@kungfu-tech/buildchain 4.1.3-alpha.4 → 4.1.3-alpha.6

package/packages/core/providers/github/pipeline-events.js

@@ -1,5 +1,84 @@
 import { readBusinessAttempt } from "../../workflow/attempt/reader.js";
 
+// The current provider timeline survives webhook/runtime handoff. Compare it
+// with this candidate's lifetime so an earlier removal cannot cancel recovery.
+export function githubPipelineQueueExit(graphql, repository) {
+  if (!/^[\w.-]+\/[\w.-]+$/u.test(repository || ""))
+    throw new Error("Invalid pipeline queue repository");
+  const [owner, repo] = repository.split("/");
+  return async (current, candidate) => {
+    if (!candidate || candidate.terminal) return null;
+    const started = Date.parse(candidate.enqueuedAt);
+    if (!Number.isFinite(started))
+      throw new Error("Queue candidate timestamp is missing");
+    const number = current.intent.source.pullRequest;
+    const result = await graphql(
+      `
+        query ($owner: String!, $repo: String!, $number: Int!) {
+          repository(owner: $owner, name: $repo) {
+            pullRequest(number: $number) {
+              number
+              headRefOid
+              baseRefName
+              state
+              mergeQueueEntry {
+                id
+              }
+              timelineItems(
+                last: 2
+                itemTypes: [
+                  ADDED_TO_MERGE_QUEUE_EVENT
+                  REMOVED_FROM_MERGE_QUEUE_EVENT
+                ]
+              ) {
+                nodes {
+                  __typename
+                  ... on AddedToMergeQueueEvent {
+                    id
+                    createdAt
+                  }
+                  ... on RemovedFromMergeQueueEvent {
+                    id
+                    createdAt
+                  }
+                }
+              }
+            }
+          }
+        }
+      `,
+      { owner, repo, number },
+    );
+    const pr = result.repository?.pullRequest;
+    if (
+      pr?.number !== number ||
+      pr.headRefOid !== current.generation.source.commit ||
+      pr.baseRefName !== current.intent.source.targetBranch
+    )
+      throw new Error("Queue exit source identity changed; reobserve");
+    if (pr.state !== "OPEN" || pr.mergeQueueEntry) return null;
+    const nodes = pr.timelineItems?.nodes;
+    if (!Array.isArray(nodes) || nodes.length > 2)
+      throw new Error("Queue exit timeline readback is missing or ambiguous");
+    const event = nodes.at(-1);
+    if (event?.__typename !== "RemovedFromMergeQueueEvent") return null;
+    const queued = nodes.at(-2);
+    if (queued?.__typename !== "AddedToMergeQueueEvent")
+      throw new Error("Queue removal has no matching admission readback");
+    const removed = Date.parse(event.createdAt);
+    const entered = Date.parse(queued.createdAt);
+    if (
+      !event.id ||
+      !queued.id ||
+      !Number.isFinite(removed) ||
+      !Number.isFinite(entered) ||
+      entered > removed
+    )
+      throw new Error("Queue removal identity or timestamp is missing");
+    return entered > started ? event : null;
+  };
+}
+
 // Branch/terminal notifications wake existing intents only. They cannot create
 // historical releases or infer an execution request from an untracked old PR.
 export function githubPipelineEvents(request, journal, repository) {

package/packages/core/providers/github/pipeline-source.js

@@ -10,17 +10,34 @@ function exactSha(value) {
   return value;
 }
 
+function sourceRefBinding(reference) {
+  return {
+    ref: reference?.ref ?? null,
+    sha: reference?.sha ?? null,
+    repository: {
+      id: reference?.repo?.id ?? null,
+      nodeId: reference?.repo?.node_id ?? null,
+      fullName: reference?.repo?.full_name ?? null,
+    },
+  };
+}
+
+function mergedCommit(pr) {
+  return pr.merged === true ? pr.merge_commit_sha : null;
+}
+
 function pullRequestBinding(pr) {
+  // Provider timestamps and repository metadata can change during our own
+  // evidence writes. Bind source and delivery state, not those unrelated fields.
   return {
     number: pr.number,
     state: pr.state,
     merged: pr.merged,
-    mergeCommit: pr.merge_commit_sha,
-    head: pr.head,
-    base: pr.base,
+    mergeCommit: mergedCommit(pr),
+    head: sourceRefBinding(pr.head),
+    base: sourceRefBinding(pr.base),
     draft: pr.draft,
-    labels: pr.labels,
-    updatedAt: pr.updated_at,
+    ready: pr.labels.some((label) => label.name === "ready"),
   };
 }
 
@@ -113,7 +130,7 @@ export function githubPipelineSource(request, repository) {
         baseCommit,
         state: pr.state,
         merged: pr.merged === true,
-        mergeCommit: pr.merge_commit_sha,
+        mergeCommit: mergedCommit(pr),
         draft: pr.draft === true,
         ready: pr.labels.some((label) => label.name === "ready"),
       },
@@ -141,7 +158,7 @@ export function githubPipelineSource(request, repository) {
       targetBranch: pr.base.ref,
       state: pr.state,
       merged: pr.merged === true,
-      mergeCommit: pr.merge_commit_sha,
+      mergeCommit: mergedCommit(pr),
       source: sameHead ? generation.source : null,
       baseCommit: null,
       ready: pr.labels.some((label) => label.name === "ready"),

package/packages/core/publication/pipeline/pack.js

@@ -44,6 +44,33 @@ function packageArtifact(directory, output, expected, version, environment) {
   };
 }
 
+function archiveNames(file, suffix) {
+  const options = {
+    cwd: path.dirname(file),
+    encoding: "utf8",
+    maxBuffer: 16 * 1024 * 1024,
+    timeout: 30000,
+    stdio: ["ignore", "pipe", "pipe"],
+  };
+  if (suffix === ".zip") {
+    const script = [
+      "import json,sys,zipfile",
+      "with zipfile.ZipFile(sys.argv[1]) as archive:",
+      "    print(json.dumps(archive.namelist()))",
+    ].join("\n");
+    return JSON.parse(
+      execFileSync(
+        process.platform === "win32" ? "python" : "python3",
+        ["-c", script, path.basename(file)],
+        options,
+      ),
+    );
+  }
+  return execFileSync("tar", ["-tf", path.basename(file)], options)
+    .trim()
+    .split(/\r?\n/u);
+}
+
 export function inspectPipelineFileArtifact(directory, expected) {
   const file = publicationPath(directory, expected.path);
   if (expected.kind === "pdf") {
@@ -60,18 +87,14 @@ export function inspectPipelineFileArtifact(directory, expected) {
   );
   if (!suffix)
     throw new Error("Declared binary output must be a standard archive");
-  const names = execFileSync("tar", ["-tf", path.basename(file)], {
-    cwd: path.dirname(file),
-    encoding: "utf8",
-    maxBuffer: 16 * 1024 * 1024,
-  })
-    .trim()
-    .split(/\r?\n/u);
+  const names = archiveNames(file, suffix);
   if (
     !names[0] ||
     names.some(
       (name) =>
-        name.startsWith("/") ||
+        !name.trim() ||
+        /[\u0000-\u001f\u007f]/u.test(name) ||
+        name.replaceAll("\\", "/").startsWith("/") ||
         /^[A-Za-z]:/u.test(name) ||
         name.replaceAll("\\", "/").split("/").includes(".."),
     )

package/packages/core/workflow/pipeline/actions.js

@@ -5,12 +5,7 @@ import { normalInputs } from "../../consumer/contract/entries.js";
 import { pipelineHost } from "./host.js";
 import { controlPipeline } from "./controller.js";
 import { buildPipelineSource } from "./build.js";
-import { recordPipelineBuild } from "./build-control.js";
 import { wakePipelineStableWait } from "../../publication/pipeline/stable-wait.js";
-import {
-  RECOVERY_BUILD_CONTEXT,
-  recordRecoveryBuild,
-} from "./recovery-build-control.js";
 
 export async function controlPipelineAction(core, env) {
   const { configPath } = normalInputs({
@@ -39,24 +34,6 @@ export async function buildPipelineAction(core, env) {
   );
 }
 
-export async function recordPipelineBuildAction(core, env) {
-  const host = await pipelineHost(core, env, "Record product build");
-  const context = JSON.parse(core.getInput("context", { required: true }));
-  if (context.schema === "buildchain.pipeline-group-build-context/v1")
-    return host.groupRecord(context);
-  const result =
-    context.schema === RECOVERY_BUILD_CONTEXT
-      ? await recordRecoveryBuild(context, host)
-      : await recordPipelineBuild(context, host);
-  if (result.outcome !== "success")
-    throw new Error("Product build did not succeed");
-  core.info(
-    result.wakePending
-      ? "Build retained; next event will retry delivery wake"
-      : "Build retained and attempt woken",
-  );
-}
-
 export async function wakePipelineAction(core, env) {
   const waiting = core.getInput("stable-wait");
   const host = await pipelineHost(

package/packages/core/workflow/pipeline/build-evidence.js

@@ -5,6 +5,83 @@ import {
 } from "./build-qualification.js";
 import { pipelinePlatforms } from "./platforms.js";
 
+const RECOVERY_CHECK = "Buildchain recovery verification";
+
+// Dispatch-created Actions checks do not satisfy protected PR checks. Preserve
+// their evidence under a diagnostic name instead of shadowing normal PR checks.
+export async function observePipelineBuildChecks(source, request, repository) {
+  if (
+    source.repository !== repository ||
+    !/^[0-9a-f]{40}$/u.test(source.commit)
+  )
+    throw new Error("Recovery check repository or source identity drift");
+  const base = `/repos/${repository}`,
+    renames = [],
+    eligible = [];
+  for (let page = 1; page <= 20; page++) {
+    const result = await request(
+      `${base}/commits/${source.commit}/check-runs?filter=all&per_page=100&page=${page}`,
+    );
+    if (!Array.isArray(result.check_runs) || result.check_runs.length > 100)
+      throw new Error("Recovery check inventory is incomplete");
+    for (const check of result.check_runs) {
+      const match = /^buildchain:(attempt-[0-9a-f]{64}):(\d+):(\d+)$/u.exec(
+        check.external_id || "",
+      );
+      if (
+        check.name !== "check" ||
+        check.app?.slug !== "github-actions" ||
+        !match
+      )
+        continue;
+      const runId = Number(match[2]),
+        runAttempt = Number(match[3]);
+      if (
+        check.head_sha !== source.commit ||
+        ![check.id, runId, runAttempt].every(
+          (value) => Number.isSafeInteger(value) && value > 0,
+        )
+      )
+        throw new Error("Recovery check provider identity drift");
+      const run = await request(
+        `${base}/actions/runs/${runId}/attempts/${runAttempt}`,
+      );
+      if (
+        run.id !== runId ||
+        run.run_attempt !== runAttempt ||
+        run.repository?.full_name !== repository
+      )
+        throw new Error("Recovery check execution identity drift");
+      if (["workflow_dispatch", "repository_dispatch"].includes(run.event))
+        renames.push({
+          id: check.id,
+          externalId: check.external_id,
+          sourceHead: source.commit,
+          runId,
+          runAttempt,
+          name: RECOVERY_CHECK,
+        });
+      else if (
+        [
+          "push",
+          "pull_request",
+          "pull_request_review",
+          "pull_request_target",
+        ].includes(run.event) &&
+        run.head_sha === source.commit
+      )
+        eligible.push({
+          id: check.id,
+          runId,
+          runAttempt,
+          conclusion: check.conclusion,
+        });
+    }
+    if (result.check_runs.length < 100) return { renames, eligible };
+  }
+  throw new Error("Recovery check inventory exceeds its complete-read bound");
+}
+
 // The archive reference is already validated against the current attempt. A
 // build result is still re-read from the provider before it can admit delivery.
 export async function pipelineBuildEvidence(session, host) {
@@ -74,18 +151,59 @@ export async function publishPipelineBuildCheck(
       "Product check source differs from independently verified build",
     );
   const externalId = `buildchain:${context.attempt}:${context.runId}:${context.runAttempt}`;
+  const recovered = readback.schema === PIPELINE_BUILD_QUALIFICATION;
+  let checkName = recovered ? RECOVERY_CHECK : "check";
+  const output = {
+    title: recovered
+      ? "Buildchain recovered product verification"
+      : "Buildchain product verification",
+    summary: `Exact product jobs: ${readback.root}\nAttempt: ${context.attempt}`,
+  };
+  if (recovered) {
+    const checks = await observePipelineBuildChecks(
+      context.source,
+      request,
+      repository,
+    );
+    for (const change of checks.renames)
+      await request(`/repos/${repository}/check-runs/${change.id}`, {
+        method: "PATCH",
+        body: { name: change.name },
+      });
+    const original = checks.eligible.find((check) =>
+      readback.segments.some(
+        (segment) =>
+          segment.readback.runId === check.runId &&
+          segment.readback.runAttempt === check.runAttempt,
+      ),
+    );
+    // A complete replacement has no reusable original check to project onto.
+    // Retain that failed execution and publish this independently qualified
+    // aggregate as the required check. Protected landing still requalifies it
+    // and publishes the App-bound commit status before queue admission.
+    if (!original) checkName = "check";
+    // Keep the eligible normal-event check identity. Only a fully requalified
+    // source aggregate can repair its failed projection; original runs and
+    // immutable build receipts still retain their original failure outcomes.
+    if (
+      original &&
+      original.conclusion !== "success" &&
+      readback.outcome === "success"
+    )
+      await request(`/repos/${repository}/check-runs/${original.id}`, {
+        method: "PATCH",
+        body: { status: "completed", conclusion: "success", output },
+      });
+  }
   return request(`/repos/${repository}/check-runs`, {
     method: "POST",
     body: {
-      name: "check",
+      name: checkName,
       head_sha: context.source.commit,
       external_id: externalId,
       status: "completed",
       conclusion: readback.outcome === "success" ? "success" : "failure",
-      output: {
-        title: "Buildchain product verification",
-        summary: `Exact product jobs: ${readback.root}\nAttempt: ${context.attempt}`,
-      },
+      output,
       details_url: `https://github.com/${repository}/actions/runs/${context.runId}/attempts/${context.runAttempt}`,
     },
   });

package/packages/core/workflow/pipeline/build-result.js

@@ -61,6 +61,7 @@ export async function retainPipelineBuildResult(
     host.request,
     host.repository,
   );
+  await host.publishBuildStatus?.(context, readback);
   if (
     readback.schema === PIPELINE_BUILD_QUALIFICATION &&
     readback.outcome === "success"

package/packages/core/workflow/pipeline/channel-control.js

@@ -3,17 +3,38 @@ import { pipelineBuildEvidence } from "./build-evidence.js";
 
 async function record(session, phase, state, receipt, host, reason = "") {
   const observed = await session.journal.read();
+  if (observed.attempt !== session.observed.attempt)
+    throw new Error("Channel receipt belongs to a superseded attempt");
   const root = recordDigest(receipt);
-  const reference = await host
-    .materialStore(session)
-    .retain(`${phase}/${root.slice(7)}`, receipt, "provider-readback");
+  const eventKey = `${phase}:${state}:${root}`;
+  const store = host.materialStore(session);
+  const prior = observed.history
+    .at(-1)
+    .events.find((event) => event.payload.eventKey === eventKey);
+  if (prior) {
+    if (
+      prior.node !== phase ||
+      prior.payload.state !== state ||
+      prior.payload.reason !== reason ||
+      prior.payload.materials.length !== 1 ||
+      recordDigest(await store.read(prior.payload.materials[0])) !== root
+    )
+      throw new Error("Channel retry changed its immutable receipt");
+    return observed;
+  }
+  const reference = await store.retain(
+    `${phase}/${root.slice(7)}`,
+    receipt,
+    "provider-readback",
+  );
   return session.progress.progress({
     attempt: observed.attempt,
     phase,
     state,
-    eventKey: `${phase}:${state}:${root}`,
+    eventKey,
     reason,
     materials: [reference],
+    expectedHead: observed.head,
   });
 }
 

package/packages/core/workflow/pipeline/controller.js

@@ -2,7 +2,10 @@ import { pipelineEvent } from "./events.js";
 import { selectPipelineSession } from "./selection.js";
 import { beginPipelineBuild } from "./build-control.js";
 import { controlPipelineDelivery } from "./delivery-control.js";
-import { githubPipelineEvents } from "../../providers/github/pipeline-events.js";
+import {
+  githubPipelineEvents,
+  githubPipelineQueueExit,
+} from "../../providers/github/pipeline-events.js";
 import { pipelinePlatforms } from "./platforms.js";
 import { recordDigest } from "../../release/discussion/envelope.js";
 
@@ -95,6 +98,11 @@ export async function controlPipeline(name, payload, inputs, host) {
       attempt: session.observed.attempt,
     };
   }
+  if (session.intent.expectedNodes.includes("warrant"))
+    host.queueExit ||= githubPipelineQueueExit(
+      host.github.graphql,
+      host.repository,
+    );
   const operation = session.intent.expectedNodes.includes("warrant")
     ? await controlPipelineDelivery(session, inputs, host)
     : await host.channel(session, admission, inputs);

package/packages/core/workflow/pipeline/delivery-control.js

@@ -3,6 +3,7 @@ import { preparePipelineDelivery } from "./delivery-request.js";
 import { pipelineBuildEvidence } from "./build-evidence.js";
 import {
   observePipelineWorker,
+  pipelineDeliveryExecution,
   pipelineDeliveryStore,
 } from "./delivery-observation.js";
 import { reconcilePipeline, pipelineCandidate } from "./reconcile.js";
@@ -21,8 +22,14 @@ export async function observePipelineDelivery(session, inputs, host, delivery) {
     inputs,
   );
   admission.live.terminalOnly = host.terminalOnly === true;
-  admission.live.dequeued = host.eventAction === "dequeued";
   const queue = await delivery.read();
+  admission.live.queueExit =
+    admission.live.state === "open" &&
+    admission.live.source?.commit === current.generation.source.commit &&
+    admission.live.targetBranch === session.intent.source.targetBranch
+      ? await host.queueExit(current, pipelineCandidate(queue, current))
+      : null;
+  admission.live.dequeued = Boolean(admission.live.queueExit);
   const worker = await observePipelineWorker(session, current, queue, host);
   const input = { current, live: admission.live, queue, worker, evidence: {} };
   return {
@@ -68,6 +75,30 @@ async function retainDeliveryRequest(fresh, session, build, host) {
     ...scheduling.history.at(-1),
     intent: session.intent,
   };
+  // The provider execution owns the delivery slot before it acquires a
+  // Warrant. A later wake must not replace its retained coordinates while its
+  // queued or running job is still entitled to perform final admission.
+  const executionOwner = await pipelineDeliveryExecution(
+    session,
+    schedulingCurrent,
+    host,
+  );
+  if (executionOwner) {
+    const { run } = await host.runs.read(
+      executionOwner.runId,
+      executionOwner.runAttempt,
+    );
+    if (
+      run.id !== executionOwner.runId ||
+      run.run_attempt !== executionOwner.runAttempt
+    )
+      throw new Error("Retained delivery execution provider identity drift");
+    if (run.status !== "completed")
+      return {
+        operation: "wait",
+        reason: "admitted-delivery-execution-running",
+      };
+  }
   const active = await observePipelineWorker(
     session,
     schedulingCurrent,
@@ -145,14 +176,28 @@ export async function controlPipelineDelivery(session, inputs, host) {
       !["cancelled", "failure", "superseded", "complete"].includes(
         fresh.observed.status,
       )
-    )
-      await session.progress.progress({
-        attempt: fresh.attempt,
-        phase: fresh.phase,
-        state: "superseded",
-        eventKey: `supersede:${recordDigest(fresh.live)}`,
-        reason: fresh.decision.reason,
-      });
+    ) {
+      try {
+        await session.progress.progress({
+          attempt: fresh.attempt,
+          phase: fresh.phase,
+          state: "superseded",
+          eventKey: `supersede:${recordDigest(fresh.live)}`,
+          reason: fresh.decision.reason,
+        });
+      } catch (error) {
+        // Concurrent notifications can finish the same attempt after readback.
+        // Its immutable terminal result is sufficient; never rewrite that phase.
+        const latest = await session.journal.read();
+        if (
+          latest.attempt !== fresh.attempt ||
+          !["cancelled", "failure", "superseded", "complete"].includes(
+            latest.status,
+          )
+        )
+          throw error;
+      }
+    }
     return { operation: "successor", reason: fresh.decision.reason };
   }
   if (fresh.live.merged) return { operation: "settle", fresh, delivery };

package/packages/core/workflow/pipeline/delivery-observation.js

@@ -13,16 +13,7 @@ function workerJob(jobs, name) {
   return selected[0];
 }
 
-export async function observePipelineWorker(session, current, queue, host) {
-  const warrant = queue.activeWarrant;
-  const candidate = pipelineCandidate(queue, current);
-  if (
-    !warrant ||
-    candidate?.candidateId !== warrant.candidateId ||
-    warrant.sourceHead !== current.generation.source.commit ||
-    warrant.pullRequestNumber !== current.intent.source.pullRequest
-  )
-    return null;
+export async function pipelineDeliveryExecution(session, current, host) {
   const phase = [...current.events]
     .reverse()
     .find((event) =>
@@ -43,6 +34,21 @@ export async function observePipelineWorker(session, current, queue, host) {
     execution.generation !== current.generation.id
   )
     throw new Error("Native worker execution belongs to another attempt");
+  return execution;
+}
+
+export async function observePipelineWorker(session, current, queue, host) {
+  const warrant = queue.activeWarrant;
+  const candidate = pipelineCandidate(queue, current);
+  if (
+    !warrant ||
+    candidate?.candidateId !== warrant.candidateId ||
+    warrant.sourceHead !== current.generation.source.commit ||
+    warrant.pullRequestNumber !== current.intent.source.pullRequest
+  )
+    return null;
+  const execution = await pipelineDeliveryExecution(session, current, host);
+  if (!execution) return null;
   const { run, jobs } = await host.runs.read(
     execution.runId,
     execution.runAttempt,

package/packages/core/workflow/pipeline/group-control.js

@@ -38,6 +38,7 @@ export async function recordPipelineGroup(context, host) {
   );
   if (readback.outcome === "success")
     await host.qualifyChannel(context.source, context.branch);
+  await host.publishBuildStatus?.(context, readback);
   await host.request(`/repos/${host.repository}/check-runs`, {
     method: "POST",
     body: {

package/packages/core/workflow/pipeline/guard-build.js

@@ -35,3 +35,40 @@ export async function guardPipelineBuild(
   );
   return build;
 }
+
+// A commit status is source-bound and survives later workflow suites. Publish
+// only the independently reread build at the protected landing boundary, whose
+// existing Actions credential owns statuses:write. Retained build receipts
+// preserve the original executions and their outcomes.
+export async function publishPipelineBuildStatus(
+  input,
+  build,
+  request,
+  repository,
+) {
+  if (
+    build.readback.source.repository !== repository ||
+    build.readback.source.commit !== input["expected-head-sha"] ||
+    build.sourceHead !== input["expected-head-sha"] ||
+    build.run.id !== Number(input["source-workflow-run-id"]) ||
+    build.readback.runId !== build.run.id ||
+    build.readback.runAttempt !== build.run.run_attempt ||
+    build.outcome !== "success" ||
+    build.readback.outcome !== "success"
+  )
+    throw new Error(
+      "Landing status differs from its qualified exact-source build",
+    );
+  return request(`/repos/${repository}/statuses/${build.sourceHead}`, {
+    method: "POST",
+    body: {
+      context: "check",
+      state: "success",
+      description: `Qualified product build: ${build.readback.root}`.slice(
+        0,
+        140,
+      ),
+      target_url: `https://github.com/${repository}/actions/runs/${build.run.id}/attempts/${build.run.run_attempt}`,
+    },
+  });
+}

package/packages/core/workflow/pipeline/guard.js

@@ -105,13 +105,15 @@ export async function guardPipelineAdmission(input, connection) {
     throw new Error(
       "Pipeline protected review or required checks changed before delivery effect",
     );
-  await guardPipelineBuild(input, observed, {
+  const build = await guardPipelineBuild(input, observed, {
     material,
     source,
     request,
     repository: connection.repository,
   });
-  return guardPipelineDelivery(input, connection);
+  const fresh = await guardPipelineDelivery(input, connection);
+  await connection.publishBuildStatus?.(build);
+  return fresh;
 }
 
 export async function guardPipelineDelivery(input, connection, lookup) {