@intentius/chant-lexicon-forgejo 0.59.0 → 0.61.0

package/dist/components/generate-op-pipeline.d.ts

@@ -35,6 +35,17 @@
  * configuration to point `gh` at a Forgejo instance, so this refuses the mode
  * by name rather than generating a job whose finding step fails on every run.
  *
+ * A spec's `environment` (#2257) is dropped on the same terms as
+ * `permissions:`, and for a stronger reason: Forgejo Actions has no
+ * environments at all — no protection rules, no required reviewers, no
+ * per-environment secrets — so the key names an object that does not exist on
+ * the instance. Dropping it silently would be the worst outcome available,
+ * because the whole point of the option is a human holding an apply, so this
+ * also writes a comment into the generated file's header saying which
+ * environment was asked for and that nothing on Forgejo enforces it. What
+ * still holds the apply here is chant's own gate (#2119), which is a fact on
+ * the `chant/lifecycle` branch and needs nothing from the forge.
+ *
  * The gated-apply notice job (#2243) does not cross over either, for the same
  * reason and by the same mechanism as `permissions:`: it shells to `gh`, which
  * a Forgejo `act_runner` neither ships nor can point at its own instance, and

package/dist/components/generate-op-pipeline.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generate-op-pipeline.d.ts","sourceRoot":"","sources":["../../src/components/generate-op-pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AAOH,OAAO,KAAK,EACV,wBAAwB,EACxB,gBAAgB,EAChB,eAAe,EAChB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAA2B,KAAK,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAOjF;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,eAAe,EAAE,EACtB,OAAO,GAAE,wBAA6B,EACtC,cAAc,GAAE,qBAA0B,GACzC,gBAAgB,CA2BlB"}
+{"version":3,"file":"generate-op-pipeline.d.ts","sourceRoot":"","sources":["../../src/components/generate-op-pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0DG;AAOH,OAAO,KAAK,EACV,wBAAwB,EACxB,gBAAgB,EAChB,eAAe,EAChB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAA2B,KAAK,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAmCjF;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,eAAe,EAAE,EACtB,OAAO,GAAE,wBAA6B,EACtC,cAAc,GAAE,qBAA0B,GACzC,gBAAgB,CA+BlB"}

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "e73b98e495fadacf1d8eb846417c22f36d149b2f6a5fbaa822e3aa97cd0f987b",
+    "manifest.json": "3ad50028d0c5d782a8ab2eb2698b266fc87cc318ca165f3afb975673e50fbc12",
     "meta.json": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
     "types/index.d.ts": "66204549b2a864ab5489e3f02c1878e73ab4b3c9d938cfb480b66f71543a43de",
     "rules/delegate-to-github.ts": "1060cda40f4b73d6cca3ba3fa13b80b4886147d4034c88584c2d80c5510dbe5e",
@@ -9,5 +9,5 @@
     "rules/wfj011.ts": "fcb8bf6685d744af20ad804ce929488257995c74b9a3353b2eacae3768d1c83e",
     "skills/chant-forgejo.md": "a1a560429db736c187e0b34cf8dd9efc6ad771afefcbf6f802d160d3d5274257"
   },
-  "composite": "0081cd5b78e54825816485bdff8d43a75f9dff6f63a59c8e32c7358c88dcdab2"
+  "composite": "6b8ee9eafa0ad60a4c7bff3c450faf3de13857d7b67766ec6a870f0695152fd6"
 }

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "forgejo",
-  "version": "0.59.0",
+  "version": "0.61.0",
   "chantVersion": ">=0.1.0",
   "namespace": "Forgejo",
   "intrinsics": [],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-forgejo",
-  "version": "0.59.0",
+  "version": "0.61.0",
   "description": "Forgejo / Codeberg / Gitea Actions lexicon for chant — a thin GitHub Actions dialect",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -54,8 +54,8 @@
   },
   "peerDependencies": {
     "zod": "^4.3.6",
-    "@intentius/chant": "^0.59.0",
-    "@intentius/chant-lexicon-github": "^0.59.0"
+    "@intentius/chant": "^0.61.0",
+    "@intentius/chant-lexicon-github": "^0.61.0"
   },
   "scripts": {
     "generate": "tsx src/codegen/generate-cli.ts",

package/src/components/generate-op-pipeline.test.ts

@@ -14,6 +14,7 @@ import type { ScheduledOpSpec } from "@intentius/chant/lexicon";
 
 interface ParsedJob {
   "runs-on"?: string;
+  environment?: Record<string, string>;
   outputs?: Record<string, string>;
   steps: Array<{ id?: string; uses?: string; run?: string }>;
 }
@@ -198,3 +199,81 @@ describe("generateForgejoOpPipeline: the gated apply on push (#2243)", () => {
     expect(gh.jobs).toHaveProperty("app-apply-gate-notice");
   });
 });
+
+/**
+ * chant #2257 — the option Forgejo has no concept for at all. Unlike
+ * `permissions:`, which the runner reads and ignores, an environment is an
+ * object that does not exist on a Forgejo instance: no protection rules, no
+ * required reviewers, no wait timers. Emitting the key would read as a
+ * deployment gate and hold nothing back, so it is dropped — and, because the
+ * whole point of the option is a human holding an apply, the drop is said out
+ * loud in the file rather than only in a build warning.
+ */
+describe("generateForgejoOpPipeline: a dropped deployment environment (#2257)", () => {
+  const APPLY: ScheduledOpSpec = { name: "app-apply", trigger: { kind: "push", branches: ["main"] } };
+  const GATED: ScheduledOpSpec = { ...APPLY, environment: { name: "production" } };
+
+  /** The document a spec with no `environment` emitted before the option existed. */
+  const AUDIT_YAML_BEFORE_2257 =
+    [
+      "on:",
+      "  schedule:",
+      "    - cron: '0 6 * * *'",
+      "  workflow_dispatch: {}",
+      "",
+      "concurrency:",
+      "  group: actions-audit",
+      "  cancel-in-progress: false",
+      "",
+      "jobs:",
+      "  actions-audit:",
+      "    runs-on: docker",
+      "    container: node:22-slim",
+      "    steps:",
+      "      - uses: https://code.forgejo.org/actions/checkout@v4",
+      "      - run: chant run actions-audit",
+      "        env:",
+      "          GITHUB_TOKEN: '${{ github.token }}'",
+      "          GH_TOKEN: '${{ github.token }}'",
+    ].join("\n") + "\n";
+
+  test("a spec with no environment emits the bytes it emitted before the option existed", () => {
+    const yaml = generateForgejoOpPipeline([
+      { name: "actions-audit", schedule: "0 6 * * *", findingMode: "issue" },
+    ]).files[0].yaml;
+    expect(yaml).toBe(AUDIT_YAML_BEFORE_2257);
+  });
+
+  test("drops the key, and github with the same spec keeps it", () => {
+    const fj = parseFile(generateForgejoOpPipeline([GATED]).files[0].yaml);
+    expect(fj.jobs!["app-apply"].environment).toBeUndefined();
+    // A dialect drop, not a builder that never computed it.
+    expect(generateGithubOpPipeline([GATED]).files[0].yaml).toContain("environment:");
+  });
+
+  test("says in the generated header which environment did not survive, and what still gates", () => {
+    const yaml = generateForgejoOpPipeline([GATED]).files[0].yaml;
+    expect(yaml.startsWith("# chant dropped `environment: production`")).toBe(true);
+    expect(yaml).toContain("Forgejo Actions has no");
+    expect(yaml).toContain("not held back by anything on the forge");
+    // The gate that does survive is chant's own, which needs nothing from the forge.
+    expect(yaml).toContain("chant/lifecycle");
+    expect(yaml).toContain("approve <op> <gate>");
+  });
+
+  test("the header only appears for the Op that asked for an environment", () => {
+    const files = generateForgejoOpPipeline([
+      { ...GATED, name: "app-apply" },
+      { name: "app-watch", schedule: "0 6 * * *" },
+    ]).files;
+    expect(files[0].yaml).toContain("# chant dropped `environment: production`");
+    expect(files[1].yaml).not.toContain("# chant dropped");
+    expect(files[1].yaml.startsWith("on:")).toBe(true);
+  });
+
+  test("refuses the same malformed environment github refuses, through the shared builder", () => {
+    expect(() =>
+      generateForgejoOpPipeline([{ ...APPLY, environment: { name: "production", url: "/deploys" } }]),
+    ).toThrow(/neither an absolute http\(s\) URL nor a/);
+  });
+});

package/src/components/generate-op-pipeline.ts

@@ -35,6 +35,17 @@
  * configuration to point `gh` at a Forgejo instance, so this refuses the mode
  * by name rather than generating a job whose finding step fails on every run.
  *
+ * A spec's `environment` (#2257) is dropped on the same terms as
+ * `permissions:`, and for a stronger reason: Forgejo Actions has no
+ * environments at all — no protection rules, no required reviewers, no
+ * per-environment secrets — so the key names an object that does not exist on
+ * the instance. Dropping it silently would be the worst outcome available,
+ * because the whole point of the option is a human holding an apply, so this
+ * also writes a comment into the generated file's header saying which
+ * environment was asked for and that nothing on Forgejo enforces it. What
+ * still holds the apply here is chant's own gate (#2119), which is a fact on
+ * the `chant/lifecycle` branch and needs nothing from the forge.
+ *
  * The gated-apply notice job (#2243) does not cross over either, for the same
  * reason and by the same mechanism as `permissions:`: it shells to `gh`, which
  * a Forgejo `act_runner` neither ships nor can point at its own instance, and
@@ -64,6 +75,34 @@ function forgejoize(value: Record<string, unknown>, dialect: ForgejoDialectOptio
   return transformWorkflowObject(value, dialect).value as Record<string, unknown>;
 }
 
+/**
+ * Strip the job-level `environment:` github emitted (#2257). Forgejo Actions
+ * has no environments, so the key would read as a deployment gate and hold
+ * nothing back. Dropped from the rebuilt doc rather than from the dialect's
+ * own `DROPPED_KEYS`, so this touches the Op generator alone and leaves every
+ * other document the dialect transforms exactly as it emits today.
+ */
+function withoutEnvironment(jobsDoc: Record<string, unknown>): Record<string, unknown> {
+  return Object.fromEntries(
+    Object.entries(jobsDoc).map(([jobName, job]) => {
+      if (typeof job !== "object" || job === null || !("environment" in job)) return [jobName, job];
+      const { environment: _dropped, ...rest } = job as Record<string, unknown>;
+      return [jobName, rest];
+    }),
+  );
+}
+
+/** Say in the generated file which environment gate did not survive the crossing. */
+function droppedEnvironmentHeader(environmentName: string): string[] {
+  return [
+    `# chant dropped \`environment: ${environmentName}\` from this workflow: Forgejo Actions has no`,
+    "# environments, so there is no protection rule, required reviewer or wait timer for the key to",
+    "# name. This job is not held back by anything on the forge. What still stops the apply is chant's",
+    "# own gate: the run records a pending fact on the chant/lifecycle branch and ends, and `chant",
+    "# approve <op> <gate>` is what lets the next run through.",
+  ];
+}
+
 /**
  * Synthesize one `.forgejo/workflows/*.yml` per scheduled Op. Reuses github's
  * trigger/job structure ({@link buildGithubOpPipelineDocs}) — its `setup`-step
@@ -92,13 +131,17 @@ export function generateForgejoOpPipeline(
   const { files, jobs } = buildGithubOpPipelineDocs(ops, options);
 
   return {
-    files: files.map(({ name, doc }) => {
+    // One file per spec, in spec order, which is what lets the header below
+    // read its Op's own `environment` off the input by position.
+    files: files.map(({ name, doc }, index) => {
+      const environment = ops[index].environment;
       const forgejoDoc: GithubOpPipelineDoc = {
+        ...(environment ? { header: droppedEnvironmentHeader(environment.name) } : {}),
         on: forgejoize(doc.on, dialectOptions),
         ...(doc.env ? { env: forgejoize(doc.env, dialectOptions) } : {}),
         concurrency: forgejoize(doc.concurrency, dialectOptions),
         permissions: {},
-        jobsDoc: forgejoize(doc.jobsDoc, dialectOptions),
+        jobsDoc: forgejoize(withoutEnvironment(doc.jobsDoc), dialectOptions),
       };
       return { name, yaml: emitOpPipelineYAML(forgejoDoc) };
     }),