@intentius/chant-lexicon-github 0.105.0 → 0.106.1

package/dist/components/generate-pipeline.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generate-pipeline.d.ts","sourceRoot":"","sources":["../../src/components/generate-pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AAGH,OAAO,EAAyB,KAAK,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAKjG,OAAO,KAAK,EACV,oBAAoB,IAAI,YAAY,EACpC,wBAAwB,IAAI,qBAAqB,EACjD,uBAAuB,IAAI,oBAAoB,EAEhD,MAAM,0BAA0B,CAAC;AAGlC,YAAY,EAAE,YAAY,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,CAAC;AAE1E;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;;;OAKG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,6FAA6F;IAC7F,WAAW,EAAE,MAAM,CAAC;IACpB,8DAA8D;IAC9D,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5B,mIAAmI;IACnI,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC;;;;;;OAMG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,qDAAqD;IACrD,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,uEAAuE;IACvE,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,0DAA0D;IAC1D,IAAI,EAAE,YAAY,EAAE,CAAC;CACtB;AAmKD;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,CAWpD;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,eAAe,EAAE,EAC7B,OAAO,GAAE,qBAA0B,GAClC,iBAAiB,CAgLnB;AA4CD;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,iBAAiB,GAAG,MAAM,CAU/D;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,eAAe,EAAE,EAC7B,OAAO,GAAE,qBAA0B,GAClC,oBAAoB,CAGtB"}
+{"version":3,"file":"generate-pipeline.d.ts","sourceRoot":"","sources":["../../src/components/generate-pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AAGH,OAAO,EAAyB,KAAK,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAKjG,OAAO,KAAK,EACV,oBAAoB,IAAI,YAAY,EACpC,wBAAwB,IAAI,qBAAqB,EACjD,uBAAuB,IAAI,oBAAoB,EAEhD,MAAM,0BAA0B,CAAC;AAGlC,YAAY,EAAE,YAAY,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,CAAC;AAE1E;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;;;OAKG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,6FAA6F;IAC7F,WAAW,EAAE,MAAM,CAAC;IACpB,8DAA8D;IAC9D,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5B,mIAAmI;IACnI,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC;;;;;;OAMG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,qDAAqD;IACrD,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,uEAAuE;IACvE,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,0DAA0D;IAC1D,IAAI,EAAE,YAAY,EAAE,CAAC;CACtB;AAqMD;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,CAWpD;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,eAAe,EAAE,EAC7B,OAAO,GAAE,qBAA0B,GAClC,iBAAiB,CA+KnB;AA4CD;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,iBAAiB,GAAG,MAAM,CAU/D;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,eAAe,EAAE,EAC7B,OAAO,GAAE,qBAA0B,GAClC,oBAAoB,CAGtB"}

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "03cc71f94400e43857233bde18dcc75ea6cdc558cf5aba121b2b20302cc65abf",
+    "manifest.json": "86245b91fbd6f3569b7e78ca9b9d4241f4709598483c4b73a55627a46b2c72fd",
     "meta.json": "c50e0ef3845c370c3ad2210b8bba455980417c0f818aa6ed46e06d4fb8b1b9f9",
     "types/index.d.ts": "bdd54a4145a39a9dd4f7bbc8c500191acb6bc9057a87da0040475afac84db397",
     "rules/deprecated-action-version.ts": "d41e6e532ab7f623af1bee4ac5279fcb2baada7defa1c5d022a5bc71983e8797",
@@ -78,5 +78,5 @@
     "skills/chant-github-patterns.md": "bb3abef289a8fdfcf07d6bb2d7289dcb2f38bc0cb0321ea320b78b45a6f548c0",
     "skills/chant-github-security.md": "aab111cb0871cad30281ce48d7da23663689619351029219e2be019a1a61e394"
   },
-  "composite": "d2901c48edae88440d6c5eff9b16a26bbdbdf792924b2f3e607848975f5236e3"
+  "composite": "4970f8db5a1ce849770c89a6393a48f46854cc626fc8e458a21afe9c0567e9f3"
 }

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "github",
-  "version": "0.105.0",
+  "version": "0.106.1",
   "chantVersion": ">=0.1.0",
   "namespace": "GitHub",
   "intrinsics": [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-github",
-  "version": "0.105.0",
+  "version": "0.106.1",
   "description": "GitHub Actions lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -61,7 +61,7 @@
     "typescript": "^5.9.3"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.105.0",
+    "@intentius/chant": "^0.106.1",
     "typescript": "^5.9.3"
   }
 }

package/src/components/__fixtures__/pr-loop.github.golden.yml

@@ -15,7 +15,7 @@ jobs:
   plan:
     if: github.event_name == 'pull_request'
     runs-on: ubuntu-latest
-    container: node:22-slim
+    container: node:22
     permissions:
       contents: read
       pull-requests: write
@@ -24,6 +24,7 @@ jobs:
       - uses: actions/checkout@v7
         with:
           fetch-depth: 0
+      - run: command -v tofu >/dev/null 2>&1 || (curl -fsSL https://get.opentofu.org/install-opentofu.sh -o /tmp/install-opentofu.sh && sh /tmp/install-opentofu.sh --install-method standalone)
       - name: Plan the members this pull request reaches
         env:
           BASE_SHA: '${{ github.event.pull_request.base.sha }}'
@@ -41,7 +42,7 @@ jobs:
   apply:
     if: github.event_name == 'push'
     runs-on: ubuntu-latest
-    container: node:22-slim
+    container: node:22
     concurrency:
       group: chant-apply-prod
       cancel-in-progress: false
@@ -53,11 +54,24 @@ jobs:
       - uses: actions/checkout@v7
         with:
           fetch-depth: 0
+      - run: command -v tofu >/dev/null 2>&1 || (curl -fsSL https://get.opentofu.org/install-opentofu.sh -o /tmp/install-opentofu.sh && sh /tmp/install-opentofu.sh --install-method standalone)
+      - name: Restore the record of an earlier attempt at this commit
+        uses: actions/cache/restore@v4
+        with:
+          path: .chant/pr-resume/pr-apply.json
+          key: chant-apply-prod-${{ github.sha }}-${{ github.run_id }}-${{ github.run_attempt }}
+          restore-keys: chant-apply-prod-${{ github.sha }}-
       - name: Apply the plan a reviewer approved
         env:
           BASE_SHA: '${{ github.event.before }}'
           GITHUB_TOKEN: '${{ github.token }}'
-        run: chant components pr-apply --base "$BASE_SHA" --env prod --gate pr-apply --output .chant/pr --forge github --require-review
+        run: chant components pr-apply --base "$BASE_SHA" --env prod --gate pr-apply --output .chant/pr --forge github --require-review --resume .chant/pr-resume/pr-apply.json
+      - name: Keep the record for a re-run
+        if: always()
+        uses: actions/cache/save@v4
+        with:
+          path: .chant/pr-resume/pr-apply.json
+          key: chant-apply-prod-${{ github.sha }}-${{ github.run_id }}-${{ github.run_attempt }}
       - name: Keep the apply report
         if: always()
         uses: actions/upload-artifact@v4

package/src/components/generate-pipeline.test.ts

@@ -438,10 +438,13 @@ describe("generateGithubPipeline: gated waves (#3049)", () => {
     const steps = parsed.jobs["wave-2"].steps;
     expect(steps[0].with).toEqual({ "fetch-depth": 0 });
     expect(steps[1]).toMatchObject({ uses: "actions/download-artifact@v4", with: { name: "fan-out-record-wave-1", path: ".chant" } });
-    expect(steps[2].run).toBe(
+    // The default image is the pr-loop one: node:22, with OpenTofu installed when missing.
+    expect(parsed.jobs["wave-2"]).toMatchObject({ container: "node:22" });
+    expect(steps[2].run).toMatch(/^command -v tofu /);
+    expect(steps[3].run).toBe(
       "chant components fan-out --base HEAD~1 --env prod --wave-gate release --wave 2 --resume .chant/fan-out.json",
     );
-    expect(steps[3]).toMatchObject({ if: "always()", with: { name: "fan-out-record-wave-2", path: ".chant/fan-out.json" } });
+    expect(steps[4]).toMatchObject({ if: "always()", with: { name: "fan-out-record-wave-2", path: ".chant/fan-out.json" } });
     // Wave 1 has nothing to download.
     expect(parsed.jobs["wave-1"].steps.some((s) => s.uses === "actions/download-artifact@v4")).toBe(false);
   });

package/src/components/generate-pipeline.ts

@@ -60,7 +60,7 @@ import { emitYAML, emitYAMLEntry } from "@intentius/chant/yaml";
 import { resolveComponentGraph, type DriverComponent } from "@intentius/chant/components/driver";
 import { hasPublishStep, promoteArchivePaths } from "@intentius/chant/components/promote";
 import { GATED_WAVE_RECORD, gatedWaveJobs } from "@intentius/chant/components/gated-wave-pipeline";
-import { PR_LOOP_REPORT_DIR, prApplyGroup, prLoopJobs } from "@intentius/chant/components/pr-pipeline";
+import { PR_APPLY_RECORD, PR_LOOP_IMAGE, PR_LOOP_REPORT_DIR, prApplyGroup, prApplyRecordKey, prLoopJobs, prLoopSetup } from "@intentius/chant/components/pr-pipeline";
 import { memberRepoPath } from "@intentius/chant/lexicon";
 import type {
   ComponentPipelineJob as GeneratedJob,
@@ -142,6 +142,7 @@ function gatedWaveGithubDoc(
         with: { name: waveRecordArtifact(job.wave - 1), path: dirnameOf(GATED_WAVE_RECORD) },
       });
     }
+    for (const line of prLoopSetup(image)) steps.push({ run: line });
     for (const line of beforeScript) steps.push({ run: line });
     steps.push({ run: job.command.join(" ") });
     for (const line of extraScript) steps.push({ run: line });
@@ -183,6 +184,15 @@ function gatedWaveGithubDoc(
  * job can push, to record a pending fact on `chant/lifecycle`, and runs one
  * at a time per environment. Both keep their report as an artifact, and both
  * check out the full history, since each measures the change with git.
+ * The apply job restores its attempt record from the cache before it runs
+ * and saves it afterwards, failed or not, so a re-run of a failed apply
+ * finishes it under the same approval (#3543).
+ *
+ * For a workspace member (#3465) the run steps start in the member's
+ * directory and the report artifact is kept from there. The triggers take no
+ * path filter, since a change outside the member can reach it; the plan
+ * selects from the whole change and passes `--member`, which keeps the
+ * member's gate, note and statuses apart from the other members'.
  */
 function prLoopGithubDoc(
   env: string,
@@ -193,17 +203,40 @@ function prLoopGithubDoc(
 ): GithubPipelineDoc {
   const loop = options.prLoop!;
   const branch = loop.branch ?? "main";
-  const [plan, apply] = prLoopJobs(loop.forge ?? "github", env, loop);
+  const member = options.member;
+  const rooted = !member || member.dir === "." || member.dir === "";
+  const [plan, apply] = prLoopJobs(loop.forge ?? "github", env, loop, member?.name);
+  const reportPath = member ? memberRepoPath(member, PR_LOOP_REPORT_DIR) : PR_LOOP_REPORT_DIR;
+  // The apply's attempt record (#3543) lives in the cache under the pushed
+  // commit. Cache keys cannot be overwritten, so each attempt saves under
+  // its run and attempt, and a re-run restores the newest for the commit.
+  const recordPath = member ? memberRepoPath(member, PR_APPLY_RECORD) : PR_APPLY_RECORD;
+  const recordPrefix = `${prApplyRecordKey(env, "${{ github.sha }}", member?.name)}-`;
+  const recordKey = `${recordPrefix}\${{ github.run_id }}-\${{ github.run_attempt }}`;
+  const restoreRecord = {
+    name: "Restore the record of an earlier attempt at this commit",
+    uses: "actions/cache/restore@v4",
+    with: { path: recordPath, key: recordKey, "restore-keys": recordPrefix },
+  };
+  const saveRecord = {
+    name: "Keep the record for a re-run",
+    if: "always()",
+    uses: "actions/cache/save@v4",
+    with: { path: recordPath, key: recordKey },
+  };
   const steps = (job: typeof plan, name: string): Array<Record<string, unknown>> => [
     { uses: actionRef("actions/checkout"), with: { "fetch-depth": 0 } },
+    ...prLoopSetup(image).map((line) => ({ run: line })),
     ...beforeScript.map((line) => ({ run: line })),
+    ...(job.jobName === "apply" ? [restoreRecord] : []),
     { name, env: job.env, run: job.command },
     ...extraScript.map((line) => ({ run: line })),
+    ...(job.jobName === "apply" ? [saveRecord] : []),
     {
       name: `Keep the ${job.jobName} report`,
       if: "always()",
       uses: "actions/upload-artifact@v4",
-      with: { name: `chant-pr-${job.jobName}`, path: PR_LOOP_REPORT_DIR, "if-no-files-found": "ignore", "include-hidden-files": true },
+      with: { name: `chant-pr-${job.jobName}`, path: reportPath, "if-no-files-found": "ignore", "include-hidden-files": true },
     },
   ];
   const jobsDoc: Record<string, unknown> = {
@@ -218,15 +251,16 @@ function prLoopGithubDoc(
       if: "github.event_name == 'push'",
       "runs-on": "ubuntu-latest",
       container: image,
-      concurrency: { group: prApplyGroup(env), "cancel-in-progress": false },
+      concurrency: { group: prApplyGroup(env, member?.name), "cancel-in-progress": false },
       permissions: { contents: "write", "pull-requests": "write", statuses: "write" },
       steps: steps(apply, "Apply the plan a reviewer approved"),
     },
   };
   return {
-    name: `chant-pr-${env}`,
+    name: member ? `chant-pr-${member.name}-${env}` : `chant-pr-${env}`,
     environment: env,
     on: { pull_request: { branches: [branch] }, push: { branches: [branch] } },
+    ...(rooted ? {} : { defaults: { run: { "working-directory": member!.dir } } }),
     env: { ...options.variables, CHANT_ENV: env },
     jobsDoc,
     stages: ["plan", "apply"],
@@ -302,7 +336,7 @@ export function buildGithubPipelineDoc(
   options: GenerateGithubOptions = {},
 ): GithubPipelineDoc {
   const env = options.env ?? "production";
-  const image = options.image ?? DEFAULT_IMAGE;
+  const image = options.image ?? (options.prLoop || options.gatedWaves ? PR_LOOP_IMAGE : DEFAULT_IMAGE);
   const runCommand = options.runCommand ?? ["chant", "run", "--components", "{name}", "--env", env];
   const beforeScript = options.beforeScript ?? [];
   const extraScript = options.extraScript ?? [];
@@ -314,7 +348,6 @@ export function buildGithubPipelineDoc(
     if (options.gatedWaves || options.promoteTo !== undefined) {
       throw new Error("a pull-request pipeline has no wave or promote jobs; drop --wave-gate and --promote-to, or --pr-loop");
     }
-    if (options.member) throw new Error("a pull-request pipeline is not generated for a workspace member yet; generate it from the project outside the workspace");
     return prLoopGithubDoc(env, image, beforeScript, extraScript, options);
   }
 

package/src/components/generate-pr-pipeline.test.ts

@@ -30,6 +30,8 @@ function hasActionlint(): boolean {
 }
 
 interface Step {
+  name?: string;
+  if?: string;
   uses?: string;
   run?: string;
   env?: Record<string, string>;
@@ -73,6 +75,35 @@ describe("the GitHub pull-request workflow", () => {
     for (const job of Object.values(doc.jobs)) expect(job.steps[0].with).toEqual({ "fetch-depth": 0 });
   });
 
+  test("the apply resumes from a record the cache keeps for the pushed commit across a re-run (#3543)", () => {
+    const steps = doc.jobs.apply.steps;
+    const restore = steps.findIndex((s) => s.uses === "actions/cache/restore@v4");
+    const run = steps.findIndex((s) => s.run?.includes("pr-apply"));
+    const save = steps.findIndex((s) => s.uses === "actions/cache/save@v4");
+    expect(restore).toBeGreaterThan(-1);
+    expect(restore).toBeLessThan(run);
+    expect(save).toBeGreaterThan(run);
+    expect(steps[run].run).toContain("--resume .chant/pr-resume/pr-apply.json");
+    const key = "chant-apply-prod-${{ github.sha }}-${{ github.run_id }}-${{ github.run_attempt }}";
+    expect(steps[restore].with).toEqual({ path: ".chant/pr-resume/pr-apply.json", key, "restore-keys": "chant-apply-prod-${{ github.sha }}-" });
+    // Saved even when the apply failed, which is when a re-run needs it.
+    expect(steps[save].if).toBe("always()");
+    expect(steps[save].with).toEqual({ path: ".chant/pr-resume/pr-apply.json", key });
+    // The plan job runs the pull request's code: it neither reads nor writes the record.
+    expect(doc.jobs.plan.steps.some((s) => s.uses?.startsWith("actions/cache"))).toBe(false);
+    expect(doc.jobs.plan.steps.find((s) => s.run?.includes("pr-plan"))!.run).not.toContain("--resume");
+    // The report artifact does not carry the record, which holds the members' outputs.
+    const keep = steps.find((s) => s.uses?.startsWith("actions/upload-artifact"))!;
+    expect(keep.with?.path).toBe(".chant/pr");
+  });
+
+  test("runs in an image with git and installs OpenTofu, unless the caller names an image", () => {
+    expect(doc.jobs.plan.steps[1].run).toContain("install-opentofu");
+    const own = generateGithubPipeline(ESTATE, { env: "prod", image: "example/ci:1", prLoop: {} }).yaml;
+    expect(own).toContain("container: example/ci:1");
+    expect(own).not.toContain("install-opentofu");
+  });
+
   test("the gate, branch and review requirement are options", () => {
     const yaml = generateGithubPipeline(ESTATE, { env: "prod", prLoop: { gate: "infra-apply", branch: "trunk", requireReview: false } }).yaml;
     expect(yaml).toContain("--gate infra-apply");
@@ -85,6 +116,43 @@ describe("the GitHub pull-request workflow", () => {
     expect(() => generateGithubPipeline(ESTATE, { prLoop: {}, promoteTo: "prod" })).toThrow(/pull-request pipeline has no wave or promote jobs/);
   });
 
+  test("inside a workspace member: runs in the member's directory and keeps its own gate, note and apply group (#3465)", () => {
+    const member = { name: "network", dir: "infra/network", file: ".github/workflows/chant-pr-network-prod.yml" };
+    const scoped = generateGithubPipeline(ESTATE, { env: "prod", prLoop: {}, member });
+    const mdoc = parseYAML(scoped.yaml) as {
+      name: string;
+      on: Record<string, unknown>;
+      defaults?: { run: Record<string, string> };
+      jobs: Record<string, Job>;
+    };
+    expect(mdoc.name).toBe("chant-pr-network-prod");
+    // No path filter: a change outside the member can reach it.
+    expect(mdoc.on).toEqual({ pull_request: { branches: ["main"] }, push: { branches: ["main"] } });
+    expect(mdoc.defaults).toEqual({ run: { "working-directory": "infra/network" } });
+    const plan = mdoc.jobs.plan.steps.find((s) => s.run?.includes("pr-plan"))!;
+    expect(plan.run).toBe('chant components pr-plan --base "$BASE_SHA" --pr "$PR_NUMBER" --env prod --gate pr-apply --output .chant/pr --forge github --member network');
+    const apply = mdoc.jobs.apply.steps.find((s) => s.run?.includes("pr-apply"))!;
+    expect(apply.run).toContain("--member network");
+    expect(mdoc.jobs.apply.concurrency).toEqual({ group: "chant-apply-network-prod", "cancel-in-progress": false });
+    // The record path is relative to the member for --resume and to the repository for the cache.
+    expect(apply.run).toContain("--resume .chant/pr-resume/pr-apply.json");
+    const restore = mdoc.jobs.apply.steps.find((s) => s.uses === "actions/cache/restore@v4")!;
+    expect(restore.with).toMatchObject({ path: "infra/network/.chant/pr-resume/pr-apply.json", "restore-keys": "chant-apply-network-prod-${{ github.sha }}-" });
+    for (const job of Object.values(mdoc.jobs)) {
+      const keep = job.steps.find((s) => s.uses?.startsWith("actions/upload-artifact"))!;
+      expect(keep.with?.path).toBe("infra/network/.chant/pr");
+    }
+  });
+
+  test("a member at the workspace root keeps the root's paths but its own names", () => {
+    const yaml = generateGithubPipeline(ESTATE, { env: "prod", prLoop: {}, member: { name: "root", dir: "." } }).yaml;
+    const mdoc = parseYAML(yaml) as { name: string; defaults?: unknown; jobs: Record<string, Job> };
+    expect(mdoc.name).toBe("chant-pr-root-prod");
+    expect(mdoc.defaults).toBeUndefined();
+    expect(yaml).toContain("--member root");
+    expect(yaml).toContain("path: .chant/pr");
+  });
+
   test.skipIf(!hasActionlint())("passes actionlint", () => {
     const dir = mkdtempSync(join(tmpdir(), "chant-actionlint-"));
     try {