@intentius/chant-lexicon-github 0.106.1 → 0.106.3

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "86245b91fbd6f3569b7e78ca9b9d4241f4709598483c4b73a55627a46b2c72fd",
+    "manifest.json": "bc9354c7588b77975a1fc52ebe5fb14915137fa87a6982c32c464f12c30c2b80",
     "meta.json": "c50e0ef3845c370c3ad2210b8bba455980417c0f818aa6ed46e06d4fb8b1b9f9",
     "types/index.d.ts": "bdd54a4145a39a9dd4f7bbc8c500191acb6bc9057a87da0040475afac84db397",
     "rules/deprecated-action-version.ts": "d41e6e532ab7f623af1bee4ac5279fcb2baada7defa1c5d022a5bc71983e8797",
@@ -78,5 +78,5 @@
     "skills/chant-github-patterns.md": "bb3abef289a8fdfcf07d6bb2d7289dcb2f38bc0cb0321ea320b78b45a6f548c0",
     "skills/chant-github-security.md": "aab111cb0871cad30281ce48d7da23663689619351029219e2be019a1a61e394"
   },
-  "composite": "4970f8db5a1ce849770c89a6393a48f46854cc626fc8e458a21afe9c0567e9f3"
+  "composite": "3b71f70f79d394ab86c7cd10ffc18228599568f05f9588335786c50ce73dc3a2"
 }

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "github",
-  "version": "0.106.1",
+  "version": "0.106.3",
   "chantVersion": ">=0.1.0",
   "namespace": "GitHub",
   "intrinsics": [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-github",
-  "version": "0.106.1",
+  "version": "0.106.3",
   "description": "GitHub Actions lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -61,7 +61,7 @@
     "typescript": "^5.9.3"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.106.1",
+    "@intentius/chant": "^0.106.3",
     "typescript": "^5.9.3"
   }
 }

package/src/components/generate-pipeline.member.test.ts

@@ -49,7 +49,7 @@ describe("generateGithubPipeline for a workspace member", () => {
   test("run steps start in the member's directory, and the name carries the member", () => {
     const doc = parseYAML(generateGithubPipeline(components, { env: "staging", member: api }).yaml) as unknown as Doc;
     expect(doc.defaults).toEqual({ run: { "working-directory": "services/api" } });
-    expect(doc.name).toBe("chant-components-api-staging");
+    expect(doc.name).toBe("chant-components.api.staging");
   });
 
   test("artifact paths move under the member's directory, where the run steps write them", () => {

package/src/components/generate-pipeline.ts

@@ -257,7 +257,7 @@ function prLoopGithubDoc(
     },
   };
   return {
-    name: member ? `chant-pr-${member.name}-${env}` : `chant-pr-${env}`,
+    name: member ? `chant-pr.${member.name}.${env}` : `chant-pr-${env}`,
     environment: env,
     on: { pull_request: { branches: [branch] }, push: { branches: [branch] } },
     ...(rooted ? {} : { defaults: { run: { "working-directory": member!.dir } } }),
@@ -534,7 +534,7 @@ function scopeToMember(doc: GithubPipelineDoc, member: PipelineMember): GithubPi
   }
   return {
     ...doc,
-    name: `chant-components-${member.name}-${doc.environment}`,
+    name: `chant-components.${member.name}.${doc.environment}`,
     ...(rooted ? {} : { defaults: { run: { "working-directory": member.dir } } }),
     jobsDoc,
   };

package/src/components/generate-pr-pipeline.test.ts

@@ -11,6 +11,7 @@ import { join } from "node:path";
 import { describe, expect, test } from "vitest";
 import { parseYAML } from "@intentius/chant/yaml";
 import type { DriverComponent } from "@intentius/chant/components/driver";
+import { prApplyGroup, prApplyRecordKey } from "@intentius/chant/components/pr-pipeline";
 import { generateGithubPipeline } from "./generate-pipeline";
 
 const ESTATE: DriverComponent[] = [
@@ -117,7 +118,7 @@ describe("the GitHub pull-request workflow", () => {
   });
 
   test("inside a workspace member: runs in the member's directory and keeps its own gate, note and apply group (#3465)", () => {
-    const member = { name: "network", dir: "infra/network", file: ".github/workflows/chant-pr-network-prod.yml" };
+    const member = { name: "network", dir: "infra/network", file: ".github/workflows/chant-pr.network.prod.yml" };
     const scoped = generateGithubPipeline(ESTATE, { env: "prod", prLoop: {}, member });
     const mdoc = parseYAML(scoped.yaml) as {
       name: string;
@@ -125,7 +126,7 @@ describe("the GitHub pull-request workflow", () => {
       defaults?: { run: Record<string, string> };
       jobs: Record<string, Job>;
     };
-    expect(mdoc.name).toBe("chant-pr-network-prod");
+    expect(mdoc.name).toBe("chant-pr.network.prod");
     // No path filter: a change outside the member can reach it.
     expect(mdoc.on).toEqual({ pull_request: { branches: ["main"] }, push: { branches: ["main"] } });
     expect(mdoc.defaults).toEqual({ run: { "working-directory": "infra/network" } });
@@ -133,21 +134,31 @@ describe("the GitHub pull-request workflow", () => {
     expect(plan.run).toBe('chant components pr-plan --base "$BASE_SHA" --pr "$PR_NUMBER" --env prod --gate pr-apply --output .chant/pr --forge github --member network');
     const apply = mdoc.jobs.apply.steps.find((s) => s.run?.includes("pr-apply"))!;
     expect(apply.run).toContain("--member network");
-    expect(mdoc.jobs.apply.concurrency).toEqual({ group: "chant-apply-network-prod", "cancel-in-progress": false });
+    expect(mdoc.jobs.apply.concurrency).toEqual({ group: "chant-apply.network.prod", "cancel-in-progress": false });
     // The record path is relative to the member for --resume and to the repository for the cache.
     expect(apply.run).toContain("--resume .chant/pr-resume/pr-apply.json");
     const restore = mdoc.jobs.apply.steps.find((s) => s.uses === "actions/cache/restore@v4")!;
-    expect(restore.with).toMatchObject({ path: "infra/network/.chant/pr-resume/pr-apply.json", "restore-keys": "chant-apply-network-prod-${{ github.sha }}-" });
+    expect(restore.with).toMatchObject({ path: "infra/network/.chant/pr-resume/pr-apply.json", "restore-keys": "chant-apply.network.prod-${{ github.sha }}-" });
     for (const job of Object.values(mdoc.jobs)) {
       const keep = job.steps.find((s) => s.uses?.startsWith("actions/upload-artifact"))!;
       expect(keep.with?.path).toBe("infra/network/.chant/pr");
     }
   });
 
+  test("no two member and environment pairs share an apply group or record key", () => {
+    expect(prApplyGroup("b-c", "a")).toBe("chant-apply.a.b-c");
+    expect(prApplyGroup("c", "a-b")).toBe("chant-apply.a-b.c");
+    expect(prApplyGroup("b-c", "a")).not.toBe(prApplyGroup("c", "a-b"));
+    expect(prApplyRecordKey("b-c", "abc", "a")).not.toBe(prApplyRecordKey("c", "abc", "a-b"));
+    // A single project's group never looks like a member's.
+    expect(prApplyGroup("a-b-c")).toBe("chant-apply-a-b-c");
+    expect(prApplyGroup("a.b-c")).not.toBe(prApplyGroup("b-c", "a"));
+  });
+
   test("a member at the workspace root keeps the root's paths but its own names", () => {
     const yaml = generateGithubPipeline(ESTATE, { env: "prod", prLoop: {}, member: { name: "root", dir: "." } }).yaml;
     const mdoc = parseYAML(yaml) as { name: string; defaults?: unknown; jobs: Record<string, Job> };
-    expect(mdoc.name).toBe("chant-pr-root-prod");
+    expect(mdoc.name).toBe("chant-pr.root.prod");
     expect(mdoc.defaults).toBeUndefined();
     expect(yaml).toContain("--member root");
     expect(yaml).toContain("path: .chant/pr");

package/src/composites/composites.test.ts

@@ -13,30 +13,33 @@ import { DockerBuild } from "./docker-build";
 import { DeployEnvironment } from "./deploy-environment";
 import { GoCI } from "./go-ci";
 
+// The generated resource classes type `props` as unknown; the tests read it as a record.
+const propsOf = (entity: unknown): Record<string, any> => (entity as { props: Record<string, any> }).props;
+
 // ── Checkout ────────────────────────────────────────────────────────
 
 describe("Checkout", () => {
   test("returns step with checkout action", () => {
     const result = Checkout({});
     expect(result.step).toBeDefined();
-    expect(result.step.props.uses).toBe("actions/checkout@v7");
-    expect(result.step.props.name).toBe("Checkout");
+    expect(propsOf(result.step).uses).toBe("actions/checkout@v7");
+    expect(propsOf(result.step).name).toBe("Checkout");
   });
 
   test("passes ref as with input", () => {
     const result = Checkout({ ref: "develop" });
-    expect(result.step.props.with).toBeDefined();
-    expect((result.step.props.with as Record<string, string>).ref).toBe("develop");
+    expect(propsOf(result.step).with).toBeDefined();
+    expect((propsOf(result.step).with as Record<string, string>).ref).toBe("develop");
   });
 
   test("passes fetchDepth as with input", () => {
     const result = Checkout({ fetchDepth: 0 });
-    expect((result.step.props.with as Record<string, string>)["fetch-depth"]).toBe("0");
+    expect((propsOf(result.step).with as Record<string, string>)["fetch-depth"]).toBe("0");
   });
 
   test("omits with when no optional props", () => {
     const result = Checkout({});
-    expect(result.step.props.with).toBeUndefined();
+    expect(propsOf(result.step).with).toBeUndefined();
   });
 });
 
@@ -45,18 +48,18 @@ describe("Checkout", () => {
 describe("SetupNode", () => {
   test("returns step with setup-node action", () => {
     const result = SetupNode({});
-    expect(result.step.props.uses).toBe("actions/setup-node@v7");
-    expect(result.step.props.name).toBe("Setup Node.js");
+    expect(propsOf(result.step).uses).toBe("actions/setup-node@v7");
+    expect(propsOf(result.step).name).toBe("Setup Node.js");
   });
 
   test("passes nodeVersion", () => {
     const result = SetupNode({ nodeVersion: "22" });
-    expect((result.step.props.with as Record<string, string>)["node-version"]).toBe("22");
+    expect((propsOf(result.step).with as Record<string, string>)["node-version"]).toBe("22");
   });
 
   test("passes cache option", () => {
     const result = SetupNode({ cache: "npm" });
-    expect((result.step.props.with as Record<string, string>).cache).toBe("npm");
+    expect((propsOf(result.step).with as Record<string, string>).cache).toBe("npm");
   });
 });
 
@@ -65,12 +68,12 @@ describe("SetupNode", () => {
 describe("SetupGo", () => {
   test("returns step with setup-go action", () => {
     const result = SetupGo({});
-    expect(result.step.props.uses).toBe("actions/setup-go@v5");
+    expect(propsOf(result.step).uses).toBe("actions/setup-go@v5");
   });
 
   test("passes goVersion", () => {
     const result = SetupGo({ goVersion: "1.22" });
-    expect((result.step.props.with as Record<string, string>)["go-version"]).toBe("1.22");
+    expect((propsOf(result.step).with as Record<string, string>)["go-version"]).toBe("1.22");
   });
 });
 
@@ -79,12 +82,12 @@ describe("SetupGo", () => {
 describe("SetupPython", () => {
   test("returns step with setup-python action", () => {
     const result = SetupPython({});
-    expect(result.step.props.uses).toBe("actions/setup-python@v5");
+    expect(propsOf(result.step).uses).toBe("actions/setup-python@v5");
   });
 
   test("passes pythonVersion", () => {
     const result = SetupPython({ pythonVersion: "3.12" });
-    expect((result.step.props.with as Record<string, string>)["python-version"]).toBe("3.12");
+    expect((propsOf(result.step).with as Record<string, string>)["python-version"]).toBe("3.12");
   });
 });
 
@@ -93,9 +96,9 @@ describe("SetupPython", () => {
 describe("CacheAction", () => {
   test("returns step with cache action", () => {
     const result = CacheAction({ path: "node_modules", key: "npm-${{ hashFiles('package-lock.json') }}" });
-    expect(result.step.props.uses).toBe("actions/cache@v4");
-    expect((result.step.props.with as Record<string, string>).path).toBe("node_modules");
-    expect((result.step.props.with as Record<string, string>).key).toBe("npm-${{ hashFiles('package-lock.json') }}");
+    expect(propsOf(result.step).uses).toBe("actions/cache@v4");
+    expect((propsOf(result.step).with as Record<string, string>).path).toBe("node_modules");
+    expect((propsOf(result.step).with as Record<string, string>).key).toBe("npm-${{ hashFiles('package-lock.json') }}");
   });
 });
 
@@ -104,14 +107,14 @@ describe("CacheAction", () => {
 describe("UploadArtifact", () => {
   test("returns step with upload action", () => {
     const result = UploadArtifact({ name: "build", path: "dist/" });
-    expect(result.step.props.uses).toBe("actions/upload-artifact@v4");
-    expect((result.step.props.with as Record<string, string>).name).toBe("build");
-    expect((result.step.props.with as Record<string, string>).path).toBe("dist/");
+    expect(propsOf(result.step).uses).toBe("actions/upload-artifact@v4");
+    expect((propsOf(result.step).with as Record<string, string>).name).toBe("build");
+    expect((propsOf(result.step).with as Record<string, string>).path).toBe("dist/");
   });
 
   test("passes retentionDays", () => {
     const result = UploadArtifact({ name: "build", path: "dist/", retentionDays: 7 });
-    expect((result.step.props.with as Record<string, string>)["retention-days"]).toBe("7");
+    expect((propsOf(result.step).with as Record<string, string>)["retention-days"]).toBe("7");
   });
 });
 
@@ -120,8 +123,8 @@ describe("UploadArtifact", () => {
 describe("DownloadArtifact", () => {
   test("returns step with download action", () => {
     const result = DownloadArtifact({ name: "build" });
-    expect(result.step.props.uses).toBe("actions/download-artifact@v4");
-    expect((result.step.props.with as Record<string, string>).name).toBe("build");
+    expect(propsOf(result.step).uses).toBe("actions/download-artifact@v4");
+    expect((propsOf(result.step).with as Record<string, string>).name).toBe("build");
   });
 });
 
@@ -136,39 +139,39 @@ describe("NodeCI", () => {
 
   test("workflow has CI name", () => {
     const result = NodeCI({});
-    expect(result.workflow.props.name).toBe("CI");
+    expect(propsOf(result.workflow).name).toBe("CI");
   });
 
   test("job has ubuntu-latest runner", () => {
     const result = NodeCI({});
-    expect(result.job.props["runs-on"]).toBe("ubuntu-latest");
+    expect(propsOf(result.job)["runs-on"]).toBe("ubuntu-latest");
   });
 
   test("job has steps array", () => {
     const result = NodeCI({});
-    expect(Array.isArray(result.job.props.steps)).toBe(true);
-    expect((result.job.props.steps as unknown[]).length).toBe(5);
+    expect(Array.isArray(propsOf(result.job).steps)).toBe(true);
+    expect((propsOf(result.job).steps as unknown[]).length).toBe(5);
   });
 
   test("uses default npm commands", () => {
     const result = NodeCI({});
-    const steps = result.job.props.steps as Array<{ props: Record<string, unknown> }>;
+    const steps = propsOf(result.job).steps as Array<{ props: Record<string, unknown> }>;
     const installStep = steps[2];
-    expect(installStep.props.run).toBe("npm ci");
+    expect(propsOf(installStep).run).toBe("npm ci");
   });
 
   test("uses pnpm when specified", () => {
     const result = NodeCI({ packageManager: "pnpm" });
-    const steps = result.job.props.steps as Array<{ props: Record<string, unknown> }>;
+    const steps = propsOf(result.job).steps as Array<{ props: Record<string, unknown> }>;
     const installStep = steps[2];
-    expect(installStep.props.run).toBe("pnpm install");
+    expect(propsOf(installStep).run).toBe("pnpm install");
   });
 
   test("uses custom installCommand", () => {
     const result = NodeCI({ installCommand: "yarn install --frozen-lockfile" });
-    const steps = result.job.props.steps as Array<{ props: Record<string, unknown> }>;
+    const steps = propsOf(result.job).steps as Array<{ props: Record<string, unknown> }>;
     const installStep = steps[2];
-    expect(installStep.props.run).toBe("yarn install --frozen-lockfile");
+    expect(propsOf(installStep).run).toBe("yarn install --frozen-lockfile");
   });
 });
 
@@ -184,98 +187,98 @@ describe("NodePipeline", () => {
 
   test("workflow has Node Pipeline name", () => {
     const result = NodePipeline({});
-    expect(result.workflow.props.name).toBe("Node Pipeline");
+    expect(propsOf(result.workflow).name).toBe("Node Pipeline");
   });
 
   test("buildJob has 5 steps (checkout, setup, install, build, upload)", () => {
     const result = NodePipeline({});
-    const steps = result.buildJob.props.steps as unknown[];
+    const steps = propsOf(result.buildJob).steps as unknown[];
     expect(steps.length).toBe(5);
   });
 
   test("testJob has 5 steps (checkout, setup, install, download, test)", () => {
     const result = NodePipeline({});
-    const steps = result.testJob.props.steps as unknown[];
+    const steps = propsOf(result.testJob).steps as unknown[];
     expect(steps.length).toBe(5);
   });
 
   test("testJob depends on build", () => {
     const result = NodePipeline({});
-    expect(result.testJob.props.needs).toEqual(["build"]);
+    expect(propsOf(result.testJob).needs).toEqual(["build"]);
   });
 
   test("uses npm ci by default", () => {
     const result = NodePipeline({});
-    const steps = result.buildJob.props.steps as Array<{ props: Record<string, unknown> }>;
+    const steps = propsOf(result.buildJob).steps as Array<{ props: Record<string, unknown> }>;
     expect(steps[2].props.run).toBe("npm ci");
   });
 
   test("uses pnpm install with frozen lockfile", () => {
     const result = NodePipeline({ packageManager: "pnpm" });
-    const steps = result.buildJob.props.steps as Array<{ props: Record<string, unknown> }>;
+    const steps = propsOf(result.buildJob).steps as Array<{ props: Record<string, unknown> }>;
     expect(steps[2].props.run).toBe("pnpm install --frozen-lockfile");
   });
 
   test("uses yarn install with frozen lockfile", () => {
     const result = NodePipeline({ packageManager: "yarn" });
-    const steps = result.buildJob.props.steps as Array<{ props: Record<string, unknown> }>;
+    const steps = propsOf(result.buildJob).steps as Array<{ props: Record<string, unknown> }>;
     expect(steps[2].props.run).toBe("yarn install --frozen-lockfile");
   });
 
   test("bun uses oven-sh/setup-bun instead of setup-node", () => {
     const result = NodePipeline({ packageManager: "bun" });
-    const steps = result.buildJob.props.steps as Array<{ props: Record<string, unknown> }>;
+    const steps = propsOf(result.buildJob).steps as Array<{ props: Record<string, unknown> }>;
     expect(steps[1].props.uses).toBe("oven-sh/setup-bun@v2");
     expect(steps[1].props.name).toBe("Setup Bun");
   });
 
   test("bun uses bun install with frozen lockfile", () => {
     const result = NodePipeline({ packageManager: "bun" });
-    const steps = result.buildJob.props.steps as Array<{ props: Record<string, unknown> }>;
+    const steps = propsOf(result.buildJob).steps as Array<{ props: Record<string, unknown> }>;
     expect(steps[2].props.run).toBe("bun install --frozen-lockfile");
   });
 
   test("npm setup step has cache: npm", () => {
     const result = NodePipeline({ packageManager: "npm" });
-    const steps = result.buildJob.props.steps as Array<{ props: Record<string, unknown> }>;
+    const steps = propsOf(result.buildJob).steps as Array<{ props: Record<string, unknown> }>;
     expect((steps[1].props.with as Record<string, string>).cache).toBe("npm");
   });
 
   test("upload step uses upload-artifact with configured name", () => {
     const result = NodePipeline({ artifactName: "my-build" });
-    const steps = result.buildJob.props.steps as Array<{ props: Record<string, unknown> }>;
+    const steps = propsOf(result.buildJob).steps as Array<{ props: Record<string, unknown> }>;
     expect(steps[4].props.uses).toBe("actions/upload-artifact@v4");
     expect((steps[4].props.with as Record<string, string>).name).toBe("my-build");
   });
 
   test("download step in testJob uses configured artifact name", () => {
     const result = NodePipeline({ artifactName: "my-build" });
-    const steps = result.testJob.props.steps as Array<{ props: Record<string, unknown> }>;
+    const steps = propsOf(result.testJob).steps as Array<{ props: Record<string, unknown> }>;
     expect(steps[3].props.uses).toBe("actions/download-artifact@v4");
     expect((steps[3].props.with as Record<string, string>).name).toBe("my-build");
   });
 
   test("uses custom runsOn", () => {
     const result = NodePipeline({ runsOn: "self-hosted" });
-    expect(result.buildJob.props["runs-on"]).toBe("self-hosted");
-    expect(result.testJob.props["runs-on"]).toBe("self-hosted");
+    expect(propsOf(result.buildJob)["runs-on"]).toBe("self-hosted");
+    expect(propsOf(result.testJob)["runs-on"]).toBe("self-hosted");
   });
 
   test("uses custom installCommand", () => {
     const result = NodePipeline({ installCommand: "npm install --legacy-peer-deps" });
-    const steps = result.buildJob.props.steps as Array<{ props: Record<string, unknown> }>;
+    const steps = propsOf(result.buildJob).steps as Array<{ props: Record<string, unknown> }>;
     expect(steps[2].props.run).toBe("npm install --legacy-peer-deps");
   });
 
   test("build step uses configured script", () => {
     const result = NodePipeline({ buildScript: "compile" });
-    const steps = result.buildJob.props.steps as Array<{ props: Record<string, unknown> }>;
+    const steps = propsOf(result.buildJob).steps as Array<{ props: Record<string, unknown> }>;
     expect(steps[3].props.run).toBe("npm run compile");
   });
 
   test("test step uses configured script", () => {
     const result = NodePipeline({ testScript: "test:ci" });
-    const steps = result.testJob.props.steps as Array<{ props: Record<string, unknown> }>;
+    const steps = propsOf(result.testJob).steps as Array<{ props: Record<string, unknown> }>;
     expect(steps[4].props.run).toBe("npm run test:ci");
   });
 });
@@ -285,7 +288,7 @@ describe("NodePipeline", () => {
 describe("BunPipeline", () => {
   test("defaults to bun package manager", () => {
     const result = BunPipeline({});
-    const steps = result.buildJob.props.steps as Array<{ props: Record<string, unknown> }>;
+    const steps = propsOf(result.buildJob).steps as Array<{ props: Record<string, unknown> }>;
     expect(steps[1].props.uses).toBe("oven-sh/setup-bun@v2");
     expect(steps[2].props.run).toBe("bun install --frozen-lockfile");
   });
@@ -294,7 +297,7 @@ describe("BunPipeline", () => {
 describe("PnpmPipeline", () => {
   test("defaults to pnpm package manager", () => {
     const result = PnpmPipeline({});
-    const steps = result.buildJob.props.steps as Array<{ props: Record<string, unknown> }>;
+    const steps = propsOf(result.buildJob).steps as Array<{ props: Record<string, unknown> }>;
     expect((steps[1].props.with as Record<string, string>).cache).toBe("pnpm");
     expect(steps[2].props.run).toBe("pnpm install --frozen-lockfile");
   });
@@ -303,7 +306,7 @@ describe("PnpmPipeline", () => {
 describe("YarnPipeline", () => {
   test("defaults to yarn package manager", () => {
     const result = YarnPipeline({});
-    const steps = result.buildJob.props.steps as Array<{ props: Record<string, unknown> }>;
+    const steps = propsOf(result.buildJob).steps as Array<{ props: Record<string, unknown> }>;
     expect((steps[1].props.with as Record<string, string>).cache).toBe("yarn");
     expect(steps[2].props.run).toBe("yarn install --frozen-lockfile");
   });
@@ -320,7 +323,7 @@ describe("PythonCI", () => {
 
   test("workflow has Python CI name", () => {
     const result = PythonCI({});
-    expect(result.workflow.props.name).toBe("Python CI");
+    expect(propsOf(result.workflow).name).toBe("Python CI");
   });
 
   test("includes lintJob by default", () => {
@@ -335,66 +338,66 @@ describe("PythonCI", () => {
 
   test("testJob uses setup-python with default version", () => {
     const result = PythonCI({});
-    const steps = result.testJob.props.steps as Array<{ props: Record<string, unknown> }>;
+    const steps = propsOf(result.testJob).steps as Array<{ props: Record<string, unknown> }>;
     const setupStep = steps[1];
-    expect(setupStep.props.uses).toBe("actions/setup-python@v5");
-    expect((setupStep.props.with as Record<string, string>)["python-version"]).toBe("3.12");
+    expect(propsOf(setupStep).uses).toBe("actions/setup-python@v5");
+    expect((propsOf(setupStep).with as Record<string, string>)["python-version"]).toBe("3.12");
   });
 
   test("testJob uses pip cache by default", () => {
     const result = PythonCI({});
-    const steps = result.testJob.props.steps as Array<{ props: Record<string, unknown> }>;
+    const steps = propsOf(result.testJob).steps as Array<{ props: Record<string, unknown> }>;
     expect((steps[1].props.with as Record<string, string>).cache).toBe("pip");
   });
 
   test("poetry mode uses poetry cache", () => {
     const result = PythonCI({ usePoetry: true });
-    const steps = result.testJob.props.steps as Array<{ props: Record<string, unknown> }>;
+    const steps = propsOf(result.testJob).steps as Array<{ props: Record<string, unknown> }>;
     expect((steps[1].props.with as Record<string, string>).cache).toBe("poetry");
   });
 
   test("poetry mode installs poetry first", () => {
     const result = PythonCI({ usePoetry: true });
-    const steps = result.testJob.props.steps as Array<{ props: Record<string, unknown> }>;
+    const steps = propsOf(result.testJob).steps as Array<{ props: Record<string, unknown> }>;
     expect(steps[2].props.run).toBe("pip install poetry");
     expect(steps[3].props.run).toBe("poetry install");
   });
 
   test("pip mode installs from requirements.txt", () => {
     const result = PythonCI({});
-    const steps = result.testJob.props.steps as Array<{ props: Record<string, unknown> }>;
+    const steps = propsOf(result.testJob).steps as Array<{ props: Record<string, unknown> }>;
     expect(steps[2].props.run).toBe("pip install -r requirements.txt");
   });
 
   test("uses custom requirements file", () => {
     const result = PythonCI({ requirementsFile: "requirements-dev.txt" });
-    const steps = result.testJob.props.steps as Array<{ props: Record<string, unknown> }>;
+    const steps = propsOf(result.testJob).steps as Array<{ props: Record<string, unknown> }>;
     expect(steps[2].props.run).toBe("pip install -r requirements-dev.txt");
   });
 
   test("test step uses configured command", () => {
     const result = PythonCI({ testCommand: "python -m pytest" });
-    const steps = result.testJob.props.steps as Array<{ props: Record<string, unknown> }>;
+    const steps = propsOf(result.testJob).steps as Array<{ props: Record<string, unknown> }>;
     const lastStep = steps[steps.length - 1];
-    expect(lastStep.props.run).toBe("python -m pytest");
+    expect(propsOf(lastStep).run).toBe("python -m pytest");
   });
 
   test("lint step uses configured command", () => {
     const result = PythonCI({ lintCommand: "flake8 ." });
-    const steps = result.lintJob!.props.steps as Array<{ props: Record<string, unknown> }>;
+    const steps = propsOf(result.lintJob!).steps as Array<{ props: Record<string, unknown> }>;
     const lastStep = steps[steps.length - 1];
-    expect(lastStep.props.run).toBe("flake8 .");
+    expect(propsOf(lastStep).run).toBe("flake8 .");
   });
 
   test("uses custom python version", () => {
     const result = PythonCI({ pythonVersion: "3.11" });
-    const steps = result.testJob.props.steps as Array<{ props: Record<string, unknown> }>;
+    const steps = propsOf(result.testJob).steps as Array<{ props: Record<string, unknown> }>;
     expect((steps[1].props.with as Record<string, string>)["python-version"]).toBe("3.11");
   });
 
   test("uses custom runsOn", () => {
     const result = PythonCI({ runsOn: "macos-latest" });
-    expect(result.testJob.props["runs-on"]).toBe("macos-latest");
+    expect(propsOf(result.testJob)["runs-on"]).toBe("macos-latest");
   });
 });
 
@@ -409,90 +412,90 @@ describe("DockerBuild", () => {
 
   test("workflow has Docker Build name", () => {
     const result = DockerBuild({});
-    expect(result.workflow.props.name).toBe("Docker Build");
+    expect(propsOf(result.workflow).name).toBe("Docker Build");
   });
 
   test("workflow has packages write permission", () => {
     const result = DockerBuild({});
-    expect((result.workflow.props.permissions as Record<string, string>).packages).toBe("write");
-    expect((result.workflow.props.permissions as Record<string, string>).contents).toBe("read");
+    expect((propsOf(result.workflow).permissions as Record<string, string>).packages).toBe("write");
+    expect((propsOf(result.workflow).permissions as Record<string, string>).contents).toBe("read");
   });
 
   test("job has 5 steps", () => {
     const result = DockerBuild({});
-    const steps = result.job.props.steps as unknown[];
+    const steps = propsOf(result.job).steps as unknown[];
     expect(steps.length).toBe(5);
   });
 
   test("uses docker/login-action", () => {
     const result = DockerBuild({});
-    const steps = result.job.props.steps as Array<{ props: Record<string, unknown> }>;
+    const steps = propsOf(result.job).steps as Array<{ props: Record<string, unknown> }>;
     expect(steps[1].props.uses).toBe("docker/login-action@v3");
   });
 
   test("uses docker/setup-buildx-action", () => {
     const result = DockerBuild({});
-    const steps = result.job.props.steps as Array<{ props: Record<string, unknown> }>;
+    const steps = propsOf(result.job).steps as Array<{ props: Record<string, unknown> }>;
     expect(steps[2].props.uses).toBe("docker/setup-buildx-action@v3");
   });
 
   test("uses docker/metadata-action", () => {
     const result = DockerBuild({});
-    const steps = result.job.props.steps as Array<{ props: Record<string, unknown> }>;
+    const steps = propsOf(result.job).steps as Array<{ props: Record<string, unknown> }>;
     expect(steps[3].props.uses).toBe("docker/metadata-action@v5");
   });
 
   test("uses docker/build-push-action", () => {
     const result = DockerBuild({});
-    const steps = result.job.props.steps as Array<{ props: Record<string, unknown> }>;
+    const steps = propsOf(result.job).steps as Array<{ props: Record<string, unknown> }>;
     expect(steps[4].props.uses).toBe("docker/build-push-action@v6");
   });
 
   test("login step uses ghcr.io by default", () => {
     const result = DockerBuild({});
-    const steps = result.job.props.steps as Array<{ props: Record<string, unknown> }>;
+    const steps = propsOf(result.job).steps as Array<{ props: Record<string, unknown> }>;
     expect((steps[1].props.with as Record<string, string>).registry).toBe("ghcr.io");
   });
 
   test("uses custom registry", () => {
     const result = DockerBuild({ registry: "docker.io" });
-    const steps = result.job.props.steps as Array<{ props: Record<string, unknown> }>;
+    const steps = propsOf(result.job).steps as Array<{ props: Record<string, unknown> }>;
     expect((steps[1].props.with as Record<string, string>).registry).toBe("docker.io");
   });
 
   test("build-push step has push: true by default", () => {
     const result = DockerBuild({});
-    const steps = result.job.props.steps as Array<{ props: Record<string, unknown> }>;
+    const steps = propsOf(result.job).steps as Array<{ props: Record<string, unknown> }>;
     expect((steps[4].props.with as Record<string, string>).push).toBe("true");
   });
 
   test("build-push step uses configured dockerfile", () => {
     const result = DockerBuild({ dockerfile: "Dockerfile.prod" });
-    const steps = result.job.props.steps as Array<{ props: Record<string, unknown> }>;
+    const steps = propsOf(result.job).steps as Array<{ props: Record<string, unknown> }>;
     expect((steps[4].props.with as Record<string, string>).file).toBe("Dockerfile.prod");
   });
 
   test("build-push step includes platforms when specified", () => {
     const result = DockerBuild({ platforms: ["linux/amd64", "linux/arm64"] });
-    const steps = result.job.props.steps as Array<{ props: Record<string, unknown> }>;
+    const steps = propsOf(result.job).steps as Array<{ props: Record<string, unknown> }>;
     expect((steps[4].props.with as Record<string, string>).platforms).toBe("linux/amd64,linux/arm64");
   });
 
   test("build-push step omits platforms when not specified", () => {
     const result = DockerBuild({});
-    const steps = result.job.props.steps as Array<{ props: Record<string, unknown> }>;
+    const steps = propsOf(result.job).steps as Array<{ props: Record<string, unknown> }>;
     expect((steps[4].props.with as Record<string, string>).platforms).toBeUndefined();
   });
 
   test("build-push step includes build-args when specified", () => {
     const result = DockerBuild({ buildArgs: { NODE_ENV: "production", VERSION: "1.0" } });
-    const steps = result.job.props.steps as Array<{ props: Record<string, unknown> }>;
+    const steps = propsOf(result.job).steps as Array<{ props: Record<string, unknown> }>;
     expect((steps[4].props.with as Record<string, string>)["build-args"]).toBe("NODE_ENV=production\nVERSION=1.0");
   });
 
   test("uses custom runsOn", () => {
     const result = DockerBuild({ runsOn: "self-hosted" });
-    expect(result.job.props["runs-on"]).toBe("self-hosted");
+    expect(propsOf(result.job)["runs-on"]).toBe("self-hosted");
   });
 });
 
@@ -507,7 +510,7 @@ describe("DeployEnvironment", () => {
 
   test("deployJob has environment with name", () => {
     const result = DeployEnvironment({ name: "staging", deployScript: "npm run deploy" });
-    expect((result.deployJob.props.environment as Record<string, string>).name).toBe("staging");
+    expect((propsOf(result.deployJob).environment as Record<string, string>).name).toBe("staging");
   });
 
   test("deployJob has environment url when specified", () => {
@@ -516,12 +519,12 @@ describe("DeployEnvironment", () => {
       deployScript: "npm run deploy",
       url: "https://staging.example.com",
     });
-    expect((result.deployJob.props.environment as Record<string, string>).url).toBe("https://staging.example.com");
+    expect((propsOf(result.deployJob).environment as Record<string, string>).url).toBe("https://staging.example.com");
   });
 
   test("deployJob has concurrency group", () => {
     const result = DeployEnvironment({ name: "staging", deployScript: "npm run deploy" });
-    const concurrency = result.deployJob.props.concurrency as Record<string, unknown>;
+    const concurrency = propsOf(result.deployJob).concurrency as Record<string, unknown>;
     expect(concurrency.group).toBe("deploy-staging");
     expect(concurrency["cancel-in-progress"]).toBe(true);
   });
@@ -532,13 +535,13 @@ describe("DeployEnvironment", () => {
       deployScript: "npm run deploy",
       concurrencyGroup: "custom-group",
     });
-    const concurrency = result.deployJob.props.concurrency as Record<string, unknown>;
+    const concurrency = propsOf(result.deployJob).concurrency as Record<string, unknown>;
     expect(concurrency.group).toBe("custom-group");
   });
 
   test("deployJob has checkout + deploy steps", () => {
     const result = DeployEnvironment({ name: "staging", deployScript: "npm run deploy" });
-    const steps = result.deployJob.props.steps as Array<{ props: Record<string, unknown> }>;
+    const steps = propsOf(result.deployJob).steps as Array<{ props: Record<string, unknown> }>;
     expect(steps.length).toBe(2);
     expect(steps[0].props.uses).toBe("actions/checkout@v7");
     expect(steps[1].props.run).toBe("npm run deploy");
@@ -549,7 +552,7 @@ describe("DeployEnvironment", () => {
       name: "staging",
       deployScript: ["npm run build", "npm run deploy"],
     });
-    const steps = result.deployJob.props.steps as Array<{ props: Record<string, unknown> }>;
+    const steps = propsOf(result.deployJob).steps as Array<{ props: Record<string, unknown> }>;
     expect(steps.length).toBe(3);
     expect(steps[1].props.run).toBe("npm run build");
     expect(steps[2].props.run).toBe("npm run deploy");
@@ -557,7 +560,7 @@ describe("DeployEnvironment", () => {
 
   test("cleanupJob has default cleanup script", () => {
     const result = DeployEnvironment({ name: "staging", deployScript: "npm run deploy" });
-    const steps = result.cleanupJob.props.steps as Array<{ props: Record<string, unknown> }>;
+    const steps = propsOf(result.cleanupJob).steps as Array<{ props: Record<string, unknown> }>;
     expect(steps[1].props.run).toBe('echo "Cleaning up..."');
   });
 
@@ -567,13 +570,13 @@ describe("DeployEnvironment", () => {
       deployScript: "npm run deploy",
       cleanupScript: "npm run teardown",
     });
-    const steps = result.cleanupJob.props.steps as Array<{ props: Record<string, unknown> }>;
+    const steps = propsOf(result.cleanupJob).steps as Array<{ props: Record<string, unknown> }>;
     expect(steps[1].props.run).toBe("npm run teardown");
   });
 
   test("cleanupJob has environment with name", () => {
     const result = DeployEnvironment({ name: "production", deployScript: "npm run deploy" });
-    expect((result.cleanupJob.props.environment as Record<string, string>).name).toBe("production");
+    expect((propsOf(result.cleanupJob).environment as Record<string, string>).name).toBe("production");
   });
 
   test("uses custom runsOn", () => {
@@ -582,8 +585,8 @@ describe("DeployEnvironment", () => {
       deployScript: "npm run deploy",
       runsOn: "self-hosted",
     });
-    expect(result.deployJob.props["runs-on"]).toBe("self-hosted");
-    expect(result.cleanupJob.props["runs-on"]).toBe("self-hosted");
+    expect(propsOf(result.deployJob)["runs-on"]).toBe("self-hosted");
+    expect(propsOf(result.cleanupJob)["runs-on"]).toBe("self-hosted");
   });
 });
 
@@ -599,7 +602,7 @@ describe("GoCI", () => {
 
   test("workflow has Go CI name", () => {
     const result = GoCI({});
-    expect(result.workflow.props.name).toBe("Go CI");
+    expect(propsOf(result.workflow).name).toBe("Go CI");
   });
 
   test("includes lintJob by default", () => {
@@ -614,63 +617,63 @@ describe("GoCI", () => {
 
   test("buildJob has 3 steps (checkout, setup-go, build)", () => {
     const result = GoCI({});
-    const steps = result.buildJob.props.steps as unknown[];
+    const steps = propsOf(result.buildJob).steps as unknown[];
     expect(steps.length).toBe(3);
   });
 
   test("testJob has 3 steps (checkout, setup-go, test)", () => {
     const result = GoCI({});
-    const steps = result.testJob.props.steps as unknown[];
+    const steps = propsOf(result.testJob).steps as unknown[];
     expect(steps.length).toBe(3);
   });
 
   test("buildJob uses setup-go with default version", () => {
     const result = GoCI({});
-    const steps = result.buildJob.props.steps as Array<{ props: Record<string, unknown> }>;
+    const steps = propsOf(result.buildJob).steps as Array<{ props: Record<string, unknown> }>;
     expect(steps[1].props.uses).toBe("actions/setup-go@v5");
     expect((steps[1].props.with as Record<string, string>)["go-version"]).toBe("1.22");
   });
 
   test("uses custom go version", () => {
     const result = GoCI({ goVersion: "1.21" });
-    const steps = result.buildJob.props.steps as Array<{ props: Record<string, unknown> }>;
+    const steps = propsOf(result.buildJob).steps as Array<{ props: Record<string, unknown> }>;
     expect((steps[1].props.with as Record<string, string>)["go-version"]).toBe("1.21");
   });
 
   test("buildJob runs go build by default", () => {
     const result = GoCI({});
-    const steps = result.buildJob.props.steps as Array<{ props: Record<string, unknown> }>;
+    const steps = propsOf(result.buildJob).steps as Array<{ props: Record<string, unknown> }>;
     expect(steps[2].props.run).toBe("go build ./...");
   });
 
   test("testJob runs go test with race detector by default", () => {
     const result = GoCI({});
-    const steps = result.testJob.props.steps as Array<{ props: Record<string, unknown> }>;
+    const steps = propsOf(result.testJob).steps as Array<{ props: Record<string, unknown> }>;
     expect(steps[2].props.run).toBe("go test ./... -v -race");
   });
 
   test("uses custom build command", () => {
     const result = GoCI({ buildCommand: "go build -o bin/app ./cmd/app" });
-    const steps = result.buildJob.props.steps as Array<{ props: Record<string, unknown> }>;
+    const steps = propsOf(result.buildJob).steps as Array<{ props: Record<string, unknown> }>;
     expect(steps[2].props.run).toBe("go build -o bin/app ./cmd/app");
   });
 
   test("uses custom test command", () => {
     const result = GoCI({ testCommand: "go test -short ./..." });
-    const steps = result.testJob.props.steps as Array<{ props: Record<string, unknown> }>;
+    const steps = propsOf(result.testJob).steps as Array<{ props: Record<string, unknown> }>;
     expect(steps[2].props.run).toBe("go test -short ./...");
   });
 
   test("lintJob uses golangci-lint-action", () => {
     const result = GoCI({});
-    const steps = result.lintJob!.props.steps as Array<{ props: Record<string, unknown> }>;
+    const steps = propsOf(result.lintJob!).steps as Array<{ props: Record<string, unknown> }>;
     expect(steps[2].props.uses).toBe("golangci/golangci-lint-action@v6");
   });
 
   test("uses custom runsOn", () => {
     const result = GoCI({ runsOn: "macos-latest" });
-    expect(result.buildJob.props["runs-on"]).toBe("macos-latest");
-    expect(result.testJob.props["runs-on"]).toBe("macos-latest");
+    expect(propsOf(result.buildJob)["runs-on"]).toBe("macos-latest");
+    expect(propsOf(result.testJob)["runs-on"]).toBe("macos-latest");
   });
 });
 
@@ -682,8 +685,8 @@ describe("defaults overrides", () => {
       ref: "main",
       defaults: { step: { id: "my-checkout" } },
     });
-    expect(result.step.props.id).toBe("my-checkout");
-    expect(result.step.props.uses).toBe("actions/checkout@v7");
+    expect(propsOf(result.step).id).toBe("my-checkout");
+    expect(propsOf(result.step).uses).toBe("actions/checkout@v7");
   });
 
   test("SetupNode defaults override step props", () => {
@@ -691,8 +694,8 @@ describe("defaults overrides", () => {
       nodeVersion: "20",
       defaults: { step: { id: "setup" } },
     });
-    expect(result.step.props.id).toBe("setup");
-    expect(result.step.props.name).toBe("Setup Node.js");
+    expect(propsOf(result.step).id).toBe("setup");
+    expect(propsOf(result.step).name).toBe("Setup Node.js");
   });
 
   test("NodeCI defaults override job and workflow props", () => {
@@ -702,8 +705,8 @@ describe("defaults overrides", () => {
         workflow: { concurrency: "ci-${{ github.ref }}" } as any,
       },
     });
-    expect(result.job.props["timeout-minutes"]).toBe(30);
-    expect(result.workflow.props.concurrency).toBe("ci-${{ github.ref }}");
+    expect(propsOf(result.job)["timeout-minutes"]).toBe(30);
+    expect(propsOf(result.workflow).concurrency).toBe("ci-${{ github.ref }}");
   });
 
   test("NodePipeline defaults override individual jobs", () => {
@@ -713,8 +716,8 @@ describe("defaults overrides", () => {
         testJob: { "timeout-minutes": 20 } as any,
       },
     });
-    expect(result.buildJob.props["timeout-minutes"]).toBe(15);
-    expect(result.testJob.props["timeout-minutes"]).toBe(20);
+    expect(propsOf(result.buildJob)["timeout-minutes"]).toBe(15);
+    expect(propsOf(result.testJob)["timeout-minutes"]).toBe(20);
   });
 
   test("DockerBuild defaults override job and workflow", () => {
@@ -724,8 +727,8 @@ describe("defaults overrides", () => {
         workflow: { concurrency: "docker" } as any,
       },
     });
-    expect(result.job.props["timeout-minutes"]).toBe(60);
-    expect(result.workflow.props.concurrency).toBe("docker");
+    expect(propsOf(result.job)["timeout-minutes"]).toBe(60);
+    expect(propsOf(result.workflow).concurrency).toBe("docker");
   });
 
   test("DeployEnvironment defaults override deploy and cleanup jobs", () => {
@@ -737,8 +740,8 @@ describe("defaults overrides", () => {
         cleanupJob: { "timeout-minutes": 10 } as any,
       },
     });
-    expect(result.deployJob.props["timeout-minutes"]).toBe(30);
-    expect(result.cleanupJob.props["timeout-minutes"]).toBe(10);
+    expect(propsOf(result.deployJob)["timeout-minutes"]).toBe(30);
+    expect(propsOf(result.cleanupJob)["timeout-minutes"]).toBe(10);
   });
 
   test("GoCI defaults override workflow name", () => {
@@ -747,7 +750,7 @@ describe("defaults overrides", () => {
         workflow: { name: "Custom Go CI" } as any,
       },
     });
-    expect(result.workflow.props.name).toBe("Custom Go CI");
+    expect(propsOf(result.workflow).name).toBe("Custom Go CI");
   });
 
   test("PythonCI defaults override testJob", () => {
@@ -756,7 +759,7 @@ describe("defaults overrides", () => {
         testJob: { "timeout-minutes": 45 } as any,
       },
     });
-    expect(result.testJob.props["timeout-minutes"]).toBe(45);
+    expect(propsOf(result.testJob)["timeout-minutes"]).toBe(45);
   });
 
   test("UploadArtifact defaults override step props", () => {
@@ -765,8 +768,8 @@ describe("defaults overrides", () => {
       path: "dist/",
       defaults: { step: { id: "upload" } },
     });
-    expect(result.step.props.id).toBe("upload");
-    expect(result.step.props.uses).toBe("actions/upload-artifact@v4");
+    expect(propsOf(result.step).id).toBe("upload");
+    expect(propsOf(result.step).uses).toBe("actions/upload-artifact@v4");
   });
 
   test("CacheAction defaults override step props", () => {
@@ -775,7 +778,7 @@ describe("defaults overrides", () => {
       key: "cache-key",
       defaults: { step: { id: "cache-step" } },
     });
-    expect(result.step.props.id).toBe("cache-step");
-    expect(result.step.props.uses).toBe("actions/cache@v4");
+    expect(propsOf(result.step).id).toBe("cache-step");
+    expect(propsOf(result.step).uses).toBe("actions/cache@v4");
   });
 });