@intentius/chant-lexicon-forgejo 0.124.70 → 0.124.72

package/dist/components/ci-jobs.d.ts

@@ -17,6 +17,13 @@ export declare function forgejoize(value: Record<string, unknown>, dialect: Forg
  * dialect transforms as it is.
  */
 export declare function withoutEnvironment(jobsDoc: Record<string, unknown>): Record<string, unknown>;
+/**
+ * Forgejo 15 and later serves a job an OIDC token only when the job sets
+ * `enable-openid-connect: true` (#4753); it does not read `id-token: write`.
+ * Each job that asks for the token, by its own `permissions` or, with none of
+ * its own, by the workflow's, gets the key.
+ */
+export declare function withOpenIdConnect(jobsDoc: Record<string, unknown>, workflowPermissions: unknown): Record<string, unknown>;
 /** The header of an Op's workflow whose environment gate did not survive the crossing. */
 export declare function droppedEnvironmentHeader(environmentName: string): string[];
 /** The header of an Op waves workflow, naming each wave whose environment was dropped as `wave -> environment`. */

package/dist/components/ci-jobs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ci-jobs.d.ts","sourceRoot":"","sources":["../../src/components/ci-jobs.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iEAAiE,CAAC;AAC3G,OAAO,EAA2B,KAAK,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAEjF,kEAAkE;AAClE,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,EAAE,qBAAqB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAElH;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAQ5F;AAED,0FAA0F;AAC1F,wBAAgB,wBAAwB,CAAC,eAAe,EAAE,MAAM,GAAG,MAAM,EAAE,CAQ1E;AAED,mHAAmH;AACnH,wBAAgB,6BAA6B,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,EAAE,CAOlF;AAED;;;;GAIG;AACH,eAAO,MAAM,eAAe;IAAK,iBAAiB;CAAqC,CAAC;AAExF;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,mBAAmB,EAAE,OAAO,EAAE,qBAAqB,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,GAAG,mBAAmB,CAcnI"}
+{"version":3,"file":"ci-jobs.d.ts","sourceRoot":"","sources":["../../src/components/ci-jobs.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iEAAiE,CAAC;AAC3G,OAAO,EAA2B,KAAK,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAEjF,kEAAkE;AAClE,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,EAAE,qBAAqB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAElH;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAQ5F;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,mBAAmB,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAUzH;AAED,0FAA0F;AAC1F,wBAAgB,wBAAwB,CAAC,eAAe,EAAE,MAAM,GAAG,MAAM,EAAE,CAQ1E;AAED,mHAAmH;AACnH,wBAAgB,6BAA6B,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,EAAE,CAOlF;AAED;;;;GAIG;AACH,eAAO,MAAM,eAAe;IAAK,iBAAiB;CAAqC,CAAC;AAExF;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,mBAAmB,EAAE,OAAO,EAAE,qBAAqB,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,GAAG,mBAAmB,CAenI"}

package/dist/components/ci-jobs.js

@@ -26,6 +26,22 @@ export function withoutEnvironment(jobsDoc) {
         return [jobName, rest];
     }));
 }
+/**
+ * Forgejo 15 and later serves a job an OIDC token only when the job sets
+ * `enable-openid-connect: true` (#4753); it does not read `id-token: write`.
+ * Each job that asks for the token, by its own `permissions` or, with none of
+ * its own, by the workflow's, gets the key.
+ */
+export function withOpenIdConnect(jobsDoc, workflowPermissions) {
+    const wants = (p) => typeof p === "object" && p !== null && p["id-token"] === "write";
+    const workflow = wants(workflowPermissions);
+    return Object.fromEntries(Object.entries(jobsDoc).map(([jobName, job]) => {
+        if (typeof job !== "object" || job === null)
+            return [jobName, job];
+        const own = job.permissions;
+        return wants(own) || (own === undefined && workflow) ? [jobName, { ...job, "enable-openid-connect": true }] : [jobName, job];
+    }));
+}
 /** The header of an Op's workflow whose environment gate did not survive the crossing. */
 export function droppedEnvironmentHeader(environmentName) {
     return [
@@ -65,9 +81,10 @@ export function forgejoWorkflowDoc(doc, dialect, header) {
         ...(doc.env ? { env: forgejoize(doc.env, dialect) } : {}),
         ...(doc.concurrency ? { concurrency: forgejoize(doc.concurrency, dialect) } : {}),
         permissions: {},
-        jobsDoc: forgejoize(withoutEnvironment(doc.jobsDoc), dialect),
+        jobsDoc: withOpenIdConnect(forgejoize(withoutEnvironment(doc.jobsDoc), dialect), doc.permissions),
         ...(doc.gatedNoticeDoc ? { gatedNoticeDoc: forgejoize(doc.gatedNoticeDoc, dialect) } : {}),
         ...(doc.reviewNoteDoc ? { reviewNoteDoc: forgejoize(doc.reviewNoteDoc, dialect) } : {}),
         ...(doc.agentDoc ? { agentDoc: forgejoize(doc.agentDoc, dialect) } : {}),
+        ...(doc.commitDoc ? { commitDoc: forgejoize(doc.commitDoc, dialect) } : {}),
     };
 }

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "41aee4ba1fe4330d30fab53fc1d593863b4cf4f4c6f0ac9960f6b20de7f8ef82",
+    "manifest.json": "a12f035cc5e61cfe98b0c5eb91628d0e6383bb868ce59b605925f2b6089e2c97",
     "meta.json": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
     "types/index.d.ts": "66204549b2a864ab5489e3f02c1878e73ab4b3c9d938cfb480b66f71543a43de",
     "rules/delegate-to-github.ts": "1060cda40f4b73d6cca3ba3fa13b80b4886147d4034c88584c2d80c5510dbe5e",
@@ -9,5 +9,5 @@
     "rules/wfj011.ts": "fcb8bf6685d744af20ad804ce929488257995c74b9a3353b2eacae3768d1c83e",
     "skills/chant-forgejo.md": "f28d7fb69fb1cfd992496ef41fda0ea5ccd54a29b84ea1c501a44f6a3992c4d5"
   },
-  "composite": "eba0a5d9ab481245353bcdff350575f6a19421e1c38c3c0b5bc72bc52424a3f6"
+  "composite": "f05bc732b6f3251c2a60aa97343513b8f23baf293b3edfa594d365b0009540df"
 }

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "forgejo",
-  "version": "0.124.70",
+  "version": "0.124.72",
   "chantVersion": ">=0.1.0",
   "namespace": "Forgejo",
   "intrinsics": [],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-forgejo",
-  "version": "0.124.70",
+  "version": "0.124.72",
   "description": "Forgejo / Codeberg / Gitea Actions lexicon for chant — a thin GitHub Actions dialect",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -54,8 +54,8 @@
   },
   "peerDependencies": {
     "zod": "^4.3.6",
-    "@intentius/chant": "^0.124.70",
-    "@intentius/chant-lexicon-github": "^0.124.70"
+    "@intentius/chant": "^0.124.72",
+    "@intentius/chant-lexicon-github": "^0.124.72"
   },
   "scripts": {
     "generate": "tsx src/codegen/generate-cli.ts",

package/src/components/__golden__/op-waves-jobs.yml

@@ -107,6 +107,7 @@ jobs:
           name: migrations-wave-2-prod-us-outcome
           path: .chant/op-waves/migrations/outcomes/outcome-wave-2-group-us.json
           if-no-files-found: ignore
+    enable-openid-connect: true
   wave-2-prod-eu:
     runs-on: eu-apply
     needs:

package/src/components/ci-jobs.ts

@@ -32,6 +32,24 @@ export function withoutEnvironment(jobsDoc: Record<string, unknown>): Record<str
   );
 }
 
+/**
+ * Forgejo 15 and later serves a job an OIDC token only when the job sets
+ * `enable-openid-connect: true` (#4753); it does not read `id-token: write`.
+ * Each job that asks for the token, by its own `permissions` or, with none of
+ * its own, by the workflow's, gets the key.
+ */
+export function withOpenIdConnect(jobsDoc: Record<string, unknown>, workflowPermissions: unknown): Record<string, unknown> {
+  const wants = (p: unknown): boolean => typeof p === "object" && p !== null && (p as Record<string, unknown>)["id-token"] === "write";
+  const workflow = wants(workflowPermissions);
+  return Object.fromEntries(
+    Object.entries(jobsDoc).map(([jobName, job]) => {
+      if (typeof job !== "object" || job === null) return [jobName, job];
+      const own = (job as Record<string, unknown>).permissions;
+      return wants(own) || (own === undefined && workflow) ? [jobName, { ...(job as Record<string, unknown>), "enable-openid-connect": true }] : [jobName, job];
+    }),
+  );
+}
+
 /** The header of an Op's workflow whose environment gate did not survive the crossing. */
 export function droppedEnvironmentHeader(environmentName: string): string[] {
   return [
@@ -74,9 +92,10 @@ export function forgejoWorkflowDoc(doc: GithubOpPipelineDoc, dialect: ForgejoDia
     ...(doc.env ? { env: forgejoize(doc.env, dialect) } : {}),
     ...(doc.concurrency ? { concurrency: forgejoize(doc.concurrency, dialect) } : {}),
     permissions: {},
-    jobsDoc: forgejoize(withoutEnvironment(doc.jobsDoc), dialect),
+    jobsDoc: withOpenIdConnect(forgejoize(withoutEnvironment(doc.jobsDoc), dialect), doc.permissions),
     ...(doc.gatedNoticeDoc ? { gatedNoticeDoc: forgejoize(doc.gatedNoticeDoc, dialect) } : {}),
     ...(doc.reviewNoteDoc ? { reviewNoteDoc: forgejoize(doc.reviewNoteDoc, dialect) } : {}),
     ...(doc.agentDoc ? { agentDoc: forgejoize(doc.agentDoc, dialect) } : {}),
+    ...(doc.commitDoc ? { commitDoc: forgejoize(doc.commitDoc, dialect) } : {}),
   };
 }

package/src/components/commit-jobs.push.test.ts

@@ -0,0 +1,18 @@
+/** #4749 on Forgejo: GitHub's commit jobs under the Forgejo dialect, with the job's own token. */
+import { describe, expect, test } from "vitest";
+import { parseYAML } from "@intentius/chant/yaml";
+import type { ScheduledOpSpec } from "@intentius/chant/lexicon";
+import { generateForgejoOpPipeline } from "./generate-op-pipeline";
+
+type Job = { steps: Array<{ name?: string; env?: Record<string, string>; run?: string }> };
+
+describe("commit jobs with jobToken on Forgejo (#4749)", () => {
+  test("push with the job's token through the Forgejo client, then run after", () => {
+    const spec: ScheduledOpSpec = { name: "chant-fmt", commit: { on: "comment", comment: "/chant fmt", command: ["tofu", "fmt"], allowed: ["infra/"], jobToken: true, after: ["echo pushed"] } };
+    const doc = parseYAML(generateForgejoOpPipeline([spec]).files[0]!.yaml) as { jobs: Record<string, Job> };
+    const steps = doc.jobs["chant-fmt-push"]!.steps;
+    const land = steps.find((s) => s.name === "Push the change to the pull request")!;
+    expect(land.env).toMatchObject({ CHANT_FORGEJO_TOKEN: "${{ github.token }}" });
+    expect(steps.at(-1)!.run).toContain("echo pushed");
+  });
+});

package/src/components/generate-op-pipeline.artifacts.test.ts

@@ -0,0 +1,22 @@
+/** #4622: a scheduled Op's job keeps named artifacts after its run, with the upload action Forgejo runs. */
+import { describe, expect, test } from "vitest";
+import { parseYAML } from "@intentius/chant/yaml";
+import { generateForgejoOpPipeline } from "./generate-op-pipeline";
+import { ACTION_PINS } from "@intentius/chant/action-pins";
+import type { ScheduledOpSpec } from "@intentius/chant/lexicon";
+
+type Step = { if?: string; uses?: string; run?: string; with?: Record<string, unknown> };
+
+describe("scheduled Op artifacts on Forgejo (#4622)", () => {
+  test("each artifact is an upload-artifact v3 step after the run, kept whatever the run ended with", () => {
+    const spec: ScheduledOpSpec = { name: "drift", schedule: "0 6 * * *", artifacts: [{ name: "drift-report", paths: ["reports/"], retentionDays: 7 }] };
+    const doc = parseYAML(generateForgejoOpPipeline([spec]).files[0]!.yaml) as { jobs: Record<string, { steps: Step[] }> };
+    const s = doc.jobs.drift!.steps;
+    const run = s.findIndex((x) => x.run?.includes("chant run drift"));
+    const up = s.findIndex((x) => x.uses?.startsWith("actions/upload-artifact@") || x.uses?.includes("/upload-artifact@"));
+    expect(up).toBeGreaterThan(run);
+    expect(s[up]!.uses).toContain(ACTION_PINS.uploadArtifact3.sha);
+    expect(s[up]!.if).toBe("always()");
+    expect(s[up]!.with).toEqual({ name: "drift-report", path: "reports/", "if-no-files-found": "ignore", "retention-days": 7 });
+  });
+});

package/src/components/generate-op-pipeline.commit.test.ts

@@ -0,0 +1,28 @@
+/** The commit jobs on Forgejo (#4722): GitHub's jobs under the Forgejo dialect. */
+import { describe, expect, test } from "vitest";
+import { parseYAML } from "@intentius/chant/yaml";
+import type { ScheduledOpSpec } from "@intentius/chant/lexicon";
+import { generateForgejoOpPipeline } from "./generate-op-pipeline";
+
+type Job = { if?: string; permissions?: unknown; steps: Array<{ env?: Record<string, string>; run?: string }> };
+
+describe("commit jobs on Forgejo (#4722)", () => {
+  test("ask the forge who may write, drop permissions, and push with the token through the Forgejo client", () => {
+    const spec: ScheduledOpSpec = { name: "chant-fmt", commit: { on: "comment", comment: "/chant fmt", command: ["tofu", "fmt"], allowed: ["infra/"], tokenEnv: "CHANT_PUSH_TOKEN" } };
+    const doc = parseYAML(generateForgejoOpPipeline([spec]).files[0]!.yaml) as { jobs: Record<string, Job> };
+    const commit = doc.jobs["chant-fmt"]!;
+    expect(commit.if).toContain("github.event.is_pull");
+    expect(commit.if).not.toContain("author_association");
+    expect(commit.permissions).toBeUndefined();
+    const land = doc.jobs["chant-fmt-push"]!.steps.at(-1)!;
+    expect(land.env).toMatchObject({ CHANT_FORGEJO_TOKEN: "${{ secrets.CHANT_PUSH_TOKEN }}" });
+    expect(land.run).toContain("chant commit land --forge forgejo");
+  });
+
+  test("a check commit job follows the check", () => {
+    const spec: ScheduledOpSpec = { name: "fmt-check", trigger: { kind: "pull_request" }, commit: { on: "check", command: ["tofu", "fmt"], allowed: ["infra/"], tokenEnv: "CHANT_PUSH_TOKEN" } };
+    const doc = parseYAML(generateForgejoOpPipeline([spec]).files[0]!.yaml) as { jobs: Record<string, Job & { needs?: string }> };
+    expect(doc.jobs["fmt-check-commit"]!.needs).toBe("fmt-check");
+    expect(doc.jobs["fmt-check-commit-push"]).toBeDefined();
+  });
+});

package/src/components/openid-connect.test.ts

@@ -0,0 +1,25 @@
+/** #4753: a Forgejo job that asks for an OIDC token sets enable-openid-connect. */
+import { describe, expect, test } from "vitest";
+import { parseYAML } from "@intentius/chant/yaml";
+import { generateForgejoOpPipeline } from "./generate-op-pipeline";
+import { withOpenIdConnect } from "./ci-jobs";
+
+type Job = Record<string, unknown>;
+const jobs = (yaml: string) => (parseYAML(yaml) as { jobs: Record<string, Job> }).jobs;
+
+describe("enable-openid-connect on Forgejo (#4753)", () => {
+  test("a scheduled Op whose permissions ask for id-token: write gets it on its job; one that does not, does not", () => {
+    const withToken = jobs(generateForgejoOpPipeline([{ name: "drift", schedule: "0 6 * * *", permissions: { "id-token": "write" } }]).files[0]!.yaml);
+    expect(withToken.drift!["enable-openid-connect"]).toBe(true);
+    const without = jobs(generateForgejoOpPipeline([{ name: "drift", schedule: "0 6 * * *" }]).files[0]!.yaml);
+    expect(without.drift!["enable-openid-connect"]).toBeUndefined();
+  });
+
+  test("a job's own permissions decide over the workflow's", () => {
+    const out = withOpenIdConnect({ a: { steps: [] }, b: { permissions: { "id-token": "write" } }, c: { permissions: { contents: "read" } } }, { "id-token": "write" });
+    expect(out.a).toMatchObject({ "enable-openid-connect": true });
+    expect(out.b).toMatchObject({ "enable-openid-connect": true });
+    expect(out.c).not.toHaveProperty("enable-openid-connect");
+    expect(withOpenIdConnect({ a: {} }, { contents: "read" }).a).toEqual({});
+  });
+});