@intentius/chant-lexicon-forgejo 0.124.44 → 0.124.45

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "d5b652db2a12a8d27befefb71ad5decf40894ddfb4dcd07d382cffc8edc62e12",
+    "manifest.json": "c1a68237e53c0382fc13d60e8e3d70af752df98f9bb686edf451cf9a9fc07483",
     "meta.json": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
     "types/index.d.ts": "66204549b2a864ab5489e3f02c1878e73ab4b3c9d938cfb480b66f71543a43de",
     "rules/delegate-to-github.ts": "1060cda40f4b73d6cca3ba3fa13b80b4886147d4034c88584c2d80c5510dbe5e",
@@ -9,5 +9,5 @@
     "rules/wfj011.ts": "fcb8bf6685d744af20ad804ce929488257995c74b9a3353b2eacae3768d1c83e",
     "skills/chant-forgejo.md": "f28d7fb69fb1cfd992496ef41fda0ea5ccd54a29b84ea1c501a44f6a3992c4d5"
   },
-  "composite": "15afe2fbb23a600c1a17fca0a7f0002ede58d9df9081a4f4be4192c89eded17f"
+  "composite": "5c3c74f908805d79a782b469e02b1c59fdf0dae91105a4df9e6626dc704a9f17"
 }

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "forgejo",
-  "version": "0.124.44",
+  "version": "0.124.45",
   "chantVersion": ">=0.1.0",
   "namespace": "Forgejo",
   "intrinsics": [],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-forgejo",
-  "version": "0.124.44",
+  "version": "0.124.45",
   "description": "Forgejo / Codeberg / Gitea Actions lexicon for chant — a thin GitHub Actions dialect",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -54,8 +54,8 @@
   },
   "peerDependencies": {
     "zod": "^4.3.6",
-    "@intentius/chant": "^0.124.44",
-    "@intentius/chant-lexicon-github": "^0.124.44"
+    "@intentius/chant": "^0.124.45",
+    "@intentius/chant-lexicon-github": "^0.124.45"
   },
   "scripts": {
     "generate": "tsx src/codegen/generate-cli.ts",

package/src/components/generate-op-waves-pipeline.test.ts

@@ -103,3 +103,20 @@ describe("a runner per wave and job groups per wave (#3914)", () => {
     expect(() => generateForgejoOpWavesPipeline({ ...grouped, waves: [{ ...grouped.waves[0]!, runner: { group: "x" } }] }, { specFile: "waves.json" })).toThrow(/wave "dev" runner is the runner group/);
   });
 });
+
+describe("an Op wave's jobs by cloud identity (#4332)", () => {
+  test("the dialect keeps id-token: write, and each job trades before its checkout", async () => {
+    const { parseYAML } = await import("@intentius/chant/yaml");
+    const { cloudIdentityWave, TRADE_SPEC_ENV } = await import("@intentius/chant/ci-identity");
+    const decl = { aws: { rules: [{ targets: ["a/**"], plan: "a-plan", apply: "a-apply" }, { plan: "own-plan", apply: "own-apply" }] } };
+    const roots = ["a/x", "b/y"];
+    const grouped: OpWavesSpec = { ...spec, waves: [{ name: "prod", runs: roots.map((target) => ({ target })), ...cloudIdentityWave(decl, "prod", undefined, roots) }] };
+    const { jobs } = parseYAML(generateForgejoOpWavesPipeline(grouped, { specFile: "waves.json" }).files[0]!.yaml) as { jobs: Record<string, { permissions?: Record<string, string>; steps: Array<{ uses?: string; env?: Record<string, string> }> }> };
+    expect(Object.keys(jobs)).toEqual(["wave-1-prod-decide", "wave-1-prod-a", "wave-1-prod-default"]);
+    for (const job of Object.values(jobs)) {
+      expect(job.permissions).toEqual({ "id-token": "write" });
+      expect(job.steps[0]!.env![TRADE_SPEC_ENV]).toBeDefined();
+      expect(job.steps[1]!.uses).toContain("checkout");
+    }
+  });
+});