@intentius/chant-lexicon-github 0.117.0 → 0.118.0

package/dist/components/generate-op-waves-pipeline.d.ts

@@ -18,6 +18,11 @@
  * runs `chant run resume --op <name>` on that schedule: it re-runs the failed
  * jobs of a run whose waiting wave has been approved since, with the job's
  * token and `actions: write`.
+ *
+ * When a wave's approval is `pr-review` (#3684), the workflow also asks for
+ * `pull-requests: read`, so a wave can read the merged pull request's
+ * reviews, and a second workflow, `<name>-plans.yml`, runs `chant run wave
+ * --record-plans` on each pull request to record the digests its head plans.
  */
 import { type OpWavesSpec } from "@intentius/chant/op/op-waves";
 import type { OpWavesPipelineOptions, OpWavesPipelineResult } from "@intentius/chant/lexicon";
@@ -31,6 +36,7 @@ export declare function buildGithubOpWavesDoc(spec: OpWavesSpec, options: OpWave
     doc: GithubOpPipelineDoc;
     jobs: OpWavesPipelineResult["jobs"];
     resumeDoc?: GithubOpPipelineDoc;
+    plansDoc?: GithubOpPipelineDoc;
 };
 /** Render an Op waves spec as one GitHub Actions workflow, `<name>.yml`. */
 export declare function generateGithubOpWavesPipeline(spec: OpWavesSpec, options: OpWavesPipelineOptions): OpWavesPipelineResult;

package/dist/components/generate-op-waves-pipeline.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generate-op-waves-pipeline.d.ts","sourceRoot":"","sources":["../../src/components/generate-op-waves-pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAoC,KAAK,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAClG,OAAO,KAAK,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAE9F,OAAO,EAIL,KAAK,mBAAmB,EACzB,MAAM,wBAAwB,CAAC;AAEhC,yFAAyF;AACzF,eAAO,MAAM,cAAc,YAAY,CAAC;AAExC,oEAAoE;AACpE,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAE1F;AAOD,qEAAqE;AACrE,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,WAAW,EACjB,OAAO,EAAE,sBAAsB,GAC9B;IAAE,GAAG,EAAE,mBAAmB,CAAC;IAAC,IAAI,EAAE,qBAAqB,CAAC,MAAM,CAAC,CAAC;IAAC,SAAS,CAAC,EAAE,mBAAmB,CAAA;CAAE,CA0DpG;AA2BD,4EAA4E;AAC5E,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,sBAAsB,GAAG,qBAAqB,CAKvH"}
+{"version":3,"file":"generate-op-waves-pipeline.d.ts","sourceRoot":"","sources":["../../src/components/generate-op-waves-pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAoC,KAAK,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAClG,OAAO,KAAK,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAE9F,OAAO,EAIL,KAAK,mBAAmB,EACzB,MAAM,wBAAwB,CAAC;AAEhC,yFAAyF;AACzF,eAAO,MAAM,cAAc,YAAY,CAAC;AAExC,oEAAoE;AACpE,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAE1F;AAOD,qEAAqE;AACrE,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,WAAW,EACjB,OAAO,EAAE,sBAAsB,GAC9B;IAAE,GAAG,EAAE,mBAAmB,CAAC;IAAC,IAAI,EAAE,qBAAqB,CAAC,MAAM,CAAC,CAAC;IAAC,SAAS,CAAC,EAAE,mBAAmB,CAAC;IAAC,QAAQ,CAAC,EAAE,mBAAmB,CAAA;CAAE,CAgEpI;AA4CD,4EAA4E;AAC5E,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,sBAAsB,GAAG,qBAAqB,CAMvH"}

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "80cd8fc60162a6b30fc79202a8992ab61d34b4d245c93553194e489340c32abd",
+    "manifest.json": "a0a217bf875f2999a78da91e06dd0fe33165e52b6077800a76654f75c9e8354d",
     "meta.json": "c50e0ef3845c370c3ad2210b8bba455980417c0f818aa6ed46e06d4fb8b1b9f9",
     "types/index.d.ts": "bdd54a4145a39a9dd4f7bbc8c500191acb6bc9057a87da0040475afac84db397",
     "rules/deprecated-action-version.ts": "d41e6e532ab7f623af1bee4ac5279fcb2baada7defa1c5d022a5bc71983e8797",
@@ -78,5 +78,5 @@
     "skills/chant-github-patterns.md": "bb3abef289a8fdfcf07d6bb2d7289dcb2f38bc0cb0321ea320b78b45a6f548c0",
     "skills/chant-github-security.md": "aab111cb0871cad30281ce48d7da23663689619351029219e2be019a1a61e394"
   },
-  "composite": "56d98c73201dd7cf4c5a2ca9153dfd1324ae6cc21adf35f9a956e389f98f51b8"
+  "composite": "db3b08fa2fb816149260d6ea9f821c842bbd6317bcb181114380fbb14fd7a734"
 }

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "github",
-  "version": "0.117.0",
+  "version": "0.118.0",
   "chantVersion": ">=0.1.0",
   "namespace": "GitHub",
   "intrinsics": [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-github",
-  "version": "0.117.0",
+  "version": "0.118.0",
   "description": "GitHub Actions lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -61,7 +61,7 @@
     "typescript": "^5.9.3"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.117.0",
+    "@intentius/chant": "^0.118.0",
     "typescript": "^5.9.3"
   }
 }

package/src/components/generate-op-waves-pipeline.test.ts

@@ -41,4 +41,12 @@ describe("generateGithubOpWavesPipeline", () => {
     expect(yaml).toContain("GITHUB_TOKEN: '${{ github.token }}'");
     expect(generateGithubOpWavesPipeline(spec, { specFile: "waves.json" }).files).toHaveLength(1);
   });
+
+  test("a pr-review wave adds a pull request workflow that records the head's plans (#3684)", () => {
+    const { files } = generateGithubOpWavesPipeline({ ...spec, waves: spec.waves.map((w, i) => (i === spec.waves.length - 1 ? { ...w, approval: "pr-review" as const } : w)) }, { specFile: "waves.json" });
+    expect(files.map((f) => f.name)).toEqual([`${spec.name}.yml`, `${spec.name}-plans.yml`]);
+    expect(files[1]!.yaml).toContain("pull_request:");
+    expect(files[1]!.yaml).toContain("run: chant run wave --spec waves.json --record-plans");
+    expect(files[0]!.yaml).toMatch(/permissions:\n\s+contents: write\n\s+pull-requests: read/);
+  });
 });

package/src/components/generate-op-waves-pipeline.ts

@@ -18,6 +18,11 @@
  * runs `chant run resume --op <name>` on that schedule: it re-runs the failed
  * jobs of a run whose waiting wave has been approved since, with the job's
  * token and `actions: write`.
+ *
+ * When a wave's approval is `pr-review` (#3684), the workflow also asks for
+ * `pull-requests: read`, so a wave can read the merged pull request's
+ * reviews, and a second workflow, `<name>-plans.yml`, runs `chant run wave
+ * --record-plans` on each pull request to record the digests its head plans.
  */
 
 import { opWaveJobs, opWavesResumeCommand, type OpWavesSpec } from "@intentius/chant/op/op-waves";
@@ -47,9 +52,10 @@ function dirOf(path: string): string {
 export function buildGithubOpWavesDoc(
   spec: OpWavesSpec,
   options: OpWavesPipelineOptions,
-): { doc: GithubOpPipelineDoc; jobs: OpWavesPipelineResult["jobs"]; resumeDoc?: GithubOpPipelineDoc } {
+): { doc: GithubOpPipelineDoc; jobs: OpWavesPipelineResult["jobs"]; resumeDoc?: GithubOpPipelineDoc; plansDoc?: GithubOpPipelineDoc } {
   const jobs = opWaveJobs(spec, options.specFile);
   const image = options.image ?? OP_WAVES_IMAGE;
+  const byReview = spec.waves.some((w) => w.approval === "pr-review");
   for (const wave of spec.waves) {
     assertSetupSteps(`${spec.name}/${wave.name}`, wave.setup ?? []);
     if (wave.environment) assertEnvironment(`${spec.name}/${wave.name}`, wave.environment);
@@ -101,10 +107,15 @@ export function buildGithubOpWavesDoc(
     on: { push: { branches: spec.branches?.length ? spec.branches : ["main"] }, workflow_dispatch: {} },
     ...(options.variables && Object.keys(options.variables).length > 0 ? { env: options.variables } : {}),
     concurrency: { group: spec.name, "cancel-in-progress": false },
-    permissions: { contents: "write" },
+    permissions: { contents: "write", ...(byReview ? { "pull-requests": "read" } : {}) },
     jobsDoc,
   };
-  return { doc, jobs, ...(spec.resume ? { resumeDoc: buildResumeDoc(spec, options) } : {}) };
+  return {
+    doc,
+    jobs,
+    ...(spec.resume ? { resumeDoc: buildResumeDoc(spec, options) } : {}),
+    ...(byReview ? { plansDoc: buildPlansDoc(spec, options) } : {}),
+  };
 }
 
 /** The scheduled resume workflow (#3683). */
@@ -126,6 +137,23 @@ function buildResumeDoc(spec: OpWavesSpec, options: OpWavesPipelineOptions): Git
   };
 }
 
+/** The pull request workflow a `pr-review` wave needs (#3684): record the digests each head plans. */
+function buildPlansDoc(spec: OpWavesSpec, options: OpWavesPipelineOptions): GithubOpPipelineDoc {
+  const steps: Array<Record<string, unknown>> = [{ uses: actionRef("actions/checkout"), with: { "fetch-depth": 0 } }];
+  for (const step of spec.waves[0]?.setup ?? []) steps.push({ ...step });
+  for (const line of options.beforeScript ?? []) steps.push({ run: line });
+  steps.push({ name: "Plan every wave at the head and record its digests", run: ["chant", "run", "wave", "--spec", options.specFile, "--record-plans"].join(" ") });
+  return {
+    name: `${spec.name}-plans`,
+    on: { pull_request: { branches: spec.branches?.length ? spec.branches : ["main"] } },
+    ...(options.variables && Object.keys(options.variables).length > 0 ? { env: options.variables } : {}),
+    concurrency: { group: spec.name + "-plans-${{ github.event.number }}", "cancel-in-progress": true },
+    // contents: write pushes the record to chant/lifecycle.
+    permissions: { contents: "write" },
+    jobsDoc: { "record-plans": { "runs-on": "ubuntu-latest", container: options.image ?? OP_WAVES_IMAGE, steps } },
+  };
+}
+
 function describeJob(kind: "wave" | "decide" | "share", wave: number, name: string, share?: number): string {
   if (kind === "decide") return `Plan wave ${wave} (${name}) and decide its gate`;
   if (kind === "share") return `Apply share ${share} of wave ${wave} (${name})`;
@@ -134,8 +162,9 @@ function describeJob(kind: "wave" | "decide" | "share", wave: number, name: stri
 
 /** Render an Op waves spec as one GitHub Actions workflow, `<name>.yml`. */
 export function generateGithubOpWavesPipeline(spec: OpWavesSpec, options: OpWavesPipelineOptions): OpWavesPipelineResult {
-  const { doc, jobs, resumeDoc } = buildGithubOpWavesDoc(spec, options);
+  const { doc, jobs, resumeDoc, plansDoc } = buildGithubOpWavesDoc(spec, options);
   const files = [{ name: `${spec.name}.yml`, yaml: emitOpPipelineYAML(doc) }];
   if (resumeDoc) files.push({ name: `${spec.name}-resume.yml`, yaml: emitOpPipelineYAML(resumeDoc) });
+  if (plansDoc) files.push({ name: `${spec.name}-plans.yml`, yaml: emitOpPipelineYAML(plansDoc) });
   return { files, jobs };
 }