@intentius/chant-lexicon-forgejo 0.124.31 → 0.124.33

package/dist/migrate/from-github/index.js

@@ -0,0 +1,63 @@
+/**
+ * github → forgejo migration entry point.
+ *
+ * Thin by design: Forgejo Actions YAML *is* GitHub Actions YAML, so the
+ * migration applies the same dialect as a `chant build` (drop ignored keys,
+ * resolve `uses:` refs, map runner labels) and emits the result. No stage
+ * inference, job→script rewrite, or `!reference` intrinsic like the gitlab
+ * migration needs. The differentiated value is the security-fate **compare**
+ * (see ./security).
+ */
+import { parseYAML, emitYAML } from "@intentius/chant/yaml";
+import { transformWorkflowObject } from "../../dialect.js";
+import { analyzeForgejoSecurity, provenanceToDiagnostics, renderSecurityPosture, } from "./security.js";
+/** Emit a parsed/transformed workflow object back to YAML. */
+function emitForgejoYaml(value) {
+    const body = emitYAML(value, 0);
+    return (body.startsWith("\n") ? body.slice(1) : body) + "\n";
+}
+/** Emit a chant TypeScript pipeline (authored github-style, imported from forgejo). */
+async function emitTs(content, opts) {
+    const { GitHubActionsParser } = await import("@intentius/chant-lexicon-github/import/parser");
+    const { GitHubActionsGenerator } = await import("@intentius/chant-lexicon-github/import/generator");
+    const ir = new GitHubActionsParser().parse(content);
+    const files = new GitHubActionsGenerator().generate(ir);
+    const banner = `// Migrated from ${opts.sourceFile ?? "(stdin)"} by chant migrate (github → forgejo).\n` +
+        `// Authored github-style; the forgejo lexicon applies its dialect on build.\n\n`;
+    return (banner +
+        files
+            .map((f) => f.content.replace(/@intentius\/chant-lexicon-github/g, "@intentius/chant-lexicon-forgejo"))
+            .join("\n"));
+}
+/**
+ * Migrate a GitHub Actions workflow into a Forgejo workflow.
+ *
+ * @param content raw .github/workflows/*.yml content
+ * @param opts    migration options
+ */
+export async function transform(content, opts = {}) {
+    const source = parseYAML(content);
+    let output;
+    if (opts.emit === "ts") {
+        output = await emitTs(content, opts);
+    }
+    else {
+        const { value } = transformWorkflowObject(source);
+        output = emitForgejoYaml(value);
+    }
+    // The compare is computed against the *source* — that's where the dropped
+    // keys still exist — so it reports what the move costs.
+    const provenance = analyzeForgejoSecurity(source, { sourceFile: opts.sourceFile });
+    const diagnostics = provenanceToDiagnostics(provenance, { strict: opts.strict });
+    const securityPosture = renderSecurityPosture(provenance);
+    return { output, provenance, diagnostics, securityPosture };
+}
+/**
+ * Lightweight detector: does this content look like a GitHub Actions workflow?
+ * Used by the plugin's `migrationSource("github")`.
+ */
+export function detectGitHubWorkflow(content) {
+    if (!/^\s*jobs\s*:/m.test(content))
+        return false;
+    return /^\s*on\s*:/m.test(content) || /^\s*runs-on\s*:/m.test(content);
+}

package/dist/migrate/from-github/security.js

@@ -0,0 +1,140 @@
+/**
+ * Security-fate model for the github → forgejo migration edge.
+ *
+ * github → forgejo YAML is near-identical, so the migration itself is thin. The
+ * differentiated value is the **compare**: classifying what survives the move
+ * and what Forgejo silently drops. Most properties translate verbatim; the
+ * useful findings are the keys the Forgejo runner ignores (`permissions` →
+ * `needs-review`, `continue-on-error` → `lost`) plus refs/labels that need attention
+ * (unresolved `uses:`, unmapped runner labels → `needs-review`).
+ *
+ * Mirrors the gitlab lexicon's fate model (translated / approximated /
+ * needs-review / lost) but for the Forgejo edge — kept local so the forgejo
+ * lexicon does not depend on the gitlab one.
+ */
+import { DEFAULT_RUNNER_LABELS } from "../../dialect.js";
+import { resolveActionRef } from "../../actions.js";
+function toKebabCase(name) {
+    return name.replace(/([a-z0-9])([A-Z])/g, "$1-$2").toLowerCase();
+}
+/**
+ * Classify the fate of security-relevant properties in a parsed GitHub Actions
+ * workflow as it migrates to Forgejo. Walks the source object so occurrence
+ * counts (and paths) are precise.
+ */
+export function analyzeForgejoSecurity(workflow, opts = {}) {
+    const records = [];
+    const file = opts.sourceFile;
+    function visit(value, path) {
+        if (value === null || typeof value !== "object")
+            return;
+        if (Array.isArray(value)) {
+            value.forEach((v, i) => visit(v, `${path}[${i}]`));
+            return;
+        }
+        for (const [key, v] of Object.entries(value)) {
+            const kebab = toKebabCase(key);
+            const childPath = path ? `${path}.${key}` : key;
+            if (kebab === "permissions") {
+                records.push({
+                    sourceKey: childPath,
+                    sourceFile: file,
+                    category: "needs-review",
+                    rule: "MIG-FJ-PERMISSIONS",
+                    note: `permissions: is dropped, except id-token, which a job needs to request an OIDC token. The Forgejo runner does not enforce the scopes, so confirm the token scope in your Forgejo/runner and repository settings.`,
+                    security: { property: "Least-privilege permissions", fate: "needs-review", severity: "warning", reestablish: "Forgejo runner/token settings" },
+                });
+                continue;
+            }
+            if (kebab === "continue-on-error") {
+                records.push({
+                    sourceKey: childPath,
+                    sourceFile: file,
+                    category: "skipped",
+                    rule: "MIG-FJ-CONTINUE-ON-ERROR",
+                    note: `continue-on-error is ignored by the Forgejo runner — the failure-tolerance control is lost. A failing step/job will fail the run.`,
+                    security: { property: "continue-on-error tolerance", fate: "lost", severity: "warning" },
+                });
+                continue;
+            }
+            if (kebab === "uses" && typeof v === "string") {
+                const { warning } = resolveActionRef(v);
+                if (warning) {
+                    records.push({
+                        sourceKey: childPath,
+                        sourceFile: file,
+                        category: "needs-review",
+                        rule: "MIG-FJ-ACTION-UNRESOLVED",
+                        note: `Action ref '${v}' has no built-in Forgejo mapping and won't resolve from a GitHub Marketplace. Use a full repository URL or mirror it under forgejo.actionsRoot.`,
+                        security: { property: "Action reference", fate: "needs-review", severity: "warning" },
+                    });
+                }
+                continue;
+            }
+            if (kebab === "runs-on") {
+                for (const label of runnerLabels(v)) {
+                    if (DEFAULT_RUNNER_LABELS[label] === undefined) {
+                        records.push({
+                            sourceKey: childPath,
+                            sourceFile: file,
+                            category: "needs-review",
+                            rule: "MIG-FJ-RUNNER-LABEL",
+                            note: `Runner label '${label}' has no built-in Forgejo mapping. Confirm a Forgejo runner advertises it, or map it via forgejo.runnerLabels.`,
+                            security: { property: "Runner label", fate: "needs-review", severity: "warning" },
+                        });
+                    }
+                }
+                continue;
+            }
+            visit(v, childPath);
+        }
+    }
+    visit(workflow, "");
+    return records;
+}
+function runnerLabels(value) {
+    if (typeof value === "string")
+        return [value];
+    if (Array.isArray(value))
+        return value.filter((v) => typeof v === "string");
+    return [];
+}
+/**
+ * Convert security records into SARIF-shaped diagnostics. Security findings
+ * always emit a diagnostic at their severity, escalated to `error` under
+ * `--strict` when the property was lost or needs review.
+ */
+export function provenanceToDiagnostics(records, opts = {}) {
+    return records.map((r) => {
+        const escalate = opts.strict && (r.security.fate === "lost" || r.security.fate === "needs-review");
+        return {
+            file: r.sourceFile ?? "<input>",
+            line: 1,
+            column: 1,
+            ruleId: r.rule,
+            severity: escalate ? "error" : r.security.severity,
+            message: r.note ?? r.rule,
+        };
+    });
+}
+/** Render a "Security posture" Markdown section from the security records. */
+export function renderSecurityPosture(records) {
+    if (records.length === 0) {
+        return "## Security posture\n\nNo security-relevant properties weaken or drop at the Forgejo migration edge.\n";
+    }
+    const byRule = new Map();
+    for (const r of records) {
+        const existing = byRule.get(r.rule);
+        if (existing)
+            existing.count += 1;
+        else
+            byRule.set(r.rule, { property: r.security.property, fate: r.security.fate, rule: r.rule, count: 1 });
+    }
+    let out = "## Security posture\n\n";
+    out += "| Property | Fate | Rule | Count |\n|---|---|---|---|\n";
+    for (const line of byRule.values()) {
+        out += `| ${line.property} | ${line.fate} | ${line.rule} | ${line.count} |\n`;
+    }
+    out += "\nFates: **translated** (carried as-is) · **approximated** · **needs-review** (confirm/adjust on Forgejo) · **lost** (the Forgejo runner ignores the property).\n";
+    return out;
+}

package/dist/plugin.js

@@ -0,0 +1,206 @@
+/**
+ * Forgejo Actions lexicon plugin.
+ *
+ * Forgejo runs GitHub-Actions-compatible workflows, so this lexicon is a thin
+ * dialect of the github lexicon: it reuses github's generated entities and
+ * composites wholesale (re-exported from ./index) and overrides only the
+ * serializer. There is no own spec, so the codegen lifecycle methods are
+ * intentionally no-ops — they delegate the real work to the github lexicon.
+ */
+import { postSynthChecks as postSynthCheckList } from "./lint/post-synth/index.js";
+import { forgejoAuditCatalog } from "./lint/audit-catalog.js";
+import { createSkillsLoader, createDiffTool } from "@intentius/chant/lexicon-plugin-helpers";
+import { forgejoSerializer } from "./serializer.js";
+import { forgejoContextTools } from "./mcp/context-tools.js";
+import { generateForgejoPipeline } from "./components/generate-pipeline.js";
+import { generateForgejoOpPipeline } from "./components/generate-op-pipeline.js";
+import { generateForgejoOpWavesPipeline } from "./components/generate-op-waves-pipeline.js";
+import { forgejoLintRules } from "./lint/rules/delegate-to-github.js";
+import { forgejoCompletions } from "./lsp/completions.js";
+import { forgejoHover } from "./lsp/hover.js";
+import { forgejoConfigSchema } from "./config.js";
+import { githubGraphEdges } from "@intentius/chant-lexicon-github";
+const reuseNote = "forgejo reuses the github lexicon's entities — run `chant generate` in the github lexicon instead.";
+export const forgejoPlugin = {
+    name: "forgejo",
+    configSchema: forgejoConfigSchema,
+    auditCatalog: () => forgejoAuditCatalog,
+    serializer: forgejoSerializer,
+    // Forgejo workflows are github entities, so github resolves their `needs`,
+    // `uses:` and `workflow_run` edges (#3910); `.forgejo/workflows/` paths too.
+    graphEdges: (entities) => githubGraphEdges(entities),
+    // Generate mode (#969): component graph → Forgejo Actions workflow. Reuses
+    // github's pipeline structure and applies the Forgejo dialect (runner labels,
+    // `uses:` resolution) — see ./components/generate-pipeline.
+    generateComponentPipeline: (components, options) => generateForgejoPipeline(components, options),
+    // Generate mode, Op counterpart (#927): scheduled Op → Forgejo Actions workflow.
+    generateOpPipeline: (ops, options) => generateForgejoOpPipeline(ops, options),
+    // Ordered waves of Op runs, each behind one gate (#3679).
+    generateOpWavesPipeline: (spec, options) => generateForgejoOpWavesPipeline(spec, options),
+    initTemplates(template) {
+        if (template === "docker-build") {
+            return {
+                src: {
+                    "pipeline.ts": `import { Workflow, Job, Step, Checkout } from "@intentius/chant-lexicon-forgejo";
+
+export const workflow = new Workflow({
+  name: "Docker Build",
+  on: { push: { branches: ["main"] } },
+});
+
+export const build = new Job({
+  "runs-on": "ubuntu-latest",
+  steps: [
+    Checkout({}).step,
+    new Step({ name: "Build", run: "docker build -t myapp ." }),
+  ],
+});
+`,
+                },
+            };
+        }
+        // Default template: a Node CI workflow. Reuses github entities; the forgejo
+        // serializer maps "ubuntu-latest" to a Forgejo runner label on build.
+        return {
+            src: {
+                "pipeline.ts": `import { Workflow, Job, Step, Checkout, SetupNode } from "@intentius/chant-lexicon-forgejo";
+
+export const workflow = new Workflow({
+  name: "CI",
+  on: {
+    push: { branches: ["main"] },
+    pull_request: { branches: ["main"] },
+  },
+});
+
+export const build = new Job({
+  "runs-on": "ubuntu-latest",
+  steps: [
+    Checkout({}).step,
+    SetupNode({ nodeVersion: "22", cache: "npm" }).step,
+    new Step({ name: "Install", run: "npm ci" }),
+    new Step({ name: "Build", run: "npm run build" }),
+    new Step({ name: "Test", run: "npm test" }),
+  ],
+});
+`,
+            },
+        };
+    },
+    detectTemplate(data) {
+        if (typeof data !== "object" || data === null)
+            return false;
+        const obj = data;
+        // Forgejo Actions workflows are GitHub-Actions-shaped: `on:` + `jobs:`.
+        if (obj.on !== undefined && obj.jobs !== undefined)
+            return true;
+        for (const value of Object.values(obj)) {
+            if (typeof value === "object" && value !== null) {
+                const entry = value;
+                if (entry["runs-on"] !== undefined || entry.steps !== undefined) {
+                    return true;
+                }
+            }
+        }
+        return false;
+    },
+    migrationSource(from) {
+        if (from !== "github")
+            return undefined;
+        return {
+            detect(content) {
+                // Inline heuristic — keeps the migrate code out of the import graph
+                // until a transform actually runs.
+                if (!/^\s*jobs\s*:/m.test(content))
+                    return false;
+                return /^\s*on\s*:/m.test(content) || /^\s*runs-on\s*:/m.test(content);
+            },
+            async transform(content, opts) {
+                const { transform } = await import("./migrate/from-github/index.js");
+                const result = await transform(content, {
+                    emit: opts.emit,
+                    sourceFile: opts.sourceFile,
+                    strict: opts.strict,
+                    security: opts.security,
+                });
+                return {
+                    output: result.output,
+                    provenance: result.provenance,
+                    diagnostics: result.diagnostics,
+                    securityPosture: result.securityPosture,
+                };
+            },
+        };
+    },
+    postSynthChecks() {
+        return postSynthCheckList;
+    },
+    // Lint rules and LSP support are delegated to github, not forked — see
+    // ./lint/rules/delegate-to-github.ts and ./lsp/{completions,hover}.ts.
+    lintRules() {
+        return forgejoLintRules;
+    },
+    completionProvider(ctx) {
+        return forgejoCompletions(ctx);
+    },
+    hoverProvider(ctx) {
+        return forgejoHover(ctx);
+    },
+    mcpTools() {
+        return [
+            createDiffTool(forgejoSerializer, "Compare current build output against previous output for Forgejo Actions", "forgejo"),
+            ...forgejoContextTools(),
+        ];
+    },
+    skills: createSkillsLoader(import.meta.url, [
+        {
+            file: "chant-forgejo.md",
+            name: "chant-forgejo",
+            description: "Forgejo / Codeberg / Gitea Actions with chant — build, the dialect (dropped keys, runner labels, uses: resolution), and github→forgejo migration",
+            triggers: [
+                { type: "file-pattern", value: "**/.forgejo/workflows/*.yml" },
+                { type: "file-pattern", value: "**/.gitea/workflows/*.yml" },
+                { type: "context", value: "forgejo" },
+                { type: "context", value: "codeberg" },
+                { type: "context", value: "gitea" },
+            ],
+            parameters: [],
+            examples: [
+                {
+                    title: "Build a Forgejo workflow",
+                    description: "Author github-style; the forgejo dialect applies on build",
+                    input: "Create a CI workflow for Codeberg",
+                    output: `chant build src -o .forgejo/workflows/ci.yml`,
+                },
+            ],
+        },
+    ]),
+    // ── Codegen lifecycle — delegated to github (no own spec) ──────────
+    async generate() {
+        console.error(reuseNote);
+    },
+    async validate() {
+        console.error("All checks passed.");
+    },
+    async coverage() {
+        console.error(reuseNote);
+    },
+    // Packaging is real (unlike generate/validate/coverage above): forgejo
+    // ships its own dist/manifest.json — an empty resource catalog plus its
+    // own post-synth checks and skill — even though the catalog it packages
+    // is empty. See ./codegen/{generate,package}.ts.
+    async package(options) {
+        const { packageLexicon } = await import("./codegen/package.js");
+        const { writeBundleSpec } = await import("@intentius/chant/codegen/package");
+        const { join: pathJoin, dirname: pathDirname } = await import("path");
+        const { fileURLToPath: toPath } = await import("url");
+        const { spec, stats } = await packageLexicon(options);
+        const pkgDir = pathDirname(pathDirname(toPath(import.meta.url)));
+        writeBundleSpec(spec, pathJoin(pkgDir, "dist"));
+        console.error(`Packaged ${stats.resources} resources, ${stats.ruleCount} rules, ${stats.skillCount} skills`);
+    },
+    async docs(options) {
+        const { generateDocs } = await import("./codegen/docs.js");
+        return generateDocs(options);
+    },
+};

package/dist/serializer.js

@@ -0,0 +1,50 @@
+/**
+ * Forgejo Actions YAML serializer.
+ *
+ * A thin dialect of the github serializer: it applies the Forgejo dialect
+ * (see ./dialect) to the entity graph, then delegates emission to the github
+ * serializer, which already produces GitHub-Actions-compatible YAML — exactly
+ * what Forgejo / Codeberg / Gitea runners execute.
+ *
+ * The serializer's `name` is "github" on purpose: github-lexicon entities are
+ * tagged `lexicon: "github"`, and the build pipeline partitions and looks up
+ * serializers by that tag. A forgejo project loads only this serializer, so it
+ * claims that partition. The distinct `rulePrefix` ("WFJ") keeps Forgejo lint
+ * diagnostics namespaced apart from github's "GHA".
+ */
+import { githubSerializer } from "@intentius/chant-lexicon-github";
+import { applyForgejoDialect } from "./dialect.js";
+/** Extract forgejo dialect options from the resolved project config, if any. */
+function readForgejoOptions(config) {
+    const forgejo = config?.forgejo;
+    if (!forgejo || typeof forgejo !== "object")
+        return {};
+    const obj = forgejo;
+    const options = {};
+    if (obj.runnerLabels && typeof obj.runnerLabels === "object") {
+        options.runnerLabels = obj.runnerLabels;
+    }
+    if (typeof obj.actionsRoot === "string") {
+        options.actionsRoot = obj.actionsRoot;
+    }
+    return options;
+}
+/**
+ * Forgejo Actions YAML serializer implementation.
+ */
+export const forgejoSerializer = {
+    name: "github",
+    rulePrefix: "WFJ",
+    serialize(entities, outputs, context) {
+        const options = readForgejoOptions(context?.config);
+        const { entities: transformed, warnings } = applyForgejoDialect(entities, options);
+        const result = githubSerializer.serialize(transformed, outputs, context);
+        if (typeof result === "string") {
+            return warnings.length > 0 ? { primary: result, warnings } : result;
+        }
+        return {
+            ...result,
+            warnings: [...(result.warnings ?? []), ...warnings],
+        };
+    },
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-forgejo",
-  "version": "0.124.31",
+  "version": "0.124.33",
   "description": "Forgejo / Codeberg / Gitea Actions lexicon for chant — a thin GitHub Actions dialect",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -34,17 +34,17 @@
     ".": {
       "development": "./src/index.ts",
       "types": "./dist/index.d.ts",
-      "default": "./src/index.ts"
+      "default": "./dist/index.js"
     },
     "./*": {
       "development": "./src/*.ts",
       "types": "./dist/*.d.ts",
-      "default": "./src/*.ts"
+      "default": "./dist/*.js"
     },
     "./lint/post-synth": {
       "development": "./src/lint/post-synth/index.ts",
       "types": "./dist/lint/post-synth/index.d.ts",
-      "default": "./src/lint/post-synth/index.ts"
+      "default": "./dist/lint/post-synth/index.js"
     }
   },
   "devDependencies": {
@@ -54,14 +54,14 @@
   },
   "peerDependencies": {
     "zod": "^4.3.6",
-    "@intentius/chant": "^0.124.31",
-    "@intentius/chant-lexicon-github": "^0.124.31"
+    "@intentius/chant": "^0.124.33",
+    "@intentius/chant-lexicon-github": "^0.124.33"
   },
   "scripts": {
     "generate": "tsx src/codegen/generate-cli.ts",
     "bundle": "tsx src/codegen/package-cli.ts",
     "docs": "tsx src/codegen/docs-cli.ts",
     "prepack": "npm run generate && npm run bundle && npm run build",
-    "build": "../../scripts/tsc7.sh -p tsconfig.build.json && tsc-alias -p tsconfig.build.json && find dist -type f \\( -name \"*.js\" -o -name \"*.js.map\" \\) -delete"
+    "build": "../../scripts/tsc7.sh -p tsconfig.build.json --sourceMap false && tsc-alias -p tsconfig.build.json"
   }
 }

package/src/codegen/package.ts

@@ -10,7 +10,7 @@
 import { readFileSync } from "fs";
 import { forgejoPlugin } from "../plugin";
 import { join, dirname } from "path";
-import { fileURLToPath } from "url";
+import { moduleSourceDir } from "@intentius/chant/module-source";
 import {
   packagePipeline,
   collectSkills,
@@ -23,7 +23,7 @@ export type { PackageOptions, PackageResult };
 
 // package.ts is at src/codegen/package.ts — 2 dirname calls reach src/
 // then join(pkgDir, "..") is the package root where package.json lives
-const pkgDir = dirname(dirname(fileURLToPath(import.meta.url)));
+const pkgDir = dirname(moduleSourceDir(import.meta.url));
 
 /**
  * Package the Forgejo lexicon into a distributable BundleSpec.

package/src/components/__fixtures__/pr-loop-build.forgejo.golden.yml

@@ -30,7 +30,8 @@ jobs:
           BASE_SHA: '${{ github.event.pull_request.base.sha }}'
           PR_NUMBER: '${{ github.event.pull_request.number }}'
           GITHUB_TOKEN: '${{ github.token }}'
-        run: chant components pr-plan --base "$BASE_SHA" --pr "$PR_NUMBER" --env prod --gate pr-apply --output .chant/pr --forge forgejo
+          CHANT_RUNNER_KEY: '${{ secrets.CHANT_RUNNER_KEY }}'
+        run: chant ci run plan --in-place --no-push --base "$BASE_SHA" --pr "$PR_NUMBER" --env prod --gate pr-apply --forge forgejo
       - name: Keep the plan report
         if: always()
         uses: https://code.forgejo.org/actions/upload-artifact@v3
@@ -64,7 +65,10 @@ jobs:
         env:
           BASE_SHA: '${{ github.event.before }}'
           GITHUB_TOKEN: '${{ github.token }}'
-        run: chant components pr-apply --base "$BASE_SHA" --env prod --gate pr-apply --output .chant/pr --forge forgejo --require-review --resume .chant/pr-resume/pr-apply.json
+          CHANT_RUNNER_KEY: '${{ secrets.CHANT_RUNNER_KEY }}'
+        run: |
+          if [ -z "$BASE_SHA" ] || [ "$BASE_SHA" = "0000000000000000000000000000000000000000" ]; then git fetch origin "main" && BASE_SHA="$(git merge-base FETCH_HEAD "$GITHUB_SHA")"; if [ "$BASE_SHA" = "$GITHUB_SHA" ]; then BASE_SHA="$(git rev-parse --verify --quiet "$GITHUB_SHA^" || echo 4b825dc642cb6eb9a060e54bf8d69288fbee4904)"; fi; fi; export BASE_SHA
+          chant ci run apply --in-place --base "$BASE_SHA" --env prod --gate pr-apply --forge forgejo
       - name: Keep the record for a re-run
         if: always()
         uses: https://code.forgejo.org/actions/cache/save@v4

package/src/components/__fixtures__/pr-loop-record.forgejo.golden.yml

@@ -0,0 +1,64 @@
+name: chant-pr-prod
+
+on:
+  pull_request:
+    branches:
+      - main
+  push:
+    branches:
+      - main
+
+env:
+  CHANT_ENV: prod
+
+jobs:
+  plan:
+    if: github.event_name == 'pull_request'
+    runs-on: docker
+    container: node:22
+    steps:
+      - uses: https://code.forgejo.org/actions/checkout@v7
+        with:
+          fetch-depth: 0
+      - run: command -v tofu >/dev/null 2>&1 || (curl -fsSL https://get.opentofu.org/install-opentofu.sh -o /tmp/install-opentofu.sh && sh /tmp/install-opentofu.sh --install-method standalone)
+      - name: Plan the members this pull request reaches
+        env:
+          BASE_SHA: '${{ github.event.pull_request.base.sha }}'
+          PR_NUMBER: '${{ github.event.pull_request.number }}'
+          GITHUB_TOKEN: '${{ github.token }}'
+          CHANT_RUNNER_KEY: '${{ secrets.CHANT_RUNNER_KEY }}'
+        run: chant ci run plan --in-place --no-push --base "$BASE_SHA" --pr "$PR_NUMBER" --env prod --gate pr-apply --forge forgejo
+      - name: Keep the plan report
+        if: always()
+        uses: https://code.forgejo.org/actions/upload-artifact@v3
+        with:
+          name: chant-pr-plan
+          path: .chant/pr
+          if-no-files-found: ignore
+  record:
+    if: github.event_name == 'push'
+    runs-on: docker
+    container: node:22
+    concurrency:
+      group: chant-record-prod
+      cancel-in-progress: false
+    steps:
+      - uses: https://code.forgejo.org/actions/checkout@v7
+        with:
+          fetch-depth: 0
+      - run: command -v tofu >/dev/null 2>&1 || (curl -fsSL https://get.opentofu.org/install-opentofu.sh -o /tmp/install-opentofu.sh && sh /tmp/install-opentofu.sh --install-method standalone)
+      - name: Record the plan on the merged commit; nothing applies
+        env:
+          BASE_SHA: '${{ github.event.before }}'
+          GITHUB_TOKEN: '${{ github.token }}'
+          CHANT_RUNNER_KEY: '${{ secrets.CHANT_RUNNER_KEY }}'
+        run: |
+          if [ -z "$BASE_SHA" ] || [ "$BASE_SHA" = "0000000000000000000000000000000000000000" ]; then git fetch origin "main" && BASE_SHA="$(git merge-base FETCH_HEAD "$GITHUB_SHA")"; if [ "$BASE_SHA" = "$GITHUB_SHA" ]; then BASE_SHA="$(git rev-parse --verify --quiet "$GITHUB_SHA^" || echo 4b825dc642cb6eb9a060e54bf8d69288fbee4904)"; fi; fi; export BASE_SHA
+          chant ci run record --in-place --base "$BASE_SHA" --env prod --gate pr-apply --forge forgejo
+      - name: Keep the record report
+        if: always()
+        uses: https://code.forgejo.org/actions/upload-artifact@v3
+        with:
+          name: chant-pr-record
+          path: .chant/pr
+          if-no-files-found: ignore