@intentius/chant-lexicon-github 0.102.0 → 0.104.1

package/dist/components/generate-pipeline.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generate-pipeline.d.ts","sourceRoot":"","sources":["../../src/components/generate-pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AAGH,OAAO,EAAyB,KAAK,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAGjG,OAAO,KAAK,EACV,oBAAoB,IAAI,YAAY,EACpC,wBAAwB,IAAI,qBAAqB,EACjD,uBAAuB,IAAI,oBAAoB,EAEhD,MAAM,0BAA0B,CAAC;AAGlC,YAAY,EAAE,YAAY,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,CAAC;AAE1E;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;;;OAKG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,6FAA6F;IAC7F,WAAW,EAAE,MAAM,CAAC;IACpB,8DAA8D;IAC9D,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5B,mIAAmI;IACnI,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC;;;;;;OAMG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,qDAAqD;IACrD,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,uEAAuE;IACvE,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,0DAA0D;IAC1D,IAAI,EAAE,YAAY,EAAE,CAAC;CACtB;AA6BD;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,CAWpD;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,eAAe,EAAE,EAC7B,OAAO,GAAE,qBAA0B,GAClC,iBAAiB,CAmKnB;AA4CD;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,iBAAiB,GAAG,MAAM,CAU/D;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,eAAe,EAAE,EAC7B,OAAO,GAAE,qBAA0B,GAClC,oBAAoB,CAGtB"}
+{"version":3,"file":"generate-pipeline.d.ts","sourceRoot":"","sources":["../../src/components/generate-pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AAGH,OAAO,EAAyB,KAAK,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAKjG,OAAO,KAAK,EACV,oBAAoB,IAAI,YAAY,EACpC,wBAAwB,IAAI,qBAAqB,EACjD,uBAAuB,IAAI,oBAAoB,EAEhD,MAAM,0BAA0B,CAAC;AAGlC,YAAY,EAAE,YAAY,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,CAAC;AAE1E;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;;;OAKG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,6FAA6F;IAC7F,WAAW,EAAE,MAAM,CAAC;IACpB,8DAA8D;IAC9D,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5B,mIAAmI;IACnI,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC;;;;;;OAMG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,qDAAqD;IACrD,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,uEAAuE;IACvE,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,0DAA0D;IAC1D,IAAI,EAAE,YAAY,EAAE,CAAC;CACtB;AAmKD;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,CAWpD;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,eAAe,EAAE,EAC7B,OAAO,GAAE,qBAA0B,GAClC,iBAAiB,CAgLnB;AA4CD;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,iBAAiB,GAAG,MAAM,CAU/D;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,eAAe,EAAE,EAC7B,OAAO,GAAE,qBAA0B,GAClC,oBAAoB,CAGtB"}

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "acb14fd2e5c1d90d4de3e5400297d5f0e94abde98b5325f30e56eff59cc15440",
+    "manifest.json": "fdb92786145ee3d5605d434aa59832d4feb14b3663b5963b012710546606e047",
     "meta.json": "c50e0ef3845c370c3ad2210b8bba455980417c0f818aa6ed46e06d4fb8b1b9f9",
     "types/index.d.ts": "bdd54a4145a39a9dd4f7bbc8c500191acb6bc9057a87da0040475afac84db397",
     "rules/deprecated-action-version.ts": "d41e6e532ab7f623af1bee4ac5279fcb2baada7defa1c5d022a5bc71983e8797",
@@ -78,5 +78,5 @@
     "skills/chant-github-patterns.md": "bb3abef289a8fdfcf07d6bb2d7289dcb2f38bc0cb0321ea320b78b45a6f548c0",
     "skills/chant-github-security.md": "aab111cb0871cad30281ce48d7da23663689619351029219e2be019a1a61e394"
   },
-  "composite": "4ca047e656894e9ca5b89957a7622a8851c3297e5540ef5bba9914e478320553"
+  "composite": "4120e5c5daf8c9e06b7a2702a881c96d81964046b4723c1b036ac52fe54b5826"
 }

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "github",
-  "version": "0.102.0",
+  "version": "0.104.1",
   "chantVersion": ">=0.1.0",
   "namespace": "GitHub",
   "intrinsics": [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-github",
-  "version": "0.102.0",
+  "version": "0.104.1",
   "description": "GitHub Actions lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -61,7 +61,7 @@
     "typescript": "^5.9.3"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.102.0",
+    "@intentius/chant": "^0.104.1",
     "typescript": "^5.9.3"
   }
 }

package/src/components/__fixtures__/pr-loop.github.golden.yml

@@ -0,0 +1,68 @@
+name: chant-pr-prod
+
+on:
+  pull_request:
+    branches:
+      - main
+  push:
+    branches:
+      - main
+
+env:
+  CHANT_ENV: prod
+
+jobs:
+  plan:
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    container: node:22-slim
+    permissions:
+      contents: read
+      pull-requests: write
+      statuses: write
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+      - name: Plan the members this pull request reaches
+        env:
+          BASE_SHA: '${{ github.event.pull_request.base.sha }}'
+          PR_NUMBER: '${{ github.event.pull_request.number }}'
+          GITHUB_TOKEN: '${{ github.token }}'
+        run: chant components pr-plan --base "$BASE_SHA" --pr "$PR_NUMBER" --env prod --gate pr-apply --output .chant/pr --forge github
+      - name: Keep the plan report
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: chant-pr-plan
+          path: .chant/pr
+          if-no-files-found: ignore
+          include-hidden-files: true
+  apply:
+    if: github.event_name == 'push'
+    runs-on: ubuntu-latest
+    container: node:22-slim
+    concurrency:
+      group: chant-apply-prod
+      cancel-in-progress: false
+    permissions:
+      contents: write
+      pull-requests: write
+      statuses: write
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+      - name: Apply the plan a reviewer approved
+        env:
+          BASE_SHA: '${{ github.event.before }}'
+          GITHUB_TOKEN: '${{ github.token }}'
+        run: chant components pr-apply --base "$BASE_SHA" --env prod --gate pr-apply --output .chant/pr --forge github --require-review
+      - name: Keep the apply report
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: chant-pr-apply
+          path: .chant/pr
+          if-no-files-found: ignore
+          include-hidden-files: true

package/src/components/generate-pipeline.test.ts

@@ -421,3 +421,32 @@ describe("generateGithubPipeline: a promote job (#2575)", () => {
     expect(artifactRoot(["/tmp/out/a.tar", "/tmp/out/b.tar"])).toBe("/tmp/out");
   });
 });
+
+describe("generateGithubPipeline: gated waves (#3049)", () => {
+  const roots: DriverComponent[] = [
+    { name: "net", deploy: [] },
+    { name: "a", dependsOn: ["net"], deploy: [] },
+    { name: "app", dependsOn: ["a"], deploy: [] },
+  ];
+
+  test("one job per wave, each handing the attempt record to the next", () => {
+    const result = generateGithubPipeline(roots, { env: "prod", gatedWaves: { gate: "release" } });
+    const parsed = parseYAML(result.yaml) as { jobs: Record<string, { needs?: string[]; steps: Array<Record<string, unknown>> }> };
+    expect(Object.keys(parsed.jobs)).toEqual(["wave-1", "wave-2", "wave-3"]);
+    expect(parsed.jobs["wave-2"].needs).toEqual(["wave-1"]);
+
+    const steps = parsed.jobs["wave-2"].steps;
+    expect(steps[0].with).toEqual({ "fetch-depth": 0 });
+    expect(steps[1]).toMatchObject({ uses: "actions/download-artifact@v4", with: { name: "fan-out-record-wave-1", path: ".chant" } });
+    expect(steps[2].run).toBe(
+      "chant components fan-out --base HEAD~1 --env prod --wave-gate release --wave 2 --resume .chant/fan-out.json",
+    );
+    expect(steps[3]).toMatchObject({ if: "always()", with: { name: "fan-out-record-wave-2", path: ".chant/fan-out.json" } });
+    // Wave 1 has nothing to download.
+    expect(parsed.jobs["wave-1"].steps.some((s) => s.uses === "actions/download-artifact@v4")).toBe(false);
+  });
+
+  test("a gated-wave pipeline has no promote job", () => {
+    expect(() => generateGithubPipeline(roots, { gatedWaves: { gate: "release" }, promoteTo: "prod" })).toThrow(/no promote job/);
+  });
+});

package/src/components/generate-pipeline.ts

@@ -59,6 +59,8 @@
 import { emitYAML, emitYAMLEntry } from "@intentius/chant/yaml";
 import { resolveComponentGraph, type DriverComponent } from "@intentius/chant/components/driver";
 import { hasPublishStep, promoteArchivePaths } from "@intentius/chant/components/promote";
+import { GATED_WAVE_RECORD, gatedWaveJobs } from "@intentius/chant/components/gated-wave-pipeline";
+import { PR_LOOP_REPORT_DIR, prApplyGroup, prLoopJobs } from "@intentius/chant/components/pr-pipeline";
 import { memberRepoPath } from "@intentius/chant/lexicon";
 import type {
   ComponentPipelineJob as GeneratedJob,
@@ -107,6 +109,140 @@ export interface GithubPipelineDoc {
   jobs: GeneratedJob[];
 }
 
+/** The workflow artifact the gated-wave jobs hand their attempt record through, one per wave. */
+function waveRecordArtifact(wave: number): string {
+  return `fan-out-record-wave-${wave}`;
+}
+
+/**
+ * The gated-wave workflow (#3049): one job per wave, each running one wave of
+ * `chant components fan-out --wave-gate`, chained by `needs:`. Each job
+ * downloads the record the job before it uploaded and uploads its own, even
+ * when it stops at a gate (exit 3), so re-running it after `chant approve`
+ * reads the record. The checkout fetches full history for `--base`.
+ */
+function gatedWaveGithubDoc(
+  components: DriverComponent[],
+  env: string,
+  image: string,
+  beforeScript: string[],
+  extraScript: string[],
+  options: GenerateGithubOptions,
+): GithubPipelineDoc {
+  const waveJobs = gatedWaveJobs(components, env, options.gatedWaves!);
+  const jobsDoc: Record<string, unknown> = {};
+  const jobs: GeneratedJob[] = [];
+  for (const job of waveJobs) {
+    jobs.push({ jobName: job.jobName, component: `wave ${job.wave}`, stage: job.jobName, needs: job.needs });
+    const steps: Array<Record<string, unknown>> = [{ uses: actionRef("actions/checkout"), with: { "fetch-depth": 0 } }];
+    if (job.wave > 1) {
+      steps.push({
+        name: `Download the record wave ${job.wave - 1} left`,
+        uses: "actions/download-artifact@v4",
+        with: { name: waveRecordArtifact(job.wave - 1), path: dirnameOf(GATED_WAVE_RECORD) },
+      });
+    }
+    for (const line of beforeScript) steps.push({ run: line });
+    steps.push({ run: job.command.join(" ") });
+    for (const line of extraScript) steps.push({ run: line });
+    steps.push({
+      name: `Upload the record for wave ${job.wave}`,
+      if: "always()",
+      uses: "actions/upload-artifact@v4",
+      with: {
+        name: waveRecordArtifact(job.wave),
+        path: GATED_WAVE_RECORD,
+        "if-no-files-found": "ignore",
+        "include-hidden-files": true,
+        overwrite: true,
+      },
+    });
+    jobsDoc[job.jobName] = {
+      "runs-on": "ubuntu-latest",
+      ...(job.needs.length > 0 ? { needs: job.needs } : {}),
+      container: image,
+      steps,
+    };
+  }
+  const doc: GithubPipelineDoc = {
+    name: `chant-components-${env}`,
+    environment: env,
+    on: { workflow_dispatch: {} },
+    env: { ...options.variables, CHANT_ENV: env },
+    jobsDoc,
+    stages: waveJobs.map((j) => j.jobName),
+    jobs,
+  };
+  return options.member ? scopeToMember(doc, options.member) : doc;
+}
+
+/**
+ * The pull-request workflow (#3183): `plan` on each pull request into the
+ * target branch, `apply` on each push to it. The plan job can comment and set
+ * statuses but cannot push, since it runs the pull request's code; the apply
+ * job can push, to record a pending fact on `chant/lifecycle`, and runs one
+ * at a time per environment. Both keep their report as an artifact, and both
+ * check out the full history, since each measures the change with git.
+ */
+function prLoopGithubDoc(
+  env: string,
+  image: string,
+  beforeScript: string[],
+  extraScript: string[],
+  options: GenerateGithubOptions,
+): GithubPipelineDoc {
+  const loop = options.prLoop!;
+  const branch = loop.branch ?? "main";
+  const [plan, apply] = prLoopJobs(loop.forge ?? "github", env, loop);
+  const steps = (job: typeof plan, name: string): Array<Record<string, unknown>> => [
+    { uses: actionRef("actions/checkout"), with: { "fetch-depth": 0 } },
+    ...beforeScript.map((line) => ({ run: line })),
+    { name, env: job.env, run: job.command },
+    ...extraScript.map((line) => ({ run: line })),
+    {
+      name: `Keep the ${job.jobName} report`,
+      if: "always()",
+      uses: "actions/upload-artifact@v4",
+      with: { name: `chant-pr-${job.jobName}`, path: PR_LOOP_REPORT_DIR, "if-no-files-found": "ignore", "include-hidden-files": true },
+    },
+  ];
+  const jobsDoc: Record<string, unknown> = {
+    plan: {
+      if: "github.event_name == 'pull_request'",
+      "runs-on": "ubuntu-latest",
+      container: image,
+      permissions: { contents: "read", "pull-requests": "write", statuses: "write" },
+      steps: steps(plan, "Plan the members this pull request reaches"),
+    },
+    apply: {
+      if: "github.event_name == 'push'",
+      "runs-on": "ubuntu-latest",
+      container: image,
+      concurrency: { group: prApplyGroup(env), "cancel-in-progress": false },
+      permissions: { contents: "write", "pull-requests": "write", statuses: "write" },
+      steps: steps(apply, "Apply the plan a reviewer approved"),
+    },
+  };
+  return {
+    name: `chant-pr-${env}`,
+    environment: env,
+    on: { pull_request: { branches: [branch] }, push: { branches: [branch] } },
+    env: { ...options.variables, CHANT_ENV: env },
+    jobsDoc,
+    stages: ["plan", "apply"],
+    jobs: [
+      { jobName: "plan", component: "pull request plan", stage: "plan", needs: [] },
+      { jobName: "apply", component: "pull request apply", stage: "apply", needs: [] },
+    ],
+  };
+}
+
+/** The directory part of a relative path, `.` when there is none. */
+function dirnameOf(path: string): string {
+  const i = path.lastIndexOf("/");
+  return i <= 0 ? "." : path.slice(0, i);
+}
+
 /** GitHub Actions job ids must match `[a-zA-Z_][a-zA-Z0-9_-]*`; component names are already kebab-case in every fixture, but normalize defensively (mirrors gitlab's `toJobName`). */
 function toJobName(componentName: string): string {
   return componentName.replace(/([a-z0-9])([A-Z])/g, "$1-$2").toLowerCase();
@@ -174,6 +310,19 @@ export function buildGithubPipelineDoc(
   const { waves } = resolveComponentGraph(components);
   const byName = new Map(components.map((c) => [c.name, c]));
 
+  if (options.prLoop) {
+    if (options.gatedWaves || options.promoteTo !== undefined) {
+      throw new Error("a pull-request pipeline has no wave or promote jobs; drop --wave-gate and --promote-to, or --pr-loop");
+    }
+    if (options.member) throw new Error("a pull-request pipeline is not generated for a workspace member yet; generate it from the project outside the workspace");
+    return prLoopGithubDoc(env, image, beforeScript, extraScript, options);
+  }
+
+  if (options.gatedWaves) {
+    if (options.promoteTo !== undefined) throw new Error("a gated-wave pipeline has no promote job; drop --promote-to or --wave-gate");
+    return gatedWaveGithubDoc(components, env, image, beforeScript, extraScript, options);
+  }
+
   // Components that something else depends on must hand their resolved outputs
   // (stack outputs, published artifact refs) to their dependents, which run as
   // separate jobs on separate runners. Each such producer dumps its outputs to

package/src/components/generate-pr-pipeline.test.ts

@@ -0,0 +1,98 @@
+/**
+ * The generated pull-request workflow for GitHub Actions (#3183): a plan job
+ * on each pull request, an apply job on each push to the target branch. The
+ * whole file has a golden, and actionlint checks it when it is installed.
+ */
+
+import { execFileSync } from "node:child_process";
+import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { describe, expect, test } from "vitest";
+import { parseYAML } from "@intentius/chant/yaml";
+import type { DriverComponent } from "@intentius/chant/components/driver";
+import { generateGithubPipeline } from "./generate-pipeline";
+
+const ESTATE: DriverComponent[] = [
+  { name: "net", dependsOn: [], deploy: [{ phase: "Apply", steps: [{ kind: "terraform-apply", root: "net" }] }] },
+  { name: "app", dependsOn: ["net"], deploy: [{ phase: "Apply", steps: [{ kind: "terraform-apply", root: "app" }] }] },
+];
+
+const GOLDEN = join(import.meta.dirname, "__fixtures__", "pr-loop.github.golden.yml");
+
+function hasActionlint(): boolean {
+  try {
+    execFileSync("actionlint", ["-version"], { stdio: "ignore" });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+interface Step {
+  uses?: string;
+  run?: string;
+  env?: Record<string, string>;
+  with?: Record<string, unknown>;
+}
+interface Job {
+  if: string;
+  permissions: Record<string, string>;
+  concurrency?: Record<string, unknown>;
+  steps: Step[];
+}
+
+describe("the GitHub pull-request workflow", () => {
+  const result = generateGithubPipeline(ESTATE, { env: "prod", prLoop: {} });
+  const doc = parseYAML(result.yaml) as { name: string; on: Record<string, unknown>; jobs: Record<string, Job> };
+
+  test("matches its golden", () => {
+    if (process.env.UPDATE_GOLDEN) writeFileSync(GOLDEN, result.yaml);
+    expect(result.yaml).toBe(readFileSync(GOLDEN, "utf-8"));
+  });
+
+  test("plans on a pull request into main and applies on a push to it", () => {
+    expect(doc.name).toBe("chant-pr-prod");
+    expect(doc.on).toEqual({ pull_request: { branches: ["main"] }, push: { branches: ["main"] } });
+    expect(doc.jobs.plan.if).toBe("github.event_name == 'pull_request'");
+    expect(doc.jobs.apply.if).toBe("github.event_name == 'push'");
+    expect(result.jobs.map((j) => j.jobName)).toEqual(["plan", "apply"]);
+  });
+
+  test("the plan job measures from the pull request's base and cannot push; the apply job can, one at a time", () => {
+    const plan = doc.jobs.plan.steps.find((s) => s.run?.includes("pr-plan"))!;
+    expect(plan.run).toBe('chant components pr-plan --base "$BASE_SHA" --pr "$PR_NUMBER" --env prod --gate pr-apply --output .chant/pr --forge github');
+    expect(plan.env).toMatchObject({ BASE_SHA: "${{ github.event.pull_request.base.sha }}", PR_NUMBER: "${{ github.event.pull_request.number }}" });
+    expect(doc.jobs.plan.permissions).toEqual({ contents: "read", "pull-requests": "write", statuses: "write" });
+
+    const apply = doc.jobs.apply.steps.find((s) => s.run?.includes("pr-apply"))!;
+    expect(apply.run).toContain("--require-review");
+    expect(apply.env).toMatchObject({ BASE_SHA: "${{ github.event.before }}" });
+    expect(doc.jobs.apply.permissions.contents).toBe("write");
+    expect(doc.jobs.apply.concurrency).toEqual({ group: "chant-apply-prod", "cancel-in-progress": false });
+    for (const job of Object.values(doc.jobs)) expect(job.steps[0].with).toEqual({ "fetch-depth": 0 });
+  });
+
+  test("the gate, branch and review requirement are options", () => {
+    const yaml = generateGithubPipeline(ESTATE, { env: "prod", prLoop: { gate: "infra-apply", branch: "trunk", requireReview: false } }).yaml;
+    expect(yaml).toContain("--gate infra-apply");
+    expect(yaml).toContain("- trunk");
+    expect(yaml).not.toContain("--require-review");
+  });
+
+  test("refuses a wave or promote job beside it", () => {
+    expect(() => generateGithubPipeline(ESTATE, { prLoop: {}, gatedWaves: { gate: "g" } })).toThrow(/pull-request pipeline has no wave or promote jobs/);
+    expect(() => generateGithubPipeline(ESTATE, { prLoop: {}, promoteTo: "prod" })).toThrow(/pull-request pipeline has no wave or promote jobs/);
+  });
+
+  test.skipIf(!hasActionlint())("passes actionlint", () => {
+    const dir = mkdtempSync(join(tmpdir(), "chant-actionlint-"));
+    try {
+      mkdirSync(join(dir, ".github", "workflows"), { recursive: true });
+      writeFileSync(join(dir, ".github", "workflows", "chant-pr.yml"), result.yaml);
+      expect(() => execFileSync("actionlint", [".github/workflows/chant-pr.yml"], { cwd: dir, encoding: "utf8" })).not.toThrow();
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+});