@intentius/chant-lexicon-forgejo 0.124.27 → 0.124.28

package/dist/actions.d.ts

@@ -24,10 +24,23 @@ export declare const DEFAULT_ACTIONS_ROOT = "https://code.forgejo.org";
 export type ActionTarget = {
     kind: "mirror";
     repo: string;
+    /**
+     * The newest major version that runs on a Forgejo runner, when an older
+     * one is needed: a ref asking for a later major is rewritten to this one.
+     */
+    newest?: string;
 } | {
     kind: "url";
     url: string;
 };
+/**
+ * `upload-artifact` and `download-artifact` v4 and later use `@actions/artifact`
+ * v2, which refuses to run on GitHub Enterprise Server, and a Forgejo runner
+ * presents itself to an action as one: the step fails with "@actions/artifact
+ * v2.0.0+, upload-artifact@v4+ and download-artifact@v4+ are not currently
+ * supported on GHES" (#4008). v3 talks to the artifact service Forgejo serves.
+ */
+export declare const FORGEJO_ARTIFACT_VERSION = "v3";
 /** Built-in mapping of GitHub action `owner/repo` → Forgejo-resolvable target. */
 export declare const KNOWN_ACTIONS: Record<string, ActionTarget>;
 export interface ActionResolveOptions {

package/dist/actions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"actions.d.ts","sourceRoot":"","sources":["../src/actions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,6BAA6B,CAAC;AAE/D;;;;;GAKG;AACH,MAAM,MAAM,YAAY,GAAG;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC;AAE3F,kFAAkF;AAClF,eAAO,MAAM,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAkBtD,CAAC;AAEF,MAAM,WAAW,oBAAoB;IACnC,2EAA2E;IAC3E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,+DAA+D;IAC/D,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;CACtC;AAED,MAAM,WAAW,mBAAmB;IAClC,gDAAgD;IAChD,SAAS,EAAE,MAAM,CAAC;IAClB,4EAA4E;IAC5E,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAaD;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,GAAE,oBAAyB,GAAG,mBAAmB,CA2BrG"}
+{"version":3,"file":"actions.d.ts","sourceRoot":"","sources":["../src/actions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,6BAA6B,CAAC;AAE/D;;;;;GAKG;AACH,MAAM,MAAM,YAAY,GACpB;IACE,IAAI,EAAE,QAAQ,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,GACD;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjC;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,OAAO,CAAC;AAE7C,kFAAkF;AAClF,eAAO,MAAM,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAkBtD,CAAC;AAEF,MAAM,WAAW,oBAAoB;IACnC,2EAA2E;IAC3E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,+DAA+D;IAC/D,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;CACtC;AAED,MAAM,WAAW,mBAAmB;IAClC,gDAAgD;IAChD,SAAS,EAAE,MAAM,CAAC;IAClB,4EAA4E;IAC5E,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAaD;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,GAAE,oBAAyB,GAAG,mBAAmB,CA4BrG"}

package/dist/dialect.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dialect.d.ts","sourceRoot":"","sources":["../src/dialect.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAMH,OAAO,EAAsC,KAAK,UAAU,EAAE,MAAM,6BAA6B,CAAC;AA4ClG;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAKxD,CAAC;AAEF,MAAM,WAAW,qBAAqB;IACpC,mFAAmF;IACnF,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,uEAAuE;IACvE,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,oBAAoB;IACnC,sEAAsE;IACtE,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAClC,iEAAiE;IACjE,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAwFD,MAAM,WAAW,qBAAqB;IACpC,qEAAqE;IACrE,KAAK,EAAE,OAAO,CAAC;IACf,8EAA8E;IAC9E,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CACrC,GAAG,EAAE,OAAO,EACZ,OAAO,GAAE,qBAA0B,GAClC,qBAAqB,CAKvB;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,EACjC,OAAO,GAAE,qBAA0B,GAClC,oBAAoB,CAWtB"}
+{"version":3,"file":"dialect.d.ts","sourceRoot":"","sources":["../src/dialect.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAMH,OAAO,EAAsC,KAAK,UAAU,EAAE,MAAM,6BAA6B,CAAC;AA4ClG;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAKxD,CAAC;AAEF,MAAM,WAAW,qBAAqB;IACpC,mFAAmF;IACnF,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,uEAAuE;IACvE,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,oBAAoB;IACnC,sEAAsE;IACtE,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAClC,iEAAiE;IACjE,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AA4GD,MAAM,WAAW,qBAAqB;IACpC,qEAAqE;IACrE,KAAK,EAAE,OAAO,CAAC;IACf,8EAA8E;IAC9E,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CACrC,GAAG,EAAE,OAAO,EACZ,OAAO,GAAE,qBAA0B,GAClC,qBAAqB,CAKvB;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,EACjC,OAAO,GAAE,qBAA0B,GAClC,oBAAoB,CAWtB"}

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "03614474340b227ee29e077bd5ba73ea6d197dc7048b3c668420d94176a1c3d4",
+    "manifest.json": "46e2c8c8be7c7056342dd04f39489292a7b68af45e73087dbbf70ef968420c05",
     "meta.json": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
     "types/index.d.ts": "66204549b2a864ab5489e3f02c1878e73ab4b3c9d938cfb480b66f71543a43de",
     "rules/delegate-to-github.ts": "1060cda40f4b73d6cca3ba3fa13b80b4886147d4034c88584c2d80c5510dbe5e",
@@ -9,5 +9,5 @@
     "rules/wfj011.ts": "fcb8bf6685d744af20ad804ce929488257995c74b9a3353b2eacae3768d1c83e",
     "skills/chant-forgejo.md": "f28d7fb69fb1cfd992496ef41fda0ea5ccd54a29b84ea1c501a44f6a3992c4d5"
   },
-  "composite": "d22822447c0e75457838451a166f817efdb3f22bf77b63ce476e3e50496f2d0b"
+  "composite": "2ce8fb0d3c767dc7b1a80d6f4280549d2eda2b8e4582067eca557eb29c394d8c"
 }

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "forgejo",
-  "version": "0.124.27",
+  "version": "0.124.28",
   "chantVersion": ">=0.1.0",
   "namespace": "Forgejo",
   "intrinsics": [],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-forgejo",
-  "version": "0.124.27",
+  "version": "0.124.28",
   "description": "Forgejo / Codeberg / Gitea Actions lexicon for chant — a thin GitHub Actions dialect",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -54,8 +54,8 @@
   },
   "peerDependencies": {
     "zod": "^4.3.6",
-    "@intentius/chant": "^0.124.27",
-    "@intentius/chant-lexicon-github": "^0.124.27"
+    "@intentius/chant": "^0.124.28",
+    "@intentius/chant-lexicon-github": "^0.124.28"
   },
   "scripts": {
     "generate": "tsx src/codegen/generate-cli.ts",

package/src/actions.test.ts

@@ -9,20 +9,27 @@ describe("resolveActionRef — mapped actions", () => {
   });
 
   test("rewrites the common actions/* set", () => {
-    for (const name of [
-      "actions/setup-node",
-      "actions/setup-go",
-      "actions/setup-python",
-      "actions/cache",
-      "actions/upload-artifact",
-      "actions/download-artifact",
-    ]) {
+    for (const name of ["actions/setup-node", "actions/setup-go", "actions/setup-python", "actions/cache"]) {
       const { rewritten, warning } = resolveActionRef(`${name}@v4`);
       expect(rewritten).toBe(`${DEFAULT_ACTIONS_ROOT}/${name}@v4`);
       expect(warning).toBeUndefined();
     }
   });
 
+  test("moves upload-artifact and download-artifact v4 and later to v3, which runs on a Forgejo runner (#4008)", () => {
+    for (const name of ["actions/upload-artifact", "actions/download-artifact"]) {
+      for (const v of ["v4", "v4.6.2", "v5"]) {
+        const { rewritten, warning } = resolveActionRef(`${name}@${v}`);
+        expect(rewritten).toBe(`${DEFAULT_ACTIONS_ROOT}/${name}@v3`);
+        expect(warning).toBeUndefined();
+      }
+      // v3 and earlier, a SHA and a branch are the author's to choose.
+      for (const v of ["v3", "v2.3.1", "0123456789abcdef0123456789abcdef01234567", "main"]) {
+        expect(resolveActionRef(`${name}@${v}`).rewritten).toBe(`${DEFAULT_ACTIONS_ROOT}/${name}@${v}`);
+      }
+    }
+  });
+
   test("pins docker/* to a full GitHub URL, independent of the actions root", () => {
     const { rewritten, warning } = resolveActionRef("docker/build-push-action@v5", {
       actionsRoot: "https://example.test",

package/src/actions.ts

@@ -23,7 +23,26 @@ export const DEFAULT_ACTIONS_ROOT = "https://code.forgejo.org";
  *  - `url`:    an absolute base URL — independent of the actions root (used for
  *              actions not carried by the Forgejo mirror, e.g. `docker/*`).
  */
-export type ActionTarget = { kind: "mirror"; repo: string } | { kind: "url"; url: string };
+export type ActionTarget =
+  | {
+      kind: "mirror";
+      repo: string;
+      /**
+       * The newest major version that runs on a Forgejo runner, when an older
+       * one is needed: a ref asking for a later major is rewritten to this one.
+       */
+      newest?: string;
+    }
+  | { kind: "url"; url: string };
+
+/**
+ * `upload-artifact` and `download-artifact` v4 and later use `@actions/artifact`
+ * v2, which refuses to run on GitHub Enterprise Server, and a Forgejo runner
+ * presents itself to an action as one: the step fails with "@actions/artifact
+ * v2.0.0+, upload-artifact@v4+ and download-artifact@v4+ are not currently
+ * supported on GHES" (#4008). v3 talks to the artifact service Forgejo serves.
+ */
+export const FORGEJO_ARTIFACT_VERSION = "v3";
 
 /** Built-in mapping of GitHub action `owner/repo` → Forgejo-resolvable target. */
 export const KNOWN_ACTIONS: Record<string, ActionTarget> = {
@@ -35,8 +54,8 @@ export const KNOWN_ACTIONS: Record<string, ActionTarget> = {
   "actions/setup-java": { kind: "mirror", repo: "actions/setup-java" },
   "actions/setup-dotnet": { kind: "mirror", repo: "actions/setup-dotnet" },
   "actions/cache": { kind: "mirror", repo: "actions/cache" },
-  "actions/upload-artifact": { kind: "mirror", repo: "actions/upload-artifact" },
-  "actions/download-artifact": { kind: "mirror", repo: "actions/download-artifact" },
+  "actions/upload-artifact": { kind: "mirror", repo: "actions/upload-artifact", newest: FORGEJO_ARTIFACT_VERSION },
+  "actions/download-artifact": { kind: "mirror", repo: "actions/download-artifact", newest: FORGEJO_ARTIFACT_VERSION },
   // docker/* — not on the Forgejo mirror; pin to the full GitHub URL, which
   // Forgejo runners can fetch directly.
   "docker/build-push-action": { kind: "url", url: "https://github.com/docker/build-push-action" },
@@ -99,10 +118,22 @@ export function resolveActionRef(ref: string, options: ActionResolveOptions = {}
 
   const base = target.kind === "mirror" ? `${root}/${target.repo}` : target.url;
   const withSubpath = subpath ? `${base}/${subpath}` : base;
-  const rewritten = version ? `${withSubpath}@${version}` : withSubpath;
+  const pinned = target.kind === "mirror" && target.newest && laterMajor(version, target.newest) ? target.newest : version;
+  const rewritten = pinned ? `${withSubpath}@${pinned}` : withSubpath;
   return { rewritten };
 }
 
+/** Whether `version` (`v4`, `v4.1.0`) names a later major than `newest` (`v3`). A SHA or branch never does. */
+function laterMajor(version: string, newest: string): boolean {
+  const major = (v: string): number | undefined => {
+    const m = /^v?(\d+)(?:\.\d+)*$/.exec(v);
+    return m ? Number(m[1]) : undefined;
+  };
+  const a = major(version);
+  const b = major(newest);
+  return a !== undefined && b !== undefined && a > b;
+}
+
 function unresolvedWarning(ref: string): string {
   return (
     `forgejo: unresolved action ref '${ref}' — it has no built-in mapping and won't ` +

package/src/components/__fixtures__/pr-loop.forgejo.golden.yml

@@ -29,12 +29,11 @@ jobs:
         run: chant components pr-plan --base "$BASE_SHA" --pr "$PR_NUMBER" --env prod --gate pr-apply --output .chant/pr --forge forgejo
       - name: Keep the plan report
         if: always()
-        uses: https://code.forgejo.org/actions/upload-artifact@v4
+        uses: https://code.forgejo.org/actions/upload-artifact@v3
         with:
           name: chant-pr-plan
           path: .chant/pr
           if-no-files-found: ignore
-          include-hidden-files: true
   apply:
     if: github.event_name == 'push'
     runs-on: docker
@@ -66,9 +65,8 @@ jobs:
           key: chant-apply-prod-${{ github.sha }}-${{ github.run_id }}-${{ github.run_attempt }}
       - name: Keep the apply report
         if: always()
-        uses: https://code.forgejo.org/actions/upload-artifact@v4
+        uses: https://code.forgejo.org/actions/upload-artifact@v3
         with:
           name: chant-pr-apply
           path: .chant/pr
           if-no-files-found: ignore
-          include-hidden-files: true

package/src/components/__golden__/op-waves-jobs.yml

@@ -33,13 +33,11 @@ jobs:
         run: chant run wave --spec waves.json --wave 2 --decide
       - name: Keep wave 2's decision
         if: always()
-        uses: https://code.forgejo.org/actions/upload-artifact@v4
+        uses: https://code.forgejo.org/actions/upload-artifact@v3
         with:
           name: migrations-wave-2-decision
           path: .chant/op-waves/migrations/wave-2.json
           if-no-files-found: ignore
-          include-hidden-files: true
-          overwrite: true
   wave-2-prod-us:
     runs-on:
       - self-hosted
@@ -57,7 +55,7 @@ jobs:
         with:
           fetch-depth: 0
       - name: Download wave 2's decision
-        uses: https://code.forgejo.org/actions/download-artifact@v4
+        uses: https://code.forgejo.org/actions/download-artifact@v3
         with:
           name: migrations-wave-2-decision
           path: .chant/op-waves/migrations
@@ -73,7 +71,7 @@ jobs:
         with:
           fetch-depth: 0
       - name: Download wave 2's decision
-        uses: https://code.forgejo.org/actions/download-artifact@v4
+        uses: https://code.forgejo.org/actions/download-artifact@v3
         with:
           name: migrations-wave-2-decision
           path: .chant/op-waves/migrations

package/src/components/generate-pr-pipeline.test.ts

@@ -12,6 +12,7 @@ import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { describe, expect, test } from "vitest";
 import type { DriverComponent } from "@intentius/chant/components/driver";
+import { generateGithubPipeline } from "@intentius/chant-lexicon-github/components/generate-pipeline";
 import { generateForgejoPipeline } from "./generate-pipeline";
 
 const ESTATE: DriverComponent[] = [
@@ -51,6 +52,18 @@ describe("the Forgejo pull-request workflow", () => {
     expect(result.yaml).toContain("--forge forgejo --require-review --resume .chant/pr-resume/pr-apply.json");
   });
 
+  test("keeps its reports with upload-artifact v3, the version a Forgejo runner runs, while GitHub keeps v4 (#4008)", () => {
+    // v4 refuses a runner that reads as GitHub Enterprise Server, as Forgejo's does.
+    expect(result.yaml.match(/uses: https:\/\/code\.forgejo\.org\/actions\/upload-artifact@v3$/gm)).toHaveLength(2);
+    expect(result.yaml).not.toMatch(/(upload|download)-artifact@v4/);
+    // v3 uploads hidden files with no input asking for it, so .chant/pr is still kept.
+    expect(result.yaml).not.toContain("include-hidden-files");
+    expect(result.yaml).toContain("path: .chant/pr");
+    const github = generateGithubPipeline(ESTATE, { env: "prod", prLoop: {} }).yaml;
+    expect(github.match(/uses: actions\/upload-artifact@v4$/gm)).toHaveLength(2);
+    expect(github).toContain("include-hidden-files: true");
+  });
+
   test.skipIf(!hasActionlint())("passes actionlint, less the runner label and actions by URL", () => {
     const dir = mkdtempSync(join(tmpdir(), "chant-actionlint-"));
     try {

package/src/dialect.ts

@@ -166,9 +166,29 @@ function transformValue(value: unknown, ctx: TransformCtx): unknown {
     }
     result[key] = transformValue(v, ctx);
   }
+  dropV4OnlyArtifactInputs(result);
   return result;
 }
 
+/**
+ * The inputs only `upload-artifact` v4 has, which a step moved to v3
+ * (`FORGEJO_ARTIFACT_VERSION`, #4008) loses. v3 always uploads hidden files,
+ * so dropping `include-hidden-files` keeps what the step uploads; and a v3
+ * artifact is not immutable, so a second upload under one name needs no
+ * `overwrite`.
+ */
+const V4_ONLY_UPLOAD_INPUTS = new Set(["include-hidden-files", "overwrite"]);
+
+/** Drop {@link V4_ONLY_UPLOAD_INPUTS} from a step that uses `upload-artifact@v3`. */
+function dropV4OnlyArtifactInputs(step: Record<string, unknown>): void {
+  const uses = step.uses;
+  const withs = step.with;
+  if (typeof uses !== "string" || !/\/actions\/upload-artifact@v3$/.test(uses)) return;
+  if (withs === null || typeof withs !== "object" || Array.isArray(withs)) return;
+  const kept = Object.fromEntries(Object.entries(withs as Record<string, unknown>).filter(([k]) => !V4_ONLY_UPLOAD_INPUTS.has(toKebabCase(k))));
+  step.with = kept;
+}
+
 /** Shallow-clone a Declarable, replacing its `props` with a transformed copy. */
 function cloneDeclarable(entity: Declarable, ctx: TransformCtx): Declarable {
   const descriptors = Object.getOwnPropertyDescriptors(entity);