{ "schema": "buildchain.consumer-upgrade/v1", "source": { "ref": "v4.1.3", "sha": "1a35569933b727fd4eabe13147ac5fdb2abc05d0" }, "entries": [ { "path": ".github/workflows/public-build-demo.yml", "target": ".github/workflows/.build-demo.yml", "interface": { "workflow_call": { "inputs": { "source-ref": { "default": "", "type": "string", "required": false }, "binary-artifact-name": { "type": "string", "required": true }, "binary-artifact-digest": { "type": "string", "required": true }, "scenario-path": { "default": ".buildchain/auditable-demo.json", "type": "string", "required": false }, "renderer-image": { "type": "string", "required": true }, "render-media": { "default": false, "type": "boolean", "required": false }, "render-failure-advisory": { "description": "Preserve a required Gate while reporting full-media render failure without failing the caller", "default": false, "type": "boolean", "required": false }, "media-profile": { "default": "responsive-web-delivery-v1", "type": "string", "required": false }, "materialize": { "default": false, "type": "boolean", "required": false }, "materialize-base-ref": { "default": "", "type": "string", "required": false }, "artifact-retention-days": { "default": 14, "type": "number", "required": false }, "runtime-ref": { "description": "Transient execution runtime; empty selects the consumer lock.", "type": "string", "required": false, "default": "" }, "contract-lock": { "description": "Optional consumer runtime lock path.", "type": "string", "required": false, "default": "" }, "runtime-selection": { "description": "Entry-resolved runtime transport for nested workflow jobs.", "type": "string", "required": false, "default": "" } }, "secrets": { "DEMO_UPDATE_TOKEN": { "required": false } }, "outputs": { "source-sha": { "value": "${{ jobs.capture.outputs.source-sha }}" }, "capture-artifact-name": { "value": "${{ jobs.capture.outputs.capture-artifact-name }}" }, "capture-artifact-digest": { "value": "${{ jobs.capture.outputs.capture-artifact-digest }}" }, "evidence-artifact-name": { "value": "${{ jobs.qualify.outputs.evidence-artifact-name }}" }, "evidence-artifact-digest": { "value": "${{ jobs.qualify.outputs.evidence-artifact-digest }}" }, "render-result": { "value": "${{ jobs.qualify.outputs.render-result }}" }, "publication-pr-url": { "value": "${{ jobs.publish.outputs.pr-url }}" } } } }, "permissions": { "actions": "read", "contents": "read" }, "interfaceSource": "on:\n workflow_call:\n inputs:\n source-ref:\n default: \"\"\n type: string\n required: false\n binary-artifact-name:\n type: string\n required: true\n binary-artifact-digest:\n type: string\n required: true\n scenario-path:\n default: .buildchain/auditable-demo.json\n type: string\n required: false\n renderer-image:\n type: string\n required: true\n render-media:\n default: false\n type: boolean\n required: false\n render-failure-advisory:\n description: Preserve a required Gate while reporting full-media render failure without failing the\n caller\n default: false\n type: boolean\n required: false\n media-profile:\n default: responsive-web-delivery-v1\n type: string\n required: false\n materialize:\n default: false\n type: boolean\n required: false\n materialize-base-ref:\n default: \"\"\n type: string\n required: false\n artifact-retention-days:\n default: 14\n type: number\n required: false\n runtime-ref:\n description: Transient execution runtime; empty selects the consumer lock.\n type: string\n required: false\n default: \"\"\n contract-lock:\n description: Optional consumer runtime lock path.\n type: string\n required: false\n default: \"\"\n runtime-selection:\n description: Entry-resolved runtime transport for nested workflow jobs.\n type: string\n required: false\n default: \"\"\n secrets:\n DEMO_UPDATE_TOKEN:\n required: false\n outputs:\n source-sha:\n value: ${{ jobs.capture.outputs.source-sha }}\n capture-artifact-name:\n value: ${{ jobs.capture.outputs.capture-artifact-name }}\n capture-artifact-digest:\n value: ${{ jobs.capture.outputs.capture-artifact-digest }}\n evidence-artifact-name:\n value: ${{ jobs.qualify.outputs.evidence-artifact-name }}\n evidence-artifact-digest:\n value: ${{ jobs.qualify.outputs.evidence-artifact-digest }}\n render-result:\n value: ${{ jobs.qualify.outputs.render-result }}\n publication-pr-url:\n value: ${{ jobs.publish.outputs.pr-url }}" }, { "path": ".github/workflows/public-release-web.yml", "target": ".github/workflows/.release-web.yml", "interface": { "workflow_call": { "inputs": { "working-directory": { "default": ".", "type": "string", "required": false }, "node-version": { "default": "24", "type": "string", "required": false }, "build-command": { "default": "", "type": "string", "required": false }, "verify-command": { "default": "", "type": "string", "required": false }, "artifact-path": { "default": "dist", "type": "string", "required": false }, "aws-region": { "default": "us-east-1", "type": "string", "required": false }, "preview-apply": { "default": false, "type": "boolean", "required": false }, "preview-cleanup-apply": { "default": false, "type": "boolean", "required": false }, "preview-aws-role-arn": { "default": "", "type": "string", "required": false }, "preview-environment": { "default": "preview", "type": "string", "required": false }, "preview-comment": { "default": true, "type": "boolean", "required": false }, "staging-apply": { "default": false, "type": "boolean", "required": false }, "staging-aws-role-arn": { "default": "", "type": "string", "required": false }, "staging-environment": { "default": "staging", "type": "string", "required": false }, "production-apply": { "description": "Enable production deployment capability; each production apply still requires a trusted event decision.", "default": false, "type": "boolean", "required": false }, "production-approved": { "default": false, "type": "boolean", "required": false }, "production-source-sha": { "description": "Optional exact reviewed consumer source SHA for a trusted workflow_dispatch production activation.", "default": "", "type": "string", "required": false }, "production-release-on-main": { "description": "Treat a reviewed release pull request merge into main as production approval.", "default": false, "type": "boolean", "required": false }, "production-release-label": { "description": "Required pull request label for production release PR merges.", "default": "buildchain-release", "type": "string", "required": false }, "production-release-head-prefix": { "description": "Optional source branch prefix required for production release PR merges.", "default": "release/", "type": "string", "required": false }, "production-release-branch-channel": { "description": "Branch channel slug for Buildchain-opened production release PRs.", "default": "production", "type": "string", "required": false }, "production-release-pr-mode": { "description": "Production release PR handoff mode: auto, summary-only, or disabled.", "default": "auto", "type": "string", "required": false }, "production-release-app-client-id": { "description": "Optional GitHub App client id used to create production release PRs. Requires production-release-app-private-key.", "default": "", "type": "string", "required": false }, "fail-on-release-pr-error": { "description": "Fail the workflow when automatic production release PR creation cannot complete.", "default": false, "type": "boolean", "required": false }, "production-aws-role-arn": { "default": "", "type": "string", "required": false }, "production-environment": { "default": "production", "type": "string", "required": false }, "publication-admission-json": { "description": "Fresh sealed admission for production deploy; ignored by preview and staging lanes.", "default": "", "type": "string", "required": false }, "publication-runner-provenance-json": { "description": "Qualified runner provenance bound by the production admission.", "default": "", "type": "string", "required": false }, "publication-control-plane-audit-json": { "description": "Fresh consumer control-plane audit bound to production-environment.", "default": "", "type": "string", "required": false }, "github-governance-receipt-json": { "description": "Fresh qualifying governance receipt for the exact production repository and target ref", "default": "", "type": "string", "required": false }, "publication-gate-aggregate-json": { "description": "Optional complete Gate aggregate for the external sealed-evidence compatibility path.", "default": "", "type": "string", "required": false }, "publication-expected-json": { "description": "Consumer-owned exact production source, runtime, Gate, artifact, target, and channel bindings.", "default": "", "type": "string", "required": false }, "publication-used-nonces-json": { "description": "Consumer-owned JSON array of already consumed admission nonces.", "default": "[]", "type": "string", "required": false }, "release-feedback-actor-privacy": { "description": "Actor identity mode for web-surface release feedback passports: public, redacted, or private-ref.", "default": "public", "type": "string", "required": false }, "runtime-ref": { "description": "Transient execution runtime; empty selects the consumer lock.", "type": "string", "required": false, "default": "" }, "contract-lock": { "description": "Optional consumer runtime lock path.", "type": "string", "required": false, "default": "" }, "runtime-selection": { "description": "Entry-resolved runtime transport for nested workflow jobs.", "type": "string", "required": false, "default": "" } }, "secrets": { "production-release-app-private-key": { "description": "Private key for production-release-app-client-id. When set, Buildchain creates production release PRs with that GitHub App installation token.", "required": false }, "production-release-pr-token": { "description": "Optional narrowly scoped token for production release PR creation.", "required": false } }, "outputs": { "web-surface-channel": { "description": "Planned web-surface channel", "value": "${{ jobs.plan.outputs.web-surface-channel }}" }, "web-surface-alias": { "description": "Planned preview alias when applicable", "value": "${{ jobs.plan.outputs.web-surface-alias }}" }, "web-surface-url": { "description": "Planned deployment URL", "value": "${{ jobs.plan.outputs.web-surface-url }}" }, "web-surface-urls-json": { "description": "All planned deployment URLs keyed by surface name", "value": "${{ jobs.plan.outputs.web-surface-urls-json }}" }, "web-surface-manifest-json": { "description": "Deployment manifest JSON when a deployment plan was created", "value": "${{ jobs.plan.outputs.web-surface-manifest-json }}" }, "web-surface-cleanup-plan-json": { "description": "Cleanup plan JSON when a cleanup plan was created", "value": "${{ jobs.plan.outputs.web-surface-cleanup-plan-json }}" }, "preview-apply-result-json": { "description": "Preview deploy apply result JSON when preview apply ran", "value": "${{ jobs.preview-apply.outputs.preview-apply-result-json }}" }, "preview-cleanup-result-json": { "description": "Preview cleanup apply result JSON when cleanup apply ran", "value": "${{ jobs.preview-cleanup.outputs.preview-cleanup-result-json }}" }, "staging-apply-result-json": { "description": "Staging deploy apply result JSON when staging apply ran", "value": "${{ jobs.staging-apply.outputs.staging-apply-result-json }}" }, "production-apply-result-json": { "description": "Production deploy apply result JSON when production apply ran", "value": "${{ jobs.production-apply.outputs.production-apply-result-json }}" }, "production-release-pr-url": { "description": "Production release PR URL opened after staging apply", "value": "${{ jobs.open-production-release-pr.outputs.production-release-pr-url }}" }, "release-pr-status": { "description": "Production release PR handoff status: created, updated, permission-denied, summary-only, disabled, or failed", "value": "${{ jobs.open-production-release-pr.outputs.release-pr-status }}" }, "buildchain-runtime-ref": { "description": "Resolved Buildchain runtime ref", "value": "${{ jobs.execution-runtime.outputs.runtime-ref }}" }, "buildchain-runtime-sha": { "description": "Resolved immutable Buildchain runtime SHA", "value": "${{ jobs.execution-runtime.outputs.runtime-sha }}" }, "buildchain-runtime-class": { "description": "Runtime stability class: stable, alpha, train, exact-sha, or development", "value": "${{ jobs.execution-runtime.outputs.runtime-class }}" }, "buildchain-runtime-override": { "description": "Whether a train or exact-SHA buildchain-ref override was used", "value": "${{ jobs.execution-runtime.outputs.runtime-override }}" }, "controller-plan-artifact": { "description": "Controller plan artifact name", "value": "${{ jobs.controller-plan.outputs.controller-plan-artifact }}" }, "controller-plan-json": { "description": "Compact controller plan JSON", "value": "${{ jobs.controller-plan.outputs.controller-plan-json }}" }, "controller-plan-digest": { "description": "Controller plan digest", "value": "${{ jobs.controller-plan.outputs.controller-plan-digest }}" }, "controller-receipt-artifact": { "description": "Controller receipt artifact name", "value": "${{ jobs.controller-receipt.outputs.controller-receipt-artifact }}" }, "controller-receipt-json": { "description": "Compact controller receipt JSON", "value": "${{ jobs.controller-receipt.outputs.controller-receipt-json }}" }, "controller-receipt-digest": { "description": "Controller receipt digest", "value": "${{ jobs.controller-receipt.outputs.controller-receipt-digest }}" }, "controller-receipt-status": { "description": "Controller receipt status", "value": "${{ jobs.controller-receipt.outputs.controller-receipt-status }}" } } } }, "permissions": { "actions": "read", "contents": "read" }, "interfaceSource": "on:\n workflow_call:\n inputs:\n working-directory:\n default: .\n type: string\n required: false\n node-version:\n default: \"24\"\n type: string\n required: false\n build-command:\n default: \"\"\n type: string\n required: false\n verify-command:\n default: \"\"\n type: string\n required: false\n artifact-path:\n default: dist\n type: string\n required: false\n aws-region:\n default: us-east-1\n type: string\n required: false\n preview-apply:\n default: false\n type: boolean\n required: false\n preview-cleanup-apply:\n default: false\n type: boolean\n required: false\n preview-aws-role-arn:\n default: \"\"\n type: string\n required: false\n preview-environment:\n default: preview\n type: string\n required: false\n preview-comment:\n default: true\n type: boolean\n required: false\n staging-apply:\n default: false\n type: boolean\n required: false\n staging-aws-role-arn:\n default: \"\"\n type: string\n required: false\n staging-environment:\n default: staging\n type: string\n required: false\n production-apply:\n description: Enable production deployment capability; each production apply still requires a trusted\n event decision.\n default: false\n type: boolean\n required: false\n production-approved:\n default: false\n type: boolean\n required: false\n production-source-sha:\n description: Optional exact reviewed consumer source SHA for a trusted workflow_dispatch production\n activation.\n default: \"\"\n type: string\n required: false\n production-release-on-main:\n description: Treat a reviewed release pull request merge into main as production approval.\n default: false\n type: boolean\n required: false\n production-release-label:\n description: Required pull request label for production release PR merges.\n default: buildchain-release\n type: string\n required: false\n production-release-head-prefix:\n description: Optional source branch prefix required for production release PR merges.\n default: release/\n type: string\n required: false\n production-release-branch-channel:\n description: Branch channel slug for Buildchain-opened production release PRs.\n default: production\n type: string\n required: false\n production-release-pr-mode:\n description: \"Production release PR handoff mode: auto, summary-only, or disabled.\"\n default: auto\n type: string\n required: false\n production-release-app-client-id:\n description: Optional GitHub App client id used to create production release PRs. Requires\n production-release-app-private-key.\n default: \"\"\n type: string\n required: false\n fail-on-release-pr-error:\n description: Fail the workflow when automatic production release PR creation cannot complete.\n default: false\n type: boolean\n required: false\n production-aws-role-arn:\n default: \"\"\n type: string\n required: false\n production-environment:\n default: production\n type: string\n required: false\n publication-admission-json:\n description: Fresh sealed admission for production deploy; ignored by preview and staging lanes.\n default: \"\"\n type: string\n required: false\n publication-runner-provenance-json:\n description: Qualified runner provenance bound by the production admission.\n default: \"\"\n type: string\n required: false\n publication-control-plane-audit-json:\n description: Fresh consumer control-plane audit bound to production-environment.\n default: \"\"\n type: string\n required: false\n github-governance-receipt-json:\n description: Fresh qualifying governance receipt for the exact production repository and target ref\n default: \"\"\n type: string\n required: false\n publication-gate-aggregate-json:\n description: Optional complete Gate aggregate for the external sealed-evidence compatibility path.\n default: \"\"\n type: string\n required: false\n publication-expected-json:\n description: Consumer-owned exact production source, runtime, Gate, artifact, target, and channel\n bindings.\n default: \"\"\n type: string\n required: false\n publication-used-nonces-json:\n description: Consumer-owned JSON array of already consumed admission nonces.\n default: \"[]\"\n type: string\n required: false\n release-feedback-actor-privacy:\n description: \"Actor identity mode for web-surface release feedback passports: public, redacted, or\n private-ref.\"\n default: public\n type: string\n required: false\n runtime-ref:\n description: Transient execution runtime; empty selects the consumer lock.\n type: string\n required: false\n default: \"\"\n contract-lock:\n description: Optional consumer runtime lock path.\n type: string\n required: false\n default: \"\"\n runtime-selection:\n description: Entry-resolved runtime transport for nested workflow jobs.\n type: string\n required: false\n default: \"\"\n secrets:\n production-release-app-private-key:\n description: Private key for production-release-app-client-id. When set, Buildchain creates\n production release PRs with that GitHub App installation token.\n required: false\n production-release-pr-token:\n description: Optional narrowly scoped token for production release PR creation.\n required: false\n outputs:\n web-surface-channel:\n description: Planned web-surface channel\n value: ${{ jobs.plan.outputs.web-surface-channel }}\n web-surface-alias:\n description: Planned preview alias when applicable\n value: ${{ jobs.plan.outputs.web-surface-alias }}\n web-surface-url:\n description: Planned deployment URL\n value: ${{ jobs.plan.outputs.web-surface-url }}\n web-surface-urls-json:\n description: All planned deployment URLs keyed by surface name\n value: ${{ jobs.plan.outputs.web-surface-urls-json }}\n web-surface-manifest-json:\n description: Deployment manifest JSON when a deployment plan was created\n value: ${{ jobs.plan.outputs.web-surface-manifest-json }}\n web-surface-cleanup-plan-json:\n description: Cleanup plan JSON when a cleanup plan was created\n value: ${{ jobs.plan.outputs.web-surface-cleanup-plan-json }}\n preview-apply-result-json:\n description: Preview deploy apply result JSON when preview apply ran\n value: ${{ jobs.preview-apply.outputs.preview-apply-result-json }}\n preview-cleanup-result-json:\n description: Preview cleanup apply result JSON when cleanup apply ran\n value: ${{ jobs.preview-cleanup.outputs.preview-cleanup-result-json }}\n staging-apply-result-json:\n description: Staging deploy apply result JSON when staging apply ran\n value: ${{ jobs.staging-apply.outputs.staging-apply-result-json }}\n production-apply-result-json:\n description: Production deploy apply result JSON when production apply ran\n value: ${{ jobs.production-apply.outputs.production-apply-result-json }}\n production-release-pr-url:\n description: Production release PR URL opened after staging apply\n value: ${{ jobs.open-production-release-pr.outputs.production-release-pr-url }}\n release-pr-status:\n description: \"Production release PR handoff status: created, updated, permission-denied,\n summary-only, disabled, or failed\"\n value: ${{ jobs.open-production-release-pr.outputs.release-pr-status }}\n buildchain-runtime-ref:\n description: Resolved Buildchain runtime ref\n value: ${{ jobs.execution-runtime.outputs.runtime-ref }}\n buildchain-runtime-sha:\n description: Resolved immutable Buildchain runtime SHA\n value: ${{ jobs.execution-runtime.outputs.runtime-sha }}\n buildchain-runtime-class:\n description: \"Runtime stability class: stable, alpha, train, exact-sha, or development\"\n value: ${{ jobs.execution-runtime.outputs.runtime-class }}\n buildchain-runtime-override:\n description: Whether a train or exact-SHA buildchain-ref override was used\n value: ${{ jobs.execution-runtime.outputs.runtime-override }}\n controller-plan-artifact:\n description: Controller plan artifact name\n value: ${{ jobs.controller-plan.outputs.controller-plan-artifact }}\n controller-plan-json:\n description: Compact controller plan JSON\n value: ${{ jobs.controller-plan.outputs.controller-plan-json }}\n controller-plan-digest:\n description: Controller plan digest\n value: ${{ jobs.controller-plan.outputs.controller-plan-digest }}\n controller-receipt-artifact:\n description: Controller receipt artifact name\n value: ${{ jobs.controller-receipt.outputs.controller-receipt-artifact }}\n controller-receipt-json:\n description: Compact controller receipt JSON\n value: ${{ jobs.controller-receipt.outputs.controller-receipt-json }}\n controller-receipt-digest:\n description: Controller receipt digest\n value: ${{ jobs.controller-receipt.outputs.controller-receipt-digest }}\n controller-receipt-status:\n description: Controller receipt status\n value: ${{ jobs.controller-receipt.outputs.controller-receipt-status }}\n" }, { "path": ".github/workflows/public-release-signing-authority.yml", "target": ".github/workflows/.release-signing-authority.yml", "interface": { "workflow_dispatch": { "inputs": { "source-repository": { "description": "Consumer owner/repository containing sealed request artifacts", "required": true, "type": "string" }, "source-run-id": { "description": "Consumer workflow run containing sealed request artifacts", "required": true, "type": "string" }, "source-run-attempt": { "description": "Exact consumer workflow attempt that sealed the request artifact", "required": true, "type": "string" }, "request-artifact-pattern": { "description": "Exact/pattern name of Buildchain-sealed request artifacts", "required": true, "type": "string" }, "expected-request-root": { "description": "Canonical sha256 root of the exact sealed request index", "required": true, "type": "string" }, "result-artifact-name": { "description": "Globally unique immutable result artifact name", "required": true, "type": "string" }, "correlation-id": { "description": "Consumer-generated non-secret correlation identifier", "required": true, "type": "string" }, "runtime-ref": { "description": "Transient execution runtime; empty selects the consumer lock.", "type": "string", "required": false, "default": "" }, "contract-lock": { "description": "Optional consumer runtime lock path.", "type": "string", "required": false, "default": "" } } } }, "permissions": { "contents": "read" }, "interfaceSource": "on:\n workflow_dispatch:\n inputs:\n source-repository:\n description: Consumer owner/repository containing sealed request artifacts\n required: true\n type: string\n source-run-id:\n description: Consumer workflow run containing sealed request artifacts\n required: true\n type: string\n source-run-attempt:\n description: Exact consumer workflow attempt that sealed the request artifact\n required: true\n type: string\n request-artifact-pattern:\n description: Exact/pattern name of Buildchain-sealed request artifacts\n required: true\n type: string\n expected-request-root:\n description: Canonical sha256 root of the exact sealed request index\n required: true\n type: string\n result-artifact-name:\n description: Globally unique immutable result artifact name\n required: true\n type: string\n correlation-id:\n description: Consumer-generated non-secret correlation identifier\n required: true\n type: string\n runtime-ref:\n description: Transient execution runtime; empty selects the consumer lock.\n type: string\n required: false\n default: \"\"\n contract-lock:\n description: Optional consumer runtime lock path.\n type: string\n required: false\n default: \"\"" }, { "path": ".github/workflows/public-ops-bootstrap.yml", "target": ".github/workflows/.ops-bootstrap.yml", "interface": { "workflow_call": { "inputs": { "request-json": { "description": "Versioned exact-candidate request envelope", "required": true, "type": "string" }, "runtime-ref": { "description": "Transient execution runtime; empty selects the consumer lock.", "type": "string", "required": false, "default": "" }, "contract-lock": { "description": "Optional consumer runtime lock path.", "type": "string", "required": false, "default": "" }, "runtime-selection": { "description": "Entry-resolved runtime transport for nested workflow jobs.", "type": "string", "required": false, "default": "" } }, "outputs": { "runtime-sha": { "description": "Exact admitted Buildchain runtime SHA", "value": "${{ jobs.admit.outputs.runtime-sha }}" }, "request-root": { "description": "Canonical request root", "value": "${{ jobs.admit.outputs.request-root }}" }, "admission-root": { "description": "Candidate-tree admission policy root", "value": "${{ jobs.admit.outputs.admission-root }}" }, "result-root": { "description": "Candidate result root", "value": "${{ jobs.execute.outputs.result-root }}" }, "result-json": { "description": "Rooted candidate result for schema-derived facade output projection", "value": "${{ jobs.execute.outputs.result-json }}" }, "terminal-receipt-json": { "description": "Terminal receipt with exact runtime and review lineage", "value": "${{ jobs.settle.outputs.terminal-receipt-json }}" }, "terminal-receipt-root": { "description": "Terminal receipt root", "value": "${{ jobs.settle.outputs.terminal-receipt-root }}" } } } }, "permissions": null, "interfaceSource": "on:\n workflow_call:\n inputs:\n request-json:\n description: Versioned exact-candidate request envelope\n required: true\n type: string\n runtime-ref:\n description: Transient execution runtime; empty selects the consumer lock.\n type: string\n required: false\n default: \"\"\n contract-lock:\n description: Optional consumer runtime lock path.\n type: string\n required: false\n default: \"\"\n runtime-selection:\n description: Entry-resolved runtime transport for nested workflow jobs.\n type: string\n required: false\n default: \"\"\n outputs:\n runtime-sha:\n description: Exact admitted Buildchain runtime SHA\n value: ${{ jobs.admit.outputs.runtime-sha }}\n request-root:\n description: Canonical request root\n value: ${{ jobs.admit.outputs.request-root }}\n admission-root:\n description: Candidate-tree admission policy root\n value: ${{ jobs.admit.outputs.admission-root }}\n result-root:\n description: Candidate result root\n value: ${{ jobs.execute.outputs.result-root }}\n result-json:\n description: Rooted candidate result for schema-derived facade output projection\n value: ${{ jobs.execute.outputs.result-json }}\n terminal-receipt-json:\n description: Terminal receipt with exact runtime and review lineage\n value: ${{ jobs.settle.outputs.terminal-receipt-json }}\n terminal-receipt-root:\n description: Terminal receipt root\n value: ${{ jobs.settle.outputs.terminal-receipt-root }}" }, { "path": ".github/workflows/build.yml", "target": ".github/workflows/.build-candidate.yml", "interface": { "workflow_call": { "inputs": { "buildchain-channel": { "description": "Buildchain runtime channel: auto, alpha, or stable", "default": "auto", "type": "string", "required": false }, "buildchain-alpha-contract-lock-path": { "description": "Consumer-owned contract lock selected for the alpha channel", "default": ".buildchain/alpha-contract-lock.json", "type": "string", "required": false }, "buildchain-stable-contract-lock-path": { "description": "Consumer-owned contract lock selected for the stable channel", "default": ".buildchain/contract-lock.json", "type": "string", "required": false }, "buildchain-repository": { "default": "kungfu-systems/buildchain", "type": "string", "required": false }, "buildchain-ref": { "description": "Official floating Buildchain channel, protected authority, or a temporary train/SHA for trusted manual validation.", "default": "", "type": "string", "required": false }, "buildchain-expected-channel": { "description": "Explicit stable or alpha lane expected by a trusted channel router when the workflow shell ref is opaque", "default": "", "type": "string", "required": false }, "buildchain-expected-major": { "description": "Explicit Buildchain major expected by a trusted channel router when the workflow shell ref is opaque", "default": "", "type": "string", "required": false }, "buildchain-contract-lock-path": { "description": "Consumer-owned Buildchain contract lock path", "default": "", "type": "string", "required": false }, "buildchain-contract-compatibility-policy": { "description": "Contract compatibility policy: major-compatible, allow-additive, or exact", "default": "major-compatible", "type": "string", "required": false }, "buildchain-contract-drift-issue-mode": { "description": "Consumer issue behavior for Buildchain floating-ref contract drift: off, breaking-only, or compatible-and-breaking", "default": "compatible-and-breaking", "type": "string", "required": false }, "working-directory": { "default": ".", "type": "string", "required": false }, "runner-preset": { "description": "Runner preset: github-hosted, kungfu-v4-self-hosted, aws-us-codebuild-linux, aws-us-ec2-windows-jit, aws-us-ec2-macos-jit, or custom with platforms-json", "default": "github-hosted", "type": "string", "required": false }, "aws-codebuild-project": { "description": "Required CodeBuild project name for the explicit aws-us-codebuild-linux burst preset", "default": "", "type": "string", "required": false }, "aws-ec2-windows-runner-label": { "description": "Required unique card-scoped JIT label for the explicit aws-us-ec2-windows-jit burst preset", "default": "", "type": "string", "required": false }, "aws-ec2-macos-runner-label": { "description": "Required unique campaign-scoped JIT label for the explicit aws-us-ec2-macos-jit burst preset", "default": "", "type": "string", "required": false }, "platforms-json": { "description": "Optional custom JSON array of platform objects: id, name, runner JSON string, and optional githubHosted boolean", "default": "", "type": "string", "required": false }, "self-hosted-offline-fallback": { "description": "Route each supported exact-label self-hosted lane to its GitHub-hosted runner when no matching runner is online", "default": false, "type": "boolean", "required": false }, "control-runner-json": { "description": "JSON runner-label array for trusted control-plane jobs", "default": "[\"ubuntu-24.04\"]", "type": "string", "required": false }, "artifact-finalization-command": { "description": "Optional consumer verification command over final artifact bytes before manifest resealing", "default": "", "type": "string", "required": false }, "artifact-finalization-on-platform": { "description": "Run trusted artifact finalization on each GitHub-hosted platform runner instead of the control runner", "default": false, "type": "boolean", "required": false }, "fail-fast": { "description": "Cancel sibling platform lanes after a required matrix failure; false retains all-platform diagnostics", "default": false, "type": "boolean", "required": false }, "linux-container-preset": { "description": "Optional Linux job container preset: kungfu-verify, none, or custom with linux-container-image", "default": "", "type": "string", "required": false }, "linux-container-image": { "description": "Optional explicit Linux job container image, preferably pinned by digest", "default": "", "type": "string", "required": false }, "require-trusted-event": { "default": true, "type": "boolean", "required": false }, "untrusted-policy": { "description": "fail or skip when an untrusted fork event asks for build execution", "default": "fail", "type": "string", "required": false }, "publish-channel": { "description": "Publish channel requested by the caller: none, alpha, release, major, or a custom channel from publish-refs-json", "default": "none", "type": "string", "required": false }, "publish-refs-json": { "description": "Optional JSON object mapping publish channels to allowed Git ref regular expressions", "default": "", "type": "string", "required": false }, "publish-source-ref": { "description": "Optional source branch such as publish-gate/alpha// to resolve and lock before build", "default": "", "type": "string", "required": false }, "publish-anchor-request-json": { "description": "Required JSON request when publish-source-ref resolves to publish-gate/anchor", "default": "", "type": "string", "required": false }, "publish-registry": { "description": "Registry recorded in the resolved publish source manifest", "default": "https://registry.npmjs.org/", "type": "string", "required": false }, "setup-node": { "default": true, "type": "boolean", "required": false }, "node-version": { "default": "24", "type": "string", "required": false }, "setup-rust": { "description": "Install a Rust toolchain for native lifecycle jobs", "default": false, "type": "boolean", "required": false }, "rust-toolchain": { "description": "Rust toolchain installed when setup-rust is enabled", "default": "stable", "type": "string", "required": false }, "rustup-dist-server": { "description": "Optional rustup distribution mirror; empty uses the official Rust server", "default": "", "type": "string", "required": false }, "rustup-update-root": { "description": "Optional rustup self-update mirror; empty uses the official Rust server", "default": "", "type": "string", "required": false }, "cargo-registry-index": { "description": "Optional crates.io-compatible Cargo registry index; empty uses the Cargo default", "default": "", "type": "string", "required": false }, "install-command": { "default": "", "type": "string", "required": false }, "build-command": { "default": "", "type": "string", "required": false }, "verify-command": { "default": "", "type": "string", "required": false }, "verify-substage-evidence-path": { "description": "Optional lifecycle verify substage evidence path produced by the consumer command", "default": "", "type": "string", "required": false }, "kfd-agent-hub": { "description": "Agent Hub conformance mode: off or auto. Auto reads .buildchain/kfd/agent-hub.json and runs the fixed KFD suite.", "default": "off", "type": "string", "required": false }, "lifecycle-timeout-minutes": { "description": "Maximum minutes for the build matrix job and fallback timeout for each lifecycle stage", "default": 120, "type": "number", "required": false }, "require-install": { "default": false, "type": "boolean", "required": false }, "require-build": { "default": true, "type": "boolean", "required": false }, "require-verify": { "default": false, "type": "boolean", "required": false }, "artifact-name": { "default": "buildchain-artifact", "type": "string", "required": false }, "artifact-name-template": { "description": "Artifact name template with placeholders: {artifact}, {platform}, {sha}, {shortSha}, {runId}, {runAttempt}", "default": "{artifact}-{platform}-{sha}", "type": "string", "required": false }, "artifact-paths": { "default": "dist\nbuild/stage\n", "type": "string", "required": false }, "pre-upload-transport-smoke-scenario-path": { "description": "Optional declarative demo scenario, relative to working-directory, whose transport smoke must pass before Linux artifact upload", "default": "", "type": "string", "required": false }, "pre-upload-transport-smoke-artifact-root": { "description": "Artifact root, relative to working-directory, used by the pre-upload transport simulation", "default": ".", "type": "string", "required": false }, "credential-island-macos-app-path": { "description": "Optional exact .app path to seal for a protected macOS credential-island job", "default": "", "type": "string", "required": false }, "credential-island-environment": { "description": "Protected environment used by the built-in signer; leave empty for caller-owned signing", "default": "", "type": "string", "required": false }, "credential-island-caller-owned": { "description": "Seal and export the macOS input/runtime for a caller-owned protected signing job instead of running the built-in signer", "default": false, "type": "boolean", "required": false }, "credential-island-macos-platform-id": { "description": "macOS build platform whose sealed app is admitted to the credential island", "default": "macos-arm64", "type": "string", "required": false }, "github-artifact-attestation-subject-path": { "description": "Optional exact artifact path to bind to a GitHub keyless attestation policy after the final platform manifest is sealed", "default": "", "type": "string", "required": false }, "github-artifact-attestation-signer-sha": { "description": "Exact 40-hex Buildchain commit containing the trusted reusable signer workflow", "default": "", "type": "string", "required": false }, "github-artifact-attestation-platform-id": { "description": "Linux platform id that owns github-artifact-attestation-subject-path", "default": "linux-x64", "type": "string", "required": false }, "release-candidate": { "description": "Generate and upload a PR-stage release-candidate passport after the full platform matrix succeeds", "default": false, "type": "boolean", "required": false }, "expected-artifacts-json": { "description": "Optional JSON expectation contract for final artifact files", "default": "", "type": "string", "required": false }, "process-summary-path": { "description": "Optional process sampler summary JSON path, relative to workspace, to embed in final diagnostics", "default": "", "type": "string", "required": false }, "sample-process-tree": { "description": "Wrap the build lifecycle with the process tree sampler", "default": true, "type": "boolean", "required": false }, "process-sample-interval-ms": { "description": "Process sampler interval in milliseconds", "default": 15000, "type": "number", "required": false }, "requested-parallelism": { "description": "Optional expected build parallelism recorded in process diagnostics", "default": 0, "type": "number", "required": false }, "artifact-retention-days": { "default": 14, "type": "number", "required": false }, "artifact-compression-level": { "description": "GitHub Artifact payload compression level (0-9); zero avoids recompressing release archives and reduces signed-URL exposure", "default": 0, "type": "number", "required": false }, "artifact-signing-request-upload-no-proxy": { "description": "Optional NO_PROXY value scoped only to Buildchain-owned signing request uploads; signed-result downloads retain the runner route", "default": "", "type": "string", "required": false }, "artifact-transfer-mode": { "description": "Artifact transfer policy: GitHub-hosted platforms always upload natively; other platforms use github-artifacts or s3-to-github-artifacts", "default": "github-artifacts", "type": "string", "required": false }, "artifact-relay-s3-bucket": { "description": "Optional S3 bucket for artifact relay. Empty may use BUILDCHAIN_ARTIFACT_RELAY_S3_BUCKET repo/org variable.", "default": "", "type": "string", "required": false }, "artifact-relay-s3-region": { "description": "Optional S3 region for artifact relay. Empty may use BUILDCHAIN_ARTIFACT_RELAY_S3_REGION repo/org variable.", "default": "", "type": "string", "required": false }, "artifact-relay-s3-prefix": { "description": "Optional S3 key prefix for artifact relay. Empty may use BUILDCHAIN_ARTIFACT_RELAY_S3_PREFIX repo/org variable.", "default": "", "type": "string", "required": false }, "artifact-relay-s3-role-arn": { "description": "Optional shared OIDC role ARN for S3 relay upload/download. Prefer repo/org variables or secrets.", "default": "", "type": "string", "required": false }, "artifact-relay-s3-upload-role-arn": { "description": "Optional upload OIDC role ARN for self-hosted build runners.", "default": "", "type": "string", "required": false }, "artifact-relay-s3-download-role-arn": { "description": "Optional download OIDC role ARN for the GitHub-hosted relay runner.", "default": "", "type": "string", "required": false }, "artifact-relay-s3-oidc-audience": { "description": "Optional OIDC audience for S3 relay roles. Defaults to sts.amazonaws.com.cn for cn-* regions, otherwise sts.amazonaws.com.", "default": "", "type": "string", "required": false }, "checkout-cache-mode": { "description": "Locked source checkout cache mode: off, auto, or require", "default": "off", "type": "string", "required": false }, "checkout-cache-mirror-url-template": { "description": "Trusted local/LAN Git mirror URL template. Supports {owner}, {repo}, {repository}, {repositorySlug}, and {sha}.", "default": "", "type": "string", "required": false }, "checkout-cache-reference-repository-template": { "description": "Trusted runner-local bare reference repository template. Supports {owner}, {repo}, {repository}, {repositorySlug}, and {sha}.", "default": "", "type": "string", "required": false }, "checkout-cache-fallback": { "description": "Fallback when checkout cache misses: github or fail", "default": "github", "type": "string", "required": false }, "checkout-cache-timeout-seconds": { "description": "Timeout for each trusted cache transport attempt", "default": 60, "type": "number", "required": false }, "checkout-cache-github-timeout-seconds": { "description": "Timeout for each GitHub fallback fetch attempt", "default": 600, "type": "number", "required": false }, "checkout-cache-fetch-attempts": { "description": "Maximum bounded attempts for retryable GitHub fallback fetch failures", "default": 3, "type": "number", "required": false }, "checkout-history-mode": { "description": "Locked consumer source history: shallow or full. Full retains ancestry required by source-history gates.", "default": "shallow", "type": "string", "required": false }, "shifu-cache-profile-ref": { "description": "Opaque trusted Shifu cache profile reference passed to lifecycle commands without interpretation", "default": "", "type": "string", "required": false }, "shifu-cache-profile-digest": { "description": "Opaque expected Shifu cache profile digest passed to lifecycle commands without interpretation", "default": "", "type": "string", "required": false }, "cache-dependency-lock-root": { "description": "Optional consumer-owned exact dependency-lock root bound into structured cache evidence", "default": "", "type": "string", "required": false }, "cache-toolchain-root": { "description": "Optional consumer-owned exact toolchain root bound into structured cache evidence", "default": "", "type": "string", "required": false }, "cache-policy-root": { "description": "Optional consumer-owned exact qualification policy root bound into structured cache evidence", "default": "", "type": "string", "required": false }, "compiler-cache-provider": { "description": "Audited compiler cache provider prepared before build: none or sccache", "default": "none", "type": "string", "required": false }, "compiler-cache-platforms-json": { "description": "JSON array of platform ids on which compiler-cache preparation is enabled", "default": "[]", "type": "string", "required": false }, "compiler-cache-required": { "description": "Fail the selected platform before build when the compiler cache cannot be prepared", "default": false, "type": "boolean", "required": false }, "gate-profile-aggregate-json": { "description": "Optional qualifying buildchain.shifu-gate-aggregate/v1 JSON from the reusable Gate workflow", "default": "", "type": "string", "required": false }, "release-candidate-family-evidence-json": { "description": "Optional exact Initiative-family release evidence JSON embedded in the release-candidate passport", "default": "", "type": "string", "required": false }, "config-path": { "description": "Locate buildchain.toml when the project cannot be discovered.", "type": "string", "required": false, "default": "" }, "runtime-ref": { "description": "Transient execution runtime; empty selects the consumer lock.", "type": "string", "required": false, "default": "" }, "contract-lock": { "description": "Optional consumer runtime contract lock path.", "type": "string", "required": false, "default": "" }, "resume-run-id": { "description": "Failed execution to resume using its original source and retained build outputs.", "type": "string", "required": false, "default": "" }, "runtime-selection": { "description": "Entry-resolved runtime transport for nested workflows.", "type": "string", "required": false, "default": "" } }, "secrets": { "BUILDCHAIN_ARTIFACT_RELAY_S3_ROLE_ARN": { "required": false }, "BUILDCHAIN_ARTIFACT_RELAY_S3_UPLOAD_ROLE_ARN": { "required": false }, "BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN": { "required": false }, "BUILDCHAIN_MACOS_CERTIFICATE_P12_BASE64": { "required": false }, "BUILDCHAIN_MACOS_CERTIFICATE_PASSWORD": { "required": false }, "BUILDCHAIN_MACOS_NOTARY_API_KEY_P8_BASE64": { "required": false }, "BUILDCHAIN_MACOS_NOTARY_API_KEY_ID": { "required": false }, "BUILDCHAIN_MACOS_NOTARY_API_ISSUER": { "required": false }, "BUILDCHAIN_PROMOTION_TOKEN": { "required": false } }, "outputs": { "result": { "description": "Rooted build result and exact artifact references.", "value": "${{ jobs.build.outputs.result }}" }, "release-candidate-artifact": { "description": "Uploaded release-candidate passport artifact name when release-candidate is enabled", "value": "${{ fromJSON(jobs.build.outputs.result).historical_outputs['release-candidate-artifact'] }}" }, "controller-receipt-artifact": { "description": "Uploaded build-channel-router controller receipt artifact name", "value": "${{ fromJSON(jobs.build.outputs.result).historical_outputs['controller-receipt-artifact'] }}" }, "buildchain-channel": { "description": "Resolved Buildchain channel: alpha or stable", "value": "${{ fromJSON(jobs.build.outputs.result).historical_outputs['buildchain-channel'] }}" }, "buildchain-channel-selection-source": { "description": "Evidence source used to select the Buildchain channel", "value": "${{ fromJSON(jobs.build.outputs.result).historical_outputs['buildchain-channel-selection-source'] }}" }, "buildchain-channel-reason": { "description": "Human-readable Buildchain channel selection reason", "value": "${{ fromJSON(jobs.build.outputs.result).historical_outputs['buildchain-channel-reason'] }}" }, "runner-preset": { "description": "Resolved runner preset name", "value": "${{ fromJSON(jobs.build.outputs.result).historical_outputs['runner-preset'] }}" }, "platforms-json": { "description": "Resolved platform matrix JSON", "value": "${{ fromJSON(jobs.build.outputs.result).historical_outputs['platforms-json'] }}" }, "runner-routing-json": { "description": "De-identified self-hosted availability and offline fallback decision", "value": "${{ fromJSON(jobs.build.outputs.result).historical_outputs['runner-routing-json'] }}" }, "platform-count": { "description": "Resolved platform count", "value": "${{ fromJSON(jobs.build.outputs.result).historical_outputs['platform-count'] }}" }, "linux-container-enabled": { "description": "Whether Linux build platforms are routed through a job container", "value": "${{ fromJSON(jobs.build.outputs.result).historical_outputs['linux-container-enabled'] }}" }, "linux-container-image": { "description": "Resolved Linux job container image", "value": "${{ fromJSON(jobs.build.outputs.result).historical_outputs['linux-container-image'] }}" }, "build-summary-artifact": { "description": "Uploaded aggregate build summary artifact name", "value": "${{ fromJSON(jobs.build.outputs.result).historical_outputs['build-summary-artifact'] }}" }, "credential-island-macos-artifact": { "description": "Uploaded signed macOS payload artifact name when the credential island is enabled", "value": "${{ fromJSON(jobs.build.outputs.result).historical_outputs['credential-island-macos-artifact'] }}" }, "credential-island-macos-manifest-artifact": { "description": "Uploaded signed macOS manifest artifact name when the credential island is enabled", "value": "${{ fromJSON(jobs.build.outputs.result).historical_outputs['credential-island-macos-manifest-artifact'] }}" }, "build-diagnostics-summary-artifact": { "description": "Uploaded aggregate diagnostics summary artifact name", "value": "${{ fromJSON(jobs.build.outputs.result).historical_outputs['build-diagnostics-summary-artifact'] }}" }, "release-candidate-passport-artifact": { "description": "Uploaded release-candidate passport artifact name when release-candidate is enabled", "value": "${{ fromJSON(jobs.build.outputs.result).historical_outputs['release-candidate-passport-artifact'] }}" }, "release-candidate-passport-json": { "description": "Compact release-candidate passport JSON when release-candidate is enabled", "value": "${{ fromJSON(jobs.build.outputs.result).historical_outputs['release-candidate-passport-json'] }}" }, "build-summary-json": { "description": "Compact aggregate build summary JSON", "value": "${{ fromJSON(jobs.build.outputs.result).historical_outputs['build-summary-json'] }}" }, "artifact-coordinates-json": { "description": "Producer-owned exact GitHub Artifact coordinates for every resolved build platform", "value": "${{ fromJSON(jobs.build.outputs.result).historical_outputs['artifact-coordinates-json'] }}" }, "build-diagnostics-summary-json": { "description": "Compact aggregate diagnostics summary JSON with lifecycle, diagnostics contract warning, and sidecar manifest warning totals", "value": "${{ fromJSON(jobs.build.outputs.result).historical_outputs['build-diagnostics-summary-json'] }}" }, "trusted-event": { "description": "Whether the event is trusted enough to run build jobs", "value": "${{ fromJSON(jobs.build.outputs.result).historical_outputs['trusted-event'] }}" }, "buildchain-runtime-ref": { "description": "Resolved Buildchain runtime ref", "value": "${{ fromJSON(jobs.build.outputs.result).historical_outputs['buildchain-runtime-ref'] }}" }, "buildchain-runtime-sha": { "description": "Resolved immutable Buildchain runtime SHA", "value": "${{ fromJSON(jobs.build.outputs.result).historical_outputs['buildchain-runtime-sha'] }}" }, "buildchain-runtime-class": { "description": "Runtime stability class: stable, alpha, authority, train, exact-sha, or development", "value": "${{ fromJSON(jobs.build.outputs.result).historical_outputs['buildchain-runtime-class'] }}" }, "buildchain-runtime-override": { "description": "Whether an authority, train, or exact-SHA buildchain-ref override was used", "value": "${{ fromJSON(jobs.build.outputs.result).historical_outputs['buildchain-runtime-override'] }}" }, "buildchain-runtime-trust-decision": { "description": "Runtime override trust decision", "value": "${{ fromJSON(jobs.build.outputs.result).historical_outputs['buildchain-runtime-trust-decision'] }}" }, "buildchain-contract-lock-status": { "description": "Floating Buildchain runtime contract lock status", "value": "${{ fromJSON(jobs.build.outputs.result).historical_outputs['buildchain-contract-lock-status'] }}" }, "buildchain-contract-lock-drift": { "description": "Whether the floating Buildchain runtime SHA or contract digest drifted from the consumer lock", "value": "${{ fromJSON(jobs.build.outputs.result).historical_outputs['buildchain-contract-lock-drift'] }}" }, "buildchain-contract-digest": { "description": "Current Buildchain runtime contract digest", "value": "${{ fromJSON(jobs.build.outputs.result).historical_outputs['buildchain-contract-digest'] }}" }, "publish-channel": { "description": "Resolved publish channel", "value": "${{ fromJSON(jobs.build.outputs.result).historical_outputs['publish-channel'] }}" }, "publish-allowed": { "description": "Whether this event/ref may publish after successful verification", "value": "${{ fromJSON(jobs.build.outputs.result).historical_outputs['publish-allowed'] }}" }, "publish-reason": { "description": "Human-readable publish gate reason", "value": "${{ fromJSON(jobs.build.outputs.result).historical_outputs['publish-reason'] }}" }, "publish-source-ref": { "description": "Resolved publish source ref", "value": "${{ fromJSON(jobs.build.outputs.result).historical_outputs['publish-source-ref'] }}" }, "publish-source-sha": { "description": "Locked source SHA used for checkout/build/summary", "value": "${{ fromJSON(jobs.build.outputs.result).historical_outputs['publish-source-sha'] }}" }, "publish-source-tree-sha": { "description": "Git tree SHA for the locked source commit used by release-candidate promotion equivalence checks", "value": "${{ fromJSON(jobs.build.outputs.result).historical_outputs['publish-source-tree-sha'] }}" }, "publish-source-locked": { "description": "Whether a publish-gate source ref was explicitly locked", "value": "${{ fromJSON(jobs.build.outputs.result).historical_outputs['publish-source-locked'] }}" }, "publish-source-channel": { "description": "Channel parsed from the publish-gate source ref", "value": "${{ fromJSON(jobs.build.outputs.result).historical_outputs['publish-source-channel'] }}" }, "publish-source-line": { "description": "Line parsed from the publish-gate source ref", "value": "${{ fromJSON(jobs.build.outputs.result).historical_outputs['publish-source-line'] }}" }, "publish-source-consumer-version": { "description": "Consumer version parsed from the publish-gate source ref", "value": "${{ fromJSON(jobs.build.outputs.result).historical_outputs['publish-source-consumer-version'] }}" }, "release-manifest-json": { "description": "Resolved release manifest JSON", "value": "${{ fromJSON(jobs.build.outputs.result).historical_outputs['release-manifest-json'] }}" }, "controller-plan-artifact": { "description": "Uploaded build-channel-router controller plan artifact name", "value": "${{ fromJSON(jobs.build.outputs.result).historical_outputs['controller-plan-artifact'] }}" }, "controller-plan-json": { "description": "Compact source/runtime-bound build-channel-router controller plan", "value": "${{ fromJSON(jobs.build.outputs.result).historical_outputs['controller-plan-json'] }}" }, "controller-plan-digest": { "description": "Digest of the build-channel-router controller plan", "value": "${{ fromJSON(jobs.build.outputs.result).historical_outputs['controller-plan-digest'] }}" }, "controller-receipt-json": { "description": "Compact build-channel-router controller receipt", "value": "${{ fromJSON(jobs.build.outputs.result).historical_outputs['controller-receipt-json'] }}" }, "controller-receipt-digest": { "description": "Digest of the build-channel-router controller receipt", "value": "${{ fromJSON(jobs.build.outputs.result).historical_outputs['controller-receipt-digest'] }}" }, "controller-receipt-status": { "description": "Final build-channel-router controller status", "value": "${{ fromJSON(jobs.build.outputs.result).historical_outputs['controller-receipt-status'] }}" } } } }, "permissions": { "issues": "write", "contents": "read", "actions": "read", "id-token": "write", "attestations": "write" }, "interfaceSource": "on:\n workflow_call:\n inputs:\n buildchain-channel:\n description: \"Buildchain runtime channel: auto, alpha, or stable\"\n default: auto\n type: string\n required: false\n buildchain-alpha-contract-lock-path:\n description: Consumer-owned contract lock selected for the alpha channel\n default: .buildchain/alpha-contract-lock.json\n type: string\n required: false\n buildchain-stable-contract-lock-path:\n description: Consumer-owned contract lock selected for the stable channel\n default: .buildchain/contract-lock.json\n type: string\n required: false\n buildchain-repository:\n default: kungfu-systems/buildchain\n type: string\n required: false\n buildchain-ref:\n description: Official floating Buildchain channel, protected authority, or a\n temporary train/SHA for trusted manual validation.\n default: \"\"\n type: string\n required: false\n buildchain-expected-channel:\n description: Explicit stable or alpha lane expected by a trusted channel router\n when the workflow shell ref is opaque\n default: \"\"\n type: string\n required: false\n buildchain-expected-major:\n description: Explicit Buildchain major expected by a trusted channel router when\n the workflow shell ref is opaque\n default: \"\"\n type: string\n required: false\n buildchain-contract-lock-path:\n description: Consumer-owned Buildchain contract lock path\n default: \"\"\n type: string\n required: false\n buildchain-contract-compatibility-policy:\n description: \"Contract compatibility policy: major-compatible, allow-additive,\n or exact\"\n default: major-compatible\n type: string\n required: false\n buildchain-contract-drift-issue-mode:\n description: \"Consumer issue behavior for Buildchain floating-ref contract\n drift: off, breaking-only, or compatible-and-breaking\"\n default: compatible-and-breaking\n type: string\n required: false\n working-directory:\n default: .\n type: string\n required: false\n runner-preset:\n description: \"Runner preset: github-hosted, kungfu-v4-self-hosted,\n aws-us-codebuild-linux, aws-us-ec2-windows-jit, aws-us-ec2-macos-jit,\n or custom with platforms-json\"\n default: github-hosted\n type: string\n required: false\n aws-codebuild-project:\n description: Required CodeBuild project name for the explicit\n aws-us-codebuild-linux burst preset\n default: \"\"\n type: string\n required: false\n aws-ec2-windows-runner-label:\n description: Required unique card-scoped JIT label for the explicit\n aws-us-ec2-windows-jit burst preset\n default: \"\"\n type: string\n required: false\n aws-ec2-macos-runner-label:\n description: Required unique campaign-scoped JIT label for the explicit\n aws-us-ec2-macos-jit burst preset\n default: \"\"\n type: string\n required: false\n platforms-json:\n description: \"Optional custom JSON array of platform objects: id, name, runner\n JSON string, and optional githubHosted boolean\"\n default: \"\"\n type: string\n required: false\n self-hosted-offline-fallback:\n description: Route each supported exact-label self-hosted lane to its\n GitHub-hosted runner when no matching runner is online\n default: false\n type: boolean\n required: false\n control-runner-json:\n description: JSON runner-label array for trusted control-plane jobs\n default: '[\"ubuntu-24.04\"]'\n type: string\n required: false\n artifact-finalization-command:\n description: Optional consumer verification command over final artifact bytes\n before manifest resealing\n default: \"\"\n type: string\n required: false\n artifact-finalization-on-platform:\n description: Run trusted artifact finalization on each GitHub-hosted platform\n runner instead of the control runner\n default: false\n type: boolean\n required: false\n fail-fast:\n description: Cancel sibling platform lanes after a required matrix failure;\n false retains all-platform diagnostics\n default: false\n type: boolean\n required: false\n linux-container-preset:\n description: \"Optional Linux job container preset: kungfu-verify, none, or\n custom with linux-container-image\"\n default: \"\"\n type: string\n required: false\n linux-container-image:\n description: Optional explicit Linux job container image, preferably pinned by\n digest\n default: \"\"\n type: string\n required: false\n require-trusted-event:\n default: true\n type: boolean\n required: false\n untrusted-policy:\n description: fail or skip when an untrusted fork event asks for build execution\n default: fail\n type: string\n required: false\n publish-channel:\n description: \"Publish channel requested by the caller: none, alpha, release,\n major, or a custom channel from publish-refs-json\"\n default: none\n type: string\n required: false\n publish-refs-json:\n description: Optional JSON object mapping publish channels to allowed Git ref\n regular expressions\n default: \"\"\n type: string\n required: false\n publish-source-ref:\n description: Optional source branch such as publish-gate/alpha//\n to resolve and lock before build\n default: \"\"\n type: string\n required: false\n publish-anchor-request-json:\n description: Required JSON request when publish-source-ref resolves to\n publish-gate/anchor\n default: \"\"\n type: string\n required: false\n publish-registry:\n description: Registry recorded in the resolved publish source manifest\n default: https://registry.npmjs.org/\n type: string\n required: false\n setup-node:\n default: true\n type: boolean\n required: false\n node-version:\n default: \"24\"\n type: string\n required: false\n setup-rust:\n description: Install a Rust toolchain for native lifecycle jobs\n default: false\n type: boolean\n required: false\n rust-toolchain:\n description: Rust toolchain installed when setup-rust is enabled\n default: stable\n type: string\n required: false\n rustup-dist-server:\n description: Optional rustup distribution mirror; empty uses the official Rust\n server\n default: \"\"\n type: string\n required: false\n rustup-update-root:\n description: Optional rustup self-update mirror; empty uses the official Rust server\n default: \"\"\n type: string\n required: false\n cargo-registry-index:\n description: Optional crates.io-compatible Cargo registry index; empty uses the\n Cargo default\n default: \"\"\n type: string\n required: false\n install-command:\n default: \"\"\n type: string\n required: false\n build-command:\n default: \"\"\n type: string\n required: false\n verify-command:\n default: \"\"\n type: string\n required: false\n verify-substage-evidence-path:\n description: Optional lifecycle verify substage evidence path produced by the\n consumer command\n default: \"\"\n type: string\n required: false\n kfd-agent-hub:\n description: \"Agent Hub conformance mode: off or auto. Auto reads\n .buildchain/kfd/agent-hub.json and runs the fixed KFD suite.\"\n default: off\n type: string\n required: false\n lifecycle-timeout-minutes:\n description: Maximum minutes for the build matrix job and fallback timeout for\n each lifecycle stage\n default: 120\n type: number\n required: false\n require-install:\n default: false\n type: boolean\n required: false\n require-build:\n default: true\n type: boolean\n required: false\n require-verify:\n default: false\n type: boolean\n required: false\n artifact-name:\n default: buildchain-artifact\n type: string\n required: false\n artifact-name-template:\n description: \"Artifact name template with placeholders: {artifact}, {platform},\n {sha}, {shortSha}, {runId}, {runAttempt}\"\n default: \"{artifact}-{platform}-{sha}\"\n type: string\n required: false\n artifact-paths:\n default: |\n dist\n build/stage\n type: string\n required: false\n pre-upload-transport-smoke-scenario-path:\n description: Optional declarative demo scenario, relative to working-directory,\n whose transport smoke must pass before Linux artifact upload\n default: \"\"\n type: string\n required: false\n pre-upload-transport-smoke-artifact-root:\n description: Artifact root, relative to working-directory, used by the\n pre-upload transport simulation\n default: .\n type: string\n required: false\n credential-island-macos-app-path:\n description: Optional exact .app path to seal for a protected macOS\n credential-island job\n default: \"\"\n type: string\n required: false\n credential-island-environment:\n description: Protected environment used by the built-in signer; leave empty for\n caller-owned signing\n default: \"\"\n type: string\n required: false\n credential-island-caller-owned:\n description: Seal and export the macOS input/runtime for a caller-owned\n protected signing job instead of running the built-in signer\n default: false\n type: boolean\n required: false\n credential-island-macos-platform-id:\n description: macOS build platform whose sealed app is admitted to the credential\n island\n default: macos-arm64\n type: string\n required: false\n github-artifact-attestation-subject-path:\n description: Optional exact artifact path to bind to a GitHub keyless\n attestation policy after the final platform manifest is sealed\n default: \"\"\n type: string\n required: false\n github-artifact-attestation-signer-sha:\n description: Exact 40-hex Buildchain commit containing the trusted reusable\n signer workflow\n default: \"\"\n type: string\n required: false\n github-artifact-attestation-platform-id:\n description: Linux platform id that owns github-artifact-attestation-subject-path\n default: linux-x64\n type: string\n required: false\n release-candidate:\n description: Generate and upload a PR-stage release-candidate passport after the\n full platform matrix succeeds\n default: false\n type: boolean\n required: false\n expected-artifacts-json:\n description: Optional JSON expectation contract for final artifact files\n default: \"\"\n type: string\n required: false\n process-summary-path:\n description: Optional process sampler summary JSON path, relative to workspace,\n to embed in final diagnostics\n default: \"\"\n type: string\n required: false\n sample-process-tree:\n description: Wrap the build lifecycle with the process tree sampler\n default: true\n type: boolean\n required: false\n process-sample-interval-ms:\n description: Process sampler interval in milliseconds\n default: 15000\n type: number\n required: false\n requested-parallelism:\n description: Optional expected build parallelism recorded in process diagnostics\n default: 0\n type: number\n required: false\n artifact-retention-days:\n default: 14\n type: number\n required: false\n artifact-compression-level:\n description: GitHub Artifact payload compression level (0-9); zero avoids\n recompressing release archives and reduces signed-URL exposure\n default: 0\n type: number\n required: false\n artifact-signing-request-upload-no-proxy:\n description: Optional NO_PROXY value scoped only to Buildchain-owned signing\n request uploads; signed-result downloads retain the runner route\n default: \"\"\n type: string\n required: false\n artifact-transfer-mode:\n description: \"Artifact transfer policy: GitHub-hosted platforms always upload\n natively; other platforms use github-artifacts or\n s3-to-github-artifacts\"\n default: github-artifacts\n type: string\n required: false\n artifact-relay-s3-bucket:\n description: Optional S3 bucket for artifact relay. Empty may use\n BUILDCHAIN_ARTIFACT_RELAY_S3_BUCKET repo/org variable.\n default: \"\"\n type: string\n required: false\n artifact-relay-s3-region:\n description: Optional S3 region for artifact relay. Empty may use\n BUILDCHAIN_ARTIFACT_RELAY_S3_REGION repo/org variable.\n default: \"\"\n type: string\n required: false\n artifact-relay-s3-prefix:\n description: Optional S3 key prefix for artifact relay. Empty may use\n BUILDCHAIN_ARTIFACT_RELAY_S3_PREFIX repo/org variable.\n default: \"\"\n type: string\n required: false\n artifact-relay-s3-role-arn:\n description: Optional shared OIDC role ARN for S3 relay upload/download. Prefer\n repo/org variables or secrets.\n default: \"\"\n type: string\n required: false\n artifact-relay-s3-upload-role-arn:\n description: Optional upload OIDC role ARN for self-hosted build runners.\n default: \"\"\n type: string\n required: false\n artifact-relay-s3-download-role-arn:\n description: Optional download OIDC role ARN for the GitHub-hosted relay runner.\n default: \"\"\n type: string\n required: false\n artifact-relay-s3-oidc-audience:\n description: Optional OIDC audience for S3 relay roles. Defaults to\n sts.amazonaws.com.cn for cn-* regions, otherwise sts.amazonaws.com.\n default: \"\"\n type: string\n required: false\n checkout-cache-mode:\n description: \"Locked source checkout cache mode: off, auto, or require\"\n default: off\n type: string\n required: false\n checkout-cache-mirror-url-template:\n description: Trusted local/LAN Git mirror URL template. Supports {owner},\n {repo}, {repository}, {repositorySlug}, and {sha}.\n default: \"\"\n type: string\n required: false\n checkout-cache-reference-repository-template:\n description: Trusted runner-local bare reference repository template. Supports\n {owner}, {repo}, {repository}, {repositorySlug}, and {sha}.\n default: \"\"\n type: string\n required: false\n checkout-cache-fallback:\n description: \"Fallback when checkout cache misses: github or fail\"\n default: github\n type: string\n required: false\n checkout-cache-timeout-seconds:\n description: Timeout for each trusted cache transport attempt\n default: 60\n type: number\n required: false\n checkout-cache-github-timeout-seconds:\n description: Timeout for each GitHub fallback fetch attempt\n default: 600\n type: number\n required: false\n checkout-cache-fetch-attempts:\n description: Maximum bounded attempts for retryable GitHub fallback fetch failures\n default: 3\n type: number\n required: false\n checkout-history-mode:\n description: \"Locked consumer source history: shallow or full. Full retains\n ancestry required by source-history gates.\"\n default: shallow\n type: string\n required: false\n shifu-cache-profile-ref:\n description: Opaque trusted Shifu cache profile reference passed to lifecycle\n commands without interpretation\n default: \"\"\n type: string\n required: false\n shifu-cache-profile-digest:\n description: Opaque expected Shifu cache profile digest passed to lifecycle\n commands without interpretation\n default: \"\"\n type: string\n required: false\n cache-dependency-lock-root:\n description: Optional consumer-owned exact dependency-lock root bound into\n structured cache evidence\n default: \"\"\n type: string\n required: false\n cache-toolchain-root:\n description: Optional consumer-owned exact toolchain root bound into structured\n cache evidence\n default: \"\"\n type: string\n required: false\n cache-policy-root:\n description: Optional consumer-owned exact qualification policy root bound into\n structured cache evidence\n default: \"\"\n type: string\n required: false\n compiler-cache-provider:\n description: \"Audited compiler cache provider prepared before build: none or\n sccache\"\n default: none\n type: string\n required: false\n compiler-cache-platforms-json:\n description: JSON array of platform ids on which compiler-cache preparation is\n enabled\n default: \"[]\"\n type: string\n required: false\n compiler-cache-required:\n description: Fail the selected platform before build when the compiler cache\n cannot be prepared\n default: false\n type: boolean\n required: false\n gate-profile-aggregate-json:\n description: Optional qualifying buildchain.shifu-gate-aggregate/v1 JSON from\n the reusable Gate workflow\n default: \"\"\n type: string\n required: false\n release-candidate-family-evidence-json:\n description: Optional exact Initiative-family release evidence JSON embedded in\n the release-candidate passport\n default: \"\"\n type: string\n required: false\n config-path:\n description: Locate buildchain.toml when the project cannot be discovered.\n type: string\n required: false\n default: \"\"\n runtime-ref:\n description: Transient execution runtime; empty selects the consumer lock.\n type: string\n required: false\n default: \"\"\n contract-lock:\n description: Optional consumer runtime contract lock path.\n type: string\n required: false\n default: \"\"\n resume-run-id:\n description: Failed execution to resume using its original source and retained\n build outputs.\n type: string\n required: false\n default: \"\"\n runtime-selection:\n description: Entry-resolved runtime transport for nested workflows.\n type: string\n required: false\n default: \"\"\n secrets:\n BUILDCHAIN_ARTIFACT_RELAY_S3_ROLE_ARN:\n required: false\n BUILDCHAIN_ARTIFACT_RELAY_S3_UPLOAD_ROLE_ARN:\n required: false\n BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN:\n required: false\n BUILDCHAIN_MACOS_CERTIFICATE_P12_BASE64:\n required: false\n BUILDCHAIN_MACOS_CERTIFICATE_PASSWORD:\n required: false\n BUILDCHAIN_MACOS_NOTARY_API_KEY_P8_BASE64:\n required: false\n BUILDCHAIN_MACOS_NOTARY_API_KEY_ID:\n required: false\n BUILDCHAIN_MACOS_NOTARY_API_ISSUER:\n required: false\n BUILDCHAIN_PROMOTION_TOKEN:\n required: false\n outputs:\n result:\n description: Rooted build result and exact artifact references.\n value: ${{ jobs.build.outputs.result }}\n release-candidate-artifact:\n description: Uploaded release-candidate passport artifact name when\n release-candidate is enabled\n value: ${{\n fromJSON(jobs.build.outputs.result).historical_outputs['release-candidate-artifact']\n }}\n controller-receipt-artifact:\n description: Uploaded build-channel-router controller receipt artifact name\n value: ${{\n fromJSON(jobs.build.outputs.result).historical_outputs['controller-receipt-artifact']\n }}\n buildchain-channel:\n description: \"Resolved Buildchain channel: alpha or stable\"\n value: ${{\n fromJSON(jobs.build.outputs.result).historical_outputs['buildchain-channel']\n }}\n buildchain-channel-selection-source:\n description: Evidence source used to select the Buildchain channel\n value: ${{\n fromJSON(jobs.build.outputs.result).historical_outputs['buildchain-channel-selection-source']\n }}\n buildchain-channel-reason:\n description: Human-readable Buildchain channel selection reason\n value: ${{\n fromJSON(jobs.build.outputs.result).historical_outputs['buildchain-channel-reason']\n }}\n runner-preset:\n description: Resolved runner preset name\n value: ${{\n fromJSON(jobs.build.outputs.result).historical_outputs['runner-preset']\n }}\n platforms-json:\n description: Resolved platform matrix JSON\n value: ${{\n fromJSON(jobs.build.outputs.result).historical_outputs['platforms-json']\n }}\n runner-routing-json:\n description: De-identified self-hosted availability and offline fallback decision\n value: ${{\n fromJSON(jobs.build.outputs.result).historical_outputs['runner-routing-json']\n }}\n platform-count:\n description: Resolved platform count\n value: ${{\n fromJSON(jobs.build.outputs.result).historical_outputs['platform-count']\n }}\n linux-container-enabled:\n description: Whether Linux build platforms are routed through a job container\n value: ${{\n fromJSON(jobs.build.outputs.result).historical_outputs['linux-container-enabled']\n }}\n linux-container-image:\n description: Resolved Linux job container image\n value: ${{\n fromJSON(jobs.build.outputs.result).historical_outputs['linux-container-image']\n }}\n build-summary-artifact:\n description: Uploaded aggregate build summary artifact name\n value: ${{\n fromJSON(jobs.build.outputs.result).historical_outputs['build-summary-artifact']\n }}\n credential-island-macos-artifact:\n description: Uploaded signed macOS payload artifact name when the credential\n island is enabled\n value: ${{\n fromJSON(jobs.build.outputs.result).historical_outputs['credential-island-macos-artifact']\n }}\n credential-island-macos-manifest-artifact:\n description: Uploaded signed macOS manifest artifact name when the credential\n island is enabled\n value: ${{\n fromJSON(jobs.build.outputs.result).historical_outputs['credential-island-macos-manifest-artifact']\n }}\n build-diagnostics-summary-artifact:\n description: Uploaded aggregate diagnostics summary artifact name\n value: ${{\n fromJSON(jobs.build.outputs.result).historical_outputs['build-diagnostics-summary-artifact']\n }}\n release-candidate-passport-artifact:\n description: Uploaded release-candidate passport artifact name when\n release-candidate is enabled\n value: ${{\n fromJSON(jobs.build.outputs.result).historical_outputs['release-candidate-passport-artifact']\n }}\n release-candidate-passport-json:\n description: Compact release-candidate passport JSON when release-candidate is\n enabled\n value: ${{\n fromJSON(jobs.build.outputs.result).historical_outputs['release-candidate-passport-json']\n }}\n build-summary-json:\n description: Compact aggregate build summary JSON\n value: ${{\n fromJSON(jobs.build.outputs.result).historical_outputs['build-summary-json']\n }}\n artifact-coordinates-json:\n description: Producer-owned exact GitHub Artifact coordinates for every resolved\n build platform\n value: ${{\n fromJSON(jobs.build.outputs.result).historical_outputs['artifact-coordinates-json']\n }}\n build-diagnostics-summary-json:\n description: Compact aggregate diagnostics summary JSON with lifecycle,\n diagnostics contract warning, and sidecar manifest warning totals\n value: ${{\n fromJSON(jobs.build.outputs.result).historical_outputs['build-diagnostics-summary-json']\n }}\n trusted-event:\n description: Whether the event is trusted enough to run build jobs\n value: ${{\n fromJSON(jobs.build.outputs.result).historical_outputs['trusted-event']\n }}\n buildchain-runtime-ref:\n description: Resolved Buildchain runtime ref\n value: ${{\n fromJSON(jobs.build.outputs.result).historical_outputs['buildchain-runtime-ref']\n }}\n buildchain-runtime-sha:\n description: Resolved immutable Buildchain runtime SHA\n value: ${{\n fromJSON(jobs.build.outputs.result).historical_outputs['buildchain-runtime-sha']\n }}\n buildchain-runtime-class:\n description: \"Runtime stability class: stable, alpha, authority, train,\n exact-sha, or development\"\n value: ${{\n fromJSON(jobs.build.outputs.result).historical_outputs['buildchain-runtime-class']\n }}\n buildchain-runtime-override:\n description: Whether an authority, train, or exact-SHA buildchain-ref override\n was used\n value: ${{\n fromJSON(jobs.build.outputs.result).historical_outputs['buildchain-runtime-override']\n }}\n buildchain-runtime-trust-decision:\n description: Runtime override trust decision\n value: ${{\n fromJSON(jobs.build.outputs.result).historical_outputs['buildchain-runtime-trust-decision']\n }}\n buildchain-contract-lock-status:\n description: Floating Buildchain runtime contract lock status\n value: ${{\n fromJSON(jobs.build.outputs.result).historical_outputs['buildchain-contract-lock-status']\n }}\n buildchain-contract-lock-drift:\n description: Whether the floating Buildchain runtime SHA or contract digest\n drifted from the consumer lock\n value: ${{\n fromJSON(jobs.build.outputs.result).historical_outputs['buildchain-contract-lock-drift']\n }}\n buildchain-contract-digest:\n description: Current Buildchain runtime contract digest\n value: ${{\n fromJSON(jobs.build.outputs.result).historical_outputs['buildchain-contract-digest']\n }}\n publish-channel:\n description: Resolved publish channel\n value: ${{\n fromJSON(jobs.build.outputs.result).historical_outputs['publish-channel']\n }}\n publish-allowed:\n description: Whether this event/ref may publish after successful verification\n value: ${{\n fromJSON(jobs.build.outputs.result).historical_outputs['publish-allowed']\n }}\n publish-reason:\n description: Human-readable publish gate reason\n value: ${{\n fromJSON(jobs.build.outputs.result).historical_outputs['publish-reason']\n }}\n publish-source-ref:\n description: Resolved publish source ref\n value: ${{\n fromJSON(jobs.build.outputs.result).historical_outputs['publish-source-ref']\n }}\n publish-source-sha:\n description: Locked source SHA used for checkout/build/summary\n value: ${{\n fromJSON(jobs.build.outputs.result).historical_outputs['publish-source-sha']\n }}\n publish-source-tree-sha:\n description: Git tree SHA for the locked source commit used by release-candidate\n promotion equivalence checks\n value: ${{\n fromJSON(jobs.build.outputs.result).historical_outputs['publish-source-tree-sha']\n }}\n publish-source-locked:\n description: Whether a publish-gate source ref was explicitly locked\n value: ${{\n fromJSON(jobs.build.outputs.result).historical_outputs['publish-source-locked']\n }}\n publish-source-channel:\n description: Channel parsed from the publish-gate source ref\n value: ${{\n fromJSON(jobs.build.outputs.result).historical_outputs['publish-source-channel']\n }}\n publish-source-line:\n description: Line parsed from the publish-gate source ref\n value: ${{\n fromJSON(jobs.build.outputs.result).historical_outputs['publish-source-line']\n }}\n publish-source-consumer-version:\n description: Consumer version parsed from the publish-gate source ref\n value: ${{\n fromJSON(jobs.build.outputs.result).historical_outputs['publish-source-consumer-version']\n }}\n release-manifest-json:\n description: Resolved release manifest JSON\n value: ${{\n fromJSON(jobs.build.outputs.result).historical_outputs['release-manifest-json']\n }}\n controller-plan-artifact:\n description: Uploaded build-channel-router controller plan artifact name\n value: ${{\n fromJSON(jobs.build.outputs.result).historical_outputs['controller-plan-artifact']\n }}\n controller-plan-json:\n description: Compact source/runtime-bound build-channel-router controller plan\n value: ${{\n fromJSON(jobs.build.outputs.result).historical_outputs['controller-plan-json']\n }}\n controller-plan-digest:\n description: Digest of the build-channel-router controller plan\n value: ${{\n fromJSON(jobs.build.outputs.result).historical_outputs['controller-plan-digest']\n }}\n controller-receipt-json:\n description: Compact build-channel-router controller receipt\n value: ${{\n fromJSON(jobs.build.outputs.result).historical_outputs['controller-receipt-json']\n }}\n controller-receipt-digest:\n description: Digest of the build-channel-router controller receipt\n value: ${{\n fromJSON(jobs.build.outputs.result).historical_outputs['controller-receipt-digest']\n }}\n controller-receipt-status:\n description: Final build-channel-router controller status\n value: ${{\n fromJSON(jobs.build.outputs.result).historical_outputs['controller-receipt-status']\n }}\n", "adapter": "build-v4.0", "earlierSource": { "ref": "v4.0.0", "sha": "45a49dcaa0fcef59bc66481a85c39514d08972cc" }, "inheritCallerPermissions": true }, { "path": ".github/workflows/public-ops-patrol.yml", "target": ".github/workflows/.ops-patrol.yml", "interface": { "workflow_call": { "inputs": { "cadence": { "description": "Patrol cadence: daily, weekly, or monthly", "default": "daily", "type": "string", "required": false }, "mode": { "description": "Patrol mode. cadence-default keeps the cadence wrapper stable while Buildchain grows capabilities.", "default": "cadence-default", "type": "string", "required": false }, "capabilities": { "description": "Optional comma/newline separated capability override", "default": "", "type": "string", "required": false }, "target-branch": { "description": "Protected dev branch to inspect or maintain", "default": "", "type": "string", "required": false }, "required-status-checks": { "description": "Comma or newline separated required status/check-run name fragments", "default": "check / check", "type": "string", "required": false }, "ready-label": { "description": "Required label for PRs eligible to merge. Empty disables the label gate.", "default": "ready", "type": "string", "required": false }, "block-labels": { "description": "Comma or newline separated labels that block merging", "default": "blocked,do-not-merge,work-in-progress", "type": "string", "required": false }, "allowed-head-prefixes": { "description": "Comma or newline separated allowed source branch prefixes", "default": "feature/,fix/,chore/,docs/,ci/,refactor/", "type": "string", "required": false }, "require-approval": { "description": "Require at least one current approval and no latest changes-requested review", "default": true, "type": "boolean", "required": false }, "same-repository-only": { "description": "Reject fork/cross-repository PR heads by default", "default": true, "type": "boolean", "required": false }, "max-actions": { "description": "Maximum actions to take in one run", "default": 1, "type": "number", "required": false }, "merge-method": { "description": "GitHub merge method for ready dev PRs: merge, squash, or rebase", "default": "merge", "type": "string", "required": false }, "landing-mode": { "description": "Landing mode for ready dev PRs: auto, direct, or queue", "default": "auto", "type": "string", "required": false }, "dry-run": { "description": "Plan only; do not mutate repository state", "default": true, "type": "boolean", "required": false }, "runtime-ref": { "description": "Transient execution runtime; empty selects the consumer lock.", "type": "string", "required": false, "default": "" }, "contract-lock": { "description": "Optional consumer runtime lock path.", "type": "string", "required": false, "default": "" }, "runtime-selection": { "description": "Entry-resolved runtime transport for nested workflow jobs.", "type": "string", "required": false, "default": "" } }, "secrets": { "github-token": { "description": "Optional token for repository inspection and maintenance. Defaults to github.token.", "required": false } }, "outputs": { "result-path": { "description": "Patrol result JSON path", "value": "${{ jobs.patrol.outputs.result-path }}" }, "evaluated-count": { "description": "Number of PRs evaluated by enabled capabilities", "value": "${{ jobs.patrol.outputs.evaluated-count }}" }, "action-count": { "description": "Number of actions taken, or planned in dry-run mode", "value": "${{ jobs.patrol.outputs.action-count }}" }, "skipped-count": { "description": "Number of skipped PRs", "value": "${{ jobs.patrol.outputs.skipped-count }}" }, "planned-count": { "description": "Number of stable-interface checks not yet implemented", "value": "${{ jobs.patrol.outputs.planned-count }}" } } } }, "permissions": { "contents": "write", "pull-requests": "write", "checks": "read", "statuses": "read" }, "interfaceSource": "on:\n workflow_call:\n inputs:\n cadence:\n description: \"Patrol cadence: daily, weekly, or monthly\"\n default: daily\n type: string\n required: false\n mode:\n description: Patrol mode. cadence-default keeps the cadence wrapper stable while Buildchain grows\n capabilities.\n default: cadence-default\n type: string\n required: false\n capabilities:\n description: Optional comma/newline separated capability override\n default: \"\"\n type: string\n required: false\n target-branch:\n description: Protected dev branch to inspect or maintain\n default: \"\"\n type: string\n required: false\n required-status-checks:\n description: Comma or newline separated required status/check-run name fragments\n default: check / check\n type: string\n required: false\n ready-label:\n description: Required label for PRs eligible to merge. Empty disables the label gate.\n default: ready\n type: string\n required: false\n block-labels:\n description: Comma or newline separated labels that block merging\n default: blocked,do-not-merge,work-in-progress\n type: string\n required: false\n allowed-head-prefixes:\n description: Comma or newline separated allowed source branch prefixes\n default: feature/,fix/,chore/,docs/,ci/,refactor/\n type: string\n required: false\n require-approval:\n description: Require at least one current approval and no latest changes-requested review\n default: true\n type: boolean\n required: false\n same-repository-only:\n description: Reject fork/cross-repository PR heads by default\n default: true\n type: boolean\n required: false\n max-actions:\n description: Maximum actions to take in one run\n default: 1\n type: number\n required: false\n merge-method:\n description: \"GitHub merge method for ready dev PRs: merge, squash, or rebase\"\n default: merge\n type: string\n required: false\n landing-mode:\n description: \"Landing mode for ready dev PRs: auto, direct, or queue\"\n default: auto\n type: string\n required: false\n dry-run:\n description: Plan only; do not mutate repository state\n default: true\n type: boolean\n required: false\n runtime-ref:\n description: Transient execution runtime; empty selects the consumer lock.\n type: string\n required: false\n default: \"\"\n contract-lock:\n description: Optional consumer runtime lock path.\n type: string\n required: false\n default: \"\"\n runtime-selection:\n description: Entry-resolved runtime transport for nested workflow jobs.\n type: string\n required: false\n default: \"\"\n secrets:\n github-token:\n description: Optional token for repository inspection and maintenance. Defaults to github.token.\n required: false\n outputs:\n result-path:\n description: Patrol result JSON path\n value: ${{ jobs.patrol.outputs.result-path }}\n evaluated-count:\n description: Number of PRs evaluated by enabled capabilities\n value: ${{ jobs.patrol.outputs.evaluated-count }}\n action-count:\n description: Number of actions taken, or planned in dry-run mode\n value: ${{ jobs.patrol.outputs.action-count }}\n skipped-count:\n description: Number of skipped PRs\n value: ${{ jobs.patrol.outputs.skipped-count }}\n planned-count:\n description: Number of stable-interface checks not yet implemented\n value: ${{ jobs.patrol.outputs.planned-count }}" }, { "path": ".github/workflows/public-build-check.yml", "target": ".github/workflows/.build-check.yml", "interface": { "workflow_call": { "inputs": { "working-directory": { "description": "Repository directory containing buildchain.toml", "default": ".", "type": "string", "required": false }, "node-version": { "description": "Node.js version used for the Buildchain runtime", "default": "24", "type": "string", "required": false }, "require-version-state": { "description": "Require configured version.files entries", "default": false, "type": "boolean", "required": false }, "mode": { "description": "Check mode: verify runs install + verify; source runs install + check", "default": "verify", "type": "string", "required": false }, "upload-artifacts": { "description": "Upload check lifecycle manifests and summaries", "default": true, "type": "boolean", "required": false }, "source-proof-reuse": { "description": "Allow exact accepted pull-request source proof reuse for merge groups", "default": false, "type": "boolean", "required": false }, "source-proof-policy-paths-json": { "description": "JSON array of source policy paths bound into the reusable proof", "default": "[]", "type": "string", "required": false }, "source-proof-closure-paths-json": { "description": "JSON array of source closure paths bound into the reusable proof", "default": "[]", "type": "string", "required": false }, "source-proof-dependency-paths-json": { "description": "JSON array of dependency paths bound into the reusable proof", "default": "[]", "type": "string", "required": false }, "source-proof-required-contexts-json": { "description": "JSON array of required contexts bound into the reusable proof", "default": "[]", "type": "string", "required": false }, "runtime-ref": { "description": "Transient execution runtime; empty selects the consumer lock.", "type": "string", "required": false, "default": "" }, "contract-lock": { "description": "Optional consumer runtime lock path.", "type": "string", "required": false, "default": "" }, "runtime-selection": { "description": "Entry-resolved runtime transport for nested workflow jobs.", "type": "string", "required": false, "default": "" } }, "outputs": { "controller-plan-artifact": { "description": "Uploaded source-check controller plan artifact name", "value": "${{ jobs.check.outputs.controller-plan-artifact }}" }, "controller-plan-json": { "description": "Compact source/runtime-bound source-check controller plan", "value": "${{ jobs.check.outputs.controller-plan-json }}" }, "controller-plan-digest": { "description": "Digest of the source-check controller plan", "value": "${{ jobs.check.outputs.controller-plan-digest }}" }, "controller-receipt-artifact": { "description": "Uploaded source-check controller receipt artifact name", "value": "${{ jobs.check.outputs.controller-receipt-artifact }}" }, "controller-receipt-json": { "description": "Compact source-check controller receipt", "value": "${{ jobs.check.outputs.controller-receipt-json }}" }, "controller-receipt-digest": { "description": "Digest of the source-check controller receipt", "value": "${{ jobs.check.outputs.controller-receipt-digest }}" }, "controller-receipt-status": { "description": "Final source-check controller status", "value": "${{ jobs.check.outputs.controller-receipt-status }}" }, "source-proof-root": { "description": "Exact source qualification proof root sealed or reused by this run", "value": "${{ jobs.check.outputs.source-proof-root }}" }, "source-proof-reused": { "description": "Whether this run reused an exact accepted source proof", "value": "${{ jobs.check.outputs.source-proof-reused }}" }, "source-proof-reuse-reason": { "description": "Reuse decision or fail-closed fallback reason", "value": "${{ jobs.check.outputs.source-proof-reuse-reason }}" }, "source-proof-producer-run-id": { "description": "Pull-request workflow run that produced the reused proof", "value": "${{ jobs.check.outputs.source-proof-producer-run-id }}" }, "source-proof-decision-root": { "description": "Exact merge-group source-proof reuse decision root", "value": "${{ jobs.check.outputs.source-proof-decision-root }}" } } } }, "permissions": { "actions": "read", "contents": "read", "pull-requests": "read" }, "interfaceSource": "on:\n workflow_call:\n inputs:\n working-directory:\n description: Repository directory containing buildchain.toml\n default: .\n type: string\n required: false\n node-version:\n description: Node.js version used for the Buildchain runtime\n default: \"24\"\n type: string\n required: false\n require-version-state:\n description: Require configured version.files entries\n default: false\n type: boolean\n required: false\n mode:\n description: \"Check mode: verify runs install + verify; source runs install + check\"\n default: verify\n type: string\n required: false\n upload-artifacts:\n description: Upload check lifecycle manifests and summaries\n default: true\n type: boolean\n required: false\n source-proof-reuse:\n description: Allow exact accepted pull-request source proof reuse for merge groups\n default: false\n type: boolean\n required: false\n source-proof-policy-paths-json:\n description: JSON array of source policy paths bound into the reusable proof\n default: \"[]\"\n type: string\n required: false\n source-proof-closure-paths-json:\n description: JSON array of source closure paths bound into the reusable proof\n default: \"[]\"\n type: string\n required: false\n source-proof-dependency-paths-json:\n description: JSON array of dependency paths bound into the reusable proof\n default: \"[]\"\n type: string\n required: false\n source-proof-required-contexts-json:\n description: JSON array of required contexts bound into the reusable proof\n default: \"[]\"\n type: string\n required: false\n runtime-ref:\n description: Transient execution runtime; empty selects the consumer lock.\n type: string\n required: false\n default: \"\"\n contract-lock:\n description: Optional consumer runtime lock path.\n type: string\n required: false\n default: \"\"\n runtime-selection:\n description: Entry-resolved runtime transport for nested workflow jobs.\n type: string\n required: false\n default: \"\"\n outputs:\n controller-plan-artifact:\n description: Uploaded source-check controller plan artifact name\n value: ${{ jobs.check.outputs.controller-plan-artifact }}\n controller-plan-json:\n description: Compact source/runtime-bound source-check controller plan\n value: ${{ jobs.check.outputs.controller-plan-json }}\n controller-plan-digest:\n description: Digest of the source-check controller plan\n value: ${{ jobs.check.outputs.controller-plan-digest }}\n controller-receipt-artifact:\n description: Uploaded source-check controller receipt artifact name\n value: ${{ jobs.check.outputs.controller-receipt-artifact }}\n controller-receipt-json:\n description: Compact source-check controller receipt\n value: ${{ jobs.check.outputs.controller-receipt-json }}\n controller-receipt-digest:\n description: Digest of the source-check controller receipt\n value: ${{ jobs.check.outputs.controller-receipt-digest }}\n controller-receipt-status:\n description: Final source-check controller status\n value: ${{ jobs.check.outputs.controller-receipt-status }}\n source-proof-root:\n description: Exact source qualification proof root sealed or reused by this run\n value: ${{ jobs.check.outputs.source-proof-root }}\n source-proof-reused:\n description: Whether this run reused an exact accepted source proof\n value: ${{ jobs.check.outputs.source-proof-reused }}\n source-proof-reuse-reason:\n description: Reuse decision or fail-closed fallback reason\n value: ${{ jobs.check.outputs.source-proof-reuse-reason }}\n source-proof-producer-run-id:\n description: Pull-request workflow run that produced the reused proof\n value: ${{ jobs.check.outputs.source-proof-producer-run-id }}\n source-proof-decision-root:\n description: Exact merge-group source-proof reuse decision root\n value: ${{ jobs.check.outputs.source-proof-decision-root }}" }, { "path": ".github/workflows/public-ops-alpha-candidate-patrol.yml", "target": ".github/workflows/.ops-alpha-candidate-patrol.yml", "interface": { "workflow_call": { "inputs": { "source-branch": { "description": "Development source branch", "required": true, "type": "string" }, "target-branch": { "description": "Alpha target branch", "required": true, "type": "string" }, "dev-workflow-path": { "description": "Repository path of the Dev Patrol workflow", "default": ".github/workflows/dev-verify-patrol.yml", "required": false, "type": "string" }, "alpha-workflow-path": { "description": "Repository path of the Alpha preflight workflow", "default": ".github/workflows/alpha-promotion-preflight.yml", "required": false, "type": "string" }, "max-age-seconds": { "description": "Maximum age of each same-SHA workflow result", "default": 604800, "required": false, "type": "number" }, "pull-request-body-prefix": { "description": "Repository-owned declaration prepended when a candidate PR is created", "default": "", "required": false, "type": "string" }, "pull-request-body-prefix-renderer": { "description": "Repository-relative Node.js renderer for an exact-source PR declaration", "default": "", "required": false, "type": "string" }, "settlement-authorized": { "description": "Run the separately permissioned candidate settlement job", "default": false, "required": false, "type": "boolean" }, "auto-merge": { "description": "Enable GitHub auto-merge on the managed exact-source Alpha PR", "default": false, "required": false, "type": "boolean" }, "merge-method": { "description": "GitHub auto-merge method: merge, squash, or rebase", "default": "merge", "required": false, "type": "string" }, "dry-run": { "description": "Evaluate without creating a branch or pull request", "default": true, "required": false, "type": "boolean" }, "reactivation-authorized": { "description": "Explicitly authorize a new evidence-bound transition for a tombstoned SHA", "default": false, "required": false, "type": "boolean" }, "runtime-ref": { "description": "Transient execution runtime; empty selects the consumer lock.", "type": "string", "required": false, "default": "" }, "contract-lock": { "description": "Optional consumer runtime lock path.", "type": "string", "required": false, "default": "" }, "runtime-selection": { "description": "Entry-resolved runtime transport for nested workflow jobs.", "type": "string", "required": false, "default": "" } }, "secrets": { "promotion-token": { "description": "Repository-owned token for source-lock branch and PR writes", "required": false } }, "outputs": { "result-path": { "value": "${{ jobs.observe.outputs.result-path }}" }, "eligible": { "value": "${{ jobs.observe.outputs.eligible }}" }, "selected-sha": { "value": "${{ jobs.observe.outputs.selected-sha }}" }, "source-lock-ref": { "value": "${{ jobs.observe.outputs.source-lock-ref }}" }, "promotion-pr": { "value": "${{ jobs.settle.outputs.promotion-pr || jobs.observe.outputs.active-candidate-pr }}" }, "controller-state": { "value": "${{ jobs.settle.outputs.controller-state || jobs.observe.outputs.controller-state }}" }, "active-candidate-pr": { "value": "${{ jobs.settle.outputs.active-candidate-pr || jobs.observe.outputs.active-candidate-pr }}" }, "next-candidate-sha": { "value": "${{ jobs.settle.outputs.next-candidate-sha || jobs.observe.outputs.next-candidate-sha }}" }, "settlement-action": { "value": "${{ jobs.settle.outputs.settlement-action || 'none' }}" }, "prior-state-root": { "value": "${{ jobs.settle.outputs.prior-state-root || jobs.observe.outputs.prior-state-root }}" }, "train-root": { "value": "${{ jobs.settle.outputs.train-root || jobs.observe.outputs.train-root }}" }, "cut-root": { "value": "${{ jobs.settle.outputs.cut-root || jobs.observe.outputs.cut-root }}" }, "candidate-generation": { "value": "${{ jobs.settle.outputs.candidate-generation || jobs.observe.outputs.candidate-generation }}" }, "candidate-tree-sha": { "value": "${{ jobs.settle.outputs.candidate-tree-sha || jobs.observe.outputs.candidate-tree-sha }}" }, "runtime-sha": { "value": "${{ jobs.observe.outputs.runtime-sha }}" }, "drift-root": { "value": "${{ jobs.settle.outputs.drift-root || jobs.observe.outputs.drift-root }}" }, "hold-root": { "value": "${{ jobs.settle.outputs.hold-root || jobs.observe.outputs.hold-root }}" } } } }, "permissions": { "actions": "read", "contents": "read", "pull-requests": "read" }, "interfaceSource": "on:\n workflow_call:\n inputs:\n source-branch:\n description: Development source branch\n required: true\n type: string\n target-branch:\n description: Alpha target branch\n required: true\n type: string\n dev-workflow-path:\n description: Repository path of the Dev Patrol workflow\n default: .github/workflows/dev-verify-patrol.yml\n required: false\n type: string\n alpha-workflow-path:\n description: Repository path of the Alpha preflight workflow\n default: .github/workflows/alpha-promotion-preflight.yml\n required: false\n type: string\n max-age-seconds:\n description: Maximum age of each same-SHA workflow result\n default: 604800\n required: false\n type: number\n pull-request-body-prefix:\n description: Repository-owned declaration prepended when a candidate PR is created\n default: \"\"\n required: false\n type: string\n pull-request-body-prefix-renderer:\n description: Repository-relative Node.js renderer for an exact-source PR declaration\n default: \"\"\n required: false\n type: string\n settlement-authorized:\n description: Run the separately permissioned candidate settlement job\n default: false\n required: false\n type: boolean\n auto-merge:\n description: Enable GitHub auto-merge on the managed exact-source Alpha PR\n default: false\n required: false\n type: boolean\n merge-method:\n description: \"GitHub auto-merge method: merge, squash, or rebase\"\n default: merge\n required: false\n type: string\n dry-run:\n description: Evaluate without creating a branch or pull request\n default: true\n required: false\n type: boolean\n reactivation-authorized:\n description: Explicitly authorize a new evidence-bound transition for a tombstoned SHA\n default: false\n required: false\n type: boolean\n runtime-ref:\n description: Transient execution runtime; empty selects the consumer lock.\n type: string\n required: false\n default: \"\"\n contract-lock:\n description: Optional consumer runtime lock path.\n type: string\n required: false\n default: \"\"\n runtime-selection:\n description: Entry-resolved runtime transport for nested workflow jobs.\n type: string\n required: false\n default: \"\"\n secrets:\n promotion-token:\n description: Repository-owned token for source-lock branch and PR writes\n required: false\n outputs:\n result-path:\n value: ${{ jobs.observe.outputs.result-path }}\n eligible:\n value: ${{ jobs.observe.outputs.eligible }}\n selected-sha:\n value: ${{ jobs.observe.outputs.selected-sha }}\n source-lock-ref:\n value: ${{ jobs.observe.outputs.source-lock-ref }}\n promotion-pr:\n value: ${{ jobs.settle.outputs.promotion-pr || jobs.observe.outputs.active-candidate-pr }}\n controller-state:\n value: ${{ jobs.settle.outputs.controller-state || jobs.observe.outputs.controller-state }}\n active-candidate-pr:\n value: ${{ jobs.settle.outputs.active-candidate-pr || jobs.observe.outputs.active-candidate-pr }}\n next-candidate-sha:\n value: ${{ jobs.settle.outputs.next-candidate-sha || jobs.observe.outputs.next-candidate-sha }}\n settlement-action:\n value: ${{ jobs.settle.outputs.settlement-action || 'none' }}\n prior-state-root:\n value: ${{ jobs.settle.outputs.prior-state-root || jobs.observe.outputs.prior-state-root }}\n train-root:\n value: ${{ jobs.settle.outputs.train-root || jobs.observe.outputs.train-root }}\n cut-root:\n value: ${{ jobs.settle.outputs.cut-root || jobs.observe.outputs.cut-root }}\n candidate-generation:\n value: ${{ jobs.settle.outputs.candidate-generation || jobs.observe.outputs.candidate-generation }}\n candidate-tree-sha:\n value: ${{ jobs.settle.outputs.candidate-tree-sha || jobs.observe.outputs.candidate-tree-sha }}\n runtime-sha:\n value: ${{ jobs.observe.outputs.runtime-sha }}\n drift-root:\n value: ${{ jobs.settle.outputs.drift-root || jobs.observe.outputs.drift-root }}\n hold-root:\n value: ${{ jobs.settle.outputs.hold-root || jobs.observe.outputs.hold-root }}" }, { "path": ".github/workflows/public-ops-warrant-cancel.yml", "target": ".github/workflows/.ops-warrant-cancel.yml", "interface": { "workflow_call": { "inputs": { "target-branch": { "description": "Protected dev branch", "type": "string", "required": true }, "expected-pr-number": { "description": "Exact PR owning the queued candidate", "type": "number", "required": true }, "expected-candidate-id": { "description": "Exact queued candidate content root", "type": "string", "required": true }, "expected-source-head-sha": { "description": "Exact source head recorded in the queue", "type": "string", "required": true }, "observed-source-head-sha": { "description": "Exact source head observed on the terminal event", "type": "string", "required": true }, "expected-old-state-root": { "description": "Exact queue root observed by the caller", "type": "string", "required": true }, "event-action": { "description": "closed, cancelled, or dequeued", "type": "string", "required": true }, "outcome": { "description": "cancelled or dequeued", "type": "string", "required": true }, "terminal-evidence-root": { "description": "Exact immutable terminal event evidence root", "type": "string", "required": true }, "reason": { "description": "Visible terminal reason", "default": "", "type": "string", "required": false }, "runtime-ref": { "description": "Transient execution runtime; empty selects the consumer lock.", "type": "string", "required": false, "default": "" }, "contract-lock": { "description": "Optional consumer runtime lock path.", "type": "string", "required": false, "default": "" }, "runtime-selection": { "description": "Entry-resolved runtime transport for nested workflow jobs.", "type": "string", "required": false, "default": "" } }, "secrets": { "github-token": { "description": "Token permitted to advance the Buildchain Warrant state ref", "required": false } }, "outputs": { "cancellation-action": { "value": "${{ jobs.cancel.outputs.cancellation-action }}" }, "cancellation-receipt-root": { "value": "${{ jobs.cancel.outputs.cancellation-receipt-root }}" }, "final-state-root": { "value": "${{ jobs.cancel.outputs.final-state-root }}" } } } }, "permissions": { "contents": "write" }, "interfaceSource": "on:\n workflow_call:\n inputs:\n target-branch:\n description: Protected dev branch\n type: string\n required: true\n expected-pr-number:\n description: Exact PR owning the queued candidate\n type: number\n required: true\n expected-candidate-id:\n description: Exact queued candidate content root\n type: string\n required: true\n expected-source-head-sha:\n description: Exact source head recorded in the queue\n type: string\n required: true\n observed-source-head-sha:\n description: Exact source head observed on the terminal event\n type: string\n required: true\n expected-old-state-root:\n description: Exact queue root observed by the caller\n type: string\n required: true\n event-action:\n description: closed, cancelled, or dequeued\n type: string\n required: true\n outcome:\n description: cancelled or dequeued\n type: string\n required: true\n terminal-evidence-root:\n description: Exact immutable terminal event evidence root\n type: string\n required: true\n reason:\n description: Visible terminal reason\n default: \"\"\n type: string\n required: false\n runtime-ref:\n description: Transient execution runtime; empty selects the consumer lock.\n type: string\n required: false\n default: \"\"\n contract-lock:\n description: Optional consumer runtime lock path.\n type: string\n required: false\n default: \"\"\n runtime-selection:\n description: Entry-resolved runtime transport for nested workflow jobs.\n type: string\n required: false\n default: \"\"\n secrets:\n github-token:\n description: Token permitted to advance the Buildchain Warrant state ref\n required: false\n outputs:\n cancellation-action:\n value: ${{ jobs.cancel.outputs.cancellation-action }}\n cancellation-receipt-root:\n value: ${{ jobs.cancel.outputs.cancellation-receipt-root }}\n final-state-root:\n value: ${{ jobs.cancel.outputs.final-state-root }}" }, { "path": ".github/workflows/public-ops-warrant-close.yml", "target": ".github/workflows/.ops-warrant-close.yml", "interface": { "workflow_call": { "inputs": { "target-branch": { "description": "Protected dev branch", "type": "string", "required": true }, "expected-pr-number": { "description": "Exact PR holding the active Warrant", "type": "number", "required": true }, "expected-head-sha": { "description": "Exact immutable PR head", "type": "string", "required": true }, "outcome": { "description": "merged, terminal-failure, dequeued, or cancelled", "type": "string", "required": true }, "current-base-sha": { "description": "Exact latest dev base used by integration", "default": "", "type": "string", "required": false }, "replay-tree-sha": { "description": "Exact replayed Project Cut tree", "default": "", "type": "string", "required": false }, "merge-group-head-sha": { "description": "Exact GitHub merge_group candidate head", "default": "", "type": "string", "required": false }, "merge-group-tree-sha": { "description": "Exact GitHub merge_group candidate tree", "default": "", "type": "string", "required": false }, "required-context-roots-json": { "description": "Non-empty JSON array of exact final check roots", "default": "[]", "type": "string", "required": false }, "terminal-evidence-root": { "description": "Required evidence root for non-merged terminal outcomes", "default": "", "type": "string", "required": false }, "reason": { "description": "Visible terminal reason", "default": "", "type": "string", "required": false }, "runtime-ref": { "description": "Transient execution runtime; empty selects the consumer lock.", "type": "string", "required": false, "default": "" }, "contract-lock": { "description": "Optional consumer runtime lock path.", "type": "string", "required": false, "default": "" }, "runtime-selection": { "description": "Entry-resolved runtime transport for nested workflow jobs.", "type": "string", "required": false, "default": "" } }, "secrets": { "github-token": { "description": "Token permitted to advance the Buildchain Warrant state ref", "required": false } }, "outputs": { "integration-proof-root": { "value": "${{ jobs.close.outputs.integration-proof-root }}" }, "close-receipt-root": { "value": "${{ jobs.close.outputs.close-receipt-root }}" }, "final-state-root": { "value": "${{ jobs.close.outputs.final-state-root }}" }, "successor-wake-json": { "value": "${{ jobs.close.outputs.successor-wake-json }}" } } } }, "permissions": { "contents": "write" }, "interfaceSource": "on:\n workflow_call:\n inputs:\n target-branch:\n description: Protected dev branch\n type: string\n required: true\n expected-pr-number:\n description: Exact PR holding the active Warrant\n type: number\n required: true\n expected-head-sha:\n description: Exact immutable PR head\n type: string\n required: true\n outcome:\n description: merged, terminal-failure, dequeued, or cancelled\n type: string\n required: true\n current-base-sha:\n description: Exact latest dev base used by integration\n default: \"\"\n type: string\n required: false\n replay-tree-sha:\n description: Exact replayed Project Cut tree\n default: \"\"\n type: string\n required: false\n merge-group-head-sha:\n description: Exact GitHub merge_group candidate head\n default: \"\"\n type: string\n required: false\n merge-group-tree-sha:\n description: Exact GitHub merge_group candidate tree\n default: \"\"\n type: string\n required: false\n required-context-roots-json:\n description: Non-empty JSON array of exact final check roots\n default: \"[]\"\n type: string\n required: false\n terminal-evidence-root:\n description: Required evidence root for non-merged terminal outcomes\n default: \"\"\n type: string\n required: false\n reason:\n description: Visible terminal reason\n default: \"\"\n type: string\n required: false\n runtime-ref:\n description: Transient execution runtime; empty selects the consumer lock.\n type: string\n required: false\n default: \"\"\n contract-lock:\n description: Optional consumer runtime lock path.\n type: string\n required: false\n default: \"\"\n runtime-selection:\n description: Entry-resolved runtime transport for nested workflow jobs.\n type: string\n required: false\n default: \"\"\n secrets:\n github-token:\n description: Token permitted to advance the Buildchain Warrant state ref\n required: false\n outputs:\n integration-proof-root:\n value: ${{ jobs.close.outputs.integration-proof-root }}\n close-receipt-root:\n value: ${{ jobs.close.outputs.close-receipt-root }}\n final-state-root:\n value: ${{ jobs.close.outputs.final-state-root }}\n successor-wake-json:\n value: ${{ jobs.close.outputs.successor-wake-json }}" }, { "path": ".github/workflows/public-ops-dev-auto-merge.yml", "target": ".github/workflows/.ops-dev-auto-merge.yml", "interface": { "workflow_call": { "inputs": { "native-platform": { "description": "Declared platform for independent native verification.", "type": "string", "required": false, "default": "linux-x64" }, "pipeline-attempt": { "description": "Internally selected business attempt when invoked by the normal pipeline.", "type": "string", "required": false, "default": "" }, "target-branch": { "description": "Protected dev branch to merge ready PRs into", "default": "", "type": "string", "required": false }, "expected-pr-number": { "description": "Optional exact PR number for targeted Agent admission; requires expected-head-sha", "default": 0, "type": "number", "required": false }, "expected-head-sha": { "description": "Exact 40-character PR head required for targeted Agent admission", "default": "", "type": "string", "required": false }, "source-workflow-run-id": { "description": "Exact successful source workflow run retained for immediate Warrant handoff", "default": 0, "type": "number", "required": false }, "handoff-workflow-id": { "description": "Optional consumer workflow file to dispatch when another candidate owns the active Warrant", "default": "", "type": "string", "required": false }, "diagnostic-context": { "description": "Commit-status context used for PR-visible targeted admission state", "default": "Buildchain delivery intent", "type": "string", "required": false }, "delivery-warrant-mode": { "description": "Delivery Warrant rollout: off, shadow (read-only queue plan), or required", "default": "off", "type": "string", "required": false }, "source-identity-root": { "description": "Immutable semantic source identity root", "default": "", "type": "string", "required": false }, "source-patch-root": { "description": "Immutable source patch or tree-intent root", "default": "", "type": "string", "required": false }, "project-cut-proof-json": { "description": "Optional exact rooted Project Cut replay proof required when GitHub reports the PR behind the current protected base", "default": "", "type": "string", "required": false }, "plan-root": { "description": "Exact qualification plan root", "default": "", "type": "string", "required": false }, "closure-root": { "description": "Exact affected-closure root", "default": "", "type": "string", "required": false }, "dependency-root": { "description": "Exact dependency-graph root", "default": "", "type": "string", "required": false }, "toolchain-root": { "description": "Exact qualification toolchain root", "default": "", "type": "string", "required": false }, "environment-root": { "description": "Exact native execution environment contract root; required for required native qualification", "default": "", "type": "string", "required": false }, "affected-paths-json": { "description": "JSON array of covered paths; an empty array reconstructs paths from the exact successful source workflow run", "default": "[]", "type": "string", "required": false }, "shard-evidence-roots-json": { "description": "JSON array of additional native-shard evidence roots", "default": "[]", "type": "string", "required": false }, "native-proof-json": { "description": "Optional reusable semantic native proof; base-only drift is classified before use", "default": "", "type": "string", "required": false }, "native-command": { "description": "Native qualification command run after provisional Warrant selection when proof reuse is unavailable", "default": "", "type": "string", "required": false }, "native-command-root": { "description": "Optional exact root of native-command; when supplied it must match before admission or spawn", "default": "", "type": "string", "required": false }, "release-blocker-priority-json": { "description": "Optional exact rooted release-blocker priority claim", "default": "", "type": "string", "required": false }, "native-heartbeat-seconds": { "description": "Heartbeat cadence while native qualification is running", "default": 300, "type": "number", "required": false }, "delivery-class": { "description": "Bounded delivery class", "default": "native-proof-required", "type": "string", "required": false }, "delivery-priority": { "description": "Reviewed priority: ordinary, expedited, or emergency", "default": "ordinary", "type": "string", "required": false }, "warrant-lease-seconds": { "description": "Delivery Warrant lease TTL", "default": 3600, "type": "number", "required": false }, "required-status-checks": { "description": "Comma or newline separated required status/check-run name fragments", "default": "check / check", "type": "string", "required": false }, "queue-admission-context": { "description": "Exact-head status written and read back before native queue admission; required in Warrant mode", "default": "", "type": "string", "required": false }, "active-lease-context": { "description": "Exact-head lease status written and read back as pending before enqueue; required in Warrant mode", "default": "", "type": "string", "required": false }, "ready-label": { "description": "Required label for PRs eligible to merge. Empty disables the label gate.", "default": "ready", "type": "string", "required": false }, "block-labels": { "description": "Comma or newline separated labels that block merging", "default": "blocked,do-not-merge,work-in-progress", "type": "string", "required": false }, "allowed-head-prefixes": { "description": "Comma or newline separated allowed source branch prefixes", "default": "feature/,fix/,chore/,docs/,ci/,refactor/", "type": "string", "required": false }, "require-approval": { "description": "Require at least one current approval and no latest changes-requested review", "default": true, "type": "boolean", "required": false }, "same-repository-only": { "description": "Reject fork/cross-repository PR heads by default", "default": true, "type": "boolean", "required": false }, "max-merges": { "description": "Maximum PRs to merge in one run", "default": 1, "type": "number", "required": false }, "merge-method": { "description": "GitHub merge method: merge, squash, or rebase", "default": "merge", "type": "string", "required": false }, "landing-mode": { "description": "Landing mode: auto selects native queue when enabled; queue fails closed without one", "default": "auto", "type": "string", "required": false }, "defer-landing": { "description": "Qualify the exact required Warrant and publish its evidence without landing the PR", "default": false, "type": "boolean", "required": false }, "dry-run": { "description": "Plan only; do not merge PRs", "default": true, "type": "boolean", "required": false }, "source-root": { "description": "Canonical Work source root required for Warrant submission.", "type": "string", "default": "", "required": false }, "runtime-ref": { "description": "Transient execution runtime; empty selects the consumer lock.", "type": "string", "required": false, "default": "" }, "contract-lock": { "description": "Optional consumer runtime lock path.", "type": "string", "required": false, "default": "" }, "runtime-selection": { "description": "Entry-resolved runtime transport for nested workflow jobs.", "type": "string", "required": false, "default": "" } }, "secrets": { "github-token": { "description": "Optional token for reading and merging PRs. Defaults to github.token.", "required": false } }, "outputs": { "evaluated-count": { "description": "Number of PRs evaluated", "value": "${{ jobs.merge-dev-prs.outputs.evaluated-count }}" }, "merged-count": { "description": "Number of PRs directly merged, or directly eligible in dry-run mode", "value": "${{ jobs.merge-dev-prs.outputs.merged-count }}" }, "enqueued-count": { "description": "Number of PRs admitted into the native merge queue", "value": "${{ jobs.merge-dev-prs.outputs.enqueued-count }}" }, "action-count": { "description": "Number of direct merges, queue admissions, or planned actions", "value": "${{ jobs.merge-dev-prs.outputs.action-count }}" }, "skipped-count": { "description": "Number of PRs skipped", "value": "${{ jobs.merge-dev-prs.outputs.skipped-count }}" }, "final-base-sha": { "description": "Final target branch SHA after the run", "value": "${{ jobs.merge-dev-prs.outputs.final-base-sha }}" }, "admission-state": { "description": "Typed targeted admission state; empty for cadence patrol", "value": "${{ jobs.merge-dev-prs.outputs.admission-state }}" }, "admission-receipt-root": { "description": "Content root of the targeted exact-head admission receipt", "value": "${{ jobs.merge-dev-prs.outputs.admission-receipt-root }}" }, "source-proof-root": { "description": "Content root of the reusable Source Qualification Proof", "value": "${{ jobs.merge-dev-prs.outputs.source-proof-root }}" }, "warrant-receipt-root": { "description": "Content root of the selected Delivery Warrant receipt", "value": "${{ jobs.merge-dev-prs.outputs.warrant-receipt-root }}" }, "warrant-state-root": { "description": "Exact readback root of the durable Warrant queue", "value": "${{ jobs.merge-dev-prs.outputs.warrant-state-root }}" }, "warrant-state-commit": { "description": "Immutable queue commit containing the active Warrant readback", "value": "${{ jobs.merge-dev-prs.outputs.warrant-state-commit }}" }, "project-cut-proof-root": { "description": "Verified exact Project Cut replay proof root, when supplied", "value": "${{ jobs.merge-dev-prs.outputs.project-cut-proof-root }}" }, "native-proof-root": { "description": "Fresh or reused semantic native proof root", "value": "${{ jobs.merge-dev-prs.outputs.native-proof-root }}" }, "native-reuse-decision-root": { "description": "Rooted fail-closed native proof reuse decision", "value": "${{ jobs.merge-dev-prs.outputs.native-reuse-decision-root }}" }, "qualified-warrant-receipt-root": { "description": "Atomic provisional-to-qualified Warrant receipt root", "value": "${{ jobs.merge-dev-prs.outputs.qualified-warrant-receipt-root }}" }, "native-execution-transfer-root": { "description": "Content root of the cross-job native proof and state transfer", "value": "${{ jobs.merge-dev-prs.outputs.native-execution-transfer-root }}" }, "provider-finalizer-boundary-root": { "description": "Live provider readback root proving pairwise-distinct hosted native, seal, and finalizer domains", "value": "${{ jobs.merge-dev-prs.outputs.provider-finalizer-boundary-root }}" }, "provider-heartbeat-receipt-root": { "description": "Rooted independent durable heartbeat continuity receipt", "value": "${{ jobs.merge-dev-prs.outputs.provider-heartbeat-receipt-root }}" } } } }, "permissions": { "actions": "write", "contents": "write", "pull-requests": "write", "checks": "read", "statuses": "write" }, "interfaceSource": "on:\n workflow_call:\n inputs:\n native-platform:\n description: Declared platform for independent native verification.\n type: string\n required: false\n default: linux-x64\n pipeline-attempt:\n description: Internally selected business attempt when invoked by the normal pipeline.\n type: string\n required: false\n default: \"\"\n target-branch:\n description: Protected dev branch to merge ready PRs into\n default: \"\"\n type: string\n required: false\n expected-pr-number:\n description: Optional exact PR number for targeted Agent admission; requires expected-head-sha\n default: 0\n type: number\n required: false\n expected-head-sha:\n description: Exact 40-character PR head required for targeted Agent admission\n default: \"\"\n type: string\n required: false\n source-workflow-run-id:\n description: Exact successful source workflow run retained for immediate Warrant handoff\n default: 0\n type: number\n required: false\n handoff-workflow-id:\n description: Optional consumer workflow file to dispatch when another candidate owns the active Warrant\n default: \"\"\n type: string\n required: false\n diagnostic-context:\n description: Commit-status context used for PR-visible targeted admission state\n default: Buildchain delivery intent\n type: string\n required: false\n delivery-warrant-mode:\n description: \"Delivery Warrant rollout: off, shadow (read-only queue plan), or required\"\n default: off\n type: string\n required: false\n source-identity-root:\n description: Immutable semantic source identity root\n default: \"\"\n type: string\n required: false\n source-patch-root:\n description: Immutable source patch or tree-intent root\n default: \"\"\n type: string\n required: false\n project-cut-proof-json:\n description:\n Optional exact rooted Project Cut replay proof required when GitHub reports the PR\n behind the current protected base\n default: \"\"\n type: string\n required: false\n plan-root:\n description: Exact qualification plan root\n default: \"\"\n type: string\n required: false\n closure-root:\n description: Exact affected-closure root\n default: \"\"\n type: string\n required: false\n dependency-root:\n description: Exact dependency-graph root\n default: \"\"\n type: string\n required: false\n toolchain-root:\n description: Exact qualification toolchain root\n default: \"\"\n type: string\n required: false\n environment-root:\n description:\n Exact native execution environment contract root; required for required native\n qualification\n default: \"\"\n type: string\n required: false\n affected-paths-json:\n description:\n JSON array of covered paths; an empty array reconstructs paths from the exact\n successful source workflow run\n default: \"[]\"\n type: string\n required: false\n shard-evidence-roots-json:\n description: JSON array of additional native-shard evidence roots\n default: \"[]\"\n type: string\n required: false\n native-proof-json:\n description: Optional reusable semantic native proof; base-only drift is classified before use\n default: \"\"\n type: string\n required: false\n native-command:\n description:\n Native qualification command run after provisional Warrant selection when proof reuse\n is unavailable\n default: \"\"\n type: string\n required: false\n native-command-root:\n description:\n Optional exact root of native-command; when supplied it must match before admission or\n spawn\n default: \"\"\n type: string\n required: false\n release-blocker-priority-json:\n description: Optional exact rooted release-blocker priority claim\n default: \"\"\n type: string\n required: false\n native-heartbeat-seconds:\n description: Heartbeat cadence while native qualification is running\n default: 300\n type: number\n required: false\n delivery-class:\n description: Bounded delivery class\n default: native-proof-required\n type: string\n required: false\n delivery-priority:\n description: \"Reviewed priority: ordinary, expedited, or emergency\"\n default: ordinary\n type: string\n required: false\n warrant-lease-seconds:\n description: Delivery Warrant lease TTL\n default: 3600\n type: number\n required: false\n required-status-checks:\n description: Comma or newline separated required status/check-run name fragments\n default: check / check\n type: string\n required: false\n queue-admission-context:\n description:\n Exact-head status written and read back before native queue admission; required in\n Warrant mode\n default: \"\"\n type: string\n required: false\n active-lease-context:\n description:\n Exact-head lease status written and read back as pending before enqueue; required in\n Warrant mode\n default: \"\"\n type: string\n required: false\n ready-label:\n description: Required label for PRs eligible to merge. Empty disables the label gate.\n default: ready\n type: string\n required: false\n block-labels:\n description: Comma or newline separated labels that block merging\n default: blocked,do-not-merge,work-in-progress\n type: string\n required: false\n allowed-head-prefixes:\n description: Comma or newline separated allowed source branch prefixes\n default: feature/,fix/,chore/,docs/,ci/,refactor/\n type: string\n required: false\n require-approval:\n description: Require at least one current approval and no latest changes-requested review\n default: true\n type: boolean\n required: false\n same-repository-only:\n description: Reject fork/cross-repository PR heads by default\n default: true\n type: boolean\n required: false\n max-merges:\n description: Maximum PRs to merge in one run\n default: 1\n type: number\n required: false\n merge-method:\n description: \"GitHub merge method: merge, squash, or rebase\"\n default: merge\n type: string\n required: false\n landing-mode:\n description: \"Landing mode: auto selects native queue when enabled; queue fails closed without one\"\n default: auto\n type: string\n required: false\n defer-landing:\n description: Qualify the exact required Warrant and publish its evidence without landing the PR\n default: false\n type: boolean\n required: false\n dry-run:\n description: Plan only; do not merge PRs\n default: true\n type: boolean\n required: false\n source-root:\n description: Canonical Work source root required for Warrant submission.\n type: string\n default: \"\"\n required: false\n runtime-ref:\n description: Transient execution runtime; empty selects the consumer lock.\n type: string\n required: false\n default: \"\"\n contract-lock:\n description: Optional consumer runtime lock path.\n type: string\n required: false\n default: \"\"\n runtime-selection:\n description: Entry-resolved runtime transport for nested workflow jobs.\n type: string\n required: false\n default: \"\"\n secrets:\n github-token:\n description: Optional token for reading and merging PRs. Defaults to github.token.\n required: false\n outputs:\n evaluated-count:\n description: Number of PRs evaluated\n value: ${{ jobs.merge-dev-prs.outputs.evaluated-count }}\n merged-count:\n description: Number of PRs directly merged, or directly eligible in dry-run mode\n value: ${{ jobs.merge-dev-prs.outputs.merged-count }}\n enqueued-count:\n description: Number of PRs admitted into the native merge queue\n value: ${{ jobs.merge-dev-prs.outputs.enqueued-count }}\n action-count:\n description: Number of direct merges, queue admissions, or planned actions\n value: ${{ jobs.merge-dev-prs.outputs.action-count }}\n skipped-count:\n description: Number of PRs skipped\n value: ${{ jobs.merge-dev-prs.outputs.skipped-count }}\n final-base-sha:\n description: Final target branch SHA after the run\n value: ${{ jobs.merge-dev-prs.outputs.final-base-sha }}\n admission-state:\n description: Typed targeted admission state; empty for cadence patrol\n value: ${{ jobs.merge-dev-prs.outputs.admission-state }}\n admission-receipt-root:\n description: Content root of the targeted exact-head admission receipt\n value: ${{ jobs.merge-dev-prs.outputs.admission-receipt-root }}\n source-proof-root:\n description: Content root of the reusable Source Qualification Proof\n value: ${{ jobs.merge-dev-prs.outputs.source-proof-root }}\n warrant-receipt-root:\n description: Content root of the selected Delivery Warrant receipt\n value: ${{ jobs.merge-dev-prs.outputs.warrant-receipt-root }}\n warrant-state-root:\n description: Exact readback root of the durable Warrant queue\n value: ${{ jobs.merge-dev-prs.outputs.warrant-state-root }}\n warrant-state-commit:\n description: Immutable queue commit containing the active Warrant readback\n value: ${{ jobs.merge-dev-prs.outputs.warrant-state-commit }}\n project-cut-proof-root:\n description: Verified exact Project Cut replay proof root, when supplied\n value: ${{ jobs.merge-dev-prs.outputs.project-cut-proof-root }}\n native-proof-root:\n description: Fresh or reused semantic native proof root\n value: ${{ jobs.merge-dev-prs.outputs.native-proof-root }}\n native-reuse-decision-root:\n description: Rooted fail-closed native proof reuse decision\n value: ${{ jobs.merge-dev-prs.outputs.native-reuse-decision-root }}\n qualified-warrant-receipt-root:\n description: Atomic provisional-to-qualified Warrant receipt root\n value: ${{ jobs.merge-dev-prs.outputs.qualified-warrant-receipt-root }}\n native-execution-transfer-root:\n description: Content root of the cross-job native proof and state transfer\n value: ${{ jobs.merge-dev-prs.outputs.native-execution-transfer-root }}\n provider-finalizer-boundary-root:\n description:\n Live provider readback root proving pairwise-distinct hosted native, seal, and\n finalizer domains\n value: ${{ jobs.merge-dev-prs.outputs.provider-finalizer-boundary-root }}\n provider-heartbeat-receipt-root:\n description: Rooted independent durable heartbeat continuity receipt\n value: ${{ jobs.merge-dev-prs.outputs.provider-heartbeat-receipt-root }}" }, { "path": ".github/workflows/public-ops-dev-qualification-patrol.yml", "target": ".github/workflows/.ops-dev-qualification-patrol.yml", "interface": { "workflow_call": { "inputs": { "source-branch": { "description": "Development branch whose latest head is qualified", "required": true, "type": "string" }, "dev-workflow-path": { "description": "Heavy Dev qualification workflow path", "default": ".github/workflows/dev-verify-patrol.yml", "required": false, "type": "string" }, "preflight-workflow-path": { "description": "Lightweight exact-source preflight workflow path", "default": ".github/workflows/alpha-promotion-preflight.yml", "required": false, "type": "string" }, "priority-workflows-json": { "description": "JSON array of Alpha and release workflows that retain runner priority", "default": "[]", "required": false, "type": "string" }, "dispatch-inputs-json": { "description": "Scalar workflow_dispatch inputs; source-sha is controller-owned", "default": "{}", "required": false, "type": "string" }, "max-attempts": { "description": "Maximum total attempts for an exact Dev qualification run", "default": 2, "required": false, "type": "number" }, "mutation-authorized": { "description": "Permit the separately permissioned mutation job", "default": false, "required": false, "type": "boolean" }, "dry-run": { "description": "Observe without dispatching or rerunning a workflow", "default": true, "required": false, "type": "boolean" }, "runtime-ref": { "description": "Transient execution runtime; empty selects the consumer lock.", "type": "string", "required": false, "default": "" }, "contract-lock": { "description": "Optional consumer runtime lock path.", "type": "string", "required": false, "default": "" }, "runtime-selection": { "description": "Entry-resolved runtime transport for nested workflow jobs.", "type": "string", "required": false, "default": "" } }, "secrets": { "qualification-token": { "description": "Repository-owned token with Actions write permission", "required": false } }, "outputs": { "state": { "value": "${{ jobs.mutate.outputs.state || jobs.observe.outputs.state }}" }, "action": { "value": "${{ jobs.mutate.outputs.action || jobs.observe.outputs.action }}" }, "reason": { "value": "${{ jobs.mutate.outputs.reason || jobs.observe.outputs.reason }}" }, "source-sha": { "value": "${{ jobs.mutate.outputs.source-sha || jobs.observe.outputs.source-sha }}" }, "pending-sha": { "value": "${{ jobs.mutate.outputs.pending-sha || jobs.observe.outputs.pending-sha }}" }, "active-run-id": { "value": "${{ jobs.mutate.outputs.active-run-id || jobs.observe.outputs.active-run-id }}" }, "decision-root": { "value": "${{ jobs.mutate.outputs.decision-root || jobs.observe.outputs.decision-root }}" } } } }, "permissions": { "actions": "read", "contents": "read" }, "interfaceSource": "on:\n workflow_call:\n inputs:\n source-branch:\n description: Development branch whose latest head is qualified\n required: true\n type: string\n dev-workflow-path:\n description: Heavy Dev qualification workflow path\n default: .github/workflows/dev-verify-patrol.yml\n required: false\n type: string\n preflight-workflow-path:\n description: Lightweight exact-source preflight workflow path\n default: .github/workflows/alpha-promotion-preflight.yml\n required: false\n type: string\n priority-workflows-json:\n description: JSON array of Alpha and release workflows that retain runner priority\n default: \"[]\"\n required: false\n type: string\n dispatch-inputs-json:\n description: Scalar workflow_dispatch inputs; source-sha is controller-owned\n default: \"{}\"\n required: false\n type: string\n max-attempts:\n description: Maximum total attempts for an exact Dev qualification run\n default: 2\n required: false\n type: number\n mutation-authorized:\n description: Permit the separately permissioned mutation job\n default: false\n required: false\n type: boolean\n dry-run:\n description: Observe without dispatching or rerunning a workflow\n default: true\n required: false\n type: boolean\n runtime-ref:\n description: Transient execution runtime; empty selects the consumer lock.\n type: string\n required: false\n default: \"\"\n contract-lock:\n description: Optional consumer runtime lock path.\n type: string\n required: false\n default: \"\"\n runtime-selection:\n description: Entry-resolved runtime transport for nested workflow jobs.\n type: string\n required: false\n default: \"\"\n secrets:\n qualification-token:\n description: Repository-owned token with Actions write permission\n required: false\n outputs:\n state:\n value: ${{ jobs.mutate.outputs.state || jobs.observe.outputs.state }}\n action:\n value: ${{ jobs.mutate.outputs.action || jobs.observe.outputs.action }}\n reason:\n value: ${{ jobs.mutate.outputs.reason || jobs.observe.outputs.reason }}\n source-sha:\n value: ${{ jobs.mutate.outputs.source-sha || jobs.observe.outputs.source-sha }}\n pending-sha:\n value: ${{ jobs.mutate.outputs.pending-sha || jobs.observe.outputs.pending-sha }}\n active-run-id:\n value: ${{ jobs.mutate.outputs.active-run-id || jobs.observe.outputs.active-run-id }}\n decision-root:\n value: ${{ jobs.mutate.outputs.decision-root || jobs.observe.outputs.decision-root }}" }, { "path": ".github/workflows/public-ops-housekeeping.yml", "target": ".github/workflows/.ops-housekeeping.yml", "interface": { "workflow_call": { "inputs": { "repository": { "description": "Repository to inspect as owner/repo. Empty uses the caller repository.", "required": false, "type": "string", "default": "" }, "target-branch": { "description": "Optional primary ancestry target. Empty discovers the default and all protected mainline families repository-wide.", "required": false, "type": "string", "default": "" }, "mode": { "description": "Execution mode: report or apply.", "required": false, "type": "string", "default": "report" }, "apply-enabled": { "description": "Explicit positive mutation gate. Must be true together with mode=apply.", "required": false, "type": "boolean", "default": false }, "protected-patterns": { "description": "Comma or newline separated protected branch globs.", "required": false, "type": "string", "default": "dev/**,alpha/**,release/**,publish-gate/**" }, "retained-patterns": { "description": "Comma or newline separated retained branch globs.", "required": false, "type": "string", "default": "train/**,authority/**" }, "temporary-branch-patterns": { "description": "Positive allowlist of temporary development branch globs eligible for deletion.", "required": false, "type": "string", "default": "feature/**,fix/**,chore/**,docs/**,ci/**,refactor/**" }, "stale-days": { "description": "Age threshold for stale pull-request reporting and optional labeling.", "required": false, "type": "number", "default": 30 }, "stale-pull-request-label": { "description": "Optional label for stale pull requests. Empty keeps pull requests report-only.", "required": false, "type": "string", "default": "" }, "max-actions": { "description": "Maximum ordered plan actions eligible for one apply run.", "required": false, "type": "number", "default": 20 }, "artifact-retention-days": { "description": "Retention for plan, report, and receipt artifacts.", "required": false, "type": "number", "default": 30 }, "artifact-prefix": { "description": "Non-secret artifact name prefix.", "required": false, "type": "string", "default": "engineering-housekeeper" }, "runtime-ref": { "description": "Transient execution runtime; empty selects the consumer lock.", "type": "string", "required": false, "default": "" }, "contract-lock": { "description": "Optional consumer runtime lock path.", "type": "string", "required": false, "default": "" }, "runtime-selection": { "description": "Entry-resolved runtime transport for nested workflow jobs.", "type": "string", "required": false, "default": "" } }, "secrets": { "housekeeper_token": { "description": "Optional caller-owned token. Defaults to the caller-scoped github.token.", "required": false }, "housekeeper_app_id": { "description": "Optional caller-owned GitHub App id; must be paired with housekeeper_app_private_key.", "required": false }, "housekeeper_app_private_key": { "description": "Optional caller-owned GitHub App private key; must be paired with housekeeper_app_id.", "required": false } }, "outputs": { "plan-root": { "description": "Root of the exact observed plan.", "value": "${{ jobs.plan.outputs.plan-root }}" }, "report-receipt-root": { "description": "Root of the default dry-run receipt.", "value": "${{ jobs.plan.outputs.report-receipt-root }}" }, "branch-receipt-root": { "description": "Root of the branch apply receipt, or empty when no branch apply job ran.", "value": "${{ jobs.delete-branches.outputs.receipt-root }}" }, "pull-request-receipt-root": { "description": "Root of the pull-request apply receipt, or empty when no pull-request apply job ran.", "value": "${{ jobs.label-pull-requests.outputs.receipt-root }}" }, "action-count": { "description": "Number of exact actions in the plan before the apply limit.", "value": "${{ jobs.plan.outputs.action-count }}" }, "outcome": { "description": "Plan outcome: no-actions, report-ready, or apply-ready.", "value": "${{ jobs.plan.outputs.outcome }}" }, "plan-artifact": { "description": "Artifact containing the exact rooted plan.", "value": "${{ jobs.plan.outputs.plan-artifact }}" }, "report-artifact": { "description": "Artifact containing the decision and dry-run outcome report.", "value": "${{ jobs.plan.outputs.report-artifact }}" }, "receipt-artifact": { "description": "Artifact containing the default dry-run receipt.", "value": "${{ jobs.plan.outputs.receipt-artifact }}" } } } }, "permissions": {}, "interfaceSource": "on:\n workflow_call:\n inputs:\n repository:\n description: Repository to inspect as owner/repo. Empty uses the caller repository.\n required: false\n type: string\n default: \"\"\n target-branch:\n description: Optional primary ancestry target. Empty discovers the default and all protected\n mainline families repository-wide.\n required: false\n type: string\n default: \"\"\n mode:\n description: \"Execution mode: report or apply.\"\n required: false\n type: string\n default: report\n apply-enabled:\n description: Explicit positive mutation gate. Must be true together with mode=apply.\n required: false\n type: boolean\n default: false\n protected-patterns:\n description: Comma or newline separated protected branch globs.\n required: false\n type: string\n default: dev/**,alpha/**,release/**,publish-gate/**\n retained-patterns:\n description: Comma or newline separated retained branch globs.\n required: false\n type: string\n default: train/**,authority/**\n temporary-branch-patterns:\n description: Positive allowlist of temporary development branch globs eligible for deletion.\n required: false\n type: string\n default: feature/**,fix/**,chore/**,docs/**,ci/**,refactor/**\n stale-days:\n description: Age threshold for stale pull-request reporting and optional labeling.\n required: false\n type: number\n default: 30\n stale-pull-request-label:\n description: Optional label for stale pull requests. Empty keeps pull requests report-only.\n required: false\n type: string\n default: \"\"\n max-actions:\n description: Maximum ordered plan actions eligible for one apply run.\n required: false\n type: number\n default: 20\n artifact-retention-days:\n description: Retention for plan, report, and receipt artifacts.\n required: false\n type: number\n default: 30\n artifact-prefix:\n description: Non-secret artifact name prefix.\n required: false\n type: string\n default: engineering-housekeeper\n runtime-ref:\n description: Transient execution runtime; empty selects the consumer lock.\n type: string\n required: false\n default: \"\"\n contract-lock:\n description: Optional consumer runtime lock path.\n type: string\n required: false\n default: \"\"\n runtime-selection:\n description: Entry-resolved runtime transport for nested workflow jobs.\n type: string\n required: false\n default: \"\"\n secrets:\n housekeeper_token:\n description: Optional caller-owned token. Defaults to the caller-scoped github.token.\n required: false\n housekeeper_app_id:\n description: Optional caller-owned GitHub App id; must be paired with housekeeper_app_private_key.\n required: false\n housekeeper_app_private_key:\n description: Optional caller-owned GitHub App private key; must be paired with housekeeper_app_id.\n required: false\n outputs:\n plan-root:\n description: Root of the exact observed plan.\n value: ${{ jobs.plan.outputs.plan-root }}\n report-receipt-root:\n description: Root of the default dry-run receipt.\n value: ${{ jobs.plan.outputs.report-receipt-root }}\n branch-receipt-root:\n description: Root of the branch apply receipt, or empty when no branch apply job ran.\n value: ${{ jobs.delete-branches.outputs.receipt-root }}\n pull-request-receipt-root:\n description: Root of the pull-request apply receipt, or empty when no pull-request apply job ran.\n value: ${{ jobs.label-pull-requests.outputs.receipt-root }}\n action-count:\n description: Number of exact actions in the plan before the apply limit.\n value: ${{ jobs.plan.outputs.action-count }}\n outcome:\n description: \"Plan outcome: no-actions, report-ready, or apply-ready.\"\n value: ${{ jobs.plan.outputs.outcome }}\n plan-artifact:\n description: Artifact containing the exact rooted plan.\n value: ${{ jobs.plan.outputs.plan-artifact }}\n report-artifact:\n description: Artifact containing the decision and dry-run outcome report.\n value: ${{ jobs.plan.outputs.report-artifact }}\n receipt-artifact:\n description: Artifact containing the default dry-run receipt.\n value: ${{ jobs.plan.outputs.receipt-artifact }}" }, { "path": ".github/workflows/public-release-artifact-attestation.yml", "target": ".github/workflows/.release-artifact-attestation.yml", "interface": { "workflow_call": { "inputs": { "evidence-run-id": { "description": "Exact successful caller workflow run containing the sealed subject, platform manifest, and Release Passport.", "type": "string", "required": true }, "source-sha": { "description": "Exact caller source SHA already bound by the build manifest and Release Passport.", "type": "string", "required": true }, "subject-artifact-name": { "description": "GitHub Actions artifact containing the exact release subject.", "type": "string", "required": true }, "subject-relative-path": { "description": "Safe relative path to the single subject inside subject-artifact-name.", "type": "string", "required": true }, "platform-manifest-artifact-name": { "description": "GitHub Actions artifact containing the original build-runner platform manifest.", "type": "string", "required": true }, "platform-manifest-relative-path": { "description": "Safe relative path to the platform manifest JSON.", "type": "string", "required": true }, "release-passport-artifact-name": { "description": "GitHub Actions artifact containing the pre-attestation Buildchain Release Passport.", "type": "string", "required": true }, "release-passport-relative-path": { "description": "Safe relative path to buildchain.release.json.", "type": "string", "default": "buildchain.release.json", "required": false }, "policy-json": { "description": "Exact buildchain.github-artifact-attestation-policy/v1 JSON already bound by the Release Passport.", "type": "string", "required": true }, "evidence-artifact-name": { "description": "Retained GitHub Actions artifact containing the Sigstore bundle and Buildchain evidence.", "type": "string", "default": "buildchain-github-artifact-attestation-evidence", "required": false }, "environment": { "description": "Caller-repository protected environment governing real release attestations.", "type": "string", "default": "buildchain-artifact-attestation", "required": false }, "retention-days": { "description": "Retention for offline attestation evidence.", "type": "number", "default": 90, "required": false }, "runtime-ref": { "description": "Transient execution runtime; empty selects the consumer lock.", "type": "string", "required": false, "default": "" }, "contract-lock": { "description": "Optional consumer runtime lock path.", "type": "string", "required": false, "default": "" }, "runtime-selection": { "description": "Entry-resolved runtime transport for nested workflow jobs.", "type": "string", "required": false, "default": "" } }, "outputs": { "attestation-id": { "description": "GitHub attestation id.", "value": "${{ jobs.attest.outputs.attestation-id }}" }, "attestation-url": { "description": "GitHub attestation URL.", "value": "${{ jobs.attest.outputs.attestation-url }}" }, "bundle-digest": { "description": "SHA-256 of the retained Sigstore bundle.", "value": "${{ jobs.attest.outputs.bundle-digest }}" }, "evidence-root": { "description": "Semantic root of buildchain.github-artifact-attestation-evidence/v1.", "value": "${{ jobs.attest.outputs.evidence-root }}" }, "evidence-artifact-name": { "description": "Uploaded offline evidence artifact name.", "value": "${{ inputs.evidence-artifact-name }}" } } } }, "permissions": { "actions": "read", "artifact-metadata": "write", "attestations": "write", "contents": "read", "id-token": "write" }, "interfaceSource": "on:\n workflow_call:\n inputs:\n evidence-run-id:\n description: Exact successful caller workflow run containing the sealed subject, platform manifest,\n and Release Passport.\n type: string\n required: true\n source-sha:\n description: Exact caller source SHA already bound by the build manifest and Release Passport.\n type: string\n required: true\n subject-artifact-name:\n description: GitHub Actions artifact containing the exact release subject.\n type: string\n required: true\n subject-relative-path:\n description: Safe relative path to the single subject inside subject-artifact-name.\n type: string\n required: true\n platform-manifest-artifact-name:\n description: GitHub Actions artifact containing the original build-runner platform manifest.\n type: string\n required: true\n platform-manifest-relative-path:\n description: Safe relative path to the platform manifest JSON.\n type: string\n required: true\n release-passport-artifact-name:\n description: GitHub Actions artifact containing the pre-attestation Buildchain Release Passport.\n type: string\n required: true\n release-passport-relative-path:\n description: Safe relative path to buildchain.release.json.\n type: string\n default: buildchain.release.json\n required: false\n policy-json:\n description: Exact buildchain.github-artifact-attestation-policy/v1 JSON already bound by the\n Release Passport.\n type: string\n required: true\n evidence-artifact-name:\n description: Retained GitHub Actions artifact containing the Sigstore bundle and Buildchain evidence.\n type: string\n default: buildchain-github-artifact-attestation-evidence\n required: false\n environment:\n description: Caller-repository protected environment governing real release attestations.\n type: string\n default: buildchain-artifact-attestation\n required: false\n retention-days:\n description: Retention for offline attestation evidence.\n type: number\n default: 90\n required: false\n runtime-ref:\n description: Transient execution runtime; empty selects the consumer lock.\n type: string\n required: false\n default: \"\"\n contract-lock:\n description: Optional consumer runtime lock path.\n type: string\n required: false\n default: \"\"\n runtime-selection:\n description: Entry-resolved runtime transport for nested workflow jobs.\n type: string\n required: false\n default: \"\"\n outputs:\n attestation-id:\n description: GitHub attestation id.\n value: ${{ jobs.attest.outputs.attestation-id }}\n attestation-url:\n description: GitHub attestation URL.\n value: ${{ jobs.attest.outputs.attestation-url }}\n bundle-digest:\n description: SHA-256 of the retained Sigstore bundle.\n value: ${{ jobs.attest.outputs.bundle-digest }}\n evidence-root:\n description: Semantic root of buildchain.github-artifact-attestation-evidence/v1.\n value: ${{ jobs.attest.outputs.evidence-root }}\n evidence-artifact-name:\n description: Uploaded offline evidence artifact name.\n value: ${{ inputs.evidence-artifact-name }}" }, { "path": ".github/workflows/public-release-paper.yml", "target": ".github/workflows/.release-paper.yml", "interface": { "workflow_call": { "inputs": { "working-directory": { "default": ".", "type": "string", "required": false }, "toolchain-type": { "default": "config", "type": "string", "required": false }, "verify-command": { "default": "make check", "type": "string", "required": false }, "package-name": { "default": "", "type": "string", "required": false }, "publish-dist-tag": { "default": "", "type": "string", "required": false }, "target-ref": { "default": "", "type": "string", "required": false }, "target-sha": { "default": "", "type": "string", "required": false }, "publisher-workflow-path": { "description": "Repository-local workflow path configured as the npm trusted publisher", "default": ".github/workflows/public-release-paper.yml", "type": "string", "required": false }, "artifact-name": { "default": "paper-publication", "type": "string", "required": false }, "artifact-paths": { "description": "Declared release assets in addition to Buildchain publication evidence and npm package bytes", "default": "_build/*.pdf", "type": "string", "required": false }, "artifact-retention-days": { "default": 30, "type": "number", "required": false }, "required-status-check": { "default": "check / check", "type": "string", "required": false }, "branch-protection-bypass-apps": { "default": "github-actions", "type": "string", "required": false }, "github-release": { "default": true, "type": "boolean", "required": false }, "release-passport-output-dir": { "default": ".buildchain/release-passport", "type": "string", "required": false }, "release-passport-product-name": { "default": "", "type": "string", "required": false }, "release-passport-impact-json": { "default": "", "type": "string", "required": false }, "github-governance-receipt-json": { "description": "Fresh qualifying governance receipt for the exact publication repository and target ref", "default": "", "type": "string", "required": false }, "dry-run": { "default": false, "type": "boolean", "required": false }, "runtime-ref": { "description": "Transient execution runtime; empty selects the consumer lock.", "type": "string", "required": false, "default": "" }, "contract-lock": { "description": "Optional consumer runtime lock path.", "type": "string", "required": false, "default": "" }, "runtime-selection": { "description": "Entry-resolved runtime transport for nested workflow jobs.", "type": "string", "required": false, "default": "" } }, "secrets": { "KUNGFU_GOVERNANCE_AUDITOR_APP_PRIVATE_KEY": { "description": "Private key for the dedicated read-only GitHub governance auditor App", "required": false }, "BUILDCHAIN_GENERATED_WRITE_APP_CLIENT_ID": { "description": "Preferred GitHub App client ID for generated repository writes", "required": false }, "BUILDCHAIN_GENERATED_WRITE_APP_PRIVATE_KEY": { "description": "Preferred GitHub App private key for generated repository writes", "required": false }, "BUILDCHAIN_GENERATED_WRITE_TOKEN": { "description": "Equivalent narrow token fallback for generated repository writes", "required": false } }, "outputs": { "package-name": { "value": "${{ jobs.publication-candidate.outputs.package-name }}" }, "package-version": { "value": "${{ jobs.publication-candidate.outputs.package-version }}" }, "public-release-tag": { "value": "${{ jobs.publish.outputs.public-release-tag }}" }, "release-passport-path": { "value": "${{ jobs.publish.outputs.release-passport-path }}" }, "github-release-url": { "value": "${{ jobs.publish.outputs.github-release-url }}" }, "upstream-release-json": { "description": "Exact post-publication release envelope for downstream propagation", "value": "${{ jobs.publish.outputs.upstream-release-json }}" }, "propagation-work-artifact": { "description": "Artifact containing one paused typed propagation work unit per configured downstream target", "value": "${{ jobs.publish.outputs.propagation-work-artifact }}" }, "controller-plan-json": { "description": "Paper publication controller plan json", "value": "${{ jobs.publish.outputs.controller-plan-json }}" }, "controller-plan-digest": { "description": "Paper publication controller plan digest", "value": "${{ jobs.publish.outputs.controller-plan-digest }}" }, "controller-plan-artifact": { "description": "Paper publication controller plan artifact", "value": "${{ jobs.publish.outputs.controller-plan-artifact }}" }, "controller-receipt-json": { "description": "Paper publication controller receipt json", "value": "${{ jobs.publish.outputs.controller-receipt-json }}" }, "controller-receipt-digest": { "description": "Paper publication controller receipt digest", "value": "${{ jobs.publish.outputs.controller-receipt-digest }}" }, "controller-receipt-artifact": { "description": "Paper publication controller receipt artifact", "value": "${{ jobs.publish.outputs.controller-receipt-artifact }}" }, "controller-receipt-status": { "description": "Paper publication controller receipt status", "value": "${{ jobs.publish.outputs.controller-receipt-status }}" } } } }, "permissions": { "contents": "read" }, "interfaceSource": "on:\n workflow_call:\n inputs:\n working-directory:\n default: .\n type: string\n required: false\n toolchain-type:\n default: config\n type: string\n required: false\n verify-command:\n default: make check\n type: string\n required: false\n package-name:\n default: \"\"\n type: string\n required: false\n publish-dist-tag:\n default: \"\"\n type: string\n required: false\n target-ref:\n default: \"\"\n type: string\n required: false\n target-sha:\n default: \"\"\n type: string\n required: false\n publisher-workflow-path:\n description: Repository-local workflow path configured as the npm trusted publisher\n default: .github/workflows/public-release-paper.yml\n type: string\n required: false\n artifact-name:\n default: paper-publication\n type: string\n required: false\n artifact-paths:\n description: Declared release assets in addition to Buildchain publication evidence and npm package\n bytes\n default: _build/*.pdf\n type: string\n required: false\n artifact-retention-days:\n default: 30\n type: number\n required: false\n required-status-check:\n default: check / check\n type: string\n required: false\n branch-protection-bypass-apps:\n default: github-actions\n type: string\n required: false\n github-release:\n default: true\n type: boolean\n required: false\n release-passport-output-dir:\n default: .buildchain/release-passport\n type: string\n required: false\n release-passport-product-name:\n default: \"\"\n type: string\n required: false\n release-passport-impact-json:\n default: \"\"\n type: string\n required: false\n github-governance-receipt-json:\n description: Fresh qualifying governance receipt for the exact publication repository and target ref\n default: \"\"\n type: string\n required: false\n dry-run:\n default: false\n type: boolean\n required: false\n runtime-ref:\n description: Transient execution runtime; empty selects the consumer lock.\n type: string\n required: false\n default: \"\"\n contract-lock:\n description: Optional consumer runtime lock path.\n type: string\n required: false\n default: \"\"\n runtime-selection:\n description: Entry-resolved runtime transport for nested workflow jobs.\n type: string\n required: false\n default: \"\"\n secrets:\n KUNGFU_GOVERNANCE_AUDITOR_APP_PRIVATE_KEY:\n description: Private key for the dedicated read-only GitHub governance auditor App\n required: false\n BUILDCHAIN_GENERATED_WRITE_APP_CLIENT_ID:\n description: Preferred GitHub App client ID for generated repository writes\n required: false\n BUILDCHAIN_GENERATED_WRITE_APP_PRIVATE_KEY:\n description: Preferred GitHub App private key for generated repository writes\n required: false\n BUILDCHAIN_GENERATED_WRITE_TOKEN:\n description: Equivalent narrow token fallback for generated repository writes\n required: false\n outputs:\n package-name:\n value: ${{ jobs.publication-candidate.outputs.package-name }}\n package-version:\n value: ${{ jobs.publication-candidate.outputs.package-version }}\n public-release-tag:\n value: ${{ jobs.publish.outputs.public-release-tag }}\n release-passport-path:\n value: ${{ jobs.publish.outputs.release-passport-path }}\n github-release-url:\n value: ${{ jobs.publish.outputs.github-release-url }}\n upstream-release-json:\n description: Exact post-publication release envelope for downstream propagation\n value: ${{ jobs.publish.outputs.upstream-release-json }}\n propagation-work-artifact:\n description: Artifact containing one paused typed propagation work unit per configured downstream target\n value: ${{ jobs.publish.outputs.propagation-work-artifact }}\n controller-plan-json:\n description: Paper publication controller plan json\n value: ${{ jobs.publish.outputs.controller-plan-json }}\n controller-plan-digest:\n description: Paper publication controller plan digest\n value: ${{ jobs.publish.outputs.controller-plan-digest }}\n controller-plan-artifact:\n description: Paper publication controller plan artifact\n value: ${{ jobs.publish.outputs.controller-plan-artifact }}\n controller-receipt-json:\n description: Paper publication controller receipt json\n value: ${{ jobs.publish.outputs.controller-receipt-json }}\n controller-receipt-digest:\n description: Paper publication controller receipt digest\n value: ${{ jobs.publish.outputs.controller-receipt-digest }}\n controller-receipt-artifact:\n description: Paper publication controller receipt artifact\n value: ${{ jobs.publish.outputs.controller-receipt-artifact }}\n controller-receipt-status:\n description: Paper publication controller receipt status\n value: ${{ jobs.publish.outputs.controller-receipt-status }}" }, { "path": ".github/workflows/public-ops-patrol-daily.yml", "target": ".github/workflows/.ops-patrol-daily.yml", "interface": { "workflow_call": { "inputs": { "target-branch": { "description": "Protected dev branch to inspect or maintain", "default": "", "type": "string", "required": false }, "required-status-checks": { "description": "Comma or newline separated required status/check-run name fragments", "default": "check / check", "type": "string", "required": false }, "ready-label": { "description": "Required label for PRs eligible to merge. Empty disables the label gate.", "default": "ready", "type": "string", "required": false }, "block-labels": { "description": "Comma or newline separated labels that block merging", "default": "blocked,do-not-merge,work-in-progress", "type": "string", "required": false }, "allowed-head-prefixes": { "description": "Comma or newline separated allowed source branch prefixes", "default": "feature/,fix/,chore/,docs/,ci/,refactor/", "type": "string", "required": false }, "require-approval": { "description": "Require at least one current approval and no latest changes-requested review", "default": true, "type": "boolean", "required": false }, "same-repository-only": { "description": "Reject fork/cross-repository PR heads by default", "default": true, "type": "boolean", "required": false }, "max-actions": { "description": "Maximum actions to take in one run", "default": 1, "type": "number", "required": false }, "merge-method": { "description": "GitHub merge method for ready dev PRs: merge, squash, or rebase", "default": "merge", "type": "string", "required": false }, "landing-mode": { "description": "Landing mode for ready dev PRs: auto, direct, or queue", "default": "auto", "type": "string", "required": false }, "dry-run": { "description": "Plan only; do not mutate repository state", "default": true, "type": "boolean", "required": false }, "runtime-ref": { "description": "Runtime entry selection parameter.", "type": "string", "required": false, "default": "" }, "contract-lock": { "description": "Runtime entry selection parameter.", "type": "string", "required": false, "default": "" }, "runtime-selection": { "description": "Runtime entry selection parameter.", "type": "string", "required": false, "default": "" } }, "secrets": { "github-token": { "description": "Optional token for repository inspection and maintenance. Defaults to github.token.", "required": false } }, "outputs": { "result-path": { "description": "Patrol result JSON path", "value": "${{ jobs.patrol.outputs.result-path }}" }, "evaluated-count": { "description": "Number of PRs evaluated by enabled capabilities", "value": "${{ jobs.patrol.outputs.evaluated-count }}" }, "action-count": { "description": "Number of actions taken, or planned in dry-run mode", "value": "${{ jobs.patrol.outputs.action-count }}" }, "skipped-count": { "description": "Number of skipped PRs", "value": "${{ jobs.patrol.outputs.skipped-count }}" }, "planned-count": { "description": "Number of stable-interface checks not yet implemented", "value": "${{ jobs.patrol.outputs.planned-count }}" } } } }, "permissions": { "contents": "write", "pull-requests": "write", "checks": "read", "statuses": "read" }, "interfaceSource": "on:\n workflow_call:\n inputs:\n target-branch:\n description: Protected dev branch to inspect or maintain\n default: \"\"\n type: string\n required: false\n required-status-checks:\n description: Comma or newline separated required status/check-run name fragments\n default: check / check\n type: string\n required: false\n ready-label:\n description: Required label for PRs eligible to merge. Empty disables the label gate.\n default: ready\n type: string\n required: false\n block-labels:\n description: Comma or newline separated labels that block merging\n default: blocked,do-not-merge,work-in-progress\n type: string\n required: false\n allowed-head-prefixes:\n description: Comma or newline separated allowed source branch prefixes\n default: feature/,fix/,chore/,docs/,ci/,refactor/\n type: string\n required: false\n require-approval:\n description: Require at least one current approval and no latest changes-requested review\n default: true\n type: boolean\n required: false\n same-repository-only:\n description: Reject fork/cross-repository PR heads by default\n default: true\n type: boolean\n required: false\n max-actions:\n description: Maximum actions to take in one run\n default: 1\n type: number\n required: false\n merge-method:\n description: \"GitHub merge method for ready dev PRs: merge, squash, or rebase\"\n default: merge\n type: string\n required: false\n landing-mode:\n description: \"Landing mode for ready dev PRs: auto, direct, or queue\"\n default: auto\n type: string\n required: false\n dry-run:\n description: Plan only; do not mutate repository state\n default: true\n type: boolean\n required: false\n runtime-ref:\n description: Runtime entry selection parameter.\n type: string\n required: false\n default: \"\"\n contract-lock:\n description: Runtime entry selection parameter.\n type: string\n required: false\n default: \"\"\n runtime-selection:\n description: Runtime entry selection parameter.\n type: string\n required: false\n default: \"\"\n secrets:\n github-token:\n description: Optional token for repository inspection and maintenance. Defaults to github.token.\n required: false\n outputs:\n result-path:\n description: Patrol result JSON path\n value: ${{ jobs.patrol.outputs.result-path }}\n evaluated-count:\n description: Number of PRs evaluated by enabled capabilities\n value: ${{ jobs.patrol.outputs.evaluated-count }}\n action-count:\n description: Number of actions taken, or planned in dry-run mode\n value: ${{ jobs.patrol.outputs.action-count }}\n skipped-count:\n description: Number of skipped PRs\n value: ${{ jobs.patrol.outputs.skipped-count }}\n planned-count:\n description: Number of stable-interface checks not yet implemented\n value: ${{ jobs.patrol.outputs.planned-count }}" }, { "path": ".github/workflows/public-ops-patrol-monthly.yml", "target": ".github/workflows/.ops-patrol-monthly.yml", "interface": { "workflow_call": { "inputs": { "target-branch": { "description": "Protected dev branch to inspect", "default": "", "type": "string", "required": false }, "dry-run": { "description": "Plan only; do not mutate repository state", "default": true, "type": "boolean", "required": false }, "runtime-ref": { "description": "Runtime entry selection parameter.", "type": "string", "required": false, "default": "" }, "contract-lock": { "description": "Runtime entry selection parameter.", "type": "string", "required": false, "default": "" }, "runtime-selection": { "description": "Runtime entry selection parameter.", "type": "string", "required": false, "default": "" } }, "secrets": { "github-token": { "description": "Optional token for repository inspection. Defaults to github.token.", "required": false } }, "outputs": { "result-path": { "description": "Patrol result JSON path", "value": "${{ jobs.patrol.outputs.result-path }}" }, "evaluated-count": { "description": "Number of PRs evaluated by enabled capabilities", "value": "${{ jobs.patrol.outputs.evaluated-count }}" }, "action-count": { "description": "Number of actions taken, or planned in dry-run mode", "value": "${{ jobs.patrol.outputs.action-count }}" }, "skipped-count": { "description": "Number of skipped PRs", "value": "${{ jobs.patrol.outputs.skipped-count }}" }, "planned-count": { "description": "Number of stable-interface checks not yet implemented", "value": "${{ jobs.patrol.outputs.planned-count }}" } } } }, "permissions": { "contents": "write", "pull-requests": "write", "checks": "read", "statuses": "read" }, "interfaceSource": "on:\n workflow_call:\n inputs:\n target-branch:\n description: Protected dev branch to inspect\n default: \"\"\n type: string\n required: false\n dry-run:\n description: Plan only; do not mutate repository state\n default: true\n type: boolean\n required: false\n runtime-ref:\n description: Runtime entry selection parameter.\n type: string\n required: false\n default: \"\"\n contract-lock:\n description: Runtime entry selection parameter.\n type: string\n required: false\n default: \"\"\n runtime-selection:\n description: Runtime entry selection parameter.\n type: string\n required: false\n default: \"\"\n secrets:\n github-token:\n description: Optional token for repository inspection. Defaults to github.token.\n required: false\n outputs:\n result-path:\n description: Patrol result JSON path\n value: ${{ jobs.patrol.outputs.result-path }}\n evaluated-count:\n description: Number of PRs evaluated by enabled capabilities\n value: ${{ jobs.patrol.outputs.evaluated-count }}\n action-count:\n description: Number of actions taken, or planned in dry-run mode\n value: ${{ jobs.patrol.outputs.action-count }}\n skipped-count:\n description: Number of skipped PRs\n value: ${{ jobs.patrol.outputs.skipped-count }}\n planned-count:\n description: Number of stable-interface checks not yet implemented\n value: ${{ jobs.patrol.outputs.planned-count }}" }, { "path": ".github/workflows/public-ops-observed-evidence.yml", "target": ".github/workflows/.ops-observed-evidence.yml", "interface": { "workflow_call": { "inputs": { "build-command": { "type": "string", "required": true }, "verify-command": { "type": "string", "required": true }, "artifact-path": { "type": "string", "required": true }, "manifest-path": { "type": "string", "required": true }, "evidence-source-repository": { "type": "string", "default": "", "required": false }, "evidence-source-ref": { "type": "string", "default": "", "required": false }, "evidence-source-path": { "type": "string", "default": ".observed-evidence/source", "required": false }, "production-aws-role-arn": { "type": "string", "required": true }, "production-bucket": { "type": "string", "required": true }, "cloudfront-distribution": { "type": "string", "required": false, "default": "" }, "production-environment": { "type": "string", "required": false, "default": "production" }, "runtime-ref": { "description": "Transient execution runtime; empty selects the consumer lock.", "type": "string", "required": false, "default": "" }, "contract-lock": { "description": "Optional consumer runtime lock path.", "type": "string", "required": false, "default": "" }, "runtime-selection": { "description": "Entry-resolved runtime transport for nested workflow jobs.", "type": "string", "required": false, "default": "" } }, "outputs": { "receipt-path": { "value": "${{ jobs.publish.outputs.receipt-path }}" } } } }, "permissions": { "contents": "read", "id-token": "write" }, "interfaceSource": "on:\n workflow_call:\n inputs:\n build-command:\n type: string\n required: true\n verify-command:\n type: string\n required: true\n artifact-path:\n type: string\n required: true\n manifest-path:\n type: string\n required: true\n evidence-source-repository:\n type: string\n default: \"\"\n required: false\n evidence-source-ref:\n type: string\n default: \"\"\n required: false\n evidence-source-path:\n type: string\n default: .observed-evidence/source\n required: false\n production-aws-role-arn:\n type: string\n required: true\n production-bucket:\n type: string\n required: true\n cloudfront-distribution:\n type: string\n required: false\n default: \"\"\n production-environment:\n type: string\n required: false\n default: production\n runtime-ref:\n description: Transient execution runtime; empty selects the consumer lock.\n type: string\n required: false\n default: \"\"\n contract-lock:\n description: Optional consumer runtime lock path.\n type: string\n required: false\n default: \"\"\n runtime-selection:\n description: Entry-resolved runtime transport for nested workflow jobs.\n type: string\n required: false\n default: \"\"\n outputs:\n receipt-path:\n value: ${{ jobs.publish.outputs.receipt-path }}" }, { "path": ".github/workflows/public-ops-patrol-weekly.yml", "target": ".github/workflows/.ops-patrol-weekly.yml", "interface": { "workflow_call": { "inputs": { "target-branch": { "description": "Protected dev branch to inspect", "default": "", "type": "string", "required": false }, "dry-run": { "description": "Plan only; do not mutate repository state", "default": true, "type": "boolean", "required": false }, "runtime-ref": { "description": "Runtime entry selection parameter.", "type": "string", "required": false, "default": "" }, "contract-lock": { "description": "Runtime entry selection parameter.", "type": "string", "required": false, "default": "" }, "runtime-selection": { "description": "Runtime entry selection parameter.", "type": "string", "required": false, "default": "" } }, "secrets": { "github-token": { "description": "Optional token for repository inspection. Defaults to github.token.", "required": false } }, "outputs": { "result-path": { "description": "Patrol result JSON path", "value": "${{ jobs.patrol.outputs.result-path }}" }, "evaluated-count": { "description": "Number of PRs evaluated by enabled capabilities", "value": "${{ jobs.patrol.outputs.evaluated-count }}" }, "action-count": { "description": "Number of actions taken, or planned in dry-run mode", "value": "${{ jobs.patrol.outputs.action-count }}" }, "skipped-count": { "description": "Number of skipped PRs", "value": "${{ jobs.patrol.outputs.skipped-count }}" }, "planned-count": { "description": "Number of stable-interface checks not yet implemented", "value": "${{ jobs.patrol.outputs.planned-count }}" } } } }, "permissions": { "contents": "write", "pull-requests": "write", "checks": "read", "statuses": "read" }, "interfaceSource": "on:\n workflow_call:\n inputs:\n target-branch:\n description: Protected dev branch to inspect\n default: \"\"\n type: string\n required: false\n dry-run:\n description: Plan only; do not mutate repository state\n default: true\n type: boolean\n required: false\n runtime-ref:\n description: Runtime entry selection parameter.\n type: string\n required: false\n default: \"\"\n contract-lock:\n description: Runtime entry selection parameter.\n type: string\n required: false\n default: \"\"\n runtime-selection:\n description: Runtime entry selection parameter.\n type: string\n required: false\n default: \"\"\n secrets:\n github-token:\n description: Optional token for repository inspection. Defaults to github.token.\n required: false\n outputs:\n result-path:\n description: Patrol result JSON path\n value: ${{ jobs.patrol.outputs.result-path }}\n evaluated-count:\n description: Number of PRs evaluated by enabled capabilities\n value: ${{ jobs.patrol.outputs.evaluated-count }}\n action-count:\n description: Number of actions taken, or planned in dry-run mode\n value: ${{ jobs.patrol.outputs.action-count }}\n skipped-count:\n description: Number of skipped PRs\n value: ${{ jobs.patrol.outputs.skipped-count }}\n planned-count:\n description: Number of stable-interface checks not yet implemented\n value: ${{ jobs.patrol.outputs.planned-count }}" }, { "path": ".github/workflows/public-build-publication.yml", "target": ".github/workflows/.build-publication.yml", "interface": { "workflow_call": { "inputs": { "buildchain-alpha-contract-lock-path": { "description": "Consumer-owned alpha contract lock required by v4 consumer admission", "default": ".buildchain/alpha-contract-lock.json", "type": "string", "required": false }, "buildchain-stable-contract-lock-path": { "description": "Consumer-owned stable contract lock required by v4 consumer admission", "default": ".buildchain/contract-lock.json", "type": "string", "required": false }, "working-directory": { "default": ".", "type": "string", "required": false }, "setup-node": { "default": true, "type": "boolean", "required": false }, "node-version": { "default": "24", "type": "string", "required": false }, "build-command": { "default": "make pdf", "type": "string", "required": false }, "toolchain-type": { "description": "Publication build toolchain: config, custom-command, or latex-docker. config reads [publication.toolchain].", "default": "config", "type": "string", "required": false }, "toolchain-image": { "description": "Container image for latex-docker toolchain, without digest. Defaults to the Buildchain paper LaTeX builder.", "default": "ghcr.io/kungfu-systems/build-images/latex-pdf-builder", "type": "string", "required": false }, "toolchain-digest": { "description": "sha256: for the latex-docker toolchain image.", "default": "sha256:c20f3809e96836c1c78e97c76939d12f1de3fed0ea9b7c40c43332ec2ea480f8", "type": "string", "required": false }, "toolchain-command": { "description": "Command run by the declared publication toolchain. For custom-command this overrides build-command.", "default": "", "type": "string", "required": false }, "verify-command": { "default": "make check", "type": "string", "required": false }, "artifact-name": { "default": "publication-artifact", "type": "string", "required": false }, "artifact-paths": { "default": "_build/main.pdf\n.buildchain/publication/publication-artifact.json\n.buildchain/publication/publication-artifact-passport.json\n.buildchain/publication/publication-registry.json\n.buildchain/publication/source.tar.gz\n", "type": "string", "required": false }, "artifact-retention-days": { "default": 30, "type": "number", "required": false }, "prepare-paper-package": { "description": "Prepare the deterministic npm paper package inside the read-only publication candidate", "default": false, "type": "boolean", "required": false }, "package-name": { "description": "Optional npm package name override", "default": "", "type": "string", "required": false }, "publish-dist-tag": { "description": "Expected npm distribution tag; empty derives alpha/latest from target-ref", "default": "", "type": "string", "required": false }, "target-ref": { "description": "Protected publication channel ref", "default": "", "type": "string", "required": false }, "runtime-ref": { "description": "Transient execution runtime; empty selects the consumer lock.", "type": "string", "required": false, "default": "" }, "contract-lock": { "description": "Optional consumer runtime lock path.", "type": "string", "required": false, "default": "" }, "runtime-selection": { "description": "Entry-resolved runtime transport for nested workflow jobs.", "type": "string", "required": false, "default": "" } }, "outputs": { "publication-artifact-name": { "description": "Uploaded publication artifact name", "value": "${{ jobs.publication.outputs.publication-artifact-name }}" }, "publication-manifest-path": { "description": "Generated publication manifest path", "value": "${{ jobs.publication.outputs.publication-manifest-path }}" }, "publication-passport-path": { "description": "Generated publication passport path", "value": "${{ jobs.publication.outputs.publication-passport-path }}" }, "publication-registry-path": { "description": "Generated publication archive registry path when archive config is present", "value": "${{ jobs.publication.outputs.publication-registry-path }}" }, "publication-manifest-json": { "description": "Compact publication manifest JSON", "value": "${{ jobs.publication.outputs.publication-manifest-json }}" }, "controller-plan-artifact": { "description": "Controller plan artifact name", "value": "${{ jobs.publication.outputs.controller-plan-artifact }}" }, "controller-plan-json": { "description": "Compact controller plan JSON", "value": "${{ jobs.publication.outputs.controller-plan-json }}" }, "controller-plan-digest": { "description": "Controller plan digest", "value": "${{ jobs.publication.outputs.controller-plan-digest }}" }, "controller-receipt-artifact": { "description": "Controller receipt artifact name", "value": "${{ jobs.publication.outputs.controller-receipt-artifact }}" }, "controller-receipt-json": { "description": "Compact controller receipt JSON", "value": "${{ jobs.publication.outputs.controller-receipt-json }}" }, "controller-receipt-digest": { "description": "Controller receipt digest", "value": "${{ jobs.publication.outputs.controller-receipt-digest }}" }, "controller-receipt-status": { "description": "Controller receipt status", "value": "${{ jobs.publication.outputs.controller-receipt-status }}" }, "runtime-sha": { "description": "Exact resolved Buildchain runtime SHA", "value": "${{ jobs.publication.outputs.runtime-sha }}" }, "package-name": { "description": "Prepared npm package name", "value": "${{ jobs.publication.outputs.package-name }}" }, "package-version": { "description": "Prepared npm package version", "value": "${{ jobs.publication.outputs.package-version }}" }, "publish-dist-tag": { "description": "Prepared npm distribution tag", "value": "${{ jobs.publication.outputs.publish-dist-tag }}" } } } }, "permissions": { "contents": "read", "issues": "write" }, "interfaceSource": "on:\n workflow_call:\n inputs:\n buildchain-alpha-contract-lock-path:\n description: Consumer-owned alpha contract lock required by v4 consumer admission\n default: .buildchain/alpha-contract-lock.json\n type: string\n required: false\n buildchain-stable-contract-lock-path:\n description: Consumer-owned stable contract lock required by v4 consumer admission\n default: .buildchain/contract-lock.json\n type: string\n required: false\n working-directory:\n default: .\n type: string\n required: false\n setup-node:\n default: true\n type: boolean\n required: false\n node-version:\n default: \"24\"\n type: string\n required: false\n build-command:\n default: make pdf\n type: string\n required: false\n toolchain-type:\n description: \"Publication build toolchain: config, custom-command, or latex-docker. config reads\n [publication.toolchain].\"\n default: config\n type: string\n required: false\n toolchain-image:\n description: Container image for latex-docker toolchain, without digest. Defaults to the Buildchain\n paper LaTeX builder.\n default: ghcr.io/kungfu-systems/build-images/latex-pdf-builder\n type: string\n required: false\n toolchain-digest:\n description: sha256: for the latex-docker toolchain image.\n default: sha256:c20f3809e96836c1c78e97c76939d12f1de3fed0ea9b7c40c43332ec2ea480f8\n type: string\n required: false\n toolchain-command:\n description: Command run by the declared publication toolchain. For custom-command this overrides\n build-command.\n default: \"\"\n type: string\n required: false\n verify-command:\n default: make check\n type: string\n required: false\n artifact-name:\n default: publication-artifact\n type: string\n required: false\n artifact-paths:\n default: |\n _build/main.pdf\n .buildchain/publication/publication-artifact.json\n .buildchain/publication/publication-artifact-passport.json\n .buildchain/publication/publication-registry.json\n .buildchain/publication/source.tar.gz\n type: string\n required: false\n artifact-retention-days:\n default: 30\n type: number\n required: false\n prepare-paper-package:\n description: Prepare the deterministic npm paper package inside the read-only publication candidate\n default: false\n type: boolean\n required: false\n package-name:\n description: Optional npm package name override\n default: \"\"\n type: string\n required: false\n publish-dist-tag:\n description: Expected npm distribution tag; empty derives alpha/latest from target-ref\n default: \"\"\n type: string\n required: false\n target-ref:\n description: Protected publication channel ref\n default: \"\"\n type: string\n required: false\n runtime-ref:\n description: Transient execution runtime; empty selects the consumer lock.\n type: string\n required: false\n default: \"\"\n contract-lock:\n description: Optional consumer runtime lock path.\n type: string\n required: false\n default: \"\"\n runtime-selection:\n description: Entry-resolved runtime transport for nested workflow jobs.\n type: string\n required: false\n default: \"\"\n outputs:\n publication-artifact-name:\n description: Uploaded publication artifact name\n value: ${{ jobs.publication.outputs.publication-artifact-name }}\n publication-manifest-path:\n description: Generated publication manifest path\n value: ${{ jobs.publication.outputs.publication-manifest-path }}\n publication-passport-path:\n description: Generated publication passport path\n value: ${{ jobs.publication.outputs.publication-passport-path }}\n publication-registry-path:\n description: Generated publication archive registry path when archive config is present\n value: ${{ jobs.publication.outputs.publication-registry-path }}\n publication-manifest-json:\n description: Compact publication manifest JSON\n value: ${{ jobs.publication.outputs.publication-manifest-json }}\n controller-plan-artifact:\n description: Controller plan artifact name\n value: ${{ jobs.publication.outputs.controller-plan-artifact }}\n controller-plan-json:\n description: Compact controller plan JSON\n value: ${{ jobs.publication.outputs.controller-plan-json }}\n controller-plan-digest:\n description: Controller plan digest\n value: ${{ jobs.publication.outputs.controller-plan-digest }}\n controller-receipt-artifact:\n description: Controller receipt artifact name\n value: ${{ jobs.publication.outputs.controller-receipt-artifact }}\n controller-receipt-json:\n description: Compact controller receipt JSON\n value: ${{ jobs.publication.outputs.controller-receipt-json }}\n controller-receipt-digest:\n description: Controller receipt digest\n value: ${{ jobs.publication.outputs.controller-receipt-digest }}\n controller-receipt-status:\n description: Controller receipt status\n value: ${{ jobs.publication.outputs.controller-receipt-status }}\n runtime-sha:\n description: Exact resolved Buildchain runtime SHA\n value: ${{ jobs.publication.outputs.runtime-sha }}\n package-name:\n description: Prepared npm package name\n value: ${{ jobs.publication.outputs.package-name }}\n package-version:\n description: Prepared npm package version\n value: ${{ jobs.publication.outputs.package-version }}\n publish-dist-tag:\n description: Prepared npm distribution tag\n value: ${{ jobs.publication.outputs.publish-dist-tag }}" }, { "path": ".github/workflows/public-release-promote.yml", "target": ".github/workflows/.release-candidate-promote.yml", "interface": { "workflow_call": { "inputs": { "request-json": { "description": "JSON object matching contracts/promotion-request-v1.schema.json. The API validates types, defaults and authority before dispatch.", "required": true, "type": "string" }, "runtime-ref": { "description": "Transient execution runtime; empty selects the consumer lock.", "type": "string", "required": false, "default": "" }, "contract-lock": { "description": "Optional consumer runtime lock path.", "type": "string", "required": false, "default": "" }, "runtime-selection": { "description": "Entry-resolved runtime transport for nested workflow jobs.", "type": "string", "required": false, "default": "" } }, "secrets": { "BUILDCHAIN_PROMOTION_TOKEN": { "description": "Optional bypass-capable token used only for generated protected ref updates", "required": false }, "BUILDCHAIN_PUBLICATION_COMMIT_TOKEN": { "description": "Optional consumer-owned credential exposed only to the final publication commit command", "required": false }, "BUILDCHAIN_PUBLICATION_COMMIT_SIGNING_KEY": { "description": "Optional consumer-owned private signing material exposed only to the final publication commit command", "required": false }, "KUNGFU_GOVERNANCE_AUDITOR_APP_PRIVATE_KEY": { "description": "Private key for the dedicated read-only GitHub governance auditor App", "required": false }, "buildchain-issue-token": { "description": "Optional token with issues:write on the Buildchain repository for workflow-friction reports", "required": false }, "BUILDCHAIN_ISSUE_TOKEN": { "description": "Optional token with issues:write on the Buildchain repository for workflow-friction reports", "required": false }, "buildchain-issue-app-id": { "description": "Optional GitHub App ID used to mint a Buildchain issue-report token", "required": false }, "BUILDCHAIN_ISSUE_APP_ID": { "description": "Optional GitHub App ID used to mint a Buildchain issue-report token", "required": false }, "buildchain-issue-app-private-key": { "description": "Optional GitHub App private key used to mint a Buildchain issue-report token", "required": false }, "BUILDCHAIN_ISSUE_APP_PRIVATE_KEY": { "description": "Optional GitHub App private key used to mint a Buildchain issue-report token", "required": false } }, "outputs": { "buildchain-channel": { "description": "Admitted channel.", "value": "${{ jobs.resolve-promotion.outputs.channel }}" }, "promotion-router-ref": { "description": "Admitted router-ref.", "value": "${{ jobs.resolve-promotion.outputs.router-ref }}" }, "promotion-router-sha": { "description": "Admitted router-sha.", "value": "${{ jobs.resolve-promotion.outputs.router-sha }}" }, "promotion-shell-ref": { "description": "Admitted shell-ref.", "value": "${{ jobs.resolve-promotion.outputs.shell-ref }}" }, "promotion-shell-sha": { "description": "Admitted shell-sha.", "value": "${{ jobs.resolve-promotion.outputs.shell-sha }}" }, "promotion-runtime-ref": { "description": "Admitted runtime-ref.", "value": "${{ jobs.resolve-promotion.outputs.runtime-ref }}" }, "promotion-runtime-sha": { "description": "Admitted runtime-sha.", "value": "${{ jobs.resolve-promotion.outputs.runtime-sha }}" }, "promotion-contract-lock-path": { "description": "Admitted contract-lock-path.", "value": "${{ jobs.resolve-promotion.outputs.contract-lock-path }}" }, "promotion-contract-lock-digest": { "description": "Admitted contract-lock-digest.", "value": "${{ jobs.resolve-promotion.outputs.contract-lock-digest }}" }, "promotion-publication-channel": { "description": "Admitted publication-channel.", "value": "${{ jobs.resolve-promotion.outputs.publication-channel }}" }, "promotion-target-ref": { "description": "Admitted target-ref.", "value": "${{ jobs.resolve-promotion.outputs.target-ref }}" }, "promotion-override-used": { "description": "Admitted override-used.", "value": "${{ jobs.resolve-promotion.outputs.override-used }}" }, "discussion-id": { "description": "Release transaction discussion-id.", "value": "${{ jobs.invoke.outputs.discussion-id }}" }, "discussion-url": { "description": "Release transaction discussion-url.", "value": "${{ jobs.invoke.outputs.discussion-url }}" }, "promoted-sha": { "description": "Promoted channel SHA", "value": "${{ jobs.invoke.outputs.promoted-sha }}" }, "built-source-sha": { "description": "PR-stage built source SHA", "value": "${{ jobs.invoke.outputs.built-source-sha }}" }, "release-candidate-artifact": { "description": "Resolved release-candidate artifact name", "value": "${{ jobs.invoke.outputs.release-candidate-artifact }}" }, "release-candidate-action": { "description": "Candidate admission action: discovered or reused", "value": "${{ jobs.invoke.outputs.release-candidate-action }}" }, "release-candidate-recovery-root": { "description": "Exact sha256 recovery receipt root", "value": "${{ jobs.invoke.outputs.release-candidate-recovery-root }}" }, "release-candidate-recovery-receipt-artifact": { "description": "Immutable recovery receipt Actions artifact name", "value": "${{ jobs.invoke.outputs.release-candidate-recovery-receipt-artifact }}" }, "release-propagation-work-artifact": { "description": "Captured package release propagation Work artifact", "value": "${{ jobs.invoke.outputs.release-propagation-work-artifact }}" }, "publication-commit-evidence-path": { "description": "Validated consumer publication commit evidence path", "value": "${{ jobs.invoke.outputs.publication-commit-evidence-path }}" }, "publication-commit-evidence-digest": { "description": "sha256 digest of validated consumer publication commit evidence", "value": "${{ jobs.invoke.outputs.publication-commit-evidence-digest }}" }, "publication-commit-url": { "description": "Canonical public authority URL validated after the final commit", "value": "${{ jobs.invoke.outputs.publication-commit-url }}" }, "publication-commit-payload-root": { "description": "Exact public authority payload root validated after the final commit", "value": "${{ jobs.invoke.outputs.publication-commit-payload-root }}" }, "controller-plan-artifact": { "description": "Controller plan artifact name", "value": "${{ jobs.invoke.outputs.controller-plan-artifact }}" }, "controller-plan-json": { "description": "Compact controller plan JSON", "value": "${{ jobs.invoke.outputs.controller-plan-json }}" }, "controller-plan-digest": { "description": "Controller plan digest", "value": "${{ jobs.invoke.outputs.controller-plan-digest }}" }, "publication-capability-digest": { "description": "Sealed publication capability receipt digest", "value": "${{ jobs.invoke.outputs.publication-capability-digest }}" }, "github-artifact-attestation-id": { "description": "GitHub keyless attestation id for the declared Linux release artifact", "value": "${{ jobs.invoke.outputs.github-artifact-attestation-id }}" }, "github-artifact-attestation-url": { "description": "GitHub keyless attestation URL", "value": "${{ jobs.invoke.outputs.github-artifact-attestation-url }}" }, "github-artifact-attestation-evidence-root": { "description": "Verified Buildchain attestation evidence root published with the GitHub Release", "value": "${{ jobs.invoke.outputs.github-artifact-attestation-evidence-root }}" }, "github-artifact-attestation-publication-receipt-digest": { "description": "Read-back verified GitHub Release evidence publication receipt digest", "value": "${{ jobs.invoke.outputs.github-artifact-attestation-publication-receipt-digest }}" }, "release-tail-declaration-root": { "description": "Root of the declarative release-tail contract", "value": "${{ jobs.invoke.outputs.release-tail-declaration-root }}" }, "release-tail-transaction-state": { "description": "Final declarative release-tail transaction state", "value": "${{ jobs.invoke.outputs.release-tail-transaction-state }}" }, "release-tail-transaction-root": { "description": "Stable declarative release-tail transaction root", "value": "${{ jobs.invoke.outputs.release-tail-transaction-root }}" }, "release-tail-state-root": { "description": "Root of the final declarative release-tail transaction state", "value": "${{ jobs.invoke.outputs.release-tail-state-root }}" }, "release-tail-receipt-roots-json": { "description": "JSON array of standardized declarative release-tail receipt roots", "value": "${{ jobs.invoke.outputs.release-tail-receipt-roots-json }}" }, "release-invocation-root": { "description": "Canonical post-admission ReleaseInvocation root", "value": "${{ jobs.invoke.outputs.release-invocation-root }}" }, "release-transaction-root": { "description": "Canonical three-phase ReleaseTransaction root", "value": "${{ jobs.invoke.outputs.release-transaction-root }}" }, "release-receipt-root": { "description": "Single terminal ReleaseReceipt root", "value": "${{ jobs.invoke.outputs.release-receipt-root }}" }, "controller-receipt-artifact": { "description": "Controller receipt artifact name", "value": "${{ jobs.invoke.outputs.controller-receipt-artifact }}" }, "controller-receipt-json": { "description": "Compact controller receipt JSON", "value": "${{ jobs.invoke.outputs.controller-receipt-json }}" }, "controller-receipt-digest": { "description": "Controller receipt digest", "value": "${{ jobs.invoke.outputs.controller-receipt-digest }}" }, "controller-receipt-status": { "description": "Controller receipt status", "value": "${{ jobs.invoke.outputs.controller-receipt-status }}" } } } }, "permissions": null, "interfaceSource": "on:\n workflow_call:\n inputs:\n request-json:\n description: JSON object matching contracts/promotion-request-v1.schema.json. The API validates types, defaults and authority before dispatch.\n required: true\n type: string\n runtime-ref:\n description: Transient execution runtime; empty selects the consumer lock.\n type: string\n required: false\n default: \"\"\n contract-lock:\n description: Optional consumer runtime lock path.\n type: string\n required: false\n default: \"\"\n runtime-selection:\n description: Entry-resolved runtime transport for nested workflow jobs.\n type: string\n required: false\n default: \"\"\n secrets:\n BUILDCHAIN_PROMOTION_TOKEN:\n description: Optional bypass-capable token used only for generated protected ref updates\n required: false\n BUILDCHAIN_PUBLICATION_COMMIT_TOKEN:\n description: Optional consumer-owned credential exposed only to the final publication commit command\n required: false\n BUILDCHAIN_PUBLICATION_COMMIT_SIGNING_KEY:\n description: Optional consumer-owned private signing material exposed only to the final publication commit command\n required: false\n KUNGFU_GOVERNANCE_AUDITOR_APP_PRIVATE_KEY:\n description: Private key for the dedicated read-only GitHub governance auditor App\n required: false\n buildchain-issue-token:\n description: Optional token with issues:write on the Buildchain repository for workflow-friction reports\n required: false\n BUILDCHAIN_ISSUE_TOKEN:\n description: Optional token with issues:write on the Buildchain repository for workflow-friction reports\n required: false\n buildchain-issue-app-id:\n description: Optional GitHub App ID used to mint a Buildchain issue-report token\n required: false\n BUILDCHAIN_ISSUE_APP_ID:\n description: Optional GitHub App ID used to mint a Buildchain issue-report token\n required: false\n buildchain-issue-app-private-key:\n description: Optional GitHub App private key used to mint a Buildchain issue-report token\n required: false\n BUILDCHAIN_ISSUE_APP_PRIVATE_KEY:\n description: Optional GitHub App private key used to mint a Buildchain issue-report token\n required: false\n outputs:\n buildchain-channel:\n description: Admitted channel.\n value: ${{ jobs.resolve-promotion.outputs.channel }}\n promotion-router-ref:\n description: Admitted router-ref.\n value: ${{ jobs.resolve-promotion.outputs.router-ref }}\n promotion-router-sha:\n description: Admitted router-sha.\n value: ${{ jobs.resolve-promotion.outputs.router-sha }}\n promotion-shell-ref:\n description: Admitted shell-ref.\n value: ${{ jobs.resolve-promotion.outputs.shell-ref }}\n promotion-shell-sha:\n description: Admitted shell-sha.\n value: ${{ jobs.resolve-promotion.outputs.shell-sha }}\n promotion-runtime-ref:\n description: Admitted runtime-ref.\n value: ${{ jobs.resolve-promotion.outputs.runtime-ref }}\n promotion-runtime-sha:\n description: Admitted runtime-sha.\n value: ${{ jobs.resolve-promotion.outputs.runtime-sha }}\n promotion-contract-lock-path:\n description: Admitted contract-lock-path.\n value: ${{ jobs.resolve-promotion.outputs.contract-lock-path }}\n promotion-contract-lock-digest:\n description: Admitted contract-lock-digest.\n value: ${{ jobs.resolve-promotion.outputs.contract-lock-digest }}\n promotion-publication-channel:\n description: Admitted publication-channel.\n value: ${{ jobs.resolve-promotion.outputs.publication-channel }}\n promotion-target-ref:\n description: Admitted target-ref.\n value: ${{ jobs.resolve-promotion.outputs.target-ref }}\n promotion-override-used:\n description: Admitted override-used.\n value: ${{ jobs.resolve-promotion.outputs.override-used }}\n discussion-id:\n description: Release transaction discussion-id.\n value: ${{ jobs.invoke.outputs.discussion-id }}\n discussion-url:\n description: Release transaction discussion-url.\n value: ${{ jobs.invoke.outputs.discussion-url }}\n promoted-sha:\n description: Promoted channel SHA\n value: ${{ jobs.invoke.outputs.promoted-sha }}\n built-source-sha:\n description: PR-stage built source SHA\n value: ${{ jobs.invoke.outputs.built-source-sha }}\n release-candidate-artifact:\n description: Resolved release-candidate artifact name\n value: ${{ jobs.invoke.outputs.release-candidate-artifact }}\n release-candidate-action:\n description: \"Candidate admission action: discovered or reused\"\n value: ${{ jobs.invoke.outputs.release-candidate-action }}\n release-candidate-recovery-root:\n description: Exact sha256 recovery receipt root\n value: ${{ jobs.invoke.outputs.release-candidate-recovery-root }}\n release-candidate-recovery-receipt-artifact:\n description: Immutable recovery receipt Actions artifact name\n value: ${{ jobs.invoke.outputs.release-candidate-recovery-receipt-artifact }}\n release-propagation-work-artifact:\n description: Captured package release propagation Work artifact\n value: ${{ jobs.invoke.outputs.release-propagation-work-artifact }}\n publication-commit-evidence-path:\n description: Validated consumer publication commit evidence path\n value: ${{ jobs.invoke.outputs.publication-commit-evidence-path }}\n publication-commit-evidence-digest:\n description: sha256 digest of validated consumer publication commit evidence\n value: ${{ jobs.invoke.outputs.publication-commit-evidence-digest }}\n publication-commit-url:\n description: Canonical public authority URL validated after the final commit\n value: ${{ jobs.invoke.outputs.publication-commit-url }}\n publication-commit-payload-root:\n description: Exact public authority payload root validated after the final commit\n value: ${{ jobs.invoke.outputs.publication-commit-payload-root }}\n controller-plan-artifact:\n description: Controller plan artifact name\n value: ${{ jobs.invoke.outputs.controller-plan-artifact }}\n controller-plan-json:\n description: Compact controller plan JSON\n value: ${{ jobs.invoke.outputs.controller-plan-json }}\n controller-plan-digest:\n description: Controller plan digest\n value: ${{ jobs.invoke.outputs.controller-plan-digest }}\n publication-capability-digest:\n description: Sealed publication capability receipt digest\n value: ${{ jobs.invoke.outputs.publication-capability-digest }}\n github-artifact-attestation-id:\n description: GitHub keyless attestation id for the declared Linux release artifact\n value: ${{ jobs.invoke.outputs.github-artifact-attestation-id }}\n github-artifact-attestation-url:\n description: GitHub keyless attestation URL\n value: ${{ jobs.invoke.outputs.github-artifact-attestation-url }}\n github-artifact-attestation-evidence-root:\n description: Verified Buildchain attestation evidence root published with the GitHub Release\n value: ${{ jobs.invoke.outputs.github-artifact-attestation-evidence-root }}\n github-artifact-attestation-publication-receipt-digest:\n description: Read-back verified GitHub Release evidence publication receipt digest\n value: ${{ jobs.invoke.outputs.github-artifact-attestation-publication-receipt-digest }}\n release-tail-declaration-root:\n description: Root of the declarative release-tail contract\n value: ${{ jobs.invoke.outputs.release-tail-declaration-root }}\n release-tail-transaction-state:\n description: Final declarative release-tail transaction state\n value: ${{ jobs.invoke.outputs.release-tail-transaction-state }}\n release-tail-transaction-root:\n description: Stable declarative release-tail transaction root\n value: ${{ jobs.invoke.outputs.release-tail-transaction-root }}\n release-tail-state-root:\n description: Root of the final declarative release-tail transaction state\n value: ${{ jobs.invoke.outputs.release-tail-state-root }}\n release-tail-receipt-roots-json:\n description: JSON array of standardized declarative release-tail receipt roots\n value: ${{ jobs.invoke.outputs.release-tail-receipt-roots-json }}\n release-invocation-root:\n description: Canonical post-admission ReleaseInvocation root\n value: ${{ jobs.invoke.outputs.release-invocation-root }}\n release-transaction-root:\n description: Canonical three-phase ReleaseTransaction root\n value: ${{ jobs.invoke.outputs.release-transaction-root }}\n release-receipt-root:\n description: Single terminal ReleaseReceipt root\n value: ${{ jobs.invoke.outputs.release-receipt-root }}\n controller-receipt-artifact:\n description: Controller receipt artifact name\n value: ${{ jobs.invoke.outputs.controller-receipt-artifact }}\n controller-receipt-json:\n description: Compact controller receipt JSON\n value: ${{ jobs.invoke.outputs.controller-receipt-json }}\n controller-receipt-digest:\n description: Controller receipt digest\n value: ${{ jobs.invoke.outputs.controller-receipt-digest }}\n controller-receipt-status:\n description: Controller receipt status\n value: ${{ jobs.invoke.outputs.controller-receipt-status }}" }, { "path": ".github/workflows/public-ops-release-governance.yml", "target": ".github/workflows/.ops-release-governance.yml", "interface": { "workflow_call": { "inputs": { "branch": { "description": "Managed dev/alpha/release branch whose required checks will be inspected", "required": true, "type": "string" }, "candidate-sha": { "description": "Already-tested pull request head SHA used to derive the emitted aggregate check", "required": true, "type": "string" }, "apply": { "description": "Replace stale Buildchain aggregate contexts while preserving all other required checks", "default": false, "required": false, "type": "boolean" }, "runtime-ref": { "description": "Transient execution runtime; empty selects the consumer lock.", "type": "string", "required": false, "default": "" }, "contract-lock": { "description": "Optional consumer runtime lock path.", "type": "string", "required": false, "default": "" }, "runtime-selection": { "description": "Entry-resolved runtime transport for nested workflow jobs.", "type": "string", "required": false, "default": "" } }, "secrets": { "governance-token": { "description": "Token with read access to checks and administration access to branch protection", "required": false }, "BUILDCHAIN_PROMOTION_TOKEN": { "description": "Repository promotion token used by direct workflow dispatch", "required": false } } }, "workflow_dispatch": { "inputs": { "branch": { "description": "Managed dev/alpha/release branch whose required checks will be inspected", "required": true, "type": "string" }, "candidate-sha": { "description": "Already-tested pull request head SHA used to derive the emitted aggregate check", "required": true, "type": "string" }, "apply": { "description": "Replace stale Buildchain aggregate contexts while preserving all other required checks", "default": false, "required": false, "type": "boolean" }, "runtime-ref": { "description": "Transient execution runtime; empty selects the consumer lock.", "type": "string", "required": false, "default": "" }, "contract-lock": { "description": "Optional consumer runtime lock path.", "type": "string", "required": false, "default": "" } } } }, "permissions": { "actions": "read", "checks": "read", "contents": "read", "pull-requests": "read" }, "interfaceSource": "on:\n workflow_call:\n inputs:\n branch:\n description: Managed dev/alpha/release branch whose required checks will be inspected\n required: true\n type: string\n candidate-sha:\n description: Already-tested pull request head SHA used to derive the emitted aggregate check\n required: true\n type: string\n apply:\n description: Replace stale Buildchain aggregate contexts while preserving all other required checks\n default: false\n required: false\n type: boolean\n runtime-ref:\n description: Transient execution runtime; empty selects the consumer lock.\n type: string\n required: false\n default: \"\"\n contract-lock:\n description: Optional consumer runtime lock path.\n type: string\n required: false\n default: \"\"\n runtime-selection:\n description: Entry-resolved runtime transport for nested workflow jobs.\n type: string\n required: false\n default: \"\"\n secrets:\n governance-token:\n description: Token with read access to checks and administration access to branch protection\n required: false\n BUILDCHAIN_PROMOTION_TOKEN:\n description: Repository promotion token used by direct workflow dispatch\n required: false\n workflow_dispatch:\n inputs:\n branch:\n description: Managed dev/alpha/release branch whose required checks will be inspected\n required: true\n type: string\n candidate-sha:\n description: Already-tested pull request head SHA used to derive the emitted aggregate check\n required: true\n type: string\n apply:\n description: Replace stale Buildchain aggregate contexts while preserving all other required checks\n default: false\n required: false\n type: boolean\n runtime-ref:\n description: Transient execution runtime; empty selects the consumer lock.\n type: string\n required: false\n default: \"\"\n contract-lock:\n description: Optional consumer runtime lock path.\n type: string\n required: false\n default: \"\"" }, { "path": ".github/workflows/public-release-propagation.yml", "target": ".github/workflows/.release-propagation.yml", "interface": { "workflow_call": { "inputs": { "graph-json": { "description": "Release propagation graph JSON", "required": true, "type": "string" }, "upstream-release-json": { "description": "Finalized upstream release envelope JSON", "required": true, "type": "string" }, "source-node": { "description": "Optional source node id; inferred from repository/package when omitted", "default": "", "required": false, "type": "string" }, "downstream-target": { "description": "Target downstream node id or owner/repo", "required": true, "type": "string" }, "downstream-repository": { "description": "Downstream owner/repo to checkout and update", "required": true, "type": "string" }, "downstream-base-ref": { "description": "Downstream PR base branch", "required": true, "type": "string" }, "downstream-branch": { "description": "Optional downstream update branch override. Empty uses the exact release identity.", "default": "", "required": false, "type": "string" }, "lock-path": { "description": "Optional downstream lock path override", "default": "", "required": false, "type": "string" }, "downstream-update-command": { "description": "Optional consumer-owned command that applies the exact lock to downstream package/config pins", "default": "", "required": false, "type": "string" }, "pr-title": { "description": "Downstream PR title", "default": "chore: consume upstream release", "required": false, "type": "string" }, "pr-body": { "description": "Additional downstream PR body", "default": "", "required": false, "type": "string" }, "downstream-prepare-command": { "description": "Optional consumer-owned command that pins the propagated release and updates deterministic generated files", "default": "", "required": false, "type": "string" }, "refresh-managed-readme-badges": { "description": "Refresh a Buildchain-managed README badge block after consumer preparation", "default": true, "required": false, "type": "boolean" }, "downstream-verify-command": { "description": "Optional consumer-owned check command run against the final propagation tree before commit", "default": "", "required": false, "type": "string" }, "agent-work-context-json": { "description": "Optional exact typed Family State, WorkRef, and authority context; when present emits a resumable propagation work unit", "default": "", "required": false, "type": "string" }, "agent-work-mode": { "description": "capture-only emits a paused typed Work; execute requires an exact authorized Work context", "default": "capture-only", "required": false, "type": "string" }, "dry-run": { "description": "Plan and write lock without pushing a PR", "default": true, "required": false, "type": "boolean" }, "runtime-ref": { "description": "Transient execution runtime; empty selects the consumer lock.", "type": "string", "required": false, "default": "" }, "contract-lock": { "description": "Optional consumer runtime lock path.", "type": "string", "required": false, "default": "" }, "runtime-selection": { "description": "Entry-resolved runtime transport for nested workflow jobs.", "type": "string", "required": false, "default": "" } }, "secrets": { "propagation-token": { "description": "Token with contents:write and pull-requests:write on the downstream repository", "required": false } }, "outputs": { "controller-plan-artifact": { "description": "Controller plan artifact name", "value": "${{ jobs.propagate.outputs.controller-plan-artifact }}" }, "controller-plan-json": { "description": "Compact controller plan JSON", "value": "${{ jobs.propagate.outputs.controller-plan-json }}" }, "controller-plan-digest": { "description": "Controller plan digest", "value": "${{ jobs.propagate.outputs.controller-plan-digest }}" }, "controller-receipt-artifact": { "description": "Controller receipt artifact name", "value": "${{ jobs.propagate.outputs.controller-receipt-artifact }}" }, "controller-receipt-json": { "description": "Compact controller receipt JSON", "value": "${{ jobs.propagate.outputs.controller-receipt-json }}" }, "controller-receipt-digest": { "description": "Controller receipt digest", "value": "${{ jobs.propagate.outputs.controller-receipt-digest }}" }, "controller-receipt-status": { "description": "Controller receipt status", "value": "${{ jobs.propagate.outputs.controller-receipt-status }}" }, "propagation-receipt-json": { "description": "Exact release propagation receipt JSON", "value": "${{ jobs.propagate.outputs.propagation-receipt-json }}" }, "propagation-receipt-digest": { "description": "Exact release propagation receipt SHA-256", "value": "${{ jobs.propagate.outputs.propagation-receipt-digest }}" }, "propagation-work-artifact": { "description": "Agent-native propagation work artifact name", "value": "${{ jobs.propagate.outputs.propagation-work-artifact }}" }, "propagation-work-json": { "description": "Latest agent-native propagation work envelope", "value": "${{ jobs.propagate.outputs.propagation-work-json }}" }, "propagation-work-root": { "description": "Latest agent-native propagation work content root", "value": "${{ jobs.propagate.outputs.propagation-work-root }}" }, "propagation-work-next-action": { "description": "Next executable agent action", "value": "${{ jobs.propagate.outputs.propagation-work-next-action }}" } } } }, "permissions": { "contents": "write", "pull-requests": "write" }, "interfaceSource": "on:\n workflow_call:\n inputs:\n graph-json:\n description: Release propagation graph JSON\n required: true\n type: string\n upstream-release-json:\n description: Finalized upstream release envelope JSON\n required: true\n type: string\n source-node:\n description: Optional source node id; inferred from repository/package when omitted\n default: \"\"\n required: false\n type: string\n downstream-target:\n description: Target downstream node id or owner/repo\n required: true\n type: string\n downstream-repository:\n description: Downstream owner/repo to checkout and update\n required: true\n type: string\n downstream-base-ref:\n description: Downstream PR base branch\n required: true\n type: string\n downstream-branch:\n description: Optional downstream update branch override. Empty uses the exact release identity.\n default: \"\"\n required: false\n type: string\n lock-path:\n description: Optional downstream lock path override\n default: \"\"\n required: false\n type: string\n downstream-update-command:\n description: Optional consumer-owned command that applies the exact lock to downstream\n package/config pins\n default: \"\"\n required: false\n type: string\n pr-title:\n description: Downstream PR title\n default: \"chore: consume upstream release\"\n required: false\n type: string\n pr-body:\n description: Additional downstream PR body\n default: \"\"\n required: false\n type: string\n downstream-prepare-command:\n description: Optional consumer-owned command that pins the propagated release and updates\n deterministic generated files\n default: \"\"\n required: false\n type: string\n refresh-managed-readme-badges:\n description: Refresh a Buildchain-managed README badge block after consumer preparation\n default: true\n required: false\n type: boolean\n downstream-verify-command:\n description: Optional consumer-owned check command run against the final propagation tree before commit\n default: \"\"\n required: false\n type: string\n agent-work-context-json:\n description: Optional exact typed Family State, WorkRef, and authority context; when present emits a\n resumable propagation work unit\n default: \"\"\n required: false\n type: string\n agent-work-mode:\n description: capture-only emits a paused typed Work; execute requires an exact authorized Work context\n default: capture-only\n required: false\n type: string\n dry-run:\n description: Plan and write lock without pushing a PR\n default: true\n required: false\n type: boolean\n runtime-ref:\n description: Transient execution runtime; empty selects the consumer lock.\n type: string\n required: false\n default: \"\"\n contract-lock:\n description: Optional consumer runtime lock path.\n type: string\n required: false\n default: \"\"\n runtime-selection:\n description: Entry-resolved runtime transport for nested workflow jobs.\n type: string\n required: false\n default: \"\"\n secrets:\n propagation-token:\n description: Token with contents:write and pull-requests:write on the downstream repository\n required: false\n outputs:\n controller-plan-artifact:\n description: Controller plan artifact name\n value: ${{ jobs.propagate.outputs.controller-plan-artifact }}\n controller-plan-json:\n description: Compact controller plan JSON\n value: ${{ jobs.propagate.outputs.controller-plan-json }}\n controller-plan-digest:\n description: Controller plan digest\n value: ${{ jobs.propagate.outputs.controller-plan-digest }}\n controller-receipt-artifact:\n description: Controller receipt artifact name\n value: ${{ jobs.propagate.outputs.controller-receipt-artifact }}\n controller-receipt-json:\n description: Compact controller receipt JSON\n value: ${{ jobs.propagate.outputs.controller-receipt-json }}\n controller-receipt-digest:\n description: Controller receipt digest\n value: ${{ jobs.propagate.outputs.controller-receipt-digest }}\n controller-receipt-status:\n description: Controller receipt status\n value: ${{ jobs.propagate.outputs.controller-receipt-status }}\n propagation-receipt-json:\n description: Exact release propagation receipt JSON\n value: ${{ jobs.propagate.outputs.propagation-receipt-json }}\n propagation-receipt-digest:\n description: Exact release propagation receipt SHA-256\n value: ${{ jobs.propagate.outputs.propagation-receipt-digest }}\n propagation-work-artifact:\n description: Agent-native propagation work artifact name\n value: ${{ jobs.propagate.outputs.propagation-work-artifact }}\n propagation-work-json:\n description: Latest agent-native propagation work envelope\n value: ${{ jobs.propagate.outputs.propagation-work-json }}\n propagation-work-root:\n description: Latest agent-native propagation work content root\n value: ${{ jobs.propagate.outputs.propagation-work-root }}\n propagation-work-next-action:\n description: Next executable agent action\n value: ${{ jobs.propagate.outputs.propagation-work-next-action }}" }, { "path": ".github/workflows/public-release-tail.yml", "target": ".github/workflows/.release-tail.yml", "interface": { "workflow_call": { "inputs": { "declaration-path": { "description": "Versioned release-tail declaration in the caller checkout", "type": "string", "required": false }, "provider-bindings-path": { "description": "Release-tail provider bindings, or an optional exact canonical match for capsule-bound rehearsal bindings", "type": "string", "required": false }, "rehearsal-capsule-path": { "description": "Optional v4 Publication Rehearsal Capsule in the caller checkout", "type": "string", "default": "", "required": false }, "candidate-root": { "description": "Caller-relative Publication Rehearsal candidate root", "type": "string", "default": ".buildchain/publication-rehearsal/candidate", "required": false }, "rehearsal-mode": { "description": "Publication rehearsal mode: simulate, replay, or provider", "type": "string", "default": "simulate", "required": false }, "rehearsal-authority-path": { "description": "Caller-relative exact rehearsal-only authority for provider mode", "type": "string", "default": "", "required": false }, "rehearsal-evidence-path": { "description": "Rooted Publication Rehearsal evidence path", "type": "string", "default": ".buildchain/publication-rehearsal/evidence.json", "required": false }, "state-path": { "description": "Durable release-tail transaction path", "type": "string", "default": ".buildchain/release-tail/state.json", "required": false }, "execute": { "description": "Execute provider effects; false only seals the plan", "type": "boolean", "default": true, "required": false }, "runtime-ref": { "description": "Transient execution runtime; empty selects the consumer lock.", "type": "string", "required": false, "default": "" }, "contract-lock": { "description": "Optional consumer runtime lock path.", "type": "string", "required": false, "default": "" }, "runtime-selection": { "description": "Entry-resolved runtime transport for nested workflow jobs.", "type": "string", "required": false, "default": "" } }, "secrets": { "http-token": { "description": "Optional bearer token for built-in HTTPS mutation adapters", "required": false } }, "outputs": { "transaction-state": { "description": "Final transaction state", "value": "${{ jobs.release-tail.outputs.transaction-state }}" }, "transaction-root": { "description": "Stable declared transaction root", "value": "${{ jobs.release-tail.outputs.transaction-root }}" }, "state-root": { "description": "Root of the final durable state", "value": "${{ jobs.release-tail.outputs.state-root }}" }, "rehearsal-evidence-root": { "description": "Root of non-authoritative Publication Rehearsal evidence", "value": "${{ jobs.release-tail.outputs.rehearsal-evidence-root }}" } } } }, "permissions": null, "interfaceSource": "on:\n workflow_call:\n inputs:\n declaration-path:\n description: Versioned release-tail declaration in the caller checkout\n type: string\n required: false\n provider-bindings-path:\n description: Release-tail provider bindings, or an optional exact canonical match for capsule-bound\n rehearsal bindings\n type: string\n required: false\n rehearsal-capsule-path:\n description: Optional v4 Publication Rehearsal Capsule in the caller checkout\n type: string\n default: \"\"\n required: false\n candidate-root:\n description: Caller-relative Publication Rehearsal candidate root\n type: string\n default: .buildchain/publication-rehearsal/candidate\n required: false\n rehearsal-mode:\n description: \"Publication rehearsal mode: simulate, replay, or provider\"\n type: string\n default: simulate\n required: false\n rehearsal-authority-path:\n description: Caller-relative exact rehearsal-only authority for provider mode\n type: string\n default: \"\"\n required: false\n rehearsal-evidence-path:\n description: Rooted Publication Rehearsal evidence path\n type: string\n default: .buildchain/publication-rehearsal/evidence.json\n required: false\n state-path:\n description: Durable release-tail transaction path\n type: string\n default: .buildchain/release-tail/state.json\n required: false\n execute:\n description: Execute provider effects; false only seals the plan\n type: boolean\n default: true\n required: false\n runtime-ref:\n description: Transient execution runtime; empty selects the consumer lock.\n type: string\n required: false\n default: \"\"\n contract-lock:\n description: Optional consumer runtime lock path.\n type: string\n required: false\n default: \"\"\n runtime-selection:\n description: Entry-resolved runtime transport for nested workflow jobs.\n type: string\n required: false\n default: \"\"\n secrets:\n http-token:\n description: Optional bearer token for built-in HTTPS mutation adapters\n required: false\n outputs:\n transaction-state:\n description: Final transaction state\n value: ${{ jobs.release-tail.outputs.transaction-state }}\n transaction-root:\n description: Stable declared transaction root\n value: ${{ jobs.release-tail.outputs.transaction-root }}\n state-root:\n description: Root of the final durable state\n value: ${{ jobs.release-tail.outputs.state-root }}\n rehearsal-evidence-root:\n description: Root of non-authoritative Publication Rehearsal evidence\n value: ${{ jobs.release-tail.outputs.rehearsal-evidence-root }}" }, { "path": ".github/workflows/public-ops-stable-candidate-patrol.yml", "target": ".github/workflows/.ops-stable-candidate-patrol.yml", "interface": { "workflow_call": { "inputs": { "target-branch": { "description": "Stable release branch. Empty maps the caller dev/vN/vN.M branch to release/vN/vN.M.", "default": "", "type": "string", "required": false }, "ledger-ref": { "description": "Durable machine branch for the candidate ledger. Empty derives it from the release line.", "default": "", "type": "string", "required": false }, "minimum-soak-seconds": { "description": "Minimum interval after the final required check", "default": 0, "type": "number", "required": false }, "required-checks": { "description": "Comma/newline separated commit status contexts or check-run names; alpha-release is the prerelease publication fact", "default": "", "type": "string", "required": false }, "revoked-versions": { "description": "Exact alpha versions explicitly revoked by repository policy", "default": "", "type": "string", "required": false }, "revoke-reason": { "description": "Auditable reason applied to revoked versions", "default": "repository-policy-revocation", "type": "string", "required": false }, "hold": { "description": "Hold scheduled stable selection for the whole repository", "default": false, "type": "boolean", "required": false }, "hold-reason": { "description": "Auditable repository hold reason", "default": "", "type": "string", "required": false }, "release-now": { "description": "Exact alpha version selected by explicit human authority; bypasses schedule/soak but not revocation or source identity", "default": "", "type": "string", "required": false }, "auto-promote": { "description": "Create the exact source-lock stable PR for the selected candidate", "default": false, "type": "boolean", "required": false }, "auto-merge": { "description": "Enable GitHub auto-merge on the generated stable PR", "default": false, "type": "boolean", "required": false }, "merge-method": { "description": "GitHub auto-merge method: merge, squash, or rebase", "default": "merge", "type": "string", "required": false }, "auto-approve": { "description": "Approve the generated PR with an independent approval token, or the caller github.token when repository policy permits", "default": false, "type": "boolean", "required": false }, "dry-run": { "description": "Evaluate only; do not persist the ledger or create refs/PRs", "default": true, "type": "boolean", "required": false }, "runtime-ref": { "description": "Transient execution runtime; empty selects the consumer lock.", "type": "string", "required": false, "default": "" }, "contract-lock": { "description": "Optional consumer runtime lock path.", "type": "string", "required": false, "default": "" }, "runtime-selection": { "description": "Entry-resolved runtime transport for nested workflow jobs.", "type": "string", "required": false, "default": "" } }, "secrets": { "promotion-token": { "description": "Repository-owned token used for durable ledger, source-lock branch and PR writes", "required": false }, "approval-token": { "description": "Independent repository-owned token used only to approve the generated PR", "required": false } }, "outputs": { "result-path": { "value": "${{ jobs.patrol.outputs.result-path }}" }, "selected": { "value": "${{ jobs.patrol.outputs.selected }}" }, "selected-version": { "value": "${{ jobs.patrol.outputs.selected-version }}" }, "selected-sha": { "value": "${{ jobs.patrol.outputs.selected-sha }}" }, "stable-version": { "value": "${{ jobs.patrol.outputs.stable-version }}" }, "promotion-pr": { "value": "${{ jobs.patrol.outputs.promotion-pr }}" } } } }, "permissions": { "actions": "write", "contents": "write", "discussions": "write", "pull-requests": "write", "checks": "read", "statuses": "read" }, "interfaceSource": "on:\n workflow_call:\n inputs:\n target-branch:\n description: Stable release branch. Empty maps the caller dev/vN/vN.M branch to release/vN/vN.M.\n default: \"\"\n type: string\n required: false\n ledger-ref:\n description: Durable machine branch for the candidate ledger. Empty derives it from the release line.\n default: \"\"\n type: string\n required: false\n minimum-soak-seconds:\n description: Minimum interval after the final required check\n default: 0\n type: number\n required: false\n required-checks:\n description: Comma/newline separated commit status contexts or check-run names; alpha-release is the\n prerelease publication fact\n default: \"\"\n type: string\n required: false\n revoked-versions:\n description: Exact alpha versions explicitly revoked by repository policy\n default: \"\"\n type: string\n required: false\n revoke-reason:\n description: Auditable reason applied to revoked versions\n default: repository-policy-revocation\n type: string\n required: false\n hold:\n description: Hold scheduled stable selection for the whole repository\n default: false\n type: boolean\n required: false\n hold-reason:\n description: Auditable repository hold reason\n default: \"\"\n type: string\n required: false\n release-now:\n description: Exact alpha version selected by explicit human authority; bypasses schedule/soak but\n not revocation or source identity\n default: \"\"\n type: string\n required: false\n auto-promote:\n description: Create the exact source-lock stable PR for the selected candidate\n default: false\n type: boolean\n required: false\n auto-merge:\n description: Enable GitHub auto-merge on the generated stable PR\n default: false\n type: boolean\n required: false\n merge-method:\n description: \"GitHub auto-merge method: merge, squash, or rebase\"\n default: merge\n type: string\n required: false\n auto-approve:\n description: Approve the generated PR with an independent approval token, or the caller github.token\n when repository policy permits\n default: false\n type: boolean\n required: false\n dry-run:\n description: Evaluate only; do not persist the ledger or create refs/PRs\n default: true\n type: boolean\n required: false\n runtime-ref:\n description: Transient execution runtime; empty selects the consumer lock.\n type: string\n required: false\n default: \"\"\n contract-lock:\n description: Optional consumer runtime lock path.\n type: string\n required: false\n default: \"\"\n runtime-selection:\n description: Entry-resolved runtime transport for nested workflow jobs.\n type: string\n required: false\n default: \"\"\n secrets:\n promotion-token:\n description: Repository-owned token used for durable ledger, source-lock branch and PR writes\n required: false\n approval-token:\n description: Independent repository-owned token used only to approve the generated PR\n required: false\n outputs:\n result-path:\n value: ${{ jobs.patrol.outputs.result-path }}\n selected:\n value: ${{ jobs.patrol.outputs.selected }}\n selected-version:\n value: ${{ jobs.patrol.outputs.selected-version }}\n selected-sha:\n value: ${{ jobs.patrol.outputs.selected-sha }}\n stable-version:\n value: ${{ jobs.patrol.outputs.stable-version }}\n promotion-pr:\n value: ${{ jobs.patrol.outputs.promotion-pr }}" }, { "path": ".github/workflows/public-build-adopter-qualification.yml", "target": ".github/workflows/.build-adopter-qualification.yml", "interface": { "workflow_dispatch": { "inputs": { "consumer": { "description": "Stable lowercase public adopter identity", "required": false, "default": "buildchain", "type": "string" }, "input-path": { "description": "Repository-relative public adopter delivery gate input", "required": false, "default": "contracts/fixtures/v4-adopter-delivery-v1/gate-positive.json", "type": "string" }, "consumer-repository": { "description": "Exact external public adopter repository for candidate qualification", "required": false, "default": "", "type": "string" }, "consumer-ref": { "description": "Exact external public adopter commit for candidate qualification", "required": false, "default": "", "type": "string" }, "invocation-source-path": { "description": "Public floating caller path retained by the external adopter", "required": false, "default": "", "type": "string" }, "runtime-ref": { "description": "Transient execution runtime; empty selects the consumer lock.", "type": "string", "required": false, "default": "" }, "contract-lock": { "description": "Optional consumer runtime lock path.", "type": "string", "required": false, "default": "" } } }, "workflow_call": { "inputs": { "consumer": { "description": "Stable lowercase public adopter identity", "required": true, "type": "string" }, "input-path": { "description": "Repository-relative public adopter delivery gate input", "required": true, "type": "string" }, "consumer-repository": { "description": "Exact external public adopter repository for candidate qualification", "required": false, "default": "", "type": "string" }, "consumer-ref": { "description": "Exact external public adopter commit for candidate qualification", "required": false, "default": "", "type": "string" }, "invocation-source-path": { "description": "Public floating caller path retained by the external adopter", "required": false, "default": "", "type": "string" }, "runtime-ref": { "description": "Transient execution runtime; empty selects the consumer lock.", "type": "string", "required": false, "default": "" }, "contract-lock": { "description": "Optional consumer runtime lock path.", "type": "string", "required": false, "default": "" }, "runtime-selection": { "description": "Entry-resolved runtime transport for nested workflow jobs.", "type": "string", "required": false, "default": "" } } } }, "permissions": { "contents": "read" }, "interfaceSource": "on:\n workflow_dispatch:\n inputs:\n consumer:\n description: Stable lowercase public adopter identity\n required: false\n default: buildchain\n type: string\n input-path:\n description: Repository-relative public adopter delivery gate input\n required: false\n default: contracts/fixtures/v4-adopter-delivery-v1/gate-positive.json\n type: string\n consumer-repository:\n description: Exact external public adopter repository for candidate qualification\n required: false\n default: \"\"\n type: string\n consumer-ref:\n description: Exact external public adopter commit for candidate qualification\n required: false\n default: \"\"\n type: string\n invocation-source-path:\n description: Public floating caller path retained by the external adopter\n required: false\n default: \"\"\n type: string\n runtime-ref:\n description: Transient execution runtime; empty selects the consumer lock.\n type: string\n required: false\n default: \"\"\n contract-lock:\n description: Optional consumer runtime lock path.\n type: string\n required: false\n default: \"\"\n workflow_call:\n inputs:\n consumer:\n description: Stable lowercase public adopter identity\n required: true\n type: string\n input-path:\n description: Repository-relative public adopter delivery gate input\n required: true\n type: string\n consumer-repository:\n description: Exact external public adopter repository for candidate qualification\n required: false\n default: \"\"\n type: string\n consumer-ref:\n description: Exact external public adopter commit for candidate qualification\n required: false\n default: \"\"\n type: string\n invocation-source-path:\n description: Public floating caller path retained by the external adopter\n required: false\n default: \"\"\n type: string\n runtime-ref:\n description: Transient execution runtime; empty selects the consumer lock.\n type: string\n required: false\n default: \"\"\n contract-lock:\n description: Optional consumer runtime lock path.\n type: string\n required: false\n default: \"\"\n runtime-selection:\n description: Entry-resolved runtime transport for nested workflow jobs.\n type: string\n required: false\n default: \"\"" }, { "path": ".github/workflows/public-build-stage-capsule-canary.yml", "target": ".github/workflows/.build-stage-capsule-canary.yml", "interface": { "workflow_call": { "inputs": { "consumer": { "description": "Stable lowercase consumer identity used in exact evidence roots", "required": true, "type": "string" }, "node-version": { "description": "Node.js version used by the declared consumer lifecycle", "required": false, "default": "24", "type": "string" }, "go-version": { "description": "Optional Go version required by the declared consumer lifecycle", "required": false, "default": "", "type": "string" }, "install-artifact-path": { "description": "Real output path produced by lifecycle.install", "required": true, "type": "string" }, "build-artifact-path": { "description": "Real output path produced by lifecycle.build", "required": true, "type": "string" }, "verify-artifact-path": { "description": "Real output path produced by lifecycle.verify", "required": true, "type": "string" }, "runtime-ref": { "description": "Transient execution runtime; empty selects the consumer lock.", "type": "string", "required": false, "default": "" }, "contract-lock": { "description": "Optional consumer runtime lock path.", "type": "string", "required": false, "default": "" }, "runtime-selection": { "description": "Entry-resolved runtime transport for nested workflow jobs.", "type": "string", "required": false, "default": "" } } } }, "permissions": { "contents": "read" }, "interfaceSource": "on:\n workflow_call:\n inputs:\n consumer:\n description: Stable lowercase consumer identity used in exact evidence roots\n required: true\n type: string\n node-version:\n description: Node.js version used by the declared consumer lifecycle\n required: false\n default: \"24\"\n type: string\n go-version:\n description: Optional Go version required by the declared consumer lifecycle\n required: false\n default: \"\"\n type: string\n install-artifact-path:\n description: Real output path produced by lifecycle.install\n required: true\n type: string\n build-artifact-path:\n description: Real output path produced by lifecycle.build\n required: true\n type: string\n verify-artifact-path:\n description: Real output path produced by lifecycle.verify\n required: true\n type: string\n runtime-ref:\n description: Transient execution runtime; empty selects the consumer lock.\n type: string\n required: false\n default: \"\"\n contract-lock:\n description: Optional consumer runtime lock path.\n type: string\n required: false\n default: \"\"\n runtime-selection:\n description: Entry-resolved runtime transport for nested workflow jobs.\n type: string\n required: false\n default: \"\"" }, { "path": ".github/workflows/public-ops-tail-reseal.yml", "target": ".github/workflows/.ops-tail-reseal.yml", "interface": { "workflow_call": { "inputs": { "request-json": { "description": "Exact rooted v4 tail-reseal request JSON", "required": true, "type": "string" }, "consumer-policy-receipt-json": { "description": "Original candidate floating-consumer policy receipt JSON", "required": true, "type": "string" }, "macos-finalization-command": { "description": "Reviewed macOS signing-finalization command that emits provider readbacks", "required": true, "type": "string" }, "artifact-retention-days": { "description": "Retention window for resealed candidate evidence", "required": false, "default": 7, "type": "number" }, "runtime-ref": { "description": "Transient execution runtime; empty selects the consumer lock.", "type": "string", "required": false, "default": "" }, "contract-lock": { "description": "Optional consumer runtime lock path.", "type": "string", "required": false, "default": "" }, "runtime-selection": { "description": "Entry-resolved runtime transport for nested workflow jobs.", "type": "string", "required": false, "default": "" } }, "secrets": { "BUILDCHAIN_EVIDENCE_READ_TOKEN": { "description": "Read-only token for cross-repository run and artifact evidence", "required": true }, "BUILDCHAIN_SIGNING_TOKEN": { "description": "Credential-island token available only to macOS finalization", "required": true } }, "outputs": { "release-candidate-passport-json": { "description": "Standard v4 candidate Release Passport summary", "value": "${{ jobs.seal.outputs.release-candidate-passport-json }}" }, "tail-reseal-receipt-root": { "description": "Root of the independently read-back tail-reseal receipt", "value": "${{ jobs.seal.outputs.tail-reseal-receipt-root }}" } } } }, "permissions": { "actions": "read", "contents": "read" }, "interfaceSource": "on:\n workflow_call:\n inputs:\n request-json:\n description: Exact rooted v4 tail-reseal request JSON\n required: true\n type: string\n consumer-policy-receipt-json:\n description: Original candidate floating-consumer policy receipt JSON\n required: true\n type: string\n macos-finalization-command:\n description: Reviewed macOS signing-finalization command that emits provider readbacks\n required: true\n type: string\n artifact-retention-days:\n description: Retention window for resealed candidate evidence\n required: false\n default: 7\n type: number\n runtime-ref:\n description: Transient execution runtime; empty selects the consumer lock.\n type: string\n required: false\n default: \"\"\n contract-lock:\n description: Optional consumer runtime lock path.\n type: string\n required: false\n default: \"\"\n runtime-selection:\n description: Entry-resolved runtime transport for nested workflow jobs.\n type: string\n required: false\n default: \"\"\n secrets:\n BUILDCHAIN_EVIDENCE_READ_TOKEN:\n description: Read-only token for cross-repository run and artifact evidence\n required: true\n BUILDCHAIN_SIGNING_TOKEN:\n description: Credential-island token available only to macOS finalization\n required: true\n outputs:\n release-candidate-passport-json:\n description: Standard v4 candidate Release Passport summary\n value: ${{ jobs.seal.outputs.release-candidate-passport-json }}\n tail-reseal-receipt-root:\n description: Root of the independently read-back tail-reseal receipt\n value: ${{ jobs.seal.outputs.tail-reseal-receipt-root }}" }, { "path": ".github/workflows/public-release-oci-compose-preview.yml", "target": ".github/workflows/.release-oci-compose-preview.yml", "interface": { "workflow_call": { "secrets": { "BUILDCHAIN_PROMOTION_TOKEN": { "required": true } }, "inputs": { "runtime-ref": { "description": "Transient execution runtime; empty selects the consumer lock.", "type": "string", "required": false, "default": "" }, "contract-lock": { "description": "Optional consumer runtime lock path.", "type": "string", "required": false, "default": "" }, "runtime-selection": { "description": "Entry-resolved runtime transport for nested workflow jobs.", "type": "string", "required": false, "default": "" } } } }, "permissions": { "contents": "read" }, "interfaceSource": "on:\n workflow_call:\n secrets:\n BUILDCHAIN_PROMOTION_TOKEN:\n required: true\n inputs:\n runtime-ref:\n description: Transient execution runtime; empty selects the consumer lock.\n type: string\n required: false\n default: \"\"\n contract-lock:\n description: Optional consumer runtime lock path.\n type: string\n required: false\n default: \"\"\n runtime-selection:\n description: Entry-resolved runtime transport for nested workflow jobs.\n type: string\n required: false\n default: \"\"" }, { "path": ".github/workflows/v4-stage-capsule-canary.yml", "target": ".github/workflows/.build-stage-capsule-canary.yml", "source": { "ref": "v4.0.0", "sha": "45a49dcaa0fcef59bc66481a85c39514d08972cc" }, "interface": { "workflow_call": { "inputs": { "consumer": { "description": "Stable lowercase consumer identity used in exact evidence roots", "required": true, "type": "string" }, "node-version": { "description": "Node.js version used by the declared consumer lifecycle", "required": false, "default": "24", "type": "string" }, "go-version": { "description": "Optional Go version required by the declared consumer lifecycle", "required": false, "default": "", "type": "string" }, "install-artifact-path": { "description": "Real output path produced by lifecycle.install", "required": true, "type": "string" }, "build-artifact-path": { "description": "Real output path produced by lifecycle.build", "required": true, "type": "string" }, "verify-artifact-path": { "description": "Real output path produced by lifecycle.verify", "required": true, "type": "string" }, "runtime-ref": { "description": "Transient execution runtime; empty selects the consumer lock.", "type": "string", "required": false, "default": "" }, "contract-lock": { "description": "Optional consumer runtime lock path.", "type": "string", "required": false, "default": "" }, "runtime-selection": { "description": "Entry-resolved runtime transport for nested workflow jobs.", "type": "string", "required": false, "default": "" } } } }, "permissions": { "contents": "read" }, "interfaceSource": "on:\n workflow_call:\n inputs:\n consumer:\n description: Stable lowercase consumer identity used in exact evidence roots\n required: true\n type: string\n node-version:\n description: Node.js version used by the declared consumer lifecycle\n required: false\n default: \"24\"\n type: string\n go-version:\n description: Optional Go version required by the declared consumer lifecycle\n required: false\n default: \"\"\n type: string\n install-artifact-path:\n description: Real output path produced by lifecycle.install\n required: true\n type: string\n build-artifact-path:\n description: Real output path produced by lifecycle.build\n required: true\n type: string\n verify-artifact-path:\n description: Real output path produced by lifecycle.verify\n required: true\n type: string\n runtime-ref:\n description: Transient execution runtime; empty selects the consumer lock.\n type: string\n required: false\n default: \"\"\n contract-lock:\n description: Optional consumer runtime lock path.\n type: string\n required: false\n default: \"\"\n runtime-selection:\n description: Entry-resolved runtime transport for nested workflow jobs.\n type: string\n required: false\n default: \"\"\n" }, { "path": ".github/workflows/check.yml", "target": ".github/workflows/.build-check.yml", "adapter": "entry-v4.0", "source": { "ref": "v4.0.0", "sha": "45a49dcaa0fcef59bc66481a85c39514d08972cc" }, "interface": { "workflow_call": { "inputs": { "working-directory": { "description": "Repository directory containing buildchain.toml", "default": ".", "type": "string", "required": false }, "node-version": { "description": "Node.js version used for the Buildchain runtime", "default": "24", "type": "string", "required": false }, "require-version-state": { "description": "Require configured version.files entries", "default": false, "type": "boolean", "required": false }, "mode": { "description": "Check mode: verify runs install + verify; source runs install + check", "default": "verify", "type": "string", "required": false }, "upload-artifacts": { "description": "Upload check lifecycle manifests and summaries", "default": true, "type": "boolean", "required": false }, "source-proof-reuse": { "description": "Allow exact accepted pull-request source proof reuse for merge groups", "default": false, "type": "boolean", "required": false }, "source-proof-policy-paths-json": { "description": "JSON array of source policy paths bound into the reusable proof", "default": "[]", "type": "string", "required": false }, "source-proof-closure-paths-json": { "description": "JSON array of source closure paths bound into the reusable proof", "default": "[]", "type": "string", "required": false }, "source-proof-dependency-paths-json": { "description": "JSON array of dependency paths bound into the reusable proof", "default": "[]", "type": "string", "required": false }, "source-proof-required-contexts-json": { "description": "JSON array of required contexts bound into the reusable proof", "default": "[]", "type": "string", "required": false }, "runtime-ref": { "description": "Transient execution runtime; empty selects the consumer lock.", "type": "string", "required": false, "default": "" }, "contract-lock": { "description": "Optional consumer runtime lock path.", "type": "string", "required": false, "default": "" }, "runtime-selection": { "description": "Entry-resolved runtime transport for nested workflow jobs.", "type": "string", "required": false, "default": "" }, "buildchain-repository": { "description": "Buildchain runtime repository", "default": "kungfu-systems/buildchain", "type": "string", "required": false }, "buildchain-ref": { "description": "Buildchain runtime ref. Empty uses v3.", "default": "v3", "type": "string", "required": false } }, "outputs": { "controller-plan-artifact": { "description": "Uploaded source-check controller plan artifact name", "value": "${{ jobs.check.outputs.controller-plan-artifact }}" }, "controller-plan-json": { "description": "Compact source/runtime-bound source-check controller plan", "value": "${{ jobs.check.outputs.controller-plan-json }}" }, "controller-plan-digest": { "description": "Digest of the source-check controller plan", "value": "${{ jobs.check.outputs.controller-plan-digest }}" }, "controller-receipt-artifact": { "description": "Uploaded source-check controller receipt artifact name", "value": "${{ jobs.check.outputs.controller-receipt-artifact }}" }, "controller-receipt-json": { "description": "Compact source-check controller receipt", "value": "${{ jobs.check.outputs.controller-receipt-json }}" }, "controller-receipt-digest": { "description": "Digest of the source-check controller receipt", "value": "${{ jobs.check.outputs.controller-receipt-digest }}" }, "controller-receipt-status": { "description": "Final source-check controller status", "value": "${{ jobs.check.outputs.controller-receipt-status }}" }, "source-proof-root": { "description": "Exact source qualification proof root sealed or reused by this run", "value": "${{ jobs.check.outputs.source-proof-root }}" }, "source-proof-reused": { "description": "Whether this run reused an exact accepted source proof", "value": "${{ jobs.check.outputs.source-proof-reused }}" }, "source-proof-reuse-reason": { "description": "Reuse decision or fail-closed fallback reason", "value": "${{ jobs.check.outputs.source-proof-reuse-reason }}" }, "source-proof-producer-run-id": { "description": "Pull-request workflow run that produced the reused proof", "value": "${{ jobs.check.outputs.source-proof-producer-run-id }}" }, "source-proof-decision-root": { "description": "Exact merge-group source-proof reuse decision root", "value": "${{ jobs.check.outputs.source-proof-decision-root }}" } } } }, "permissions": { "contents": "read" }, "interfaceSource": "on:\n workflow_call:\n inputs:\n working-directory:\n description: Repository directory containing buildchain.toml\n default: .\n type: string\n required: false\n node-version:\n description: Node.js version used for the Buildchain runtime\n default: \"24\"\n type: string\n required: false\n require-version-state:\n description: Require configured version.files entries\n default: false\n type: boolean\n required: false\n mode:\n description: \"Check mode: verify runs install + verify; source runs install + check\"\n default: verify\n type: string\n required: false\n upload-artifacts:\n description: Upload check lifecycle manifests and summaries\n default: true\n type: boolean\n required: false\n source-proof-reuse:\n description: Allow exact accepted pull-request source proof reuse for merge groups\n default: false\n type: boolean\n required: false\n source-proof-policy-paths-json:\n description: JSON array of source policy paths bound into the reusable proof\n default: \"[]\"\n type: string\n required: false\n source-proof-closure-paths-json:\n description: JSON array of source closure paths bound into the reusable proof\n default: \"[]\"\n type: string\n required: false\n source-proof-dependency-paths-json:\n description: JSON array of dependency paths bound into the reusable proof\n default: \"[]\"\n type: string\n required: false\n source-proof-required-contexts-json:\n description: JSON array of required contexts bound into the reusable proof\n default: \"[]\"\n type: string\n required: false\n runtime-ref:\n description: Transient execution runtime; empty selects the consumer lock.\n type: string\n required: false\n default: \"\"\n contract-lock:\n description: Optional consumer runtime lock path.\n type: string\n required: false\n default: \"\"\n runtime-selection:\n description: Entry-resolved runtime transport for nested workflow jobs.\n type: string\n required: false\n default: \"\"\n buildchain-repository:\n description: Buildchain runtime repository\n default: kungfu-systems/buildchain\n type: string\n required: false\n buildchain-ref:\n description: Buildchain runtime ref. Empty uses v3.\n default: v3\n type: string\n required: false\n outputs:\n controller-plan-artifact:\n description: Uploaded source-check controller plan artifact name\n value: ${{ jobs.check.outputs.controller-plan-artifact }}\n controller-plan-json:\n description: Compact source/runtime-bound source-check controller plan\n value: ${{ jobs.check.outputs.controller-plan-json }}\n controller-plan-digest:\n description: Digest of the source-check controller plan\n value: ${{ jobs.check.outputs.controller-plan-digest }}\n controller-receipt-artifact:\n description: Uploaded source-check controller receipt artifact name\n value: ${{ jobs.check.outputs.controller-receipt-artifact }}\n controller-receipt-json:\n description: Compact source-check controller receipt\n value: ${{ jobs.check.outputs.controller-receipt-json }}\n controller-receipt-digest:\n description: Digest of the source-check controller receipt\n value: ${{ jobs.check.outputs.controller-receipt-digest }}\n controller-receipt-status:\n description: Final source-check controller status\n value: ${{ jobs.check.outputs.controller-receipt-status }}\n source-proof-root:\n description: Exact source qualification proof root sealed or reused by this run\n value: ${{ jobs.check.outputs.source-proof-root }}\n source-proof-reused:\n description: Whether this run reused an exact accepted source proof\n value: ${{ jobs.check.outputs.source-proof-reused }}\n source-proof-reuse-reason:\n description: Reuse decision or fail-closed fallback reason\n value: ${{ jobs.check.outputs.source-proof-reuse-reason }}\n source-proof-producer-run-id:\n description: Pull-request workflow run that produced the reused proof\n value: ${{ jobs.check.outputs.source-proof-producer-run-id }}\n source-proof-decision-root:\n description: Exact merge-group source-proof reuse decision root\n value: ${{ jobs.check.outputs.source-proof-decision-root }}\n" }, { "path": ".github/workflows/.build-historical.yml", "target": ".github/workflows/.build.yml", "adapter": "build-backbone", "support": true, "inheritCallerPermissions": true, "interface": { "workflow_call": { "inputs": { "compatibility-inputs": { "description": "Internal transport for retained historical build arguments.", "type": "string", "required": false, "default": "" }, "config-path": { "description": "Locate buildchain.toml when the project cannot be discovered.", "type": "string", "required": false, "default": "" }, "runtime-ref": { "description": "Transient execution runtime; empty selects the consumer lock.", "type": "string", "required": false, "default": "" }, "contract-lock": { "description": "Optional consumer runtime contract lock path.", "type": "string", "required": false, "default": "" }, "resume-run-id": { "description": "Failed execution to resume using its original source and retained build outputs.", "type": "string", "required": false, "default": "" }, "runtime-selection": { "description": "Entry-resolved runtime transport for nested workflows.", "type": "string", "required": false, "default": "" } }, "secrets": { "BUILDCHAIN_PROMOTION_TOKEN": { "required": false }, "BUILDCHAIN_MACOS_CERTIFICATE_P12_BASE64": { "required": false }, "BUILDCHAIN_MACOS_CERTIFICATE_PASSWORD": { "required": false }, "BUILDCHAIN_MACOS_NOTARY_API_KEY_P8_BASE64": { "required": false }, "BUILDCHAIN_MACOS_NOTARY_API_KEY_ID": { "required": false }, "BUILDCHAIN_MACOS_NOTARY_API_ISSUER": { "required": false } }, "outputs": { "result": { "description": "Rooted build result and exact artifact references.", "value": "${{ jobs.deliver.outputs.result }}" }, "runtime-selection": { "description": "Entry-resolved runtime for the historical aggregate check.", "value": "${{ jobs.execution-runtime.outputs.selection }}" } } } }, "permissions": null, "interfaceSource": "on:\n workflow_call:\n inputs:\n compatibility-inputs:\n description: Internal transport for retained historical build arguments.\n type: string\n required: false\n default: \"\"\n config-path:\n description: Locate buildchain.toml when the project cannot be discovered.\n type: string\n required: false\n default: \"\"\n runtime-ref:\n description: Transient execution runtime; empty selects the consumer lock.\n type: string\n required: false\n default: \"\"\n contract-lock:\n description: Optional consumer runtime contract lock path.\n type: string\n required: false\n default: \"\"\n resume-run-id:\n description: Failed execution to resume using its original source and retained\n build outputs.\n type: string\n required: false\n default: \"\"\n runtime-selection:\n description: Entry-resolved runtime transport for nested workflows.\n type: string\n required: false\n default: \"\"\n secrets:\n BUILDCHAIN_PROMOTION_TOKEN:\n required: false\n BUILDCHAIN_MACOS_CERTIFICATE_P12_BASE64:\n required: false\n BUILDCHAIN_MACOS_CERTIFICATE_PASSWORD:\n required: false\n BUILDCHAIN_MACOS_NOTARY_API_KEY_P8_BASE64:\n required: false\n BUILDCHAIN_MACOS_NOTARY_API_KEY_ID:\n required: false\n BUILDCHAIN_MACOS_NOTARY_API_ISSUER:\n required: false\n outputs:\n result:\n description: Rooted build result and exact artifact references.\n value: ${{ jobs.deliver.outputs.result }}\n runtime-selection:\n description: Entry-resolved runtime for the historical aggregate check.\n value: ${{ jobs.execution-runtime.outputs.selection }}\n", "inputVariables": { "artifact-relay-s3-bucket": "BUILDCHAIN_ARTIFACT_RELAY_S3_BUCKET", "artifact-relay-s3-region": "BUILDCHAIN_ARTIFACT_RELAY_S3_REGION", "artifact-relay-s3-prefix": "BUILDCHAIN_ARTIFACT_RELAY_S3_PREFIX", "artifact-relay-s3-role-arn": "BUILDCHAIN_ARTIFACT_RELAY_S3_ROLE_ARN", "artifact-relay-s3-upload-role-arn": "BUILDCHAIN_ARTIFACT_RELAY_S3_UPLOAD_ROLE_ARN", "artifact-relay-s3-download-role-arn": "BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN", "artifact-relay-s3-oidc-audience": "BUILDCHAIN_ARTIFACT_RELAY_S3_OIDC_AUDIENCE", "checkout-cache-mirror-url-template": "BUILDCHAIN_CHECKOUT_CACHE_MIRROR_URL_TEMPLATE", "checkout-cache-reference-repository-template": "BUILDCHAIN_CHECKOUT_CACHE_REFERENCE_REPOSITORY_TEMPLATE", "artifact-signing-request-upload-no-proxy": "BUILDCHAIN_ARTIFACT_SIGNING_REQUEST_UPLOAD_NO_PROXY" } }, { "path": ".github/workflows/release-candidate-promote.yml", "target": ".github/workflows/.release-candidate-promote.yml", "adapter": "promotion-v4.0", "source": { "ref": "v4.0.0", "sha": "45a49dcaa0fcef59bc66481a85c39514d08972cc" }, "permissions": { "actions": "write", "artifact-metadata": "write", "attestations": "write", "checks": "write", "contents": "write", "id-token": "write", "issues": "write", "pull-requests": "write" }, "interface": { "workflow_call": { "inputs": { "buildchain-channel": { "description": "Promotion workflow-shell/runtime channel: auto, alpha, or stable", "default": "auto", "type": "string", "required": false }, "buildchain-alpha-contract-lock-path": { "description": "Consumer-owned contract lock selected for alpha promotion", "default": ".buildchain/alpha-contract-lock.json", "type": "string", "required": false }, "buildchain-stable-contract-lock-path": { "description": "Consumer-owned contract lock selected for stable promotion", "default": ".buildchain/contract-lock.json", "type": "string", "required": false }, "buildchain-repository": { "default": "kungfu-systems/buildchain", "type": "string", "required": false }, "buildchain-ref": { "description": "Optional Buildchain runtime ref. Empty uses the workflow shell ref.", "default": "", "type": "string", "required": false }, "buildchain-contract-lock-path": { "description": "Consumer-owned Buildchain contract lock path", "default": "", "type": "string", "required": false }, "buildchain-contract-compatibility-policy": { "description": "Contract compatibility policy: major-compatible, allow-additive, or exact", "default": "major-compatible", "type": "string", "required": false }, "buildchain-contract-drift-issue-mode": { "description": "Consumer issue behavior for Buildchain floating-ref contract drift: off, breaking-only, or compatible-and-breaking", "default": "compatible-and-breaking", "type": "string", "required": false }, "allow-repository": { "description": "Repository allowed to promote. Empty defaults to the caller repository.", "default": "", "type": "string", "required": false }, "channel": { "description": "Promotion channel: alpha, release, or major. Empty derives from target-ref.", "default": "", "type": "string", "required": false }, "target-ref": { "description": "Channel ref to promote. Defaults to the current ref name.", "default": "", "type": "string", "required": false }, "target-sha": { "description": "Channel commit SHA to promote. Defaults to the current workflow SHA.", "default": "", "type": "string", "required": false }, "package-manager": { "description": "Package manager recorded for audit: npm, pnpm, yarn, or custom", "default": "npm", "type": "string", "required": false }, "artifact-name": { "description": "Base artifact name used by the PR-stage reusable build", "default": "buildchain-artifact", "type": "string", "required": false }, "release-candidate-workflow-file": { "description": "PR-stage release-candidate workflow file name", "default": "build.yml", "type": "string", "required": false }, "release-candidate-workflow-name": { "description": "PR-stage release-candidate workflow display name", "default": "Build", "type": "string", "required": false }, "release-candidate-wait-seconds": { "description": "Bounded wait for the complete PR-stage release-candidate workflow, including post-required-check evidence tails", "default": 10800, "type": "number", "required": false }, "resume-candidate-repository": { "description": "Repository that owns the sealed candidate run; empty selects normal candidate discovery", "default": "", "type": "string", "required": false }, "resume-candidate-run-id": { "description": "Exact successful candidate workflow run ID to recover through this fresh workflow event", "default": "", "type": "string", "required": false }, "resume-expected-workflow-file": { "description": "Exact trusted Build workflow file that produced the candidate", "default": "", "type": "string", "required": false }, "resume-expected-workflow-name": { "description": "Exact trusted Build workflow display name that produced the candidate", "default": "", "type": "string", "required": false }, "resume-expected-source-tree": { "description": "Optional exact candidate Git tree; required when expected candidate root is empty", "default": "", "type": "string", "required": false }, "resume-expected-candidate-root": { "description": "Optional exact sha256 Release Candidate root; required when expected source tree is empty", "default": "", "type": "string", "required": false }, "resume-expected-candidate-runtime-sha": { "description": "Exact Buildchain runtime SHA recorded by the original candidate", "default": "", "type": "string", "required": false }, "resume-buildchain-runtime-sha": { "description": "Exact current Buildchain tooling SHA authorized to perform recovery", "default": "", "type": "string", "required": false }, "resume-transaction-id": { "description": "Optional exact durable publication transaction identity to resume", "default": "", "type": "string", "required": false }, "release-candidate-family-evidence-required": { "description": "Require exact Initiative-family evidence before protected promotion", "default": false, "type": "boolean", "required": false }, "release-candidate-family-evidence-root": { "description": "Optional expected Initiative-family evidence content root", "default": "", "type": "string", "required": false }, "release-candidate-family-initiative-id": { "description": "Optional expected Initiative identity", "default": "", "type": "string", "required": false }, "release-candidate-family-assignment-id": { "description": "Optional expected child Assignment identity", "default": "", "type": "string", "required": false }, "artifact-patterns": { "description": "Newline-separated payload artifact patterns expected from the RC bundle", "default": "", "type": "string", "required": false }, "required-status-check": { "description": "Exact required protected-branch status check context", "default": "check / check", "type": "string", "required": false }, "branch-protection-bypass-apps": { "description": "GitHub App slugs allowed to bypass pull-request review for Buildchain-managed generated channel ref updates", "default": "github-actions", "type": "string", "required": false }, "branch-protection-bypass-users": { "description": "Reserved compatibility input; managed channel protection rejects user bypass actors", "default": "", "type": "string", "required": false }, "branch-protection-bypass-teams": { "description": "Reserved compatibility input; managed channel protection rejects team bypass actors", "default": "", "type": "string", "required": false }, "publish-target": { "description": "Publish target recorded for audit: npm, github-release, custom", "default": "npm", "type": "string", "required": false }, "github-release": { "description": "Create/update the public GitHub Release and upload Buildchain release passport/evidence assets after a complete release transaction", "default": true, "type": "boolean", "required": false }, "declarative-release-tail": { "description": "Publish and read back GitHub Release assets through the Buildchain declarative release-tail provider plane", "default": false, "type": "boolean", "required": false }, "github-release-title": { "description": "Optional GitHub Release title. Empty defaults to the public release tag.", "default": "", "type": "string", "required": false }, "github-release-notes": { "description": "Optional GitHub Release notes. Empty uses a Buildchain release-passport asset note.", "default": "", "type": "string", "required": false }, "github-release-payload-patterns": { "description": "Newline-separated basename patterns selecting PR-stage payload files for the immutable public GitHub Release", "default": "", "type": "string", "required": false }, "publication-commit-command": { "description": "Optional consumer command that commits the well-known publication authority after every artifact, passport, and public read-back prerequisite succeeds", "default": "", "type": "string", "required": false }, "publication-commit-evidence-path": { "description": "Consumer evidence JSON written by publication-commit-command under .buildchain/", "default": ".buildchain/publication-commit/evidence.json", "type": "string", "required": false }, "release-activation-command": { "description": "Optional consumer command that completes exact site publication/readback and writes the authoritative activation receipt set", "default": "", "type": "string", "required": false }, "release-activation-receipt-set-path": { "description": "Consumer activation receipt set written under .buildchain/", "default": ".buildchain/release-activation/receipt-set.json", "type": "string", "required": false }, "release-passport-evidence-command": { "description": "Optional consumer command that synthesizes released evidence only from the validated activation receipt set", "default": "", "type": "string", "required": false }, "release-passport-evidence-path": { "description": "Released evidence JSON written by release-passport-evidence-command under .buildchain/", "default": ".buildchain/release-evidence/product-released-evidence.json", "type": "string", "required": false }, "standalone-binary-distribution": { "description": "Dispatch binary-distribution.yml after promotion; enable only when the caller repository provides that workflow", "default": false, "type": "boolean", "required": false }, "runner-preset": { "description": "Runner preset recorded for audit", "default": "github-hosted", "type": "string", "required": false }, "trusted-publishing": { "description": "Whether the publish target uses GitHub OIDC trusted publishing", "default": true, "type": "boolean", "required": false }, "publish-command": { "description": "Optional publish command. Defaults to lifecycle.publish from buildchain.toml.", "default": "", "type": "string", "required": false }, "publish-rematerialize-on-resume": { "description": "Replay the consumer publish materialization step after valid durable evidence is restored; use only when the command is idempotent and recreates ephemeral Passport inputs or release assets", "default": false, "type": "boolean", "required": false }, "publish-transaction-override": { "description": "Explicitly allow ancestry-bound finalization recovery for an already published durable transaction", "default": false, "type": "boolean", "required": false }, "publish-required-artifacts-json": { "description": "Required publish artifacts JSON passed to the promotion action; ref_template may contain one {version} placeholder", "default": "", "type": "string", "required": false }, "publish-artifact-kind": { "description": "Artifact kind used when generating publish-required-artifacts-json from downloaded payloads", "default": "npm", "type": "string", "required": false }, "publish-mode": { "description": "Publish mode passed to promote-buildchain-ref", "default": "", "type": "string", "required": false }, "publish-dist-tag": { "description": "Expected dist-tag passed to promote-buildchain-ref", "default": "", "type": "string", "required": false }, "publish-package-set-order": { "description": "Package-set ordering passed to promote-buildchain-ref", "default": "as-provided", "type": "string", "required": false }, "publish-package-main": { "description": "Main package name for package-set ordering", "default": "", "type": "string", "required": false }, "release-passport": { "description": "Generate and persist the release passport after publish finalization", "default": true, "type": "boolean", "required": false }, "release-propagation-config-path": { "description": "Optional source-controlled package propagation capture config read from the exact finalized release SHA", "default": "", "type": "string", "required": false }, "release-passport-output-dir": { "description": "Release passport output directory", "default": ".buildchain/release-passport", "type": "string", "required": false }, "release-passport-product-name": { "description": "Product name recorded in buildchain.release.json", "default": "", "type": "string", "required": false }, "release-passport-impact-json": { "description": "Surface-aware release impact JSON or path passed to the release passport collector", "default": "", "type": "string", "required": false }, "release-passport-kfd-1-witness-jsons": { "description": "Newline- or comma-separated KFD-1 contract-world witness JSON paths passed to the release passport collector", "default": "", "type": "string", "required": false }, "release-passport-kfd-2-claim-jsons": { "description": "Newline- or comma-separated KFD-2 public release trust claim JSON paths passed to the release passport collector", "default": "", "type": "string", "required": false }, "release-passport-kfd-3-prebuild-witness-jsons": { "description": "Newline- or comma-separated KFD-3 collaboration-interface pre-build witness JSON paths passed to the release passport collector", "default": "", "type": "string", "required": false }, "release-passport-kfd-3-artifact-witness-jsons": { "description": "Newline- or comma-separated KFD-3 artifact-side collaboration-interface witness JSON paths passed to the release passport collector", "default": "", "type": "string", "required": false }, "release-passport-kfd-3-artifact-verify-command": { "description": "Product-owned command that emits KFD-3 artifact-side collaboration-interface witness JSON", "default": "", "type": "string" }, "release-passport-kfd-adopter-manifest-json": { "description": "Standard full-cut adopter conformance manifest JSON path", "default": "", "type": "string", "required": false }, "release-passport-kfd-support-matrix-json": { "description": "Legacy KFD support projection JSON path accepted only for exact manifest comparison", "default": "", "type": "string", "required": false }, "release-passport-kfd-product-gate-jsons": { "description": "Newline- or comma-separated KFD-4/5/7 product gate result JSON paths", "default": "", "type": "string", "required": false }, "release-passport-invariant-passport-jsons": { "description": "Newline- or comma-separated invariant Passport JSON paths passed to the release gate", "default": "", "type": "string", "required": false }, "release-passport-invariant-passport-command": { "description": "Product-owned command that emits a canonical invariant Passport JSON document", "default": "", "type": "string", "required": false }, "release-passport-evidence-jsons": { "description": "Newline- or comma-separated product-owned release evidence attachment paths bound to the exact release coordinates", "default": "", "type": "string", "required": false }, "release-passport-attachment-command": { "description": "Product-owned command that emits generated release evidence attachment paths as JSON", "default": "", "type": "string", "required": false }, "release-passport-buildchain-self-kfd": { "description": "Generate Buildchain-owned KFD-1/2/3 self witnesses and claims from the checked-out package source before release passport finalization", "default": false, "type": "boolean", "required": false }, "github-artifact-attestation-policy-json": { "description": "One GitHub artifact attestation policy JSON path from the sealed release candidate; empty disables attestation", "default": "", "type": "string", "required": false }, "github-artifact-attestation-environment": { "description": "Caller-repository protected environment governing the keyless attestation", "default": "buildchain-artifact-attestation", "type": "string", "required": false }, "github-artifact-attestation-retention-days": { "description": "Retention for offline GitHub/Sigstore evidence artifacts", "default": 90, "type": "number", "required": false }, "release-passport-platform-manifest-paths": { "description": "Optional platform manifest paths for release passport; defaults to downloaded PR-stage payload manifests", "default": "", "type": "string", "required": false }, "required-artifact-count": { "description": "Minimum downloaded payload count required before publish; npm counts package tarballs", "default": 3, "type": "number", "required": false }, "publication-admission-json": { "description": "Fresh sealed publication admission JSON; required for non-dry-run publication", "default": "", "type": "string", "required": false }, "publication-runner-provenance-json": { "description": "Runner provenance receipt bound by the admission", "default": "", "type": "string", "required": false }, "publication-control-plane-audit-json": { "description": "Fresh external control-plane audit receipt bound by the admission", "default": "", "type": "string", "required": false }, "github-governance-receipt-json": { "description": "Fresh qualifying governance receipt for the exact publication repository and target ref", "default": "", "type": "string", "required": false }, "publication-gate-aggregate-json": { "description": "Qualifying Shifu Gate aggregate or explicit consumer-owned no-Gate decision", "default": "", "type": "string", "required": false }, "publication-gate-command": { "description": "Consumer-owned read-only command that assembles a qualifying Gate aggregate from the exact downloaded release-candidate evidence", "default": "", "type": "string", "required": false }, "publication-gate-controller-sha": { "description": "Exact caller-repository commit that owns the consumer Gate command; empty uses the publication source SHA", "default": "", "type": "string", "required": false }, "publication-expected-json": { "description": "Independent exact source/runtime/product/channel/artifact bindings", "default": "", "type": "string", "required": false }, "publication-used-nonces-json": { "description": "JSON array of already consumed admission nonces", "default": "[]", "type": "string", "required": false }, "publication-consumer-qualification-command": { "description": "Opt-in consumer-owned predicate command; writes its decision to BUILDCHAIN_PUBLICATION_QUALIFICATION_RESULT_PATH", "default": "", "type": "string", "required": false }, "publication-consumer-qualification-controller-sha": { "description": "Exact caller-repository commit that owns the consumer qualification command; empty uses the Gate controller SHA, then the publication source SHA", "default": "", "type": "string", "required": false }, "publication-consumer-predicate-id": { "description": "Stable identifier for the opt-in consumer-owned publication predicate", "default": "", "type": "string", "required": false }, "publication-used-qualification-nonces-json": { "description": "JSON array of already consumed qualification nonces", "default": "[]", "type": "string", "required": false }, "publication-auto-admission": { "description": "Assemble sealed evidence from the caller repository's exact managed release candidate", "default": false, "type": "boolean", "required": false }, "publication-auto-no-gate": { "description": "Explicitly declare that this managed publication has no consumer-owned Shifu Gate registry", "default": false, "type": "boolean", "required": false }, "publication-publisher-workflow-path": { "description": "Caller workflow path bound by the provider trusted-publisher policy", "default": "", "type": "string", "required": false }, "publication-product": { "default": "Buildchain", "type": "string", "required": false }, "publication-target": { "default": "npm:@kungfu-tech/buildchain", "type": "string", "required": false }, "publication-package-name": { "default": "@kungfu-tech/buildchain", "type": "string", "required": false }, "dry-run": { "description": "Plan only; do not publish or move refs", "default": false, "type": "boolean", "required": false }, "request-json": { "description": "JSON object matching contracts/promotion-request-v1.schema.json. The API validates types, defaults and authority before dispatch.", "required": false, "type": "string", "default": "" }, "runtime-ref": { "description": "Transient execution runtime; empty selects the consumer lock.", "type": "string", "required": false, "default": "" }, "contract-lock": { "description": "Optional consumer runtime lock path.", "type": "string", "required": false, "default": "" }, "runtime-selection": { "description": "Entry-resolved runtime transport for nested workflow jobs.", "type": "string", "required": false, "default": "" } }, "secrets": { "BUILDCHAIN_PROMOTION_TOKEN": { "description": "Optional bypass-capable token used only for generated protected ref updates", "required": false }, "BUILDCHAIN_PUBLICATION_COMMIT_TOKEN": { "description": "Optional consumer-owned credential exposed only to the final publication commit command", "required": false }, "BUILDCHAIN_PUBLICATION_COMMIT_SIGNING_KEY": { "description": "Optional consumer-owned private signing material exposed only to the final publication commit command", "required": false }, "KUNGFU_GOVERNANCE_AUDITOR_APP_PRIVATE_KEY": { "description": "Private key for the dedicated read-only GitHub governance auditor App", "required": false }, "buildchain-issue-token": { "description": "Optional token with issues:write on the Buildchain repository for workflow-friction reports", "required": false }, "BUILDCHAIN_ISSUE_TOKEN": { "description": "Optional token with issues:write on the Buildchain repository for workflow-friction reports", "required": false }, "buildchain-issue-app-id": { "description": "Optional GitHub App ID used to mint a Buildchain issue-report token", "required": false }, "BUILDCHAIN_ISSUE_APP_ID": { "description": "Optional GitHub App ID used to mint a Buildchain issue-report token", "required": false }, "buildchain-issue-app-private-key": { "description": "Optional GitHub App private key used to mint a Buildchain issue-report token", "required": false }, "BUILDCHAIN_ISSUE_APP_PRIVATE_KEY": { "description": "Optional GitHub App private key used to mint a Buildchain issue-report token", "required": false } }, "outputs": { "buildchain-channel": { "description": "Admitted channel.", "value": "${{ jobs.resolve-promotion.outputs.channel }}" }, "promotion-router-ref": { "description": "Admitted router-ref.", "value": "${{ jobs.resolve-promotion.outputs.router-ref }}" }, "promotion-router-sha": { "description": "Admitted router-sha.", "value": "${{ jobs.resolve-promotion.outputs.router-sha }}" }, "promotion-shell-ref": { "description": "Admitted shell-ref.", "value": "${{ jobs.resolve-promotion.outputs.shell-ref }}" }, "promotion-shell-sha": { "description": "Admitted shell-sha.", "value": "${{ jobs.resolve-promotion.outputs.shell-sha }}" }, "promotion-runtime-ref": { "description": "Admitted runtime-ref.", "value": "${{ jobs.resolve-promotion.outputs.runtime-ref }}" }, "promotion-runtime-sha": { "description": "Admitted runtime-sha.", "value": "${{ jobs.resolve-promotion.outputs.runtime-sha }}" }, "promotion-contract-lock-path": { "description": "Admitted contract-lock-path.", "value": "${{ jobs.resolve-promotion.outputs.contract-lock-path }}" }, "promotion-contract-lock-digest": { "description": "Admitted contract-lock-digest.", "value": "${{ jobs.resolve-promotion.outputs.contract-lock-digest }}" }, "promotion-publication-channel": { "description": "Admitted publication-channel.", "value": "${{ jobs.resolve-promotion.outputs.publication-channel }}" }, "promotion-target-ref": { "description": "Admitted target-ref.", "value": "${{ jobs.resolve-promotion.outputs.target-ref }}" }, "promotion-override-used": { "description": "Admitted override-used.", "value": "${{ jobs.resolve-promotion.outputs.override-used }}" }, "promoted-sha": { "description": "Promoted channel SHA", "value": "${{ jobs.invoke.outputs.promoted-sha }}" }, "built-source-sha": { "description": "PR-stage built source SHA", "value": "${{ jobs.invoke.outputs.built-source-sha }}" }, "release-candidate-artifact": { "description": "Resolved release-candidate artifact name", "value": "${{ jobs.invoke.outputs.release-candidate-artifact }}" }, "release-candidate-action": { "description": "Candidate admission action: discovered or reused", "value": "${{ jobs.invoke.outputs.release-candidate-action }}" }, "release-candidate-recovery-root": { "description": "Exact sha256 recovery receipt root", "value": "${{ jobs.invoke.outputs.release-candidate-recovery-root }}" }, "release-candidate-recovery-receipt-artifact": { "description": "Immutable recovery receipt Actions artifact name", "value": "${{ jobs.invoke.outputs.release-candidate-recovery-receipt-artifact }}" }, "release-propagation-work-artifact": { "description": "Captured package release propagation Work artifact", "value": "${{ jobs.invoke.outputs.release-propagation-work-artifact }}" }, "publication-commit-evidence-path": { "description": "Validated consumer publication commit evidence path", "value": "${{ jobs.invoke.outputs.publication-commit-evidence-path }}" }, "publication-commit-evidence-digest": { "description": "sha256 digest of validated consumer publication commit evidence", "value": "${{ jobs.invoke.outputs.publication-commit-evidence-digest }}" }, "publication-commit-url": { "description": "Canonical public authority URL validated after the final commit", "value": "${{ jobs.invoke.outputs.publication-commit-url }}" }, "publication-commit-payload-root": { "description": "Exact public authority payload root validated after the final commit", "value": "${{ jobs.invoke.outputs.publication-commit-payload-root }}" }, "controller-plan-artifact": { "description": "Controller plan artifact name", "value": "${{ jobs.invoke.outputs.controller-plan-artifact }}" }, "controller-plan-json": { "description": "Compact controller plan JSON", "value": "${{ jobs.invoke.outputs.controller-plan-json }}" }, "controller-plan-digest": { "description": "Controller plan digest", "value": "${{ jobs.invoke.outputs.controller-plan-digest }}" }, "publication-capability-digest": { "description": "Sealed publication capability receipt digest", "value": "${{ jobs.invoke.outputs.publication-capability-digest }}" }, "github-artifact-attestation-id": { "description": "GitHub keyless attestation id for the declared Linux release artifact", "value": "${{ jobs.invoke.outputs.github-artifact-attestation-id }}" }, "github-artifact-attestation-url": { "description": "GitHub keyless attestation URL", "value": "${{ jobs.invoke.outputs.github-artifact-attestation-url }}" }, "github-artifact-attestation-evidence-root": { "description": "Verified Buildchain attestation evidence root published with the GitHub Release", "value": "${{ jobs.invoke.outputs.github-artifact-attestation-evidence-root }}" }, "github-artifact-attestation-publication-receipt-digest": { "description": "Read-back verified GitHub Release evidence publication receipt digest", "value": "${{ jobs.invoke.outputs.github-artifact-attestation-publication-receipt-digest }}" }, "release-tail-declaration-root": { "description": "Root of the declarative release-tail contract", "value": "${{ jobs.invoke.outputs.release-tail-declaration-root }}" }, "release-tail-transaction-state": { "description": "Final declarative release-tail transaction state", "value": "${{ jobs.invoke.outputs.release-tail-transaction-state }}" }, "release-tail-transaction-root": { "description": "Stable declarative release-tail transaction root", "value": "${{ jobs.invoke.outputs.release-tail-transaction-root }}" }, "release-tail-state-root": { "description": "Root of the final declarative release-tail transaction state", "value": "${{ jobs.invoke.outputs.release-tail-state-root }}" }, "release-tail-receipt-roots-json": { "description": "JSON array of standardized declarative release-tail receipt roots", "value": "${{ jobs.invoke.outputs.release-tail-receipt-roots-json }}" }, "controller-receipt-artifact": { "description": "Controller receipt artifact name", "value": "${{ jobs.invoke.outputs.controller-receipt-artifact }}" }, "controller-receipt-json": { "description": "Compact controller receipt JSON", "value": "${{ jobs.invoke.outputs.controller-receipt-json }}" }, "controller-receipt-digest": { "description": "Controller receipt digest", "value": "${{ jobs.invoke.outputs.controller-receipt-digest }}" }, "controller-receipt-status": { "description": "Controller receipt status", "value": "${{ jobs.invoke.outputs.controller-receipt-status }}" }, "discussion-id": { "description": "Release transaction discussion-id.", "value": "${{ jobs.invoke.outputs.discussion-id }}" }, "discussion-url": { "description": "Release transaction discussion-url.", "value": "${{ jobs.invoke.outputs.discussion-url }}" }, "release-invocation-root": { "description": "Canonical post-admission ReleaseInvocation root", "value": "${{ jobs.invoke.outputs.release-invocation-root }}" }, "release-transaction-root": { "description": "Canonical three-phase ReleaseTransaction root", "value": "${{ jobs.invoke.outputs.release-transaction-root }}" }, "release-receipt-root": { "description": "Single terminal ReleaseReceipt root", "value": "${{ jobs.invoke.outputs.release-receipt-root }}" } } } }, "interfaceSource": "on:\n workflow_call:\n inputs:\n buildchain-channel:\n description: \"Promotion workflow-shell/runtime channel: auto, alpha, or stable\"\n default: auto\n type: string\n required: false\n buildchain-alpha-contract-lock-path:\n description: Consumer-owned contract lock selected for alpha promotion\n default: .buildchain/alpha-contract-lock.json\n type: string\n required: false\n buildchain-stable-contract-lock-path:\n description: Consumer-owned contract lock selected for stable promotion\n default: .buildchain/contract-lock.json\n type: string\n required: false\n buildchain-repository:\n default: kungfu-systems/buildchain\n type: string\n required: false\n buildchain-ref:\n description: Optional Buildchain runtime ref. Empty uses the workflow shell ref.\n default: \"\"\n type: string\n required: false\n buildchain-contract-lock-path:\n description: Consumer-owned Buildchain contract lock path\n default: \"\"\n type: string\n required: false\n buildchain-contract-compatibility-policy:\n description: \"Contract compatibility policy: major-compatible, allow-additive,\n or exact\"\n default: major-compatible\n type: string\n required: false\n buildchain-contract-drift-issue-mode:\n description: \"Consumer issue behavior for Buildchain floating-ref contract\n drift: off, breaking-only, or compatible-and-breaking\"\n default: compatible-and-breaking\n type: string\n required: false\n allow-repository:\n description: Repository allowed to promote. Empty defaults to the caller repository.\n default: \"\"\n type: string\n required: false\n channel:\n description: \"Promotion channel: alpha, release, or major. Empty derives from\n target-ref.\"\n default: \"\"\n type: string\n required: false\n target-ref:\n description: Channel ref to promote. Defaults to the current ref name.\n default: \"\"\n type: string\n required: false\n target-sha:\n description: Channel commit SHA to promote. Defaults to the current workflow SHA.\n default: \"\"\n type: string\n required: false\n package-manager:\n description: \"Package manager recorded for audit: npm, pnpm, yarn, or custom\"\n default: npm\n type: string\n required: false\n artifact-name:\n description: Base artifact name used by the PR-stage reusable build\n default: buildchain-artifact\n type: string\n required: false\n release-candidate-workflow-file:\n description: PR-stage release-candidate workflow file name\n default: build.yml\n type: string\n required: false\n release-candidate-workflow-name:\n description: PR-stage release-candidate workflow display name\n default: Build\n type: string\n required: false\n release-candidate-wait-seconds:\n description: Bounded wait for the complete PR-stage release-candidate workflow,\n including post-required-check evidence tails\n default: 10800\n type: number\n required: false\n resume-candidate-repository:\n description: Repository that owns the sealed candidate run; empty selects normal\n candidate discovery\n default: \"\"\n type: string\n required: false\n resume-candidate-run-id:\n description: Exact successful candidate workflow run ID to recover through this\n fresh workflow event\n default: \"\"\n type: string\n required: false\n resume-expected-workflow-file:\n description: Exact trusted Build workflow file that produced the candidate\n default: \"\"\n type: string\n required: false\n resume-expected-workflow-name:\n description: Exact trusted Build workflow display name that produced the candidate\n default: \"\"\n type: string\n required: false\n resume-expected-source-tree:\n description: Optional exact candidate Git tree; required when expected candidate\n root is empty\n default: \"\"\n type: string\n required: false\n resume-expected-candidate-root:\n description: Optional exact sha256 Release Candidate root; required when\n expected source tree is empty\n default: \"\"\n type: string\n required: false\n resume-expected-candidate-runtime-sha:\n description: Exact Buildchain runtime SHA recorded by the original candidate\n default: \"\"\n type: string\n required: false\n resume-buildchain-runtime-sha:\n description: Exact current Buildchain tooling SHA authorized to perform recovery\n default: \"\"\n type: string\n required: false\n resume-transaction-id:\n description: Optional exact durable publication transaction identity to resume\n default: \"\"\n type: string\n required: false\n release-candidate-family-evidence-required:\n description: Require exact Initiative-family evidence before protected promotion\n default: false\n type: boolean\n required: false\n release-candidate-family-evidence-root:\n description: Optional expected Initiative-family evidence content root\n default: \"\"\n type: string\n required: false\n release-candidate-family-initiative-id:\n description: Optional expected Initiative identity\n default: \"\"\n type: string\n required: false\n release-candidate-family-assignment-id:\n description: Optional expected child Assignment identity\n default: \"\"\n type: string\n required: false\n artifact-patterns:\n description: Newline-separated payload artifact patterns expected from the RC bundle\n default: \"\"\n type: string\n required: false\n required-status-check:\n description: Exact required protected-branch status check context\n default: check / check\n type: string\n required: false\n branch-protection-bypass-apps:\n description: GitHub App slugs allowed to bypass pull-request review for\n Buildchain-managed generated channel ref updates\n default: github-actions\n type: string\n required: false\n branch-protection-bypass-users:\n description: Reserved compatibility input; managed channel protection rejects\n user bypass actors\n default: \"\"\n type: string\n required: false\n branch-protection-bypass-teams:\n description: Reserved compatibility input; managed channel protection rejects\n team bypass actors\n default: \"\"\n type: string\n required: false\n publish-target:\n description: \"Publish target recorded for audit: npm, github-release, custom\"\n default: npm\n type: string\n required: false\n github-release:\n description: Create/update the public GitHub Release and upload Buildchain\n release passport/evidence assets after a complete release transaction\n default: true\n type: boolean\n required: false\n declarative-release-tail:\n description: Publish and read back GitHub Release assets through the Buildchain\n declarative release-tail provider plane\n default: false\n type: boolean\n required: false\n github-release-title:\n description: Optional GitHub Release title. Empty defaults to the public release\n tag.\n default: \"\"\n type: string\n required: false\n github-release-notes:\n description: Optional GitHub Release notes. Empty uses a Buildchain\n release-passport asset note.\n default: \"\"\n type: string\n required: false\n github-release-payload-patterns:\n description: Newline-separated basename patterns selecting PR-stage payload\n files for the immutable public GitHub Release\n default: \"\"\n type: string\n required: false\n publication-commit-command:\n description: Optional consumer command that commits the well-known publication\n authority after every artifact, passport, and public read-back\n prerequisite succeeds\n default: \"\"\n type: string\n required: false\n publication-commit-evidence-path:\n description: Consumer evidence JSON written by publication-commit-command under\n .buildchain/\n default: .buildchain/publication-commit/evidence.json\n type: string\n required: false\n release-activation-command:\n description: Optional consumer command that completes exact site\n publication/readback and writes the authoritative activation receipt\n set\n default: \"\"\n type: string\n required: false\n release-activation-receipt-set-path:\n description: Consumer activation receipt set written under .buildchain/\n default: .buildchain/release-activation/receipt-set.json\n type: string\n required: false\n release-passport-evidence-command:\n description: Optional consumer command that synthesizes released evidence only\n from the validated activation receipt set\n default: \"\"\n type: string\n required: false\n release-passport-evidence-path:\n description: Released evidence JSON written by release-passport-evidence-command\n under .buildchain/\n default: .buildchain/release-evidence/product-released-evidence.json\n type: string\n required: false\n standalone-binary-distribution:\n description: Dispatch binary-distribution.yml after promotion; enable only when\n the caller repository provides that workflow\n default: false\n type: boolean\n required: false\n runner-preset:\n description: Runner preset recorded for audit\n default: github-hosted\n type: string\n required: false\n trusted-publishing:\n description: Whether the publish target uses GitHub OIDC trusted publishing\n default: true\n type: boolean\n required: false\n publish-command:\n description: Optional publish command. Defaults to lifecycle.publish from\n buildchain.toml.\n default: \"\"\n type: string\n required: false\n publish-rematerialize-on-resume:\n description: Replay the consumer publish materialization step after valid\n durable evidence is restored; use only when the command is idempotent\n and recreates ephemeral Passport inputs or release assets\n default: false\n type: boolean\n required: false\n publish-transaction-override:\n description: Explicitly allow ancestry-bound finalization recovery for an\n already published durable transaction\n default: false\n type: boolean\n required: false\n publish-required-artifacts-json:\n description: Required publish artifacts JSON passed to the promotion action;\n ref_template may contain one {version} placeholder\n default: \"\"\n type: string\n required: false\n publish-artifact-kind:\n description: Artifact kind used when generating publish-required-artifacts-json\n from downloaded payloads\n default: npm\n type: string\n required: false\n publish-mode:\n description: Publish mode passed to promote-buildchain-ref\n default: \"\"\n type: string\n required: false\n publish-dist-tag:\n description: Expected dist-tag passed to promote-buildchain-ref\n default: \"\"\n type: string\n required: false\n publish-package-set-order:\n description: Package-set ordering passed to promote-buildchain-ref\n default: as-provided\n type: string\n required: false\n publish-package-main:\n description: Main package name for package-set ordering\n default: \"\"\n type: string\n required: false\n release-passport:\n description: Generate and persist the release passport after publish finalization\n default: true\n type: boolean\n required: false\n release-propagation-config-path:\n description: Optional source-controlled package propagation capture config read\n from the exact finalized release SHA\n default: \"\"\n type: string\n required: false\n release-passport-output-dir:\n description: Release passport output directory\n default: .buildchain/release-passport\n type: string\n required: false\n release-passport-product-name:\n description: Product name recorded in buildchain.release.json\n default: \"\"\n type: string\n required: false\n release-passport-impact-json:\n description: Surface-aware release impact JSON or path passed to the release\n passport collector\n default: \"\"\n type: string\n required: false\n release-passport-kfd-1-witness-jsons:\n description: Newline- or comma-separated KFD-1 contract-world witness JSON paths\n passed to the release passport collector\n default: \"\"\n type: string\n required: false\n release-passport-kfd-2-claim-jsons:\n description: Newline- or comma-separated KFD-2 public release trust claim JSON\n paths passed to the release passport collector\n default: \"\"\n type: string\n required: false\n release-passport-kfd-3-prebuild-witness-jsons:\n description: Newline- or comma-separated KFD-3 collaboration-interface pre-build\n witness JSON paths passed to the release passport collector\n default: \"\"\n type: string\n required: false\n release-passport-kfd-3-artifact-witness-jsons:\n description: Newline- or comma-separated KFD-3 artifact-side\n collaboration-interface witness JSON paths passed to the release\n passport collector\n default: \"\"\n type: string\n required: false\n release-passport-kfd-3-artifact-verify-command:\n description: Product-owned command that emits KFD-3 artifact-side\n collaboration-interface witness JSON\n default: \"\"\n type: string\n release-passport-kfd-adopter-manifest-json:\n description: Standard full-cut adopter conformance manifest JSON path\n default: \"\"\n type: string\n required: false\n release-passport-kfd-support-matrix-json:\n description: Legacy KFD support projection JSON path accepted only for exact\n manifest comparison\n default: \"\"\n type: string\n required: false\n release-passport-kfd-product-gate-jsons:\n description: Newline- or comma-separated KFD-4/5/7 product gate result JSON paths\n default: \"\"\n type: string\n required: false\n release-passport-invariant-passport-jsons:\n description: Newline- or comma-separated invariant Passport JSON paths passed to\n the release gate\n default: \"\"\n type: string\n required: false\n release-passport-invariant-passport-command:\n description: Product-owned command that emits a canonical invariant Passport\n JSON document\n default: \"\"\n type: string\n required: false\n release-passport-evidence-jsons:\n description: Newline- or comma-separated product-owned release evidence\n attachment paths bound to the exact release coordinates\n default: \"\"\n type: string\n required: false\n release-passport-attachment-command:\n description: Product-owned command that emits generated release evidence\n attachment paths as JSON\n default: \"\"\n type: string\n required: false\n release-passport-buildchain-self-kfd:\n description: Generate Buildchain-owned KFD-1/2/3 self witnesses and claims from\n the checked-out package source before release passport finalization\n default: false\n type: boolean\n required: false\n github-artifact-attestation-policy-json:\n description: One GitHub artifact attestation policy JSON path from the sealed\n release candidate; empty disables attestation\n default: \"\"\n type: string\n required: false\n github-artifact-attestation-environment:\n description: Caller-repository protected environment governing the keyless\n attestation\n default: buildchain-artifact-attestation\n type: string\n required: false\n github-artifact-attestation-retention-days:\n description: Retention for offline GitHub/Sigstore evidence artifacts\n default: 90\n type: number\n required: false\n release-passport-platform-manifest-paths:\n description: Optional platform manifest paths for release passport; defaults to\n downloaded PR-stage payload manifests\n default: \"\"\n type: string\n required: false\n required-artifact-count:\n description: Minimum downloaded payload count required before publish; npm\n counts package tarballs\n default: 3\n type: number\n required: false\n publication-admission-json:\n description: Fresh sealed publication admission JSON; required for non-dry-run\n publication\n default: \"\"\n type: string\n required: false\n publication-runner-provenance-json:\n description: Runner provenance receipt bound by the admission\n default: \"\"\n type: string\n required: false\n publication-control-plane-audit-json:\n description: Fresh external control-plane audit receipt bound by the admission\n default: \"\"\n type: string\n required: false\n github-governance-receipt-json:\n description: Fresh qualifying governance receipt for the exact publication\n repository and target ref\n default: \"\"\n type: string\n required: false\n publication-gate-aggregate-json:\n description: Qualifying Shifu Gate aggregate or explicit consumer-owned no-Gate\n decision\n default: \"\"\n type: string\n required: false\n publication-gate-command:\n description: Consumer-owned read-only command that assembles a qualifying Gate\n aggregate from the exact downloaded release-candidate evidence\n default: \"\"\n type: string\n required: false\n publication-gate-controller-sha:\n description: Exact caller-repository commit that owns the consumer Gate command;\n empty uses the publication source SHA\n default: \"\"\n type: string\n required: false\n publication-expected-json:\n description: Independent exact source/runtime/product/channel/artifact bindings\n default: \"\"\n type: string\n required: false\n publication-used-nonces-json:\n description: JSON array of already consumed admission nonces\n default: \"[]\"\n type: string\n required: false\n publication-consumer-qualification-command:\n description: Opt-in consumer-owned predicate command; writes its decision to\n BUILDCHAIN_PUBLICATION_QUALIFICATION_RESULT_PATH\n default: \"\"\n type: string\n required: false\n publication-consumer-qualification-controller-sha:\n description: Exact caller-repository commit that owns the consumer qualification\n command; empty uses the Gate controller SHA, then the publication\n source SHA\n default: \"\"\n type: string\n required: false\n publication-consumer-predicate-id:\n description: Stable identifier for the opt-in consumer-owned publication predicate\n default: \"\"\n type: string\n required: false\n publication-used-qualification-nonces-json:\n description: JSON array of already consumed qualification nonces\n default: \"[]\"\n type: string\n required: false\n publication-auto-admission:\n description: Assemble sealed evidence from the caller repository's exact managed\n release candidate\n default: false\n type: boolean\n required: false\n publication-auto-no-gate:\n description: Explicitly declare that this managed publication has no\n consumer-owned Shifu Gate registry\n default: false\n type: boolean\n required: false\n publication-publisher-workflow-path:\n description: Caller workflow path bound by the provider trusted-publisher policy\n default: \"\"\n type: string\n required: false\n publication-product:\n default: Buildchain\n type: string\n required: false\n publication-target:\n default: npm:@kungfu-tech/buildchain\n type: string\n required: false\n publication-package-name:\n default: \"@kungfu-tech/buildchain\"\n type: string\n required: false\n dry-run:\n description: Plan only; do not publish or move refs\n default: false\n type: boolean\n required: false\n request-json:\n description: JSON object matching contracts/promotion-request-v1.schema.json.\n The API validates types, defaults and authority before dispatch.\n required: false\n type: string\n default: \"\"\n runtime-ref:\n description: Transient execution runtime; empty selects the consumer lock.\n type: string\n required: false\n default: \"\"\n contract-lock:\n description: Optional consumer runtime lock path.\n type: string\n required: false\n default: \"\"\n runtime-selection:\n description: Entry-resolved runtime transport for nested workflow jobs.\n type: string\n required: false\n default: \"\"\n secrets:\n BUILDCHAIN_PROMOTION_TOKEN:\n description: Optional bypass-capable token used only for generated protected ref\n updates\n required: false\n BUILDCHAIN_PUBLICATION_COMMIT_TOKEN:\n description: Optional consumer-owned credential exposed only to the final\n publication commit command\n required: false\n BUILDCHAIN_PUBLICATION_COMMIT_SIGNING_KEY:\n description: Optional consumer-owned private signing material exposed only to\n the final publication commit command\n required: false\n KUNGFU_GOVERNANCE_AUDITOR_APP_PRIVATE_KEY:\n description: Private key for the dedicated read-only GitHub governance auditor App\n required: false\n buildchain-issue-token:\n description: Optional token with issues:write on the Buildchain repository for\n workflow-friction reports\n required: false\n BUILDCHAIN_ISSUE_TOKEN:\n description: Optional token with issues:write on the Buildchain repository for\n workflow-friction reports\n required: false\n buildchain-issue-app-id:\n description: Optional GitHub App ID used to mint a Buildchain issue-report token\n required: false\n BUILDCHAIN_ISSUE_APP_ID:\n description: Optional GitHub App ID used to mint a Buildchain issue-report token\n required: false\n buildchain-issue-app-private-key:\n description: Optional GitHub App private key used to mint a Buildchain\n issue-report token\n required: false\n BUILDCHAIN_ISSUE_APP_PRIVATE_KEY:\n description: Optional GitHub App private key used to mint a Buildchain\n issue-report token\n required: false\n outputs:\n buildchain-channel:\n description: Admitted channel.\n value: ${{ jobs.resolve-promotion.outputs.channel }}\n promotion-router-ref:\n description: Admitted router-ref.\n value: ${{ jobs.resolve-promotion.outputs.router-ref }}\n promotion-router-sha:\n description: Admitted router-sha.\n value: ${{ jobs.resolve-promotion.outputs.router-sha }}\n promotion-shell-ref:\n description: Admitted shell-ref.\n value: ${{ jobs.resolve-promotion.outputs.shell-ref }}\n promotion-shell-sha:\n description: Admitted shell-sha.\n value: ${{ jobs.resolve-promotion.outputs.shell-sha }}\n promotion-runtime-ref:\n description: Admitted runtime-ref.\n value: ${{ jobs.resolve-promotion.outputs.runtime-ref }}\n promotion-runtime-sha:\n description: Admitted runtime-sha.\n value: ${{ jobs.resolve-promotion.outputs.runtime-sha }}\n promotion-contract-lock-path:\n description: Admitted contract-lock-path.\n value: ${{ jobs.resolve-promotion.outputs.contract-lock-path }}\n promotion-contract-lock-digest:\n description: Admitted contract-lock-digest.\n value: ${{ jobs.resolve-promotion.outputs.contract-lock-digest }}\n promotion-publication-channel:\n description: Admitted publication-channel.\n value: ${{ jobs.resolve-promotion.outputs.publication-channel }}\n promotion-target-ref:\n description: Admitted target-ref.\n value: ${{ jobs.resolve-promotion.outputs.target-ref }}\n promotion-override-used:\n description: Admitted override-used.\n value: ${{ jobs.resolve-promotion.outputs.override-used }}\n promoted-sha:\n description: Promoted channel SHA\n value: ${{ jobs.invoke.outputs.promoted-sha }}\n built-source-sha:\n description: PR-stage built source SHA\n value: ${{ jobs.invoke.outputs.built-source-sha }}\n release-candidate-artifact:\n description: Resolved release-candidate artifact name\n value: ${{ jobs.invoke.outputs.release-candidate-artifact }}\n release-candidate-action:\n description: \"Candidate admission action: discovered or reused\"\n value: ${{ jobs.invoke.outputs.release-candidate-action }}\n release-candidate-recovery-root:\n description: Exact sha256 recovery receipt root\n value: ${{ jobs.invoke.outputs.release-candidate-recovery-root }}\n release-candidate-recovery-receipt-artifact:\n description: Immutable recovery receipt Actions artifact name\n value: ${{ jobs.invoke.outputs.release-candidate-recovery-receipt-artifact }}\n release-propagation-work-artifact:\n description: Captured package release propagation Work artifact\n value: ${{ jobs.invoke.outputs.release-propagation-work-artifact }}\n publication-commit-evidence-path:\n description: Validated consumer publication commit evidence path\n value: ${{ jobs.invoke.outputs.publication-commit-evidence-path }}\n publication-commit-evidence-digest:\n description: sha256 digest of validated consumer publication commit evidence\n value: ${{ jobs.invoke.outputs.publication-commit-evidence-digest }}\n publication-commit-url:\n description: Canonical public authority URL validated after the final commit\n value: ${{ jobs.invoke.outputs.publication-commit-url }}\n publication-commit-payload-root:\n description: Exact public authority payload root validated after the final commit\n value: ${{ jobs.invoke.outputs.publication-commit-payload-root }}\n controller-plan-artifact:\n description: Controller plan artifact name\n value: ${{ jobs.invoke.outputs.controller-plan-artifact }}\n controller-plan-json:\n description: Compact controller plan JSON\n value: ${{ jobs.invoke.outputs.controller-plan-json }}\n controller-plan-digest:\n description: Controller plan digest\n value: ${{ jobs.invoke.outputs.controller-plan-digest }}\n publication-capability-digest:\n description: Sealed publication capability receipt digest\n value: ${{ jobs.invoke.outputs.publication-capability-digest }}\n github-artifact-attestation-id:\n description: GitHub keyless attestation id for the declared Linux release artifact\n value: ${{ jobs.invoke.outputs.github-artifact-attestation-id }}\n github-artifact-attestation-url:\n description: GitHub keyless attestation URL\n value: ${{ jobs.invoke.outputs.github-artifact-attestation-url }}\n github-artifact-attestation-evidence-root:\n description: Verified Buildchain attestation evidence root published with the\n GitHub Release\n value: ${{ jobs.invoke.outputs.github-artifact-attestation-evidence-root }}\n github-artifact-attestation-publication-receipt-digest:\n description: Read-back verified GitHub Release evidence publication receipt digest\n value: ${{\n jobs.invoke.outputs.github-artifact-attestation-publication-receipt-digest\n }}\n release-tail-declaration-root:\n description: Root of the declarative release-tail contract\n value: ${{ jobs.invoke.outputs.release-tail-declaration-root }}\n release-tail-transaction-state:\n description: Final declarative release-tail transaction state\n value: ${{ jobs.invoke.outputs.release-tail-transaction-state }}\n release-tail-transaction-root:\n description: Stable declarative release-tail transaction root\n value: ${{ jobs.invoke.outputs.release-tail-transaction-root }}\n release-tail-state-root:\n description: Root of the final declarative release-tail transaction state\n value: ${{ jobs.invoke.outputs.release-tail-state-root }}\n release-tail-receipt-roots-json:\n description: JSON array of standardized declarative release-tail receipt roots\n value: ${{ jobs.invoke.outputs.release-tail-receipt-roots-json }}\n controller-receipt-artifact:\n description: Controller receipt artifact name\n value: ${{ jobs.invoke.outputs.controller-receipt-artifact }}\n controller-receipt-json:\n description: Compact controller receipt JSON\n value: ${{ jobs.invoke.outputs.controller-receipt-json }}\n controller-receipt-digest:\n description: Controller receipt digest\n value: ${{ jobs.invoke.outputs.controller-receipt-digest }}\n controller-receipt-status:\n description: Controller receipt status\n value: ${{ jobs.invoke.outputs.controller-receipt-status }}\n discussion-id:\n description: Release transaction discussion-id.\n value: ${{ jobs.invoke.outputs.discussion-id }}\n discussion-url:\n description: Release transaction discussion-url.\n value: ${{ jobs.invoke.outputs.discussion-url }}\n release-invocation-root:\n description: Canonical post-admission ReleaseInvocation root\n value: ${{ jobs.invoke.outputs.release-invocation-root }}\n release-transaction-root:\n description: Canonical three-phase ReleaseTransaction root\n value: ${{ jobs.invoke.outputs.release-transaction-root }}\n release-receipt-root:\n description: Single terminal ReleaseReceipt root\n value: ${{ jobs.invoke.outputs.release-receipt-root }}\n", "inheritCallerPermissions": true }, { "path": ".github/workflows/.release-historical.yml", "target": ".github/workflows/.release-promote.yml", "adapter": "promotion-backbone", "support": true, "interface": { "workflow_call": { "inputs": { "request-json": { "description": "Complete normalized buildchain.promotion-invocation/v1 produced by the public promotion API.", "type": "string", "required": true }, "runtime-ref": { "description": "Transient execution runtime; empty selects the consumer lock.", "type": "string", "required": false, "default": "" }, "contract-lock": { "description": "Optional consumer runtime lock path.", "type": "string", "required": false, "default": "" }, "runtime-selection": { "description": "Entry-resolved runtime transport for nested workflow jobs.", "type": "string", "required": false, "default": "" } }, "secrets": { "BUILDCHAIN_PROMOTION_TOKEN": { "description": "Optional bypass-capable token used only for generated protected ref updates", "required": false }, "BUILDCHAIN_PUBLICATION_COMMIT_TOKEN": { "description": "Optional consumer-owned credential exposed only to the final publication commit command", "required": false }, "BUILDCHAIN_PUBLICATION_COMMIT_SIGNING_KEY": { "description": "Optional consumer-owned private signing material exposed only to the final publication commit command", "required": false }, "KUNGFU_GOVERNANCE_AUDITOR_APP_PRIVATE_KEY": { "description": "Private key for the dedicated read-only GitHub governance auditor App", "required": false }, "buildchain-issue-token": { "description": "Optional token with issues:write on the Buildchain repository for workflow-friction reports", "required": false }, "BUILDCHAIN_ISSUE_TOKEN": { "description": "Optional token with issues:write on the Buildchain repository for workflow-friction reports", "required": false }, "buildchain-issue-app-id": { "description": "Optional GitHub App ID used to mint a Buildchain issue-report token", "required": false }, "BUILDCHAIN_ISSUE_APP_ID": { "description": "Optional GitHub App ID used to mint a Buildchain issue-report token", "required": false }, "buildchain-issue-app-private-key": { "description": "Optional GitHub App private key used to mint a Buildchain issue-report token", "required": false }, "BUILDCHAIN_ISSUE_APP_PRIVATE_KEY": { "description": "Optional GitHub App private key used to mint a Buildchain issue-report token", "required": false } }, "outputs": { "discussion-id": { "description": "Release transaction discussion-id.", "value": "${{ jobs.apply.outputs.discussion-id }}" }, "discussion-url": { "description": "Release transaction discussion-url.", "value": "${{ jobs.apply.outputs.discussion-url }}" }, "promoted-sha": { "description": "Promoted channel SHA", "value": "${{ jobs.apply.outputs.promoted-sha || jobs.qualify.outputs.current-sha }}" }, "built-source-sha": { "description": "PR-stage built source SHA", "value": "${{ jobs.apply.outputs.built-source-sha }}" }, "release-candidate-artifact": { "description": "Resolved release-candidate artifact name", "value": "${{ jobs.apply.outputs.release-candidate-artifact }}" }, "release-candidate-action": { "description": "Candidate admission action: discovered or reused", "value": "${{ jobs.apply.outputs.release-candidate-action }}" }, "release-candidate-recovery-root": { "description": "Exact sha256 recovery receipt root", "value": "${{ jobs.apply.outputs.release-invocation-root }}" }, "release-candidate-recovery-receipt-artifact": { "description": "Immutable recovery receipt Actions artifact name", "value": "${{ '' }}" }, "release-propagation-work-artifact": { "description": "Captured package release propagation Work artifact", "value": "${{ '' }}" }, "publication-commit-evidence-path": { "description": "Validated consumer publication commit evidence path", "value": "${{ '' }}" }, "publication-commit-evidence-digest": { "description": "sha256 digest of validated consumer publication commit evidence", "value": "${{ '' }}" }, "publication-commit-url": { "description": "Canonical public authority URL validated after the final commit", "value": "${{ '' }}" }, "publication-commit-payload-root": { "description": "Exact public authority payload root validated after the final commit", "value": "${{ '' }}" }, "controller-plan-artifact": { "description": "Controller plan artifact name", "value": "${{ '' }}" }, "controller-plan-json": { "description": "Compact controller plan JSON", "value": "${{ '' }}" }, "controller-plan-digest": { "description": "Controller plan digest", "value": "${{ jobs.apply.outputs.release-invocation-root }}" }, "publication-capability-digest": { "description": "Sealed publication capability receipt digest", "value": "${{ jobs.apply.outputs.release-invocation-root }}" }, "github-artifact-attestation-id": { "description": "GitHub keyless attestation id for the declared Linux release artifact", "value": "${{ '' }}" }, "github-artifact-attestation-url": { "description": "GitHub keyless attestation URL", "value": "${{ '' }}" }, "github-artifact-attestation-evidence-root": { "description": "Verified Buildchain attestation evidence root published with the GitHub Release", "value": "${{ '' }}" }, "github-artifact-attestation-publication-receipt-digest": { "description": "Read-back verified GitHub Release evidence publication receipt digest", "value": "${{ '' }}" }, "release-tail-declaration-root": { "description": "Root of the declarative release-tail contract", "value": "${{ jobs.apply.outputs.release-tail-declaration-root }}" }, "release-tail-transaction-state": { "description": "Final declarative release-tail transaction state", "value": "${{ jobs.apply.outputs.release-tail-transaction-state }}" }, "release-tail-transaction-root": { "description": "Stable declarative release-tail transaction root", "value": "${{ jobs.apply.outputs.release-tail-transaction-root }}" }, "release-tail-state-root": { "description": "Root of the final declarative release-tail transaction state", "value": "${{ jobs.apply.outputs.release-tail-state-root }}" }, "release-tail-receipt-roots-json": { "description": "JSON array of standardized declarative release-tail receipt roots", "value": "${{ jobs.apply.outputs.release-tail-receipt-roots-json }}" }, "release-invocation-root": { "description": "Canonical post-admission ReleaseInvocation root", "value": "${{ jobs.apply.outputs.release-invocation-root }}" }, "release-transaction-root": { "description": "Canonical three-phase ReleaseTransaction root", "value": "${{ jobs.apply.outputs.release-transaction-root }}" }, "release-receipt-root": { "description": "Single terminal ReleaseReceipt root", "value": "${{ jobs.apply.outputs.release-receipt-root }}" }, "controller-receipt-artifact": { "description": "Controller receipt artifact name", "value": "${{ jobs.settle.outputs.controller-receipt-artifact }}" }, "controller-receipt-json": { "description": "Compact controller receipt JSON", "value": "${{ jobs.settle.outputs.controller-receipt-json }}" }, "controller-receipt-digest": { "description": "Controller receipt digest", "value": "${{ jobs.settle.outputs.controller-receipt-digest }}" }, "controller-receipt-status": { "description": "Controller receipt status", "value": "${{ jobs.settle.outputs.controller-receipt-status }}" } } } }, "interfaceSource": "on:\n workflow_call:\n inputs:\n request-json:\n description: Complete normalized buildchain.promotion-invocation/v1 produced by\n the public promotion API.\n type: string\n required: true\n runtime-ref:\n description: Transient execution runtime; empty selects the consumer lock.\n type: string\n required: false\n default: \"\"\n contract-lock:\n description: Optional consumer runtime lock path.\n type: string\n required: false\n default: \"\"\n runtime-selection:\n description: Entry-resolved runtime transport for nested workflow jobs.\n type: string\n required: false\n default: \"\"\n secrets:\n BUILDCHAIN_PROMOTION_TOKEN:\n description: Optional bypass-capable token used only for generated protected ref\n updates\n required: false\n BUILDCHAIN_PUBLICATION_COMMIT_TOKEN:\n description: Optional consumer-owned credential exposed only to the final\n publication commit command\n required: false\n BUILDCHAIN_PUBLICATION_COMMIT_SIGNING_KEY:\n description: Optional consumer-owned private signing material exposed only to\n the final publication commit command\n required: false\n KUNGFU_GOVERNANCE_AUDITOR_APP_PRIVATE_KEY:\n description: Private key for the dedicated read-only GitHub governance auditor App\n required: false\n buildchain-issue-token:\n description: Optional token with issues:write on the Buildchain repository for\n workflow-friction reports\n required: false\n BUILDCHAIN_ISSUE_TOKEN:\n description: Optional token with issues:write on the Buildchain repository for\n workflow-friction reports\n required: false\n buildchain-issue-app-id:\n description: Optional GitHub App ID used to mint a Buildchain issue-report token\n required: false\n BUILDCHAIN_ISSUE_APP_ID:\n description: Optional GitHub App ID used to mint a Buildchain issue-report token\n required: false\n buildchain-issue-app-private-key:\n description: Optional GitHub App private key used to mint a Buildchain\n issue-report token\n required: false\n BUILDCHAIN_ISSUE_APP_PRIVATE_KEY:\n description: Optional GitHub App private key used to mint a Buildchain\n issue-report token\n required: false\n outputs:\n discussion-id:\n description: Release transaction discussion-id.\n value: ${{ jobs.apply.outputs.discussion-id }}\n discussion-url:\n description: Release transaction discussion-url.\n value: ${{ jobs.apply.outputs.discussion-url }}\n promoted-sha:\n description: Promoted channel SHA\n value: ${{ jobs.apply.outputs.promoted-sha || jobs.qualify.outputs.current-sha\n }}\n built-source-sha:\n description: PR-stage built source SHA\n value: ${{ jobs.apply.outputs.built-source-sha }}\n release-candidate-artifact:\n description: Resolved release-candidate artifact name\n value: ${{ jobs.apply.outputs.release-candidate-artifact }}\n release-candidate-action:\n description: \"Candidate admission action: discovered or reused\"\n value: ${{ jobs.apply.outputs.release-candidate-action }}\n release-candidate-recovery-root:\n description: Exact sha256 recovery receipt root\n value: ${{ jobs.apply.outputs.release-invocation-root }}\n release-candidate-recovery-receipt-artifact:\n description: Immutable recovery receipt Actions artifact name\n value: ${{ '' }}\n release-propagation-work-artifact:\n description: Captured package release propagation Work artifact\n value: ${{ '' }}\n publication-commit-evidence-path:\n description: Validated consumer publication commit evidence path\n value: ${{ '' }}\n publication-commit-evidence-digest:\n description: sha256 digest of validated consumer publication commit evidence\n value: ${{ '' }}\n publication-commit-url:\n description: Canonical public authority URL validated after the final commit\n value: ${{ '' }}\n publication-commit-payload-root:\n description: Exact public authority payload root validated after the final commit\n value: ${{ '' }}\n controller-plan-artifact:\n description: Controller plan artifact name\n value: ${{ '' }}\n controller-plan-json:\n description: Compact controller plan JSON\n value: ${{ '' }}\n controller-plan-digest:\n description: Controller plan digest\n value: ${{ jobs.apply.outputs.release-invocation-root }}\n publication-capability-digest:\n description: Sealed publication capability receipt digest\n value: ${{ jobs.apply.outputs.release-invocation-root }}\n github-artifact-attestation-id:\n description: GitHub keyless attestation id for the declared Linux release artifact\n value: ${{ '' }}\n github-artifact-attestation-url:\n description: GitHub keyless attestation URL\n value: ${{ '' }}\n github-artifact-attestation-evidence-root:\n description: Verified Buildchain attestation evidence root published with the\n GitHub Release\n value: ${{ '' }}\n github-artifact-attestation-publication-receipt-digest:\n description: Read-back verified GitHub Release evidence publication receipt digest\n value: ${{ '' }}\n release-tail-declaration-root:\n description: Root of the declarative release-tail contract\n value: ${{ jobs.apply.outputs.release-tail-declaration-root }}\n release-tail-transaction-state:\n description: Final declarative release-tail transaction state\n value: ${{ jobs.apply.outputs.release-tail-transaction-state }}\n release-tail-transaction-root:\n description: Stable declarative release-tail transaction root\n value: ${{ jobs.apply.outputs.release-tail-transaction-root }}\n release-tail-state-root:\n description: Root of the final declarative release-tail transaction state\n value: ${{ jobs.apply.outputs.release-tail-state-root }}\n release-tail-receipt-roots-json:\n description: JSON array of standardized declarative release-tail receipt roots\n value: ${{ jobs.apply.outputs.release-tail-receipt-roots-json }}\n release-invocation-root:\n description: Canonical post-admission ReleaseInvocation root\n value: ${{ jobs.apply.outputs.release-invocation-root }}\n release-transaction-root:\n description: Canonical three-phase ReleaseTransaction root\n value: ${{ jobs.apply.outputs.release-transaction-root }}\n release-receipt-root:\n description: Single terminal ReleaseReceipt root\n value: ${{ jobs.apply.outputs.release-receipt-root }}\n controller-receipt-artifact:\n description: Controller receipt artifact name\n value: ${{ jobs.settle.outputs.controller-receipt-artifact }}\n controller-receipt-json:\n description: Compact controller receipt JSON\n value: ${{ jobs.settle.outputs.controller-receipt-json }}\n controller-receipt-digest:\n description: Controller receipt digest\n value: ${{ jobs.settle.outputs.controller-receipt-digest }}\n controller-receipt-status:\n description: Controller receipt status\n value: ${{ jobs.settle.outputs.controller-receipt-status }}\n", "permissions": null }, { "path": ".github/workflows/dev-pr-auto-merge.yml", "target": ".github/workflows/.ops-dev-auto-merge.yml", "adapter": "entry-v4.0", "source": { "ref": "v4.0.9", "sha": "c951b90a6dc6cffa8e62a75218194019ad47679f" }, "permissions": { "contents": "write", "pull-requests": "write", "checks": "read", "statuses": "write" }, "interface": { "workflow_call": { "inputs": { "native-platform": { "description": "Declared platform for independent native verification.", "type": "string", "required": false, "default": "linux-x64" }, "pipeline-attempt": { "description": "Internally selected business attempt when invoked by the normal pipeline.", "type": "string", "required": false, "default": "" }, "target-branch": { "description": "Protected dev branch to merge ready PRs into", "default": "", "type": "string", "required": false }, "expected-pr-number": { "description": "Optional exact PR number for targeted Agent admission; requires expected-head-sha", "default": 0, "type": "number", "required": false }, "expected-head-sha": { "description": "Exact 40-character PR head required for targeted Agent admission", "default": "", "type": "string", "required": false }, "source-workflow-run-id": { "description": "Exact successful source workflow run retained for immediate Warrant handoff", "default": 0, "type": "number", "required": false }, "handoff-workflow-id": { "description": "Optional consumer workflow file to dispatch when another candidate owns the active Warrant", "default": "", "type": "string", "required": false }, "diagnostic-context": { "description": "Commit-status context used for PR-visible targeted admission state", "default": "Buildchain delivery intent", "type": "string", "required": false }, "delivery-warrant-mode": { "description": "Delivery Warrant rollout: off, shadow (read-only queue plan), or required", "default": "off", "type": "string", "required": false }, "source-identity-root": { "description": "Immutable semantic source identity root", "default": "", "type": "string", "required": false }, "source-patch-root": { "description": "Immutable source patch or tree-intent root", "default": "", "type": "string", "required": false }, "project-cut-proof-json": { "description": "Optional exact rooted Project Cut replay proof required when GitHub reports the PR behind the current protected base", "default": "", "type": "string", "required": false }, "plan-root": { "description": "Exact qualification plan root", "default": "", "type": "string", "required": false }, "closure-root": { "description": "Exact affected-closure root", "default": "", "type": "string", "required": false }, "dependency-root": { "description": "Exact dependency-graph root", "default": "", "type": "string", "required": false }, "toolchain-root": { "description": "Exact qualification toolchain root", "default": "", "type": "string", "required": false }, "environment-root": { "description": "Exact native execution environment contract root; required for required native qualification", "default": "", "type": "string", "required": false }, "affected-paths-json": { "description": "JSON array of paths covered by source qualification", "default": "[]", "type": "string", "required": false }, "shard-evidence-roots-json": { "description": "JSON array of additional native-shard evidence roots", "default": "[]", "type": "string", "required": false }, "native-proof-json": { "description": "Optional reusable semantic native proof; base-only drift is classified before use", "default": "", "type": "string", "required": false }, "native-command": { "description": "Native qualification command run after provisional Warrant selection when proof reuse is unavailable", "default": "", "type": "string", "required": false }, "native-command-root": { "description": "Optional exact root of native-command; when supplied it must match before admission or spawn", "default": "", "type": "string", "required": false }, "release-blocker-priority-json": { "description": "Optional exact rooted release-blocker priority claim", "default": "", "type": "string", "required": false }, "native-heartbeat-seconds": { "description": "Heartbeat cadence while native qualification is running", "default": 300, "type": "number", "required": false }, "delivery-class": { "description": "Bounded delivery class", "default": "native-proof-required", "type": "string", "required": false }, "delivery-priority": { "description": "Reviewed priority: ordinary, expedited, or emergency", "default": "ordinary", "type": "string", "required": false }, "warrant-lease-seconds": { "description": "Delivery Warrant lease TTL", "default": 3600, "type": "number", "required": false }, "required-status-checks": { "description": "Comma or newline separated required status/check-run name fragments", "default": "check / check", "type": "string", "required": false }, "queue-admission-context": { "description": "Exact-head status written and read back before native queue admission; required in Warrant mode", "default": "", "type": "string", "required": false }, "active-lease-context": { "description": "Exact-head lease status written and read back as pending before enqueue; required in Warrant mode", "default": "", "type": "string", "required": false }, "ready-label": { "description": "Required label for PRs eligible to merge. Empty disables the label gate.", "default": "ready", "type": "string", "required": false }, "block-labels": { "description": "Comma or newline separated labels that block merging", "default": "blocked,do-not-merge,work-in-progress", "type": "string", "required": false }, "allowed-head-prefixes": { "description": "Comma or newline separated allowed source branch prefixes", "default": "feature/,fix/,chore/,docs/,ci/,refactor/", "type": "string", "required": false }, "require-approval": { "description": "Require at least one current approval and no latest changes-requested review", "default": true, "type": "boolean", "required": false }, "same-repository-only": { "description": "Reject fork/cross-repository PR heads by default", "default": true, "type": "boolean", "required": false }, "max-merges": { "description": "Maximum PRs to merge in one run", "default": 1, "type": "number", "required": false }, "merge-method": { "description": "GitHub merge method: merge, squash, or rebase", "default": "merge", "type": "string", "required": false }, "landing-mode": { "description": "Landing mode: auto selects native queue when enabled; queue fails closed without one", "default": "auto", "type": "string", "required": false }, "defer-landing": { "description": "Qualify the exact required Warrant and publish its evidence without landing the PR", "default": false, "type": "boolean", "required": false }, "dry-run": { "description": "Plan only; do not merge PRs", "default": true, "type": "boolean", "required": false }, "source-root": { "description": "Canonical Work source root required for Warrant submission.", "type": "string", "default": "", "required": false }, "runtime-ref": { "description": "Transient execution runtime; empty selects the consumer lock.", "type": "string", "required": false, "default": "" }, "contract-lock": { "description": "Optional consumer runtime lock path.", "type": "string", "required": false, "default": "" }, "runtime-selection": { "description": "Entry-resolved runtime transport for nested workflow jobs.", "type": "string", "required": false, "default": "" }, "universal-request-json": { "description": "Versioned exact-candidate request envelope; empty preserves the compatibility path", "default": "", "required": false, "type": "string" }, "buildchain-repository": { "description": "Buildchain runtime repository", "default": "kungfu-systems/buildchain", "type": "string", "required": false }, "buildchain-ref": { "description": "Explicit Buildchain v4 runtime ref; empty and v3 selectors are rejected.", "default": "v4", "type": "string", "required": false }, "source-workflow-id": { "description": "Optional consumer source workflow file used to recover a legacy active candidate's exact successful run", "default": "", "type": "string", "required": false }, "legacy-active-owner-binding-json": { "description": "Explicit legacy-safe handoff path carrying the exact phase-less queue root, fence, and generation", "default": "", "type": "string", "required": false }, "assignment-root": { "description": "Exact native Assignment content root", "default": "", "type": "string", "required": false }, "initiative-root": { "description": "Exact parent Initiative content root", "default": "", "type": "string", "required": false } }, "secrets": { "github-token": { "description": "Optional token for reading and merging PRs. Defaults to github.token.", "required": false } }, "outputs": { "evaluated-count": { "description": "Number of PRs evaluated", "value": "${{ jobs.merge-dev-prs.outputs.evaluated-count }}" }, "merged-count": { "description": "Number of PRs directly merged, or directly eligible in dry-run mode", "value": "${{ jobs.merge-dev-prs.outputs.merged-count }}" }, "enqueued-count": { "description": "Number of PRs admitted into the native merge queue", "value": "${{ jobs.merge-dev-prs.outputs.enqueued-count }}" }, "action-count": { "description": "Number of direct merges, queue admissions, or planned actions", "value": "${{ jobs.merge-dev-prs.outputs.action-count }}" }, "skipped-count": { "description": "Number of PRs skipped", "value": "${{ jobs.merge-dev-prs.outputs.skipped-count }}" }, "final-base-sha": { "description": "Final target branch SHA after the run", "value": "${{ jobs.merge-dev-prs.outputs.final-base-sha }}" }, "admission-state": { "description": "Typed targeted admission state; empty for cadence patrol", "value": "${{ jobs.merge-dev-prs.outputs.admission-state }}" }, "admission-receipt-root": { "description": "Content root of the targeted exact-head admission receipt", "value": "${{ jobs.merge-dev-prs.outputs.admission-receipt-root }}" }, "source-proof-root": { "description": "Content root of the reusable Source Qualification Proof", "value": "${{ jobs.merge-dev-prs.outputs.source-proof-root }}" }, "warrant-receipt-root": { "description": "Content root of the selected Delivery Warrant receipt", "value": "${{ jobs.merge-dev-prs.outputs.warrant-receipt-root }}" }, "warrant-state-root": { "description": "Exact readback root of the durable Warrant queue", "value": "${{ jobs.merge-dev-prs.outputs.warrant-state-root }}" }, "warrant-state-commit": { "description": "Immutable queue commit containing the active Warrant readback", "value": "${{ jobs.merge-dev-prs.outputs.warrant-state-commit }}" }, "project-cut-proof-root": { "description": "Verified exact Project Cut replay proof root, when supplied", "value": "${{ jobs.merge-dev-prs.outputs.project-cut-proof-root }}" }, "native-proof-root": { "description": "Fresh or reused semantic native proof root", "value": "${{ jobs.merge-dev-prs.outputs.native-proof-root }}" }, "native-reuse-decision-root": { "description": "Rooted fail-closed native proof reuse decision", "value": "${{ jobs.merge-dev-prs.outputs.native-reuse-decision-root }}" }, "qualified-warrant-receipt-root": { "description": "Atomic provisional-to-qualified Warrant receipt root", "value": "${{ jobs.merge-dev-prs.outputs.qualified-warrant-receipt-root }}" }, "native-execution-transfer-root": { "description": "Content root of the cross-job native proof and state transfer", "value": "${{ jobs.merge-dev-prs.outputs.native-execution-transfer-root }}" }, "provider-finalizer-boundary-root": { "description": "Live provider readback root proving pairwise-distinct hosted native, seal, and finalizer domains", "value": "${{ jobs.merge-dev-prs.outputs.provider-finalizer-boundary-root }}" }, "provider-heartbeat-receipt-root": { "description": "Rooted independent durable heartbeat continuity receipt", "value": "${{ jobs.merge-dev-prs.outputs.provider-heartbeat-receipt-root }}" } } } }, "interfaceSource": "on:\n workflow_call:\n inputs:\n native-platform:\n description: Declared platform for independent native verification.\n type: string\n required: false\n default: linux-x64\n pipeline-attempt:\n description: Internally selected business attempt when invoked by the normal\n pipeline.\n type: string\n required: false\n default: \"\"\n target-branch:\n description: Protected dev branch to merge ready PRs into\n default: \"\"\n type: string\n required: false\n expected-pr-number:\n description: Optional exact PR number for targeted Agent admission; requires\n expected-head-sha\n default: 0\n type: number\n required: false\n expected-head-sha:\n description: Exact 40-character PR head required for targeted Agent admission\n default: \"\"\n type: string\n required: false\n source-workflow-run-id:\n description: Exact successful source workflow run retained for immediate Warrant\n handoff\n default: 0\n type: number\n required: false\n handoff-workflow-id:\n description: Optional consumer workflow file to dispatch when another candidate\n owns the active Warrant\n default: \"\"\n type: string\n required: false\n diagnostic-context:\n description: Commit-status context used for PR-visible targeted admission state\n default: Buildchain delivery intent\n type: string\n required: false\n delivery-warrant-mode:\n description: \"Delivery Warrant rollout: off, shadow (read-only queue plan), or\n required\"\n default: off\n type: string\n required: false\n source-identity-root:\n description: Immutable semantic source identity root\n default: \"\"\n type: string\n required: false\n source-patch-root:\n description: Immutable source patch or tree-intent root\n default: \"\"\n type: string\n required: false\n project-cut-proof-json:\n description: Optional exact rooted Project Cut replay proof required when GitHub\n reports the PR behind the current protected base\n default: \"\"\n type: string\n required: false\n plan-root:\n description: Exact qualification plan root\n default: \"\"\n type: string\n required: false\n closure-root:\n description: Exact affected-closure root\n default: \"\"\n type: string\n required: false\n dependency-root:\n description: Exact dependency-graph root\n default: \"\"\n type: string\n required: false\n toolchain-root:\n description: Exact qualification toolchain root\n default: \"\"\n type: string\n required: false\n environment-root:\n description: Exact native execution environment contract root; required for\n required native qualification\n default: \"\"\n type: string\n required: false\n affected-paths-json:\n description: JSON array of paths covered by source qualification\n default: \"[]\"\n type: string\n required: false\n shard-evidence-roots-json:\n description: JSON array of additional native-shard evidence roots\n default: \"[]\"\n type: string\n required: false\n native-proof-json:\n description: Optional reusable semantic native proof; base-only drift is\n classified before use\n default: \"\"\n type: string\n required: false\n native-command:\n description: Native qualification command run after provisional Warrant\n selection when proof reuse is unavailable\n default: \"\"\n type: string\n required: false\n native-command-root:\n description: Optional exact root of native-command; when supplied it must match\n before admission or spawn\n default: \"\"\n type: string\n required: false\n release-blocker-priority-json:\n description: Optional exact rooted release-blocker priority claim\n default: \"\"\n type: string\n required: false\n native-heartbeat-seconds:\n description: Heartbeat cadence while native qualification is running\n default: 300\n type: number\n required: false\n delivery-class:\n description: Bounded delivery class\n default: native-proof-required\n type: string\n required: false\n delivery-priority:\n description: \"Reviewed priority: ordinary, expedited, or emergency\"\n default: ordinary\n type: string\n required: false\n warrant-lease-seconds:\n description: Delivery Warrant lease TTL\n default: 3600\n type: number\n required: false\n required-status-checks:\n description: Comma or newline separated required status/check-run name fragments\n default: check / check\n type: string\n required: false\n queue-admission-context:\n description: Exact-head status written and read back before native queue\n admission; required in Warrant mode\n default: \"\"\n type: string\n required: false\n active-lease-context:\n description: Exact-head lease status written and read back as pending before\n enqueue; required in Warrant mode\n default: \"\"\n type: string\n required: false\n ready-label:\n description: Required label for PRs eligible to merge. Empty disables the label\n gate.\n default: ready\n type: string\n required: false\n block-labels:\n description: Comma or newline separated labels that block merging\n default: blocked,do-not-merge,work-in-progress\n type: string\n required: false\n allowed-head-prefixes:\n description: Comma or newline separated allowed source branch prefixes\n default: feature/,fix/,chore/,docs/,ci/,refactor/\n type: string\n required: false\n require-approval:\n description: Require at least one current approval and no latest\n changes-requested review\n default: true\n type: boolean\n required: false\n same-repository-only:\n description: Reject fork/cross-repository PR heads by default\n default: true\n type: boolean\n required: false\n max-merges:\n description: Maximum PRs to merge in one run\n default: 1\n type: number\n required: false\n merge-method:\n description: \"GitHub merge method: merge, squash, or rebase\"\n default: merge\n type: string\n required: false\n landing-mode:\n description: \"Landing mode: auto selects native queue when enabled; queue fails\n closed without one\"\n default: auto\n type: string\n required: false\n defer-landing:\n description: Qualify the exact required Warrant and publish its evidence without\n landing the PR\n default: false\n type: boolean\n required: false\n dry-run:\n description: Plan only; do not merge PRs\n default: true\n type: boolean\n required: false\n source-root:\n description: Canonical Work source root required for Warrant submission.\n type: string\n default: \"\"\n required: false\n runtime-ref:\n description: Transient execution runtime; empty selects the consumer lock.\n type: string\n required: false\n default: \"\"\n contract-lock:\n description: Optional consumer runtime lock path.\n type: string\n required: false\n default: \"\"\n runtime-selection:\n description: Entry-resolved runtime transport for nested workflow jobs.\n type: string\n required: false\n default: \"\"\n universal-request-json:\n description: Versioned exact-candidate request envelope; empty preserves the\n compatibility path\n default: \"\"\n required: false\n type: string\n buildchain-repository:\n description: Buildchain runtime repository\n default: kungfu-systems/buildchain\n type: string\n required: false\n buildchain-ref:\n description: Explicit Buildchain v4 runtime ref; empty and v3 selectors are\n rejected.\n default: v4\n type: string\n required: false\n source-workflow-id:\n description: Optional consumer source workflow file used to recover a legacy\n active candidate's exact successful run\n default: \"\"\n type: string\n required: false\n legacy-active-owner-binding-json:\n description: Explicit legacy-safe handoff path carrying the exact phase-less\n queue root, fence, and generation\n default: \"\"\n type: string\n required: false\n assignment-root:\n description: Exact native Assignment content root\n default: \"\"\n type: string\n required: false\n initiative-root:\n description: Exact parent Initiative content root\n default: \"\"\n type: string\n required: false\n secrets:\n github-token:\n description: Optional token for reading and merging PRs. Defaults to github.token.\n required: false\n outputs:\n evaluated-count:\n description: Number of PRs evaluated\n value: ${{ jobs.merge-dev-prs.outputs.evaluated-count }}\n merged-count:\n description: Number of PRs directly merged, or directly eligible in dry-run mode\n value: ${{ jobs.merge-dev-prs.outputs.merged-count }}\n enqueued-count:\n description: Number of PRs admitted into the native merge queue\n value: ${{ jobs.merge-dev-prs.outputs.enqueued-count }}\n action-count:\n description: Number of direct merges, queue admissions, or planned actions\n value: ${{ jobs.merge-dev-prs.outputs.action-count }}\n skipped-count:\n description: Number of PRs skipped\n value: ${{ jobs.merge-dev-prs.outputs.skipped-count }}\n final-base-sha:\n description: Final target branch SHA after the run\n value: ${{ jobs.merge-dev-prs.outputs.final-base-sha }}\n admission-state:\n description: Typed targeted admission state; empty for cadence patrol\n value: ${{ jobs.merge-dev-prs.outputs.admission-state }}\n admission-receipt-root:\n description: Content root of the targeted exact-head admission receipt\n value: ${{ jobs.merge-dev-prs.outputs.admission-receipt-root }}\n source-proof-root:\n description: Content root of the reusable Source Qualification Proof\n value: ${{ jobs.merge-dev-prs.outputs.source-proof-root }}\n warrant-receipt-root:\n description: Content root of the selected Delivery Warrant receipt\n value: ${{ jobs.merge-dev-prs.outputs.warrant-receipt-root }}\n warrant-state-root:\n description: Exact readback root of the durable Warrant queue\n value: ${{ jobs.merge-dev-prs.outputs.warrant-state-root }}\n warrant-state-commit:\n description: Immutable queue commit containing the active Warrant readback\n value: ${{ jobs.merge-dev-prs.outputs.warrant-state-commit }}\n project-cut-proof-root:\n description: Verified exact Project Cut replay proof root, when supplied\n value: ${{ jobs.merge-dev-prs.outputs.project-cut-proof-root }}\n native-proof-root:\n description: Fresh or reused semantic native proof root\n value: ${{ jobs.merge-dev-prs.outputs.native-proof-root }}\n native-reuse-decision-root:\n description: Rooted fail-closed native proof reuse decision\n value: ${{ jobs.merge-dev-prs.outputs.native-reuse-decision-root }}\n qualified-warrant-receipt-root:\n description: Atomic provisional-to-qualified Warrant receipt root\n value: ${{ jobs.merge-dev-prs.outputs.qualified-warrant-receipt-root }}\n native-execution-transfer-root:\n description: Content root of the cross-job native proof and state transfer\n value: ${{ jobs.merge-dev-prs.outputs.native-execution-transfer-root }}\n provider-finalizer-boundary-root:\n description: Live provider readback root proving pairwise-distinct hosted\n native, seal, and finalizer domains\n value: ${{ jobs.merge-dev-prs.outputs.provider-finalizer-boundary-root }}\n provider-heartbeat-receipt-root:\n description: Rooted independent durable heartbeat continuity receipt\n value: ${{ jobs.merge-dev-prs.outputs.provider-heartbeat-receipt-root }}\n" } ] }