@intentius/chant-lexicon-forgejo 0.124.23 → 0.124.24

package/dist/components/generate-op-waves-pipeline.d.ts

@@ -14,6 +14,13 @@
  *
  * A `pr-review` wave (#3684) gets `<name>-plans.yml` on pull requests, as on
  * GitHub. Forgejo's job token reads reviews with no permission to ask for.
+ *
+ * `runner` and a wave's `jobs` (#3914) render as on GitHub, with two limits:
+ * a runner is a label or a list of labels (a GitHub runner group is a spec
+ * error), and a job group cannot name an `environment`, since Forgejo has
+ * none to put in front of it. A job with id tokens keeps `permissions:
+ * id-token: write`, the one scope the dialect leaves, and reads each audience
+ * from `<NAME>_AUDIENCE` when it requests its token.
  */
 import type { OpWavesSpec } from "@intentius/chant/op/op-waves";
 import type { OpWavesPipelineOptions, OpWavesPipelineResult } from "@intentius/chant/lexicon";

package/dist/components/generate-op-waves-pipeline.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generate-op-waves-pipeline.d.ts","sourceRoot":"","sources":["../../src/components/generate-op-waves-pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAIH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,KAAK,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAC9F,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAGxD,6EAA6E;AAC7E,wBAAgB,8BAA8B,CAC5C,IAAI,EAAE,WAAW,EACjB,OAAO,EAAE,sBAAsB,EAC/B,cAAc,GAAE,qBAA0B,GACzC,qBAAqB,CAgBvB"}
+{"version":3,"file":"generate-op-waves-pipeline.d.ts","sourceRoot":"","sources":["../../src/components/generate-op-waves-pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAIH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAEhE,OAAO,KAAK,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAC9F,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAGxD,6EAA6E;AAC7E,wBAAgB,8BAA8B,CAC5C,IAAI,EAAE,WAAW,EACjB,OAAO,EAAE,sBAAsB,EAC/B,cAAc,GAAE,qBAA0B,GACzC,qBAAqB,CAiBvB"}

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "4d91b353db6715db9fb58dced5a640ef409910826130a76a79b52da80243c71a",
+    "manifest.json": "8d1a9b3e747b19467ac4ea8c9664869ec8ad666b37847596d2102f47d69c3558",
     "meta.json": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
     "types/index.d.ts": "66204549b2a864ab5489e3f02c1878e73ab4b3c9d938cfb480b66f71543a43de",
     "rules/delegate-to-github.ts": "1060cda40f4b73d6cca3ba3fa13b80b4886147d4034c88584c2d80c5510dbe5e",
@@ -9,5 +9,5 @@
     "rules/wfj011.ts": "fcb8bf6685d744af20ad804ce929488257995c74b9a3353b2eacae3768d1c83e",
     "skills/chant-forgejo.md": "f28d7fb69fb1cfd992496ef41fda0ea5ccd54a29b84ea1c501a44f6a3992c4d5"
   },
-  "composite": "54c97202efac9c91c77df2b119d0cbe8ce16511c61032c076af5cf823f1ddbc0"
+  "composite": "81febbfee8a63ebe6a7d7ab137ed222da1fd562b7a11a4fd7465e13c21cdec2d"
 }

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "forgejo",
-  "version": "0.124.23",
+  "version": "0.124.24",
   "chantVersion": ">=0.1.0",
   "namespace": "Forgejo",
   "intrinsics": [],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-forgejo",
-  "version": "0.124.23",
+  "version": "0.124.24",
   "description": "Forgejo / Codeberg / Gitea Actions lexicon for chant — a thin GitHub Actions dialect",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -54,8 +54,8 @@
   },
   "peerDependencies": {
     "zod": "^4.3.6",
-    "@intentius/chant": "^0.124.23",
-    "@intentius/chant-lexicon-github": "^0.124.23"
+    "@intentius/chant": "^0.124.24",
+    "@intentius/chant-lexicon-github": "^0.124.24"
   },
   "scripts": {
     "generate": "tsx src/codegen/generate-cli.ts",

package/src/components/__golden__/op-waves-jobs.yml

@@ -0,0 +1,81 @@
+name: migrations
+
+on:
+  push:
+    branches:
+      - main
+  workflow_dispatch: {}
+
+concurrency:
+  group: migrations
+  cancel-in-progress: false
+
+jobs:
+  wave-1-dev:
+    runs-on: plan
+    container: node:22
+    steps:
+      - uses: https://code.forgejo.org/actions/checkout@v7
+        with:
+          fetch-depth: 0
+      - name: Plan, gate and apply wave 1 (dev)
+        run: chant run wave --spec waves.json --wave 1
+  wave-2-prod-decide:
+    runs-on: plan
+    needs:
+      - wave-1-dev
+    container: node:22
+    steps:
+      - uses: https://code.forgejo.org/actions/checkout@v7
+        with:
+          fetch-depth: 0
+      - name: Plan wave 2 (prod) and decide its gate
+        run: chant run wave --spec waves.json --wave 2 --decide
+      - name: Keep wave 2's decision
+        if: always()
+        uses: https://code.forgejo.org/actions/upload-artifact@v4
+        with:
+          name: migrations-wave-2-decision
+          path: .chant/op-waves/migrations/wave-2.json
+          if-no-files-found: ignore
+          include-hidden-files: true
+          overwrite: true
+  wave-2-prod-us:
+    runs-on:
+      - self-hosted
+      - us
+    needs:
+      - wave-2-prod-decide
+    container: node:22
+    permissions:
+      id-token: write
+    env:
+      REGION: us
+      CLOUD_TOKEN_AUDIENCE: us.example
+    steps:
+      - uses: https://code.forgejo.org/actions/checkout@v7
+        with:
+          fetch-depth: 0
+      - name: Download wave 2's decision
+        uses: https://code.forgejo.org/actions/download-artifact@v4
+        with:
+          name: migrations-wave-2-decision
+          path: .chant/op-waves/migrations
+      - name: Apply job group us of wave 2 (prod)
+        run: chant run wave --spec waves.json --wave 2 --group us
+  wave-2-prod-eu:
+    runs-on: eu-apply
+    needs:
+      - wave-2-prod-decide
+    container: node:22
+    steps:
+      - uses: https://code.forgejo.org/actions/checkout@v7
+        with:
+          fetch-depth: 0
+      - name: Download wave 2's decision
+        uses: https://code.forgejo.org/actions/download-artifact@v4
+        with:
+          name: migrations-wave-2-decision
+          path: .chant/op-waves/migrations
+      - name: Apply job group eu of wave 2 (prod)
+        run: chant run wave --spec waves.json --wave 2 --group eu

package/src/components/generate-op-waves-pipeline.test.ts

@@ -63,3 +63,43 @@ describe("generateForgejoOpWavesPipeline", () => {
     expect(() => generateForgejoOpWavesPipeline({ ...waveLevel, hooks: { after: { apply: [{ command: ["./bin/smoke"], onFailure: "approve" }] } } }, { specFile: "waves.json" })).toThrow(/nothing left to hold/);
   });
 });
+
+describe("a runner per wave and job groups per wave (#3914)", () => {
+  const grouped: OpWavesSpec = {
+    ...spec,
+    runner: "plan",
+    waves: [
+      { name: "dev", runs: [{ target: "dev" }], gate: "never" },
+      {
+        name: "prod",
+        runs: [{ target: "us/a" }, { target: "eu/a" }],
+        jobs: [
+          { name: "us", runs: ["us/*"], runner: ["self-hosted", "us"], variables: { REGION: "us" }, idTokens: { CLOUD_TOKEN: "us.example" } },
+          { name: "eu", runs: ["eu/*"], runner: "eu-apply" },
+        ],
+      },
+    ],
+  };
+
+  test("the rendered pipeline matches its golden", async () => {
+    await expect(generateForgejoOpWavesPipeline(grouped, { specFile: "waves.json" }).files[0]!.yaml).toMatchFileSnapshot("./__golden__/op-waves-jobs.yml");
+  });
+
+  test("groups render as their own jobs with their runner, variables and id-token: write", () => {
+    const { files, jobs } = generateForgejoOpWavesPipeline(grouped, { specFile: "waves.json" });
+    expect(jobs.map((j) => j.jobName)).toEqual(["wave-1-dev", "wave-2-prod-decide", "wave-2-prod-us", "wave-2-prod-eu"]);
+    const yaml = files[0]!.yaml;
+    expect(yaml).toMatch(/wave-1-dev:\n\s+runs-on: plan\n/);
+    expect(yaml).toMatch(/wave-2-prod-us:\n\s+runs-on:\n\s+- self-hosted\n\s+- us\n[\s\S]*?permissions:\n\s+id-token: write\n\s+env:\n\s+REGION: us\n\s+CLOUD_TOKEN_AUDIENCE: us.example\n/);
+    expect(yaml).toMatch(/wave-2-prod-eu:\n\s+runs-on: eu-apply\n\s+needs:\n\s+- wave-2-prod-decide\n\s+container: node:22\n\s+steps:/);
+    expect(yaml).not.toContain("contents: write");
+  });
+
+  test("a runner group, or an environment on a job group, is a spec error naming the wave and the field", () => {
+    const prod = grouped.waves[1]!;
+    const withGroup = (g: Record<string, unknown>): OpWavesSpec => ({ ...grouped, waves: [grouped.waves[0]!, { ...prod, jobs: [{ ...prod.jobs![0]!, ...g }, prod.jobs![1]!] }] });
+    expect(() => generateForgejoOpWavesPipeline(withGroup({ environment: { name: "prod-us" } }), { specFile: "waves.json" })).toThrow(/wave "prod" job group "us" names the environment "prod-us", but Forgejo Actions has no environments/);
+    expect(() => generateForgejoOpWavesPipeline(withGroup({ runner: { group: "apply" } }), { specFile: "waves.json" })).toThrow(/wave "prod" job group "us" runner is the runner group "apply", which only GitHub has/);
+    expect(() => generateForgejoOpWavesPipeline({ ...grouped, waves: [{ ...grouped.waves[0]!, runner: { group: "x" } }] }, { specFile: "waves.json" })).toThrow(/wave "dev" runner is the runner group/);
+  });
+});

package/src/components/generate-op-waves-pipeline.ts

@@ -14,11 +14,19 @@
  *
  * A `pr-review` wave (#3684) gets `<name>-plans.yml` on pull requests, as on
  * GitHub. Forgejo's job token reads reviews with no permission to ask for.
+ *
+ * `runner` and a wave's `jobs` (#3914) render as on GitHub, with two limits:
+ * a runner is a label or a list of labels (a GitHub runner group is a spec
+ * error), and a job group cannot name an `environment`, since Forgejo has
+ * none to put in front of it. A job with id tokens keeps `permissions:
+ * id-token: write`, the one scope the dialect leaves, and reads each audience
+ * from `<NAME>_AUDIENCE` when it requests its token.
  */
 
 import { buildGithubOpWavesDoc } from "@intentius/chant-lexicon-github/components/generate-op-waves-pipeline";
 import { emitOpPipelineYAML } from "@intentius/chant-lexicon-github/components/generate-op-pipeline";
 import type { OpWavesSpec } from "@intentius/chant/op/op-waves";
+import { assertRunnerLabels } from "@intentius/chant/ci-jobs";
 import type { OpWavesPipelineOptions, OpWavesPipelineResult } from "@intentius/chant/lexicon";
 import type { ForgejoDialectOptions } from "../dialect";
 import { droppedWaveEnvironmentsHeader, FORGE_TOKEN_ENV, forgejoWorkflowDoc } from "./ci-jobs";
@@ -29,6 +37,7 @@ export function generateForgejoOpWavesPipeline(
   options: OpWavesPipelineOptions,
   dialectOptions: ForgejoDialectOptions = {},
 ): OpWavesPipelineResult {
+  assertForgejoWaves(spec);
   const { doc, jobs, resumeDoc, plansDoc } = buildGithubOpWavesDoc(spec, options);
   const dropped = spec.waves.filter((w) => w.environment).map((w) => `${w.name} -> ${w.environment!.name}`);
   const header = dropped.length > 0 ? droppedWaveEnvironmentsHeader(dropped) : undefined;
@@ -45,3 +54,22 @@ export function generateForgejoOpWavesPipeline(
   if (plansDoc) files.push({ name: `${spec.name}-plans.yml`, yaml: emitOpPipelineYAML(forgejoWorkflowDoc(plansDoc, dialectOptions)) });
   return { files, jobs };
 }
+
+/** Refuse what Forgejo cannot carry (#3914): a runner group, and a job group's environment. */
+function assertForgejoWaves(spec: OpWavesSpec): void {
+  const subject = `Op waves "${spec.name}"`;
+  assertRunnerLabels(subject, "runner", spec.runner, "Forgejo");
+  for (const wave of spec.waves) {
+    assertRunnerLabels(subject, `wave "${wave.name}" runner`, wave.runner, "Forgejo");
+    for (const group of wave.jobs ?? []) {
+      const field = `wave "${wave.name}" job group "${group.name}"`;
+      assertRunnerLabels(subject, `${field} runner`, group.runner, "Forgejo");
+      if (group.environment) {
+        throw new Error(
+          `${subject}: ${field} names the environment "${group.environment.name}", but Forgejo Actions has no environments, ` +
+            "so nothing on the forge would hold the job or scope its secrets. Drop it; the group still renders as its own job with its own runner and variables.",
+        );
+      }
+    }
+  }
+}