@intentius/chant-lexicon-github 0.105.1 → 0.106.3

package/dist/components/generate-pipeline.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generate-pipeline.d.ts","sourceRoot":"","sources":["../../src/components/generate-pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AAGH,OAAO,EAAyB,KAAK,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAKjG,OAAO,KAAK,EACV,oBAAoB,IAAI,YAAY,EACpC,wBAAwB,IAAI,qBAAqB,EACjD,uBAAuB,IAAI,oBAAoB,EAEhD,MAAM,0BAA0B,CAAC;AAGlC,YAAY,EAAE,YAAY,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,CAAC;AAE1E;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;;;OAKG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,6FAA6F;IAC7F,WAAW,EAAE,MAAM,CAAC;IACpB,8DAA8D;IAC9D,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5B,mIAAmI;IACnI,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC;;;;;;OAMG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,qDAAqD;IACrD,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,uEAAuE;IACvE,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,0DAA0D;IAC1D,IAAI,EAAE,YAAY,EAAE,CAAC;CACtB;AAmKD;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,CAWpD;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,eAAe,EAAE,EAC7B,OAAO,GAAE,qBAA0B,GAClC,iBAAiB,CAgLnB;AA4CD;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,iBAAiB,GAAG,MAAM,CAU/D;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,eAAe,EAAE,EAC7B,OAAO,GAAE,qBAA0B,GAClC,oBAAoB,CAGtB"}
+{"version":3,"file":"generate-pipeline.d.ts","sourceRoot":"","sources":["../../src/components/generate-pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AAGH,OAAO,EAAyB,KAAK,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAKjG,OAAO,KAAK,EACV,oBAAoB,IAAI,YAAY,EACpC,wBAAwB,IAAI,qBAAqB,EACjD,uBAAuB,IAAI,oBAAoB,EAEhD,MAAM,0BAA0B,CAAC;AAGlC,YAAY,EAAE,YAAY,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,CAAC;AAE1E;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;;;OAKG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,6FAA6F;IAC7F,WAAW,EAAE,MAAM,CAAC;IACpB,8DAA8D;IAC9D,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5B,mIAAmI;IACnI,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC;;;;;;OAMG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,qDAAqD;IACrD,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,uEAAuE;IACvE,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,0DAA0D;IAC1D,IAAI,EAAE,YAAY,EAAE,CAAC;CACtB;AAqMD;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,CAWpD;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,eAAe,EAAE,EAC7B,OAAO,GAAE,qBAA0B,GAClC,iBAAiB,CA+KnB;AA4CD;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,iBAAiB,GAAG,MAAM,CAU/D;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,eAAe,EAAE,EAC7B,OAAO,GAAE,qBAA0B,GAClC,oBAAoB,CAGtB"}

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "f3d178ea3c655fff55f1eca010e2c202c7334b0d8e3734b68b225662e5998431",
+    "manifest.json": "bc9354c7588b77975a1fc52ebe5fb14915137fa87a6982c32c464f12c30c2b80",
     "meta.json": "c50e0ef3845c370c3ad2210b8bba455980417c0f818aa6ed46e06d4fb8b1b9f9",
     "types/index.d.ts": "bdd54a4145a39a9dd4f7bbc8c500191acb6bc9057a87da0040475afac84db397",
     "rules/deprecated-action-version.ts": "d41e6e532ab7f623af1bee4ac5279fcb2baada7defa1c5d022a5bc71983e8797",
@@ -78,5 +78,5 @@
     "skills/chant-github-patterns.md": "bb3abef289a8fdfcf07d6bb2d7289dcb2f38bc0cb0321ea320b78b45a6f548c0",
     "skills/chant-github-security.md": "aab111cb0871cad30281ce48d7da23663689619351029219e2be019a1a61e394"
   },
-  "composite": "eea703724be625f8a5a47551ed5f5b211fb78a13a5846a3682d492abee6e0106"
+  "composite": "3b71f70f79d394ab86c7cd10ffc18228599568f05f9588335786c50ce73dc3a2"
 }

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "github",
-  "version": "0.105.1",
+  "version": "0.106.3",
   "chantVersion": ">=0.1.0",
   "namespace": "GitHub",
   "intrinsics": [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-github",
-  "version": "0.105.1",
+  "version": "0.106.3",
   "description": "GitHub Actions lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -61,7 +61,7 @@
     "typescript": "^5.9.3"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.105.1",
+    "@intentius/chant": "^0.106.3",
     "typescript": "^5.9.3"
   }
 }

package/src/components/__fixtures__/pr-loop.github.golden.yml

@@ -15,7 +15,7 @@ jobs:
   plan:
     if: github.event_name == 'pull_request'
     runs-on: ubuntu-latest
-    container: node:22-slim
+    container: node:22
     permissions:
       contents: read
       pull-requests: write
@@ -24,6 +24,7 @@ jobs:
       - uses: actions/checkout@v7
         with:
           fetch-depth: 0
+      - run: command -v tofu >/dev/null 2>&1 || (curl -fsSL https://get.opentofu.org/install-opentofu.sh -o /tmp/install-opentofu.sh && sh /tmp/install-opentofu.sh --install-method standalone)
       - name: Plan the members this pull request reaches
         env:
           BASE_SHA: '${{ github.event.pull_request.base.sha }}'
@@ -41,7 +42,7 @@ jobs:
   apply:
     if: github.event_name == 'push'
     runs-on: ubuntu-latest
-    container: node:22-slim
+    container: node:22
     concurrency:
       group: chant-apply-prod
       cancel-in-progress: false
@@ -53,11 +54,24 @@ jobs:
       - uses: actions/checkout@v7
         with:
           fetch-depth: 0
+      - run: command -v tofu >/dev/null 2>&1 || (curl -fsSL https://get.opentofu.org/install-opentofu.sh -o /tmp/install-opentofu.sh && sh /tmp/install-opentofu.sh --install-method standalone)
+      - name: Restore the record of an earlier attempt at this commit
+        uses: actions/cache/restore@v4
+        with:
+          path: .chant/pr-resume/pr-apply.json
+          key: chant-apply-prod-${{ github.sha }}-${{ github.run_id }}-${{ github.run_attempt }}
+          restore-keys: chant-apply-prod-${{ github.sha }}-
       - name: Apply the plan a reviewer approved
         env:
           BASE_SHA: '${{ github.event.before }}'
           GITHUB_TOKEN: '${{ github.token }}'
-        run: chant components pr-apply --base "$BASE_SHA" --env prod --gate pr-apply --output .chant/pr --forge github --require-review
+        run: chant components pr-apply --base "$BASE_SHA" --env prod --gate pr-apply --output .chant/pr --forge github --require-review --resume .chant/pr-resume/pr-apply.json
+      - name: Keep the record for a re-run
+        if: always()
+        uses: actions/cache/save@v4
+        with:
+          path: .chant/pr-resume/pr-apply.json
+          key: chant-apply-prod-${{ github.sha }}-${{ github.run_id }}-${{ github.run_attempt }}
       - name: Keep the apply report
         if: always()
         uses: actions/upload-artifact@v4

package/src/components/generate-pipeline.member.test.ts

@@ -49,7 +49,7 @@ describe("generateGithubPipeline for a workspace member", () => {
   test("run steps start in the member's directory, and the name carries the member", () => {
     const doc = parseYAML(generateGithubPipeline(components, { env: "staging", member: api }).yaml) as unknown as Doc;
     expect(doc.defaults).toEqual({ run: { "working-directory": "services/api" } });
-    expect(doc.name).toBe("chant-components-api-staging");
+    expect(doc.name).toBe("chant-components.api.staging");
   });
 
   test("artifact paths move under the member's directory, where the run steps write them", () => {

package/src/components/generate-pipeline.test.ts

@@ -438,10 +438,13 @@ describe("generateGithubPipeline: gated waves (#3049)", () => {
     const steps = parsed.jobs["wave-2"].steps;
     expect(steps[0].with).toEqual({ "fetch-depth": 0 });
     expect(steps[1]).toMatchObject({ uses: "actions/download-artifact@v4", with: { name: "fan-out-record-wave-1", path: ".chant" } });
-    expect(steps[2].run).toBe(
+    // The default image is the pr-loop one: node:22, with OpenTofu installed when missing.
+    expect(parsed.jobs["wave-2"]).toMatchObject({ container: "node:22" });
+    expect(steps[2].run).toMatch(/^command -v tofu /);
+    expect(steps[3].run).toBe(
       "chant components fan-out --base HEAD~1 --env prod --wave-gate release --wave 2 --resume .chant/fan-out.json",
     );
-    expect(steps[3]).toMatchObject({ if: "always()", with: { name: "fan-out-record-wave-2", path: ".chant/fan-out.json" } });
+    expect(steps[4]).toMatchObject({ if: "always()", with: { name: "fan-out-record-wave-2", path: ".chant/fan-out.json" } });
     // Wave 1 has nothing to download.
     expect(parsed.jobs["wave-1"].steps.some((s) => s.uses === "actions/download-artifact@v4")).toBe(false);
   });

package/src/components/generate-pipeline.ts

@@ -60,7 +60,7 @@ import { emitYAML, emitYAMLEntry } from "@intentius/chant/yaml";
 import { resolveComponentGraph, type DriverComponent } from "@intentius/chant/components/driver";
 import { hasPublishStep, promoteArchivePaths } from "@intentius/chant/components/promote";
 import { GATED_WAVE_RECORD, gatedWaveJobs } from "@intentius/chant/components/gated-wave-pipeline";
-import { PR_LOOP_REPORT_DIR, prApplyGroup, prLoopJobs } from "@intentius/chant/components/pr-pipeline";
+import { PR_APPLY_RECORD, PR_LOOP_IMAGE, PR_LOOP_REPORT_DIR, prApplyGroup, prApplyRecordKey, prLoopJobs, prLoopSetup } from "@intentius/chant/components/pr-pipeline";
 import { memberRepoPath } from "@intentius/chant/lexicon";
 import type {
   ComponentPipelineJob as GeneratedJob,
@@ -142,6 +142,7 @@ function gatedWaveGithubDoc(
         with: { name: waveRecordArtifact(job.wave - 1), path: dirnameOf(GATED_WAVE_RECORD) },
       });
     }
+    for (const line of prLoopSetup(image)) steps.push({ run: line });
     for (const line of beforeScript) steps.push({ run: line });
     steps.push({ run: job.command.join(" ") });
     for (const line of extraScript) steps.push({ run: line });
@@ -183,6 +184,15 @@ function gatedWaveGithubDoc(
  * job can push, to record a pending fact on `chant/lifecycle`, and runs one
  * at a time per environment. Both keep their report as an artifact, and both
  * check out the full history, since each measures the change with git.
+ * The apply job restores its attempt record from the cache before it runs
+ * and saves it afterwards, failed or not, so a re-run of a failed apply
+ * finishes it under the same approval (#3543).
+ *
+ * For a workspace member (#3465) the run steps start in the member's
+ * directory and the report artifact is kept from there. The triggers take no
+ * path filter, since a change outside the member can reach it; the plan
+ * selects from the whole change and passes `--member`, which keeps the
+ * member's gate, note and statuses apart from the other members'.
  */
 function prLoopGithubDoc(
   env: string,
@@ -193,17 +203,40 @@ function prLoopGithubDoc(
 ): GithubPipelineDoc {
   const loop = options.prLoop!;
   const branch = loop.branch ?? "main";
-  const [plan, apply] = prLoopJobs(loop.forge ?? "github", env, loop);
+  const member = options.member;
+  const rooted = !member || member.dir === "." || member.dir === "";
+  const [plan, apply] = prLoopJobs(loop.forge ?? "github", env, loop, member?.name);
+  const reportPath = member ? memberRepoPath(member, PR_LOOP_REPORT_DIR) : PR_LOOP_REPORT_DIR;
+  // The apply's attempt record (#3543) lives in the cache under the pushed
+  // commit. Cache keys cannot be overwritten, so each attempt saves under
+  // its run and attempt, and a re-run restores the newest for the commit.
+  const recordPath = member ? memberRepoPath(member, PR_APPLY_RECORD) : PR_APPLY_RECORD;
+  const recordPrefix = `${prApplyRecordKey(env, "${{ github.sha }}", member?.name)}-`;
+  const recordKey = `${recordPrefix}\${{ github.run_id }}-\${{ github.run_attempt }}`;
+  const restoreRecord = {
+    name: "Restore the record of an earlier attempt at this commit",
+    uses: "actions/cache/restore@v4",
+    with: { path: recordPath, key: recordKey, "restore-keys": recordPrefix },
+  };
+  const saveRecord = {
+    name: "Keep the record for a re-run",
+    if: "always()",
+    uses: "actions/cache/save@v4",
+    with: { path: recordPath, key: recordKey },
+  };
   const steps = (job: typeof plan, name: string): Array<Record<string, unknown>> => [
     { uses: actionRef("actions/checkout"), with: { "fetch-depth": 0 } },
+    ...prLoopSetup(image).map((line) => ({ run: line })),
     ...beforeScript.map((line) => ({ run: line })),
+    ...(job.jobName === "apply" ? [restoreRecord] : []),
     { name, env: job.env, run: job.command },
     ...extraScript.map((line) => ({ run: line })),
+    ...(job.jobName === "apply" ? [saveRecord] : []),
     {
       name: `Keep the ${job.jobName} report`,
       if: "always()",
       uses: "actions/upload-artifact@v4",
-      with: { name: `chant-pr-${job.jobName}`, path: PR_LOOP_REPORT_DIR, "if-no-files-found": "ignore", "include-hidden-files": true },
+      with: { name: `chant-pr-${job.jobName}`, path: reportPath, "if-no-files-found": "ignore", "include-hidden-files": true },
     },
   ];
   const jobsDoc: Record<string, unknown> = {
@@ -218,15 +251,16 @@ function prLoopGithubDoc(
       if: "github.event_name == 'push'",
       "runs-on": "ubuntu-latest",
       container: image,
-      concurrency: { group: prApplyGroup(env), "cancel-in-progress": false },
+      concurrency: { group: prApplyGroup(env, member?.name), "cancel-in-progress": false },
       permissions: { contents: "write", "pull-requests": "write", statuses: "write" },
       steps: steps(apply, "Apply the plan a reviewer approved"),
     },
   };
   return {
-    name: `chant-pr-${env}`,
+    name: member ? `chant-pr.${member.name}.${env}` : `chant-pr-${env}`,
     environment: env,
     on: { pull_request: { branches: [branch] }, push: { branches: [branch] } },
+    ...(rooted ? {} : { defaults: { run: { "working-directory": member!.dir } } }),
     env: { ...options.variables, CHANT_ENV: env },
     jobsDoc,
     stages: ["plan", "apply"],
@@ -302,7 +336,7 @@ export function buildGithubPipelineDoc(
   options: GenerateGithubOptions = {},
 ): GithubPipelineDoc {
   const env = options.env ?? "production";
-  const image = options.image ?? DEFAULT_IMAGE;
+  const image = options.image ?? (options.prLoop || options.gatedWaves ? PR_LOOP_IMAGE : DEFAULT_IMAGE);
   const runCommand = options.runCommand ?? ["chant", "run", "--components", "{name}", "--env", env];
   const beforeScript = options.beforeScript ?? [];
   const extraScript = options.extraScript ?? [];
@@ -314,7 +348,6 @@ export function buildGithubPipelineDoc(
     if (options.gatedWaves || options.promoteTo !== undefined) {
       throw new Error("a pull-request pipeline has no wave or promote jobs; drop --wave-gate and --promote-to, or --pr-loop");
     }
-    if (options.member) throw new Error("a pull-request pipeline is not generated for a workspace member yet; generate it from the project outside the workspace");
     return prLoopGithubDoc(env, image, beforeScript, extraScript, options);
   }
 
@@ -501,7 +534,7 @@ function scopeToMember(doc: GithubPipelineDoc, member: PipelineMember): GithubPi
   }
   return {
     ...doc,
-    name: `chant-components-${member.name}-${doc.environment}`,
+    name: `chant-components.${member.name}.${doc.environment}`,
     ...(rooted ? {} : { defaults: { run: { "working-directory": member.dir } } }),
     jobsDoc,
   };

package/src/components/generate-pr-pipeline.test.ts

@@ -11,6 +11,7 @@ import { join } from "node:path";
 import { describe, expect, test } from "vitest";
 import { parseYAML } from "@intentius/chant/yaml";
 import type { DriverComponent } from "@intentius/chant/components/driver";
+import { prApplyGroup, prApplyRecordKey } from "@intentius/chant/components/pr-pipeline";
 import { generateGithubPipeline } from "./generate-pipeline";
 
 const ESTATE: DriverComponent[] = [
@@ -30,6 +31,8 @@ function hasActionlint(): boolean {
 }
 
 interface Step {
+  name?: string;
+  if?: string;
   uses?: string;
   run?: string;
   env?: Record<string, string>;
@@ -73,6 +76,35 @@ describe("the GitHub pull-request workflow", () => {
     for (const job of Object.values(doc.jobs)) expect(job.steps[0].with).toEqual({ "fetch-depth": 0 });
   });
 
+  test("the apply resumes from a record the cache keeps for the pushed commit across a re-run (#3543)", () => {
+    const steps = doc.jobs.apply.steps;
+    const restore = steps.findIndex((s) => s.uses === "actions/cache/restore@v4");
+    const run = steps.findIndex((s) => s.run?.includes("pr-apply"));
+    const save = steps.findIndex((s) => s.uses === "actions/cache/save@v4");
+    expect(restore).toBeGreaterThan(-1);
+    expect(restore).toBeLessThan(run);
+    expect(save).toBeGreaterThan(run);
+    expect(steps[run].run).toContain("--resume .chant/pr-resume/pr-apply.json");
+    const key = "chant-apply-prod-${{ github.sha }}-${{ github.run_id }}-${{ github.run_attempt }}";
+    expect(steps[restore].with).toEqual({ path: ".chant/pr-resume/pr-apply.json", key, "restore-keys": "chant-apply-prod-${{ github.sha }}-" });
+    // Saved even when the apply failed, which is when a re-run needs it.
+    expect(steps[save].if).toBe("always()");
+    expect(steps[save].with).toEqual({ path: ".chant/pr-resume/pr-apply.json", key });
+    // The plan job runs the pull request's code: it neither reads nor writes the record.
+    expect(doc.jobs.plan.steps.some((s) => s.uses?.startsWith("actions/cache"))).toBe(false);
+    expect(doc.jobs.plan.steps.find((s) => s.run?.includes("pr-plan"))!.run).not.toContain("--resume");
+    // The report artifact does not carry the record, which holds the members' outputs.
+    const keep = steps.find((s) => s.uses?.startsWith("actions/upload-artifact"))!;
+    expect(keep.with?.path).toBe(".chant/pr");
+  });
+
+  test("runs in an image with git and installs OpenTofu, unless the caller names an image", () => {
+    expect(doc.jobs.plan.steps[1].run).toContain("install-opentofu");
+    const own = generateGithubPipeline(ESTATE, { env: "prod", image: "example/ci:1", prLoop: {} }).yaml;
+    expect(own).toContain("container: example/ci:1");
+    expect(own).not.toContain("install-opentofu");
+  });
+
   test("the gate, branch and review requirement are options", () => {
     const yaml = generateGithubPipeline(ESTATE, { env: "prod", prLoop: { gate: "infra-apply", branch: "trunk", requireReview: false } }).yaml;
     expect(yaml).toContain("--gate infra-apply");
@@ -85,6 +117,53 @@ describe("the GitHub pull-request workflow", () => {
     expect(() => generateGithubPipeline(ESTATE, { prLoop: {}, promoteTo: "prod" })).toThrow(/pull-request pipeline has no wave or promote jobs/);
   });
 
+  test("inside a workspace member: runs in the member's directory and keeps its own gate, note and apply group (#3465)", () => {
+    const member = { name: "network", dir: "infra/network", file: ".github/workflows/chant-pr.network.prod.yml" };
+    const scoped = generateGithubPipeline(ESTATE, { env: "prod", prLoop: {}, member });
+    const mdoc = parseYAML(scoped.yaml) as {
+      name: string;
+      on: Record<string, unknown>;
+      defaults?: { run: Record<string, string> };
+      jobs: Record<string, Job>;
+    };
+    expect(mdoc.name).toBe("chant-pr.network.prod");
+    // No path filter: a change outside the member can reach it.
+    expect(mdoc.on).toEqual({ pull_request: { branches: ["main"] }, push: { branches: ["main"] } });
+    expect(mdoc.defaults).toEqual({ run: { "working-directory": "infra/network" } });
+    const plan = mdoc.jobs.plan.steps.find((s) => s.run?.includes("pr-plan"))!;
+    expect(plan.run).toBe('chant components pr-plan --base "$BASE_SHA" --pr "$PR_NUMBER" --env prod --gate pr-apply --output .chant/pr --forge github --member network');
+    const apply = mdoc.jobs.apply.steps.find((s) => s.run?.includes("pr-apply"))!;
+    expect(apply.run).toContain("--member network");
+    expect(mdoc.jobs.apply.concurrency).toEqual({ group: "chant-apply.network.prod", "cancel-in-progress": false });
+    // The record path is relative to the member for --resume and to the repository for the cache.
+    expect(apply.run).toContain("--resume .chant/pr-resume/pr-apply.json");
+    const restore = mdoc.jobs.apply.steps.find((s) => s.uses === "actions/cache/restore@v4")!;
+    expect(restore.with).toMatchObject({ path: "infra/network/.chant/pr-resume/pr-apply.json", "restore-keys": "chant-apply.network.prod-${{ github.sha }}-" });
+    for (const job of Object.values(mdoc.jobs)) {
+      const keep = job.steps.find((s) => s.uses?.startsWith("actions/upload-artifact"))!;
+      expect(keep.with?.path).toBe("infra/network/.chant/pr");
+    }
+  });
+
+  test("no two member and environment pairs share an apply group or record key", () => {
+    expect(prApplyGroup("b-c", "a")).toBe("chant-apply.a.b-c");
+    expect(prApplyGroup("c", "a-b")).toBe("chant-apply.a-b.c");
+    expect(prApplyGroup("b-c", "a")).not.toBe(prApplyGroup("c", "a-b"));
+    expect(prApplyRecordKey("b-c", "abc", "a")).not.toBe(prApplyRecordKey("c", "abc", "a-b"));
+    // A single project's group never looks like a member's.
+    expect(prApplyGroup("a-b-c")).toBe("chant-apply-a-b-c");
+    expect(prApplyGroup("a.b-c")).not.toBe(prApplyGroup("b-c", "a"));
+  });
+
+  test("a member at the workspace root keeps the root's paths but its own names", () => {
+    const yaml = generateGithubPipeline(ESTATE, { env: "prod", prLoop: {}, member: { name: "root", dir: "." } }).yaml;
+    const mdoc = parseYAML(yaml) as { name: string; defaults?: unknown; jobs: Record<string, Job> };
+    expect(mdoc.name).toBe("chant-pr.root.prod");
+    expect(mdoc.defaults).toBeUndefined();
+    expect(yaml).toContain("--member root");
+    expect(yaml).toContain("path: .chant/pr");
+  });
+
   test.skipIf(!hasActionlint())("passes actionlint", () => {
     const dir = mkdtempSync(join(tmpdir(), "chant-actionlint-"));
     try {

package/src/composites/composites.test.ts

@@ -13,30 +13,33 @@ import { DockerBuild } from "./docker-build";
 import { DeployEnvironment } from "./deploy-environment";
 import { GoCI } from "./go-ci";
 
+// The generated resource classes type `props` as unknown; the tests read it as a record.
+const propsOf = (entity: unknown): Record<string, any> => (entity as { props: Record<string, any> }).props;
+
 // ── Checkout ────────────────────────────────────────────────────────
 
 describe("Checkout", () => {
   test("returns step with checkout action", () => {
     const result = Checkout({});
     expect(result.step).toBeDefined();
-    expect(result.step.props.uses).toBe("actions/checkout@v7");
-    expect(result.step.props.name).toBe("Checkout");
+    expect(propsOf(result.step).uses).toBe("actions/checkout@v7");
+    expect(propsOf(result.step).name).toBe("Checkout");
   });
 
   test("passes ref as with input", () => {
     const result = Checkout({ ref: "develop" });
-    expect(result.step.props.with).toBeDefined();
-    expect((result.step.props.with as Record<string, string>).ref).toBe("develop");
+    expect(propsOf(result.step).with).toBeDefined();
+    expect((propsOf(result.step).with as Record<string, string>).ref).toBe("develop");
   });
 
   test("passes fetchDepth as with input", () => {
     const result = Checkout({ fetchDepth: 0 });
-    expect((result.step.props.with as Record<string, string>)["fetch-depth"]).toBe("0");
+    expect((propsOf(result.step).with as Record<string, string>)["fetch-depth"]).toBe("0");
   });
 
   test("omits with when no optional props", () => {
     const result = Checkout({});
-    expect(result.step.props.with).toBeUndefined();
+    expect(propsOf(result.step).with).toBeUndefined();
   });
 });
 
@@ -45,18 +48,18 @@ describe("Checkout", () => {
 describe("SetupNode", () => {
   test("returns step with setup-node action", () => {
     const result = SetupNode({});
-    expect(result.step.props.uses).toBe("actions/setup-node@v7");
-    expect(result.step.props.name).toBe("Setup Node.js");
+    expect(propsOf(result.step).uses).toBe("actions/setup-node@v7");
+    expect(propsOf(result.step).name).toBe("Setup Node.js");
   });
 
   test("passes nodeVersion", () => {
     const result = SetupNode({ nodeVersion: "22" });
-    expect((result.step.props.with as Record<string, string>)["node-version"]).toBe("22");
+    expect((propsOf(result.step).with as Record<string, string>)["node-version"]).toBe("22");
   });
 
   test("passes cache option", () => {
     const result = SetupNode({ cache: "npm" });
-    expect((result.step.props.with as Record<string, string>).cache).toBe("npm");
+    expect((propsOf(result.step).with as Record<string, string>).cache).toBe("npm");
   });
 });
 
@@ -65,12 +68,12 @@ describe("SetupNode", () => {
 describe("SetupGo", () => {
   test("returns step with setup-go action", () => {
     const result = SetupGo({});
-    expect(result.step.props.uses).toBe("actions/setup-go@v5");
+    expect(propsOf(result.step).uses).toBe("actions/setup-go@v5");
   });
 
   test("passes goVersion", () => {
     const result = SetupGo({ goVersion: "1.22" });
-    expect((result.step.props.with as Record<string, string>)["go-version"]).toBe("1.22");
+    expect((propsOf(result.step).with as Record<string, string>)["go-version"]).toBe("1.22");
   });
 });
 
@@ -79,12 +82,12 @@ describe("SetupGo", () => {
 describe("SetupPython", () => {
   test("returns step with setup-python action", () => {
     const result = SetupPython({});
-    expect(result.step.props.uses).toBe("actions/setup-python@v5");
+    expect(propsOf(result.step).uses).toBe("actions/setup-python@v5");
   });
 
   test("passes pythonVersion", () => {
     const result = SetupPython({ pythonVersion: "3.12" });
-    expect((result.step.props.with as Record<string, string>)["python-version"]).toBe("3.12");
+    expect((propsOf(result.step).with as Record<string, string>)["python-version"]).toBe("3.12");
   });
 });
 
@@ -93,9 +96,9 @@ describe("SetupPython", () => {
 describe("CacheAction", () => {
   test("returns step with cache action", () => {
     const result = CacheAction({ path: "node_modules", key: "npm-${{ hashFiles('package-lock.json') }}" });
-    expect(result.step.props.uses).toBe("actions/cache@v4");
-    expect((result.step.props.with as Record<string, string>).path).toBe("node_modules");
-    expect((result.step.props.with as Record<string, string>).key).toBe("npm-${{ hashFiles('package-lock.json') }}");
+    expect(propsOf(result.step).uses).toBe("actions/cache@v4");
+    expect((propsOf(result.step).with as Record<string, string>).path).toBe("node_modules");
+    expect((propsOf(result.step).with as Record<string, string>).key).toBe("npm-${{ hashFiles('package-lock.json') }}");
   });
 });
 
@@ -104,14 +107,14 @@ describe("CacheAction", () => {
 describe("UploadArtifact", () => {
   test("returns step with upload action", () => {
     const result = UploadArtifact({ name: "build", path: "dist/" });
-    expect(result.step.props.uses).toBe("actions/upload-artifact@v4");
-    expect((result.step.props.with as Record<string, string>).name).toBe("build");
-    expect((result.step.props.with as Record<string, string>).path).toBe("dist/");
+    expect(propsOf(result.step).uses).toBe("actions/upload-artifact@v4");
+    expect((propsOf(result.step).with as Record<string, string>).name).toBe("build");
+    expect((propsOf(result.step).with as Record<string, string>).path).toBe("dist/");
   });
 
   test("passes retentionDays", () => {
     const result = UploadArtifact({ name: "build", path: "dist/", retentionDays: 7 });
-    expect((result.step.props.with as Record<string, string>)["retention-days"]).toBe("7");
+    expect((propsOf(result.step).with as Record<string, string>)["retention-days"]).toBe("7");
   });
 });
 
@@ -120,8 +123,8 @@ describe("UploadArtifact", () => {
 describe("DownloadArtifact", () => {
   test("returns step with download action", () => {
     const result = DownloadArtifact({ name: "build" });
-    expect(result.step.props.uses).toBe("actions/download-artifact@v4");
-    expect((result.step.props.with as Record<string, string>).name).toBe("build");
+    expect(propsOf(result.step).uses).toBe("actions/download-artifact@v4");
+    expect((propsOf(result.step).with as Record<string, string>).name).toBe("build");
   });
 });
 
@@ -136,39 +139,39 @@ describe("NodeCI", () => {
 
   test("workflow has CI name", () => {
     const result = NodeCI({});
-    expect(result.workflow.props.name).toBe("CI");
+    expect(propsOf(result.workflow).name).toBe("CI");
   });
 
   test("job has ubuntu-latest runner", () => {
     const result = NodeCI({});
-    expect(result.job.props["runs-on"]).toBe("ubuntu-latest");
+    expect(propsOf(result.job)["runs-on"]).toBe("ubuntu-latest");
   });
 
   test("job has steps array", () => {
     const result = NodeCI({});
-    expect(Array.isArray(result.job.props.steps)).toBe(true);
-    expect((result.job.props.steps as unknown[]).length).toBe(5);
+    expect(Array.isArray(propsOf(result.job).steps)).toBe(true);
+    expect((propsOf(result.job).steps as unknown[]).length).toBe(5);
   });
 
   test("uses default npm commands", () => {
     const result = NodeCI({});
-    const steps = result.job.props.steps as Array<{ props: Record<string, unknown> }>;
+    const steps = propsOf(result.job).steps as Array<{ props: Record<string, unknown> }>;
     const installStep = steps[2];
-    expect(installStep.props.run).toBe("npm ci");
+    expect(propsOf(installStep).run).toBe("npm ci");
   });
 
   test("uses pnpm when specified", () => {
     const result = NodeCI({ packageManager: "pnpm" });
-    const steps = result.job.props.steps as Array<{ props: Record<string, unknown> }>;
+    const steps = propsOf(result.job).steps as Array<{ props: Record<string, unknown> }>;
     const installStep = steps[2];
-    expect(installStep.props.run).toBe("pnpm install");
+    expect(propsOf(installStep).run).toBe("pnpm install");
   });
 
   test("uses custom installCommand", () => {
     const result = NodeCI({ installCommand: "yarn install --frozen-lockfile" });
-    const steps = result.job.props.steps as Array<{ props: Record<string, unknown> }>;
+    const steps = propsOf(result.job).steps as Array<{ props: Record<string, unknown> }>;
     const installStep = steps[2];
-    expect(installStep.props.run).toBe("yarn install --frozen-lockfile");
+    expect(propsOf(installStep).run).toBe("yarn install --frozen-lockfile");
   });
 });
 
@@ -184,98 +187,98 @@ describe("NodePipeline", () => {
 
   test("workflow has Node Pipeline name", () => {
     const result = NodePipeline({});
-    expect(result.workflow.props.name).toBe("Node Pipeline");
+    expect(propsOf(result.workflow).name).toBe("Node Pipeline");
   });
 
   test("buildJob has 5 steps (checkout, setup, install, build, upload)", () => {
     const result = NodePipeline({});
-    const steps = result.buildJob.props.steps as unknown[];
+    const steps = propsOf(result.buildJob).steps as unknown[];
     expect(steps.length).toBe(5);
   });
 
   test("testJob has 5 steps (checkout, setup, install, download, test)", () => {
     const result = NodePipeline({});
-    const steps = result.testJob.props.steps as unknown[];
+    const steps = propsOf(result.testJob).steps as unknown[];
     expect(steps.length).toBe(5);
   });
 
   test("testJob depends on build", () => {
     const result = NodePipeline({});
-    expect(result.testJob.props.needs).toEqual(["build"]);
+    expect(propsOf(result.testJob).needs).toEqual(["build"]);
   });
 
   test("uses npm ci by default", () => {
     const result = NodePipeline({});
-    const steps = result.buildJob.props.steps as Array<{ props: Record<string, unknown> }>;
+    const steps = propsOf(result.buildJob).steps as Array<{ props: Record<string, unknown> }>;
     expect(steps[2].props.run).toBe("npm ci");
   });
 
   test("uses pnpm install with frozen lockfile", () => {
     const result = NodePipeline({ packageManager: "pnpm" });
-    const steps = result.buildJob.props.steps as Array<{ props: Record<string, unknown> }>;
+    const steps = propsOf(result.buildJob).steps as Array<{ props: Record<string, unknown> }>;
     expect(steps[2].props.run).toBe("pnpm install --frozen-lockfile");
   });
 
   test("uses yarn install with frozen lockfile", () => {
     const result = NodePipeline({ packageManager: "yarn" });
-    const steps = result.buildJob.props.steps as Array<{ props: Record<string, unknown> }>;
+    const steps = propsOf(result.buildJob).steps as Array<{ props: Record<string, unknown> }>;
     expect(steps[2].props.run).toBe("yarn install --frozen-lockfile");
   });
 
   test("bun uses oven-sh/setup-bun instead of setup-node", () => {
     const result = NodePipeline({ packageManager: "bun" });
-    const steps = result.buildJob.props.steps as Array<{ props: Record<string, unknown> }>;
+    const steps = propsOf(result.buildJob).steps as Array<{ props: Record<string, unknown> }>;
     expect(steps[1].props.uses).toBe("oven-sh/setup-bun@v2");
     expect(steps[1].props.name).toBe("Setup Bun");
   });
 
   test("bun uses bun install with frozen lockfile", () => {
     const result = NodePipeline({ packageManager: "bun" });
-    const steps = result.buildJob.props.steps as Array<{ props: Record<string, unknown> }>;
+    const steps = propsOf(result.buildJob).steps as Array<{ props: Record<string, unknown> }>;
     expect(steps[2].props.run).toBe("bun install --frozen-lockfile");
   });
 
   test("npm setup step has cache: npm", () => {
     const result = NodePipeline({ packageManager: "npm" });
-    const steps = result.buildJob.props.steps as Array<{ props: Record<string, unknown> }>;
+    const steps = propsOf(result.buildJob).steps as Array<{ props: Record<string, unknown> }>;
     expect((steps[1].props.with as Record<string, string>).cache).toBe("npm");
   });
 
   test("upload step uses upload-artifact with configured name", () => {
     const result = NodePipeline({ artifactName: "my-build" });
-    const steps = result.buildJob.props.steps as Array<{ props: Record<string, unknown> }>;
+    const steps = propsOf(result.buildJob).steps as Array<{ props: Record<string, unknown> }>;
     expect(steps[4].props.uses).toBe("actions/upload-artifact@v4");
     expect((steps[4].props.with as Record<string, string>).name).toBe("my-build");
   });
 
   test("download step in testJob uses configured artifact name", () => {
     const result = NodePipeline({ artifactName: "my-build" });
-    const steps = result.testJob.props.steps as Array<{ props: Record<string, unknown> }>;
+    const steps = propsOf(result.testJob).steps as Array<{ props: Record<string, unknown> }>;
     expect(steps[3].props.uses).toBe("actions/download-artifact@v4");
     expect((steps[3].props.with as Record<string, string>).name).toBe("my-build");
   });
 
   test("uses custom runsOn", () => {
     const result = NodePipeline({ runsOn: "self-hosted" });
-    expect(result.buildJob.props["runs-on"]).toBe("self-hosted");
-    expect(result.testJob.props["runs-on"]).toBe("self-hosted");
+    expect(propsOf(result.buildJob)["runs-on"]).toBe("self-hosted");
+    expect(propsOf(result.testJob)["runs-on"]).toBe("self-hosted");
   });
 
   test("uses custom installCommand", () => {
     const result = NodePipeline({ installCommand: "npm install --legacy-peer-deps" });
-    const steps = result.buildJob.props.steps as Array<{ props: Record<string, unknown> }>;
+    const steps = propsOf(result.buildJob).steps as Array<{ props: Record<string, unknown> }>;
     expect(steps[2].props.run).toBe("npm install --legacy-peer-deps");
   });
 
   test("build step uses configured script", () => {
     const result = NodePipeline({ buildScript: "compile" });
-    const steps = result.buildJob.props.steps as Array<{ props: Record<string, unknown> }>;
+    const steps = propsOf(result.buildJob).steps as Array<{ props: Record<string, unknown> }>;
     expect(steps[3].props.run).toBe("npm run compile");
   });
 
   test("test step uses configured script", () => {
     const result = NodePipeline({ testScript: "test:ci" });
-    const steps = result.testJob.props.steps as Array<{ props: Record<string, unknown> }>;
+    const steps = propsOf(result.testJob).steps as Array<{ props: Record<string, unknown> }>;
     expect(steps[4].props.run).toBe("npm run test:ci");
   });
 });
@@ -285,7 +288,7 @@ describe("NodePipeline", () => {
 describe("BunPipeline", () => {
   test("defaults to bun package manager", () => {
     const result = BunPipeline({});
-    const steps = result.buildJob.props.steps as Array<{ props: Record<string, unknown> }>;
+    const steps = propsOf(result.buildJob).steps as Array<{ props: Record<string, unknown> }>;
     expect(steps[1].props.uses).toBe("oven-sh/setup-bun@v2");
     expect(steps[2].props.run).toBe("bun install --frozen-lockfile");
   });
@@ -294,7 +297,7 @@ describe("BunPipeline", () => {
 describe("PnpmPipeline", () => {
   test("defaults to pnpm package manager", () => {
     const result = PnpmPipeline({});
-    const steps = result.buildJob.props.steps as Array<{ props: Record<string, unknown> }>;
+    const steps = propsOf(result.buildJob).steps as Array<{ props: Record<string, unknown> }>;
     expect((steps[1].props.with as Record<string, string>).cache).toBe("pnpm");
     expect(steps[2].props.run).toBe("pnpm install --frozen-lockfile");
   });
@@ -303,7 +306,7 @@ describe("PnpmPipeline", () => {
 describe("YarnPipeline", () => {
   test("defaults to yarn package manager", () => {
     const result = YarnPipeline({});
-    const steps = result.buildJob.props.steps as Array<{ props: Record<string, unknown> }>;
+    const steps = propsOf(result.buildJob).steps as Array<{ props: Record<string, unknown> }>;
     expect((steps[1].props.with as Record<string, string>).cache).toBe("yarn");
     expect(steps[2].props.run).toBe("yarn install --frozen-lockfile");
   });
@@ -320,7 +323,7 @@ describe("PythonCI", () => {
 
   test("workflow has Python CI name", () => {
     const result = PythonCI({});
-    expect(result.workflow.props.name).toBe("Python CI");
+    expect(propsOf(result.workflow).name).toBe("Python CI");
   });
 
   test("includes lintJob by default", () => {
@@ -335,66 +338,66 @@ describe("PythonCI", () => {
 
   test("testJob uses setup-python with default version", () => {
     const result = PythonCI({});
-    const steps = result.testJob.props.steps as Array<{ props: Record<string, unknown> }>;
+    const steps = propsOf(result.testJob).steps as Array<{ props: Record<string, unknown> }>;
     const setupStep = steps[1];
-    expect(setupStep.props.uses).toBe("actions/setup-python@v5");
-    expect((setupStep.props.with as Record<string, string>)["python-version"]).toBe("3.12");
+    expect(propsOf(setupStep).uses).toBe("actions/setup-python@v5");
+    expect((propsOf(setupStep).with as Record<string, string>)["python-version"]).toBe("3.12");
   });
 
   test("testJob uses pip cache by default", () => {
     const result = PythonCI({});
-    const steps = result.testJob.props.steps as Array<{ props: Record<string, unknown> }>;
+    const steps = propsOf(result.testJob).steps as Array<{ props: Record<string, unknown> }>;
     expect((steps[1].props.with as Record<string, string>).cache).toBe("pip");
   });
 
   test("poetry mode uses poetry cache", () => {
     const result = PythonCI({ usePoetry: true });
-    const steps = result.testJob.props.steps as Array<{ props: Record<string, unknown> }>;
+    const steps = propsOf(result.testJob).steps as Array<{ props: Record<string, unknown> }>;
     expect((steps[1].props.with as Record<string, string>).cache).toBe("poetry");
   });
 
   test("poetry mode installs poetry first", () => {
     const result = PythonCI({ usePoetry: true });
-    const steps = result.testJob.props.steps as Array<{ props: Record<string, unknown> }>;
+    const steps = propsOf(result.testJob).steps as Array<{ props: Record<string, unknown> }>;
     expect(steps[2].props.run).toBe("pip install poetry");
     expect(steps[3].props.run).toBe("poetry install");
   });
 
   test("pip mode installs from requirements.txt", () => {
     const result = PythonCI({});
-    const steps = result.testJob.props.steps as Array<{ props: Record<string, unknown> }>;
+    const steps = propsOf(result.testJob).steps as Array<{ props: Record<string, unknown> }>;
     expect(steps[2].props.run).toBe("pip install -r requirements.txt");
   });
 
   test("uses custom requirements file", () => {
     const result = PythonCI({ requirementsFile: "requirements-dev.txt" });
-    const steps = result.testJob.props.steps as Array<{ props: Record<string, unknown> }>;
+    const steps = propsOf(result.testJob).steps as Array<{ props: Record<string, unknown> }>;
     expect(steps[2].props.run).toBe("pip install -r requirements-dev.txt");
   });
 
   test("test step uses configured command", () => {
     const result = PythonCI({ testCommand: "python -m pytest" });
-    const steps = result.testJob.props.steps as Array<{ props: Record<string, unknown> }>;
+    const steps = propsOf(result.testJob).steps as Array<{ props: Record<string, unknown> }>;
     const lastStep = steps[steps.length - 1];
-    expect(lastStep.props.run).toBe("python -m pytest");
+    expect(propsOf(lastStep).run).toBe("python -m pytest");
   });
 
   test("lint step uses configured command", () => {
     const result = PythonCI({ lintCommand: "flake8 ." });
-    const steps = result.lintJob!.props.steps as Array<{ props: Record<string, unknown> }>;
+    const steps = propsOf(result.lintJob!).steps as Array<{ props: Record<string, unknown> }>;
     const lastStep = steps[steps.length - 1];
-    expect(lastStep.props.run).toBe("flake8 .");
+    expect(propsOf(lastStep).run).toBe("flake8 .");
   });
 
   test("uses custom python version", () => {
     const result = PythonCI({ pythonVersion: "3.11" });
-    const steps = result.testJob.props.steps as Array<{ props: Record<string, unknown> }>;
+    const steps = propsOf(result.testJob).steps as Array<{ props: Record<string, unknown> }>;
     expect((steps[1].props.with as Record<string, string>)["python-version"]).toBe("3.11");
   });
 
   test("uses custom runsOn", () => {
     const result = PythonCI({ runsOn: "macos-latest" });
-    expect(result.testJob.props["runs-on"]).toBe("macos-latest");
+    expect(propsOf(result.testJob)["runs-on"]).toBe("macos-latest");
   });
 });
 
@@ -409,90 +412,90 @@ describe("DockerBuild", () => {
 
   test("workflow has Docker Build name", () => {
     const result = DockerBuild({});
-    expect(result.workflow.props.name).toBe("Docker Build");
+    expect(propsOf(result.workflow).name).toBe("Docker Build");
   });
 
   test("workflow has packages write permission", () => {
     const result = DockerBuild({});
-    expect((result.workflow.props.permissions as Record<string, string>).packages).toBe("write");
-    expect((result.workflow.props.permissions as Record<string, string>).contents).toBe("read");
+    expect((propsOf(result.workflow).permissions as Record<string, string>).packages).toBe("write");
+    expect((propsOf(result.workflow).permissions as Record<string, string>).contents).toBe("read");
   });
 
   test("job has 5 steps", () => {
     const result = DockerBuild({});
-    const steps = result.job.props.steps as unknown[];
+    const steps = propsOf(result.job).steps as unknown[];
     expect(steps.length).toBe(5);
   });
 
   test("uses docker/login-action", () => {
     const result = DockerBuild({});
-    const steps = result.job.props.steps as Array<{ props: Record<string, unknown> }>;
+    const steps = propsOf(result.job).steps as Array<{ props: Record<string, unknown> }>;
     expect(steps[1].props.uses).toBe("docker/login-action@v3");
   });
 
   test("uses docker/setup-buildx-action", () => {
     const result = DockerBuild({});
-    const steps = result.job.props.steps as Array<{ props: Record<string, unknown> }>;
+    const steps = propsOf(result.job).steps as Array<{ props: Record<string, unknown> }>;
     expect(steps[2].props.uses).toBe("docker/setup-buildx-action@v3");
   });
 
   test("uses docker/metadata-action", () => {
     const result = DockerBuild({});
-    const steps = result.job.props.steps as Array<{ props: Record<string, unknown> }>;
+    const steps = propsOf(result.job).steps as Array<{ props: Record<string, unknown> }>;
     expect(steps[3].props.uses).toBe("docker/metadata-action@v5");
   });
 
   test("uses docker/build-push-action", () => {
     const result = DockerBuild({});
-    const steps = result.job.props.steps as Array<{ props: Record<string, unknown> }>;
+    const steps = propsOf(result.job).steps as Array<{ props: Record<string, unknown> }>;
     expect(steps[4].props.uses).toBe("docker/build-push-action@v6");
   });
 
   test("login step uses ghcr.io by default", () => {
     const result = DockerBuild({});
-    const steps = result.job.props.steps as Array<{ props: Record<string, unknown> }>;
+    const steps = propsOf(result.job).steps as Array<{ props: Record<string, unknown> }>;
     expect((steps[1].props.with as Record<string, string>).registry).toBe("ghcr.io");
   });
 
   test("uses custom registry", () => {
     const result = DockerBuild({ registry: "docker.io" });
-    const steps = result.job.props.steps as Array<{ props: Record<string, unknown> }>;
+    const steps = propsOf(result.job).steps as Array<{ props: Record<string, unknown> }>;
     expect((steps[1].props.with as Record<string, string>).registry).toBe("docker.io");
   });
 
   test("build-push step has push: true by default", () => {
     const result = DockerBuild({});
-    const steps = result.job.props.steps as Array<{ props: Record<string, unknown> }>;
+    const steps = propsOf(result.job).steps as Array<{ props: Record<string, unknown> }>;
     expect((steps[4].props.with as Record<string, string>).push).toBe("true");
   });
 
   test("build-push step uses configured dockerfile", () => {
     const result = DockerBuild({ dockerfile: "Dockerfile.prod" });
-    const steps = result.job.props.steps as Array<{ props: Record<string, unknown> }>;
+    const steps = propsOf(result.job).steps as Array<{ props: Record<string, unknown> }>;
     expect((steps[4].props.with as Record<string, string>).file).toBe("Dockerfile.prod");
   });
 
   test("build-push step includes platforms when specified", () => {
     const result = DockerBuild({ platforms: ["linux/amd64", "linux/arm64"] });
-    const steps = result.job.props.steps as Array<{ props: Record<string, unknown> }>;
+    const steps = propsOf(result.job).steps as Array<{ props: Record<string, unknown> }>;
     expect((steps[4].props.with as Record<string, string>).platforms).toBe("linux/amd64,linux/arm64");
   });
 
   test("build-push step omits platforms when not specified", () => {
     const result = DockerBuild({});
-    const steps = result.job.props.steps as Array<{ props: Record<string, unknown> }>;
+    const steps = propsOf(result.job).steps as Array<{ props: Record<string, unknown> }>;
     expect((steps[4].props.with as Record<string, string>).platforms).toBeUndefined();
   });
 
   test("build-push step includes build-args when specified", () => {
     const result = DockerBuild({ buildArgs: { NODE_ENV: "production", VERSION: "1.0" } });
-    const steps = result.job.props.steps as Array<{ props: Record<string, unknown> }>;
+    const steps = propsOf(result.job).steps as Array<{ props: Record<string, unknown> }>;
     expect((steps[4].props.with as Record<string, string>)["build-args"]).toBe("NODE_ENV=production\nVERSION=1.0");
   });
 
   test("uses custom runsOn", () => {
     const result = DockerBuild({ runsOn: "self-hosted" });
-    expect(result.job.props["runs-on"]).toBe("self-hosted");
+    expect(propsOf(result.job)["runs-on"]).toBe("self-hosted");
   });
 });
 
@@ -507,7 +510,7 @@ describe("DeployEnvironment", () => {
 
   test("deployJob has environment with name", () => {
     const result = DeployEnvironment({ name: "staging", deployScript: "npm run deploy" });
-    expect((result.deployJob.props.environment as Record<string, string>).name).toBe("staging");
+    expect((propsOf(result.deployJob).environment as Record<string, string>).name).toBe("staging");
   });
 
   test("deployJob has environment url when specified", () => {
@@ -516,12 +519,12 @@ describe("DeployEnvironment", () => {
       deployScript: "npm run deploy",
       url: "https://staging.example.com",
     });
-    expect((result.deployJob.props.environment as Record<string, string>).url).toBe("https://staging.example.com");
+    expect((propsOf(result.deployJob).environment as Record<string, string>).url).toBe("https://staging.example.com");
   });
 
   test("deployJob has concurrency group", () => {
     const result = DeployEnvironment({ name: "staging", deployScript: "npm run deploy" });
-    const concurrency = result.deployJob.props.concurrency as Record<string, unknown>;
+    const concurrency = propsOf(result.deployJob).concurrency as Record<string, unknown>;
     expect(concurrency.group).toBe("deploy-staging");
     expect(concurrency["cancel-in-progress"]).toBe(true);
   });
@@ -532,13 +535,13 @@ describe("DeployEnvironment", () => {
       deployScript: "npm run deploy",
       concurrencyGroup: "custom-group",
     });
-    const concurrency = result.deployJob.props.concurrency as Record<string, unknown>;
+    const concurrency = propsOf(result.deployJob).concurrency as Record<string, unknown>;
     expect(concurrency.group).toBe("custom-group");
   });
 
   test("deployJob has checkout + deploy steps", () => {
     const result = DeployEnvironment({ name: "staging", deployScript: "npm run deploy" });
-    const steps = result.deployJob.props.steps as Array<{ props: Record<string, unknown> }>;
+    const steps = propsOf(result.deployJob).steps as Array<{ props: Record<string, unknown> }>;
     expect(steps.length).toBe(2);
     expect(steps[0].props.uses).toBe("actions/checkout@v7");
     expect(steps[1].props.run).toBe("npm run deploy");
@@ -549,7 +552,7 @@ describe("DeployEnvironment", () => {
       name: "staging",
       deployScript: ["npm run build", "npm run deploy"],
     });
-    const steps = result.deployJob.props.steps as Array<{ props: Record<string, unknown> }>;
+    const steps = propsOf(result.deployJob).steps as Array<{ props: Record<string, unknown> }>;
     expect(steps.length).toBe(3);
     expect(steps[1].props.run).toBe("npm run build");
     expect(steps[2].props.run).toBe("npm run deploy");
@@ -557,7 +560,7 @@ describe("DeployEnvironment", () => {
 
   test("cleanupJob has default cleanup script", () => {
     const result = DeployEnvironment({ name: "staging", deployScript: "npm run deploy" });
-    const steps = result.cleanupJob.props.steps as Array<{ props: Record<string, unknown> }>;
+    const steps = propsOf(result.cleanupJob).steps as Array<{ props: Record<string, unknown> }>;
     expect(steps[1].props.run).toBe('echo "Cleaning up..."');
   });
 
@@ -567,13 +570,13 @@ describe("DeployEnvironment", () => {
       deployScript: "npm run deploy",
       cleanupScript: "npm run teardown",
     });
-    const steps = result.cleanupJob.props.steps as Array<{ props: Record<string, unknown> }>;
+    const steps = propsOf(result.cleanupJob).steps as Array<{ props: Record<string, unknown> }>;
     expect(steps[1].props.run).toBe("npm run teardown");
   });
 
   test("cleanupJob has environment with name", () => {
     const result = DeployEnvironment({ name: "production", deployScript: "npm run deploy" });
-    expect((result.cleanupJob.props.environment as Record<string, string>).name).toBe("production");
+    expect((propsOf(result.cleanupJob).environment as Record<string, string>).name).toBe("production");
   });
 
   test("uses custom runsOn", () => {
@@ -582,8 +585,8 @@ describe("DeployEnvironment", () => {
       deployScript: "npm run deploy",
       runsOn: "self-hosted",
     });
-    expect(result.deployJob.props["runs-on"]).toBe("self-hosted");
-    expect(result.cleanupJob.props["runs-on"]).toBe("self-hosted");
+    expect(propsOf(result.deployJob)["runs-on"]).toBe("self-hosted");
+    expect(propsOf(result.cleanupJob)["runs-on"]).toBe("self-hosted");
   });
 });
 
@@ -599,7 +602,7 @@ describe("GoCI", () => {
 
   test("workflow has Go CI name", () => {
     const result = GoCI({});
-    expect(result.workflow.props.name).toBe("Go CI");
+    expect(propsOf(result.workflow).name).toBe("Go CI");
   });
 
   test("includes lintJob by default", () => {
@@ -614,63 +617,63 @@ describe("GoCI", () => {
 
   test("buildJob has 3 steps (checkout, setup-go, build)", () => {
     const result = GoCI({});
-    const steps = result.buildJob.props.steps as unknown[];
+    const steps = propsOf(result.buildJob).steps as unknown[];
     expect(steps.length).toBe(3);
   });
 
   test("testJob has 3 steps (checkout, setup-go, test)", () => {
     const result = GoCI({});
-    const steps = result.testJob.props.steps as unknown[];
+    const steps = propsOf(result.testJob).steps as unknown[];
     expect(steps.length).toBe(3);
   });
 
   test("buildJob uses setup-go with default version", () => {
     const result = GoCI({});
-    const steps = result.buildJob.props.steps as Array<{ props: Record<string, unknown> }>;
+    const steps = propsOf(result.buildJob).steps as Array<{ props: Record<string, unknown> }>;
     expect(steps[1].props.uses).toBe("actions/setup-go@v5");
     expect((steps[1].props.with as Record<string, string>)["go-version"]).toBe("1.22");
   });
 
   test("uses custom go version", () => {
     const result = GoCI({ goVersion: "1.21" });
-    const steps = result.buildJob.props.steps as Array<{ props: Record<string, unknown> }>;
+    const steps = propsOf(result.buildJob).steps as Array<{ props: Record<string, unknown> }>;
     expect((steps[1].props.with as Record<string, string>)["go-version"]).toBe("1.21");
   });
 
   test("buildJob runs go build by default", () => {
     const result = GoCI({});
-    const steps = result.buildJob.props.steps as Array<{ props: Record<string, unknown> }>;
+    const steps = propsOf(result.buildJob).steps as Array<{ props: Record<string, unknown> }>;
     expect(steps[2].props.run).toBe("go build ./...");
   });
 
   test("testJob runs go test with race detector by default", () => {
     const result = GoCI({});
-    const steps = result.testJob.props.steps as Array<{ props: Record<string, unknown> }>;
+    const steps = propsOf(result.testJob).steps as Array<{ props: Record<string, unknown> }>;
     expect(steps[2].props.run).toBe("go test ./... -v -race");
   });
 
   test("uses custom build command", () => {
     const result = GoCI({ buildCommand: "go build -o bin/app ./cmd/app" });
-    const steps = result.buildJob.props.steps as Array<{ props: Record<string, unknown> }>;
+    const steps = propsOf(result.buildJob).steps as Array<{ props: Record<string, unknown> }>;
     expect(steps[2].props.run).toBe("go build -o bin/app ./cmd/app");
   });
 
   test("uses custom test command", () => {
     const result = GoCI({ testCommand: "go test -short ./..." });
-    const steps = result.testJob.props.steps as Array<{ props: Record<string, unknown> }>;
+    const steps = propsOf(result.testJob).steps as Array<{ props: Record<string, unknown> }>;
     expect(steps[2].props.run).toBe("go test -short ./...");
   });
 
   test("lintJob uses golangci-lint-action", () => {
     const result = GoCI({});
-    const steps = result.lintJob!.props.steps as Array<{ props: Record<string, unknown> }>;
+    const steps = propsOf(result.lintJob!).steps as Array<{ props: Record<string, unknown> }>;
     expect(steps[2].props.uses).toBe("golangci/golangci-lint-action@v6");
   });
 
   test("uses custom runsOn", () => {
     const result = GoCI({ runsOn: "macos-latest" });
-    expect(result.buildJob.props["runs-on"]).toBe("macos-latest");
-    expect(result.testJob.props["runs-on"]).toBe("macos-latest");
+    expect(propsOf(result.buildJob)["runs-on"]).toBe("macos-latest");
+    expect(propsOf(result.testJob)["runs-on"]).toBe("macos-latest");
   });
 });
 
@@ -682,8 +685,8 @@ describe("defaults overrides", () => {
       ref: "main",
       defaults: { step: { id: "my-checkout" } },
     });
-    expect(result.step.props.id).toBe("my-checkout");
-    expect(result.step.props.uses).toBe("actions/checkout@v7");
+    expect(propsOf(result.step).id).toBe("my-checkout");
+    expect(propsOf(result.step).uses).toBe("actions/checkout@v7");
   });
 
   test("SetupNode defaults override step props", () => {
@@ -691,8 +694,8 @@ describe("defaults overrides", () => {
       nodeVersion: "20",
       defaults: { step: { id: "setup" } },
     });
-    expect(result.step.props.id).toBe("setup");
-    expect(result.step.props.name).toBe("Setup Node.js");
+    expect(propsOf(result.step).id).toBe("setup");
+    expect(propsOf(result.step).name).toBe("Setup Node.js");
   });
 
   test("NodeCI defaults override job and workflow props", () => {
@@ -702,8 +705,8 @@ describe("defaults overrides", () => {
         workflow: { concurrency: "ci-${{ github.ref }}" } as any,
       },
     });
-    expect(result.job.props["timeout-minutes"]).toBe(30);
-    expect(result.workflow.props.concurrency).toBe("ci-${{ github.ref }}");
+    expect(propsOf(result.job)["timeout-minutes"]).toBe(30);
+    expect(propsOf(result.workflow).concurrency).toBe("ci-${{ github.ref }}");
   });
 
   test("NodePipeline defaults override individual jobs", () => {
@@ -713,8 +716,8 @@ describe("defaults overrides", () => {
         testJob: { "timeout-minutes": 20 } as any,
       },
     });
-    expect(result.buildJob.props["timeout-minutes"]).toBe(15);
-    expect(result.testJob.props["timeout-minutes"]).toBe(20);
+    expect(propsOf(result.buildJob)["timeout-minutes"]).toBe(15);
+    expect(propsOf(result.testJob)["timeout-minutes"]).toBe(20);
   });
 
   test("DockerBuild defaults override job and workflow", () => {
@@ -724,8 +727,8 @@ describe("defaults overrides", () => {
         workflow: { concurrency: "docker" } as any,
       },
     });
-    expect(result.job.props["timeout-minutes"]).toBe(60);
-    expect(result.workflow.props.concurrency).toBe("docker");
+    expect(propsOf(result.job)["timeout-minutes"]).toBe(60);
+    expect(propsOf(result.workflow).concurrency).toBe("docker");
   });
 
   test("DeployEnvironment defaults override deploy and cleanup jobs", () => {
@@ -737,8 +740,8 @@ describe("defaults overrides", () => {
         cleanupJob: { "timeout-minutes": 10 } as any,
       },
     });
-    expect(result.deployJob.props["timeout-minutes"]).toBe(30);
-    expect(result.cleanupJob.props["timeout-minutes"]).toBe(10);
+    expect(propsOf(result.deployJob)["timeout-minutes"]).toBe(30);
+    expect(propsOf(result.cleanupJob)["timeout-minutes"]).toBe(10);
   });
 
   test("GoCI defaults override workflow name", () => {
@@ -747,7 +750,7 @@ describe("defaults overrides", () => {
         workflow: { name: "Custom Go CI" } as any,
       },
     });
-    expect(result.workflow.props.name).toBe("Custom Go CI");
+    expect(propsOf(result.workflow).name).toBe("Custom Go CI");
   });
 
   test("PythonCI defaults override testJob", () => {
@@ -756,7 +759,7 @@ describe("defaults overrides", () => {
         testJob: { "timeout-minutes": 45 } as any,
       },
     });
-    expect(result.testJob.props["timeout-minutes"]).toBe(45);
+    expect(propsOf(result.testJob)["timeout-minutes"]).toBe(45);
   });
 
   test("UploadArtifact defaults override step props", () => {
@@ -765,8 +768,8 @@ describe("defaults overrides", () => {
       path: "dist/",
       defaults: { step: { id: "upload" } },
     });
-    expect(result.step.props.id).toBe("upload");
-    expect(result.step.props.uses).toBe("actions/upload-artifact@v4");
+    expect(propsOf(result.step).id).toBe("upload");
+    expect(propsOf(result.step).uses).toBe("actions/upload-artifact@v4");
   });
 
   test("CacheAction defaults override step props", () => {
@@ -775,7 +778,7 @@ describe("defaults overrides", () => {
       key: "cache-key",
       defaults: { step: { id: "cache-step" } },
     });
-    expect(result.step.props.id).toBe("cache-step");
-    expect(result.step.props.uses).toBe("actions/cache@v4");
+    expect(propsOf(result.step).id).toBe("cache-step");
+    expect(propsOf(result.step).uses).toBe("actions/cache@v4");
   });
 });