicPolicy(request, owner, name, branch) {
     },
   });
   const repository = result.data?.repository;
-  if (!repository) throw new Error("Protected branch metadata is unavailable");
-  const rule = repository.ref?.branchProtectionRule;
+  if (!repository?.ref)
+    throw new Error("Protected branch metadata is unavailable");
+  const rule = repository.ref.refUpdateRule;
+  const observed = await request(
+    `/repos/${owner}/${name}/branches/${encodeURIComponent(branch)}`,
+  );
+  const status = observed.protection?.required_status_checks;
+  const contexts = status?.contexts;
+  const checks = status?.checks;
+  if (
+    observed.name !== branch ||
+    !Array.isArray(contexts) ||
+    !Array.isArray(checks) ||
+    checks.some(
+      (check) =>
+        typeof check.context !== "string" ||
+        !check.context ||
+        !Object.hasOwn(check, "app_id") ||
+        !(
+          check.app_id === null ||
+          check.app_id === -1 ||
+          (Number.isSafeInteger(check.app_id) && check.app_id > 0)
+        ),
+    ) ||
+    contexts.some(
+      (context) => !checks.some((check) => check.context === context),
+    ) ||
+    checks.some((check) => !contexts.includes(check.context)) ||
+    (rule?.requiredStatusCheckContexts || []).some(
+      (context) => !contexts.includes(context),
+    )
+  )
+    throw new Error("Protected branch check identity metadata is incomplete");
   return {
     required_merge_queue: Boolean(repository.mergeQueue?.id),
-    required_pull_request_reviews: rule?.requiresApprovingReviews
-      ? {
-          require_code_owner_reviews: rule.requiresCodeOwnerReviews,
-          required_approving_review_count: rule.requiredApprovingReviewCount,
-        }
-      : null,
+    required_pull_request_reviews:
+      rule?.requiredApprovingReviewCount > 0
+        ? {
+            require_code_owner_reviews: rule.requiresCodeOwnerReviews,
+            required_approving_review_count: rule.requiredApprovingReviewCount,
+          }
+        : null,
     required_status_checks: {
-      checks: rule?.requiresStatusChecks
-        ? (rule.requiredStatusChecks || []).map((check) => ({
-            context: check.context,
-            app_id: check.app?.databaseId || null,
-          }))
-        : [],
+      checks,
     },
   };
 }

package/packages/core/providers/github/pipeline-release-evidence.js

@@ -0,0 +1,111 @@
+import { createHash } from "node:crypto";
+import { recordDigest } from "../../release/discussion/envelope.js";
+
+const NAMES = [
+  "plan",
+  "qualification",
+  "capsules",
+  "invocation",
+  "attestation",
+  "release",
+];
+const LIMIT = 8 * 1024 * 1024;
+
+async function inventory(request, prefix) {
+  const assets = [],
+    ids = new Set(),
+    names = new Set();
+  for (let page = 1; page <= 20; page++) {
+    const values = await request(`${prefix}/assets?per_page=100&page=${page}`);
+    if (!Array.isArray(values) || values.length > 100)
+      throw new Error("Published evidence asset inventory is incomplete");
+    for (const value of values) {
+      if (
+        !Number.isSafeInteger(value.id) ||
+        value.id < 1 ||
+        typeof value.name !== "string" ||
+        !value.name ||
+        ids.has(value.id) ||
+        names.has(value.name)
+      )
+        throw new Error("Published evidence asset inventory is ambiguous");
+      ids.add(value.id);
+      names.add(value.name);
+      assets.push(value);
+    }
+    if (values.length < 100) return assets;
+  }
+  throw new Error(
+    "Published evidence inventory exceeds its complete-read bound",
+  );
+}
+
+function selectedAssets(assets) {
+  return NAMES.map((id) => {
+    const name = `buildchain.${id}.json`;
+    const asset = assets.find((value) => value.name === name);
+    if (!asset) return { name, missing: true };
+    if (
+      asset.state !== "uploaded" ||
+      !Number.isSafeInteger(asset.size) ||
+      asset.size < 1 ||
+      asset.size > LIMIT ||
+      !/^sha256:[0-9a-f]{64}$/u.test(asset.digest || "")
+    )
+      throw new Error("Published evidence asset lacks bounded immutable bytes");
+    return { id: asset.id, name, size: asset.size, digest: asset.digest };
+  });
+}
+
+// Download only fixed evidence names from the exact already-observed release.
+// There is no caller-supplied URL, artifact selector or provider write here.
+export async function readPipelineReleaseEvidence(host, candidate) {
+  const repository = host.repository;
+  if (
+    !/^[\w.-]+\/[\w.-]+$/u.test(repository || "") ||
+    !Number.isSafeInteger(candidate.id) ||
+    candidate.id < 1
+  )
+    throw new Error("Published evidence requires exact release coordinates");
+  const prefix = `/repos/${repository}/releases/${candidate.id}`;
+  const selected = selectedAssets(await inventory(host.request, prefix));
+  const missing = selected
+    .filter((value) => value.missing)
+    .map(({ name }) => name);
+  if (missing.length) return { status: "missing", missing };
+  const [owner, repo] = repository.split("/");
+  const values = {};
+  let bundle;
+  for (const asset of selected) {
+    const result = await host.github.rest.repos.getReleaseAsset({
+      owner,
+      repo,
+      asset_id: asset.id,
+      headers: { accept: "application/octet-stream" },
+    });
+    const bytes = Buffer.from(result.data);
+    if (
+      bytes.length !== asset.size ||
+      bytes.length > LIMIT ||
+      `sha256:${createHash("sha256").update(bytes).digest("hex")}` !==
+        asset.digest
+    )
+      throw new Error(
+        "Published evidence download differs from provider bytes",
+      );
+    const id = asset.name.slice("buildchain.".length, -".json".length);
+    if (id === "attestation") bundle = bytes;
+    else
+      values[id] = JSON.parse(
+        new TextDecoder("utf-8", { fatal: true }).decode(bytes),
+      );
+  }
+  if (
+    recordDigest(selectedAssets(await inventory(host.request, prefix))) !==
+    recordDigest(selected)
+  )
+    throw new Error(
+      "Published evidence assets changed during provider readback",
+    );
+  return { status: "present", values, bundle, assets: selected };
+}