@kungfu-tech/buildchain 4.1.6 → 4.1.7

package/packages/core/build/artifact/upload.js

@@ -57,7 +57,7 @@ export async function transferBuild(context, platform) {
         sourceSha: plan.source.sha,
         platformId: platform.id,
         platformName: platform.name,
-        groups: [{ role: "payload", artifactName: names.payload, paths }],
+        groups: [{ role: "payload", artifactName: names.transfer, paths }],
       });
       artifacts.push({
         role: "relay",
@@ -71,7 +71,7 @@ export async function transferBuild(context, platform) {
     } else
       artifacts.push({
         role: "payload",
-        ref: await upload(plan, names.payload, paths, sourceRoot),
+        ref: await upload(plan, names.transfer, paths, sourceRoot),
       });
     const requestRoot = path.join(
       sourceRoot,

package/packages/core/build/plan/action.js

@@ -23,6 +23,8 @@ export async function resolveBuildPlanAction(core, env) {
       runtimeRoot,
       runtime: JSON.parse(env.BUILDCHAIN_RUNTIME_SELECTION),
       configPath: core.getInput("config-path"),
+      compatibilityInputs: core.getInput("compatibility-inputs"),
+      compatibilityEnvironment: Object.fromEntries(Object.entries(env).filter(([key]) => key.startsWith("BUILDCHAIN_HISTORICAL_"))),
       workflow: {
         ref: core.getInput("workflow-ref", { required: true }),
         sha: workflowSha,

package/packages/core/build/plan/admission.js

@@ -1,5 +1,7 @@
+import { runtimeContractLockDrift } from "../../contracts/runtime-contract-inspection.js";
 import fs from "node:fs";
 import path from "node:path";
+import { containedBuildPath } from "../build-configuration.js";
 import { scanConsumerPolicy } from "../../consumer/policy-scan.js";
 import { validatePackageManagerContract } from "../package-manager.js";
 
@@ -16,11 +18,15 @@ export async function admitBuildSource({ plan, sourceRoot, runtimeRoot, workflow
     expectedInvocationChannel: plan.identity.channel,
     resolvedWorkflowSha: plan.entry.sha,
     resolvedRuntimeSha: plan.identity.sha,
-    stableLockPath: ".buildchain/contract-lock.json",
-    alphaLockPath: ".buildchain/alpha-contract-lock.json",
+    stableLockPath: plan.contract.stable_lock_path || ".buildchain/contract-lock.json",
+    alphaLockPath: plan.contract.alpha_lock_path || ".buildchain/alpha-contract-lock.json",
   });
   if (!policy.ok) throw new Error("Build source rejected by floating consumer policy");
   validatePackageManagerContract({ cwd: sourceRoot, expectedManager: "" });
   const contract = JSON.parse(fs.readFileSync(path.join(runtimeRoot, "dist/site/buildchain-contract.json"), "utf8"));
-  return { policy: policy.receipt, policy_root: policy.receiptRoot, contract_digest: contract.contractDigest, lock_status: plan.runtime?.origin || "contract-lock" };
+  const lock = JSON.parse(fs.readFileSync(containedBuildPath(sourceRoot, plan.contract.lock_path), "utf8"));
+  const lockDrift = runtimeContractLockDrift(lock, plan.identity.sha, contract.contractDigest);
+  return { policy: policy.receipt, policy_root: policy.receiptRoot, contract_digest: contract.contractDigest,
+    lock_status: plan.runtime?.origin || "contract-lock", lock_drift: lockDrift };
+
 }

package/packages/core/build/plan/compatibility-artifacts.js

@@ -0,0 +1,47 @@
+import { containedBuildPath } from "../build-configuration.js";
+import path from "node:path";
+
+export function historicalBuildArtifacts(plan, inputs, root) {
+  const remaining = { ...inputs };
+  const fields = {
+    "artifact-name": "name",
+    "artifact-name-template": "name_template",
+    "expected-artifacts-json": "expected_json",
+  };
+  for (const [input, field] of Object.entries(fields)) {
+    if (!Object.hasOwn(remaining, input)) continue;
+    plan.artifacts[field] = remaining[input];
+    delete remaining[input];
+  }
+  plan.build.artifacts.name = plan.artifacts.name;
+  if (Object.hasOwn(remaining, "artifact-paths")) {
+    const paths = remaining["artifact-paths"]
+      .split(/\r?\n/u)
+      .map((item) => item.trim())
+      .filter(Boolean);
+    plan.build.artifacts.paths = paths;
+    plan.artifacts.paths = paths
+      .map((item) => {
+        const relative = path.posix.join(plan.project.cwd, item);
+        containedBuildPath(root, relative);
+        return relative;
+      })
+      .join("\n");
+    delete remaining["artifact-paths"];
+  }
+  const expected = JSON.parse(plan.artifacts.expected_json);
+  if (!expected || typeof expected !== "object" || Array.isArray(expected))
+    throw new Error("expected-artifacts-json must describe artifact checks");
+  for (const field of ["minFiles", "maxFiles", "minTotalBytes"])
+    if (
+      expected[field] !== undefined &&
+      (!Number.isSafeInteger(expected[field]) || expected[field] < 0)
+    )
+      throw new Error(`Invalid artifact check: ${field}`);
+  if (expected.requiredPaths !== undefined) {
+    if (!Array.isArray(expected.requiredPaths))
+      throw new Error("requiredPaths must be an array");
+    for (const item of expected.requiredPaths) containedBuildPath(root, item);
+  }
+  return remaining;
+}

package/packages/core/build/plan/compatibility-plan.js

@@ -0,0 +1,121 @@
+import fs from "node:fs";
+import { resolvePublishGate } from "../../release/promotion/publish-gate.js";
+import path from "node:path";
+import { historicalEntrySelection } from "../../runtime/entry/compatibility.js";
+import {
+  containedBuildPath,
+  normalizeBuildConfiguration,
+} from "../build-configuration.js";
+import { applyHistoricalBuildInputs } from "./compatibility.js";
+import { historicalBuildArtifacts } from "./compatibility-artifacts.js";
+import { rootOf } from "./values.js";
+
+export function historicalBuildLocator(root, locator, inputs) {
+  const directory = inputs["working-directory"];
+  if (!directory || directory === ".") return locator;
+  containedBuildPath(root, directory);
+  if (locator)
+    throw new Error(
+      "config-path cannot be combined with a historical working-directory",
+    );
+  const candidates = [".buildchain/buildchain.toml", "buildchain.toml"].map(
+    (item) => path.posix.join(directory, item),
+  );
+  const present = candidates.filter((item) =>
+    fs.existsSync(containedBuildPath(root, item)),
+  );
+  if (present.length !== 1)
+    throw new Error(
+      "Historical working-directory must contain one buildchain.toml",
+    );
+  return present[0];
+}
+
+function applySelectors(plan, remaining) {
+  const selection = historicalEntrySelection(
+    remaining,
+    `${plan.identity.repository}/${plan.identity.visible_workflow}@${plan.identity.ref}`,
+  );
+  plan.contract.lock_path = selection.lockPath;
+  plan.contract.stable_lock_path = selection.stableLock;
+  plan.contract.alpha_lock_path = selection.alphaLock;
+  for (const [input, expected] of [
+    ["buildchain-expected-channel", plan.identity.channel],
+    ["buildchain-expected-major", plan.identity.major],
+  ])
+    if (remaining[input] && remaining[input] !== expected)
+      throw new Error(`Historical ${input} does not match the called entry`);
+  for (const input of [
+    "buildchain-channel",
+    "buildchain-ref",
+    "buildchain-repository",
+    "buildchain-contract-lock-path",
+    "buildchain-stable-contract-lock-path",
+    "buildchain-alpha-contract-lock-path",
+    "buildchain-expected-channel",
+    "buildchain-expected-major",
+    "working-directory",
+  ])
+    delete remaining[input];
+}
+
+export function finishHistoricalBuildPlan(plan, inputs, root) {
+  if (!Object.keys(inputs).length) return;
+  const remaining = historicalBuildArtifacts(
+    plan,
+    applyHistoricalBuildInputs(plan, inputs),
+    root,
+  );
+  applySelectors(plan, remaining);
+  if (Object.hasOwn(remaining, "publish-channel")) {
+    const channel = remaining["publish-channel"];
+    plan.source.candidate_channel = channel === "major" ? "release"
+      : ["alpha", "release"].includes(channel) ? channel : "none";
+    delete remaining["publish-channel"];
+  }
+  delete remaining["publish-refs-json"];
+  if (remaining["artifact-relay-s3-role-arn"]) {
+    for (const kind of ["upload", "download"])
+      plan.environment.transfer[`${kind}_role_arn`] ||=
+        remaining["artifact-relay-s3-role-arn"];
+    delete remaining["artifact-relay-s3-role-arn"];
+  }
+  for (const [input, field] of [
+    ["gate-profile-aggregate-json", "gate_profile_json"],
+    ["release-candidate-family-evidence-json", "candidate_family_json"],
+  ]) {
+    if (!Object.hasOwn(remaining, input)) continue;
+    JSON.parse(remaining[input]);
+    plan.evidence[field] = remaining[input];
+    delete remaining[input];
+  }
+  if (Object.keys(remaining).length)
+    throw new Error(
+      `Unmapped historical build inputs: ${Object.keys(remaining).join(", ")}`,
+    );
+  plan.build = normalizeBuildConfiguration(plan.build);
+  plan.configuration_root = rootOf({ toml: plan.configuration_root, inputs });
+  plan.environment_root = rootOf(plan.environment);
+  plan.cache.toolchain_root = rootOf({
+    tools: plan.build.tools,
+    environment: plan.environment.tools,
+  });
+  plan.cache.policy_root = rootOf(plan.environment.cache);
+}
+
+export function historicalPublishGate(plan, inputs, eventName) {
+  if (plan.identity.visible_workflow !== ".github/workflows/build.yml") return;
+  const resolved = resolvePublishGate({
+    trusted: true,
+    publishChannel: inputs["publish-channel"] || "none",
+    publishRefsJson: inputs["publish-refs-json"] || "",
+    eventName,
+    ref: plan.source.ref,
+  });
+  plan.historical_publish_gate = {
+    trustedEvent: resolved.trusted,
+    channel: resolved.publishChannel,
+    allowed: resolved.publishAllowed,
+    reason: resolved.publishReason,
+  };
+}

package/packages/core/build/plan/compatibility.js

@@ -0,0 +1,162 @@
+import fs from "node:fs";
+import path from "node:path";
+import { installationRoot } from "../../runtime/installation-root.js";
+
+const contract = JSON.parse(
+  fs.readFileSync(
+    path.join(
+      installationRoot(import.meta.url),
+      "contracts/fixtures/consumer-upgrade/build-v4.0.0.json",
+    ),
+    "utf8",
+  ),
+);
+const bindings =
+  JSON.parse(
+    fs.readFileSync(
+      path.join(
+        installationRoot(import.meta.url),
+        "architecture/consumer-upgrade.json",
+      ),
+      "utf8",
+    ),
+  ).entries.find((entry) => entry.adapter === "build-backbone")
+    ?.inputVariables || {};
+
+// The old workflow boundary is typed before values enter the current planner.
+// Empty modern calls preserve the TOML plan; historical defaults do not replace
+// explicit TOML choices when GitHub expands all optional workflow inputs.
+export function historicalBuildInputs(value = {}, environment = {}) {
+  if (typeof value === "string") value = JSON.parse(value || "{}");
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    throw new Error("Historical build inputs must be an object");
+  const current = new Set([
+    "config-path",
+    "runtime-ref",
+    "contract-lock",
+    "resume-run-id",
+    "runtime-selection",
+  ]);
+  const result = {};
+  for (const [key, input] of Object.entries(value)) {
+    if (current.has(key)) continue;
+    const field = contract.inputs[key];
+    if (
+      !field ||
+      typeof input !== field.type ||
+      (typeof input === "number" && !Number.isFinite(input))
+    )
+      throw new Error(`Invalid historical build input: ${key}`);
+    if (input !== field.default) result[key] = input;
+  }
+  if (Object.keys(value).some((key) => Object.hasOwn(contract.inputs, key)))
+    for (const key of Object.keys(bindings)) {
+      const selected =
+        environment[
+          `BUILDCHAIN_HISTORICAL_${key.replaceAll("-", "_").toUpperCase()}`
+        ];
+      if (selected && !value[key]) result[key] = String(selected);
+    }
+  return result;
+}
+
+const paths = {
+  "runner-preset": "environment.runners.preset",
+  "platforms-json": "environment.runners.platforms_json",
+  "control-runner-json": "environment.runners.control_json",
+  "aws-codebuild-project": "environment.runners.codebuild_project",
+  "aws-ec2-windows-runner-label": "environment.runners.windows_label",
+  "aws-ec2-macos-runner-label": "environment.runners.macos_label",
+  "self-hosted-offline-fallback": "environment.runners.offline_fallback",
+  "linux-container-preset": "environment.runners.container_preset",
+  "linux-container-image": "environment.runners.container_image",
+  "rustup-dist-server": "environment.tools.rustup_dist_server",
+  "rustup-update-root": "environment.tools.rustup_update_root",
+  "cargo-registry-index": "environment.tools.cargo_registry_index",
+  "checkout-cache-mode": "environment.checkout.mode",
+  "checkout-cache-mirror-url-template":
+    "environment.checkout.mirror_url_template",
+  "checkout-cache-reference-repository-template":
+    "environment.checkout.reference_repository_template",
+  "checkout-cache-fallback": "environment.checkout.fallback",
+  "checkout-cache-timeout-seconds": "environment.checkout.timeout_seconds",
+  "checkout-cache-github-timeout-seconds":
+    "environment.checkout.github_timeout_seconds",
+  "checkout-cache-fetch-attempts": "environment.checkout.fetch_attempts",
+  "checkout-history-mode": "environment.checkout.history_mode",
+  "artifact-transfer-mode": "environment.transfer.mode",
+  "artifact-relay-s3-bucket": "environment.transfer.bucket",
+  "artifact-relay-s3-region": "environment.transfer.region",
+  "artifact-relay-s3-prefix": "environment.transfer.prefix",
+  "artifact-relay-s3-upload-role-arn": "environment.transfer.upload_role_arn",
+  "artifact-relay-s3-download-role-arn":
+    "environment.transfer.download_role_arn",
+  "artifact-relay-s3-oidc-audience": "environment.transfer.oidc_audience",
+  "shifu-cache-profile-ref": "environment.cache.profile_ref",
+  "shifu-cache-profile-digest": "environment.cache.profile_digest",
+  "compiler-cache-provider": "environment.cache.provider",
+  "compiler-cache-platforms-json": "environment.cache.platforms_json",
+  "compiler-cache-required": "environment.cache.required",
+  "artifact-signing-request-upload-no-proxy":
+    "environment.signing.upload_no_proxy",
+  "credential-island-environment": "environment.signing.environment",
+  "fail-fast": "build.fail_fast",
+  "lifecycle-timeout-minutes": "build.timeout_minutes",
+  "artifact-retention-days": "build.artifacts.retention_days",
+  "artifact-compression-level": "build.artifacts.compression_level",
+  "release-candidate": "build.artifacts.release_candidate",
+  "artifact-finalization-command": "build.finalization.command",
+  "artifact-finalization-on-platform": "build.finalization.on_platform",
+  "verify-substage-evidence-path": "build.verification.substage_evidence_path",
+  "pre-upload-transport-smoke-scenario-path":
+    "build.transport_smoke.scenario_path",
+  "pre-upload-transport-smoke-artifact-root":
+    "build.transport_smoke.artifact_root",
+  "credential-island-macos-app-path": "build.macos_signing.app_path",
+  "credential-island-macos-platform-id": "build.macos_signing.platform",
+  "github-artifact-attestation-subject-path": "build.attestation.subject_path",
+  "github-artifact-attestation-platform-id": "build.attestation.platform",
+  "sample-process-tree": "build.diagnostics.sample_process_tree",
+  "process-sample-interval-ms": "build.diagnostics.sample_interval_ms",
+  "requested-parallelism": "build.diagnostics.requested_parallelism",
+  "buildchain-contract-compatibility-policy":
+    "build.contract.compatibility_policy",
+  "buildchain-contract-drift-issue-mode": "build.contract.drift_issue_mode",
+};
+
+export function applyHistoricalBuildInputs(plan, inputs) {
+  const remaining = { ...inputs };
+  for (const [input, field] of Object.entries(paths)) {
+    if (!Object.hasOwn(remaining, input)) continue;
+    const names = field.split(".");
+    const key = names.pop();
+    const target = names.reduce((value, name) => value[name], plan);
+    target[key] = remaining[input];
+    delete remaining[input];
+  }
+  for (const stage of ["install", "build", "verify"]) {
+    if (Object.hasOwn(remaining, `${stage}-command`)) {
+      plan.lifecycle[stage].command = remaining[`${stage}-command`];
+      plan.lifecycle[stage].configured = Boolean(remaining[`${stage}-command`]);
+      delete remaining[`${stage}-command`];
+    }
+    if (Object.hasOwn(remaining, `require-${stage}`)) {
+      plan.lifecycle[stage].required = remaining[`require-${stage}`];
+      delete remaining[`require-${stage}`];
+    }
+  }
+  for (const [input, tool] of [
+    ["node-version", "node"],
+    ["rust-toolchain", "rust"],
+  ]) {
+    if (Object.hasOwn(remaining, input)) {
+      plan.tools[tool] = plan.build.tools[tool] = remaining[input];
+      delete remaining[input];
+    }
+    if (Object.hasOwn(remaining, `setup-${tool}`)) {
+      plan.tools[`setup_${tool}`] = remaining[`setup-${tool}`];
+      delete remaining[`setup-${tool}`];
+    }
+  }
+  return remaining;
+}

package/packages/core/build/plan/configuration.js

@@ -1,8 +1,11 @@
+import { resolveBuildIdentity } from "./identity.js";
 import { installationRoot } from "../../runtime/installation-root.js";
 import crypto from "node:crypto";
 import fs from "node:fs";
 import path from "node:path";
 import { loadBuildchainConfig } from "../../consumer/buildchain-config.js";
+import { historicalBuildInputs } from "./compatibility.js";
+import { historicalBuildLocator, finishHistoricalBuildPlan, historicalPublishGate } from "./compatibility-plan.js";
 import {
   containedBuildPath,
   discoverBuildConfiguration,
@@ -25,6 +28,8 @@ export function resolveBuildConfiguration({
   callerWorkflowRef = "",
   eventName = "",
   baseRef = "",
+  compatibilityInputs = {},
+  compatibilityEnvironment = {},
   environmentRegistry = JSON.parse(
     fs.readFileSync(
       path.join(runtimeRoot, "architecture/build-environments.json"),
@@ -36,43 +41,9 @@ export function resolveBuildConfiguration({
     if (!/^[a-f0-9]{40}$/u.test(value || ""))
       throw new Error(`${label} must be an exact SHA`);
   }
-  const match = String(workflowRef).match(
-    /^([^/]+\/[^/]+)\/(\.github\/workflows\/[^@]+)@(?:refs\/(?:heads|tags)\/)?(v([1-9]\d*)(-alpha)?)$/u,
-  );
-  if (!match || match[1] !== repository)
-    throw new Error(
-      "Ordinary builds require the exact called workflow identity on a floating channel",
-    );
-  const identity = {
-    repository,
-    ref: match[3],
-    full_ref: `refs/tags/${match[3]}`,
-    sha: workflowSha,
-    channel: match[5] ? "alpha" : "stable",
-    major: match[4],
-    visible_workflow: match[2],
-  };
-  const callerPath = callerWorkflowRef
-    .split("@")[0]
-    .split("/.github/workflows/")[1];
-  if (callerPath) {
-    const caller = fs.readFileSync(
-      containedBuildPath(root, `.github/workflows/${callerPath}`),
-      "utf8",
-    );
-    const calls = [
-      ...caller.matchAll(
-        /uses:\s+kungfu-systems\/buildchain\/(\.github\/workflows\/(?:build|\.build)\.yml)@(v\d+(?:-alpha)?)\s*$/gmu,
-      ),
-    ].filter((call) => call[2] === identity.ref);
-    const paths = [...new Set(calls.map((call) => call[1]))];
-    if (paths.length !== 1)
-      throw new Error(
-        "Unable to derive one visible build workflow from the exact caller",
-      );
-    identity.visible_workflow = paths[0];
-  }
-  const project = discoverBuildConfiguration(root, locator);
+  const identity = resolveBuildIdentity({ root, workflowRef, workflowSha, repository, callerWorkflowRef });
+  const historical = historicalBuildInputs(compatibilityInputs, compatibilityEnvironment);
+  const project = discoverBuildConfiguration(root, historicalBuildLocator(root, locator, historical));
   const loaded = loadBuildchainConfig(path.resolve(root, project.cwd));
   const build = normalizeBuildConfiguration(loaded.config.build);
   if (
@@ -188,6 +159,8 @@ export function resolveBuildConfiguration({
           : ".buildchain/contract-lock.json",
     },
   };
+  historicalPublishGate(plan, historical, eventName);
+  finishHistoricalBuildPlan(plan, historical, root);
   for (const [stage, status] of Object.entries(plan.lifecycle)) {
     if (status.required && !status.configured)
       throw new Error(`buildchain.toml must declare lifecycle.${stage}`);

package/packages/core/build/plan/identity.js

@@ -1,3 +1,5 @@
+import fs from "node:fs";
+import { containedBuildPath } from "../build-configuration.js";
 import { rootOf } from "./values.js";
 export function assertPlan(plan) {
   const { root, ...body } = plan;
@@ -43,3 +45,43 @@ export function bindBuildPlan({
   if (!workspace) throw new Error("Build workspace is required");
   return { plan, platform, workspace };
 }
+
+export function resolveBuildIdentity({ root, workflowRef, workflowSha, repository, callerWorkflowRef }) {
+  const match = String(workflowRef).match(
+    /^([^/]+\/[^/]+)\/(\.github\/workflows\/[^@]+)@(?:refs\/(?:heads|tags)\/)?(v([1-9]\d*)(-alpha)?)$/u,
+  );
+  if (!match || match[1] !== repository)
+    throw new Error(
+      "Ordinary builds require the exact called workflow identity on a floating channel",
+    );
+  const identity = {
+    repository,
+    ref: match[3],
+    full_ref: `refs/tags/${match[3]}`,
+    sha: workflowSha,
+    channel: match[5] ? "alpha" : "stable",
+    major: match[4],
+    visible_workflow: match[2],
+  };
+  const callerPath = callerWorkflowRef
+    .split("@")[0]
+    .split("/.github/workflows/")[1];
+  if (callerPath) {
+    const caller = fs.readFileSync(
+      containedBuildPath(root, `.github/workflows/${callerPath}`),
+      "utf8",
+    );
+    const calls = [
+      ...caller.matchAll(
+        /uses:\s+kungfu-systems\/buildchain\/(\.github\/workflows\/(?:build|\.build)\.yml)@(v\d+(?:-alpha)?)\s*$/gmu,
+      ),
+    ].filter((call) => call[2] === identity.ref);
+    const paths = [...new Set(calls.map((call) => call[1]))];
+    if (paths.length !== 1)
+      throw new Error(
+        "Unable to derive one visible build workflow from the exact caller",
+      );
+    identity.visible_workflow = paths[0];
+  }
+  return identity;
+}

package/packages/core/build/plan/lifecycle.js

@@ -9,6 +9,7 @@ export function lifecycleOptions(plan, platform, stage, root) {
     cwd: path.join(root, plan.project.cwd),
     workspace: root,
     stageName: stage,
+    command: plan.lifecycle[stage]?.command || "",
     required: plan.lifecycle[stage]?.required || false,
     timeoutMinutes: plan.build.timeout_minutes,
     artifactName: names.payload,

package/packages/core/build/plan/resolve.js

@@ -34,6 +34,8 @@ export async function resolveBuildPlan(request, providers) {
     callerWorkflowRef: workflow.callerRef,
     eventName: event.name,
     baseRef: source.baseRef,
+    compatibilityInputs: request.compatibilityInputs,
+    compatibilityEnvironment: request.compatibilityEnvironment,
   });
   const git = (...args) =>
     execFileSync("git", ["-C", sourceRoot, ...args], {

package/packages/core/build/summary/aggregation.js

@@ -58,7 +58,7 @@ export async function aggregate(context, plan, jobs, executions) {
       runId: plan.run.id,
       runAttempt: plan.run.attempt,
     },
-    publishGate: {
+    publishGate: plan.historical_publish_gate || {
       trustedEvent: true,
       channel: "none",
       allowed: false,
@@ -94,7 +94,9 @@ export async function aggregate(context, plan, jobs, executions) {
     artifacts: await readProviderArtifacts(plan.run),
     platforms: plan.platforms,
     artifactName: plan.artifacts.name,
-    artifactNameTemplate: "{artifact}-final-{platform}-{sha}",
+    artifactNameTemplate: plan.identity.visible_workflow === ".github/workflows/build.yml"
+      ? plan.artifacts.name_template || "{artifact}-{platform}-{sha}"
+      : "{artifact}-final-{platform}-{sha}",
     sourceSha: plan.source.sha,
     sourceRef: plan.source.ref,
     repository: plan.run.repository,

package/packages/core/build/summary/compatibility.js

@@ -0,0 +1,24 @@
+import { rootOf } from "../plan/values.js";
+
+export function qualifyHistoricalBuild(conclusion, value) {
+  if (conclusion !== "success")
+    throw new Error(`Build did not qualify: ${conclusion || "missing"}`);
+  const result = typeof value === "string" ? JSON.parse(value) : value;
+  if (!result || typeof result !== "object" || Array.isArray(result))
+    throw new Error("Missing rooted build result");
+  const { root, ...body } = result;
+  if (
+    result.schema !== "buildchain.build-result/v1" ||
+    result.status !== "success" ||
+    root !== rootOf(body)
+  )
+    throw new Error("Build result failed its contract or content root");
+  return result;
+}
+
+export function qualifyHistoricalBuildAction(core) {
+  qualifyHistoricalBuild(
+    core.getInput("conclusion", { required: true }),
+    core.getInput("result", { required: true }),
+  );
+}

package/packages/core/build/summary/finalization.js

@@ -1,3 +1,4 @@
+import { historicalBuildOutputs } from "./historical-outputs.js";
 import { aggregate } from "./aggregation.js";
 import { controllerReceipt } from "./controller-receipt.js";
 import path from "node:path";
@@ -97,6 +98,22 @@ async function finalizeBuild(context, jobs) {
     ["diagnostics-summary.json"],
     file(".buildchain/artifacts"),
   );
+  let historicalOutputs;
+  if (plan.identity.visible_workflow === ".github/workflows/build.yml") {
+    artifacts.controller_plan = await upload(
+      plan,
+      `${plan.artifacts.name}-controller-plan-${plan.source.sha}`,
+      ["plan.json"],
+      file(".buildchain/controller"),
+    );
+    historicalOutputs = historicalBuildOutputs(
+      plan,
+      artifacts,
+      controller,
+      aggregated.summary,
+      file,
+    );
+  }
   const result = {
     schema: "buildchain.build-result/v1",
     status: "success",
@@ -104,6 +121,7 @@ async function finalizeBuild(context, jobs) {
     source: plan.source,
     runtime: plan.identity,
     artifacts,
+    ...(historicalOutputs ? { historical_outputs: historicalOutputs } : {}),
   };
   const rooted = { ...result, root: rootOf(result) };
   await publishRecord(