@intentius/chant-lexicon-forgejo 0.124.31 → 0.124.33

package/src/components/__fixtures__/pr-loop-waves.forgejo.golden.yml

@@ -0,0 +1,117 @@
+name: chant-pr-prod
+
+on:
+  pull_request:
+    branches:
+      - main
+  push:
+    branches:
+      - main
+
+env:
+  CHANT_ENV: prod
+
+jobs:
+  plan:
+    if: github.event_name == 'pull_request'
+    runs-on: docker
+    container: node:22
+    steps:
+      - uses: https://code.forgejo.org/actions/checkout@v7
+        with:
+          fetch-depth: 0
+      - run: command -v tofu >/dev/null 2>&1 || (curl -fsSL https://get.opentofu.org/install-opentofu.sh -o /tmp/install-opentofu.sh && sh /tmp/install-opentofu.sh --install-method standalone)
+      - name: Plan the members this pull request reaches
+        env:
+          BASE_SHA: '${{ github.event.pull_request.base.sha }}'
+          PR_NUMBER: '${{ github.event.pull_request.number }}'
+          GITHUB_TOKEN: '${{ github.token }}'
+          CHANT_RUNNER_KEY: '${{ secrets.CHANT_RUNNER_KEY }}'
+        run: chant ci run plan --in-place --no-push --base "$BASE_SHA" --pr "$PR_NUMBER" --env prod --gate pr-apply --forge forgejo --wave-gate release
+      - name: Keep the plan report
+        if: always()
+        uses: https://code.forgejo.org/actions/upload-artifact@v3
+        with:
+          name: chant-pr-plan
+          path: .chant/pr
+          if-no-files-found: ignore
+  apply-wave-1:
+    if: github.event_name == 'push'
+    runs-on: docker
+    container: node:22
+    concurrency:
+      group: chant-apply-prod
+      cancel-in-progress: false
+    steps:
+      - uses: https://code.forgejo.org/actions/checkout@v7
+        with:
+          fetch-depth: 0
+      - run: command -v tofu >/dev/null 2>&1 || (curl -fsSL https://get.opentofu.org/install-opentofu.sh -o /tmp/install-opentofu.sh && sh /tmp/install-opentofu.sh --install-method standalone)
+      - name: Restore the newest record of this commit's apply
+        uses: https://code.forgejo.org/actions/cache/restore@v4
+        with:
+          path: .chant/pr-resume/pr-apply.json
+          key: chant-apply-prod-${{ github.sha }}-${{ github.run_id }}-${{ github.run_attempt }}-wave-1
+          restore-keys: chant-apply-prod-${{ github.sha }}-
+      - name: Apply wave 1, under the approval its plan has
+        env:
+          BASE_SHA: '${{ github.event.before }}'
+          GITHUB_TOKEN: '${{ github.token }}'
+          CHANT_RUNNER_KEY: '${{ secrets.CHANT_RUNNER_KEY }}'
+        run: |
+          if [ -z "$BASE_SHA" ] || [ "$BASE_SHA" = "0000000000000000000000000000000000000000" ]; then git fetch origin "main" && BASE_SHA="$(git merge-base FETCH_HEAD "$GITHUB_SHA")"; if [ "$BASE_SHA" = "$GITHUB_SHA" ]; then BASE_SHA="$(git rev-parse --verify --quiet "$GITHUB_SHA^" || echo 4b825dc642cb6eb9a060e54bf8d69288fbee4904)"; fi; fi; export BASE_SHA
+          chant ci run apply --in-place --base "$BASE_SHA" --env prod --gate pr-apply --forge forgejo --wave-gate release --wave 1
+      - name: Keep the record for the next wave and a re-run
+        if: always()
+        uses: https://code.forgejo.org/actions/cache/save@v4
+        with:
+          path: .chant/pr-resume/pr-apply.json
+          key: chant-apply-prod-${{ github.sha }}-${{ github.run_id }}-${{ github.run_attempt }}-wave-1
+      - name: Keep the wave 1 apply report
+        if: always()
+        uses: https://code.forgejo.org/actions/upload-artifact@v3
+        with:
+          name: chant-pr-apply-wave-1
+          path: .chant/pr
+          if-no-files-found: ignore
+  apply-wave-2:
+    if: github.event_name == 'push'
+    runs-on: docker
+    needs:
+      - apply-wave-1
+    container: node:22
+    concurrency:
+      group: chant-apply-prod
+      cancel-in-progress: false
+    steps:
+      - uses: https://code.forgejo.org/actions/checkout@v7
+        with:
+          fetch-depth: 0
+      - run: command -v tofu >/dev/null 2>&1 || (curl -fsSL https://get.opentofu.org/install-opentofu.sh -o /tmp/install-opentofu.sh && sh /tmp/install-opentofu.sh --install-method standalone)
+      - name: Restore the newest record of this commit's apply
+        uses: https://code.forgejo.org/actions/cache/restore@v4
+        with:
+          path: .chant/pr-resume/pr-apply.json
+          key: chant-apply-prod-${{ github.sha }}-${{ github.run_id }}-${{ github.run_attempt }}-wave-2
+          restore-keys: chant-apply-prod-${{ github.sha }}-
+      - name: Apply wave 2, under the approval its plan has
+        env:
+          BASE_SHA: '${{ github.event.before }}'
+          GITHUB_TOKEN: '${{ github.token }}'
+          CHANT_RUNNER_KEY: '${{ secrets.CHANT_RUNNER_KEY }}'
+        run: |
+          if [ -z "$BASE_SHA" ] || [ "$BASE_SHA" = "0000000000000000000000000000000000000000" ]; then git fetch origin "main" && BASE_SHA="$(git merge-base FETCH_HEAD "$GITHUB_SHA")"; if [ "$BASE_SHA" = "$GITHUB_SHA" ]; then BASE_SHA="$(git rev-parse --verify --quiet "$GITHUB_SHA^" || echo 4b825dc642cb6eb9a060e54bf8d69288fbee4904)"; fi; fi; export BASE_SHA
+          chant ci run apply --in-place --base "$BASE_SHA" --env prod --gate pr-apply --forge forgejo --wave-gate release --wave 2
+      - name: Keep the record for the next wave and a re-run
+        if: always()
+        uses: https://code.forgejo.org/actions/cache/save@v4
+        with:
+          path: .chant/pr-resume/pr-apply.json
+          key: chant-apply-prod-${{ github.sha }}-${{ github.run_id }}-${{ github.run_attempt }}-wave-2
+      - name: Keep the wave 2 apply report
+        if: always()
+        uses: https://code.forgejo.org/actions/upload-artifact@v3
+        with:
+          name: chant-pr-apply-wave-2
+          path: .chant/pr
+          if-no-files-found: ignore

package/src/components/__fixtures__/pr-loop.forgejo.golden.yml

@@ -26,7 +26,8 @@ jobs:
           BASE_SHA: '${{ github.event.pull_request.base.sha }}'
           PR_NUMBER: '${{ github.event.pull_request.number }}'
           GITHUB_TOKEN: '${{ github.token }}'
-        run: chant components pr-plan --base "$BASE_SHA" --pr "$PR_NUMBER" --env prod --gate pr-apply --output .chant/pr --forge forgejo
+          CHANT_RUNNER_KEY: '${{ secrets.CHANT_RUNNER_KEY }}'
+        run: chant ci run plan --in-place --no-push --base "$BASE_SHA" --pr "$PR_NUMBER" --env prod --gate pr-apply --forge forgejo
       - name: Keep the plan report
         if: always()
         uses: https://code.forgejo.org/actions/upload-artifact@v3
@@ -56,7 +57,10 @@ jobs:
         env:
           BASE_SHA: '${{ github.event.before }}'
           GITHUB_TOKEN: '${{ github.token }}'
-        run: chant components pr-apply --base "$BASE_SHA" --env prod --gate pr-apply --output .chant/pr --forge forgejo --require-review --resume .chant/pr-resume/pr-apply.json
+          CHANT_RUNNER_KEY: '${{ secrets.CHANT_RUNNER_KEY }}'
+        run: |
+          if [ -z "$BASE_SHA" ] || [ "$BASE_SHA" = "0000000000000000000000000000000000000000" ]; then git fetch origin "main" && BASE_SHA="$(git merge-base FETCH_HEAD "$GITHUB_SHA")"; if [ "$BASE_SHA" = "$GITHUB_SHA" ]; then BASE_SHA="$(git rev-parse --verify --quiet "$GITHUB_SHA^" || echo 4b825dc642cb6eb9a060e54bf8d69288fbee4904)"; fi; fi; export BASE_SHA
+          chant ci run apply --in-place --base "$BASE_SHA" --env prod --gate pr-apply --forge forgejo
       - name: Keep the record for a re-run
         if: always()
         uses: https://code.forgejo.org/actions/cache/save@v4

package/src/components/generate-pr-pipeline.test.ts

@@ -14,6 +14,7 @@ import { describe, expect, test } from "vitest";
 import { parseYAML } from "@intentius/chant/yaml";
 import type { DriverComponent } from "@intentius/chant/components/driver";
 import { generateGithubPipeline } from "@intentius/chant-lexicon-github/components/generate-pipeline";
+import { githubBaseFallback } from "@intentius/chant/components/pr-pipeline";
 import { generateForgejoPipeline } from "./generate-pipeline";
 
 const ESTATE: DriverComponent[] = [
@@ -33,13 +34,19 @@ function hasActionlint(): boolean {
 }
 
 describe("the Forgejo pull-request workflow", () => {
-  const result = generateForgejoPipeline(ESTATE, { env: "prod", prLoop: {} });
+  const result = generateForgejoPipeline(ESTATE, { env: "prod", prLoop: { applyOnMerge: true } });
 
   test("matches its golden", () => {
     if (process.env.UPDATE_GOLDEN) writeFileSync(GOLDEN, result.yaml);
     expect(result.yaml).toBe(readFileSync(GOLDEN, "utf-8"));
   });
 
+  test("both jobs run chant ci run with the runner key secret, as on GitHub (#4156)", () => {
+    expect(result.yaml).toContain("chant ci run plan --in-place --no-push");
+    expect(result.yaml.match(/CHANT_RUNNER_KEY: '\$\{\{ secrets\.CHANT_RUNNER_KEY \}\}'/g)).toHaveLength(2);
+    expect(result.yaml).not.toContain("chant components pr-");
+  });
+
   test("its commands talk to Forgejo, on Forgejo's runner, with the job permissions dropped", () => {
     expect(result.yaml).toContain("--forge forgejo");
     expect(result.yaml).not.toContain("--forge github");
@@ -47,8 +54,17 @@ describe("the Forgejo pull-request workflow", () => {
     expect(result.yaml).not.toMatch(/^\s*permissions:/m);
   });
 
+  test("a first push's all-zero github.event.before is settled before pr-apply reads it, as on GitHub (#4004)", () => {
+    const doc = parseYAML(result.yaml) as { jobs: Record<string, { steps: Array<{ run?: string }> }> };
+    const apply = doc.jobs.apply!.steps.find((s) => s.run?.includes("ci run apply"))!.run!.trimEnd().split("\n");
+    expect(apply[0]).toBe(githubBaseFallback());
+    expect(apply[0]).toContain('git merge-base FETCH_HEAD "$GITHUB_SHA"');
+    expect(apply[1]).toMatch(/^chant ci run apply --in-place --base "\$BASE_SHA"/);
+    expect(doc.jobs.plan!.steps.find((s) => s.run?.includes("ci run plan"))!.run).not.toContain("0000000000000000000000000000000000000000");
+  });
+
   test("events and reportUrl reach Forgejo's jobs as they reach GitHub's (#4007)", () => {
-    const yaml = generateForgejoPipeline(ESTATE, { env: "prod", prLoop: { events: true, reportUrl: "file:///srv/chant-reports" } }).yaml;
+    const yaml = generateForgejoPipeline(ESTATE, { env: "prod", prLoop: { applyOnMerge: true, events: true, reportUrl: "file:///srv/chant-reports" } }).yaml;
     expect(yaml.match(/--forge forgejo --events-json --report-url "file:\/\/\/srv\/chant-reports"/g)).toHaveLength(2);
     expect(yaml.match(/CHANT_RUN_EVENTS_DIR: \.chant\/pr\/run-events/g)).toHaveLength(2);
   });
@@ -56,7 +72,8 @@ describe("the Forgejo pull-request workflow", () => {
   test("the apply keeps its resume record in the runner's cache, through the Forgejo mirror of actions/cache (#3543)", () => {
     expect(result.yaml).toContain("uses: https://code.forgejo.org/actions/cache/restore@v4");
     expect(result.yaml).toContain("uses: https://code.forgejo.org/actions/cache/save@v4");
-    expect(result.yaml).toContain("--forge forgejo --require-review --resume .chant/pr-resume/pr-apply.json");
+    // ci run's inner pr-apply resumes from it (#4156): the job runs in place, where the cache restored it.
+    expect(result.yaml).toContain("chant ci run apply --in-place --base");
   });
 
   test("keeps its reports with upload-artifact v3, the version a Forgejo runner runs, while GitHub keeps v4 (#4008)", () => {
@@ -66,7 +83,7 @@ describe("the Forgejo pull-request workflow", () => {
     // v3 uploads hidden files with no input asking for it, so .chant/pr is still kept.
     expect(result.yaml).not.toContain("include-hidden-files");
     expect(result.yaml).toContain("path: .chant/pr");
-    const github = generateGithubPipeline(ESTATE, { env: "prod", prLoop: {} }).yaml;
+    const github = generateGithubPipeline(ESTATE, { env: "prod", prLoop: { applyOnMerge: true } }).yaml;
     expect(github.match(/uses: actions\/upload-artifact@v4$/gm)).toHaveLength(2);
     expect(github).toContain("include-hidden-files: true");
   });
@@ -87,7 +104,7 @@ describe("the Forgejo pull-request workflow", () => {
 });
 
 describe("the forgejo pull-request pipeline with build (#4088)", () => {
-  const result = generateForgejoPipeline(ESTATE, { env: "prod", prLoop: { build: true } });
+  const result = generateForgejoPipeline(ESTATE, { env: "prod", prLoop: { applyOnMerge: true, build: true } });
   const doc = parseYAML(result.yaml) as Record<string, any>;
   const golden = join(import.meta.dirname, "__fixtures__", "pr-loop-build.forgejo.golden.yml");
 
@@ -105,14 +122,31 @@ describe("the forgejo pull-request pipeline with build (#4088)", () => {
   });
 
   test("buildCommand replaces the build line and turns the option on", () => {
-    const yaml = generateForgejoPipeline(ESTATE, { env: "prod", prLoop: { buildCommand: "npm run build" } }).yaml;
+    const yaml = generateForgejoPipeline(ESTATE, { env: "prod", prLoop: { applyOnMerge: true, buildCommand: "npm run build" } }).yaml;
     expect(yaml).toContain("npm run build");
     expect(yaml).not.toContain("chant build --env");
     expect(yaml).toContain("chant lint");
   });
 
   test("the default output carries neither line", () => {
-    const plain = generateForgejoPipeline(ESTATE, { env: "prod", prLoop: {} }).yaml;
+    const plain = generateForgejoPipeline(ESTATE, { env: "prod", prLoop: { applyOnMerge: true } }).yaml;
     expect(plain).not.toContain("chant lint");
   });
 });
+
+describe("the Forgejo pull-request workflow records on merge by default (#4168)", () => {
+  const result = generateForgejoPipeline(ESTATE, { env: "prod", prLoop: {} });
+  const golden = join(import.meta.dirname, "__fixtures__", "pr-loop-record.forgejo.golden.yml");
+
+  test("matches its golden", () => {
+    if (process.env.UPDATE_GOLDEN) writeFileSync(golden, result.yaml);
+    expect(result.yaml).toBe(readFileSync(golden, "utf-8"));
+  });
+
+  test("a push runs ci run record against Forgejo, and nothing applies", () => {
+    expect(result.jobs.map((j) => j.jobName)).toEqual(["plan", "record"]);
+    expect(result.yaml).toContain('chant ci run record --in-place --base "$BASE_SHA" --env prod --gate pr-apply --forge forgejo');
+    expect(result.yaml).not.toContain("ci run apply");
+    expect(result.yaml).toContain("group: chant-record-prod");
+  });
+});

package/src/components/generate-pr-waves-pipeline.test.ts

@@ -0,0 +1,42 @@
+/**
+ * The Forgejo pull-request workflow with a gate per wave on merge (#4003):
+ * github's wave jobs with the Forgejo dialect applied and the commands
+ * talking to Forgejo. The whole file has a golden.
+ */
+
+import { readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { describe, expect, test } from "vitest";
+import { parseYAML } from "@intentius/chant/yaml";
+import type { DriverComponent } from "@intentius/chant/components/driver";
+import { generateForgejoPipeline } from "./generate-pipeline";
+
+const root = (name: string, dependsOn: string[] = []): DriverComponent => ({
+  name,
+  dependsOn,
+  deploy: [{ phase: "Apply", steps: [{ kind: "terraform-apply", root: name }] }],
+});
+const ESTATE: DriverComponent[] = [root("net"), root("app", ["net"])];
+
+const GOLDEN = join(import.meta.dirname, "__fixtures__", "pr-loop-waves.forgejo.golden.yml");
+
+describe("the Forgejo pull-request workflow with a gate per wave (#4003)", () => {
+  const result = generateForgejoPipeline(ESTATE, { env: "prod", prLoop: { applyOnMerge: true }, gatedWaves: { gate: "release" } });
+  const doc = parseYAML(result.yaml) as { jobs: Record<string, { needs?: string[]; "runs-on": string; steps: Array<{ run?: string; uses?: string }> }> };
+
+  test("matches its golden", () => {
+    if (process.env.UPDATE_GOLDEN) writeFileSync(GOLDEN, result.yaml);
+    expect(result.yaml).toBe(readFileSync(GOLDEN, "utf-8"));
+  });
+
+  test("an apply job per wave on Forgejo's runner, each passing its wave and talking to Forgejo", () => {
+    expect(Object.keys(doc.jobs)).toEqual(["plan", "apply-wave-1", "apply-wave-2"]);
+    expect(doc.jobs["apply-wave-2"]!.needs).toEqual(["apply-wave-1"]);
+    for (const k of [1, 2]) {
+      const job = doc.jobs[`apply-wave-${k}`]!;
+      expect(job["runs-on"]).toBe("docker");
+      expect(job.steps.find((s) => s.run?.includes("ci run apply"))!.run).toContain(`--forge forgejo --wave-gate release --wave ${k}`);
+      expect(job.steps.some((s) => s.uses === "https://code.forgejo.org/actions/cache/restore@v4")).toBe(true);
+    }
+  });
+});