From f4ccab919d2e090bc969cda7b9eacf8ce24cd399 Mon Sep 17 00:00:00 2001
From: Codex <codex@local>
Date: Tue, 26 May 2026 05:45:33 +0800
Subject: [PATCH] fix: remove legacy artifact identity import

---
 scripts/artifact-publish.mjs | 64 ++++++++++++++++++++++++++++++++----
 1 file changed, 58 insertions(+), 6 deletions(-)

diff --git a/scripts/artifact-publish.mjs b/scripts/artifact-publish.mjs
index cfcc5734..1a724fdd 100644
--- a/scripts/artifact-publish.mjs
+++ b/scripts/artifact-publish.mjs
@@ -16,10 +16,6 @@ import {
   resolveDevArtifactServices,
   serviceInventoryFromServices
 } from "./src/dev-artifact-services.mjs";
-import {
-  devArtifactProducer,
-  requireDevArtifactPublishIdentity
-} from "./src/dev-cd-transaction-guard.mjs";
 import { runDevBaseImagePreflight } from "./src/dev-base-image-preflight.mjs";
 import { probeRegistryCapabilities } from "./src/registry-capabilities.mjs";
 import { inspectCloudWebDistFreshness } from "../web/hwlab-cloud-web/scripts/dist-contract.mjs";
@@ -47,6 +43,13 @@ const sourceStates = new Set([
   "intentionally-disabled"
 ]);
 
+const ciArtifactIdentityEnvNames = [
+  "HWLAB_CI_ARTIFACT_RUN_ID",
+  "GITHUB_RUN_ID",
+  "CI_PIPELINE_ID",
+  "BUILDKITE_BUILD_ID"
+];
+
 const servicePorts = new Map([
   ["hwlab-cloud-api", 6667],
   ["hwlab-cloud-web", 8080],
@@ -108,6 +111,55 @@ function parseConcurrency(value, fallback) {
   return Math.min(Math.max(parsed, 1), 8);
 }
 
+function artifactIdentityValue(env, name) {
+  const value = env?.[name];
+  return typeof value === "string" && value.trim().length > 0 ? value.trim() : null;
+}
+
+function g14ArtifactIdentityName(env = process.env) {
+  return ciArtifactIdentityEnvNames.find((name) => artifactIdentityValue(env, name));
+}
+
+function g14ArtifactProducer(env = process.env) {
+  const idName = g14ArtifactIdentityName(env);
+  if (!idName) {
+    return {
+      kind: "missing",
+      runId: null,
+      owner: null
+    };
+  }
+  return {
+    kind: "g14-ci-artifact",
+    runId: artifactIdentityValue(env, idName),
+    owner: artifactIdentityValue(env, "HWLAB_CI_ARTIFACT_RUN_OWNER") ?? idName
+  };
+}
+
+function g14ArtifactPublishIdentityGuardFailure({ script, mode }) {
+  return {
+    ok: false,
+    status: "blocked",
+    error: "g14-artifact-publish-identity-required",
+    code: "g14-artifact-publish-identity-required",
+    script,
+    mode,
+    requiredEnv: "HWLAB_CI_ARTIFACT_RUN_ID or standard CI run identity",
+    acceptedEnv: ciArtifactIdentityEnvNames,
+    entrypoint: `HWLAB_CI_ARTIFACT_RUN_ID=<run-id> HWLAB_CI_ARTIFACT_RUN_OWNER=<owner> node scripts/g14-artifact-publish.mjs --publish --report ${tempReportPath("dev-artifacts.json")}`,
+    summary: `${script} ${mode} is a G14 artifact publish side-effect step and must run under CI artifact identity. Legacy D601 CD transaction identity is not accepted.`,
+    devOnly: true,
+    prodTouched: false,
+    cdLockRequired: false,
+    rolloutAttempted: false,
+    mutationAttempted: false
+  };
+}
+
+function requireG14ArtifactPublishIdentity({ env = process.env, script, mode }) {
+  return g14ArtifactIdentityName(env) ? null : g14ArtifactPublishIdentityGuardFailure({ script, mode });
+}
+
 function printHelp() {
   console.log([
     `usage: node ${cliEntrypoint} [--preflight|--build|--publish]`,
@@ -1458,7 +1510,7 @@ async function main() {
     return;
   }
   if (args.mode === "publish") {
-    const identityGuard = requireDevArtifactPublishIdentity({
+    const identityGuard = requireG14ArtifactPublishIdentity({
       script: cliEntrypoint,
       mode: "--publish"
     });
@@ -1490,7 +1542,7 @@ async function main() {
   const shortCommit = commitId.slice(0, 7);
   const buildCreatedAt = new Date().toISOString();
   const repo = repoLabelFromRemote(remoteUrl);
-  const producer = devArtifactProducer(process.env);
+  const producer = g14ArtifactProducer(process.env);
   const services = await resolveServices(args.services, catalog);
 
   let blockers = await preflight({ args, services, catalog, deployManifest, baseImagePreflight, registryCapabilities });