@intentius/chant-lexicon-forgejo 0.104.2 → 0.104.4

package/README.md

@@ -31,9 +31,11 @@ export const build = new Job({
 
 On build, the Forgejo dialect:
 
-- **Drops keys Forgejo ignores** — `permissions` and `continue-on-error` are
-  silently ignored by the Forgejo runner, so they are removed from the output
-  and reported as build warnings (emitting them is misleading).
+- **Drops keys Forgejo ignores** — `continue-on-error` is silently ignored by
+  the Forgejo runner, so it is removed from the output and reported as a build
+  warning (emitting it is misleading). `permissions` is kept, so a job can
+  declare `id-token: write` to request an OIDC token; a Forgejo version that
+  does not honour it ignores the key.
 - **Maps runner labels** — GitHub-hosted labels like `ubuntu-latest` have no
   fixed meaning on Forgejo. They are mapped to a default Forgejo label
   (`docker`), overridable per project. Unmapped labels pass through with a
@@ -75,8 +77,8 @@ fate across the edge:
 |---|---|
 | `translated` | carried across as-is |
 | `approximated` | carried with a close equivalent |
-| `needs-review` | confirm/adjust on Forgejo (unresolved `uses:`, unmapped runner label) |
-| `lost` | the Forgejo runner ignores it (`permissions`, `continue-on-error`) |
+| `needs-review` | confirm/adjust on Forgejo (`permissions`, unresolved `uses:`, unmapped runner label) |
+| `lost` | the Forgejo runner ignores it (`continue-on-error`) |
 
 The same view is available to agents as the `forgejo:compare` MCP tool, which
 takes a workflow file and returns per-property fates plus summary counts —

package/dist/dialect.d.ts

@@ -6,8 +6,11 @@
  * the right shape. The dialect differs in three small ways, all handled here as
  * a pre-pass over the resolved entity graph before the github serializer runs:
  *
- *  1. `permissions` and `continue-on-error` are silently ignored by the Forgejo
- *     runner — we drop them from the output and warn per occurrence.
+ *  1. `continue-on-error` is silently ignored by the Forgejo runner — we drop
+ *     it from the output and warn per occurrence. `permissions` is kept: a
+ *     Forgejo version that honours it (15 and later may) needs `id-token: write`
+ *     on a job to request an OIDC token, and an older runner ignores the key.
+ *     There is no version setting in the dialect, so the key always passes.
  *  2. GitHub-hosted runner labels (`ubuntu-latest`, …) have no fixed meaning on
  *     Forgejo — we map them to a default Forgejo label, overridable per project.
  *  3. Anything we can't place (an unmapped runner label) passes through with a

package/dist/dialect.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dialect.d.ts","sourceRoot":"","sources":["../src/dialect.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAMH,OAAO,EAAsC,KAAK,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAgBlG;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAKxD,CAAC;AAEF,MAAM,WAAW,qBAAqB;IACpC,mFAAmF;IACnF,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,uEAAuE;IACvE,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,oBAAoB;IACnC,sEAAsE;IACtE,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAClC,iEAAiE;IACjE,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAmFD,MAAM,WAAW,qBAAqB;IACpC,qEAAqE;IACrE,KAAK,EAAE,OAAO,CAAC;IACf,8EAA8E;IAC9E,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CACrC,GAAG,EAAE,OAAO,EACZ,OAAO,GAAE,qBAA0B,GAClC,qBAAqB,CAKvB;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,EACjC,OAAO,GAAE,qBAA0B,GAClC,oBAAoB,CAWtB"}
+{"version":3,"file":"dialect.d.ts","sourceRoot":"","sources":["../src/dialect.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAMH,OAAO,EAAsC,KAAK,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAgBlG;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAKxD,CAAC;AAEF,MAAM,WAAW,qBAAqB;IACpC,mFAAmF;IACnF,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,uEAAuE;IACvE,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,oBAAoB;IACnC,sEAAsE;IACtE,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAClC,iEAAiE;IACjE,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAmFD,MAAM,WAAW,qBAAqB;IACpC,qEAAqE;IACrE,KAAK,EAAE,OAAO,CAAC;IACf,8EAA8E;IAC9E,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CACrC,GAAG,EAAE,OAAO,EACZ,OAAO,GAAE,qBAA0B,GAClC,qBAAqB,CAKvB;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,EACjC,OAAO,GAAE,qBAA0B,GAClC,oBAAoB,CAWtB"}

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "4923e81f247efa7bdf9fe02229e3a4277493a31bb83cea66f481f626e5a180b9",
+    "manifest.json": "ea465622093caf8c29ac10e03f2e8c869a78203f7f034ffdc8c4cb09ccdfd327",
     "meta.json": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
     "types/index.d.ts": "66204549b2a864ab5489e3f02c1878e73ab4b3c9d938cfb480b66f71543a43de",
     "rules/delegate-to-github.ts": "1060cda40f4b73d6cca3ba3fa13b80b4886147d4034c88584c2d80c5510dbe5e",
@@ -9,5 +9,5 @@
     "rules/wfj011.ts": "fcb8bf6685d744af20ad804ce929488257995c74b9a3353b2eacae3768d1c83e",
     "skills/chant-forgejo.md": "a1a560429db736c187e0b34cf8dd9efc6ad771afefcbf6f802d160d3d5274257"
   },
-  "composite": "5f5b1891acd42d2f02ce67a15bf829e6a575cc7c0be6193d97b942f29f71655d"
+  "composite": "439fbfd53af4302505724bcb258cf699c7b005bdb6d4267b22ed32f15d00be57"
 }

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "forgejo",
-  "version": "0.104.2",
+  "version": "0.104.4",
   "chantVersion": ">=0.1.0",
   "namespace": "Forgejo",
   "intrinsics": [],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-forgejo",
-  "version": "0.104.2",
+  "version": "0.104.4",
   "description": "Forgejo / Codeberg / Gitea Actions lexicon for chant — a thin GitHub Actions dialect",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -54,8 +54,8 @@
   },
   "peerDependencies": {
     "zod": "^4.3.6",
-    "@intentius/chant": "^0.104.2",
-    "@intentius/chant-lexicon-github": "^0.104.2"
+    "@intentius/chant": "^0.104.4",
+    "@intentius/chant-lexicon-github": "^0.104.4"
   },
   "scripts": {
     "generate": "tsx src/codegen/generate-cli.ts",

package/src/components/__fixtures__/pr-loop.forgejo.golden.yml

@@ -16,6 +16,10 @@ jobs:
     if: github.event_name == 'pull_request'
     runs-on: docker
     container: node:22-slim
+    permissions:
+      contents: read
+      pull-requests: write
+      statuses: write
     steps:
       - uses: https://code.forgejo.org/actions/checkout@v7
         with:
@@ -41,6 +45,10 @@ jobs:
     concurrency:
       group: chant-apply-prod
       cancel-in-progress: false
+    permissions:
+      contents: write
+      pull-requests: write
+      statuses: write
     steps:
       - uses: https://code.forgejo.org/actions/checkout@v7
         with:

package/src/components/generate-pr-pipeline.test.ts

@@ -38,11 +38,11 @@ describe("the Forgejo pull-request workflow", () => {
     expect(result.yaml).toBe(readFileSync(GOLDEN, "utf-8"));
   });
 
-  test("its commands talk to Forgejo, on Forgejo's runner, with no permissions block", () => {
+  test("its commands talk to Forgejo, on Forgejo's runner, with the job permissions kept", () => {
     expect(result.yaml).toContain("--forge forgejo");
     expect(result.yaml).not.toContain("--forge github");
     expect(result.yaml).toContain("runs-on: docker");
-    expect(result.yaml).not.toMatch(/^\s+permissions:/m);
+    expect(result.yaml).toMatch(/^\s+permissions:/m);
   });
 
   test.skipIf(!hasActionlint())("passes actionlint, less the runner label and actions by URL", () => {

package/src/dialect.test.ts

@@ -31,13 +31,26 @@ function entityMap(...pairs: Array<[string, Declarable]>): Map<string, Declarabl
 }
 
 describe("applyForgejoDialect — dropped keys", () => {
-  test("drops workflow-level permissions and warns", () => {
+  test("keeps workflow-level permissions without warning", () => {
     const wf = new MockWorkflow({ name: "CI", permissions: { contents: "read" } });
     const { entities, warnings } = applyForgejoDialect(entityMap(["workflow", wf]));
     const props = (entities.get("workflow") as MockWorkflow).props;
-    expect(props.permissions).toBeUndefined();
+    expect(props.permissions).toEqual({ contents: "read" });
     expect(props.name).toBe("CI");
-    expect(warnings.filter((w) => w.includes("permissions"))).toHaveLength(1);
+    expect(warnings.filter((w) => w.includes("permissions"))).toHaveLength(0);
+  });
+
+  test("keeps job permissions, so a job can request an OIDC token", () => {
+    const job = new MockJob({
+      "runs-on": "ubuntu-latest",
+      permissions: { "id-token": "write", contents: "read" },
+      steps: [{ name: "a", run: "echo a" }],
+    });
+    const { entities, warnings } = applyForgejoDialect(entityMap(["job", job]));
+    const props = (entities.get("job") as MockJob).props;
+    expect(props.permissions).toEqual({ "id-token": "write", contents: "read" });
+    expect(props["runs-on"]).toBe("docker");
+    expect(warnings.filter((w) => w.includes("permissions"))).toHaveLength(0);
   });
 
   test("drops job and step continue-on-error, one warning each", () => {

package/src/dialect.ts

@@ -6,8 +6,11 @@
  * the right shape. The dialect differs in three small ways, all handled here as
  * a pre-pass over the resolved entity graph before the github serializer runs:
  *
- *  1. `permissions` and `continue-on-error` are silently ignored by the Forgejo
- *     runner — we drop them from the output and warn per occurrence.
+ *  1. `continue-on-error` is silently ignored by the Forgejo runner — we drop
+ *     it from the output and warn per occurrence. `permissions` is kept: a
+ *     Forgejo version that honours it (15 and later may) needs `id-token: write`
+ *     on a job to request an OIDC token, and an older runner ignores the key.
+ *     There is no version setting in the dialect, so the key always passes.
  *  2. GitHub-hosted runner labels (`ubuntu-latest`, …) have no fixed meaning on
  *     Forgejo — we map them to a default Forgejo label, overridable per project.
  *  3. Anything we can't place (an unmapped runner label) passes through with a
@@ -25,11 +28,11 @@ import { isDeclarable, isResourceDeclarable, type Declarable } from "@intentius/
 import { resolveActionRef } from "./actions";
 
 /**
- * Keys the Forgejo runner ignores. Emitting them is misleading (they look
+ * Keys the Forgejo runner ignores. `permissions` is not among them: see above. Emitting them is misleading (they look
  * enforced but aren't), so the dialect drops them. Compared in kebab-case so
  * both `continueOnError` and `continue-on-error` spellings are caught.
  */
-const DROPPED_KEYS = new Set(["permissions", "continue-on-error"]);
+const DROPPED_KEYS = new Set(["continue-on-error"]);
 
 /** Property key whose value is a runner-label selector. */
 const RUNS_ON_KEY = "runs-on";

package/src/migrate/from-github/security.test.ts

@@ -7,7 +7,7 @@ function analyze(yaml: string) {
 }
 
 describe("analyzeForgejoSecurity — fate classes", () => {
-  test("workflow-level permissions is lost", () => {
+  test("workflow-level permissions needs review", () => {
     const records = analyze(`on: push
 permissions:
   contents: read
@@ -19,7 +19,7 @@ jobs:
 `);
     const perm = records.filter((r) => r.rule === "MIG-FJ-PERMISSIONS");
     expect(perm).toHaveLength(1);
-    expect(perm[0].security.fate).toBe("lost");
+    expect(perm[0].security.fate).toBe("needs-review");
   });
 
   test("continue-on-error is lost (job and step)", () => {

package/src/migrate/from-github/security.ts

@@ -78,12 +78,12 @@ export function analyzeForgejoSecurity(
         records.push({
           sourceKey: childPath,
           sourceFile: file,
-          category: "skipped",
+          category: "needs-review",
           rule: "MIG-FJ-PERMISSIONS",
-          note: `permissions: is ignored by the Forgejo runner — the least-privilege control is lost. Re-establish it through your Forgejo/runner and repository token settings.`,
-          security: { property: "Least-privilege permissions", fate: "lost", severity: "warning", reestablish: "Forgejo runner/token settings" },
+          note: `permissions: is kept, but only a Forgejo version that honours it enforces it (15 and later may). An older runner ignores it, so confirm the token scope in your Forgejo/runner and repository settings.`,
+          security: { property: "Least-privilege permissions", fate: "needs-review", severity: "warning", reestablish: "Forgejo runner/token settings on a version that ignores permissions" },
         });
-        continue; // don't descend into a dropped subtree
+        continue;
       }
 
       if (kebab === "continue-on-error") {

package/src/migrate.mcp.test.ts

@@ -58,9 +58,7 @@ describe("forgejo MCP compare tool", () => {
 
     expect(result.found).toBe(true);
     const fates = result.properties.map((p) => p.fate);
-    expect(fates).toContain("lost"); // permissions
-    expect(fates).toContain("needs-review"); // unmapped action ref
-    expect(result.summary.lost).toBeGreaterThanOrEqual(1);
+    expect(fates).toContain("needs-review"); // permissions, unmapped action ref
     expect(result.summary["needs-review"]).toBeGreaterThanOrEqual(1);
   });
 

package/src/migrate.test.ts

@@ -23,7 +23,7 @@ describe("github → forgejo transform", () => {
   test("emits forgejo YAML with the dialect applied", async () => {
     const { output } = await transform(GHA_WORKFLOW, { sourceFile: "ci.yml" });
     expect(output).toContain("runs-on: docker");
-    expect(output).not.toContain("permissions");
+    expect(output).toContain("permissions");
     expect(output).not.toContain("continue-on-error");
     expect(output).toContain("https://code.forgejo.org/actions/checkout@v4");
     // unmapped ref still present (passed through), surfaced in the compare
@@ -36,7 +36,7 @@ describe("github → forgejo transform", () => {
     expect(rules).toContain("MIG-FJ-PERMISSIONS");
     expect(rules).toContain("MIG-FJ-CONTINUE-ON-ERROR");
     expect(rules).toContain("MIG-FJ-ACTION-UNRESOLVED");
-    expect(provenance.find((r) => r.rule === "MIG-FJ-PERMISSIONS")?.security.fate).toBe("lost");
+    expect(provenance.find((r) => r.rule === "MIG-FJ-PERMISSIONS")?.security.fate).toBe("needs-review");
     expect(securityPosture).toContain("## Security posture");
     expect(diagnostics.length).toBe(provenance.length);
   });

package/src/serializer.test.ts

@@ -47,12 +47,12 @@ describe("forgejoSerializer — github-style source roundtrip", () => {
     expect(primary).toContain("npm run build");
   });
 
-  test("drops permissions and continue-on-error, warning on each", () => {
+  test("keeps permissions, drops continue-on-error with a warning on each", () => {
     const result = asResult(forgejoSerializer.serialize(buildSource()));
-    expect(result.primary).not.toContain("permissions");
+    expect(result.primary).toContain("permissions");
     expect(result.primary).not.toContain("continue-on-error");
-    // workflow permissions + job continue-on-error + step continue-on-error
-    expect((result.warnings ?? []).filter((w) => w.includes("permissions"))).toHaveLength(1);
+    // job continue-on-error + step continue-on-error
+    expect((result.warnings ?? []).filter((w) => w.includes("permissions"))).toHaveLength(0);
     expect((result.warnings ?? []).filter((w) => w.includes("continue-on-error"))).toHaveLength(2);
   });
 
@@ -162,9 +162,9 @@ describe("forgejoSerializer — inherits PrPlanReport from github (#1983)", () =
     const result = asResult(out);
     expect(result.primary).toContain("runs-on: docker");
     expect(result.primary).not.toContain("ubuntu-latest");
-    // The job carries `permissions` — dropped by the dialect, warned once.
-    expect(result.primary).not.toContain("permissions:");
-    expect((result.warnings ?? []).filter((w) => w.includes("permissions"))).toHaveLength(1);
+    // The job carries `permissions`, which the dialect keeps.
+    expect(result.primary).toContain("permissions:");
+    expect((result.warnings ?? []).filter((w) => w.includes("permissions"))).toHaveLength(0);
     // The sticky-comment mechanism is a raw script, nothing to remap or drop.
     expect(result.primary).toContain("Post or update PR comment");
     expect(result.primary).toContain("gh api");