{ "schemaVersion": 1, "contract": "kungfu-buildchain-workflow-registry", "workflowSource": ".github/workflows reverse input enumeration", "workflows": [ { "id": ".auditable-demo", "path": ".github/workflows/.auditable-demo.yml", "reusable": true, "inputs": [ "adapter-arguments-json", "adapter-path", "artifact-retention-days", "buildchain-repository", "media-profile", "render-media", "renderer-image", "require-trusted-event", "source-artifact-digest", "source-artifact-name", "source-ref" ], "inputCount": 11, "secrets": [], "secretCount": 0, "outputs": [ "gate-artifact-digest", "gate-artifact-id", "gate-artifact-name", "gate-artifact-url", "gate-root", "media-artifact-digest", "media-artifact-id", "media-artifact-name", "media-artifact-url", "media-profile", "media-qualification-root", "media-root", "source-sha" ], "outputCount": 13, "surface": "auditable-demo", "capabilityGroup": "api-cli-reference", "status": "preview", "owner": "buildchain-workflows", "maturity": "preview", "introducedVersion": "pre-3.0.2-alpha.4", "compatibilityPromise": "preserved-through-the-v3-major-line", "deprecationReplacement": "", "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line", "nonDuplicationRationale": "Existing workflow identity retained for caller compatibility and repository orchestration." }, { "id": ".binary-release-assets", "path": ".github/workflows/.binary-release-assets.yml", "reusable": true, "inputs": [ "auto-admission", "buildchain-ref", "buildchain-repository", "evidence-run-id", "github-governance-receipt-json", "publication-admission-json", "publication-control-plane-audit-json", "publication-expected-json", "publication-gate-aggregate-json", "publication-runner-provenance-json", "publication-used-nonces-json", "publication-version", "release-tag", "source-sha", "target-ref" ], "inputCount": 15, "secrets": [], "secretCount": 0, "outputs": [], "outputCount": 0, "surface": "reusable-workflow", "capabilityGroup": "api-cli-reference", "status": "active", "owner": "buildchain-workflows", "maturity": "active", "introducedVersion": "pre-3.0.2-alpha.4", "compatibilityPromise": "preserved-through-the-v3-major-line", "deprecationReplacement": "", "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line", "nonDuplicationRationale": "Existing workflow identity retained for caller compatibility and repository orchestration." }, { "id": ".build", "path": ".github/workflows/.build.yml", "reusable": true, "inputs": [ "artifact-compression-level", "artifact-finalization-command", "artifact-finalization-on-platform", "artifact-name", "artifact-name-template", "artifact-paths", "artifact-relay-s3-bucket", "artifact-relay-s3-download-role-arn", "artifact-relay-s3-oidc-audience", "artifact-relay-s3-prefix", "artifact-relay-s3-region", "artifact-relay-s3-role-arn", "artifact-relay-s3-upload-role-arn", "artifact-retention-days", "artifact-signing-request-upload-no-proxy", "artifact-transfer-mode", "aws-codebuild-project", "aws-ec2-macos-runner-label", "aws-ec2-windows-runner-label", "build-command", "buildchain-contract-compatibility-policy", "buildchain-contract-drift-issue-mode", "buildchain-contract-lock-path", "buildchain-expected-channel", "buildchain-expected-major", "buildchain-ref", "buildchain-repository", "cache-dependency-lock-root", "cache-policy-root", "cache-toolchain-root", "cargo-registry-index", "checkout-cache-fallback", "checkout-cache-fetch-attempts", "checkout-cache-github-timeout-seconds", "checkout-cache-mirror-url-template", "checkout-cache-mode", "checkout-cache-reference-repository-template", "checkout-cache-timeout-seconds", "checkout-history-mode", "compiler-cache-platforms-json", "compiler-cache-provider", "compiler-cache-required", "control-runner-json", "credential-island-caller-owned", "credential-island-environment", "credential-island-macos-app-path", "credential-island-macos-platform-id", "expected-artifacts-json", "fail-fast", "gate-profile-aggregate-json", "github-artifact-attestation-platform-id", "github-artifact-attestation-signer-sha", "github-artifact-attestation-subject-path", "install-command", "kfd-agent-hub", "lifecycle-timeout-minutes", "linux-container-image", "linux-container-preset", "node-version", "platforms-json", "pre-upload-transport-smoke-artifact-root", "pre-upload-transport-smoke-scenario-path", "process-sample-interval-ms", "process-summary-path", "publish-anchor-request-json", "publish-channel", "publish-refs-json", "publish-registry", "publish-source-ref", "release-candidate", "release-candidate-family-evidence-json", "requested-parallelism", "require-build", "require-install", "require-trusted-event", "require-verify", "runner-preset", "rust-toolchain", "rustup-dist-server", "rustup-update-root", "sample-process-tree", "self-hosted-offline-fallback", "setup-node", "setup-rust", "shifu-cache-profile-digest", "shifu-cache-profile-ref", "untrusted-policy", "verify-command", "verify-substage-evidence-path", "working-directory" ], "inputCount": 90, "secrets": [ "BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN", "BUILDCHAIN_ARTIFACT_RELAY_S3_ROLE_ARN", "BUILDCHAIN_ARTIFACT_RELAY_S3_UPLOAD_ROLE_ARN", "BUILDCHAIN_MACOS_CERTIFICATE_P12_BASE64", "BUILDCHAIN_MACOS_CERTIFICATE_PASSWORD", "BUILDCHAIN_MACOS_NOTARY_API_ISSUER", "BUILDCHAIN_MACOS_NOTARY_API_KEY_ID", "BUILDCHAIN_MACOS_NOTARY_API_KEY_P8_BASE64", "BUILDCHAIN_PROMOTION_TOKEN" ], "secretCount": 9, "outputs": [ "artifact-coordinates-json", "build-diagnostics-summary-artifact", "build-diagnostics-summary-json", "build-summary-artifact", "build-summary-json", "buildchain-contract-digest", "buildchain-contract-lock-drift", "buildchain-contract-lock-status", "buildchain-runtime-class", "buildchain-runtime-override", "buildchain-runtime-ref", "buildchain-runtime-sha", "buildchain-runtime-trust-decision", "controller-plan-artifact", "controller-plan-digest", "controller-plan-json", "controller-receipt-artifact", "controller-receipt-digest", "controller-receipt-json", "controller-receipt-status", "credential-island-macos-artifact", "credential-island-macos-manifest-artifact", "linux-container-enabled", "linux-container-image", "platform-count", "platforms-json", "publish-allowed", "publish-channel", "publish-reason", "publish-source-channel", "publish-source-consumer-version", "publish-source-line", "publish-source-locked", "publish-source-ref", "publish-source-sha", "publish-source-tree-sha", "release-candidate-artifact", "release-candidate-passport-artifact", "release-candidate-passport-json", "release-manifest-json", "runner-preset", "runner-routing-json", "trusted-event" ], "outputCount": 43, "surface": "reusable-build", "capabilityGroup": "api-cli-reference", "status": "active", "owner": "buildchain-workflows", "maturity": "active", "introducedVersion": "pre-3.0.2-alpha.4", "compatibilityPromise": "preserved-through-the-v3-major-line", "deprecationReplacement": "", "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line", "nonDuplicationRationale": "Existing workflow identity retained for caller compatibility and repository orchestration." }, { "id": ".bump-minor-version", "path": ".github/workflows/.bump-minor-version.yml", "reusable": true, "inputs": [], "inputCount": 0, "secrets": [ "GITHUB_PUSH_TOKEN" ], "secretCount": 1, "outputs": [], "outputCount": 0, "surface": "reusable-workflow", "capabilityGroup": "api-cli-reference", "status": "active", "owner": "buildchain-workflows", "maturity": "active", "introducedVersion": "pre-3.0.2-alpha.4", "compatibilityPromise": "preserved-through-the-v3-major-line", "deprecationReplacement": "", "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line", "nonDuplicationRationale": "Existing workflow identity retained for caller compatibility and repository orchestration." }, { "id": ".declarative-auditable-demo", "path": ".github/workflows/.declarative-auditable-demo.yml", "reusable": true, "inputs": [ "artifact-retention-days", "binary-artifact-digest", "binary-artifact-name", "buildchain-repository", "materialize", "materialize-base-ref", "media-profile", "render-failure-advisory", "render-media", "renderer-image", "scenario-path", "source-ref" ], "inputCount": 12, "secrets": [ "DEMO_UPDATE_TOKEN" ], "secretCount": 1, "outputs": [ "capture-artifact-digest", "capture-artifact-name", "evidence-artifact-digest", "evidence-artifact-name", "publication-pr-url", "render-result", "source-sha" ], "outputCount": 7, "surface": "declarative-auditable-demo", "capabilityGroup": "api-cli-reference", "status": "preview", "owner": "buildchain-workflows", "maturity": "preview", "introducedVersion": "pre-3.0.2-alpha.4", "compatibilityPromise": "preserved-through-the-v3-major-line", "deprecationReplacement": "", "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line", "nonDuplicationRationale": "Existing workflow identity retained for caller compatibility and repository orchestration." }, { "id": ".gate-profile", "path": ".github/workflows/.gate-profile.yml", "reusable": true, "inputs": [ "artifact-name", "artifact-retention-days", "buildchain-ref", "buildchain-repository", "cargo-registry-index", "checkout-cache-fallback", "checkout-cache-fetch-attempts", "checkout-cache-github-timeout-seconds", "checkout-cache-mirror-url-template", "checkout-cache-mode", "checkout-cache-reference-repository-template", "checkout-cache-timeout-seconds", "gate-command-json", "gate-environment-json", "gate-plan-command-json", "gate-profile", "gate-registry", "include-advisory", "node-version", "platforms-json", "require-trusted-event", "runner-preset", "rust-toolchain", "rustup-dist-server", "rustup-update-root", "shifu-cache-profile-digest", "shifu-cache-profile-ref", "source-ref", "untrusted-policy", "working-directory" ], "inputCount": 30, "secrets": [], "secretCount": 0, "outputs": [ "buildchain-runtime-sha", "controller-plan-artifact", "controller-plan-digest", "controller-plan-json", "controller-receipt-artifact", "controller-receipt-digest", "controller-receipt-json", "controller-receipt-status", "gate-aggregate-artifact", "gate-aggregate-digest", "gate-aggregate-json", "gate-aggregate-status", "gate-matrix-digest", "source-sha" ], "outputCount": 14, "surface": "reusable-workflow", "capabilityGroup": "api-cli-reference", "status": "active", "owner": "buildchain-workflows", "maturity": "active", "introducedVersion": "pre-3.0.2-alpha.4", "compatibilityPromise": "preserved-through-the-v3-major-line", "deprecationReplacement": "", "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line", "nonDuplicationRationale": "Existing workflow identity retained for caller compatibility and repository orchestration." }, { "id": ".publication-authority", "path": ".github/workflows/.publication-authority.yml", "reusable": true, "inputs": [ "admission-json", "authority-workflow-path", "auto-admission", "auto-admission-kind", "auto-no-gate", "buildchain-ref", "buildchain-repository", "consumer-gate-command", "consumer-gate-controller-sha", "consumer-gate-evidence-source-sha", "consumer-gate-evidence-source-tree", "consumer-predicate-digest", "consumer-predicate-id", "consumer-qualification-required", "control-plane-audit-json", "dry-run", "evidence-controller-artifact", "evidence-manifest-pattern", "evidence-passport-artifact", "evidence-payload-pattern", "evidence-publication-artifact", "evidence-repository", "evidence-run-id", "evidence-summary-artifact", "expected-json", "gate-aggregate-json", "github-governance-receipt-json", "package-name", "product", "publication-target", "publication-version", "publisher-workflow-path", "required-status-check", "runner-provenance-json", "source-sha", "target-ref", "used-nonces-json" ], "inputCount": 37, "secrets": [ "BUILDCHAIN_GOVERNANCE_READ_TOKEN", "KUNGFU_GOVERNANCE_AUDITOR_APP_PRIVATE_KEY" ], "secretCount": 2, "outputs": [ "capability-artifact", "capability-digest", "capability-json", "gate-aggregate-digest", "gate-aggregate-json" ], "outputCount": 5, "surface": "reusable-workflow", "capabilityGroup": "api-cli-reference", "status": "active", "owner": "buildchain-workflows", "maturity": "active", "introducedVersion": "pre-3.0.2-alpha.4", "compatibilityPromise": "preserved-through-the-v3-major-line", "deprecationReplacement": "", "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line", "nonDuplicationRationale": "Existing workflow identity retained for caller compatibility and repository orchestration." }, { "id": ".release-candidate-promote", "path": ".github/workflows/.release-candidate-promote.yml", "reusable": true, "inputs": [ "allow-repository", "artifact-name", "artifact-patterns", "branch-protection-bypass-apps", "branch-protection-bypass-teams", "branch-protection-bypass-users", "buildchain-contract-compatibility-policy", "buildchain-contract-drift-issue-mode", "buildchain-contract-lock-path", "buildchain-expected-channel", "buildchain-expected-major", "buildchain-ref", "buildchain-repository", "channel", "declarative-release-tail", "dry-run", "github-artifact-attestation-environment", "github-artifact-attestation-policy-json", "github-artifact-attestation-retention-days", "github-governance-receipt-json", "github-release", "github-release-notes", "github-release-payload-patterns", "github-release-title", "package-manager", "promotion-contract-lock-digest", "promotion-contract-lock-path", "promotion-override-used", "promotion-publication-channel", "promotion-router-ref", "promotion-router-sha", "promotion-runtime-ref", "promotion-runtime-sha", "promotion-shell-ref", "promotion-shell-sha", "promotion-target-ref", "publication-admission-json", "publication-authority-workflow-path", "publication-auto-admission", "publication-auto-no-gate", "publication-commit-command", "publication-commit-evidence-path", "publication-consumer-predicate-id", "publication-consumer-qualification-command", "publication-consumer-qualification-controller-sha", "publication-control-plane-audit-json", "publication-expected-json", "publication-gate-aggregate-json", "publication-gate-command", "publication-gate-controller-sha", "publication-package-name", "publication-product", "publication-publisher-workflow-path", "publication-runner-provenance-json", "publication-target", "publication-used-nonces-json", "publication-used-qualification-nonces-json", "publish-artifact-kind", "publish-command", "publish-dist-tag", "publish-mode", "publish-package-main", "publish-package-set-order", "publish-rematerialize-on-resume", "publish-required-artifacts-json", "publish-target", "publish-transaction-override", "release-activation-command", "release-activation-receipt-set-path", "release-candidate-family-assignment-id", "release-candidate-family-evidence-required", "release-candidate-family-evidence-root", "release-candidate-family-initiative-id", "release-candidate-wait-seconds", "release-candidate-workflow-file", "release-candidate-workflow-name", "release-passport", "release-passport-attachment-command", "release-passport-buildchain-self-kfd", "release-passport-evidence-command", "release-passport-evidence-jsons", "release-passport-evidence-path", "release-passport-impact-json", "release-passport-invariant-passport-command", "release-passport-invariant-passport-jsons", "release-passport-kfd-1-witness-jsons", "release-passport-kfd-2-claim-jsons", "release-passport-kfd-3-artifact-verify-command", "release-passport-kfd-3-artifact-witness-jsons", "release-passport-kfd-3-prebuild-witness-jsons", "release-passport-kfd-adopter-manifest-json", "release-passport-kfd-product-gate-jsons", "release-passport-kfd-support-matrix-json", "release-passport-output-dir", "release-passport-platform-manifest-paths", "release-passport-product-name", "release-propagation-config-path", "required-artifact-count", "required-status-check", "resume-buildchain-runtime-sha", "resume-candidate-repository", "resume-candidate-run-id", "resume-expected-candidate-root", "resume-expected-candidate-runtime-sha", "resume-expected-source-tree", "resume-expected-workflow-file", "resume-expected-workflow-name", "resume-transaction-id", "runner-preset", "standalone-binary-distribution", "target-ref", "target-sha", "trusted-publishing" ], "inputCount": 113, "secrets": [ "BUILDCHAIN_ISSUE_APP_ID", "BUILDCHAIN_ISSUE_APP_PRIVATE_KEY", "BUILDCHAIN_ISSUE_TOKEN", "BUILDCHAIN_PROMOTION_TOKEN", "BUILDCHAIN_PUBLICATION_COMMIT_SIGNING_KEY", "BUILDCHAIN_PUBLICATION_COMMIT_TOKEN", "KUNGFU_GOVERNANCE_AUDITOR_APP_PRIVATE_KEY", "buildchain-issue-app-id", "buildchain-issue-app-private-key", "buildchain-issue-token" ], "secretCount": 10, "outputs": [ "built-source-sha", "controller-plan-artifact", "controller-plan-digest", "controller-plan-json", "controller-receipt-artifact", "controller-receipt-digest", "controller-receipt-json", "controller-receipt-status", "github-artifact-attestation-evidence-root", "github-artifact-attestation-id", "github-artifact-attestation-publication-receipt-digest", "github-artifact-attestation-url", "promoted-sha", "publication-capability-digest", "publication-commit-evidence-digest", "publication-commit-evidence-path", "publication-commit-payload-root", "publication-commit-url", "release-candidate-action", "release-candidate-artifact", "release-candidate-recovery-receipt-artifact", "release-candidate-recovery-root", "release-propagation-work-artifact", "release-tail-declaration-root", "release-tail-receipt-roots-json", "release-tail-state-root", "release-tail-transaction-root", "release-tail-transaction-state" ], "outputCount": 28, "surface": "reusable-workflow", "capabilityGroup": "api-cli-reference", "status": "active", "owner": "buildchain-workflows", "maturity": "active", "introducedVersion": "pre-3.0.2-alpha.4", "compatibilityPromise": "preserved-through-the-v3-major-line", "deprecationReplacement": "", "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line", "nonDuplicationRationale": "Existing workflow identity retained for caller compatibility and repository orchestration." }, { "id": ".release-docker", "path": ".github/workflows/.release-docker.yml", "reusable": true, "inputs": [ "image-name" ], "inputCount": 1, "secrets": [ "DOCKER_HUB_PASSWORD", "DOCKER_HUB_USERNAME", "GITHUB_PUSH_TOKEN" ], "secretCount": 3, "outputs": [], "outputCount": 0, "surface": "reusable-workflow", "capabilityGroup": "api-cli-reference", "status": "active", "owner": "buildchain-workflows", "maturity": "active", "introducedVersion": "pre-3.0.2-alpha.4", "compatibilityPromise": "preserved-through-the-v3-major-line", "deprecationReplacement": "", "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line", "nonDuplicationRationale": "Existing workflow identity retained for caller compatibility and repository orchestration." }, { "id": ".release-elastic-beanstalk", "path": ".github/workflows/.release-elastic-beanstalk.yml", "reusable": true, "inputs": [ "aws-region", "eb-application-name", "eb-environment-name" ], "inputCount": 3, "secrets": [ "AWS_USER_ACCESS_KEY_ID", "AWS_USER_SECRET_ACCESS_KEY", "GITHUB_PUSH_TOKEN" ], "secretCount": 3, "outputs": [], "outputCount": 0, "surface": "reusable-workflow", "capabilityGroup": "api-cli-reference", "status": "active", "owner": "buildchain-workflows", "maturity": "active", "introducedVersion": "pre-3.0.2-alpha.4", "compatibilityPromise": "preserved-through-the-v3-major-line", "deprecationReplacement": "", "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line", "nonDuplicationRationale": "Existing workflow identity retained for caller compatibility and repository orchestration." }, { "id": ".release-new-version", "path": ".github/workflows/.release-new-version.yml", "reusable": true, "inputs": [ "action-bump-version-path", "action-bump-version-ref", "action-bump-version-repository", "aws-ci-region", "aws-user-region", "bucket-release-ci", "bucket-release-user", "bucket-staging-ci", "bucket-staging-user", "clean-release-ci", "clean-release-user", "close-issues", "cloudfront-id-ci", "cloudfront-id-user", "cloudfront-paths-ci", "cloudfront-paths-user", "create-release-note", "max-preview-links", "need-qa-automated", "node-version", "protect-dev-branches", "publish-aws-ci", "publish-aws-user", "publish-github-npm", "publish-npmjs", "publish-release-note", "sync-extensions-version" ], "inputCount": 27, "secrets": [ "AIRTABLE_API_KEY", "AWS_CI_ACCESS_KEY_ID", "AWS_CI_SECRET_ACCESS_KEY", "AWS_USER_ACCESS_KEY_ID", "AWS_USER_SECRET_ACCESS_KEY", "GITHUB_PUSH_TOKEN", "MONDAY_API_KEY", "NPM_PUSH_TOKEN" ], "secretCount": 8, "outputs": [], "outputCount": 0, "surface": "reusable-workflow", "capabilityGroup": "api-cli-reference", "status": "active", "owner": "buildchain-workflows", "maturity": "active", "introducedVersion": "pre-3.0.2-alpha.4", "compatibilityPromise": "preserved-through-the-v3-major-line", "deprecationReplacement": "", "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line", "nonDuplicationRationale": "Existing workflow identity retained for caller compatibility and repository orchestration." }, { "id": ".release-verify", "path": ".github/workflows/.release-verify.yml", "reusable": true, "inputs": [ "auto-approve-enabled", "aws-ci-region", "aws-user-region", "bucket-staging-ci", "bucket-staging-user", "build-container-enabled", "build-runner-linux", "build-runner-linux-labels", "build-runner-macos", "build-runner-macos-labels", "build-runner-windows", "build-runner-windows-labels", "build-timeout-minutes", "buildchain-ref", "buildchain-repository", "builder-container", "code-signing-macos", "code-signing-windows", "collaborator-automation-enabled", "enable-linux", "enable-macos", "enable-windows", "find-dependencies", "java-version", "manager", "max-build-attempts", "max-preview-links", "node-version", "pipenv-version", "poetry-version", "prebuild", "preview-files", "publish-aws-ci", "publish-aws-user", "publish-github-npm", "publish-versioning", "python-version", "setup-env-timeout-minutes", "setup-python-enabled", "use-pipenv", "use-poetry" ], "inputCount": 41, "secrets": [ "APPLE_CSC_KEY", "APPLE_CSC_KEY_PASSWORD", "APPLE_ID", "APPLE_ID_PASSWORD", "AWS_CI_ACCESS_KEY_ID", "AWS_CI_SECRET_ACCESS_KEY", "AWS_USER_ACCESS_KEY_ID", "AWS_USER_SECRET_ACCESS_KEY", "GITHUB_PUSH_TOKEN", "NODE_AUTH_TOKEN", "WINDOWS_CSC_KEY" ], "secretCount": 11, "outputs": [], "outputCount": 0, "surface": "reusable-workflow", "capabilityGroup": "api-cli-reference", "status": "active", "owner": "buildchain-workflows", "maturity": "active", "introducedVersion": "pre-3.0.2-alpha.4", "compatibilityPromise": "preserved-through-the-v3-major-line", "deprecationReplacement": "", "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line", "nonDuplicationRationale": "Existing workflow identity retained for caller compatibility and repository orchestration." }, { "id": ".sam-release", "path": ".github/workflows/.sam-release.yml", "reusable": true, "inputs": [ "aws-region", "aws-role", "aws-root", "bucket-release" ], "inputCount": 4, "secrets": [ "AWS_ACCOUNT_ID" ], "secretCount": 1, "outputs": [], "outputCount": 0, "surface": "reusable-workflow", "capabilityGroup": "api-cli-reference", "status": "active", "owner": "buildchain-workflows", "maturity": "active", "introducedVersion": "pre-3.0.2-alpha.4", "compatibilityPromise": "preserved-through-the-v3-major-line", "deprecationReplacement": "", "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line", "nonDuplicationRationale": "Existing workflow identity retained for caller compatibility and repository orchestration." }, { "id": ".sam-verify", "path": ".github/workflows/.sam-verify.yml", "reusable": true, "inputs": [ "aws-region", "aws-role", "aws-root", "manager" ], "inputCount": 4, "secrets": [ "AWS_ACCOUNT_ID", "NODE_AUTH_TOKEN" ], "secretCount": 2, "outputs": [], "outputCount": 0, "surface": "reusable-workflow", "capabilityGroup": "api-cli-reference", "status": "active", "owner": "buildchain-workflows", "maturity": "active", "introducedVersion": "pre-3.0.2-alpha.4", "compatibilityPromise": "preserved-through-the-v3-major-line", "deprecationReplacement": "", "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line", "nonDuplicationRationale": "Existing workflow identity retained for caller compatibility and repository orchestration." }, { "id": ".sync-release-page", "path": ".github/workflows/.sync-release-page.yml", "reusable": true, "inputs": [ "aws-region", "aws-role-arn", "base-id", "bucket-release", "cloudfront-id", "exclude", "lower-edge", "product", "product-name", "release-path", "release-url", "repo", "upper-edge" ], "inputCount": 13, "secrets": [ "AIRTABLE_API_KEY", "GITHUB_PUSH_TOKEN" ], "secretCount": 2, "outputs": [], "outputCount": 0, "surface": "reusable-workflow", "capabilityGroup": "api-cli-reference", "status": "active", "owner": "buildchain-workflows", "maturity": "active", "introducedVersion": "pre-3.0.2-alpha.4", "compatibilityPromise": "preserved-through-the-v3-major-line", "deprecationReplacement": "", "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line", "nonDuplicationRationale": "Existing workflow identity retained for caller compatibility and repository orchestration." }, { "id": ".sync-remote-git", "path": ".github/workflows/.sync-remote-git.yml", "reusable": true, "inputs": [ "force", "remote-host", "remote-path", "remote-repo" ], "inputCount": 4, "secrets": [ "REMOTE_CREDENTIAL", "REMOTE_USER" ], "secretCount": 2, "outputs": [], "outputCount": 0, "surface": "reusable-workflow", "capabilityGroup": "api-cli-reference", "status": "active", "owner": "buildchain-workflows", "maturity": "active", "introducedVersion": "pre-3.0.2-alpha.4", "compatibilityPromise": "preserved-through-the-v3-major-line", "deprecationReplacement": "", "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line", "nonDuplicationRationale": "Existing workflow identity retained for caller compatibility and repository orchestration." }, { "id": ".web-surface", "path": ".github/workflows/.web-surface.yml", "reusable": true, "inputs": [ "artifact-path", "aws-region", "build-command", "buildchain-contract-compatibility-policy", "buildchain-contract-drift-issue-mode", "buildchain-contract-lock-path", "buildchain-ref", "buildchain-repository", "fail-on-release-pr-error", "github-governance-receipt-json", "node-version", "preview-apply", "preview-aws-role-arn", "preview-cleanup-apply", "preview-comment", "preview-environment", "production-apply", "production-approved", "production-aws-role-arn", "production-environment", "production-release-app-client-id", "production-release-app-id", "production-release-branch-channel", "production-release-head-prefix", "production-release-label", "production-release-on-main", "production-release-pr-mode", "production-release-pr-token", "production-source-sha", "publication-admission-json", "publication-control-plane-audit-json", "publication-expected-json", "publication-gate-aggregate-json", "publication-runner-provenance-json", "publication-used-nonces-json", "release-feedback-actor-privacy", "staging-apply", "staging-aws-role-arn", "staging-environment", "verify-command", "working-directory" ], "inputCount": 41, "secrets": [ "production-release-app-private-key" ], "secretCount": 1, "outputs": [ "buildchain-runtime-class", "buildchain-runtime-override", "buildchain-runtime-ref", "buildchain-runtime-sha", "controller-plan-artifact", "controller-plan-digest", "controller-plan-json", "controller-receipt-artifact", "controller-receipt-digest", "controller-receipt-json", "controller-receipt-status", "preview-apply-result-json", "preview-cleanup-result-json", "production-apply-result-json", "production-release-pr-url", "release-pr-status", "staging-apply-result-json", "web-surface-alias", "web-surface-channel", "web-surface-cleanup-plan-json", "web-surface-manifest-json", "web-surface-url", "web-surface-urls-json" ], "outputCount": 23, "surface": "reusable-workflow", "capabilityGroup": "api-cli-reference", "status": "active", "owner": "buildchain-workflows", "maturity": "active", "introducedVersion": "pre-3.0.2-alpha.4", "compatibilityPromise": "preserved-through-the-v3-major-line", "deprecationReplacement": "", "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line", "nonDuplicationRationale": "Existing workflow identity retained for caller compatibility and repository orchestration." }, { "id": ".wheel-release", "path": ".github/workflows/.wheel-release.yml", "reusable": true, "inputs": [ "aws-region", "aws-user-region", "bucket-release" ], "inputCount": 3, "secrets": [ "AWS_USER_ACCESS_KEY_ID", "AWS_USER_SECRET_ACCESS_KEY" ], "secretCount": 2, "outputs": [], "outputCount": 0, "surface": "reusable-workflow", "capabilityGroup": "api-cli-reference", "status": "active", "owner": "buildchain-workflows", "maturity": "active", "introducedVersion": "pre-3.0.2-alpha.4", "compatibilityPromise": "preserved-through-the-v3-major-line", "deprecationReplacement": "", "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line", "nonDuplicationRationale": "Existing workflow identity retained for caller compatibility and repository orchestration." }, { "id": ".wheel-verify", "path": ".github/workflows/.wheel-verify.yml", "reusable": true, "inputs": [ "aws-user-region", "bucket-release", "max-preview-links", "node-version", "preview-files" ], "inputCount": 5, "secrets": [ "AWS_USER_ACCESS_KEY_ID", "AWS_USER_SECRET_ACCESS_KEY", "NODE_AUTH_TOKEN" ], "secretCount": 3, "outputs": [], "outputCount": 0, "surface": "reusable-workflow", "capabilityGroup": "api-cli-reference", "status": "active", "owner": "buildchain-workflows", "maturity": "active", "introducedVersion": "pre-3.0.2-alpha.4", "compatibilityPromise": "preserved-through-the-v3-major-line", "deprecationReplacement": "", "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line", "nonDuplicationRationale": "Existing workflow identity retained for caller compatibility and repository orchestration." }, { "id": "artifact-signing-authority", "path": ".github/workflows/artifact-signing-authority.yml", "reusable": false, "inputs": [], "inputCount": 0, "secrets": [], "secretCount": 0, "outputs": [], "outputCount": 0, "surface": "repository-workflow", "capabilityGroup": "api-cli-reference", "status": "active", "owner": "buildchain-workflows", "maturity": "active", "introducedVersion": "pre-3.0.2-alpha.4", "compatibilityPromise": "preserved-through-the-v3-major-line", "deprecationReplacement": "", "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line", "nonDuplicationRationale": "Existing workflow identity retained for caller compatibility and repository orchestration." }, { "id": "auditable-demo-media-profile-qualification", "path": ".github/workflows/auditable-demo-media-profile-qualification.yml", "reusable": false, "inputs": [], "inputCount": 0, "secrets": [], "secretCount": 0, "outputs": [], "outputCount": 0, "surface": "repository-workflow", "capabilityGroup": "api-cli-reference", "status": "active", "owner": "buildchain-workflows", "maturity": "active", "introducedVersion": "pre-3.0.2-alpha.4", "compatibilityPromise": "preserved-through-the-v3-major-line", "deprecationReplacement": "", "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line", "nonDuplicationRationale": "Existing workflow identity retained for caller compatibility and repository orchestration." }, { "id": "auditable-demo", "path": ".github/workflows/auditable-demo.yml", "reusable": false, "inputs": [], "inputCount": 0, "secrets": [], "secretCount": 0, "outputs": [], "outputCount": 0, "surface": "repository-workflow", "capabilityGroup": "api-cli-reference", "status": "active", "owner": "buildchain-workflows", "maturity": "active", "introducedVersion": "pre-3.0.2-alpha.4", "compatibilityPromise": "preserved-through-the-v3-major-line", "deprecationReplacement": "", "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line", "nonDuplicationRationale": "Existing workflow identity retained for caller compatibility and repository orchestration." }, { "id": "binary-distribution", "path": ".github/workflows/binary-distribution.yml", "reusable": false, "inputs": [], "inputCount": 0, "secrets": [], "secretCount": 0, "outputs": [], "outputCount": 0, "surface": "release-passport", "capabilityGroup": "api-cli-reference", "status": "active", "owner": "buildchain-workflows", "maturity": "active", "introducedVersion": "pre-3.0.2-alpha.4", "compatibilityPromise": "preserved-through-the-v3-major-line", "deprecationReplacement": "", "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line", "nonDuplicationRationale": "Existing workflow identity retained for caller compatibility and repository orchestration." }, { "id": "binary-release-assets", "path": ".github/workflows/binary-release-assets.yml", "reusable": false, "inputs": [], "inputCount": 0, "secrets": [], "secretCount": 0, "outputs": [], "outputCount": 0, "surface": "repository-workflow", "capabilityGroup": "api-cli-reference", "status": "active", "owner": "buildchain-workflows", "maturity": "active", "introducedVersion": "pre-3.0.2-alpha.4", "compatibilityPromise": "preserved-through-the-v3-major-line", "deprecationReplacement": "", "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line", "nonDuplicationRationale": "Existing workflow identity retained for caller compatibility and repository orchestration." }, { "id": "build-surface-fixture", "path": ".github/workflows/build-surface-fixture.yml", "reusable": false, "inputs": [], "inputCount": 0, "secrets": [], "secretCount": 0, "outputs": [], "outputCount": 0, "surface": "repository-workflow", "capabilityGroup": "api-cli-reference", "status": "repository-internal", "owner": "buildchain-workflows", "maturity": "repository-internal", "introducedVersion": "pre-3.0.2-alpha.4", "compatibilityPromise": "preserved-through-the-v3-major-line", "deprecationReplacement": "", "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line", "nonDuplicationRationale": "Existing workflow identity retained for caller compatibility and repository orchestration." }, { "id": "build", "path": ".github/workflows/build.yml", "reusable": true, "inputs": [ "artifact-compression-level", "artifact-finalization-command", "artifact-finalization-on-platform", "artifact-name", "artifact-name-template", "artifact-paths", "artifact-relay-s3-bucket", "artifact-relay-s3-download-role-arn", "artifact-relay-s3-oidc-audience", "artifact-relay-s3-prefix", "artifact-relay-s3-region", "artifact-relay-s3-role-arn", "artifact-relay-s3-upload-role-arn", "artifact-retention-days", "artifact-signing-request-upload-no-proxy", "artifact-transfer-mode", "aws-codebuild-project", "aws-ec2-macos-runner-label", "aws-ec2-windows-runner-label", "build-command", "buildchain-alpha-contract-lock-path", "buildchain-channel", "buildchain-contract-compatibility-policy", "buildchain-contract-drift-issue-mode", "buildchain-contract-lock-path", "buildchain-expected-channel", "buildchain-expected-major", "buildchain-ref", "buildchain-repository", "buildchain-stable-contract-lock-path", "cache-dependency-lock-root", "cache-policy-root", "cache-toolchain-root", "cargo-registry-index", "checkout-cache-fallback", "checkout-cache-fetch-attempts", "checkout-cache-github-timeout-seconds", "checkout-cache-mirror-url-template", "checkout-cache-mode", "checkout-cache-reference-repository-template", "checkout-cache-timeout-seconds", "checkout-history-mode", "compiler-cache-platforms-json", "compiler-cache-provider", "compiler-cache-required", "control-runner-json", "credential-island-caller-owned", "credential-island-environment", "credential-island-macos-app-path", "credential-island-macos-platform-id", "expected-artifacts-json", "fail-fast", "gate-profile-aggregate-json", "github-artifact-attestation-platform-id", "github-artifact-attestation-signer-sha", "github-artifact-attestation-subject-path", "install-command", "kfd-agent-hub", "lifecycle-timeout-minutes", "linux-container-image", "linux-container-preset", "node-version", "platforms-json", "pre-upload-transport-smoke-artifact-root", "pre-upload-transport-smoke-scenario-path", "process-sample-interval-ms", "process-summary-path", "publish-anchor-request-json", "publish-channel", "publish-refs-json", "publish-registry", "publish-source-ref", "release-candidate", "release-candidate-family-evidence-json", "requested-parallelism", "require-build", "require-install", "require-trusted-event", "require-verify", "runner-preset", "rust-toolchain", "rustup-dist-server", "rustup-update-root", "sample-process-tree", "self-hosted-offline-fallback", "setup-node", "setup-rust", "shifu-cache-profile-digest", "shifu-cache-profile-ref", "untrusted-policy", "verify-command", "verify-substage-evidence-path", "working-directory" ], "inputCount": 93, "secrets": [ "BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN", "BUILDCHAIN_ARTIFACT_RELAY_S3_ROLE_ARN", "BUILDCHAIN_ARTIFACT_RELAY_S3_UPLOAD_ROLE_ARN", "BUILDCHAIN_MACOS_CERTIFICATE_P12_BASE64", "BUILDCHAIN_MACOS_CERTIFICATE_PASSWORD", "BUILDCHAIN_MACOS_NOTARY_API_ISSUER", "BUILDCHAIN_MACOS_NOTARY_API_KEY_ID", "BUILDCHAIN_MACOS_NOTARY_API_KEY_P8_BASE64", "BUILDCHAIN_PROMOTION_TOKEN" ], "secretCount": 9, "outputs": [ "artifact-coordinates-json", "build-diagnostics-summary-artifact", "build-diagnostics-summary-json", "build-summary-artifact", "build-summary-json", "buildchain-channel", "buildchain-channel-reason", "buildchain-channel-selection-source", "buildchain-contract-digest", "buildchain-contract-lock-drift", "buildchain-contract-lock-status", "buildchain-runtime-class", "buildchain-runtime-override", "buildchain-runtime-ref", "buildchain-runtime-sha", "buildchain-runtime-trust-decision", "controller-plan-artifact", "controller-plan-digest", "controller-plan-json", "controller-receipt-artifact", "controller-receipt-digest", "controller-receipt-json", "controller-receipt-status", "credential-island-macos-artifact", "credential-island-macos-manifest-artifact", "linux-container-enabled", "linux-container-image", "platform-count", "platforms-json", "publish-allowed", "publish-channel", "publish-reason", "publish-source-channel", "publish-source-consumer-version", "publish-source-line", "publish-source-locked", "publish-source-ref", "publish-source-sha", "publish-source-tree-sha", "release-candidate-artifact", "release-candidate-passport-artifact", "release-candidate-passport-json", "release-manifest-json", "runner-preset", "runner-routing-json", "trusted-event" ], "outputCount": 46, "surface": "channel-build-router", "capabilityGroup": "reusable-build", "status": "active", "owner": "buildchain-workflows", "maturity": "active", "introducedVersion": "pre-3.0.2-alpha.4", "compatibilityPromise": "preserved-through-the-v3-major-line", "deprecationReplacement": "", "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line", "nonDuplicationRationale": "Existing workflow identity retained for caller compatibility and repository orchestration." }, { "id": "buildchain-alpha-self-dogfood", "path": ".github/workflows/buildchain-alpha-self-dogfood.yml", "reusable": false, "inputs": [], "inputCount": 0, "secrets": [], "secretCount": 0, "outputs": [], "outputCount": 0, "surface": "repository-workflow", "capabilityGroup": "api-cli-reference", "status": "active", "owner": "buildchain-workflows", "maturity": "active", "introducedVersion": "pre-3.0.2-alpha.4", "compatibilityPromise": "preserved-through-the-v3-major-line", "deprecationReplacement": "", "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line", "nonDuplicationRationale": "Existing workflow identity retained for caller compatibility and repository orchestration." }, { "id": "buildchain-candidate-recovery-dogfood-failure", "path": ".github/workflows/buildchain-candidate-recovery-dogfood-failure.yml", "reusable": false, "inputs": [], "inputCount": 0, "secrets": [], "secretCount": 0, "outputs": [], "outputCount": 0, "surface": "repository-workflow", "capabilityGroup": "api-cli-reference", "status": "active", "owner": "buildchain-workflows", "maturity": "active", "introducedVersion": "pre-3.0.2-alpha.4", "compatibilityPromise": "preserved-through-the-v3-major-line", "deprecationReplacement": "", "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line", "nonDuplicationRationale": "Existing workflow identity retained for caller compatibility and repository orchestration." }, { "id": "buildchain-dev-delivery", "path": ".github/workflows/buildchain-dev-delivery.yml", "reusable": false, "inputs": [], "inputCount": 0, "secrets": [], "secretCount": 0, "outputs": [], "outputCount": 0, "surface": "dev-governance", "capabilityGroup": "governance-versioning", "status": "active", "owner": "buildchain-workflows", "maturity": "active", "introducedVersion": "pre-3.0.2-alpha.4", "compatibilityPromise": "preserved-through-the-v3-major-line", "deprecationReplacement": "", "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line", "nonDuplicationRationale": "Existing workflow identity retained for caller compatibility and repository orchestration." }, { "id": "buildchain-patrol-daily", "path": ".github/workflows/buildchain-patrol-daily.yml", "reusable": false, "inputs": [], "inputCount": 0, "secrets": [], "secretCount": 0, "outputs": [], "outputCount": 0, "surface": "repository-patrol", "capabilityGroup": "governance-versioning", "status": "active", "owner": "buildchain-workflows", "maturity": "active", "introducedVersion": "pre-3.0.2-alpha.4", "compatibilityPromise": "preserved-through-the-v3-major-line", "deprecationReplacement": "", "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line", "nonDuplicationRationale": "Existing workflow identity retained for caller compatibility and repository orchestration." }, { "id": "buildchain-patrol-monthly", "path": ".github/workflows/buildchain-patrol-monthly.yml", "reusable": false, "inputs": [], "inputCount": 0, "secrets": [], "secretCount": 0, "outputs": [], "outputCount": 0, "surface": "repository-patrol", "capabilityGroup": "governance-versioning", "status": "active", "owner": "buildchain-workflows", "maturity": "active", "introducedVersion": "pre-3.0.2-alpha.4", "compatibilityPromise": "preserved-through-the-v3-major-line", "deprecationReplacement": "", "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line", "nonDuplicationRationale": "Existing workflow identity retained for caller compatibility and repository orchestration." }, { "id": "buildchain-patrol-weekly", "path": ".github/workflows/buildchain-patrol-weekly.yml", "reusable": false, "inputs": [], "inputCount": 0, "secrets": [], "secretCount": 0, "outputs": [], "outputCount": 0, "surface": "repository-patrol", "capabilityGroup": "governance-versioning", "status": "active", "owner": "buildchain-workflows", "maturity": "active", "introducedVersion": "pre-3.0.2-alpha.4", "compatibilityPromise": "preserved-through-the-v3-major-line", "deprecationReplacement": "", "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line", "nonDuplicationRationale": "Existing workflow identity retained for caller compatibility and repository orchestration." }, { "id": "buildchain-patrol", "path": ".github/workflows/buildchain-patrol.yml", "reusable": true, "inputs": [ "allowed-head-prefixes", "block-labels", "buildchain-ref", "buildchain-repository", "cadence", "capabilities", "dry-run", "landing-mode", "max-actions", "merge-method", "mode", "ready-label", "require-approval", "required-status-checks", "same-repository-only", "target-branch" ], "inputCount": 16, "secrets": [ "github-token" ], "secretCount": 1, "outputs": [ "action-count", "evaluated-count", "planned-count", "result-path", "skipped-count" ], "outputCount": 5, "surface": "repository-patrol", "capabilityGroup": "governance-versioning", "status": "active", "owner": "buildchain-workflows", "maturity": "active", "introducedVersion": "pre-3.0.2-alpha.4", "compatibilityPromise": "preserved-through-the-v3-major-line", "deprecationReplacement": "", "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line", "nonDuplicationRationale": "Existing workflow identity retained for caller compatibility and repository orchestration." }, { "id": "buildchain-ref-promotion", "path": ".github/workflows/buildchain-ref-promotion.yml", "reusable": false, "inputs": [], "inputCount": 0, "secrets": [], "secretCount": 0, "outputs": [], "outputCount": 0, "surface": "release-governance", "capabilityGroup": "release-passport-trust", "status": "active", "owner": "buildchain-workflows", "maturity": "active", "introducedVersion": "pre-3.0.2-alpha.4", "compatibilityPromise": "preserved-through-the-v3-major-line", "deprecationReplacement": "", "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line", "nonDuplicationRationale": "Existing workflow identity retained for caller compatibility and repository orchestration." }, { "id": "buildchain-stable-candidate-patrol", "path": ".github/workflows/buildchain-stable-candidate-patrol.yml", "reusable": false, "inputs": [], "inputCount": 0, "secrets": [], "secretCount": 0, "outputs": [], "outputCount": 0, "surface": "repository-patrol", "capabilityGroup": "governance-versioning", "status": "active", "owner": "buildchain-workflows", "maturity": "active", "introducedVersion": "pre-3.0.2-alpha.4", "compatibilityPromise": "preserved-through-the-v3-major-line", "deprecationReplacement": "", "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line", "nonDuplicationRationale": "Existing workflow identity retained for caller compatibility and repository orchestration." }, { "id": "buildchain-stable-candidate-qualification", "path": ".github/workflows/buildchain-stable-candidate-qualification.yml", "reusable": false, "inputs": [], "inputCount": 0, "secrets": [], "secretCount": 0, "outputs": [], "outputCount": 0, "surface": "repository-patrol", "capabilityGroup": "api-cli-reference", "status": "repository-internal", "owner": "buildchain-workflows", "maturity": "repository-internal", "introducedVersion": "pre-3.0.2-alpha.4", "compatibilityPromise": "preserved-through-the-v3-major-line", "deprecationReplacement": "", "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line", "nonDuplicationRationale": "Existing workflow identity retained for caller compatibility and repository orchestration." }, { "id": "candidate-lab", "path": ".github/workflows/candidate-lab.yml", "reusable": false, "inputs": [], "inputCount": 0, "secrets": [], "secretCount": 0, "outputs": [], "outputCount": 0, "surface": "repository-workflow", "capabilityGroup": "api-cli-reference", "status": "repository-internal", "owner": "buildchain-workflows", "maturity": "repository-internal", "introducedVersion": "pre-3.0.2-alpha.4", "compatibilityPromise": "preserved-through-the-v3-major-line", "deprecationReplacement": "", "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line", "nonDuplicationRationale": "Existing workflow identity retained for caller compatibility and repository orchestration." }, { "id": "check", "path": ".github/workflows/check.yml", "reusable": true, "inputs": [ "buildchain-ref", "buildchain-repository", "mode", "node-version", "require-version-state", "upload-artifacts", "working-directory" ], "inputCount": 7, "secrets": [], "secretCount": 0, "outputs": [ "controller-plan-artifact", "controller-plan-digest", "controller-plan-json", "controller-receipt-artifact", "controller-receipt-digest", "controller-receipt-json", "controller-receipt-status" ], "outputCount": 7, "surface": "repository-workflow", "capabilityGroup": "api-cli-reference", "status": "active", "owner": "buildchain-workflows", "maturity": "active", "introducedVersion": "pre-3.0.2-alpha.4", "compatibilityPromise": "preserved-through-the-v3-major-line", "deprecationReplacement": "", "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line", "nonDuplicationRationale": "Existing workflow identity retained for caller compatibility and repository orchestration." }, { "id": "dev-alpha-candidate-patrol", "path": ".github/workflows/dev-alpha-candidate-patrol.yml", "reusable": true, "inputs": [ "alpha-workflow-path", "auto-merge", "buildchain-ref", "buildchain-repository", "create-pull-request", "dev-workflow-path", "dry-run", "max-age-seconds", "merge-method", "pull-request-body-prefix", "pull-request-body-prefix-renderer", "reactivation-authorized", "settlement-authorized", "source-branch", "target-branch" ], "inputCount": 15, "secrets": [ "promotion-token" ], "secretCount": 1, "outputs": [ "active-candidate-pr", "candidate-generation", "candidate-tree-sha", "controller-state", "cut-root", "drift-root", "eligible", "hold-root", "next-candidate-sha", "prior-state-root", "promotion-pr", "result-path", "runtime-sha", "selected-sha", "settlement-action", "source-lock-ref", "train-root" ], "outputCount": 17, "surface": "repository-patrol", "capabilityGroup": "governance-versioning", "status": "active", "owner": "buildchain-workflows", "maturity": "active", "introducedVersion": "pre-3.0.2-alpha.4", "compatibilityPromise": "preserved-through-the-v3-major-line", "deprecationReplacement": "", "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line", "nonDuplicationRationale": "Existing workflow identity retained for caller compatibility and repository orchestration." }, { "id": "dev-delivery-warrant-cancel", "path": ".github/workflows/dev-delivery-warrant-cancel.yml", "reusable": true, "inputs": [ "buildchain-ref", "buildchain-repository", "event-action", "expected-candidate-id", "expected-old-state-root", "expected-pr-number", "expected-source-head-sha", "observed-source-head-sha", "outcome", "reason", "target-branch", "terminal-evidence-root" ], "inputCount": 12, "secrets": [ "github-token" ], "secretCount": 1, "outputs": [ "cancellation-action", "cancellation-receipt-root", "final-state-root" ], "outputCount": 3, "surface": "repository-workflow", "capabilityGroup": "governance-versioning", "status": "active", "owner": "buildchain-workflows", "maturity": "active", "introducedVersion": "pre-3.0.2-alpha.4", "compatibilityPromise": "preserved-through-the-v3-major-line", "deprecationReplacement": "", "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line", "nonDuplicationRationale": "Existing workflow identity retained for caller compatibility and repository orchestration." }, { "id": "dev-delivery-warrant-close", "path": ".github/workflows/dev-delivery-warrant-close.yml", "reusable": true, "inputs": [ "buildchain-ref", "buildchain-repository", "current-base-sha", "expected-head-sha", "expected-pr-number", "merge-group-head-sha", "merge-group-tree-sha", "outcome", "reason", "replay-tree-sha", "required-context-roots-json", "target-branch", "terminal-evidence-root" ], "inputCount": 13, "secrets": [ "github-token" ], "secretCount": 1, "outputs": [ "close-receipt-root", "final-state-root", "integration-proof-root" ], "outputCount": 3, "surface": "repository-workflow", "capabilityGroup": "governance-versioning", "status": "active", "owner": "buildchain-workflows", "maturity": "active", "introducedVersion": "pre-3.0.2-alpha.4", "compatibilityPromise": "preserved-through-the-v3-major-line", "deprecationReplacement": "", "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line", "nonDuplicationRationale": "Existing workflow identity retained for caller compatibility and repository orchestration." }, { "id": "dev-merge-queue-governance", "path": ".github/workflows/dev-merge-queue-governance.yml", "reusable": false, "inputs": [], "inputCount": 0, "secrets": [], "secretCount": 0, "outputs": [], "outputCount": 0, "surface": "repository-workflow", "capabilityGroup": "api-cli-reference", "status": "active", "owner": "buildchain-workflows", "maturity": "active", "introducedVersion": "pre-3.0.2-alpha.4", "compatibilityPromise": "preserved-through-the-v3-major-line", "deprecationReplacement": "", "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line", "nonDuplicationRationale": "Existing workflow identity retained for caller compatibility and repository orchestration." }, { "id": "dev-pr-auto-merge", "path": ".github/workflows/dev-pr-auto-merge.yml", "reusable": true, "inputs": [ "affected-paths-json", "allowed-head-prefixes", "assignment-root", "block-labels", "buildchain-ref", "buildchain-repository", "closure-root", "delivery-class", "delivery-priority", "delivery-warrant-mode", "dependency-root", "diagnostic-context", "dry-run", "expected-head-sha", "expected-pr-number", "initiative-root", "landing-mode", "max-merges", "merge-method", "plan-root", "project-cut-proof-json", "queue-admission-context", "ready-label", "require-approval", "required-status-checks", "same-repository-only", "shard-evidence-roots-json", "source-identity-root", "source-patch-root", "target-branch", "toolchain-root", "warrant-lease-seconds" ], "inputCount": 32, "secrets": [ "github-token" ], "secretCount": 1, "outputs": [ "action-count", "admission-receipt-root", "admission-state", "enqueued-count", "evaluated-count", "final-base-sha", "merged-count", "project-cut-proof-root", "skipped-count", "source-proof-root", "warrant-receipt-root", "warrant-state-commit", "warrant-state-root" ], "outputCount": 13, "surface": "dev-governance", "capabilityGroup": "governance-versioning", "status": "active", "owner": "buildchain-workflows", "maturity": "active", "introducedVersion": "pre-3.0.2-alpha.4", "compatibilityPromise": "preserved-through-the-v3-major-line", "deprecationReplacement": "", "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line", "nonDuplicationRationale": "Existing workflow identity retained for caller compatibility and repository orchestration." }, { "id": "dev-qualification-patrol", "path": ".github/workflows/dev-qualification-patrol.yml", "reusable": true, "inputs": [ "buildchain-ref", "buildchain-repository", "dev-workflow-path", "dispatch-inputs-json", "dry-run", "max-attempts", "mutation-authorized", "preflight-workflow-path", "priority-workflows-json", "source-branch" ], "inputCount": 10, "secrets": [ "qualification-token" ], "secretCount": 1, "outputs": [ "action", "active-run-id", "decision-root", "pending-sha", "reason", "source-sha", "state" ], "outputCount": 7, "surface": "repository-patrol", "capabilityGroup": "governance-versioning", "status": "active", "owner": "buildchain-workflows", "maturity": "active", "introducedVersion": "pre-3.0.2-alpha.4", "compatibilityPromise": "preserved-through-the-v3-major-line", "deprecationReplacement": "", "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line", "nonDuplicationRationale": "Existing workflow identity retained for caller compatibility and repository orchestration." }, { "id": "engineering-housekeeper-daily", "path": ".github/workflows/engineering-housekeeper-daily.yml", "reusable": false, "inputs": [], "inputCount": 0, "secrets": [], "secretCount": 0, "outputs": [], "outputCount": 0, "surface": "repository-patrol", "capabilityGroup": "governance-versioning", "status": "preview", "owner": "buildchain-workflows", "maturity": "preview", "introducedVersion": "4.0.0", "compatibilityPromise": "preserved-through-the-v3-major-line", "deprecationReplacement": "", "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line", "nonDuplicationRationale": "One reusable policy and evidence boundary owns Engineering Housekeeper execution; scheduled callers contain cadence values only." }, { "id": "engineering-housekeeper-monthly", "path": ".github/workflows/engineering-housekeeper-monthly.yml", "reusable": false, "inputs": [], "inputCount": 0, "secrets": [], "secretCount": 0, "outputs": [], "outputCount": 0, "surface": "repository-patrol", "capabilityGroup": "governance-versioning", "status": "preview", "owner": "buildchain-workflows", "maturity": "preview", "introducedVersion": "4.0.0", "compatibilityPromise": "preserved-through-the-v3-major-line", "deprecationReplacement": "", "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line", "nonDuplicationRationale": "One reusable policy and evidence boundary owns Engineering Housekeeper execution; scheduled callers contain cadence values only." }, { "id": "engineering-housekeeper-weekly", "path": ".github/workflows/engineering-housekeeper-weekly.yml", "reusable": false, "inputs": [], "inputCount": 0, "secrets": [], "secretCount": 0, "outputs": [], "outputCount": 0, "surface": "repository-patrol", "capabilityGroup": "governance-versioning", "status": "preview", "owner": "buildchain-workflows", "maturity": "preview", "introducedVersion": "4.0.0", "compatibilityPromise": "preserved-through-the-v3-major-line", "deprecationReplacement": "", "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line", "nonDuplicationRationale": "One reusable policy and evidence boundary owns Engineering Housekeeper execution; scheduled callers contain cadence values only." }, { "id": "engineering-housekeeper", "path": ".github/workflows/engineering-housekeeper.yml", "reusable": true, "inputs": [ "apply-enabled", "artifact-prefix", "artifact-retention-days", "buildchain-ref", "buildchain-repository", "max-actions", "mode", "protected-patterns", "repository", "retained-patterns", "stale-days", "stale-pull-request-label", "target-branch", "temporary-branch-patterns" ], "inputCount": 14, "secrets": [ "housekeeper_app_id", "housekeeper_app_private_key", "housekeeper_token" ], "secretCount": 3, "outputs": [ "action-count", "branch-receipt-root", "outcome", "plan-artifact", "plan-root", "pull-request-receipt-root", "receipt-artifact", "report-artifact", "report-receipt-root" ], "outputCount": 9, "surface": "repository-patrol", "capabilityGroup": "governance-versioning", "status": "preview", "owner": "buildchain-workflows", "maturity": "preview", "introducedVersion": "4.0.0", "compatibilityPromise": "preserved-through-the-v3-major-line", "deprecationReplacement": "", "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line", "nonDuplicationRationale": "One reusable policy and evidence boundary owns Engineering Housekeeper execution; scheduled callers contain cadence values only." }, { "id": "github-artifact-attestation", "path": ".github/workflows/github-artifact-attestation.yml", "reusable": true, "inputs": [ "buildchain-ref", "environment", "evidence-artifact-name", "evidence-run-id", "platform-manifest-artifact-name", "platform-manifest-relative-path", "policy-json", "release-passport-artifact-name", "release-passport-relative-path", "retention-days", "source-sha", "subject-artifact-name", "subject-relative-path" ], "inputCount": 13, "secrets": [], "secretCount": 0, "outputs": [ "attestation-id", "attestation-url", "bundle-digest", "evidence-artifact-name", "evidence-root" ], "outputCount": 5, "surface": "release-passport", "capabilityGroup": "release-passport-trust", "status": "active", "owner": "buildchain-workflows", "maturity": "active", "introducedVersion": "pre-3.0.2-alpha.4", "compatibilityPromise": "preserved-through-the-v3-major-line", "deprecationReplacement": "", "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line", "nonDuplicationRationale": "Existing workflow identity retained for caller compatibility and repository orchestration." }, { "id": "github-governance-audit", "path": ".github/workflows/github-governance-audit.yml", "reusable": false, "inputs": [], "inputCount": 0, "secrets": [], "secretCount": 0, "outputs": [], "outputCount": 0, "surface": "dev-governance", "capabilityGroup": "api-cli-reference", "status": "active", "owner": "buildchain-workflows", "maturity": "active", "introducedVersion": "pre-3.0.2-alpha.4", "compatibilityPromise": "preserved-through-the-v3-major-line", "deprecationReplacement": "", "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line", "nonDuplicationRationale": "Existing workflow identity retained for caller compatibility and repository orchestration." }, { "id": "npm-publish", "path": ".github/workflows/npm-publish.yml", "reusable": false, "inputs": [], "inputCount": 0, "secrets": [], "secretCount": 0, "outputs": [], "outputCount": 0, "surface": "repository-workflow", "capabilityGroup": "api-cli-reference", "status": "active", "owner": "buildchain-workflows", "maturity": "active", "introducedVersion": "pre-3.0.2-alpha.4", "compatibilityPromise": "preserved-through-the-v3-major-line", "deprecationReplacement": "", "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line", "nonDuplicationRationale": "Existing workflow identity retained for caller compatibility and repository orchestration." }, { "id": "paper-release-sealed", "path": ".github/workflows/paper-release-sealed.yml", "reusable": true, "inputs": [ "artifact-name", "artifact-paths", "artifact-retention-days", "branch-protection-bypass-apps", "branch-protection-bypass-teams", "branch-protection-bypass-users", "buildchain-contract-lock-path", "buildchain-ref", "buildchain-repository", "dry-run", "github-governance-receipt-json", "github-release", "github-release-notes", "github-release-title", "package-name", "publish-dist-tag", "publisher-workflow-path", "release-passport-impact-json", "release-passport-output-dir", "release-passport-product-name", "required-status-check", "target-ref", "target-sha", "toolchain-type", "verify-command", "working-directory" ], "inputCount": 26, "secrets": [ "BUILDCHAIN_GENERATED_WRITE_APP_CLIENT_ID", "BUILDCHAIN_GENERATED_WRITE_APP_PRIVATE_KEY", "BUILDCHAIN_GENERATED_WRITE_TOKEN", "BUILDCHAIN_PROMOTION_TOKEN", "KUNGFU_GOVERNANCE_AUDITOR_APP_PRIVATE_KEY" ], "secretCount": 5, "outputs": [ "github-release-url", "package-name", "package-version", "propagation-work-artifact", "public-release-tag", "release-passport-path", "upstream-release-json" ], "outputCount": 7, "surface": "repository-workflow", "capabilityGroup": "api-cli-reference", "status": "active", "owner": "buildchain-workflows", "maturity": "active", "introducedVersion": "pre-3.0.2-alpha.4", "compatibilityPromise": "preserved-through-the-v3-major-line", "deprecationReplacement": "", "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line", "nonDuplicationRationale": "Existing workflow identity retained for caller compatibility and repository orchestration." }, { "id": "paper-release", "path": ".github/workflows/paper-release.yml", "reusable": true, "inputs": [ "artifact-name", "artifact-retention-days", "branch-protection-bypass-apps", "branch-protection-bypass-teams", "branch-protection-bypass-users", "build-command", "buildchain-contract-compatibility-policy", "buildchain-contract-drift-issue-mode", "buildchain-contract-lock-path", "buildchain-ref", "buildchain-repository", "dry-run", "github-governance-receipt-json", "github-release", "github-release-notes", "github-release-title", "node-version", "package-name", "publication-admission-json", "publication-control-plane-audit-json", "publication-expected-json", "publication-runner-provenance-json", "publication-used-nonces-json", "publish-dist-tag", "publish-package-set-order", "release-passport-impact-json", "release-passport-output-dir", "release-passport-product-name", "required-status-check", "setup-node", "target-ref", "target-sha", "toolchain-command", "toolchain-digest", "toolchain-image", "toolchain-type", "verify-command", "working-directory" ], "inputCount": 38, "secrets": [], "secretCount": 0, "outputs": [ "controller-plan-artifact", "controller-plan-digest", "controller-plan-json", "controller-receipt-artifact", "controller-receipt-digest", "controller-receipt-json", "controller-receipt-status", "github-release-url", "package-name", "package-version", "public-release-tag", "release-passport-path" ], "outputCount": 12, "surface": "reusable-build", "capabilityGroup": "reusable-build", "status": "active", "owner": "buildchain-workflows", "maturity": "active", "introducedVersion": "pre-3.0.2-alpha.4", "compatibilityPromise": "preserved-through-the-v3-major-line", "deprecationReplacement": "", "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line", "nonDuplicationRationale": "Existing workflow identity retained for caller compatibility and repository orchestration." }, { "id": "patrol-daily", "path": ".github/workflows/patrol-daily.yml", "reusable": true, "inputs": [ "allowed-head-prefixes", "block-labels", "buildchain-ref", "buildchain-repository", "dry-run", "landing-mode", "max-actions", "merge-method", "ready-label", "require-approval", "required-status-checks", "same-repository-only", "target-branch" ], "inputCount": 13, "secrets": [ "github-token" ], "secretCount": 1, "outputs": [ "action-count", "evaluated-count", "planned-count", "result-path", "skipped-count" ], "outputCount": 5, "surface": "repository-patrol", "capabilityGroup": "governance-versioning", "status": "active", "owner": "buildchain-workflows", "maturity": "active", "introducedVersion": "pre-3.0.2-alpha.4", "compatibilityPromise": "preserved-through-the-v3-major-line", "deprecationReplacement": "", "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line", "nonDuplicationRationale": "Existing workflow identity retained for caller compatibility and repository orchestration." }, { "id": "patrol-monthly", "path": ".github/workflows/patrol-monthly.yml", "reusable": true, "inputs": [ "buildchain-ref", "buildchain-repository", "dry-run", "target-branch" ], "inputCount": 4, "secrets": [ "github-token" ], "secretCount": 1, "outputs": [ "action-count", "evaluated-count", "planned-count", "result-path", "skipped-count" ], "outputCount": 5, "surface": "repository-patrol", "capabilityGroup": "governance-versioning", "status": "active", "owner": "buildchain-workflows", "maturity": "active", "introducedVersion": "pre-3.0.2-alpha.4", "compatibilityPromise": "preserved-through-the-v3-major-line", "deprecationReplacement": "", "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line", "nonDuplicationRationale": "Existing workflow identity retained for caller compatibility and repository orchestration." }, { "id": "patrol-observed-evidence", "path": ".github/workflows/patrol-observed-evidence.yml", "reusable": true, "inputs": [ "artifact-path", "build-command", "buildchain-ref", "cloudfront-distribution", "evidence-source-path", "evidence-source-ref", "evidence-source-repository", "manifest-path", "production-aws-role-arn", "production-bucket", "production-environment", "verify-command" ], "inputCount": 12, "secrets": [], "secretCount": 0, "outputs": [ "receipt-path" ], "outputCount": 1, "surface": "repository-patrol", "capabilityGroup": "governance-versioning", "status": "active", "owner": "buildchain-workflows", "maturity": "active", "introducedVersion": "pre-3.0.2-alpha.4", "compatibilityPromise": "preserved-through-the-v3-major-line", "deprecationReplacement": "", "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line", "nonDuplicationRationale": "Existing workflow identity retained for caller compatibility and repository orchestration." }, { "id": "patrol-weekly", "path": ".github/workflows/patrol-weekly.yml", "reusable": true, "inputs": [ "buildchain-ref", "buildchain-repository", "dry-run", "target-branch" ], "inputCount": 4, "secrets": [ "github-token" ], "secretCount": 1, "outputs": [ "action-count", "evaluated-count", "planned-count", "result-path", "skipped-count" ], "outputCount": 5, "surface": "repository-patrol", "capabilityGroup": "governance-versioning", "status": "active", "owner": "buildchain-workflows", "maturity": "active", "introducedVersion": "pre-3.0.2-alpha.4", "compatibilityPromise": "preserved-through-the-v3-major-line", "deprecationReplacement": "", "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line", "nonDuplicationRationale": "Existing workflow identity retained for caller compatibility and repository orchestration." }, { "id": "publication-artifact", "path": ".github/workflows/publication-artifact.yml", "reusable": true, "inputs": [ "artifact-name", "artifact-paths", "artifact-retention-days", "build-command", "buildchain-contract-compatibility-policy", "buildchain-contract-drift-issue-mode", "buildchain-contract-lock-path", "buildchain-ref", "buildchain-repository", "node-version", "package-name", "prepare-paper-package", "publish-dist-tag", "setup-node", "target-ref", "toolchain-command", "toolchain-digest", "toolchain-image", "toolchain-type", "verify-command", "working-directory" ], "inputCount": 21, "secrets": [], "secretCount": 0, "outputs": [ "controller-plan-artifact", "controller-plan-digest", "controller-plan-json", "controller-receipt-artifact", "controller-receipt-digest", "controller-receipt-json", "controller-receipt-status", "package-name", "package-version", "publication-artifact-name", "publication-manifest-json", "publication-manifest-path", "publication-passport-path", "publication-registry-path", "publish-dist-tag", "runtime-sha" ], "outputCount": 16, "surface": "repository-workflow", "capabilityGroup": "reusable-build", "status": "active", "owner": "buildchain-workflows", "maturity": "active", "introducedVersion": "pre-3.0.2-alpha.4", "compatibilityPromise": "preserved-through-the-v3-major-line", "deprecationReplacement": "", "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line", "nonDuplicationRationale": "Existing workflow identity retained for caller compatibility and repository orchestration." }, { "id": "release-candidate-promote", "path": ".github/workflows/release-candidate-promote.yml", "reusable": true, "inputs": [ "allow-repository", "artifact-name", "artifact-patterns", "branch-protection-bypass-apps", "branch-protection-bypass-teams", "branch-protection-bypass-users", "buildchain-alpha-contract-lock-path", "buildchain-channel", "buildchain-contract-compatibility-policy", "buildchain-contract-drift-issue-mode", "buildchain-contract-lock-path", "buildchain-ref", "buildchain-repository", "buildchain-stable-contract-lock-path", "channel", "declarative-release-tail", "dry-run", "github-artifact-attestation-environment", "github-artifact-attestation-policy-json", "github-artifact-attestation-retention-days", "github-governance-receipt-json", "github-release", "github-release-notes", "github-release-payload-patterns", "github-release-title", "package-manager", "publication-admission-json", "publication-auto-admission", "publication-auto-no-gate", "publication-commit-command", "publication-commit-evidence-path", "publication-consumer-predicate-id", "publication-consumer-qualification-command", "publication-consumer-qualification-controller-sha", "publication-control-plane-audit-json", "publication-expected-json", "publication-gate-aggregate-json", "publication-gate-command", "publication-gate-controller-sha", "publication-package-name", "publication-product", "publication-publisher-workflow-path", "publication-runner-provenance-json", "publication-target", "publication-used-nonces-json", "publication-used-qualification-nonces-json", "publish-artifact-kind", "publish-command", "publish-dist-tag", "publish-mode", "publish-package-main", "publish-package-set-order", "publish-rematerialize-on-resume", "publish-required-artifacts-json", "publish-target", "publish-transaction-override", "release-activation-command", "release-activation-receipt-set-path", "release-candidate-family-assignment-id", "release-candidate-family-evidence-required", "release-candidate-family-evidence-root", "release-candidate-family-initiative-id", "release-candidate-wait-seconds", "release-candidate-workflow-file", "release-candidate-workflow-name", "release-passport", "release-passport-attachment-command", "release-passport-buildchain-self-kfd", "release-passport-evidence-command", "release-passport-evidence-jsons", "release-passport-evidence-path", "release-passport-impact-json", "release-passport-invariant-passport-command", "release-passport-invariant-passport-jsons", "release-passport-kfd-1-witness-jsons", "release-passport-kfd-2-claim-jsons", "release-passport-kfd-3-artifact-verify-command", "release-passport-kfd-3-artifact-witness-jsons", "release-passport-kfd-3-prebuild-witness-jsons", "release-passport-kfd-adopter-manifest-json", "release-passport-kfd-product-gate-jsons", "release-passport-kfd-support-matrix-json", "release-passport-output-dir", "release-passport-platform-manifest-paths", "release-passport-product-name", "release-propagation-config-path", "required-artifact-count", "required-status-check", "resume-buildchain-runtime-sha", "resume-candidate-repository", "resume-candidate-run-id", "resume-expected-candidate-root", "resume-expected-candidate-runtime-sha", "resume-expected-source-tree", "resume-expected-workflow-file", "resume-expected-workflow-name", "resume-transaction-id", "runner-preset", "standalone-binary-distribution", "target-ref", "target-sha", "trusted-publishing" ], "inputCount": 102, "secrets": [ "BUILDCHAIN_ISSUE_APP_ID", "BUILDCHAIN_ISSUE_APP_PRIVATE_KEY", "BUILDCHAIN_ISSUE_TOKEN", "BUILDCHAIN_PROMOTION_TOKEN", "BUILDCHAIN_PUBLICATION_COMMIT_SIGNING_KEY", "BUILDCHAIN_PUBLICATION_COMMIT_TOKEN", "KUNGFU_GOVERNANCE_AUDITOR_APP_PRIVATE_KEY", "buildchain-issue-app-id", "buildchain-issue-app-private-key", "buildchain-issue-token" ], "secretCount": 10, "outputs": [ "buildchain-channel", "built-source-sha", "controller-plan-artifact", "controller-plan-digest", "controller-plan-json", "controller-receipt-artifact", "controller-receipt-digest", "controller-receipt-json", "controller-receipt-status", "github-artifact-attestation-evidence-root", "github-artifact-attestation-id", "github-artifact-attestation-publication-receipt-digest", "github-artifact-attestation-url", "promoted-sha", "promotion-contract-lock-digest", "promotion-contract-lock-path", "promotion-override-used", "promotion-publication-channel", "promotion-router-ref", "promotion-router-sha", "promotion-runtime-ref", "promotion-runtime-sha", "promotion-shell-ref", "promotion-shell-sha", "promotion-target-ref", "publication-capability-digest", "publication-commit-evidence-digest", "publication-commit-evidence-path", "publication-commit-payload-root", "publication-commit-url", "release-candidate-action", "release-candidate-artifact", "release-candidate-recovery-receipt-artifact", "release-candidate-recovery-root", "release-propagation-work-artifact", "release-tail-declaration-root", "release-tail-receipt-roots-json", "release-tail-state-root", "release-tail-transaction-root", "release-tail-transaction-state" ], "outputCount": 40, "surface": "release-governance", "capabilityGroup": "reusable-build", "status": "active", "owner": "buildchain-workflows", "maturity": "active", "introducedVersion": "pre-3.0.2-alpha.4", "compatibilityPromise": "preserved-through-the-v3-major-line", "deprecationReplacement": "", "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line", "nonDuplicationRationale": "Existing workflow identity retained for caller compatibility and repository orchestration." }, { "id": "release-governance-reconcile", "path": ".github/workflows/release-governance-reconcile.yml", "reusable": true, "inputs": [ "apply", "branch", "buildchain-ref", "candidate-sha" ], "inputCount": 4, "secrets": [ "BUILDCHAIN_PROMOTION_TOKEN", "governance-token" ], "secretCount": 2, "outputs": [], "outputCount": 0, "surface": "release-governance", "capabilityGroup": "api-cli-reference", "status": "active", "owner": "buildchain-workflows", "maturity": "active", "introducedVersion": "pre-3.0.2-alpha.4", "compatibilityPromise": "preserved-through-the-v3-major-line", "deprecationReplacement": "", "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line", "nonDuplicationRationale": "Existing workflow identity retained for caller compatibility and repository orchestration." }, { "id": "release-line-bootstrap", "path": ".github/workflows/release-line-bootstrap.yml", "reusable": false, "inputs": [], "inputCount": 0, "secrets": [], "secretCount": 0, "outputs": [], "outputCount": 0, "surface": "release-governance", "capabilityGroup": "release-passport-trust", "status": "active", "owner": "buildchain-workflows", "maturity": "active", "introducedVersion": "pre-3.0.2-alpha.4", "compatibilityPromise": "preserved-through-the-v3-major-line", "deprecationReplacement": "", "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line", "nonDuplicationRationale": "Existing workflow identity retained for caller compatibility and repository orchestration." }, { "id": "release-new-version", "path": ".github/workflows/release-new-version.yml", "reusable": false, "inputs": [], "inputCount": 0, "secrets": [], "secretCount": 0, "outputs": [], "outputCount": 0, "surface": "repository-workflow", "capabilityGroup": "api-cli-reference", "status": "active", "owner": "buildchain-workflows", "maturity": "active", "introducedVersion": "pre-3.0.2-alpha.4", "compatibilityPromise": "preserved-through-the-v3-major-line", "deprecationReplacement": "", "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line", "nonDuplicationRationale": "Existing workflow identity retained for caller compatibility and repository orchestration." }, { "id": "release-propagation", "path": ".github/workflows/release-propagation.yml", "reusable": true, "inputs": [ "agent-work-context-json", "agent-work-mode", "buildchain-ref", "buildchain-repository", "downstream-base-ref", "downstream-branch", "downstream-prepare-command", "downstream-repository", "downstream-target", "downstream-update-command", "downstream-verify-command", "dry-run", "graph-json", "lock-path", "pr-body", "pr-title", "refresh-managed-readme-badges", "source-node", "upstream-release-json" ], "inputCount": 19, "secrets": [ "propagation-token" ], "secretCount": 1, "outputs": [ "controller-plan-artifact", "controller-plan-digest", "controller-plan-json", "controller-receipt-artifact", "controller-receipt-digest", "controller-receipt-json", "controller-receipt-status", "propagation-receipt-digest", "propagation-receipt-json", "propagation-work-artifact", "propagation-work-json", "propagation-work-next-action", "propagation-work-root" ], "outputCount": 13, "surface": "release-propagation", "capabilityGroup": "site-and-propagation", "status": "preview", "owner": "buildchain-workflows", "maturity": "preview", "introducedVersion": "pre-3.0.2-alpha.4", "compatibilityPromise": "preserved-through-the-v3-major-line", "deprecationReplacement": "", "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line", "nonDuplicationRationale": "Existing workflow identity retained for caller compatibility and repository orchestration." }, { "id": "release-tail", "path": ".github/workflows/release-tail.yml", "reusable": true, "inputs": [ "buildchain-ref", "declaration-path", "execute", "provider-bindings-path", "state-path" ], "inputCount": 5, "secrets": [ "http-token" ], "secretCount": 1, "outputs": [ "state-root", "transaction-root", "transaction-state" ], "outputCount": 3, "surface": "release-tail-provider-plane", "capabilityGroup": "release-passport-trust", "status": "active", "owner": "buildchain-workflows", "maturity": "active", "introducedVersion": "pre-3.0.2-alpha.4", "compatibilityPromise": "preserved-through-the-v3-major-line", "deprecationReplacement": "", "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line", "nonDuplicationRationale": "Existing workflow identity retained for caller compatibility and repository orchestration." }, { "id": "release-verify", "path": ".github/workflows/release-verify.yml", "reusable": false, "inputs": [], "inputCount": 0, "secrets": [], "secretCount": 0, "outputs": [], "outputCount": 0, "surface": "repository-workflow", "capabilityGroup": "api-cli-reference", "status": "active", "owner": "buildchain-workflows", "maturity": "active", "introducedVersion": "pre-3.0.2-alpha.4", "compatibilityPromise": "preserved-through-the-v3-major-line", "deprecationReplacement": "", "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line", "nonDuplicationRationale": "Existing workflow identity retained for caller compatibility and repository orchestration." }, { "id": "schedule-purge-artifacts", "path": ".github/workflows/schedule-purge-artifacts.yml", "reusable": false, "inputs": [], "inputCount": 0, "secrets": [], "secretCount": 0, "outputs": [], "outputCount": 0, "surface": "repository-workflow", "capabilityGroup": "api-cli-reference", "status": "active", "owner": "buildchain-workflows", "maturity": "active", "introducedVersion": "pre-3.0.2-alpha.4", "compatibilityPromise": "preserved-through-the-v3-major-line", "deprecationReplacement": "", "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line", "nonDuplicationRationale": "Existing workflow identity retained for caller compatibility and repository orchestration." }, { "id": "self-hosted-runner-smoke", "path": ".github/workflows/self-hosted-runner-smoke.yml", "reusable": false, "inputs": [], "inputCount": 0, "secrets": [], "secretCount": 0, "outputs": [], "outputCount": 0, "surface": "repository-workflow", "capabilityGroup": "api-cli-reference", "status": "compatibility-fixture", "owner": "buildchain-workflows", "maturity": "compatibility-fixture", "introducedVersion": "pre-3.0.2-alpha.4", "compatibilityPromise": "preserved-through-the-v3-major-line", "deprecationReplacement": "", "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line", "nonDuplicationRationale": "Existing workflow identity retained for caller compatibility and repository orchestration." }, { "id": "stable-candidate-patrol", "path": ".github/workflows/stable-candidate-patrol.yml", "reusable": true, "inputs": [ "auto-approve", "auto-merge", "auto-promote", "buildchain-ref", "buildchain-repository", "dry-run", "hold", "hold-reason", "ledger-ref", "merge-method", "minimum-soak-seconds", "release-now", "required-checks", "revoke-reason", "revoked-versions", "target-branch" ], "inputCount": 16, "secrets": [ "approval-token", "promotion-token" ], "secretCount": 2, "outputs": [ "promotion-pr", "result-path", "selected", "selected-sha", "selected-version", "stable-version" ], "outputCount": 6, "surface": "repository-patrol", "capabilityGroup": "governance-versioning", "status": "active", "owner": "buildchain-workflows", "maturity": "active", "introducedVersion": "pre-3.0.2-alpha.4", "compatibilityPromise": "preserved-through-the-v3-major-line", "deprecationReplacement": "", "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line", "nonDuplicationRationale": "Existing workflow identity retained for caller compatibility and repository orchestration." }, { "id": "v4-public-consumer-dogfood", "path": ".github/workflows/v4-public-consumer-dogfood.yml", "reusable": false, "inputs": [], "inputCount": 0, "secrets": [], "secretCount": 0, "outputs": [], "outputCount": 0, "surface": "repository-workflow", "capabilityGroup": "api-cli-reference", "status": "active", "owner": "buildchain-workflows", "maturity": "active", "introducedVersion": "pre-3.0.2-alpha.4", "compatibilityPromise": "preserved-through-the-v3-major-line", "deprecationReplacement": "", "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line", "nonDuplicationRationale": "Existing workflow identity retained for caller compatibility and repository orchestration." }, { "id": "v4-stage-capsule-canary", "path": ".github/workflows/v4-stage-capsule-canary.yml", "reusable": true, "inputs": [ "build-artifact-path", "consumer", "go-version", "install-artifact-path", "node-version", "verify-artifact-path" ], "inputCount": 6, "secrets": [], "secretCount": 0, "outputs": [], "outputCount": 0, "surface": "repository-workflow", "capabilityGroup": "api-cli-reference", "status": "active", "owner": "buildchain-workflows", "maturity": "active", "introducedVersion": "pre-3.0.2-alpha.4", "compatibilityPromise": "preserved-through-the-v3-major-line", "deprecationReplacement": "", "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line", "nonDuplicationRationale": "Existing workflow identity retained for caller compatibility and repository orchestration." }, { "id": "verify", "path": ".github/workflows/verify.yml", "reusable": false, "inputs": [], "inputCount": 0, "secrets": [], "secretCount": 0, "outputs": [], "outputCount": 0, "surface": "repository-workflow", "capabilityGroup": "api-cli-reference", "status": "active", "owner": "buildchain-workflows", "maturity": "active", "introducedVersion": "pre-3.0.2-alpha.4", "compatibilityPromise": "preserved-through-the-v3-major-line", "deprecationReplacement": "", "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line", "nonDuplicationRationale": "Existing workflow identity retained for caller compatibility and repository orchestration." } ], "actionSource": "actions/*/action.yml reverse input enumeration", "actions": [ { "id": "github-artifact-attestation", "path": "actions/github-artifact-attestation/action.yml", "inputs": [ "attestation-id", "attestation-url", "bundle-path", "expected-buildchain-ref", "expected-caller-repository", "expected-source-sha", "mode", "output-dir", "platform-manifest-path", "policy-json", "preparation-json", "release-passport-path", "subject-path" ], "inputCount": 13, "capabilityGroup": "release-passport-trust", "status": "active", "owner": "buildchain-actions", "maturity": "stable", "introducedVersion": "pre-3.0.2-alpha.4", "compatibilityPromise": "preserved-through-the-v3-major-line", "deprecationReplacement": "", "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line", "nonDuplicationRationale": "Existing action identity retained as the canonical composite or JavaScript action boundary." }, { "id": "macos-credential-island", "path": "actions/macos-credential-island/action.yml", "inputs": [ "artifact-id", "artifact-name", "artifact-relative-output", "artifact-stem", "buildchain-runtime-sha", "certificate-p12-base64", "certificate-password", "certificate-sha1", "entitlements-profile", "expected-bundle-id", "expected-team-id", "input-root", "notary-api-issuer", "notary-api-key-id", "notary-api-key-p8-base64", "output-root", "platform-id", "source-ref", "source-repository", "source-sha", "source-tree-sha" ], "inputCount": 21, "capabilityGroup": "api-cli-reference", "status": "active", "owner": "buildchain-actions", "maturity": "stable", "introducedVersion": "pre-3.0.2-alpha.4", "compatibilityPromise": "preserved-through-the-v3-major-line", "deprecationReplacement": "", "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line", "nonDuplicationRationale": "Existing action identity retained as the canonical composite or JavaScript action boundary." }, { "id": "promote-buildchain-ref", "path": "actions/promote-buildchain-ref/action.yml", "inputs": [ "allow-repository", "branch-protection-bypass-apps", "branch-protection-bypass-teams", "branch-protection-bypass-users", "declarative-release-tail", "dry-run", "expected-publication-version", "generated-pull-request-token", "generated-ref-update-token", "generated-status-check-token", "github-release", "github-release-artifact-paths", "github-release-notes", "github-release-title", "promote-only-release-candidate", "publication-capability-json", "publication-gate-aggregate-json", "publication-qualification-receipt-json", "publication-used-qualification-nonces-json", "publish-auth", "publish-command", "publish-dist-tag", "publish-evidence-path", "publish-mode", "publish-package-main", "publish-package-set-order", "publish-rematerialize-on-resume", "publish-required-artifacts-json", "publish-required-artifacts-path", "publish-sealed-bundle-manifest", "publish-sealed-bundle-root", "publish-source-locked", "publish-source-ref", "publish-source-sha", "publish-tooling-sha", "publish-transaction", "publish-transaction-override", "reconciliation-workspace", "release-candidate-build-summary-path", "release-candidate-family-assignment-id", "release-candidate-family-evidence-required", "release-candidate-family-evidence-root", "release-candidate-family-initiative-id", "release-candidate-passport-path", "release-candidate-version", "release-material-sha", "release-passport", "release-passport-attachment-command", "release-passport-build-summary-path", "release-passport-buildchain-self-kfd", "release-passport-evidence-command", "release-passport-evidence-jsons", "release-passport-github-artifact-attestation-policy-jsons", "release-passport-impact-json", "release-passport-invariant-passport-command", "release-passport-invariant-passport-jsons", "release-passport-kfd-1-witness-jsons", "release-passport-kfd-2-claim-jsons", "release-passport-kfd-3-artifact-verify-command", "release-passport-kfd-3-artifact-witness-jsons", "release-passport-kfd-3-prebuild-witness-jsons", "release-passport-kfd-adopter-manifest-json", "release-passport-kfd-product-gate-jsons", "release-passport-kfd-support-matrix-json", "release-passport-output-dir", "release-passport-platform-manifest-paths", "release-passport-product-name", "release-passport-promotion-routing-json", "release-tail-state-path", "require-governance", "require-publication-qualification", "require-publish-source-lock", "require-version-state", "required-status-check", "sha", "tags", "target-ref", "token", "transaction-state-path", "verification-command" ], "inputCount": 80, "capabilityGroup": "release-passport-trust", "status": "active", "owner": "buildchain-actions", "maturity": "stable", "introducedVersion": "pre-3.0.2-alpha.4", "compatibilityPromise": "preserved-through-the-v3-major-line", "deprecationReplacement": "", "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line", "nonDuplicationRationale": "Existing action identity retained as the canonical composite or JavaScript action boundary." }, { "id": "release-tail", "path": "actions/release-tail/action.yml", "inputs": [ "declaration", "execute", "github-token", "http-token", "provider-bindings", "state-path" ], "inputCount": 6, "capabilityGroup": "release-passport-trust", "status": "active", "owner": "buildchain-actions", "maturity": "stable", "introducedVersion": "pre-3.0.2-alpha.4", "compatibilityPromise": "preserved-through-the-v3-major-line", "deprecationReplacement": "", "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line", "nonDuplicationRationale": "Existing action identity retained as the canonical composite or JavaScript action boundary." }, { "id": "report-buildchain-issue", "path": "actions/report-buildchain-issue/action.yml", "inputs": [ "artifact-url", "body", "body-file", "buildchain-ref", "buildchain-version", "channel", "comment-cooldown-hours", "consumer-ref", "consumer-repository", "consumer-sha", "diagnosis", "diagnostics-path", "diagnostics-url", "dry-run", "fail-on-error", "failure-code", "fingerprint", "friction-class", "heavy-builds-json", "job", "labels", "max-body-bytes", "mode", "next-action", "passport-path", "passport-url", "pull-request", "related-runs-json", "release-intent", "report-kind", "repository", "run-attempt", "run-id", "run-url", "source-ref", "source-sha", "source-tree-hash", "summary", "target-repository", "title", "token", "version", "workflow" ], "inputCount": 43, "capabilityGroup": "observability-diagnostics", "status": "active", "owner": "buildchain-actions", "maturity": "stable", "introducedVersion": "pre-3.0.2-alpha.4", "compatibilityPromise": "preserved-through-the-v3-major-line", "deprecationReplacement": "", "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line", "nonDuplicationRationale": "Existing action identity retained as the canonical composite or JavaScript action boundary." }, { "id": "run-lifecycle", "path": "actions/run-lifecycle/action.yml", "inputs": [ "artifact-name", "artifact-paths", "command", "cwd", "diagnostics-artifact-name", "diagnostics-path", "expected-artifacts-json", "manifest-artifact-name", "manifest-path", "platform-id", "platform-name", "process-sample-interval-ms", "process-samples-path", "process-summary-path", "process-summary-required", "requested-parallelism", "required", "sample-process-tree", "stage", "substage-evidence-path", "summary-path", "timeout-minutes" ], "inputCount": 22, "capabilityGroup": "reusable-build", "status": "active", "owner": "buildchain-actions", "maturity": "stable", "introducedVersion": "pre-3.0.2-alpha.4", "compatibilityPromise": "preserved-through-the-v3-major-line", "deprecationReplacement": "", "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line", "nonDuplicationRationale": "Existing action identity retained as the canonical composite or JavaScript action boundary." }, { "id": "validate-config", "path": "actions/validate-config/action.yml", "inputs": [ "config-required", "require-lifecycle-stages", "require-version-state" ], "inputCount": 3, "capabilityGroup": "reusable-build", "status": "active", "owner": "buildchain-actions", "maturity": "stable", "introducedVersion": "pre-3.0.2-alpha.4", "compatibilityPromise": "preserved-through-the-v3-major-line", "deprecationReplacement": "", "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line", "nonDuplicationRationale": "Existing action identity retained as the canonical composite or JavaScript action boundary." } ] }