platform-ci/platform_ci/build_inputs.py

"""The record that says what a build consumed, so a later release can prove an existing artifact is the same build.

The build side stores this record in the artifact manifest, and the trusted publisher recomputes the expected record for the release
commit from the forge's own facts. Reuse requires the two to be equal, so every field here is something a rebuild could change:
the source tree, the component directory, the toolchain and the runtime it ran in, the platform, the planned commands and
reports, and the declared version. No field names a repository, an owner or a run.
"""

import hashlib
import json
import re
from typing import Final, TypedDict

from platform_ci.plan import Target, to_compact_json

_TREE_PATTERN: Final = re.compile(r"[0-9a-f]{40}")
RUNTIME_KEY: Final = "runtime"


class BuildInputsRecord(TypedDict):
   """The manifest's `build_inputs` object (schema 1)."""

   source_tree: str
   input_digest: str
   toolchain: dict[str, str]
   platform: str
   config_digest: str
   version: str


def compute_build_inputs(target: Target, source_tree: str, version: str) -> BuildInputsRecord:
   """Return the build-input record of one planned target built from one source tree with one declared version."""
   if _TREE_PATTERN.fullmatch(source_tree) is None:
      raise ValueError(f"source tree must be a full 40 character tree id, got {source_tree!r}")
   toolchain_name = target["toolchain"]
   return BuildInputsRecord(
      source_tree=source_tree,
      input_digest=_digest({"source_tree": source_tree, "directory": target["directory"]}),
      # a container target runs in its digest-pinned image, a host target on its operator-attested runner
      toolchain={toolchain_name: target["toolchain_version"], RUNTIME_KEY: target["image"] or target["runner"]},
      platform=target["platform"],
      config_digest=_digest(target),
      version=version,
   )


def _digest(value: object) -> str:
   """SHA-256 of the canonical single-line JSON form."""
   return hashlib.sha256(to_compact_json(json.loads(json.dumps(value))).encode("utf-8")).hexdigest()