@kungfu-tech/buildchain 4.1.3-alpha.5 → 4.1.3-alpha.7

package/packages/core/workflow/pipeline/channel-control.js

@@ -3,17 +3,38 @@ import { pipelineBuildEvidence } from "./build-evidence.js";
 
 async function record(session, phase, state, receipt, host, reason = "") {
   const observed = await session.journal.read();
+  if (observed.attempt !== session.observed.attempt)
+    throw new Error("Channel receipt belongs to a superseded attempt");
   const root = recordDigest(receipt);
-  const reference = await host
-    .materialStore(session)
-    .retain(`${phase}/${root.slice(7)}`, receipt, "provider-readback");
+  const eventKey = `${phase}:${state}:${root}`;
+  const store = host.materialStore(session);
+  const prior = observed.history
+    .at(-1)
+    .events.find((event) => event.payload.eventKey === eventKey);
+  if (prior) {
+    if (
+      prior.node !== phase ||
+      prior.payload.state !== state ||
+      prior.payload.reason !== reason ||
+      prior.payload.materials.length !== 1 ||
+      recordDigest(await store.read(prior.payload.materials[0])) !== root
+    )
+      throw new Error("Channel retry changed its immutable receipt");
+    return observed;
+  }
+  const reference = await store.retain(
+    `${phase}/${root.slice(7)}`,
+    receipt,
+    "provider-readback",
+  );
   return session.progress.progress({
     attempt: observed.attempt,
     phase,
     state,
-    eventKey: `${phase}:${state}:${root}`,
+    eventKey,
     reason,
     materials: [reference],
+    expectedHead: observed.head,
   });
 }
 

package/packages/core/workflow/pipeline/controller.js

@@ -2,7 +2,10 @@ import { pipelineEvent } from "./events.js";
 import { selectPipelineSession } from "./selection.js";
 import { beginPipelineBuild } from "./build-control.js";
 import { controlPipelineDelivery } from "./delivery-control.js";
-import { githubPipelineEvents } from "../../providers/github/pipeline-events.js";
+import {
+  githubPipelineEvents,
+  githubPipelineQueueExit,
+} from "../../providers/github/pipeline-events.js";
 import { pipelinePlatforms } from "./platforms.js";
 import { recordDigest } from "../../release/discussion/envelope.js";
 
@@ -95,6 +98,11 @@ export async function controlPipeline(name, payload, inputs, host) {
       attempt: session.observed.attempt,
     };
   }
+  if (session.intent.expectedNodes.includes("warrant"))
+    host.queueExit ||= githubPipelineQueueExit(
+      host.github.graphql,
+      host.repository,
+    );
   const operation = session.intent.expectedNodes.includes("warrant")
     ? await controlPipelineDelivery(session, inputs, host)
     : await host.channel(session, admission, inputs);

package/packages/core/workflow/pipeline/delivery-control.js

@@ -3,6 +3,7 @@ import { preparePipelineDelivery } from "./delivery-request.js";
 import { pipelineBuildEvidence } from "./build-evidence.js";
 import {
   observePipelineWorker,
+  pipelineDeliveryExecution,
   pipelineDeliveryStore,
 } from "./delivery-observation.js";
 import { reconcilePipeline, pipelineCandidate } from "./reconcile.js";
@@ -21,8 +22,14 @@ export async function observePipelineDelivery(session, inputs, host, delivery) {
     inputs,
   );
   admission.live.terminalOnly = host.terminalOnly === true;
-  admission.live.dequeued = host.eventAction === "dequeued";
   const queue = await delivery.read();
+  admission.live.queueExit =
+    admission.live.state === "open" &&
+    admission.live.source?.commit === current.generation.source.commit &&
+    admission.live.targetBranch === session.intent.source.targetBranch
+      ? await host.queueExit(current, pipelineCandidate(queue, current))
+      : null;
+  admission.live.dequeued = Boolean(admission.live.queueExit);
   const worker = await observePipelineWorker(session, current, queue, host);
   const input = { current, live: admission.live, queue, worker, evidence: {} };
   return {
@@ -68,6 +75,30 @@ async function retainDeliveryRequest(fresh, session, build, host) {
     ...scheduling.history.at(-1),
     intent: session.intent,
   };
+  // The provider execution owns the delivery slot before it acquires a
+  // Warrant. A later wake must not replace its retained coordinates while its
+  // queued or running job is still entitled to perform final admission.
+  const executionOwner = await pipelineDeliveryExecution(
+    session,
+    schedulingCurrent,
+    host,
+  );
+  if (executionOwner) {
+    const { run } = await host.runs.read(
+      executionOwner.runId,
+      executionOwner.runAttempt,
+    );
+    if (
+      run.id !== executionOwner.runId ||
+      run.run_attempt !== executionOwner.runAttempt
+    )
+      throw new Error("Retained delivery execution provider identity drift");
+    if (run.status !== "completed")
+      return {
+        operation: "wait",
+        reason: "admitted-delivery-execution-running",
+      };
+  }
   const active = await observePipelineWorker(
     session,
     schedulingCurrent,
@@ -145,14 +176,28 @@ export async function controlPipelineDelivery(session, inputs, host) {
       !["cancelled", "failure", "superseded", "complete"].includes(
         fresh.observed.status,
       )
-    )
-      await session.progress.progress({
-        attempt: fresh.attempt,
-        phase: fresh.phase,
-        state: "superseded",
-        eventKey: `supersede:${recordDigest(fresh.live)}`,
-        reason: fresh.decision.reason,
-      });
+    ) {
+      try {
+        await session.progress.progress({
+          attempt: fresh.attempt,
+          phase: fresh.phase,
+          state: "superseded",
+          eventKey: `supersede:${recordDigest(fresh.live)}`,
+          reason: fresh.decision.reason,
+        });
+      } catch (error) {
+        // Concurrent notifications can finish the same attempt after readback.
+        // Its immutable terminal result is sufficient; never rewrite that phase.
+        const latest = await session.journal.read();
+        if (
+          latest.attempt !== fresh.attempt ||
+          !["cancelled", "failure", "superseded", "complete"].includes(
+            latest.status,
+          )
+        )
+          throw error;
+      }
+    }
     return { operation: "successor", reason: fresh.decision.reason };
   }
   if (fresh.live.merged) return { operation: "settle", fresh, delivery };

package/packages/core/workflow/pipeline/delivery-observation.js

@@ -13,16 +13,7 @@ function workerJob(jobs, name) {
   return selected[0];
 }
 
-export async function observePipelineWorker(session, current, queue, host) {
-  const warrant = queue.activeWarrant;
-  const candidate = pipelineCandidate(queue, current);
-  if (
-    !warrant ||
-    candidate?.candidateId !== warrant.candidateId ||
-    warrant.sourceHead !== current.generation.source.commit ||
-    warrant.pullRequestNumber !== current.intent.source.pullRequest
-  )
-    return null;
+export async function pipelineDeliveryExecution(session, current, host) {
   const phase = [...current.events]
     .reverse()
     .find((event) =>
@@ -43,6 +34,21 @@ export async function observePipelineWorker(session, current, queue, host) {
     execution.generation !== current.generation.id
   )
     throw new Error("Native worker execution belongs to another attempt");
+  return execution;
+}
+
+export async function observePipelineWorker(session, current, queue, host) {
+  const warrant = queue.activeWarrant;
+  const candidate = pipelineCandidate(queue, current);
+  if (
+    !warrant ||
+    candidate?.candidateId !== warrant.candidateId ||
+    warrant.sourceHead !== current.generation.source.commit ||
+    warrant.pullRequestNumber !== current.intent.source.pullRequest
+  )
+    return null;
+  const execution = await pipelineDeliveryExecution(session, current, host);
+  if (!execution) return null;
   const { run, jobs } = await host.runs.read(
     execution.runId,
     execution.runAttempt,

package/packages/core/workflow/pipeline/group-control.js

@@ -38,6 +38,7 @@ export async function recordPipelineGroup(context, host) {
   );
   if (readback.outcome === "success")
     await host.qualifyChannel(context.source, context.branch);
+  await host.publishBuildStatus?.(context, readback);
   await host.request(`/repos/${host.repository}/check-runs`, {
     method: "POST",
     body: {

package/packages/core/workflow/pipeline/guard-build.js

@@ -35,3 +35,40 @@ export async function guardPipelineBuild(
   );
   return build;
 }
+
+// A commit status is source-bound and survives later workflow suites. Publish
+// only the independently reread build at the protected landing boundary, whose
+// existing Actions credential owns statuses:write. Retained build receipts
+// preserve the original executions and their outcomes.
+export async function publishPipelineBuildStatus(
+  input,
+  build,
+  request,
+  repository,
+) {
+  if (
+    build.readback.source.repository !== repository ||
+    build.readback.source.commit !== input["expected-head-sha"] ||
+    build.sourceHead !== input["expected-head-sha"] ||
+    build.run.id !== Number(input["source-workflow-run-id"]) ||
+    build.readback.runId !== build.run.id ||
+    build.readback.runAttempt !== build.run.run_attempt ||
+    build.outcome !== "success" ||
+    build.readback.outcome !== "success"
+  )
+    throw new Error(
+      "Landing status differs from its qualified exact-source build",
+    );
+  return request(`/repos/${repository}/statuses/${build.sourceHead}`, {
+    method: "POST",
+    body: {
+      context: "check",
+      state: "success",
+      description: `Qualified product build: ${build.readback.root}`.slice(
+        0,
+        140,
+      ),
+      target_url: `https://github.com/${repository}/actions/runs/${build.run.id}/attempts/${build.run.run_attempt}`,
+    },
+  });
+}

package/packages/core/workflow/pipeline/guard.js

@@ -105,13 +105,15 @@ export async function guardPipelineAdmission(input, connection) {
     throw new Error(
       "Pipeline protected review or required checks changed before delivery effect",
     );
-  await guardPipelineBuild(input, observed, {
+  const build = await guardPipelineBuild(input, observed, {
     material,
     source,
     request,
     repository: connection.repository,
   });
-  return guardPipelineDelivery(input, connection);
+  const fresh = await guardPipelineDelivery(input, connection);
+  await connection.publishBuildStatus?.(build);
+  return fresh;
 }
 
 export async function guardPipelineDelivery(input, connection, lookup) {

package/packages/core/workflow/pipeline/host.js

@@ -24,6 +24,24 @@ import { resumePipelineNotifications } from "./notifications.js";
 import { projectPipelineStatus } from "./web-status.js";
 import { inspectRecoveryPublication } from "../../publication/pipeline/recovery-inspection.js";
 
+export function pipelineQueue({ queueToken, ...options }) {
+  const reader = new GitHubClient(options);
+  return {
+    getMergeQueueState: (branch) => reader.getMergeQueueState(branch),
+    enqueuePullRequest: async (input) => {
+      // GITHUB_TOKEN enqueue suppresses the merge_group workflow it requires.
+      if (!queueToken || queueToken === options.token)
+        throw new Error(
+          "Channel enqueue requires a distinct App or automation credential",
+        );
+      return new GitHubClient({
+        ...options,
+        token: queueToken,
+      }).enqueuePullRequest(input);
+    },
+  };
+}
+
 export async function pipelineHost(core, env, jobName) {
   const token = core.getInput("token", { required: true });
   const repository = env.GITHUB_REPOSITORY;
@@ -84,7 +102,11 @@ export async function pipelineHost(core, env, jobName) {
     source,
     workers: githubPipelineWorker(request),
     policy: githubPipelinePolicy(request, repository),
-    queue: new GitHubClient({ repository: { owner, repo }, token }),
+    queue: pipelineQueue({
+      repository: { owner, repo },
+      token,
+      queueToken: core.getInput("queue-token"),
+    }),
     integration: githubPipelineIntegration(request, repository, source, runs),
     groupRecord: (context) => recordPipelineGroup(context, host),
     channel: (session, admission, inputs) =>

package/packages/core/workflow/pipeline/integration-status.js

@@ -0,0 +1,113 @@
+import { recordDigest } from "../../release/discussion/envelope.js";
+
+// The landing job already owns statuses:write. Keep its exact admission alive
+// through the actual queue result so later channel PRs need not borrow the
+// temporary queue branch's Actions check suite.
+async function observeProtectedQueue(current, ports) {
+  const { repository, request, queue } = ports;
+  const now = ports.now || Date.now;
+  const pause =
+    ports.pause || ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+  const deadline = now() + 120 * 60 * 1000;
+  const number = current.intent.source.pullRequest;
+  const branch = current.intent.source.targetBranch;
+  let queueExitAt;
+  while (true) {
+    const pr = await request(`/repos/${repository}/pulls/${number}`);
+    if (
+      pr.head?.sha !== current.generation.source.commit ||
+      pr.head?.repo?.full_name !== repository ||
+      pr.base?.repo?.full_name !== repository ||
+      pr.base?.ref !== branch
+    )
+      throw new Error("Integrated status lost its exact admitted PR source");
+    if (pr.merged) return { pr, deadline, now, pause };
+    if (now() >= deadline)
+      throw new Error(
+        "Protected queue did not complete the admitted integration",
+      );
+    const pending = await queue(branch);
+    if (
+      pr.state !== "open" ||
+      !pending.enabled ||
+      !pending.entries.some(
+        (entry) =>
+          entry.pullRequestNumber === number &&
+          entry.pullRequestHeadSha === current.generation.source.commit,
+      )
+    ) {
+      // Queue removal can precede the PR endpoint's merged readback. Bound
+      // convergence without treating absence or a closed PR as merge evidence.
+      queueExitAt ??= now();
+      if (now() - queueExitAt >= 30_000)
+        throw new Error("Admitted PR left its protected merge queue");
+    } else queueExitAt = undefined;
+    await pause(10000);
+  }
+}
+
+async function observeIntegrationWorkflow(merged, ports) {
+  const { pr, deadline, now, pause } = merged;
+  if (!/^[0-9a-f]{40}$/u.test(pr.merge_commit_sha || ""))
+    throw new Error("Merged PR has no exact integration commit");
+  while (true) {
+    const result = await ports.request(
+      `/repos/${ports.repository}/actions/runs?event=merge_group&head_sha=${pr.merge_commit_sha}&per_page=100`,
+    );
+    if (!Array.isArray(result.workflow_runs) || result.total_count > 100)
+      throw new Error("Integration workflow inventory exceeds its bound");
+    const runs = result.workflow_runs.filter(
+      (run) =>
+        run.path?.split("@")[0] === ".github/workflows/buildchain.yml" &&
+        run.event === "merge_group" &&
+        run.head_sha === pr.merge_commit_sha,
+    );
+    if (
+      runs.some(
+        (run) => run.status === "completed" && run.conclusion === "success",
+      )
+    )
+      return;
+    if (!runs.some((run) => run.status !== "completed") || now() >= deadline)
+      throw new Error("Merged integration has no successful queue workflow");
+    await pause(10000);
+  }
+}
+
+function validateIntegratedStatus(proof, current, repository) {
+  const { root, ...body } = proof;
+  if (
+    recordDigest(body) !== root ||
+    proof.repository !== repository ||
+    proof.pullRequest !== current.intent.source.pullRequest ||
+    proof.sourceHead !== current.generation.source.commit ||
+    proof.branch !== current.intent.source.targetBranch ||
+    proof.build.source.commit !== proof.mergeCommit ||
+    proof.build.source.repository !== repository ||
+    proof.build.outcome !== "success" ||
+    proof.run.conclusion !== "success" ||
+    proof.run.status !== "completed" ||
+    proof.run.event !== "merge_group" ||
+    proof.run.head_sha !== proof.mergeCommit
+  )
+    throw new Error("Integrated status differs from its verified queue result");
+}
+
+export async function publishIntegratedPipelineStatus(current, ports) {
+  const merged = await observeProtectedQueue(current, ports);
+  await observeIntegrationWorkflow(merged, ports);
+  const { repository, integration, status } = ports;
+  const proof = await integration.observe(current);
+  validateIntegratedStatus(proof, current, repository);
+  const { root } = proof;
+  await status(`/repos/${repository}/statuses/${proof.mergeCommit}`, {
+    method: "POST",
+    body: {
+      context: "check",
+      state: "success",
+      description: `Qualified protected integration: ${root}`.slice(0, 140),
+      target_url: `https://github.com/${repository}/actions/runs/${proof.run.id}/attempts/${proof.run.run_attempt}`,
+    },
+  });
+  return proof;
+}

package/packages/core/workflow/pipeline/record-action.js

@@ -0,0 +1,27 @@
+import { pipelineHost } from "./host.js";
+import { recordPipelineBuild } from "./build-control.js";
+import { publishRecorderStatus } from "./recorder-status.js";
+import {
+  RECOVERY_BUILD_CONTEXT,
+  recordRecoveryBuild,
+} from "./recovery-build-control.js";
+
+export async function recordPipelineBuildAction(core, env) {
+  const host = await pipelineHost(core, env, "Record product build");
+  host.publishBuildStatus = (context, readback) =>
+    publishRecorderStatus(context, readback, host);
+  const context = JSON.parse(core.getInput("context", { required: true }));
+  if (context.schema === "buildchain.pipeline-group-build-context/v1")
+    return host.groupRecord(context);
+  const result =
+    context.schema === RECOVERY_BUILD_CONTEXT
+      ? await recordRecoveryBuild(context, host)
+      : await recordPipelineBuild(context, host);
+  if (result.outcome !== "success")
+    throw new Error("Product build did not succeed");
+  core.info(
+    result.wakePending
+      ? "Build retained; next event will retry delivery wake"
+      : "Build retained and attempt woken",
+  );
+}

package/packages/core/workflow/pipeline/recorder-status.js

@@ -0,0 +1,69 @@
+import { createHash } from "node:crypto";
+import { parse } from "yaml";
+import { publishPipelineBuildStatus } from "./guard-build.js";
+import { recordDigest } from "../../release/discussion/envelope.js";
+
+// A repaired runtime may execute through an older immutable published entry.
+// Read the real recorder job's permission, rather than assuming the runtime's
+// current workflow is the one GitHub scheduled. API failures are never ignored.
+export async function publishRecorderStatus(context, readback, host) {
+  const { root, ...body } = readback;
+  if (
+    context.runId !== host.runId ||
+    context.runAttempt !== host.runAttempt ||
+    readback.runId !== host.runId ||
+    readback.runAttempt !== host.runAttempt ||
+    recordDigest(context.source) !== recordDigest(readback.source) ||
+    root !== recordDigest(body)
+  )
+    throw new Error("Recorder status changed its current source or execution");
+  const { run } = await host.runs.read(host.runId, host.runAttempt);
+  const path = ".github/workflows/.ops-pipeline-execute.yml";
+  const entries = (run.referenced_workflows || []).filter((entry) =>
+    entry.path?.startsWith(`kungfu-systems/buildchain/${path}@`),
+  );
+  if (entries.length !== 1 || !/^[0-9a-f]{40}$/u.test(entries[0].sha || ""))
+    throw new Error("Recorder has no exact published execution workflow");
+  const file = await host.request(
+    `/repos/kungfu-systems/buildchain/contents/${path}?ref=${entries[0].sha}`,
+  );
+  if (
+    file.type !== "file" ||
+    file.encoding !== "base64" ||
+    !Number.isSafeInteger(file.size) ||
+    file.size < 1 ||
+    file.size > 64000 ||
+    typeof file.content !== "string" ||
+    file.content.length > 128000
+  )
+    throw new Error(
+      "Recorder execution workflow is unavailable or exceeds its bound",
+    );
+  const bytes = Buffer.from(file.content, "base64");
+  const blob = createHash("sha1")
+    .update(`blob ${bytes.length}\0`)
+    .update(bytes)
+    .digest("hex");
+  if (bytes.length !== file.size || blob !== file.sha)
+    throw new Error("Recorder execution workflow bytes changed");
+  const job = parse(bytes.toString("utf8")).jobs?.["record-build"];
+  if (job?.name !== "Record product build")
+    throw new Error("Recorder execution workflow changed its job identity");
+  if (job.permissions?.statuses !== "write") return { published: false };
+  if (readback.outcome !== "success") return { published: false };
+  await publishPipelineBuildStatus(
+    {
+      "expected-head-sha": context.source.commit,
+      "source-workflow-run-id": String(readback.runId),
+    },
+    {
+      sourceHead: context.source.commit,
+      outcome: readback.outcome,
+      run: { id: readback.runId, run_attempt: readback.runAttempt },
+      readback,
+    },
+    host.request,
+    host.repository,
+  );
+  return { published: true };
+}

package/packages/core/workflow/pipeline/recovery-integration.js

@@ -7,10 +7,23 @@ export async function qualifyRecoveryIntegration(session, admission, host) {
     ...session.observed.history.at(-1),
     intent: session.intent,
   };
+  const policyAdmission = await host.source.observe(
+    session.intent.source.pullRequest,
+    { "config-path": current.generation.source.configPath },
+  );
+  if (
+    !policyAdmission.eligible ||
+    !policyAdmission.live.merged ||
+    policyAdmission.live.targetBranch !== session.intent.source.targetBranch ||
+    policyAdmission.live.mergeCommit !== admission.live.mergeCommit ||
+    recordDigest(policyAdmission.live.source) !==
+      recordDigest(current.generation.source)
+  )
+    throw new Error("Recovery observed changed protected integration");
   const integration = await host.integration.observe(current);
   const review = await host.policy.observeMerged(
     current,
-    admission.protectedPlan.review,
+    policyAdmission.protectedPlan.review,
     integration,
   );
   if (!review.review || !review.checksPassing)