@kungfu-tech/buildchain 4.1.3-alpha.5 → 4.1.3-alpha.6

package/scripts/check-self-consumer-contract.mjs

@@ -0,0 +1,133 @@
+import fs from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { parse as yaml } from "yaml";
+import { compileConsumerPlan } from "../packages/core/consumer/contract/plan.js";
+import { consumerWorkflows } from "../packages/core/consumer/contract/entries.js";
+import { workflowPath } from "../packages/core/workflow/workflow-taxonomy.mjs";
+
+export const SELF_ENTRY_CHANNEL = "v4-alpha";
+export const SELF_CONFIG_PATH = ".buildchain/minimal-consumer.toml";
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+const PLATFORMS = ["linux-x64", "macos-arm64", "windows-x64"];
+
+// Repository policy checks the consumer-facing wiring. Product implementation
+// libraries are separately registered and may not own repository event triggers.
+// This policy supplies no repository identity exception to runtime admission.
+export function checkSelfConsumerContract(root = ROOT) {
+  const read = (file) => fs.readFileSync(path.join(root, file), "utf8");
+  const fail = (message) => {
+    throw new Error(`self-consumer-contract: ${message}`);
+  };
+  const plan = compileConsumerPlan(read(SELF_CONFIG_PATH));
+  if (read(SELF_CONFIG_PATH) !== read(".buildchain/buildchain.toml"))
+    fail("transition config must match the canonical product plan");
+  const callers = consumerWorkflows(SELF_ENTRY_CHANNEL, SELF_CONFIG_PATH);
+  for (const [file, bytes] of Object.entries(callers))
+    if (read(file) !== bytes) fail(`${file}: generated caller drift`);
+  const taxonomy = JSON.parse(read("architecture/workflow-taxonomy.json"));
+  const registered = new Set(taxonomy.entries.map(workflowPath));
+  const observed = fs
+    .readdirSync(path.join(root, ".github/workflows"))
+    .filter((file) => /\.ya?ml$/u.test(file))
+    .map((file) => `.github/workflows/${file}`);
+  if (
+    observed.length !== registered.size ||
+    observed.some((file) => !registered.has(file))
+  )
+    fail("workflow inventory is not closed");
+  const self = taxonomy.entries
+    .filter((entry) => entry.role === "self")
+    .map(workflowPath)
+    .sort();
+  if (JSON.stringify(self) !== JSON.stringify(Object.keys(callers).sort()))
+    fail("self automation must contain exactly the generated caller pair");
+  for (const entry of taxonomy.entries.filter(
+    (entry) => entry.role !== "self",
+  )) {
+    const file = workflowPath(entry);
+    const document = yaml(read(file));
+    if (
+      Object.keys(document.on || {}).some(
+        (event) => !["workflow_call", "workflow_dispatch"].includes(event),
+      )
+    )
+      fail(`${file}: product library owns a repository event`);
+  }
+  for (const prefix of ["feature", "fix", "chore", "docs", "ci", "refactor"])
+    if (
+      !plan.channels.some(
+        (route) =>
+          route.from === `${prefix}/*` &&
+          route.to === "dev/v4/v4.1" &&
+          route.operation === "develop",
+      )
+    )
+      fail(`missing protected development route for ${prefix}`);
+  for (const platform of PLATFORMS) {
+    const verified = plan.products.some(
+      (product) =>
+        product.platforms.includes(platform) &&
+        product.verify.includes("corepack pnpm@11.7.0 run check") &&
+        product.verify.includes("node scripts/verify-product-platform.mjs"),
+    );
+    if (!verified)
+      fail(
+        `${platform}: full check and platform recovery verification are required`,
+      );
+  }
+  if (
+    !plan.products.some(
+      (product) =>
+        product.type === "npm" &&
+        product.targets.some((target) => target.provider === "npm"),
+    )
+  )
+    fail("npm publication is missing");
+  for (const platform of PLATFORMS)
+    if (
+      !plan.products.some(
+        (product) =>
+          product.type === "binary" &&
+          product.platforms.includes(platform) &&
+          product.targets.some(
+            (target) => target.provider === "github-release",
+          ),
+      )
+    )
+      fail(`${platform}: binary release asset is missing`);
+  const commands = plan.products.flatMap((product) => [
+    ...(product.install || []),
+    ...product.build,
+    ...product.verify,
+  ]);
+  if (
+    commands.some((command) =>
+      /\b(?:npm publish|gh release|buildchain (?:dev warrant|release|promote|recover|publish))\b|request-json|fencingToken/u.test(
+        command,
+      ),
+    )
+  )
+    fail("product lifecycle contains consumer-owned publication orchestration");
+  if (!read(".gitattributes").split("\n").includes("* text=auto eol=lf"))
+    fail("cross-platform LF checkout contract is missing");
+  return {
+    ok: true,
+    channel: SELF_ENTRY_CHANNEL,
+    callers: Object.keys(callers),
+    plan,
+  };
+}
+
+if (
+  process.argv[1] &&
+  path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)
+) {
+  const { plan, ...result } = checkSelfConsumerContract();
+  console.log(
+    JSON.stringify({
+      ...result,
+      products: plan.products.map((product) => product.id),
+    }),
+  );
+}

package/scripts/check-universal-workflow-bootstrap.mjs

@@ -43,10 +43,8 @@ assert.doesNotMatch(read(contract.bootstrap.publicWorkflow), /admission-policy-j
 const template = parse(contract.bootstrap.consumerTemplate);
 assert.equal(template.jobs.bootstrap.uses, "kungfu-systems/buildchain/.github/workflows/public-ops-bootstrap.yml@v4");
 assert.equal(template.jobs.bootstrap.with["runtime-ref"], "${{ inputs.runtime-ref }}");
-const dogfood = parse(contract.bootstrap.selfDogfoodWorkflow);
-for (const channel of ["conformance", "alpha", "stable"]) for (const mode of ["primary", "recovery"]) {
-  const job = dogfood.jobs[`${mode}-${channel}`];
-  assert.equal(job.uses, "kungfu-systems/buildchain/.github/workflows/public-ops-bootstrap.yml@v4");
-  assert.equal(job.with["runtime-ref"], mode === "primary" ? "${{ inputs.runtime-ref }}" : "${{ inputs.recovery-runtime-ref }}");
-}
+assert.equal(contract.bootstrap.selfDogfoodActive, false);
+assert.equal(fs.existsSync(path.join(root, contract.bootstrap.selfDogfoodWorkflow)), false,
+  "The retired bootstrap self controller must not coexist with the minimal pipeline");
+assert.equal(contract.bootstrap.selfDogfoodSupersededBy, ".github/workflows/buildchain.yml");
 console.log(JSON.stringify({ ok: true, reusableWorkflowCount: reusable.length, runtimeAcquisitionOwners: 1 }));

package/scripts/generate-minimal-consumer-contract.mjs

@@ -143,7 +143,7 @@ output(
   await format(
     JSON.stringify({
       schema: "buildchain.consumer-migration/v1",
-      stage: "contract-defined; execution-entry-not-yet-published",
+      stage: "self-cutover-in-progress; final-release-qualification-pending",
       workflows: workflowInventory(),
       consumerSources: consumerSourceInventory(),
     }),

package/scripts/inventory/binary.mjs

@@ -1,26 +1,16 @@
 import assert from "node:assert/strict";
+import { checkSelfConsumerContract } from "../check-self-consumer-contract.mjs";
 import { inspectWorkflowJob, readWorkflow } from "../workflow-action-graph.mjs";
 
 export function assertBinaryInventory(root) {
-  const file = ".github/workflows/self-build-binary-distribution.yml";
-  const workflow = readWorkflow(file, root);
-  assert.equal(workflow.name, "Binary Distribution");
-  assert.deepEqual(Object.keys(workflow.jobs).filter(id => id !== "execution-runtime"), ["preflight", "binary", "passport", "dispatch-publication"]);
-  const graphs = Object.keys(workflow.jobs).filter(id => id !== "execution-runtime").map(id => inspectWorkflowJob(file, id, root));
-  for (const graph of graphs) {
-    assert.equal(graph.job.permissions.contents, "read");
-    assert.notEqual(graph.job.permissions["id-token"], "write");
-    assert.ok(!JSON.stringify(graph.job["runs-on"]).includes("self-hosted"));
-    for (const step of graph.steps) assert.ok(!/gh release (?:upload|create)/u.test(step.run || ""));
-    assert.ok(graph.actions.has(`actions/build/binary/${["preflight", "build", "passport", "dispatch-publication"][graphs.indexOf(graph)]}`));
-  }
-  const binary = graphs[1];
-  assert.deepEqual(binary.job.strategy.matrix.include.map(entry => entry.os).sort(), ["macos-latest", "ubuntu-24.04", "windows-2022"]);
-  const passport = graphs[2];
-  const executable = passport.modules.get("packages/core/build/binary/distribution.js");
-  for (const command of ["verifyBuildchainLogEvents", "verifyReleasePassport", "verifyArtifactPassport", "createReleaseEvidenceBundle", "buildchain-log-events", "buildchain-log-summary"])
-    assert.ok(executable.includes(command), `Binary evidence is missing ${command}`);
-  assert.ok(passport.actions.has("actions/build/binary/qualify"));
+  const { plan } = checkSelfConsumerContract(root);
+  assert.deepEqual(plan.products.filter(product => product.type === "binary")
+    .flatMap(product => product.platforms).sort(), ["linux-x64", "macos-arm64", "windows-x64"]);
+  const build = inspectWorkflowJob(".github/workflows/.release-pipeline-products.yml", "build", root);
+  assert.equal(build.job.permissions.contents, "read");
+  assert.notEqual(build.job.permissions["id-token"], "write");
+  assert.ok(!JSON.stringify(build.job["runs-on"]).includes("self-hosted"));
+  for (const step of build.steps) assert.ok(!/gh release (?:upload|create)/u.test(step.run || ""));
   const publish = inspectWorkflowJob(".github/workflows/.release-binary-assets.yml", "publish", root);
   assert.equal(publish.workflow.jobs["publication-authority"].uses, "./.github/workflows/.release-authority.yml");
   assert.ok(publish.job.needs.includes("publication-authority"));

package/scripts/inventory/promotion.mjs

@@ -1,4 +1,5 @@
 import assert from "node:assert/strict";
+import { checkSelfConsumerContract } from "../check-self-consumer-contract.mjs";
 import fs from "node:fs";
 import path from "node:path";
 import YAML from "yaml";
@@ -35,19 +36,7 @@ export function assertPromotionInventory(root) {
     "publish-command",
   ])
     assert.ok(!request.properties[key]);
-  for (const file of [
-    "self-release-promote",
-    "self-release-tail-dogfood",
-    "self-ops-promotion-recovery",
-  ]) {
-    const caller = YAML.parse(read(`.github/workflows/${file}.yml`));
-    const calls = Object.values(caller.jobs).filter(
-      (job) => job.uses === `kungfu-systems/buildchain/${publicPath}@v4`,
-    );
-    assert.equal(calls.length, 1, file);
-    assert.ok(calls[0].with["request-json"]);
-    assert.ok(Object.keys(calls[0].with).every(key => ["request-json", "runtime-ref", "contract-lock", "runtime-selection"].includes(key)));
-  }
+  checkSelfConsumerContract(root);
   const component = ".github/workflows/.release-promote.yml";
   const expected = {
     qualify: "promotion/qualify",

package/scripts/prepare-product-toolchain.mjs

@@ -0,0 +1,10 @@
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+// Product prerequisites cross command phases through the runner file protocol.
+// An explicit cache works with the credential-isolated Windows environment too.
+fs.appendFileSync(
+  process.env.GITHUB_ENV,
+  `GOTOOLCHAIN=go1.25.14+auto\nGOCACHE=${path.join(os.tmpdir(), "buildchain-go-cache")}\nGOPATH=${path.join(os.tmpdir(), "buildchain-go")}\n`,
+);

package/scripts/verify-product-platform.mjs

@@ -0,0 +1,65 @@
+import path from "node:path";
+import { execFileSync } from "node:child_process";
+import { verifyStageCapsuleCheckpoints } from "../packages/core/build/stage-capsule/rehearsal/verify.js";
+
+const platform = {
+  linux: "linux-x64",
+  darwin: "macos-arm64",
+  win32: "windows-x64",
+}[process.platform];
+if (!platform)
+  throw new Error(
+    `Unsupported product verification platform: ${process.platform}`,
+  );
+const goVersion = execFileSync("go", ["version"], { encoding: "utf8" }).trim();
+const goMatch = /^go version go1\.(\d+)\./u.exec(goVersion);
+if (!goMatch || Number(goMatch[1]) < 25)
+  throw new Error(
+    `Product verification requires Go 1.25 or newer in major 1: ${goVersion}`,
+  );
+const workspace = process.cwd();
+const result = verifyStageCapsuleCheckpoints({
+  runtimeRoot: workspace,
+  workspace,
+  platform,
+  environment: process.env,
+});
+if (platform === "linux-x64") {
+  // Same immutable image and backbone tests as the retired container CI lane.
+  // Supply the selected Node as the hosted container runner did; no credentials.
+  const image =
+    "ghcr.io/kungfu-systems/build-images/kungfu-verify@sha256:11f0ba64267ce88174a4f73a9bf833ff4e9c59cd16ec3d08a6432a06c2be6fb1";
+  execFileSync(
+    "docker",
+    [
+      "run",
+      "--rm",
+      "--network=none",
+      "--cap-drop=ALL",
+      "--security-opt=no-new-privileges",
+      "--mount",
+      `type=bind,source=${path.resolve(workspace)},target=/source,readonly`,
+      "--mount",
+      `type=bind,source=${process.execPath},target=/toolchain/node,readonly`,
+      "--env",
+      "PATH=/toolchain:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
+      "--workdir",
+      "/source",
+      image,
+      "node",
+      "--test",
+      "tests/build-orchestration.test.mjs",
+      "tests/build-artifact-pipeline.test.mjs",
+      "tests/dev-delivery-minimal-request.test.mjs",
+    ],
+    { stdio: "inherit" },
+  );
+}
+console.log(
+  JSON.stringify({
+    platform,
+    checkpoint: result.checkpoint,
+    resume: result.resume,
+    tail: result.tail,
+  }),
+);