@intentius/chant-lexicon-forgejo 0.124.46 → 0.124.48

package/dist/actions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"actions.d.ts","sourceRoot":"","sources":["../src/actions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,6BAA6B,CAAC;AAE/D;;;;;GAKG;AACH,MAAM,MAAM,YAAY,GACpB;IACE,IAAI,EAAE,QAAQ,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,GACD;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjC;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,OAAO,CAAC;AAE7C,kFAAkF;AAClF,eAAO,MAAM,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAkBtD,CAAC;AAEF,MAAM,WAAW,oBAAoB;IACnC,2EAA2E;IAC3E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,+DAA+D;IAC/D,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;CACtC;AAED,MAAM,WAAW,mBAAmB;IAClC,gDAAgD;IAChD,SAAS,EAAE,MAAM,CAAC;IAClB,4EAA4E;IAC5E,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAaD;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,GAAE,oBAAyB,GAAG,mBAAmB,CA4BrG"}
+{"version":3,"file":"actions.d.ts","sourceRoot":"","sources":["../src/actions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,6BAA6B,CAAC;AAE/D;;;;;GAKG;AACH,MAAM,MAAM,YAAY,GACpB;IACE,IAAI,EAAE,QAAQ,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,GACD;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjC;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,OAAO,CAAC;AAE7C,kFAAkF;AAClF,eAAO,MAAM,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAkBtD,CAAC;AAEF,MAAM,WAAW,oBAAoB;IACnC,2EAA2E;IAC3E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,+DAA+D;IAC/D,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;CACtC;AAED,MAAM,WAAW,mBAAmB;IAClC,gDAAgD;IAChD,SAAS,EAAE,MAAM,CAAC;IAClB,4EAA4E;IAC5E,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAaD;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,GAAE,oBAAyB,GAAG,mBAAmB,CA4BrG"}

package/dist/actions.js

@@ -9,6 +9,7 @@
  * The resolver rewrites a built-in set of common actions and reports anything it
  * can't place as a diagnostic (never dropping or silently passing it through).
  */
+import { pinAtMajor, pinMajor } from "@intentius/chant/action-pins";
 /**
  * Default actions root. `code.forgejo.org` hosts the Forgejo `actions/*` mirror
  * (checkout, setup-*, cache, upload/download-artifact, …). Override per project
@@ -75,10 +76,24 @@ export function resolveActionRef(ref, options = {}) {
     }
     const base = target.kind === "mirror" ? `${root}/${target.repo}` : target.url;
     const withSubpath = subpath ? `${base}/${subpath}` : base;
-    const pinned = target.kind === "mirror" && target.newest && laterMajor(version, target.newest) ? target.newest : version;
+    const pinned = target.kind === "mirror" && target.newest ? olderPin(version, target.newest) : version;
     const rewritten = pinned ? `${withSubpath}@${pinned}` : withSubpath;
     return { rewritten };
 }
+/**
+ * `version` held to `newest`: a tag of a later major becomes `newest`, and a
+ * pinned commit of a later major becomes the commit of `newest` in chant's pin
+ * table (the mirror carries the same commits as GitHub's). Anything else,
+ * including a commit the table does not know, passes through.
+ */
+function olderPin(version, newest) {
+    if (/^[0-9a-f]{40}$/.test(version)) {
+        const major = pinMajor(version);
+        const target = Number(newest.replace(/^v/, ""));
+        return major !== undefined && major > target ? (pinAtMajor(version, newest)?.sha ?? version) : version;
+    }
+    return laterMajor(version, newest) ? newest : version;
+}
 /** Whether `version` (`v4`, `v4.1.0`) names a later major than `newest` (`v3`). A SHA or branch never does. */
 function laterMajor(version, newest) {
     const major = (v) => {

package/dist/components/ci-jobs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ci-jobs.d.ts","sourceRoot":"","sources":["../../src/components/ci-jobs.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iEAAiE,CAAC;AAC3G,OAAO,EAA2B,KAAK,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAEjF,kEAAkE;AAClE,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,EAAE,qBAAqB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAElH;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAQ5F;AAED,0FAA0F;AAC1F,wBAAgB,wBAAwB,CAAC,eAAe,EAAE,MAAM,GAAG,MAAM,EAAE,CAQ1E;AAED,mHAAmH;AACnH,wBAAgB,6BAA6B,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,EAAE,CAOlF;AAED;;;;GAIG;AACH,eAAO,MAAM,eAAe;IAAK,iBAAiB;CAAqC,CAAC;AAExF;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,mBAAmB,EAAE,OAAO,EAAE,qBAAqB,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,GAAG,mBAAmB,CAYnI"}
+{"version":3,"file":"ci-jobs.d.ts","sourceRoot":"","sources":["../../src/components/ci-jobs.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iEAAiE,CAAC;AAC3G,OAAO,EAA2B,KAAK,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAEjF,kEAAkE;AAClE,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,EAAE,qBAAqB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAElH;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAQ5F;AAED,0FAA0F;AAC1F,wBAAgB,wBAAwB,CAAC,eAAe,EAAE,MAAM,GAAG,MAAM,EAAE,CAQ1E;AAED,mHAAmH;AACnH,wBAAgB,6BAA6B,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,EAAE,CAOlF;AAED;;;;GAIG;AACH,eAAO,MAAM,eAAe;IAAK,iBAAiB;CAAqC,CAAC;AAExF;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,mBAAmB,EAAE,OAAO,EAAE,qBAAqB,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,GAAG,mBAAmB,CAanI"}

package/dist/components/ci-jobs.js

@@ -67,5 +67,6 @@ export function forgejoWorkflowDoc(doc, dialect, header) {
         permissions: {},
         jobsDoc: forgejoize(withoutEnvironment(doc.jobsDoc), dialect),
         ...(doc.gatedNoticeDoc ? { gatedNoticeDoc: forgejoize(doc.gatedNoticeDoc, dialect) } : {}),
+        ...(doc.reviewNoteDoc ? { reviewNoteDoc: forgejoize(doc.reviewNoteDoc, dialect) } : {}),
     };
 }

package/dist/components/generate-pipeline.d.ts

@@ -14,7 +14,7 @@
  *
  *  - runner labels: `runs-on: ubuntu-latest` → the project's Forgejo label
  *    (default `docker`, the label a fresh `act_runner` exposes);
- *  - `uses:` refs (`actions/checkout@v4`, `actions/upload-artifact@v4`, …)
+ *  - `uses:` refs (`actions/checkout`, `actions/upload-artifact`, ...), each pinned by commit SHA,
  *    rewritten to a Forgejo-resolvable form;
  *  - keys the Forgejo runner ignores (`continue-on-error`, and `permissions` bar `id-token`)
  *    dropped (`permissions` keeps only `id-token`, which OIDC needs).

package/dist/components/generate-pipeline.js

@@ -14,7 +14,7 @@
  *
  *  - runner labels: `runs-on: ubuntu-latest` → the project's Forgejo label
  *    (default `docker`, the label a fresh `act_runner` exposes);
- *  - `uses:` refs (`actions/checkout@v4`, `actions/upload-artifact@v4`, …)
+ *  - `uses:` refs (`actions/checkout`, `actions/upload-artifact`, ...), each pinned by commit SHA,
  *    rewritten to a Forgejo-resolvable form;
  *  - keys the Forgejo runner ignores (`continue-on-error`, and `permissions` bar `id-token`)
  *    dropped (`permissions` keeps only `id-token`, which OIDC needs).

package/dist/dialect.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dialect.d.ts","sourceRoot":"","sources":["../src/dialect.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAMH,OAAO,EAAsC,KAAK,UAAU,EAAE,MAAM,6BAA6B,CAAC;AA4ClG;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAKxD,CAAC;AAEF,MAAM,WAAW,qBAAqB;IACpC,mFAAmF;IACnF,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,uEAAuE;IACvE,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,oBAAoB;IACnC,sEAAsE;IACtE,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAClC,iEAAiE;IACjE,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AA4GD,MAAM,WAAW,qBAAqB;IACpC,qEAAqE;IACrE,KAAK,EAAE,OAAO,CAAC;IACf,8EAA8E;IAC9E,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CACrC,GAAG,EAAE,OAAO,EACZ,OAAO,GAAE,qBAA0B,GAClC,qBAAqB,CAKvB;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,EACjC,OAAO,GAAE,qBAA0B,GAClC,oBAAoB,CAWtB"}
+{"version":3,"file":"dialect.d.ts","sourceRoot":"","sources":["../src/dialect.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAMH,OAAO,EAAsC,KAAK,UAAU,EAAE,MAAM,6BAA6B,CAAC;AA6ClG;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAKxD,CAAC;AAEF,MAAM,WAAW,qBAAqB;IACpC,mFAAmF;IACnF,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,uEAAuE;IACvE,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,oBAAoB;IACnC,sEAAsE;IACtE,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAClC,iEAAiE;IACjE,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AA8GD,MAAM,WAAW,qBAAqB;IACpC,qEAAqE;IACrE,KAAK,EAAE,OAAO,CAAC;IACf,8EAA8E;IAC9E,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CACrC,GAAG,EAAE,OAAO,EACZ,OAAO,GAAE,qBAA0B,GAClC,qBAAqB,CAKvB;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,EACjC,OAAO,GAAE,qBAA0B,GAClC,oBAAoB,CAWtB"}

package/dist/dialect.js

@@ -27,6 +27,7 @@
 // be `true`, so the two disagreed about a value carrying `false`. Core's also
 // accepts an entity a host built, which a local identity check cannot.
 import { isDeclarable, isResourceDeclarable } from "@intentius/chant/declarable";
+import { ACTION_PINS } from "@intentius/chant/action-pins";
 import { resolveActionRef } from "./actions.js";
 /**
  * Keys the Forgejo runner ignores. Emitting them is misleading (they look
@@ -149,7 +150,10 @@ const V4_ONLY_UPLOAD_INPUTS = new Set(["include-hidden-files", "overwrite"]);
 function dropV4OnlyArtifactInputs(step) {
     const uses = step.uses;
     const withs = step.with;
-    if (typeof uses !== "string" || !/\/actions\/upload-artifact@v3$/.test(uses))
+    if (typeof uses !== "string" || !/\/actions\/upload-artifact@(v3|[0-9a-f]{40})$/.test(uses))
+        return;
+    const at = uses.slice(uses.lastIndexOf("@") + 1);
+    if (at !== "v3" && at !== ACTION_PINS.uploadArtifact3.sha)
         return;
     if (withs === null || typeof withs !== "object" || Array.isArray(withs))
         return;

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "bab8105ec4c4a11121357a47b4e9354aca5f997e2b424a2e3875cae490402ddb",
+    "manifest.json": "7c92f5067d6618de827a23091ad2f9af240116d15538747fb85788b8e8def0cd",
     "meta.json": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
     "types/index.d.ts": "66204549b2a864ab5489e3f02c1878e73ab4b3c9d938cfb480b66f71543a43de",
     "rules/delegate-to-github.ts": "1060cda40f4b73d6cca3ba3fa13b80b4886147d4034c88584c2d80c5510dbe5e",
@@ -9,5 +9,5 @@
     "rules/wfj011.ts": "fcb8bf6685d744af20ad804ce929488257995c74b9a3353b2eacae3768d1c83e",
     "skills/chant-forgejo.md": "f28d7fb69fb1cfd992496ef41fda0ea5ccd54a29b84ea1c501a44f6a3992c4d5"
   },
-  "composite": "8cc7f304df8b87f97c43a7ab871e160469064649b8d6206ae7d4f8be93035a47"
+  "composite": "82b94434307fc1e1a0ebc3522eb258fb67afdbf00f2e0ea55c22ef397d4bbf87"
 }

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "forgejo",
-  "version": "0.124.46",
+  "version": "0.124.48",
   "chantVersion": ">=0.1.0",
   "namespace": "Forgejo",
   "intrinsics": [],

package/dist/plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAoC,MAAM,0BAA0B,CAAC;AAqBhG,eAAO,MAAM,aAAa,EAAE,aAsM3B,CAAC"}
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAoC,MAAM,0BAA0B,CAAC;AAqBhG,eAAO,MAAM,aAAa,EAAE,aAuM3B,CAAC"}

package/dist/plugin.js

@@ -118,7 +118,8 @@ export const build = new Job({
             async transform(content, opts) {
                 const { transform } = await import("./migrate/from-github/index.js");
                 const result = await transform(content, {
-                    emit: opts.emit,
+                    // "sql" is for sql targets (#4399); chant migrate refuses it for this pair.
+                    emit: opts.emit === "sql" ? undefined : opts.emit,
                     sourceFile: opts.sourceFile,
                     strict: opts.strict,
                     security: opts.security,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-forgejo",
-  "version": "0.124.46",
+  "version": "0.124.48",
   "description": "Forgejo / Codeberg / Gitea Actions lexicon for chant — a thin GitHub Actions dialect",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -54,8 +54,8 @@
   },
   "peerDependencies": {
     "zod": "^4.3.6",
-    "@intentius/chant": "^0.124.46",
-    "@intentius/chant-lexicon-github": "^0.124.46"
+    "@intentius/chant": "^0.124.48",
+    "@intentius/chant-lexicon-github": "^0.124.48"
   },
   "scripts": {
     "generate": "tsx src/codegen/generate-cli.ts",

package/src/actions.ts

@@ -10,6 +10,8 @@
  * can't place as a diagnostic (never dropping or silently passing it through).
  */
 
+import { pinAtMajor, pinMajor } from "@intentius/chant/action-pins";
+
 /**
  * Default actions root. `code.forgejo.org` hosts the Forgejo `actions/*` mirror
  * (checkout, setup-*, cache, upload/download-artifact, …). Override per project
@@ -118,11 +120,26 @@ export function resolveActionRef(ref: string, options: ActionResolveOptions = {}
 
   const base = target.kind === "mirror" ? `${root}/${target.repo}` : target.url;
   const withSubpath = subpath ? `${base}/${subpath}` : base;
-  const pinned = target.kind === "mirror" && target.newest && laterMajor(version, target.newest) ? target.newest : version;
+  const pinned = target.kind === "mirror" && target.newest ? olderPin(version, target.newest) : version;
   const rewritten = pinned ? `${withSubpath}@${pinned}` : withSubpath;
   return { rewritten };
 }
 
+/**
+ * `version` held to `newest`: a tag of a later major becomes `newest`, and a
+ * pinned commit of a later major becomes the commit of `newest` in chant's pin
+ * table (the mirror carries the same commits as GitHub's). Anything else,
+ * including a commit the table does not know, passes through.
+ */
+function olderPin(version: string, newest: string): string {
+  if (/^[0-9a-f]{40}$/.test(version)) {
+    const major = pinMajor(version);
+    const target = Number(newest.replace(/^v/, ""));
+    return major !== undefined && major > target ? (pinAtMajor(version, newest)?.sha ?? version) : version;
+  }
+  return laterMajor(version, newest) ? newest : version;
+}
+
 /** Whether `version` (`v4`, `v4.1.0`) names a later major than `newest` (`v3`). A SHA or branch never does. */
 function laterMajor(version: string, newest: string): boolean {
   const major = (v: string): number | undefined => {

package/src/components/__fixtures__/pr-loop-build.forgejo.golden.yml

@@ -68,7 +68,6 @@ jobs:
         env:
           BASE_SHA: '${{ github.event.pull_request.base.sha }}'
           PR_NUMBER: '${{ github.event.pull_request.number }}'
-          CHANT_RUNNER_KEY: '${{ secrets.CHANT_RUNNER_KEY }}'
         run: |
           if [ -z "${CHANT_NO_FORGE_TOKEN:-}" ] && [ "${0#*/}" != "$0" ] && [ -f "$0" ] && ! { [ "${0##*/}" = sh ] || [ "${0##*/}" = bash ] || [ "${0##*/}" = dash ]; } && command -v env >/dev/null 2>&1 && command -v sh >/dev/null 2>&1; then exec env -u CHANT_FORGE_TOKEN -u CHANT_GITHUB_TOKEN -u CHANT_FORGEJO_TOKEN -u CHANT_GITLAB_TOKEN -u CHANT_CHECKOUT_TOKEN -u GITHUB_TOKEN -u GH_TOKEN -u FORGEJO_TOKEN -u GITEA_TOKEN -u GITLAB_TOKEN -u CI_JOB_TOKEN -u ACTIONS_RUNTIME_TOKEN CHANT_NO_FORGE_TOKEN=1 sh -e "$0"; fi; unset CHANT_FORGE_TOKEN CHANT_GITHUB_TOKEN CHANT_FORGEJO_TOKEN CHANT_GITLAB_TOKEN CHANT_CHECKOUT_TOKEN GITHUB_TOKEN GH_TOKEN FORGEJO_TOKEN GITEA_TOKEN GITLAB_TOKEN CI_JOB_TOKEN ACTIONS_RUNTIME_TOKEN
           chant_report="$PWD/.chant/pr"
@@ -83,7 +82,7 @@ jobs:
     container: node:22
     steps:
       - name: Check out the target branch's commit
-        uses: https://code.forgejo.org/actions/checkout@v7
+        uses: https://code.forgejo.org/actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: '${{ github.event.pull_request.base.sha }}'
       - name: Take the plan report from the plan job
@@ -97,7 +96,7 @@ jobs:
           END_OF_REPORT
       - name: Keep the plan report
         if: always()
-        uses: https://code.forgejo.org/actions/upload-artifact@v3
+        uses: https://code.forgejo.org/actions/upload-artifact@ff15f0306b3f739f7b6fd43fb5d26cd321bd4de5 # v3.2.1
         with:
           name: chant-pr-plan
           path: .chant/pr
@@ -118,7 +117,7 @@ jobs:
       group: chant-record-prod
       cancel-in-progress: false
     steps:
-      - uses: https://code.forgejo.org/actions/checkout@v7
+      - uses: https://code.forgejo.org/actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
       - run: command -v tofu >/dev/null 2>&1 || (curl -fsSL https://get.opentofu.org/install-opentofu.sh -o /tmp/install-opentofu.sh && sh /tmp/install-opentofu.sh --install-method standalone)
@@ -136,7 +135,7 @@ jobs:
           chant ci run record --in-place --base "$BASE_SHA" --env prod --gate pr-apply --forge forgejo
       - name: Keep the record report
         if: always()
-        uses: https://code.forgejo.org/actions/upload-artifact@v3
+        uses: https://code.forgejo.org/actions/upload-artifact@ff15f0306b3f739f7b6fd43fb5d26cd321bd4de5 # v3.2.1
         with:
           name: chant-pr-record
           path: .chant/pr
@@ -149,7 +148,7 @@ jobs:
       group: chant-apply-prod
       cancel-in-progress: false
     steps:
-      - uses: https://code.forgejo.org/actions/checkout@v7
+      - uses: https://code.forgejo.org/actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
       - run: command -v tofu >/dev/null 2>&1 || (curl -fsSL https://get.opentofu.org/install-opentofu.sh -o /tmp/install-opentofu.sh && sh /tmp/install-opentofu.sh --install-method standalone)
@@ -158,7 +157,7 @@ jobs:
       - name: Lint the project
         run: chant lint
       - name: Restore the record of an earlier attempt at this commit
-        uses: https://code.forgejo.org/actions/cache/restore@v4
+        uses: https://code.forgejo.org/actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: .chant/pr-resume/pr-apply.json
           key: chant-apply-prod-${{ github.sha }}-${{ github.run_id }}-${{ github.run_attempt }}
@@ -172,13 +171,13 @@ jobs:
           chant ci run apply --in-place --env prod --gate pr-apply --forge forgejo
       - name: Keep the record for a re-run
         if: always()
-        uses: https://code.forgejo.org/actions/cache/save@v4
+        uses: https://code.forgejo.org/actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: .chant/pr-resume/pr-apply.json
           key: chant-apply-prod-${{ github.sha }}-${{ github.run_id }}-${{ github.run_attempt }}
       - name: Keep the apply report
         if: always()
-        uses: https://code.forgejo.org/actions/upload-artifact@v3
+        uses: https://code.forgejo.org/actions/upload-artifact@ff15f0306b3f739f7b6fd43fb5d26cd321bd4de5 # v3.2.1
         with:
           name: chant-pr-apply
           path: .chant/pr

package/src/components/__fixtures__/pr-loop-record.forgejo.golden.yml

@@ -58,7 +58,6 @@ jobs:
         env:
           BASE_SHA: '${{ github.event.pull_request.base.sha }}'
           PR_NUMBER: '${{ github.event.pull_request.number }}'
-          CHANT_RUNNER_KEY: '${{ secrets.CHANT_RUNNER_KEY }}'
         run: |
           if [ -z "${CHANT_NO_FORGE_TOKEN:-}" ] && [ "${0#*/}" != "$0" ] && [ -f "$0" ] && ! { [ "${0##*/}" = sh ] || [ "${0##*/}" = bash ] || [ "${0##*/}" = dash ]; } && command -v env >/dev/null 2>&1 && command -v sh >/dev/null 2>&1; then exec env -u CHANT_FORGE_TOKEN -u CHANT_GITHUB_TOKEN -u CHANT_FORGEJO_TOKEN -u CHANT_GITLAB_TOKEN -u CHANT_CHECKOUT_TOKEN -u GITHUB_TOKEN -u GH_TOKEN -u FORGEJO_TOKEN -u GITEA_TOKEN -u GITLAB_TOKEN -u CI_JOB_TOKEN -u ACTIONS_RUNTIME_TOKEN CHANT_NO_FORGE_TOKEN=1 sh -e "$0"; fi; unset CHANT_FORGE_TOKEN CHANT_GITHUB_TOKEN CHANT_FORGEJO_TOKEN CHANT_GITLAB_TOKEN CHANT_CHECKOUT_TOKEN GITHUB_TOKEN GH_TOKEN FORGEJO_TOKEN GITEA_TOKEN GITLAB_TOKEN CI_JOB_TOKEN ACTIONS_RUNTIME_TOKEN
           chant_report="$PWD/.chant/pr"
@@ -73,7 +72,7 @@ jobs:
     container: node:22
     steps:
       - name: Check out the target branch's commit
-        uses: https://code.forgejo.org/actions/checkout@v7
+        uses: https://code.forgejo.org/actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: '${{ github.event.pull_request.base.sha }}'
       - name: Take the plan report from the plan job
@@ -87,7 +86,7 @@ jobs:
           END_OF_REPORT
       - name: Keep the plan report
         if: always()
-        uses: https://code.forgejo.org/actions/upload-artifact@v3
+        uses: https://code.forgejo.org/actions/upload-artifact@ff15f0306b3f739f7b6fd43fb5d26cd321bd4de5 # v3.2.1
         with:
           name: chant-pr-plan
           path: .chant/pr
@@ -108,7 +107,7 @@ jobs:
       group: chant-record-prod
       cancel-in-progress: false
     steps:
-      - uses: https://code.forgejo.org/actions/checkout@v7
+      - uses: https://code.forgejo.org/actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
       - run: command -v tofu >/dev/null 2>&1 || (curl -fsSL https://get.opentofu.org/install-opentofu.sh -o /tmp/install-opentofu.sh && sh /tmp/install-opentofu.sh --install-method standalone)
@@ -122,7 +121,7 @@ jobs:
           chant ci run record --in-place --base "$BASE_SHA" --env prod --gate pr-apply --forge forgejo
       - name: Keep the record report
         if: always()
-        uses: https://code.forgejo.org/actions/upload-artifact@v3
+        uses: https://code.forgejo.org/actions/upload-artifact@ff15f0306b3f739f7b6fd43fb5d26cd321bd4de5 # v3.2.1
         with:
           name: chant-pr-record
           path: .chant/pr

package/src/components/__fixtures__/pr-loop-waves.forgejo.golden.yml

@@ -60,7 +60,6 @@ jobs:
         env:
           BASE_SHA: '${{ github.event.pull_request.base.sha }}'
           PR_NUMBER: '${{ github.event.pull_request.number }}'
-          CHANT_RUNNER_KEY: '${{ secrets.CHANT_RUNNER_KEY }}'
         run: |
           if [ -z "${CHANT_NO_FORGE_TOKEN:-}" ] && [ "${0#*/}" != "$0" ] && [ -f "$0" ] && ! { [ "${0##*/}" = sh ] || [ "${0##*/}" = bash ] || [ "${0##*/}" = dash ]; } && command -v env >/dev/null 2>&1 && command -v sh >/dev/null 2>&1; then exec env -u CHANT_FORGE_TOKEN -u CHANT_GITHUB_TOKEN -u CHANT_FORGEJO_TOKEN -u CHANT_GITLAB_TOKEN -u CHANT_CHECKOUT_TOKEN -u GITHUB_TOKEN -u GH_TOKEN -u FORGEJO_TOKEN -u GITEA_TOKEN -u GITLAB_TOKEN -u CI_JOB_TOKEN -u ACTIONS_RUNTIME_TOKEN CHANT_NO_FORGE_TOKEN=1 sh -e "$0"; fi; unset CHANT_FORGE_TOKEN CHANT_GITHUB_TOKEN CHANT_FORGEJO_TOKEN CHANT_GITLAB_TOKEN CHANT_CHECKOUT_TOKEN GITHUB_TOKEN GH_TOKEN FORGEJO_TOKEN GITEA_TOKEN GITLAB_TOKEN CI_JOB_TOKEN ACTIONS_RUNTIME_TOKEN
           chant_report="$PWD/.chant/pr"
@@ -75,7 +74,7 @@ jobs:
     container: node:22
     steps:
       - name: Check out the target branch's commit
-        uses: https://code.forgejo.org/actions/checkout@v7
+        uses: https://code.forgejo.org/actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: '${{ github.event.pull_request.base.sha }}'
       - name: Take the plan report from the plan job
@@ -89,7 +88,7 @@ jobs:
           END_OF_REPORT
       - name: Keep the plan report
         if: always()
-        uses: https://code.forgejo.org/actions/upload-artifact@v3
+        uses: https://code.forgejo.org/actions/upload-artifact@ff15f0306b3f739f7b6fd43fb5d26cd321bd4de5 # v3.2.1
         with:
           name: chant-pr-plan
           path: .chant/pr
@@ -110,7 +109,7 @@ jobs:
       group: chant-record-prod
       cancel-in-progress: false
     steps:
-      - uses: https://code.forgejo.org/actions/checkout@v7
+      - uses: https://code.forgejo.org/actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
       - run: command -v tofu >/dev/null 2>&1 || (curl -fsSL https://get.opentofu.org/install-opentofu.sh -o /tmp/install-opentofu.sh && sh /tmp/install-opentofu.sh --install-method standalone)
@@ -124,7 +123,7 @@ jobs:
           chant ci run record --in-place --base "$BASE_SHA" --env prod --gate pr-apply --forge forgejo
       - name: Keep the record report
         if: always()
-        uses: https://code.forgejo.org/actions/upload-artifact@v3
+        uses: https://code.forgejo.org/actions/upload-artifact@ff15f0306b3f739f7b6fd43fb5d26cd321bd4de5 # v3.2.1
         with:
           name: chant-pr-record
           path: .chant/pr
@@ -139,12 +138,12 @@ jobs:
     outputs:
       green-sha: '${{ steps.apply.outputs.green-sha }}'
     steps:
-      - uses: https://code.forgejo.org/actions/checkout@v7
+      - uses: https://code.forgejo.org/actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
       - run: command -v tofu >/dev/null 2>&1 || (curl -fsSL https://get.opentofu.org/install-opentofu.sh -o /tmp/install-opentofu.sh && sh /tmp/install-opentofu.sh --install-method standalone)
       - name: Restore the newest record of this commit's apply
-        uses: https://code.forgejo.org/actions/cache/restore@v4
+        uses: https://code.forgejo.org/actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: .chant/pr-resume/pr-apply.json
           key: chant-apply-prod-${{ github.sha }}-${{ github.run_id }}-${{ github.run_attempt }}-wave-1
@@ -160,13 +159,13 @@ jobs:
           chant ci run apply --in-place --env prod --gate pr-apply --forge forgejo --wave-gate release --wave 1
       - name: Keep the record for the next wave and a re-run
         if: always()
-        uses: https://code.forgejo.org/actions/cache/save@v4
+        uses: https://code.forgejo.org/actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: .chant/pr-resume/pr-apply.json
           key: chant-apply-prod-${{ github.sha }}-${{ github.run_id }}-${{ github.run_attempt }}-wave-1
       - name: Keep the wave 1 apply report
         if: always()
-        uses: https://code.forgejo.org/actions/upload-artifact@v3
+        uses: https://code.forgejo.org/actions/upload-artifact@ff15f0306b3f739f7b6fd43fb5d26cd321bd4de5 # v3.2.1
         with:
           name: chant-pr-apply-wave-1
           path: .chant/pr
@@ -183,12 +182,12 @@ jobs:
     outputs:
       green-sha: '${{ steps.apply.outputs.green-sha }}'
     steps:
-      - uses: https://code.forgejo.org/actions/checkout@v7
+      - uses: https://code.forgejo.org/actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
       - run: command -v tofu >/dev/null 2>&1 || (curl -fsSL https://get.opentofu.org/install-opentofu.sh -o /tmp/install-opentofu.sh && sh /tmp/install-opentofu.sh --install-method standalone)
       - name: Restore the newest record of this commit's apply
-        uses: https://code.forgejo.org/actions/cache/restore@v4
+        uses: https://code.forgejo.org/actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: .chant/pr-resume/pr-apply.json
           key: chant-apply-prod-${{ github.sha }}-${{ github.run_id }}-${{ github.run_attempt }}-wave-2
@@ -205,13 +204,13 @@ jobs:
           chant ci run apply --in-place --env prod --gate pr-apply --forge forgejo --wave-gate release --wave 2
       - name: Keep the record for the next wave and a re-run
         if: always()
-        uses: https://code.forgejo.org/actions/cache/save@v4
+        uses: https://code.forgejo.org/actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: .chant/pr-resume/pr-apply.json
           key: chant-apply-prod-${{ github.sha }}-${{ github.run_id }}-${{ github.run_attempt }}-wave-2
       - name: Keep the wave 2 apply report
         if: always()
-        uses: https://code.forgejo.org/actions/upload-artifact@v3
+        uses: https://code.forgejo.org/actions/upload-artifact@ff15f0306b3f739f7b6fd43fb5d26cd321bd4de5 # v3.2.1
         with:
           name: chant-pr-apply-wave-2
           path: .chant/pr

package/src/components/__fixtures__/pr-loop.forgejo.golden.yml

@@ -60,7 +60,6 @@ jobs:
         env:
           BASE_SHA: '${{ github.event.pull_request.base.sha }}'
           PR_NUMBER: '${{ github.event.pull_request.number }}'
-          CHANT_RUNNER_KEY: '${{ secrets.CHANT_RUNNER_KEY }}'
         run: |
           if [ -z "${CHANT_NO_FORGE_TOKEN:-}" ] && [ "${0#*/}" != "$0" ] && [ -f "$0" ] && ! { [ "${0##*/}" = sh ] || [ "${0##*/}" = bash ] || [ "${0##*/}" = dash ]; } && command -v env >/dev/null 2>&1 && command -v sh >/dev/null 2>&1; then exec env -u CHANT_FORGE_TOKEN -u CHANT_GITHUB_TOKEN -u CHANT_FORGEJO_TOKEN -u CHANT_GITLAB_TOKEN -u CHANT_CHECKOUT_TOKEN -u GITHUB_TOKEN -u GH_TOKEN -u FORGEJO_TOKEN -u GITEA_TOKEN -u GITLAB_TOKEN -u CI_JOB_TOKEN -u ACTIONS_RUNTIME_TOKEN CHANT_NO_FORGE_TOKEN=1 sh -e "$0"; fi; unset CHANT_FORGE_TOKEN CHANT_GITHUB_TOKEN CHANT_FORGEJO_TOKEN CHANT_GITLAB_TOKEN CHANT_CHECKOUT_TOKEN GITHUB_TOKEN GH_TOKEN FORGEJO_TOKEN GITEA_TOKEN GITLAB_TOKEN CI_JOB_TOKEN ACTIONS_RUNTIME_TOKEN
           chant_report="$PWD/.chant/pr"
@@ -75,7 +74,7 @@ jobs:
     container: node:22
     steps:
       - name: Check out the target branch's commit
-        uses: https://code.forgejo.org/actions/checkout@v7
+        uses: https://code.forgejo.org/actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: '${{ github.event.pull_request.base.sha }}'
       - name: Take the plan report from the plan job
@@ -89,7 +88,7 @@ jobs:
           END_OF_REPORT
       - name: Keep the plan report
         if: always()
-        uses: https://code.forgejo.org/actions/upload-artifact@v3
+        uses: https://code.forgejo.org/actions/upload-artifact@ff15f0306b3f739f7b6fd43fb5d26cd321bd4de5 # v3.2.1
         with:
           name: chant-pr-plan
           path: .chant/pr
@@ -110,7 +109,7 @@ jobs:
       group: chant-record-prod
       cancel-in-progress: false
     steps:
-      - uses: https://code.forgejo.org/actions/checkout@v7
+      - uses: https://code.forgejo.org/actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
       - run: command -v tofu >/dev/null 2>&1 || (curl -fsSL https://get.opentofu.org/install-opentofu.sh -o /tmp/install-opentofu.sh && sh /tmp/install-opentofu.sh --install-method standalone)
@@ -124,7 +123,7 @@ jobs:
           chant ci run record --in-place --base "$BASE_SHA" --env prod --gate pr-apply --forge forgejo
       - name: Keep the record report
         if: always()
-        uses: https://code.forgejo.org/actions/upload-artifact@v3
+        uses: https://code.forgejo.org/actions/upload-artifact@ff15f0306b3f739f7b6fd43fb5d26cd321bd4de5 # v3.2.1
         with:
           name: chant-pr-record
           path: .chant/pr
@@ -137,12 +136,12 @@ jobs:
       group: chant-apply-prod
       cancel-in-progress: false
     steps:
-      - uses: https://code.forgejo.org/actions/checkout@v7
+      - uses: https://code.forgejo.org/actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
       - run: command -v tofu >/dev/null 2>&1 || (curl -fsSL https://get.opentofu.org/install-opentofu.sh -o /tmp/install-opentofu.sh && sh /tmp/install-opentofu.sh --install-method standalone)
       - name: Restore the record of an earlier attempt at this commit
-        uses: https://code.forgejo.org/actions/cache/restore@v4
+        uses: https://code.forgejo.org/actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: .chant/pr-resume/pr-apply.json
           key: chant-apply-prod-${{ github.sha }}-${{ github.run_id }}-${{ github.run_attempt }}
@@ -156,13 +155,13 @@ jobs:
           chant ci run apply --in-place --env prod --gate pr-apply --forge forgejo
       - name: Keep the record for a re-run
         if: always()
-        uses: https://code.forgejo.org/actions/cache/save@v4
+        uses: https://code.forgejo.org/actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: .chant/pr-resume/pr-apply.json
           key: chant-apply-prod-${{ github.sha }}-${{ github.run_id }}-${{ github.run_attempt }}
       - name: Keep the apply report
         if: always()
-        uses: https://code.forgejo.org/actions/upload-artifact@v3
+        uses: https://code.forgejo.org/actions/upload-artifact@ff15f0306b3f739f7b6fd43fb5d26cd321bd4de5 # v3.2.1
         with:
           name: chant-pr-apply
           path: .chant/pr

package/src/components/__golden__/op-waves-jobs.yml

@@ -15,29 +15,48 @@ jobs:
     runs-on: plan
     container: node:22
     steps:
-      - uses: https://code.forgejo.org/actions/checkout@v7
+      - uses: https://code.forgejo.org/actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
       - name: Plan, gate and apply wave 1 (dev)
         run: chant run wave --spec waves.json --wave 1
+      - name: Keep the job's outcome
+        if: always()
+        uses: https://code.forgejo.org/actions/upload-artifact@ff15f0306b3f739f7b6fd43fb5d26cd321bd4de5 # v3.2.1
+        with:
+          name: migrations-wave-1-dev-outcome
+          path: .chant/op-waves/migrations/outcomes/outcome-wave-1.json
+          if-no-files-found: ignore
   wave-2-prod-decide:
     runs-on: plan
     needs:
       - wave-1-dev
+    if: '!cancelled()'
     container: node:22
     steps:
-      - uses: https://code.forgejo.org/actions/checkout@v7
+      - uses: https://code.forgejo.org/actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
+      - name: Download the earlier jobs' outcomes
+        uses: https://code.forgejo.org/actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2
+        with:
+          path: .chant/op-waves/migrations/outcomes
       - name: Plan wave 2 (prod) and decide its gate
         run: chant run wave --spec waves.json --wave 2 --decide
       - name: Keep wave 2's decision
         if: always()
-        uses: https://code.forgejo.org/actions/upload-artifact@v3
+        uses: https://code.forgejo.org/actions/upload-artifact@ff15f0306b3f739f7b6fd43fb5d26cd321bd4de5 # v3.2.1
         with:
           name: migrations-wave-2-decision
           path: .chant/op-waves/migrations/wave-2.json
           if-no-files-found: ignore
+      - name: Keep the job's outcome
+        if: always()
+        uses: https://code.forgejo.org/actions/upload-artifact@ff15f0306b3f739f7b6fd43fb5d26cd321bd4de5 # v3.2.1
+        with:
+          name: migrations-wave-2-prod-decide-outcome
+          path: .chant/op-waves/migrations/outcomes/outcome-wave-2.json
+          if-no-files-found: ignore
   wave-2-prod-us:
     runs-on:
       - self-hosted
@@ -51,29 +70,51 @@ jobs:
       REGION: us
       CLOUD_TOKEN_AUDIENCE: us.example
     steps:
-      - uses: https://code.forgejo.org/actions/checkout@v7
+      - uses: https://code.forgejo.org/actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
       - name: Download wave 2's decision
-        uses: https://code.forgejo.org/actions/download-artifact@v3
+        uses: https://code.forgejo.org/actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2
         with:
           name: migrations-wave-2-decision
           path: .chant/op-waves/migrations
+      - name: Download the earlier jobs' outcomes
+        uses: https://code.forgejo.org/actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2
+        with:
+          path: .chant/op-waves/migrations/outcomes
       - name: Apply job group us of wave 2 (prod)
         run: chant run wave --spec waves.json --wave 2 --group us
+      - name: Keep the job's outcome
+        if: always()
+        uses: https://code.forgejo.org/actions/upload-artifact@ff15f0306b3f739f7b6fd43fb5d26cd321bd4de5 # v3.2.1
+        with:
+          name: migrations-wave-2-prod-us-outcome
+          path: .chant/op-waves/migrations/outcomes/outcome-wave-2-group-us.json
+          if-no-files-found: ignore
   wave-2-prod-eu:
     runs-on: eu-apply
     needs:
       - wave-2-prod-decide
     container: node:22
     steps:
-      - uses: https://code.forgejo.org/actions/checkout@v7
+      - uses: https://code.forgejo.org/actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
       - name: Download wave 2's decision
-        uses: https://code.forgejo.org/actions/download-artifact@v3
+        uses: https://code.forgejo.org/actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2
         with:
           name: migrations-wave-2-decision
           path: .chant/op-waves/migrations
+      - name: Download the earlier jobs' outcomes
+        uses: https://code.forgejo.org/actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2
+        with:
+          path: .chant/op-waves/migrations/outcomes
       - name: Apply job group eu of wave 2 (prod)
         run: chant run wave --spec waves.json --wave 2 --group eu
+      - name: Keep the job's outcome
+        if: always()
+        uses: https://code.forgejo.org/actions/upload-artifact@ff15f0306b3f739f7b6fd43fb5d26cd321bd4de5 # v3.2.1
+        with:
+          name: migrations-wave-2-prod-eu-outcome
+          path: .chant/op-waves/migrations/outcomes/outcome-wave-2-group-eu.json
+          if-no-files-found: ignore

package/src/components/action-pins.test.ts

@@ -0,0 +1,54 @@
+/**
+ * #4403: no workflow chant generates names an action by tag or branch, and no
+ * generator's source does either outside the pin table.
+ */
+import { readFileSync, readdirSync } from "node:fs";
+import { join } from "node:path";
+import { describe, expect, it } from "vitest";
+import type { DriverComponent } from "@intentius/chant/components/driver";
+import { ACTION_PINS, unpinnedActions } from "@intentius/chant/action-pins";
+import { generateGithubPipeline } from "@intentius/chant-lexicon-github/components/generate-pipeline";
+import { generateForgejoPipeline } from "./generate-pipeline";
+
+const ESTATE: DriverComponent[] = [
+  { name: "net", dependsOn: [], deploy: [{ phase: "Apply", steps: [{ kind: "terraform-apply", root: "net" }] }] },
+  { name: "app", dependsOn: ["net"], deploy: [{ phase: "Apply", steps: [{ kind: "terraform-apply", root: "app" }] }] },
+];
+
+const root = join(import.meta.dirname, "../../../..");
+
+describe("the actions a generated workflow uses", () => {
+  const variants = [{ env: "prod" }, { env: "prod", prLoop: { applyOnMerge: true } }, { env: "prod", prLoop: {} }] as const;
+  for (const [forge, gen] of [["github", generateGithubPipeline], ["forgejo", generateForgejoPipeline]] as const) {
+    it(`are each pinned by commit SHA, with the release beside it, on ${forge}`, () => {
+      for (const options of variants) {
+        const yaml = gen(ESTATE, options as never).yaml;
+        expect(unpinnedActions(yaml)).toEqual([]);
+        expect(yaml).toMatch(new RegExp(`uses: \\S*actions/checkout@${ACTION_PINS.checkout7.sha} # ${ACTION_PINS.checkout7.tag}$`, "m"));
+      }
+    });
+  }
+
+  it("are pinned in the committed workflow chant ci workflow wrote", () => {
+    const committed = readFileSync(join(root, ".github/workflows/chant-ci-green.yml"), "utf8");
+    expect(unpinnedActions(committed)).toEqual([]);
+    expect(committed).toMatch(new RegExp(`uses: actions/checkout@${ACTION_PINS.checkout6.sha} # ${ACTION_PINS.checkout6.tag}$`, "m"));
+  });
+
+  it("name no action by tag or branch in a generator's source, outside the pin table", () => {
+    const dirs = ["lexicons/github/src/components", "lexicons/forgejo/src/components", "packages/core/src/components"].map((d) => join(root, d));
+    const files = [
+      ...dirs.flatMap((d) => readdirSync(d).filter((n) => n.endsWith(".ts") && !n.endsWith(".test.ts")).map((n) => join(d, n))),
+      join(root, "packages/core/src/workspace/ci-green-workflow.ts"),
+      join(root, "packages/core/src/workspace/release-workflow.ts"),
+    ];
+    const found: string[] = [];
+    for (const f of files) {
+      for (const m of readFileSync(f, "utf8").matchAll(/["'`]((?:https:\/\/[\w.]+\/)?[\w-]+\/[\w./-]+@[\w.-]+)["'`]/g)) {
+        if (!/@[0-9a-f]{40}$/.test(m[1])) found.push(`${f.slice(root.length + 1)}: ${m[1]}`);
+      }
+    }
+    expect(files.length).toBeGreaterThan(10);
+    expect(found).toEqual([]);
+  });
+});

package/src/components/ci-jobs.ts

@@ -76,5 +76,6 @@ export function forgejoWorkflowDoc(doc: GithubOpPipelineDoc, dialect: ForgejoDia
     permissions: {},
     jobsDoc: forgejoize(withoutEnvironment(doc.jobsDoc), dialect),
     ...(doc.gatedNoticeDoc ? { gatedNoticeDoc: forgejoize(doc.gatedNoticeDoc, dialect) } : {}),
+    ...(doc.reviewNoteDoc ? { reviewNoteDoc: forgejoize(doc.reviewNoteDoc, dialect) } : {}),
   };
 }

package/src/components/generate-op-pipeline.review.test.ts

@@ -0,0 +1,63 @@
+/**
+ * The split review on Forgejo (#4326): the github shape under the Forgejo
+ * dialect. Forgejo ignores `permissions:`, so the review job's safety is the
+ * token variables the step drops and the note job that holds the token alone.
+ */
+
+import { describe, expect, test } from "vitest";
+import { parseYAML } from "@intentius/chant/yaml";
+import { CHECKOUT_TOKEN_ENV, checkoutScript, FORGE_TOKEN_VARS } from "@intentius/chant/ci-handover";
+import type { ScheduledOpSpec } from "@intentius/chant/lexicon";
+import { generateForgejoOpPipeline } from "./generate-op-pipeline";
+
+interface Step {
+  id?: string;
+  uses?: string;
+  run?: string;
+  env?: Record<string, string>;
+}
+interface Job {
+  needs?: string;
+  if?: string;
+  permissions?: unknown;
+  outputs?: Record<string, string>;
+  steps: Step[];
+}
+
+const SPEC: ScheduledOpSpec = { name: "pr-review", trigger: { kind: "pull_request" }, reviewAgent: true };
+
+describe("generateForgejoOpPipeline: reviewAgent", () => {
+  const out = generateForgejoOpPipeline([SPEC]);
+  const doc = parseYAML(out.files[0]!.yaml) as { jobs: Record<string, Job> };
+
+  test("a review job and a note job, with the handoff between them", () => {
+    expect(Object.keys(doc.jobs)).toEqual(["pr-review", "pr-review-note"]);
+    expect(doc.jobs["pr-review"]!.outputs).toEqual({ report_0: "${{ steps.chant-review.outputs.report_0 }}" });
+    expect(doc.jobs["pr-review-note"]!.needs).toBe("pr-review");
+    expect(doc.jobs["pr-review-note"]!.if).toBe("needs.pr-review.result == 'success'");
+  });
+
+  test("no step of the review job but the checkout's fetches names a forge token, and the Op's step drops them", () => {
+    for (const step of doc.jobs["pr-review"]!.steps) {
+      const named = Object.keys(step.env ?? {}).filter((n) => (FORGE_TOKEN_VARS as readonly string[]).includes(n));
+      expect(named).toEqual(step.run?.trimEnd() === checkoutScript(true).trimEnd() ? [CHECKOUT_TOKEN_ENV] : []);
+      expect(step.uses ?? "").not.toMatch(/^actions\/checkout/);
+    }
+    expect(doc.jobs["pr-review"]!.steps.at(-1)!.run).toContain("exec env -u CHANT_FORGE_TOKEN");
+  });
+
+  test("the note job checks nothing out and takes the token from the job", () => {
+    const note = doc.jobs["pr-review-note"]!;
+    expect(note.steps.some((s) => (s.uses ?? "").includes("checkout"))).toBe(false);
+    expect(note.steps[1]!.env).toEqual({ GITHUB_TOKEN: "${{ github.token }}", CHANT_OP: "pr-review" });
+  });
+
+  test("the dialect drops permissions: from both jobs, as it does for every Op", () => {
+    expect(doc.jobs["pr-review"]!.permissions).toBeUndefined();
+    expect(doc.jobs["pr-review-note"]!.permissions).toBeUndefined();
+  });
+
+  test("the same refusals as github's", () => {
+    expect(() => generateForgejoOpPipeline([{ ...SPEC, trigger: { kind: "push" } }])).toThrow(/reviewAgent/);
+  });
+});

package/src/components/generate-op-pipeline.test.ts

@@ -11,6 +11,7 @@ import { parseYAML } from "@intentius/chant/yaml";
 import { generateForgejoOpPipeline } from "./generate-op-pipeline";
 import { generateGithubOpPipeline } from "@intentius/chant-lexicon-github/components/generate-op-pipeline";
 import type { ScheduledOpSpec } from "@intentius/chant/lexicon";
+import { ACTION_PINS, usesRef } from "@intentius/chant/action-pins";
 
 interface ParsedJob {
   needs?: string;
@@ -214,7 +215,7 @@ describe("generateForgejoOpPipeline: setup steps and additive permissions (#2242
     const steps = doc.jobs!["app-apply"].steps;
     // The checkout is rewritten to the Forgejo mirror; an action with no
     // mapping in ../actions.ts passes through verbatim.
-    expect(steps[0].uses).toContain("actions/checkout@v7");
+    expect(steps[0].uses).toContain(`${usesRef(ACTION_PINS.checkout7)}`);
     expect(steps[1].uses).toBe("aws-actions/configure-aws-credentials@v6");
     expect((steps[1] as { with?: Record<string, string> }).with).toEqual({
       "role-to-assume": "${{ vars.AWS_ROLE_ARN }}",
@@ -336,7 +337,7 @@ describe("generateForgejoOpPipeline: a dropped deployment environment (#2257)",
       "    runs-on: docker",
       "    container: node:22",
       "    steps:",
-      "      - uses: https://code.forgejo.org/actions/checkout@v7",
+      `      - uses: https://code.forgejo.org/${usesRef(ACTION_PINS.checkout7)} # ${ACTION_PINS.checkout7.tag}`,
       "      - run: chant run actions-audit",
       "        env:",
       "          GITHUB_TOKEN: '${{ github.token }}'",

package/src/components/generate-pipeline.test.ts

@@ -16,6 +16,7 @@ import { generateGithubPipeline } from "@intentius/chant-lexicon-github/componen
 import { type DriverComponent } from "@intentius/chant/components/driver";
 import { searchService } from "@intentius/chant/components/pilots/alb-ecs.pilot";
 import { ordersTable } from "@intentius/chant/components/pilots/dynamodb.pilot";
+import { ACTION_PINS, usesRef } from "@intentius/chant/action-pins";
 
 function pilotComponents(): DriverComponent[] {
   return [
@@ -110,7 +111,7 @@ describe("generateForgejoPipeline: dialect applied", () => {
       expect(ref).toContain("code.forgejo.org/actions/");
     }
     // checkout is present and mirrored.
-    expect(all.some((r) => r === "https://code.forgejo.org/actions/checkout@v7")).toBe(true);
+    expect(all.some((r) => r === `https://code.forgejo.org/${usesRef(ACTION_PINS.checkout7)}`)).toBe(true);
   });
 });
 

package/src/components/generate-pipeline.ts

@@ -14,7 +14,7 @@
  *
  *  - runner labels: `runs-on: ubuntu-latest` → the project's Forgejo label
  *    (default `docker`, the label a fresh `act_runner` exposes);
- *  - `uses:` refs (`actions/checkout@v4`, `actions/upload-artifact@v4`, …)
+ *  - `uses:` refs (`actions/checkout`, `actions/upload-artifact`, ...), each pinned by commit SHA,
  *    rewritten to a Forgejo-resolvable form;
  *  - keys the Forgejo runner ignores (`continue-on-error`, and `permissions` bar `id-token`)
  *    dropped (`permissions` keeps only `id-token`, which OIDC needs).

package/src/components/generate-pr-pipeline.locks.test.ts

@@ -0,0 +1,30 @@
+/** The Forgejo pull-request workflow with `ci.locks: plan` (#4327): the GitHub generator's lock and unlock jobs, in the Forgejo dialect. */
+
+import { describe, expect, test } from "vitest";
+import { parseYAML } from "@intentius/chant/yaml";
+import type { DriverComponent } from "@intentius/chant/components/driver";
+import { generateForgejoPipeline } from "./generate-pipeline";
+
+const ESTATE: DriverComponent[] = [
+  { name: "net", dependsOn: [], deploy: [{ phase: "Apply", steps: [{ kind: "terraform-apply", root: "net" }] }] },
+];
+
+interface Step { run?: string }
+type Doc = { jobs: Record<string, { if?: string; needs?: string[]; steps: Step[] }> };
+
+describe("the Forgejo workflow with ci.locks: plan", () => {
+  const doc = parseYAML(generateForgejoPipeline(ESTATE, { env: "prod", prLoop: { locks: "plan" } }).yaml) as Doc;
+
+  test("writes the lock and unlock jobs for forgejo", () => {
+    expect(doc.jobs.lock!.needs).toEqual(["plan"]);
+    expect(doc.jobs.lock!.steps.find((s) => s.run?.startsWith("chant lock"))!.run).toContain("--forge forgejo");
+    expect(doc.jobs.unlock!.if).toContain("github.event.action == 'closed'");
+    expect(doc.jobs.unlock!.steps.some((s) => s.run === 'chant unlock --pr "$PR_NUMBER"')).toBe(true);
+  });
+
+  test("without ci.locks neither job is written", () => {
+    const plain = parseYAML(generateForgejoPipeline(ESTATE, { env: "prod", prLoop: {} }).yaml) as Doc;
+    expect(Object.keys(plain.jobs)).not.toContain("lock");
+    expect(Object.keys(plain.jobs)).not.toContain("unlock");
+  });
+});

package/src/components/generate-pr-pipeline.test.ts

@@ -17,6 +17,7 @@ import { generateGithubPipeline } from "@intentius/chant-lexicon-github/componen
 import { githubBaseFallback, greenCheckout } from "@intentius/chant/components/pr-pipeline";
 import { dropForgeTokens } from "@intentius/chant/ci-handover";
 import { generateForgejoPipeline } from "./generate-pipeline";
+import { ACTION_PINS, usesRef } from "@intentius/chant/action-pins";
 
 const ESTATE: DriverComponent[] = [
   { name: "net", dependsOn: [], deploy: [{ phase: "Apply", steps: [{ kind: "terraform-apply", root: "net" }] }] },
@@ -42,9 +43,9 @@ describe("the Forgejo pull-request workflow", () => {
     expect(result.yaml).toBe(readFileSync(GOLDEN, "utf-8"));
   });
 
-  test("both jobs run chant ci run with the runner key secret, as on GitHub (#4156)", () => {
+  test("the jobs run chant ci run, with the runner key secret on every job but the plan, as on GitHub (#4156, #4328)", () => {
     expect(result.yaml).toContain("chant ci run plan --in-place --no-push");
-    expect(result.yaml.match(/CHANT_RUNNER_KEY: '\$\{\{ secrets\.CHANT_RUNNER_KEY \}\}'/g)).toHaveLength(3);
+    expect(result.yaml.match(/CHANT_RUNNER_KEY: '\$\{\{ secrets\.CHANT_RUNNER_KEY \}\}'/g)).toHaveLength(2);
     expect(result.yaml).not.toContain("chant components pr-plan");
     expect(result.yaml).not.toContain("chant components pr-apply");
     // #4295: the plan-note job posts with pr-post, to Forgejo.
@@ -84,21 +85,22 @@ describe("the Forgejo pull-request workflow", () => {
   });
 
   test("the apply keeps its resume record in the runner's cache, through the Forgejo mirror of actions/cache (#3543)", () => {
-    expect(result.yaml).toContain("uses: https://code.forgejo.org/actions/cache/restore@v4");
-    expect(result.yaml).toContain("uses: https://code.forgejo.org/actions/cache/save@v4");
+    expect(result.yaml).toContain(`uses: https://code.forgejo.org/${usesRef(ACTION_PINS.cacheRestore4)}`);
+    expect(result.yaml).toContain(`uses: https://code.forgejo.org/${usesRef(ACTION_PINS.cacheSave4)}`);
     // ci run's inner pr-apply resumes from it (#4156): the job runs in place, where the cache restored it.
     expect(result.yaml).toContain("chant ci run apply --in-place --env prod");
   });
 
   test("keeps its reports with upload-artifact v3, the version a Forgejo runner runs, while GitHub keeps v4 (#4008)", () => {
     // v4 refuses a runner that reads as GitHub Enterprise Server, as Forgejo's does.
-    expect(result.yaml.match(/uses: https:\/\/code\.forgejo\.org\/actions\/upload-artifact@v3$/gm)).toHaveLength(3);
-    expect(result.yaml).not.toMatch(/(upload|download)-artifact@v4/);
+    expect(result.yaml.match(new RegExp(`uses: https://code\\.forgejo\\.org/actions/upload-artifact@${ACTION_PINS.uploadArtifact3.sha} # ${ACTION_PINS.uploadArtifact3.tag}$`, "gm"))).toHaveLength(3);
+    expect(result.yaml).not.toContain(ACTION_PINS.uploadArtifact4.sha);
+    expect(result.yaml).not.toContain(ACTION_PINS.downloadArtifact4.sha);
     // v3 uploads hidden files with no input asking for it, so .chant/pr is still kept.
     expect(result.yaml).not.toContain("include-hidden-files");
     expect(result.yaml).toContain("path: .chant/pr");
     const github = generateGithubPipeline(ESTATE, { env: "prod", prLoop: { applyOnMerge: true } }).yaml;
-    expect(github.match(/uses: actions\/upload-artifact@v4$/gm)).toHaveLength(3);
+    expect(github.match(new RegExp(`uses: actions/upload-artifact@${ACTION_PINS.uploadArtifact4.sha} # ${ACTION_PINS.uploadArtifact4.tag}$`, "gm"))).toHaveLength(3);
     expect(github).toContain("include-hidden-files: true");
   });
 

package/src/components/generate-pr-waves-pipeline.test.ts

@@ -10,6 +10,7 @@ import { describe, expect, test } from "vitest";
 import { parseYAML } from "@intentius/chant/yaml";
 import type { DriverComponent } from "@intentius/chant/components/driver";
 import { generateForgejoPipeline } from "./generate-pipeline";
+import { ACTION_PINS, usesRef } from "@intentius/chant/action-pins";
 
 const root = (name: string, dependsOn: string[] = []): DriverComponent => ({
   name,
@@ -56,7 +57,7 @@ describe("the Forgejo pull-request workflow with a gate per wave (#4003)", () =>
       const job = doc.jobs[`apply-wave-${k}`]!;
       expect(job["runs-on"]).toBe("docker");
       expect(job.steps.find((s) => s.run?.includes("ci run apply"))!.run).toContain(`--forge forgejo --wave-gate release --wave ${k}`);
-      expect(job.steps.some((s) => s.uses === "https://code.forgejo.org/actions/cache/restore@v4")).toBe(true);
+      expect(job.steps.some((s) => s.uses === `https://code.forgejo.org/${usesRef(ACTION_PINS.cacheRestore4)}`)).toBe(true);
     }
   });
 });

package/src/dialect.ts

@@ -28,6 +28,7 @@
 // be `true`, so the two disagreed about a value carrying `false`. Core's also
 // accepts an entity a host built, which a local identity check cannot.
 import { isDeclarable, isResourceDeclarable, type Declarable } from "@intentius/chant/declarable";
+import { ACTION_PINS } from "@intentius/chant/action-pins";
 import { resolveActionRef } from "./actions";
 
 /**
@@ -183,7 +184,9 @@ const V4_ONLY_UPLOAD_INPUTS = new Set(["include-hidden-files", "overwrite"]);
 function dropV4OnlyArtifactInputs(step: Record<string, unknown>): void {
   const uses = step.uses;
   const withs = step.with;
-  if (typeof uses !== "string" || !/\/actions\/upload-artifact@v3$/.test(uses)) return;
+  if (typeof uses !== "string" || !/\/actions\/upload-artifact@(v3|[0-9a-f]{40})$/.test(uses)) return;
+  const at = uses.slice(uses.lastIndexOf("@") + 1);
+  if (at !== "v3" && at !== ACTION_PINS.uploadArtifact3.sha) return;
   if (withs === null || typeof withs !== "object" || Array.isArray(withs)) return;
   const kept = Object.fromEntries(Object.entries(withs as Record<string, unknown>).filter(([k]) => !V4_ONLY_UPLOAD_INPUTS.has(toKebabCase(k))));
   step.with = kept;

package/src/mcp/context-tools.test.ts

@@ -80,7 +80,8 @@ describe("forgejo context tools", () => {
   test("forgejo:references reports the rewritten + unmapped refs", async () => {
     const refs = (await tool("forgejo:references").handler({ path: join(dir, "src") })) as Array<{ source: string }>;
     const sources = refs.map((r) => r.source);
-    expect(sources).toContain("https://code.forgejo.org/actions/checkout@v7");
+    // Composites pin by commit SHA since #4410.
+    expect(sources.some((s: string) => /^https:\/\/code\.forgejo\.org\/actions\/checkout@[0-9a-f]{40}$/.test(s))).toBe(true);
     expect(sources).toContain("some-org/custom-action@v1");
   });
 

package/src/plugin.ts

@@ -131,7 +131,8 @@ export const build = new Job({
       async transform(content: string, opts) {
         const { transform } = await import("./migrate/from-github");
         const result = await transform(content, {
-          emit: opts.emit,
+          // "sql" is for sql targets (#4399); chant migrate refuses it for this pair.
+          emit: opts.emit === "sql" ? undefined : opts.emit,
           sourceFile: opts.sourceFile,
           strict: opts.strict,
           security: opts.security,

package/src/serializer.test.ts

@@ -88,15 +88,16 @@ describe("forgejoSerializer — uses: action resolution", () => {
     const { primary } = asResult(
       forgejoSerializer.serialize(withSteps(Checkout({}).step, SetupNode({ nodeVersion: "22" }).step)),
     );
-    expect(primary).toContain(`uses: ${DEFAULT_ACTIONS_ROOT}/actions/checkout@v7`);
-    expect(primary).toContain(`uses: ${DEFAULT_ACTIONS_ROOT}/actions/setup-node@v7`);
+    // Composites pin by commit SHA since #4410; the rewrite still puts them under the actions root.
+    expect(primary).toMatch(new RegExp(`uses: ${DEFAULT_ACTIONS_ROOT}/actions/checkout@[0-9a-f]{40}`));
+    expect(primary).toMatch(new RegExp(`uses: ${DEFAULT_ACTIONS_ROOT}/actions/setup-node@[0-9a-f]{40}`));
   });
 
   test("forgejo.actionsRoot override changes the rewritten base", () => {
     const out = forgejoSerializer.serialize(withSteps(Checkout({}).step), undefined, {
       config: { forgejo: { actionsRoot: "https://codeberg.org" } },
     });
-    expect(asResult(out).primary).toContain("uses: https://codeberg.org/actions/checkout@v7");
+    expect(asResult(out).primary).toMatch(/uses: https:\/\/codeberg\.org\/actions\/checkout@[0-9a-f]{40}/);
   });
 
   test("an unmapped action ref is passed through (WFJ010 reports it post-synth)", () => {