@kungfu-tech/buildchain 4.1.3-alpha.5 → 4.1.3-alpha.7

package/packages/core/providers/github/pipeline-product-release.js

@@ -1,4 +1,5 @@
 import { createHash } from "node:crypto";
+import { setTimeout } from "node:timers/promises";
 import { pipelineProductPayload } from "./pipeline-product-payload.js";
 
 const sha256 = (bytes) =>
@@ -48,6 +49,7 @@ export function githubPipelineProductRelease({
       throw new Error("Release requires the exact immutable publication tag");
     let value = await findRelease();
     if (!value && create) {
+      let failure;
       try {
         await github.rest.repos.createRelease({
           owner,
@@ -61,12 +63,17 @@ export function githubPipelineProductRelease({
           make_latest: "false",
         });
       } catch (error) {
+        failure = error;
+      }
+      for (let attempt = 0; attempt < 3; attempt++) {
+        if (attempt) await setTimeout(1000);
         value = await findRelease();
-        if (!value) throw error;
+        if (value) break;
       }
-      value = await findRelease();
       if (!value)
-        throw new Error("Release creation lacks exact provider readback");
+        throw (
+          failure || new Error("Release creation lacks exact provider readback")
+        );
     }
     if (
       value &&

package/packages/core/publication/npm/pipeline-channel.js

@@ -12,43 +12,6 @@ export function pipelineNpmChannel({
       );
     return response.json();
   }
-  async function credential(name) {
-    if (environment.NODE_AUTH_TOKEN) return environment.NODE_AUTH_TOKEN;
-    if (
-      !environment.ACTIONS_ID_TOKEN_REQUEST_URL ||
-      !environment.ACTIONS_ID_TOKEN_REQUEST_TOKEN
-    )
-      throw new Error(
-        "npm channel publication requires its hosted package-scoped OIDC or configured publisher credential",
-      );
-    const url = new URL(environment.ACTIONS_ID_TOKEN_REQUEST_URL);
-    if (url.protocol !== "https:")
-      throw new Error("OIDC request requires the provider HTTPS endpoint");
-    url.searchParams.set("audience", "npm:registry.npmjs.org");
-    const identity = await json(url.href, {
-      headers: {
-        authorization: `Bearer ${environment.ACTIONS_ID_TOKEN_REQUEST_TOKEN}`,
-        accept: "application/json",
-      },
-    });
-    if (typeof identity.value !== "string" || !identity.value)
-      throw new Error("Hosted OIDC provider omitted its identity token");
-    const exchange = await json(
-      `${REGISTRY}/-/npm/v1/oidc/token/exchange/package/${encodeURIComponent(name)}`,
-      {
-        method: "POST",
-        headers: {
-          authorization: `Bearer ${identity.value}`,
-          accept: "application/json",
-        },
-      },
-    );
-    if (typeof exchange.token !== "string" || !exchange.token)
-      throw new Error(
-        "npm OIDC exchange omitted its package-scoped credential",
-      );
-    return exchange.token;
-  }
   return {
     async observe(effect) {
       if (effect.access === "restricted" && !environment.NODE_AUTH_TOKEN)
@@ -69,19 +32,5 @@ export function pipelineNpmChannel({
         ? { state: "present", version }
         : { state: "absent", version: null };
     },
-    async apply(effect) {
-      const token = await credential(effect.name);
-      await json(
-        `${REGISTRY}/-/package/${encodeURIComponent(effect.name)}/dist-tags/${encodeURIComponent(effect.tag)}`,
-        {
-          method: "PUT",
-          headers: {
-            authorization: `Bearer ${token}`,
-            "content-type": "application/json",
-          },
-          body: JSON.stringify(effect.version),
-        },
-      );
-    },
   };
 }

package/packages/core/publication/npm/pipeline-provider.js

@@ -1,5 +1,6 @@
 import fs from "node:fs";
 import path from "node:path";
+import { stripVTControlCharacters } from "node:util";
 import { publishedDigest, runNpm } from "./registry.js";
 import { createNativeChildEnvironment } from "../../dev-delivery/native/execution.js";
 import {
@@ -8,6 +9,33 @@ import {
   writeImmutablePublicationFile,
 } from "../pipeline/files.js";
 
+function publicationFailureCode(result) {
+  const code = stripVTControlCharacters(String(result.stderr ?? "")).match(
+    /^npm (?:error|ERR!) code ([A-Z0-9_]+)\r?$/m,
+  )?.[1];
+  return [
+    "ENEEDAUTH",
+    "EOTP",
+    "E401",
+    "E403",
+    "E404",
+    "EPUBLISHCONFLICT",
+    "EPRIVATE",
+    "EINTEGRITY",
+    "EUSAGE",
+    "EINVALIDPACKAGENAME",
+    "ETARGET",
+    "ENOENT",
+    "ETIMEDOUT",
+    "ECONNRESET",
+    "EAI_AGAIN",
+    "ENETUNREACH",
+    "ENOTFOUND",
+  ].includes(code)
+    ? code
+    : "unclassified";
+}
+
 export function pipelineNpmEnvironment(directory, environment = process.env) {
   const cwd = path.resolve(directory);
   const config = path.join(cwd, ".buildchain-publisher.npmrc");
@@ -102,7 +130,7 @@ export function pipelineNpmProvider({
       });
       if (result.status !== 0)
         throw new Error(
-          `Sealed npm publication failed with exit ${result.status}`,
+          `Sealed npm publication failed with exit ${result.status} (npm code ${publicationFailureCode(result)})`,
         );
     },
   };

package/packages/core/publication/pipeline/apply.js

@@ -115,13 +115,14 @@ export async function applyPipelinePublication(
     matches: (effect, value) => providerFor(effect).matches(effect, value),
     apply: (effect) => providerFor(effect).apply(effect),
   };
+  const receipts = await journal.materials("publication/effect/");
   const effects = pipelinePublicationEffects({
     plan,
     qualified,
     documents,
     evidence: evidence.map(({ bytes, ...asset }) => asset),
+    receipts,
   });
-  const receipts = await journal.materials("publication/effect/");
   let fence = journal.fence;
   if (context.recovery?.preserveTransaction) {
     const readback = await observeRecoveryPublicationEffects({

package/packages/core/publication/pipeline/capsules.js

@@ -72,7 +72,10 @@ export function pipelineProductCapsules({
       identityRoot: stageCapsuleIdentityRoot(identity),
       retentionPromise: {
         class: "github-artifact",
-        retainUntil: bundle.providerArtifact.expires_at,
+        retainUntil: bundle.providerArtifact.expires_at.replace(
+          /T(\d{2}:\d{2}:\d{2})Z$/u,
+          "T$1.000Z",
+        ),
       },
       capsuleRoot: `sha256:${"0".repeat(64)}`,
     };

package/packages/core/publication/pipeline/distribution.js

@@ -1,7 +1,6 @@
 import { recordDigest } from "../../release/discussion/envelope.js";
 import { pipelineNpmChannel } from "../npm/pipeline-channel.js";
-import { applyPipelineEffects } from "./effects.js";
-import { compareDevelopmentVersions } from "../publication-development.js";
+import { applyPipelineEffects, pipelinePublicationEffects } from "./effects.js";
 
 export async function distributePipelineProducts(
   context,
@@ -9,12 +8,10 @@ export async function distributePipelineProducts(
   journal,
   retained,
   environment,
-  directory,
 ) {
   const { plan, materialization } = context;
   const channel = `v${plan.version.split(".")[0]}${plan.channel === "alpha" ? "-alpha" : ""}`;
   const refPath = `/repos/${host.repository}/git/ref/tags/${channel}`;
-  const npmTag = plan.channel === "alpha" ? "alpha" : "latest";
   const npm = pipelineNpmChannel({ environment });
   async function observe(effect) {
     if (effect.kind === "git-channel") {
@@ -25,7 +22,14 @@ export async function distributePipelineProducts(
         ? { state: "present", commit: value.object.sha }
         : { state: "absent", commit: null };
     }
-    return npm.observe(effect);
+    // Only retained historical plans contain npm channel effects. New releases
+    // set their channel in npm publish and never enter a separate npm operation.
+    const value = await npm.observe(effect);
+    if (value.version !== effect.version)
+      throw new Error(
+        `Historical npm channel ${effect.name}@${effect.tag} requires a one-time authenticated correction to ${effect.version}; recovery never republishes or rewrites npm tags`,
+      );
+    return value;
   }
   const plans = await journal.materials("publication/distribution-plan/");
   if (plans.length > 1)
@@ -40,18 +44,26 @@ export async function distributePipelineProducts(
         commit: materialization.source.commit,
       },
     ];
-    for (const artifact of retained.qualified.artifacts.filter((entry) =>
-      entry.targets.some(({ provider }) => provider === "npm"),
-    ))
-      raw.push({
-        id: `npm-channel:${artifact.id}`,
-        kind: "npm-channel",
-        name: artifact.package.name,
-        access: artifact.targets.find(({ provider }) => provider === "npm")
-          .access,
-        tag: npmTag,
-        version: plan.version,
+    const receipts = await journal.materials("publication/effect/");
+    if (receipts.length) {
+      const published = pipelinePublicationEffects({
+        plan,
+        ...retained,
+        receipts,
       });
+      for (const effect of published.filter(
+        (item) =>
+          item.kind === "npm-package" && item.tag.startsWith("buildchain-"),
+      ))
+        raw.push({
+          id: `npm-channel:${effect.product}`,
+          kind: "npm-channel",
+          name: effect.name,
+          access: effect.access,
+          tag: plan.channel === "alpha" ? "alpha" : "latest",
+          version: effect.version,
+        });
+    }
     effects = [];
     for (const effect of raw) {
       const before = await observe(effect);
@@ -81,12 +93,6 @@ export async function distributePipelineProducts(
         throw new Error(
           "Floating channel changed since retained distribution admission",
         );
-      if (
-        effect.kind === "npm-channel" &&
-        current.version &&
-        compareDevelopmentVersions(current.version, effect.version) > 0
-      )
-        throw new Error("npm channel cannot regress a newer published version");
       await journal.fence();
       if (effect.kind === "git-channel") {
         if (current.state === "absent")
@@ -101,7 +107,7 @@ export async function distributePipelineProducts(
           { method: "PATCH", body: { sha: effect.commit, force: false } },
         );
       }
-      await npm.apply(effect);
+      throw new Error("Distribution cannot write npm channels");
     },
   };
   const receipts = await applyPipelineEffects({

package/packages/core/publication/pipeline/effects.js

@@ -1,3 +1,4 @@
+import { setTimeout } from "node:timers/promises";
 import { recordDigest } from "../../release/discussion/envelope.js";
 
 const KINDS = new Set([
@@ -14,6 +15,7 @@ export function pipelinePublicationEffects({
   qualified,
   documents,
   evidence = [],
+  receipts = [],
 }) {
   const effects = [
     {
@@ -34,7 +36,7 @@ export function pipelinePublicationEffects({
           version: artifact.package.version,
           integrity: artifact.package.integrity,
           access: target.access || "public",
-          tag: `buildchain-${plan.root.slice(7, 23)}`,
+          tag: plan.channel === "alpha" ? "alpha" : "latest",
         });
       if (target.provider === "github-release")
         effects.push({
@@ -72,7 +74,24 @@ export function pipelinePublicationEffects({
     tag: plan.tag,
     prerelease: plan.channel === "alpha",
   });
-  return effects.map((effect) => ({ ...effect, root: recordDigest(effect) }));
+  return effects.map((effect) => {
+    if (effect.kind === "npm-package") {
+      // Historical receipts keep their exact identity across runtime repairs.
+      const original = {
+        ...effect,
+        tag: `buildchain-${plan.root.slice(7, 23)}`,
+      };
+      if (
+        receipts.some(
+          (receipt) =>
+            receipt.effectId === effect.id &&
+            receipt.effectRoot === recordDigest(original),
+        )
+      )
+        effect = original;
+    }
+    return { ...effect, root: recordDigest(effect) };
+  });
 }
 
 // This executor owns only bounded provider operations. Journal admission/fencing
@@ -85,6 +104,7 @@ export async function applyPipelineEffects({
   provider,
   fence,
   retain,
+  wait = setTimeout,
 }) {
   const results = [];
   for (const effect of effects) {
@@ -133,11 +153,21 @@ export async function applyPipelineEffects({
       } catch (error) {
         failure = error;
       }
-      observed = await provider.observe(effect);
+      // Accepted npm versions remain unavailable during registry scanning.
+      // Bound that wait to fifteen minutes without repeating the write.
+      const scanning = effect.kind === "npm-package" && !failure;
+      const maximumReads = scanning ? 31 : 3;
+      for (let attempt = 0; attempt < maximumReads; attempt++) {
+        if (attempt) await wait(scanning ? 30_000 : 1000);
+        await fence();
+        observed = await provider.observe(effect);
+        if (observed.state !== "absent" || provider.matches(effect, observed))
+          break;
+      }
       if (!provider.matches(effect, observed)) {
         if (failure) throw failure;
         throw new Error(
-          "Publication write lacks exact successful provider readback",
+          `Publication write lacks exact successful provider readback (${effect.kind})`,
         );
       }
     }

package/packages/core/publication/pipeline/pack.js

@@ -44,6 +44,33 @@ function packageArtifact(directory, output, expected, version, environment) {
   };
 }
 
+function archiveNames(file, suffix) {
+  const options = {
+    cwd: path.dirname(file),
+    encoding: "utf8",
+    maxBuffer: 16 * 1024 * 1024,
+    timeout: 30000,
+    stdio: ["ignore", "pipe", "pipe"],
+  };
+  if (suffix === ".zip") {
+    const script = [
+      "import json,sys,zipfile",
+      "with zipfile.ZipFile(sys.argv[1]) as archive:",
+      "    print(json.dumps(archive.namelist()))",
+    ].join("\n");
+    return JSON.parse(
+      execFileSync(
+        process.platform === "win32" ? "python" : "python3",
+        ["-c", script, path.basename(file)],
+        options,
+      ),
+    );
+  }
+  return execFileSync("tar", ["-tf", path.basename(file)], options)
+    .trim()
+    .split(/\r?\n/u);
+}
+
 export function inspectPipelineFileArtifact(directory, expected) {
   const file = publicationPath(directory, expected.path);
   if (expected.kind === "pdf") {
@@ -60,18 +87,14 @@ export function inspectPipelineFileArtifact(directory, expected) {
   );
   if (!suffix)
     throw new Error("Declared binary output must be a standard archive");
-  const names = execFileSync("tar", ["-tf", path.basename(file)], {
-    cwd: path.dirname(file),
-    encoding: "utf8",
-    maxBuffer: 16 * 1024 * 1024,
-  })
-    .trim()
-    .split(/\r?\n/u);
+  const names = archiveNames(file, suffix);
   if (
     !names[0] ||
     names.some(
       (name) =>
-        name.startsWith("/") ||
+        !name.trim() ||
+        /[\u0000-\u001f\u007f]/u.test(name) ||
+        name.replaceAll("\\", "/").startsWith("/") ||
         /^[A-Za-z]:/u.test(name) ||
         name.replaceAll("\\", "/").split("/").includes(".."),
     )

package/packages/core/publication/pipeline/settle.js

@@ -26,7 +26,6 @@ export async function settlePipelinePublication(
       journal,
       retained,
       environment,
-      directory,
     );
     await journal.record("publication/distribution-complete", receipt, {
       phase: "distribution",

package/packages/core/workflow/attempt/journal.js

@@ -1,3 +1,4 @@
+import { setTimeout } from "node:timers/promises";
 import {
   canonicalJson,
   recordDigest,
@@ -72,16 +73,17 @@ export function atomicAttemptJournal(provider, intent) {
     }
     // A lost response can follow a committed append. Reconcile the immutable
     // record in live history; never retry the old parent with force=true.
-    const result = await read();
-    if (
-      !result.snapshot.records.some(
-        (event) => canonicalJson(event) === canonicalJson(record),
+    for (let attempt = 0; attempt < 3; attempt++) {
+      if (attempt) await setTimeout(1000);
+      const result = await read();
+      if (
+        result.snapshot.records.some(
+          (event) => canonicalJson(event) === canonicalJson(record),
+        )
       )
-    )
-      throw (
-        failure || new Error("Attempt append missing from provider readback")
-      );
-    return result;
+        return result;
+    }
+    throw failure || new Error("Attempt append missing from provider readback");
   }
   return { read, append };
 }

package/packages/core/workflow/pipeline/actions.js

@@ -5,12 +5,7 @@ import { normalInputs } from "../../consumer/contract/entries.js";
 import { pipelineHost } from "./host.js";
 import { controlPipeline } from "./controller.js";
 import { buildPipelineSource } from "./build.js";
-import { recordPipelineBuild } from "./build-control.js";
 import { wakePipelineStableWait } from "../../publication/pipeline/stable-wait.js";
-import {
-  RECOVERY_BUILD_CONTEXT,
-  recordRecoveryBuild,
-} from "./recovery-build-control.js";
 
 export async function controlPipelineAction(core, env) {
   const { configPath } = normalInputs({
@@ -39,24 +34,6 @@ export async function buildPipelineAction(core, env) {
   );
 }
 
-export async function recordPipelineBuildAction(core, env) {
-  const host = await pipelineHost(core, env, "Record product build");
-  const context = JSON.parse(core.getInput("context", { required: true }));
-  if (context.schema === "buildchain.pipeline-group-build-context/v1")
-    return host.groupRecord(context);
-  const result =
-    context.schema === RECOVERY_BUILD_CONTEXT
-      ? await recordRecoveryBuild(context, host)
-      : await recordPipelineBuild(context, host);
-  if (result.outcome !== "success")
-    throw new Error("Product build did not succeed");
-  core.info(
-    result.wakePending
-      ? "Build retained; next event will retry delivery wake"
-      : "Build retained and attempt woken",
-  );
-}
-
 export async function wakePipelineAction(core, env) {
   const waiting = core.getInput("stable-wait");
   const host = await pipelineHost(

package/packages/core/workflow/pipeline/build-evidence.js

@@ -5,6 +5,83 @@ import {
 } from "./build-qualification.js";
 import { pipelinePlatforms } from "./platforms.js";
 
+const RECOVERY_CHECK = "Buildchain recovery verification";
+
+// Dispatch-created Actions checks do not satisfy protected PR checks. Preserve
+// their evidence under a diagnostic name instead of shadowing normal PR checks.
+export async function observePipelineBuildChecks(source, request, repository) {
+  if (
+    source.repository !== repository ||
+    !/^[0-9a-f]{40}$/u.test(source.commit)
+  )
+    throw new Error("Recovery check repository or source identity drift");
+  const base = `/repos/${repository}`,
+    renames = [],
+    eligible = [];
+  for (let page = 1; page <= 20; page++) {
+    const result = await request(
+      `${base}/commits/${source.commit}/check-runs?filter=all&per_page=100&page=${page}`,
+    );
+    if (!Array.isArray(result.check_runs) || result.check_runs.length > 100)
+      throw new Error("Recovery check inventory is incomplete");
+    for (const check of result.check_runs) {
+      const match = /^buildchain:(attempt-[0-9a-f]{64}):(\d+):(\d+)$/u.exec(
+        check.external_id || "",
+      );
+      if (
+        check.name !== "check" ||
+        check.app?.slug !== "github-actions" ||
+        !match
+      )
+        continue;
+      const runId = Number(match[2]),
+        runAttempt = Number(match[3]);
+      if (
+        check.head_sha !== source.commit ||
+        ![check.id, runId, runAttempt].every(
+          (value) => Number.isSafeInteger(value) && value > 0,
+        )
+      )
+        throw new Error("Recovery check provider identity drift");
+      const run = await request(
+        `${base}/actions/runs/${runId}/attempts/${runAttempt}`,
+      );
+      if (
+        run.id !== runId ||
+        run.run_attempt !== runAttempt ||
+        run.repository?.full_name !== repository
+      )
+        throw new Error("Recovery check execution identity drift");
+      if (["workflow_dispatch", "repository_dispatch"].includes(run.event))
+        renames.push({
+          id: check.id,
+          externalId: check.external_id,
+          sourceHead: source.commit,
+          runId,
+          runAttempt,
+          name: RECOVERY_CHECK,
+        });
+      else if (
+        [
+          "push",
+          "pull_request",
+          "pull_request_review",
+          "pull_request_target",
+        ].includes(run.event) &&
+        run.head_sha === source.commit
+      )
+        eligible.push({
+          id: check.id,
+          runId,
+          runAttempt,
+          conclusion: check.conclusion,
+        });
+    }
+    if (result.check_runs.length < 100) return { renames, eligible };
+  }
+  throw new Error("Recovery check inventory exceeds its complete-read bound");
+}
+
 // The archive reference is already validated against the current attempt. A
 // build result is still re-read from the provider before it can admit delivery.
 export async function pipelineBuildEvidence(session, host) {
@@ -74,18 +151,59 @@ export async function publishPipelineBuildCheck(
       "Product check source differs from independently verified build",
     );
   const externalId = `buildchain:${context.attempt}:${context.runId}:${context.runAttempt}`;
+  const recovered = readback.schema === PIPELINE_BUILD_QUALIFICATION;
+  let checkName = recovered ? RECOVERY_CHECK : "check";
+  const output = {
+    title: recovered
+      ? "Buildchain recovered product verification"
+      : "Buildchain product verification",
+    summary: `Exact product jobs: ${readback.root}\nAttempt: ${context.attempt}`,
+  };
+  if (recovered) {
+    const checks = await observePipelineBuildChecks(
+      context.source,
+      request,
+      repository,
+    );
+    for (const change of checks.renames)
+      await request(`/repos/${repository}/check-runs/${change.id}`, {
+        method: "PATCH",
+        body: { name: change.name },
+      });
+    const original = checks.eligible.find((check) =>
+      readback.segments.some(
+        (segment) =>
+          segment.readback.runId === check.runId &&
+          segment.readback.runAttempt === check.runAttempt,
+      ),
+    );
+    // A complete replacement has no reusable original check to project onto.
+    // Retain that failed execution and publish this independently qualified
+    // aggregate as the required check. Protected landing still requalifies it
+    // and publishes the App-bound commit status before queue admission.
+    if (!original) checkName = "check";
+    // Keep the eligible normal-event check identity. Only a fully requalified
+    // source aggregate can repair its failed projection; original runs and
+    // immutable build receipts still retain their original failure outcomes.
+    if (
+      original &&
+      original.conclusion !== "success" &&
+      readback.outcome === "success"
+    )
+      await request(`/repos/${repository}/check-runs/${original.id}`, {
+        method: "PATCH",
+        body: { status: "completed", conclusion: "success", output },
+      });
+  }
   return request(`/repos/${repository}/check-runs`, {
     method: "POST",
     body: {
-      name: "check",
+      name: checkName,
       head_sha: context.source.commit,
       external_id: externalId,
       status: "completed",
       conclusion: readback.outcome === "success" ? "success" : "failure",
-      output: {
-        title: "Buildchain product verification",
-        summary: `Exact product jobs: ${readback.root}\nAttempt: ${context.attempt}`,
-      },
+      output,
       details_url: `https://github.com/${repository}/actions/runs/${context.runId}/attempts/${context.runAttempt}`,
     },
   });

package/packages/core/workflow/pipeline/build-result.js

@@ -61,6 +61,7 @@ export async function retainPipelineBuildResult(
     host.request,
     host.repository,
   );
+  await host.publishBuildStatus?.(context, readback);
   if (
     readback.schema === PIPELINE_BUILD_QUALIFICATION &&
     readback.outcome === "success"