@kungfu-tech/buildchain 4.1.3 → 4.1.4
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/AGENTS.md +11 -13
- package/CONTRIBUTING.md +32 -9
- package/README.md +56 -140
- package/actions/release/promotion/ref/README.md +1 -1
- package/architecture/action-taxonomy.json +1 -1
- package/architecture/agent-change-map.md +32 -45
- package/architecture/build-orchestration.json +1 -1
- package/architecture/capability-state-machine-manifest.json +5 -5
- package/architecture/ci-lane-change-budget.json +92 -92
- package/architecture/code-layout.json +2 -12
- package/architecture/core-mechanisms.json +38 -39
- package/architecture/cross-platform-adopter-qualification.json +1 -1
- package/architecture/dev-delivery-orchestration.json +2 -2
- package/architecture/floating-consumer-policy.json +3 -3
- package/architecture/internal-capabilities.json +27 -28
- package/architecture/maintainability-debt.json +60 -94
- package/architecture/maintainability-policy.json +7 -13
- package/architecture/minimal-consumer-migration.json +43 -5014
- package/architecture/platform-stage-checkpoints.json +1 -1
- package/architecture/release-tail-contract.json +2 -2
- package/architecture/release-topology.json +31 -25
- package/architecture/stage-capsule-qualification.json +1 -1
- package/architecture/universal-workflow-bootstrap.json +60 -60
- package/architecture/universal-workflow-capability-policy.json +3 -3
- package/architecture/universal-workflow-fault-campaign.json +7 -7
- package/architecture/workflow-taxonomy.json +59 -60
- package/contracts/fixtures/v4-tail-reseal-v1/valid.json +1 -1
- package/dist/site/buildchain-contract.json +138 -66
- package/dist/site/buildchain-site.json +257 -331
- package/dist/site/capability-registry.json +4 -4
- package/dist/site/cli-registry.json +6 -142
- package/dist/site/controller-registry.json +19 -19
- package/dist/site/kfd-claims.json +481 -529
- package/dist/site/kfd-upstream-aggregate.json +1 -1
- package/dist/site/manual-registry.json +22 -22
- package/dist/site/node-api-registry.json +82 -339
- package/dist/site/page-registry.json +229 -304
- package/dist/site/public-surface-audit.json +544 -754
- package/dist/site/publication-authority-registry.json +316 -316
- package/dist/site/publication-registry.json +1 -1
- package/dist/site/site-manifest.json +23 -23
- package/dist/site/workflow-registry.json +1071 -1027
- package/docs/MAP.md +28 -20
- package/docs/auditable-demo.md +17 -49
- package/docs/bootstrap-recovery.md +46 -37
- package/docs/cli-reference.md +2 -46
- package/docs/cli.md +97 -186
- package/docs/code-organization.md +7 -5
- package/docs/dev-alpha-candidate-patrol.md +19 -42
- package/docs/dev-delivery-orchestration.md +15 -11
- package/docs/dev-delivery-qualification-landing-adr.md +10 -9
- package/docs/dev-delivery-warrant.md +17 -16
- package/docs/dev-qualification-patrol.md +25 -20
- package/docs/getting-started.md +80 -139
- package/docs/github-artifact-attestation.md +31 -81
- package/docs/install.md +66 -30
- package/docs/lifecycle-protocol.md +19 -57
- package/docs/migration-inventory.md +17 -45
- package/docs/next-development-transition.md +13 -13
- package/docs/node-api-reference.md +122 -138
- package/docs/oci-publication.md +13 -10
- package/docs/publication-artifacts.md +128 -486
- package/docs/publication-authority.md +15 -45
- package/docs/publish-transaction.md +13 -11
- package/docs/release-candidate.md +126 -355
- package/docs/release-discussions.md +36 -67
- package/docs/release-flow.md +80 -339
- package/docs/release-governance.md +114 -962
- package/docs/release-promotion-request.md +45 -43
- package/docs/release-propagation.md +13 -27
- package/docs/release-tail-provider-plane.md +38 -65
- package/docs/reusable-build-surface.md +78 -196
- package/docs/runtime-train-validation.md +8 -6
- package/docs/stable-candidate-patrol.md +13 -66
- package/docs/v4-adopter-delivery.md +15 -15
- package/docs/v4-declarative-release-tail-migration.md +19 -17
- package/docs/v4-production-release.md +11 -6
- package/docs/v4-publication-rehearsal.md +12 -27
- package/docs/v4-stage-capsule.md +14 -20
- package/docs/v4-tail-reseal.md +34 -20
- package/docs/web-surface-deployments.md +26 -264
- package/docs/workflow-catalog.md +31 -31
- package/docs/workflow-path-migration.md +10 -4
- package/package.json +5 -4
- package/packages/core/adoption/buildchain-kfd-claims.js +7 -7
- package/packages/core/adoption/cli/output.mjs +1 -9
- package/packages/core/adoption/cli/product-gate.mjs +1 -15
- package/packages/core/adoption/cli/project.mjs +9 -10
- package/packages/core/adoption/cli/standards.mjs +1 -14
- package/packages/core/adoption/cli/support.mjs +0 -2
- package/packages/core/adoption/cli/surface-register.mjs +0 -2
- package/packages/core/adoption/commands/init-repo.mjs +77 -485
- package/packages/core/adoption/consumer-init.js +279 -0
- package/packages/core/adoption/qualification/admission.js +1 -1
- package/packages/core/build/cli/cache.mjs +0 -2
- package/packages/core/build/cli/facts.mjs +0 -3
- package/packages/core/build/cli/homebrew.mjs +0 -4
- package/packages/core/build/cli/lifecycle.mjs +0 -3
- package/packages/core/build/github-artifact-attestation.js +2 -2
- package/packages/core/build/platform-stage-checkpoints.js +1 -1
- package/packages/core/build/signing/dispatch.js +1 -1
- package/packages/core/consumer/buildchain-config.js +9 -0
- package/packages/core/consumer/contract/inspection.js +351 -9
- package/packages/core/consumer/contract/javascript-syntax.js +439 -0
- package/packages/core/consumer/contract/javascript-values.js +61 -0
- package/packages/core/consumer/contract/javascript.js +555 -0
- package/packages/core/consumer/contract/local-validation.js +84 -0
- package/packages/core/contracts/buildchain-contract.js +39 -8
- package/packages/core/contracts/cli/introspection.mjs +1 -9
- package/packages/core/contracts/public-surface-cli.js +0 -1
- package/packages/core/dev-delivery/dev-delivery-contract-surface.js +2 -2
- package/packages/core/governance/buildchain-publication-authority.js +24 -24
- package/packages/core/governance/cli/doctor.mjs +58 -42
- package/packages/core/governance/commands/architecture.mjs +6 -1
- package/packages/core/governance/commands/audit-publication-control-plane.mjs +1 -1
- package/packages/core/governance/commands/workflow-friction-report.mjs +1 -1
- package/packages/core/governance/github-governance-authority.js +2 -2
- package/packages/core/governance/publication/collection.js +1 -1
- package/packages/core/index.js +1 -3
- package/packages/core/observability/cli/candidate.mjs +0 -2
- package/packages/core/observability/cli/context.mjs +0 -5
- package/packages/core/observability/cli/diagnostics.mjs +0 -7
- package/packages/core/observability/cli/events.mjs +2 -10
- package/packages/core/paper/commands/paper-work-fleet-cli.mjs +1 -1
- package/packages/core/paper/commands/paper.mjs +33 -422
- package/packages/core/paper/consumer-status.js +72 -0
- package/packages/core/paper/operations/identity.js +0 -3
- package/packages/core/paper/operations/migration.js +460 -0
- package/packages/core/paper/operations/preflight-checks.js +8 -68
- package/packages/core/paper/operations/scaffold.js +16 -326
- package/packages/core/paper/operations/status.js +27 -53
- package/packages/core/paper/paper-agent-entry.js +36 -147
- package/packages/core/paper/paper-fleet.js +24 -39
- package/packages/core/paper/paper-repository.js +16 -0
- package/packages/core/paper/paper-runtime-channels.js +1 -1
- package/packages/core/paper/paper-scaffold-content.js +153 -162
- package/packages/core/paper/paper-work.js +3 -10
- package/packages/core/paper/paper.js +43 -5
- package/packages/core/providers/github/artifact-attestation.js +1 -1
- package/packages/core/providers/github/pipeline-context-artifacts.js +172 -0
- package/packages/core/publication/authority/control-plane.js +2 -2
- package/packages/core/publication/authority/seal.js +1 -1
- package/packages/core/publication/cli/dispatch.mjs +1 -12
- package/packages/core/publication/pipeline/actions.js +16 -9
- package/packages/core/publication/pipeline/apply.js +17 -9
- package/packages/core/publication/pipeline/context.js +29 -0
- package/packages/core/publication/pipeline/prepare.js +15 -6
- package/packages/core/publication/pipeline/recovery-materials.js +63 -1
- package/packages/core/publication/pipeline/recovery-prepare.js +21 -9
- package/packages/core/publication/pipeline/stable-entry.js +12 -7
- package/packages/core/publication/pipeline/stable-products.js +21 -19
- package/packages/core/publication/pipeline/version-actions.js +15 -6
- package/packages/core/publication/publication-rehearsal-projection.js +0 -9
- package/packages/core/release/cli/dispatch.mjs +1 -4
- package/packages/core/release/cli/inspection-handlers.mjs +1 -33
- package/packages/core/release/cli/release-handlers.mjs +2 -19
- package/packages/core/release/cli/verification-handlers.mjs +4 -25
- package/packages/core/release/next-development-projection.js +13 -13
- package/packages/core/release/passport/locations.js +13 -8
- package/packages/core/release/release-passport.js +70 -5
- package/packages/core/web/cli/badges.mjs +0 -4
- package/packages/core/web/publication-admission.js +1 -1
- package/packages/core/web/publication-capability.js +1 -1
- package/packages/core/web/readme-badges.js +1 -1
- package/packages/core/workflow/cli/main.mjs +1 -4
- package/packages/core/workflow/cli/process.mjs +1 -1
- package/packages/core/workflow/commands/buildchain-cli-help.mjs +2 -8
- package/packages/core/workflow/engine/conformance.js +1 -1
- package/packages/core/workflow/pipeline/build.js +21 -1
- package/packages/core/workflow/pipeline/delivery-observation.js +6 -2
- package/packages/core/workflow/workflow-taxonomy.mjs +61 -17
- package/scripts/check-code-layout.mjs +2 -0
- package/scripts/check-core-mechanism-inventory.mjs +29 -13
- package/scripts/check-floating-consumer-policy-contract.mjs +3 -3
- package/scripts/check-inventory.mjs +27 -27
- package/scripts/check-maintainability.mjs +28 -5
- package/scripts/check-public-dogfood-contract.mjs +3 -3
- package/scripts/check-release-topology.mjs +1 -1
- package/scripts/check-self-consumer-contract.mjs +7 -7
- package/scripts/check-universal-workflow-bootstrap.mjs +1 -1
- package/scripts/generate-channel-promotion-workflow.mjs +1 -1
- package/scripts/generate-minimal-consumer-contract.mjs +21 -1
- package/scripts/generate-site-bundle.mjs +2 -1
- package/scripts/generate-tail-reseal-fixture.mjs +3 -3
- package/scripts/inventory/promotion.mjs +1 -1
- package/scripts/next-development-self-dogfood-harness.mjs +1 -1
- package/scripts/next-development-self-dogfood.mjs +4 -4
- package/scripts/site-capability-metadata.mjs +2 -6
- package/scripts/source-metric-lineage.mjs +62 -7
- package/scripts/verify-golden-path.mjs +31 -35
- package/templates/native-dev-delivery.yml +1 -1
- package/templates/universal-buildchain-bootstrap.yml +1 -1
- package/packages/core/paper/operations/bootstrap.js +0 -75
- package/packages/core/paper/operations/plans.js +0 -213
- package/packages/core/paper/operations/provisioning.js +0 -113
- package/packages/core/paper/operations/scaffold-config.js +0 -77
- package/packages/core/paper/operations/scaffold-workflows.js +0 -116
- package/packages/core/paper/operations/workspace.js +0 -60
- package/packages/core/paper/paper-npm-bootstrap.js +0 -492
|
@@ -16,6 +16,7 @@ import { evaluateBuildchainContractLock as evaluateFactBackedBuildchainContractL
|
|
|
16
16
|
import { createControllerRegistry } from "../observability/controller-evidence.js";
|
|
17
17
|
import { enumerateWorkflowInputs } from "./public-surface-audit.js";
|
|
18
18
|
import { devDeliveryWorkflowContractSurface } from "../dev-delivery/dev-delivery-contract-surface.js";
|
|
19
|
+
import { PIPELINE_ENTRY, RECOVERY_ENTRY } from "../consumer/contract/entries.js";
|
|
19
20
|
|
|
20
21
|
export {
|
|
21
22
|
BUILDCHAIN_CHANNELS,
|
|
@@ -101,6 +102,13 @@ function maybeFileDigest(root, relPath) {
|
|
|
101
102
|
}
|
|
102
103
|
|
|
103
104
|
function surface(root, value) {
|
|
105
|
+
if (["workflow", "action", "controller"].includes(value.kind))
|
|
106
|
+
value = {
|
|
107
|
+
...value,
|
|
108
|
+
apiRole: value.kind === "workflow" && [PIPELINE_ENTRY, RECOVERY_ENTRY].includes(value.path)
|
|
109
|
+
? "public"
|
|
110
|
+
: "implementation",
|
|
111
|
+
};
|
|
104
112
|
if (value.kind === "workflow" && fs.existsSync(path.join(root, value.path))) {
|
|
105
113
|
const contract = parseReusableWorkflowInterface(fs.readFileSync(path.join(root, value.path), "utf8"));
|
|
106
114
|
value = { ...value, requiredInputs: contract.inputs.filter(x => x.required).map(x => x.name), optionalInputs: contract.inputs.filter(x => !x.required).map(x => x.name), requiredOutputs: contract.outputs.map(x => typeof x === "string" ? x : x.name) };
|
|
@@ -108,6 +116,7 @@ function surface(root, value) {
|
|
|
108
116
|
const breakingModel = {
|
|
109
117
|
id: value.id,
|
|
110
118
|
kind: value.kind,
|
|
119
|
+
...(value.apiRole ? { apiRole: value.apiRole } : {}),
|
|
111
120
|
contractVersion: value.contractVersion || 1,
|
|
112
121
|
requiredInputs: value.requiredInputs || [],
|
|
113
122
|
requiredOutputs: value.requiredOutputs || [],
|
|
@@ -134,8 +143,8 @@ function declarativeAuditableDemoSurface(root, pkg, majorLine) {
|
|
|
134
143
|
return surface(root, {
|
|
135
144
|
id: "declarative-auditable-demo",
|
|
136
145
|
kind: "workflow",
|
|
137
|
-
path: ".github/workflows
|
|
138
|
-
publicRef: `${pkg.repository ? "kungfu-systems/buildchain" : "buildchain"}/.github/workflows
|
|
146
|
+
path: ".github/workflows/.build-demo.yml",
|
|
147
|
+
publicRef: `${pkg.repository ? "kungfu-systems/buildchain" : "buildchain"}/.github/workflows/.build-demo.yml@${majorLine}`,
|
|
139
148
|
breakingDefaults: {
|
|
140
149
|
scenarioPathDefault: ".buildchain/auditable-demo.json",
|
|
141
150
|
renderMediaDefault: false,
|
|
@@ -213,6 +222,28 @@ export function createBuildchainContractWorld({
|
|
|
213
222
|
? createControllerRegistry({ workflows: workflowDescriptors })
|
|
214
223
|
: readJson(path.join(root, "dist/site/controller-registry.json"), { controllers: [] }));
|
|
215
224
|
const surfaces = [
|
|
225
|
+
surface(root, {
|
|
226
|
+
id: "pipeline",
|
|
227
|
+
kind: "workflow",
|
|
228
|
+
path: PIPELINE_ENTRY,
|
|
229
|
+
publicRef: `kungfu-systems/buildchain/${PIPELINE_ENTRY}@${majorLine}`,
|
|
230
|
+
breakingDefaults: { configurationAuthority: ".buildchain/buildchain.toml", schema: 2 },
|
|
231
|
+
guarantees: [
|
|
232
|
+
"one product-independent generated caller admits normal repository events",
|
|
233
|
+
"the published runtime owns protected delivery, publication and provider readback",
|
|
234
|
+
],
|
|
235
|
+
}),
|
|
236
|
+
surface(root, {
|
|
237
|
+
id: "attempt-recovery",
|
|
238
|
+
kind: "workflow",
|
|
239
|
+
path: RECOVERY_ENTRY,
|
|
240
|
+
publicRef: `kungfu-systems/buildchain/${RECOVERY_ENTRY}@${majorLine}`,
|
|
241
|
+
breakingDefaults: { selector: "exact-attempt", repairedRuntime: "optional-transient-input" },
|
|
242
|
+
guarantees: [
|
|
243
|
+
"recovery retains original source, materials and immutable publication evidence",
|
|
244
|
+
"consumers cannot replace provider effects, artifacts or source through recovery inputs",
|
|
245
|
+
],
|
|
246
|
+
}),
|
|
216
247
|
surface(root, {
|
|
217
248
|
id: "reusable-build",
|
|
218
249
|
kind: "workflow",
|
|
@@ -234,8 +265,8 @@ export function createBuildchainContractWorld({
|
|
|
234
265
|
surface(root, {
|
|
235
266
|
id: "channel-build-router",
|
|
236
267
|
kind: "workflow",
|
|
237
|
-
path: ".github/workflows
|
|
238
|
-
publicRef: `${pkg.repository ? "kungfu-systems/buildchain" : "buildchain"}/.github/workflows
|
|
268
|
+
path: ".github/workflows/.build-candidate.yml",
|
|
269
|
+
publicRef: `${pkg.repository ? "kungfu-systems/buildchain" : "buildchain"}/.github/workflows/.build-candidate.yml@${majorLine}`,
|
|
239
270
|
breakingDefaults: {
|
|
240
271
|
configurationAuthority: "buildchain.toml",
|
|
241
272
|
runtimeIdentity: "entry-selected-complete-runtime",
|
|
@@ -253,8 +284,8 @@ export function createBuildchainContractWorld({
|
|
|
253
284
|
surface(root, {
|
|
254
285
|
id: "release-candidate-promote",
|
|
255
286
|
kind: "workflow",
|
|
256
|
-
path: ".github/workflows
|
|
257
|
-
publicRef: `${pkg.repository ? "kungfu-systems/buildchain" : "buildchain"}/.github/workflows
|
|
287
|
+
path: ".github/workflows/.release-candidate-promote.yml",
|
|
288
|
+
publicRef: `${pkg.repository ? "kungfu-systems/buildchain" : "buildchain"}/.github/workflows/.release-candidate-promote.yml@${majorLine}`,
|
|
258
289
|
breakingDefaults: {
|
|
259
290
|
channelDefault: "auto",
|
|
260
291
|
runtimeSelectionOwner: "actions/runtime/selection/resolve",
|
|
@@ -311,8 +342,8 @@ export function createBuildchainContractWorld({
|
|
|
311
342
|
surface(root, {
|
|
312
343
|
id: "web-surface",
|
|
313
344
|
kind: "workflow",
|
|
314
|
-
path: ".github/workflows
|
|
315
|
-
publicRef: `${pkg.repository ? "kungfu-systems/buildchain" : "buildchain"}/.github/workflows
|
|
345
|
+
path: ".github/workflows/.release-web.yml",
|
|
346
|
+
publicRef: `${pkg.repository ? "kungfu-systems/buildchain" : "buildchain"}/.github/workflows/.release-web.yml@${majorLine}`,
|
|
316
347
|
breakingDefaults: {
|
|
317
348
|
runtimeSelectionOwner: "actions/runtime/selection/resolve",
|
|
318
349
|
contractCompatibilityPolicy: "major-compatible",
|
|
@@ -1,15 +1,7 @@
|
|
|
1
1
|
import { BUILDCHAIN_USAGE } from "../../workflow/commands/buildchain-cli-help.mjs";
|
|
2
2
|
import { formatCliHelp } from "../cli-reference.js";
|
|
3
3
|
import { createBuildchainLayoutDiscovery } from "../buildchain-layout.js";
|
|
4
|
-
import {
|
|
5
|
-
printJson,
|
|
6
|
-
readBooleanFlag,
|
|
7
|
-
readFlag,
|
|
8
|
-
readJsonInput,
|
|
9
|
-
readRepeatedFlag,
|
|
10
|
-
readRepeatedJsonInputs,
|
|
11
|
-
writeJsonFile,
|
|
12
|
-
} from "./options.mjs";
|
|
4
|
+
import { printJson, readBooleanFlag, readFlag } from "./options.mjs";
|
|
13
5
|
import { packageVersion } from "./context.mjs";
|
|
14
6
|
|
|
15
7
|
export async function handleHelpCommand(args) {
|
|
@@ -35,7 +35,6 @@ function kfdCommandId(sub, leaf) {
|
|
|
35
35
|
}
|
|
36
36
|
|
|
37
37
|
function paperCommandId(sub, leaf) {
|
|
38
|
-
if (sub === "bootstrap" && leaf === "npm") return "paper-bootstrap-npm";
|
|
39
38
|
if (["work", "fleet"].includes(sub) && leaf) return `paper-${sub}-${leaf}`;
|
|
40
39
|
return sub ? `paper-${sub}` : "paper";
|
|
41
40
|
}
|
|
@@ -2,8 +2,8 @@ export function devDeliveryWorkflowContractSurface(pkg, majorLine) {
|
|
|
2
2
|
return {
|
|
3
3
|
id: "dev-pr-auto-merge",
|
|
4
4
|
kind: "workflow",
|
|
5
|
-
path: ".github/workflows
|
|
6
|
-
publicRef: `${pkg.repository ? "kungfu-systems/buildchain" : "buildchain"}/.github/workflows
|
|
5
|
+
path: ".github/workflows/.ops-dev-auto-merge.yml",
|
|
6
|
+
publicRef: `${pkg.repository ? "kungfu-systems/buildchain" : "buildchain"}/.github/workflows/.ops-dev-auto-merge.yml@${majorLine}`,
|
|
7
7
|
breakingDefaults: {
|
|
8
8
|
runtimeSelectorDefault: "consumer-contract-lock-or-entry",
|
|
9
9
|
authorityMode: "two-phase-delivery-warrant",
|
|
@@ -6,45 +6,45 @@ import { createPublicationAuthorityRegistry } from "../publication/publication-a
|
|
|
6
6
|
const DESCRIPTORS = Object.freeze([
|
|
7
7
|
[".github/workflows/buildchain.yml", "product-publication", true, ["npm-publish", "github-release", "channel-ref"], "trusted-publishing", "none", "fixed", "fixed", ".github/workflows/.release-pipeline-products.yml"],
|
|
8
8
|
[".github/workflows/buildchain-recover.yml", "product-publication", true, ["npm-publish", "github-release", "channel-ref"], "trusted-publishing", "none", "fixed", "fixed", ".github/workflows/.release-pipeline-products.yml"],
|
|
9
|
-
[".github/workflows
|
|
9
|
+
[".github/workflows/.release-oci-compose-preview.yml", "product-publication", true, ["oci-compose-preview"], "caller-secrets", "none", "fixed", "caller-bound"],
|
|
10
10
|
[".github/workflows/.build-demo-adapter.yml", "non-publication-oidc"],
|
|
11
|
-
[".github/workflows
|
|
11
|
+
[".github/workflows/.build-demo.yml", "governance-write"],
|
|
12
12
|
[".github/workflows/.build.yml", "non-publication-oidc"],
|
|
13
13
|
[".github/workflows/.release-promote.yml", "product-publication", true, ["npm-publish", "github-release", "channel-ref"], "trusted-publishing", "none", "fixed", "caller-bound"],
|
|
14
14
|
[".github/workflows/.release-authority.yml", "evidence-publication"],
|
|
15
15
|
[".github/workflows/.build-release-verify-compat.yml", "governance-write"],
|
|
16
16
|
[".github/workflows/.build-sam-verify-compat.yml", "retired-deny"],
|
|
17
17
|
[".github/workflows/.ops-git-sync.yml", "governance-write"],
|
|
18
|
-
[".github/workflows
|
|
18
|
+
[".github/workflows/.release-web.yml", "product-publication", true, ["web-production"], "oidc", "consumer-defined", "caller-bound", "caller-bound"],
|
|
19
19
|
[".github/workflows/.build-wheel-verify-compat.yml", "retired-deny"],
|
|
20
20
|
[".github/workflows/.release-binary-assets.yml", "product-publication", true, ["github-release"], "github-token", "buildchain-release-assets"],
|
|
21
|
-
[".github/workflows
|
|
22
|
-
[".github/workflows
|
|
23
|
-
[".github/workflows
|
|
24
|
-
[".github/workflows
|
|
25
|
-
[".github/workflows
|
|
26
|
-
[".github/workflows
|
|
27
|
-
[".github/workflows
|
|
28
|
-
[".github/workflows
|
|
29
|
-
[".github/workflows
|
|
21
|
+
[".github/workflows/.release-signing-authority.yml", "evidence-publication"],
|
|
22
|
+
[".github/workflows/.build-candidate.yml", "non-publication-oidc"],
|
|
23
|
+
[".github/workflows/.ops-bootstrap.yml", "product-publication", true, ["universal-candidate-execution"], "caller-secrets", "none", "fixed", "caller-bound"],
|
|
24
|
+
[".github/workflows/.ops-patrol.yml", "governance-write"],
|
|
25
|
+
[".github/workflows/.ops-dev-qualification-patrol.yml", "governance-write"],
|
|
26
|
+
[".github/workflows/.ops-alpha-candidate-patrol.yml", "governance-write"],
|
|
27
|
+
[".github/workflows/.ops-warrant-close.yml", "governance-write"],
|
|
28
|
+
[".github/workflows/.ops-warrant-cancel.yml", "governance-write"],
|
|
29
|
+
[".github/workflows/.ops-dev-auto-merge.yml", "governance-write"],
|
|
30
30
|
[".github/workflows/public-ops-pipeline.yml", "product-publication", true, ["npm-publish", "github-release", "channel-ref"], "trusted-publishing", "none", "fixed", "fixed", ".github/workflows/.release-pipeline-products.yml"],
|
|
31
31
|
[".github/workflows/public-ops-recover.yml", "product-publication", true, ["npm-publish", "github-release", "channel-ref"], "trusted-publishing", "none", "fixed", "fixed", ".github/workflows/.release-pipeline-products.yml"],
|
|
32
32
|
[".github/workflows/.ops-pipeline-execute.yml", "product-publication", true, ["npm-publish", "github-release", "channel-ref"], "trusted-publishing", "none", "fixed", "fixed", ".github/workflows/.release-pipeline-products.yml"],
|
|
33
33
|
[".github/workflows/.release-pipeline-products.yml", "product-publication", true, ["npm-publish", "github-release", "channel-ref"], "trusted-publishing", "none", "fixed", "fixed"],
|
|
34
34
|
[".github/workflows/.release-pipeline-version.yml", "governance-write"],
|
|
35
35
|
[".github/workflows/.ops-pipeline-delivery.yml", "governance-write"],
|
|
36
|
-
[".github/workflows
|
|
37
|
-
[".github/workflows
|
|
38
|
-
[".github/workflows
|
|
39
|
-
[".github/workflows
|
|
40
|
-
[".github/workflows
|
|
41
|
-
[".github/workflows
|
|
42
|
-
[".github/workflows
|
|
43
|
-
[".github/workflows
|
|
44
|
-
[".github/workflows
|
|
45
|
-
[".github/workflows
|
|
46
|
-
[".github/workflows
|
|
47
|
-
[".github/workflows
|
|
36
|
+
[".github/workflows/.ops-housekeeping.yml", "governance-write"],
|
|
37
|
+
[".github/workflows/.release-artifact-attestation.yml", "evidence-publication", true, ["github-artifact-attestation"], "oidc", "consumer-defined", "caller-bound", "caller-bound"],
|
|
38
|
+
[".github/workflows/.release-paper.yml", "product-publication", true, ["npm-publish", "github-release"], "trusted-publishing", "none", "fixed", "caller-bound"],
|
|
39
|
+
[".github/workflows/.ops-patrol-daily.yml", "governance-write"],
|
|
40
|
+
[".github/workflows/.ops-patrol-monthly.yml", "governance-write"],
|
|
41
|
+
[".github/workflows/.ops-observed-evidence.yml", "product-publication", true, ["observed-evidence-publication"], "oidc", "consumer-defined", "caller-bound", "caller-bound"],
|
|
42
|
+
[".github/workflows/.ops-patrol-weekly.yml", "governance-write"],
|
|
43
|
+
[".github/workflows/.build-publication.yml", "evidence-publication"],
|
|
44
|
+
[".github/workflows/.release-candidate-promote.yml", "product-publication", true, ["npm-publish", "github-release", "channel-ref"], "trusted-publishing", "none", "fixed", "caller-bound"],
|
|
45
|
+
[".github/workflows/.release-propagation.yml", "governance-write"],
|
|
46
|
+
[".github/workflows/.release-tail.yml", "product-publication", true, ["artifact.publish", "signed-channel.commit", "release.activate", "released-evidence.synthesize"], "caller-secrets", "caller-bound", "caller-bound", "fixed"],
|
|
47
|
+
[".github/workflows/.ops-stable-candidate-patrol.yml", "governance-write"],
|
|
48
48
|
]);
|
|
49
49
|
|
|
50
50
|
export function buildchainPublicationAuthorityDescriptors({ root = process.cwd() } = {}) {
|
|
@@ -1,24 +1,14 @@
|
|
|
1
|
-
import {
|
|
1
|
+
import { spawnSync } from "node:child_process";
|
|
2
2
|
import fs from "node:fs";
|
|
3
3
|
import path from "node:path";
|
|
4
4
|
import { validateBuildchainConfig } from "../../consumer/buildchain-config.js";
|
|
5
|
+
import { validateConsumerWiring } from "../../consumer/contract/local-validation.js";
|
|
5
6
|
import { detectPackageManager } from "../../build/package-manager.js";
|
|
6
|
-
import {
|
|
7
|
-
BUILDCHAIN_PROCESS_SAMPLE_REPORT_CONTRACT,
|
|
8
|
-
formatDiagnosticsSummaryTable,
|
|
9
|
-
startProcessSampler,
|
|
10
|
-
summarizeDiagnosticsArtifacts,
|
|
11
|
-
summarizeProcessSamples,
|
|
12
|
-
validateAnchoredPackageRelease,
|
|
13
|
-
} from "../../observability/diagnostics.js";
|
|
7
|
+
import { validateAnchoredPackageRelease } from "../../observability/diagnostics.js";
|
|
14
8
|
import {
|
|
15
9
|
printJson,
|
|
16
10
|
readBooleanFlag,
|
|
17
11
|
readFlag,
|
|
18
|
-
readJsonInput,
|
|
19
|
-
readRepeatedFlag,
|
|
20
|
-
readRepeatedJsonInputs,
|
|
21
|
-
writeJsonFile,
|
|
22
12
|
} from "../../contracts/cli/options.mjs";
|
|
23
13
|
|
|
24
14
|
export function checkStatus(ok, id, message, details = {}) {
|
|
@@ -51,19 +41,25 @@ export function runDoctor({
|
|
|
51
41
|
} catch (error) {
|
|
52
42
|
checks.push(checkStatus(false, "config.valid", error.message));
|
|
53
43
|
}
|
|
54
|
-
|
|
55
|
-
|
|
56
|
-
|
|
57
|
-
|
|
58
|
-
|
|
59
|
-
|
|
60
|
-
|
|
61
|
-
|
|
62
|
-
|
|
63
|
-
|
|
64
|
-
|
|
65
|
-
|
|
66
|
-
|
|
44
|
+
if (
|
|
45
|
+
validation?.config.schema !== 2 ||
|
|
46
|
+
validation.products.some((product) => product.type === "npm")
|
|
47
|
+
)
|
|
48
|
+
try {
|
|
49
|
+
const manager = detectPackageManager(resolvedCwd);
|
|
50
|
+
checks.push(
|
|
51
|
+
checkStatus(
|
|
52
|
+
true,
|
|
53
|
+
"package-manager.detected",
|
|
54
|
+
`package manager: ${manager.name}`,
|
|
55
|
+
manager,
|
|
56
|
+
),
|
|
57
|
+
);
|
|
58
|
+
} catch (error) {
|
|
59
|
+
checks.push(
|
|
60
|
+
checkStatus(false, "package-manager.detected", error.message),
|
|
61
|
+
);
|
|
62
|
+
}
|
|
67
63
|
const git = spawnSync("git", ["rev-parse", "--is-inside-work-tree"], {
|
|
68
64
|
cwd: resolvedCwd,
|
|
69
65
|
encoding: "utf8",
|
|
@@ -75,23 +71,43 @@ export function runDoctor({
|
|
|
75
71
|
"directory is a git repository",
|
|
76
72
|
),
|
|
77
73
|
);
|
|
78
|
-
|
|
79
|
-
|
|
80
|
-
|
|
81
|
-
|
|
82
|
-
|
|
83
|
-
|
|
84
|
-
|
|
85
|
-
|
|
86
|
-
|
|
87
|
-
|
|
88
|
-
|
|
89
|
-
|
|
90
|
-
|
|
91
|
-
|
|
92
|
-
)
|
|
93
|
-
|
|
74
|
+
if (validation?.config.schema === 2) {
|
|
75
|
+
try {
|
|
76
|
+
const wiring = validateConsumerWiring(
|
|
77
|
+
resolvedCwd,
|
|
78
|
+
validation.config.path,
|
|
79
|
+
);
|
|
80
|
+
checks.push(
|
|
81
|
+
checkStatus(
|
|
82
|
+
true,
|
|
83
|
+
"workflow.consumer-pair",
|
|
84
|
+
"shared consumer callers match the published contract",
|
|
85
|
+
wiring,
|
|
86
|
+
),
|
|
87
|
+
);
|
|
88
|
+
} catch (error) {
|
|
89
|
+
checks.push(checkStatus(false, "workflow.consumer-pair", error.message));
|
|
90
|
+
}
|
|
91
|
+
} else {
|
|
92
|
+
const workflowPath = path.join(
|
|
93
|
+
resolvedCwd,
|
|
94
|
+
".github",
|
|
95
|
+
"workflows",
|
|
96
|
+
"build.yml",
|
|
97
|
+
);
|
|
98
|
+
checks.push(
|
|
99
|
+
checkStatus(
|
|
100
|
+
fs.existsSync(workflowPath),
|
|
101
|
+
"workflow.build",
|
|
102
|
+
"reusable workflow caller exists",
|
|
103
|
+
{
|
|
104
|
+
path: ".github/workflows/build.yml",
|
|
105
|
+
},
|
|
106
|
+
),
|
|
107
|
+
);
|
|
108
|
+
}
|
|
94
109
|
if (
|
|
110
|
+
validation?.config.schema !== 2 &&
|
|
95
111
|
validation?.version?.strategy === "anchored" &&
|
|
96
112
|
validation.version.next === "manual"
|
|
97
113
|
) {
|
|
@@ -211,7 +211,12 @@ function validateCapabilities(capabilities, inventory, issues) {
|
|
|
211
211
|
`${capability.id} owner drifted from the current inventory`,
|
|
212
212
|
);
|
|
213
213
|
for (const surface of capability.surfaces || [])
|
|
214
|
-
if (
|
|
214
|
+
if (
|
|
215
|
+
![
|
|
216
|
+
...source.publicSurfaces,
|
|
217
|
+
...(source.internalSurfaces || []),
|
|
218
|
+
].includes(surface)
|
|
219
|
+
)
|
|
215
220
|
issues.push(
|
|
216
221
|
`${capability.id} has undeclared current surface: ${surface}`,
|
|
217
222
|
);
|
|
@@ -5,7 +5,7 @@ const flag = (name, fallback = "") => process.argv.includes(`--${name}`) ? Strin
|
|
|
5
5
|
try {
|
|
6
6
|
const repository = flag("repository");
|
|
7
7
|
const workflowRepository = flag("workflow-repository", repository);
|
|
8
|
-
const workflowPath = flag("workflow", ".github/workflows
|
|
8
|
+
const workflowPath = flag("workflow", ".github/workflows/.release-candidate-promote.yml");
|
|
9
9
|
const workflowRef = flag("workflow-ref");
|
|
10
10
|
const publisherWorkflowPath = flag("publisher-workflow", workflowPath);
|
|
11
11
|
const requiredStatusCheck = flag("required-status-check", "check");
|
|
@@ -5,7 +5,7 @@ import { recordBuildchainControlPlaneOutcome } from "../../observability/logging
|
|
|
5
5
|
import { pathToFileURL } from "node:url";
|
|
6
6
|
import { writeGitHubOutputs } from "../../providers/commands/github-output.mjs";
|
|
7
7
|
|
|
8
|
-
const DEFAULT_BUILD_WORKFLOW_FILE = "build.yml";
|
|
8
|
+
const DEFAULT_BUILD_WORKFLOW_FILE = ".build-candidate.yml";
|
|
9
9
|
const DEFAULT_BUILD_WORKFLOW_NAME = "Build";
|
|
10
10
|
|
|
11
11
|
class GitHubApiError extends Error {
|
|
@@ -120,9 +120,9 @@ const PROTECTED_AUTHORITY_PATHS = Object.freeze([
|
|
|
120
120
|
".github/workflows/self-ops-promotion-recovery.yml",
|
|
121
121
|
".github/workflows/self-release-promote.yml",
|
|
122
122
|
".github/workflows/self-ops-governance-audit.yml",
|
|
123
|
-
".github/workflows
|
|
123
|
+
".github/workflows/.release-paper.yml",
|
|
124
124
|
".github/workflows/self-release-line-open.yml",
|
|
125
|
-
".github/workflows
|
|
125
|
+
".github/workflows/.release-candidate-promote.yml",
|
|
126
126
|
"actions/release/promotion/ref/action.yml",
|
|
127
127
|
"actions/release/promotion/ref/dist/index.js",
|
|
128
128
|
"actions/release/promotion/ref/index.js",
|
|
@@ -223,7 +223,7 @@ export function collectPublicationControlPlane(
|
|
|
223
223
|
{
|
|
224
224
|
repository,
|
|
225
225
|
workflowRepository = repository,
|
|
226
|
-
workflowPath = ".github/workflows
|
|
226
|
+
workflowPath = ".github/workflows/.release-candidate-promote.yml",
|
|
227
227
|
workflowRef = "",
|
|
228
228
|
publisherWorkflowPath = workflowPath,
|
|
229
229
|
requiredStatusCheck = "check",
|
package/packages/core/index.js
CHANGED
|
@@ -652,12 +652,10 @@ export {
|
|
|
652
652
|
verifyPublicationSealedBundle,
|
|
653
653
|
} from "./publication/publication-sealed-bundle.js";
|
|
654
654
|
|
|
655
|
-
export {
|
|
655
|
+
export { PAPER_MIGRATION_CONTRACT, PAPER_NPM_BOOTSTRAP_CONTRACT, PAPER_PREFLIGHT_CONTRACT, PAPER_SCAFFOLD_CONTRACT, PAPER_STATE_ORDER, PAPER_STATUS_CONTRACT, PAPER_VISIBILITY_CONTRACT } from "./paper/operations/identity.js";
|
|
656
656
|
export { PAPER_PATHS, resolvePaperRepository } from "./paper/paper-repository.js";
|
|
657
657
|
export { collectPaperPreflight } from "./paper/paper.js";
|
|
658
658
|
export { collectPaperStatus } from "./paper/operations/status.js";
|
|
659
|
-
export { createPaperAlphaPlan, createPaperBuildPlan, createPaperResumePlan } from "./paper/operations/plans.js";
|
|
660
|
-
export { executePaperNpmBootstrap } from "./paper/operations/bootstrap.js";
|
|
661
659
|
export { planPaperMigration, planPaperScaffold, writePaperMigration, writePaperScaffold } from "./paper/operations/scaffold.js"; export * from "./paper/paper-work.js"; export * from "./paper/paper-fleet.js";
|
|
662
660
|
|
|
663
661
|
export {
|
|
@@ -1,16 +1,11 @@
|
|
|
1
1
|
import {
|
|
2
2
|
createBuildchainLogger,
|
|
3
3
|
defaultBuildchainLogPath,
|
|
4
|
-
summarizeBuildchainLogEvents,
|
|
5
4
|
} from "../logging.js";
|
|
6
5
|
import {
|
|
7
|
-
printJson,
|
|
8
6
|
readBooleanFlag,
|
|
9
7
|
readFlag,
|
|
10
|
-
readJsonInput,
|
|
11
8
|
readRepeatedFlag,
|
|
12
|
-
readRepeatedJsonInputs,
|
|
13
|
-
writeJsonFile,
|
|
14
9
|
} from "../../contracts/cli/options.mjs";
|
|
15
10
|
|
|
16
11
|
export function readAttributes(args) {
|
|
@@ -1,18 +1,11 @@
|
|
|
1
1
|
import {
|
|
2
|
-
BUILDCHAIN_PROCESS_SAMPLE_REPORT_CONTRACT,
|
|
3
2
|
formatDiagnosticsSummaryTable,
|
|
4
|
-
startProcessSampler,
|
|
5
3
|
summarizeDiagnosticsArtifacts,
|
|
6
|
-
summarizeProcessSamples,
|
|
7
|
-
validateAnchoredPackageRelease,
|
|
8
4
|
} from "../diagnostics.js";
|
|
9
5
|
import {
|
|
10
6
|
printJson,
|
|
11
7
|
readBooleanFlag,
|
|
12
8
|
readFlag,
|
|
13
|
-
readJsonInput,
|
|
14
|
-
readRepeatedFlag,
|
|
15
|
-
readRepeatedJsonInputs,
|
|
16
9
|
writeJsonFile,
|
|
17
10
|
} from "../../contracts/cli/options.mjs";
|
|
18
11
|
function readDiagnosticsArtifactInputs(args) {
|
|
@@ -1,18 +1,10 @@
|
|
|
1
|
-
import {
|
|
1
|
+
import { spawnSync } from "node:child_process";
|
|
2
2
|
import crypto from "node:crypto";
|
|
3
|
-
import {
|
|
4
|
-
createBuildchainLogger,
|
|
5
|
-
defaultBuildchainLogPath,
|
|
6
|
-
summarizeBuildchainLogEvents,
|
|
7
|
-
} from "../logging.js";
|
|
3
|
+
import { summarizeBuildchainLogEvents } from "../logging.js";
|
|
8
4
|
import {
|
|
9
5
|
printJson,
|
|
10
6
|
readBooleanFlag,
|
|
11
7
|
readFlag,
|
|
12
|
-
readJsonInput,
|
|
13
|
-
readRepeatedFlag,
|
|
14
|
-
readRepeatedJsonInputs,
|
|
15
|
-
writeJsonFile,
|
|
16
8
|
} from "../../contracts/cli/options.mjs";
|
|
17
9
|
import { cliLogger, defaultCliLogPath, readAttributes } from "./context.mjs";
|
|
18
10
|
|
|
@@ -376,7 +376,7 @@ function runScaffold(options) {
|
|
|
376
376
|
buildchainRef: readFlag(
|
|
377
377
|
options.args,
|
|
378
378
|
"buildchain-ref",
|
|
379
|
-
|
|
379
|
+
"v4",
|
|
380
380
|
),
|
|
381
381
|
buildchainSha: options.buildchainSha,
|
|
382
382
|
name: readFlag(options.args, "name", path.basename(options.cwd)),
|