@intentius/chant-lexicon-github 0.121.1 → 0.123.0

package/dist/components/generate-op-pipeline.d.ts

@@ -114,11 +114,10 @@ export interface GithubOpPipelineDoc {
     jobsDoc: Record<string, unknown>;
     /**
      * The gated-apply notice job (#2243), when this Op's trigger is `push`.
-     * Kept out of {@link jobsDoc} so a dialect that cannot run it drops it by
-     * simply not copying it: the job shells to `gh` against the GitHub API and
-     * needs `gh` on the runner, which is the same reason the `comment` finding
-     * mode is refused on forgejo (#2231). {@link emitOpPipelineYAML} merges it
-     * into `jobs:` for the forges that can. GitLab reaches the same outcome
+     * Kept out of {@link jobsDoc} so a dialect transforms it on its own terms;
+     * the forgejo generator carries it across since #3773, when the job moved
+     * off `gh` onto `@intentius/chant/pr-forge`. {@link emitOpPipelineYAML}
+     * merges it into `jobs:`. GitLab reaches the same outcome
      * without this job at all: its push job writes the pending block to an
      * artifact instead (#2256).
      */
@@ -174,23 +173,6 @@ export declare function assertEnvironment(name: string, environment: OpEnvironme
  *    push run, grants write access no step in the generated job can spend.
  */
 export declare function mergePermissions(name: string, base: Record<string, "read" | "write">, additive: Record<string, "read" | "write">, trigger: OpTrigger): Record<string, "read" | "write">;
-/**
- * Internal knobs beside the public {@link GenerateGithubOpOptions} — not part
- * of that type because they are not something a project author sets, only
- * something a dialect on top of this builder (forgejo, #2294) needs to
- * change about the shape this function emits for every spec alike.
- */
-export interface BuildGithubOpPipelineDocsInternalOptions {
-    /**
-     * Whether a `push` job's outputs (`gated`/`op`/`gate`/`approve`) and the
-     * `node -e` step that writes them to `$GITHUB_OUTPUT` are emitted (#2294).
-     * Default true (github's own behavior, unchanged): the gate-notice job
-     * beside it reads them. The forgejo generator passes `false` — it never
-     * carries a gate-notice job (`gatedNoticeDoc` never crosses the dialect),
-     * so nothing would ever read them there.
-     */
-    emitGatedOutputs?: boolean;
-}
 /**
  * Build one `GithubOpPipelineDoc` per scheduled Op: its trigger, its `setup`
  * steps, least-privilege `permissions:` for its finding-mode plus whatever
@@ -203,7 +185,7 @@ export interface BuildGithubOpPipelineDocsInternalOptions {
  * assertSetupSteps}), or a `permissions` entry that is not additive ({@link
  * mergePermissions}).
  */
-export declare function buildGithubOpPipelineDocs(ops: ScheduledOpSpec[], options?: GenerateGithubOpOptions, internalOptions?: BuildGithubOpPipelineDocsInternalOptions): {
+export declare function buildGithubOpPipelineDocs(ops: ScheduledOpSpec[], options?: GenerateGithubOpOptions): {
     files: GithubOpPipelineFile[];
     jobs: OpPipelineJob[];
 };

package/dist/components/generate-op-pipeline.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generate-op-pipeline.d.ts","sourceRoot":"","sources":["../../src/components/generate-op-pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsEG;AAIH,OAAO,KAAK,EACV,wBAAwB,IAAI,uBAAuB,EACnD,aAAa,EAEb,aAAa,EACb,gBAAgB,IAAI,sBAAsB,EAC1C,WAAW,EACX,SAAS,EAET,eAAe,EAChB,MAAM,0BAA0B,CAAC;AAGlC,YAAY,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,CAAC;AAEhE;;;;;;GAMG;AACH,MAAM,WAAW,mBAAmB;IAClC;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5B,2DAA2D;IAC3D,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,6DAA6D;IAC7D,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC;;;;OAIG;IACH,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,8DAA8D;IAC9D,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC;;;;;;;;;OASG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC1C;AAED,qFAAqF;AACrF,MAAM,WAAW,oBAAoB;IACnC,4FAA4F;IAC5F,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,mBAAmB,CAAC;CAC1B;AAmUD;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,IAAI,CA8BzE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,aAAa,GAAG,IAAI,CAwBhF;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,EACtC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,EAC1C,OAAO,EAAE,SAAS,GACjB,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,CAqClC;AA6BD;;;;;GAKG;AACH,MAAM,WAAW,wCAAwC;IACvD;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,eAAe,EAAE,EACtB,OAAO,GAAE,uBAA4B,EACrC,eAAe,GAAE,wCAA6C,GAC7D;IAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;IAAC,IAAI,EAAE,aAAa,EAAE,CAAA;CAAE,CAkG1D;AAwCD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,mBAAmB,GAAG,MAAM,CAgBnE;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,eAAe,EAAE,EACtB,OAAO,GAAE,uBAA4B,GACpC,sBAAsB,CAMxB"}
+{"version":3,"file":"generate-op-pipeline.d.ts","sourceRoot":"","sources":["../../src/components/generate-op-pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsEG;AAKH,OAAO,KAAK,EACV,wBAAwB,IAAI,uBAAuB,EACnD,aAAa,EAEb,aAAa,EACb,gBAAgB,IAAI,sBAAsB,EAC1C,WAAW,EACX,SAAS,EAET,eAAe,EAChB,MAAM,0BAA0B,CAAC;AAGlC,YAAY,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,CAAC;AAEhE;;;;;;GAMG;AACH,MAAM,WAAW,mBAAmB;IAClC;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5B,2DAA2D;IAC3D,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,6DAA6D;IAC7D,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC;;;;OAIG;IACH,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,8DAA8D;IAC9D,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC;;;;;;;;OAQG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC1C;AAED,qFAAqF;AACrF,MAAM,WAAW,oBAAoB;IACnC,4FAA4F;IAC5F,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,mBAAmB,CAAC;CAC1B;AAgVD;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,IAAI,CA8BzE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,aAAa,GAAG,IAAI,CAwBhF;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,EACtC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,EAC1C,OAAO,EAAE,SAAS,GACjB,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,CAqClC;AA6BD;;;;;;;;;;;GAWG;AACH,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,eAAe,EAAE,EACtB,OAAO,GAAE,uBAA4B,GACpC;IAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;IAAC,IAAI,EAAE,aAAa,EAAE,CAAA;CAAE,CAiG1D;AAwCD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,mBAAmB,GAAG,MAAM,CAenE;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,eAAe,EAAE,EACtB,OAAO,GAAE,uBAA4B,GACpC,sBAAsB,CAMxB"}

package/dist/components/generate-op-waves-pipeline.d.ts

@@ -23,6 +23,10 @@
  * `pull-requests: read`, so a wave can read the merged pull request's
  * reviews, and a second workflow, `<name>-plans.yml`, runs `chant run wave
  * --record-plans` on each pull request to record the digests its head plans.
+ *
+ * With `notify` on the spec (#3761), the workflow maps each variable it names
+ * from the repository secret of the same name, so a wave job can post to
+ * Slack, Teams or a signed webhook. `options.variables` wins over the mapping.
  */
 import { type OpWavesSpec } from "@intentius/chant/op/op-waves";
 import type { OpWavesPipelineOptions, OpWavesPipelineResult } from "@intentius/chant/lexicon";

package/dist/components/generate-op-waves-pipeline.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generate-op-waves-pipeline.d.ts","sourceRoot":"","sources":["../../src/components/generate-op-waves-pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAoC,KAAK,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAClG,OAAO,KAAK,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAE9F,OAAO,EAIL,KAAK,mBAAmB,EACzB,MAAM,wBAAwB,CAAC;AAEhC,yFAAyF;AACzF,eAAO,MAAM,cAAc,YAAY,CAAC;AAExC,oEAAoE;AACpE,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAE1F;AAOD,qEAAqE;AACrE,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,WAAW,EACjB,OAAO,EAAE,sBAAsB,GAC9B;IAAE,GAAG,EAAE,mBAAmB,CAAC;IAAC,IAAI,EAAE,qBAAqB,CAAC,MAAM,CAAC,CAAC;IAAC,SAAS,CAAC,EAAE,mBAAmB,CAAC;IAAC,QAAQ,CAAC,EAAE,mBAAmB,CAAA;CAAE,CAgEpI;AA4CD,4EAA4E;AAC5E,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,sBAAsB,GAAG,qBAAqB,CAMvH"}
+{"version":3,"file":"generate-op-waves-pipeline.d.ts","sourceRoot":"","sources":["../../src/components/generate-op-waves-pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAGH,OAAO,EAAoC,KAAK,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAClG,OAAO,KAAK,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAE9F,OAAO,EAIL,KAAK,mBAAmB,EACzB,MAAM,wBAAwB,CAAC;AAEhC,yFAAyF;AACzF,eAAO,MAAM,cAAc,YAAY,CAAC;AAExC,oEAAoE;AACpE,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAE1F;AAOD,qEAAqE;AACrE,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,WAAW,EACjB,OAAO,EAAE,sBAAsB,GAC9B;IAAE,GAAG,EAAE,mBAAmB,CAAC;IAAC,IAAI,EAAE,qBAAqB,CAAC,MAAM,CAAC,CAAC;IAAC,SAAS,CAAC,EAAE,mBAAmB,CAAC;IAAC,QAAQ,CAAC,EAAE,mBAAmB,CAAA;CAAE,CAkEpI;AA4CD,4EAA4E;AAC5E,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,sBAAsB,GAAG,qBAAqB,CAMvH"}

package/dist/composites/pr-plan-report.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pr-plan-report.d.ts","sourceRoot":"","sources":["../../src/composites/pr-plan-report.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,GAAG,EAAqB,MAAM,oBAAoB,CAAC;AAI5D,MAAM,WAAW,iBAAiB;IAChC;;;OAGG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB,4EAA4E;IAC5E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kEAAkE;IAClE,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,+CAA+C;IAC/C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iEAAiE;IACjE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,+DAA+D;IAC/D,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,6DAA6D;IAC7D,QAAQ,CAAC,EAAE;QACT,GAAG,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;KACrD,CAAC;CACH;AA2CD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,YAAY;;EAkEP,CAAC"}
+{"version":3,"file":"pr-plan-report.d.ts","sourceRoot":"","sources":["../../src/composites/pr-plan-report.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,GAAG,EAAqB,MAAM,oBAAoB,CAAC;AAI5D,MAAM,WAAW,iBAAiB;IAChC;;;OAGG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB,4EAA4E;IAC5E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kEAAkE;IAClE,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,+CAA+C;IAC/C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iEAAiE;IACjE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,+DAA+D;IAC/D,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,6DAA6D;IAC7D,QAAQ,CAAC,EAAE;QACT,GAAG,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;KACrD,CAAC;CACH;AAqDD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,YAAY;;EAqEP,CAAC"}

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "ad8144414b118bfcc17c78fccfdfb4f995fa60b772ab62d8a8caf5ce6e10092c",
+    "manifest.json": "ddb4b5dde531f86c72dfd39f31cf9a136cac1502167761af71c68c30cf7a456d",
     "meta.json": "c50e0ef3845c370c3ad2210b8bba455980417c0f818aa6ed46e06d4fb8b1b9f9",
     "types/index.d.ts": "0ead95536e947ddfb98a5acf0ddb88547913b5a53a342df67711c59266f84b3e",
     "rules/deprecated-action-version.ts": "d41e6e532ab7f623af1bee4ac5279fcb2baada7defa1c5d022a5bc71983e8797",
@@ -78,5 +78,5 @@
     "skills/chant-github-patterns.md": "bb3abef289a8fdfcf07d6bb2d7289dcb2f38bc0cb0321ea320b78b45a6f548c0",
     "skills/chant-github-security.md": "aab111cb0871cad30281ce48d7da23663689619351029219e2be019a1a61e394"
   },
-  "composite": "9ffb5b747d2b4b4151251fd767b83f8f02276cc92c5bea3d7c8fc7a812b92b8d"
+  "composite": "8ce3c463bf312052392409997e3971a57aee545fec0127b566c4200c425900e5"
 }

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "github",
-  "version": "0.121.1",
+  "version": "0.123.0",
   "chantVersion": ">=0.1.0",
   "namespace": "GitHub",
   "intrinsics": [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-github",
-  "version": "0.121.1",
+  "version": "0.123.0",
   "description": "GitHub Actions lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -61,7 +61,7 @@
     "typescript": "^5.9.3"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.121.1",
+    "@intentius/chant": "^0.123.0",
     "typescript": "^5.9.3"
   }
 }

package/src/components/generate-op-pipeline.notice.test.ts

@@ -0,0 +1,149 @@
+/**
+ * chant #3773: the gate-notice job's script, run.
+ *
+ * The generator emits a node script that posts through
+ * `@intentius/chant/pr-forge`. These tests take that script out of the
+ * generated workflow, run it with tsx against this checkout's chant, the way
+ * the job runs it against the release it installs, and answer its calls from
+ * a fake forge: GitHub's shapes at an `api.github.com`-style base, Forgejo's
+ * at `/api/v1`.
+ */
+
+import { execFile } from "node:child_process";
+import { mkdirSync, mkdtempSync, rmSync, symlinkSync, writeFileSync } from "node:fs";
+import { createServer, type IncomingMessage, type Server } from "node:http";
+import type { AddressInfo } from "node:net";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { promisify } from "node:util";
+import { afterEach, describe, expect, test } from "vitest";
+import { parseYAML } from "@intentius/chant/yaml";
+import { generateGithubOpPipeline } from "./generate-op-pipeline";
+
+const run = promisify(execFile);
+const REPO = fileURLToPath(new URL("../../../../", import.meta.url));
+const SHA = "0123456789abcdef0123456789abcdef01234567";
+
+interface Call {
+  method: string;
+  url: string;
+  auth?: string;
+  body?: Record<string, unknown>;
+}
+
+/** The node script inside the generated notice step's heredoc. */
+function noticeScript(): string {
+  const yaml = generateGithubOpPipeline([{ name: "app-apply", trigger: { kind: "push", branches: ["main"] } }]).files[0].yaml;
+  const doc = parseYAML(yaml) as { jobs: Record<string, { steps: Array<{ run?: string }> }> };
+  const shell = doc.jobs["app-apply-gate-notice"].steps[0].run ?? "";
+  const m = /cat > notice\.mjs <<'NOTICE'\n([\s\S]*?)\nNOTICE\n/.exec(shell);
+  if (!m) throw new Error("no notice.mjs heredoc in the notice step");
+  return m[1];
+}
+
+const dirs: string[] = [];
+
+/** A directory laid out like the job's: notice.mjs, and chant and tsx under node_modules. */
+function jobDir(): string {
+  const dir = mkdtempSync(join(tmpdir(), "chant-gate-notice-"));
+  dirs.push(dir);
+  mkdirSync(join(dir, "node_modules", "@intentius"), { recursive: true });
+  symlinkSync(join(REPO, "packages", "core"), join(dir, "node_modules", "@intentius", "chant"));
+  symlinkSync(join(REPO, "node_modules", "tsx"), join(dir, "node_modules", "tsx"));
+  writeFileSync(join(dir, "notice.mjs"), noticeScript());
+  return dir;
+}
+
+function readBody(req: IncomingMessage): Promise<Record<string, unknown> | undefined> {
+  return new Promise((resolve) => {
+    let text = "";
+    req.on("data", (c) => (text += c));
+    req.on("end", () => resolve(text ? (JSON.parse(text) as Record<string, unknown>) : undefined));
+  });
+}
+
+let server: Server | undefined;
+afterEach(() => {
+  server?.close();
+  server = undefined;
+  for (const dir of dirs.splice(0)) rmSync(dir, { recursive: true, force: true });
+});
+
+/** A fake forge answering `routes` by `METHOD path`, query string dropped. */
+async function fakeForge(routes: Record<string, (body?: Record<string, unknown>) => [number, unknown]>): Promise<{ base: string; calls: Call[] }> {
+  const calls: Call[] = [];
+  server = createServer(async (req, res) => {
+    const body = await readBody(req);
+    const path = (req.url ?? "").split("?")[0];
+    calls.push({ method: req.method ?? "", url: req.url ?? "", auth: req.headers.authorization, ...(body ? { body } : {}) });
+    const route = routes[`${req.method} ${path}`];
+    const [status, answer] = route ? route(body) : [404, { message: "not found" }];
+    res.writeHead(status, { "Content-Type": "application/json" });
+    res.end(JSON.stringify(answer));
+  });
+  await new Promise<void>((resolve) => server!.listen(0, "127.0.0.1", resolve));
+  return { base: `http://127.0.0.1:${(server!.address() as AddressInfo).port}`, calls };
+}
+
+async function runNotice(env: Record<string, string>): Promise<string> {
+  const { stdout } = await run(process.execPath, ["--import", "tsx", "notice.mjs"], {
+    cwd: jobDir(),
+    env: {
+      PATH: process.env.PATH ?? "",
+      TSX_DISABLE_CACHE: "1",
+      GITHUB_ACTIONS: "true",
+      GITHUB_REPOSITORY: "acme/infra",
+      GITHUB_SHA: SHA,
+      GITHUB_TOKEN: "job-token",
+      CHANT_OP: "app-apply",
+      CHANT_GATE: "apply",
+      CHANT_APPROVE: "chant approve app-apply apply",
+      ...env,
+    },
+  });
+  return stdout.trim();
+}
+
+describe("the gate-notice script (#3773)", () => {
+  test("on GitHub it comments on the pull request the commit merged", async () => {
+    const { base, calls } = await fakeForge({
+      [`GET /repos/acme/infra/commits/${SHA}/pulls`]: () => [200, [{ number: 7, merged_at: "2026-10-11T00:00:00Z", merge_commit_sha: SHA }]],
+      "GET /repos/acme/infra/issues/7/comments": () => [200, []],
+      "POST /repos/acme/infra/issues/7/comments": () => [201, { id: 11, html_url: "https://github.example/acme/infra/pull/7#c11" }],
+    });
+    const out = await runNotice({ GITHUB_API_URL: base, GITHUB_SERVER_URL: "https://github.com" });
+    expect(out).toBe("https://github.example/acme/infra/pull/7#c11");
+    const post = calls.find((c) => c.method === "POST")!;
+    expect(post.auth).toBe("Bearer job-token");
+    const body = String(post.body?.body);
+    expect(body.startsWith("<!-- chant-gate:app-apply -->\n\nThe `app-apply` apply for " + SHA + " stopped at gate `apply`")).toBe(true);
+    expect(body).toContain("```\nchant approve app-apply apply --approver <you>\n```");
+    expect(body).toContain("`_gates/app-apply.jsonl` on the `chant/lifecycle` branch");
+  });
+
+  test("on GitHub it edits its own comment on a later gated push", async () => {
+    const { base, calls } = await fakeForge({
+      [`GET /repos/acme/infra/commits/${SHA}/pulls`]: () => [200, [{ number: 7, merged_at: "x", merge_commit_sha: SHA }]],
+      "GET /repos/acme/infra/issues/7/comments": () => [200, [{ id: 5, body: "<!-- chant-gate:app-apply -->\n\nolder", html_url: "u5" }]],
+      "PATCH /repos/acme/infra/issues/comments/5": () => [200, { id: 5, html_url: "u5" }],
+    });
+    expect(await runNotice({ GITHUB_API_URL: base })).toBe("u5");
+    expect(calls.map((c) => c.method)).toEqual(["GET", "GET", "PATCH"]);
+  });
+
+  test("on Forgejo a commit with no pull request gets a tracking issue", async () => {
+    const { base, calls } = await fakeForge({
+      "GET /api/v1/repos/acme/infra/issues": () => [200, []],
+      "POST /api/v1/repos/acme/infra/issues": () => [201, { number: 3, html_url: "https://forgejo.example/acme/infra/issues/3" }],
+    });
+    const out = await runNotice({ FORGEJO_ACTIONS: "true", GITHUB_API_URL: `${base}/api/v1`, GITHUB_SERVER_URL: base });
+    expect(out).toBe("https://forgejo.example/acme/infra/issues/3");
+    // Forgejo's own lookup, answered 404 here: no pull request merged this commit.
+    expect(calls[0]).toMatchObject({ method: "GET", url: `/api/v1/repos/acme/infra/commits/${SHA}/pull` });
+    const post = calls.find((c) => c.method === "POST")!;
+    expect(post.auth).toBe("token job-token");
+    expect(post.body?.title).toBe("app-apply is waiting on gate apply");
+    expect(String(post.body?.body).startsWith("<!-- chant-gate:app-apply -->")).toBe(true);
+  });
+});

package/src/components/generate-op-pipeline.test.ts

@@ -11,6 +11,7 @@
  *     is a single edit reflected in every generated file.
  */
 
+import { readFileSync } from "node:fs";
 import { describe, test, expect } from "vitest";
 import { parseYAML } from "@intentius/chant/yaml";
 import { generateGithubOpPipeline } from "./generate-op-pipeline";
@@ -492,33 +493,38 @@ describe("generateGithubOpPipeline: the gated apply on push (#2243)", () => {
     const notice = pushDoc().jobs!["app-apply-gate-notice"];
     expect(notice.needs).toBe("app-apply");
     expect(notice.if).toBe("needs.app-apply.outputs.gated == 'true'");
-    // It shells to `gh`, which a hosted runner carries and the Op's own
-    // container image does not.
-    expect(notice.container).toBeUndefined();
+    // The Op's own image, which has node and npm, rather than gh on a hosted
+    // runner image (#3773).
+    expect(notice.container).toBe("node:22");
     const script = notice.steps[0].run ?? "";
-    expect(script).toContain('gh api "$api_base/repos/$GITHUB_REPOSITORY/commits/$GITHUB_SHA/pulls"');
-    expect(script).toContain('marker="<!-- chant-gate:$CHANT_OP -->"');
-    expect(script).toContain("gh issue create");
-  });
-
-  // chant #2305 — same anti-pattern `stickyCommentScript`
-  // (`lexicons/github/src/composites/pr-plan-report.ts`) and `reconcilePr`'s
-  // `postOrUpdateComment` (#2291) had: a bare relative path, which `gh`
-  // resolves against `/api/v3` for any host but github.com. This job never
-  // reaches Forgejo today (the forgejo generator never carries
-  // `gatedNoticeDoc` across the dialect, #2294), so the fix changes nothing
-  // observable on github.com or GHES — it only stops a future Forgejo notice
-  // job from inheriting the same bug.
-  test("the notice job's gh api calls resolve their base from $GITHUB_API_URL, not a bare path (#2305)", () => {
+    expect(script).toContain('import { forgeClient, forgeTargetFromEnv } from "@intentius/chant/pr-forge";');
+    expect(script).toContain('const marker = "<!-- chant-gate:" + op + " -->";');
+    expect(script).toContain("forge.pullRequestFor(target.sha)");
+    expect(script).toContain("forge.upsertNote(pr, marker, body)");
+    expect(script).toContain('forge.upsertIssue(marker, op + " is waiting on gate " + gate, body)');
+    expect(script).toContain("node --import tsx notice.mjs");
+  });
+
+  // #3773 (and #3780 for its `gh issue create`): no `gh` call is left to
+  // default to github.com on a GHES or Forgejo host. The forge, the REST base
+  // and the host come from the job's environment through pr-forge.
+  test("the notice job runs no gh at all", () => {
+    const notice = pushDoc().jobs!["app-apply-gate-notice"];
+    expect(notice.steps[0].run ?? "").not.toMatch(/(^|\s)gh\s/m);
+    const env = notice.steps[0].env ?? {};
+    expect(env.GITHUB_TOKEN).toBe("${{ github.token }}");
+    expect(env).not.toHaveProperty("GH_REPO");
+  });
+
+  test("the notice job installs the chant release this lexicon was generated with", () => {
+    const { version } = JSON.parse(readFileSync(new URL("../../package.json", import.meta.url), "utf8")) as { version: string };
     const script = pushDoc().jobs!["app-apply-gate-notice"].steps[0].run ?? "";
-    expect(script).toContain('api_base="${GITHUB_API_URL%/}"');
-    expect(script).toContain('api_base="${api_base:-https://api.github.com}"');
-    expect(script).toContain('gh api "$api_base/repos/$GITHUB_REPOSITORY/commits/$GITHUB_SHA/pulls"');
-    expect(script).toContain('gh api "$api_base/repos/$GITHUB_REPOSITORY/issues/$pr/comments"');
-    expect(script).toContain('gh api --method PATCH "$api_base/repos/$GITHUB_REPOSITORY/issues/comments/$id"');
-    expect(script).toContain('gh api --method POST "$api_base/repos/$GITHUB_REPOSITORY/issues/$pr/comments"');
-    // No bare-path call survives.
-    expect(script).not.toMatch(/gh api[^\n]*"repos\//);
+    expect(script).toContain(`npm install --omit=peer --no-audit --no-fund --loglevel=error @intentius/chant@${version}`);
+  });
+
+  test("the notice job runs in options.image when one is given", () => {
+    const doc = parseFile(generateGithubOpPipeline([pushSpec], { image: "registry.example/node:22" }).files[0].yaml);
+    expect(doc.jobs!["app-apply-gate-notice"].container).toBe("registry.example/node:22");
   });
 
   test("the notice job's permissions are its two posting paths and the lookup", () => {
@@ -544,7 +550,7 @@ describe("generateGithubOpPipeline: the gated apply on push (#2243)", () => {
 
   /**
    * chant #2299 — every Op job carries `container:` (this generator sets one
-   * unconditionally, default `node:22-slim`), and a container job's default
+   * unconditionally, default `node:22`), and a container job's default
    * shell on GitHub Actions is `sh`, not bash. `sh` rejects `set -o pipefail`
    * outright (`Illegal option -o pipefail`) and fails the step before `chant`
    * is ever reached, which is exactly what happened on a real run (choudoufu
@@ -555,7 +561,7 @@ describe("generateGithubOpPipeline: the gated apply on push (#2243)", () => {
   test("the run step needs no shell override — its script is POSIX sh, not bash (#2299)", () => {
     const doc = pushDoc();
     const job = doc.jobs!["app-apply"];
-    expect(job.container).toBe("node:22-slim");
+    expect(job.container).toBe("node:22");
     const step = job.steps.find((s) => s.id === "chant-run");
     expect(step?.shell).toBeUndefined();
     expect(step?.run).not.toContain("pipefail");
@@ -620,7 +626,7 @@ describe("generateGithubOpPipeline: a deployment environment on the Op's job (#2
       "jobs:",
       "  actions-audit:",
       "    runs-on: ubuntu-latest",
-      "    container: node:22-slim",
+      "    container: node:22",
       "    steps:",
       "      - uses: actions/checkout@v7",
       "      - run: chant run actions-audit",

package/src/components/generate-op-pipeline.ts

@@ -70,6 +70,7 @@
  * that job either, same as `environment:` above does not).
  */
 
+import { readFileSync } from "node:fs";
 import { emitYAML, emitYAMLEntry } from "@intentius/chant/yaml";
 import { memberPathFilter, resolveOpTrigger } from "@intentius/chant/lexicon";
 import type {
@@ -130,11 +131,10 @@ export interface GithubOpPipelineDoc {
   jobsDoc: Record<string, unknown>;
   /**
    * The gated-apply notice job (#2243), when this Op's trigger is `push`.
-   * Kept out of {@link jobsDoc} so a dialect that cannot run it drops it by
-   * simply not copying it: the job shells to `gh` against the GitHub API and
-   * needs `gh` on the runner, which is the same reason the `comment` finding
-   * mode is refused on forgejo (#2231). {@link emitOpPipelineYAML} merges it
-   * into `jobs:` for the forges that can. GitLab reaches the same outcome
+   * Kept out of {@link jobsDoc} so a dialect transforms it on its own terms;
+   * the forgejo generator carries it across since #3773, when the job moved
+   * off `gh` onto `@intentius/chant/pr-forge`. {@link emitOpPipelineYAML}
+   * merges it into `jobs:`. GitLab reaches the same outcome
    * without this job at all: its push job writes the pending block to an
    * artifact instead (#2256).
    */
@@ -153,7 +153,7 @@ function toJobName(opName: string): string {
   return opName.replace(/([a-z0-9])([A-Z])/g, "$1-$2").toLowerCase();
 }
 
-const DEFAULT_IMAGE = "node:22-slim";
+const DEFAULT_IMAGE = "node:22";
 
 /**
  * Default branch assumed for a `push` trigger with no `branches` override
@@ -287,18 +287,14 @@ const GATE_OUTPUT_SCRIPT =
  *
  * The `node -e` line and the job's own `outputs:` mapping exist for exactly
  * one reader: the gate-notice job beside it, which is `needs:`-only readable
- * through `steps.<id>.outputs`/`needs.<job>.outputs`. `emitOutputs: false`
- * (forgejo, #2294 — the notice job does not cross the dialect at all) drops
- * that line: nothing on Forgejo reads `$GITHUB_OUTPUT` for this job, and
- * keeping the line would be a wired-up mechanism with no reader, which is the
- * exact thing #2294 is about. The tee'd invocation survives either way — it's
- * what puts the run's own JSON record in the log, gate-notice job or not.
+ * through `steps.<id>.outputs`/`needs.<job>.outputs`. Forgejo dropped both
+ * while it had no notice job (#2294) and carries them again since #3773. The
+ * tee'd invocation is what puts the run's own JSON record in the log.
  */
 function gatedRunStep(
   id: string,
   op: string,
   invocation: string,
-  emitOutputs: boolean,
   env: Record<string, string>,
 ): Record<string, unknown> {
   const lines = [
@@ -309,70 +305,86 @@ function gatedRunStep(
     'code=$(cat "$status")',
     '[ "$code" -eq 0 ] || exit "$code"',
   ];
-  if (emitOutputs) lines.push(`node -e '${GATE_OUTPUT_SCRIPT}' "$json"`);
+  lines.push(`node -e '${GATE_OUTPUT_SCRIPT}' "$json"`);
   return { id, run: lines.join("\n"), env };
 }
 
 /**
- * The notice body's `printf` format. Kept out of {@link gateNoticeScript} so
- * the shell quoting stays readable: it is single-quoted in the emitted script
- * because it carries markdown backticks, which a double-quoted shell string
- * would run as command substitution.
+ * The chant release the notice job installs: this lexicon's own version.
+ * The github lexicon and `@intentius/chant` release in lockstep, so the pr-forge
+ * a generated workflow runs is the one this generator was built against, and
+ * it changes only when the workflow is regenerated, the same as a pinned
+ * action ref.
  */
-const NOTICE_BODY_FORMAT =
-  "%s\\n\\nThe `%s` apply for %s stopped at gate `%s` and is waiting for an approval. Nothing was applied." +
-  "\\n\\n```\\n%s --approver <you>\\n```\\n\\nThe pending fact is on `_gates/%s.jsonl` on the " +
-  "`chant/lifecycle` branch. Approving is a commit: push it and this workflow runs again and applies.\\n";
+function chantVersion(): string {
+  const pkg = JSON.parse(readFileSync(new URL("../../package.json", import.meta.url), "utf8")) as { version?: unknown };
+  if (typeof pkg.version !== "string" || pkg.version === "") {
+    throw new Error("the github lexicon's package.json has no version to pin the gate-notice job's chant to");
+  }
+  return pkg.version;
+}
 
 /**
- * What the notice job posts. The sticky-comment recipe `reconcilePr`'s
- * `comment` mode already uses (#2231), spelled in shell because this job runs
- * no Op: a hidden marker as the body's first line, found again with
- * `startswith` on the next run, PATCHed when it is there and POSTed when it is
- * not. So a branch that merges three times before anyone approves carries one
- * comment saying what is pending, not three.
- *
- * A GitHub `push` event carries no pull request, so the target is looked up:
- * `repos/{repo}/commits/{sha}/pulls` is the commit's own associated-pull-request
- * endpoint, exact rather than a search index, and on a merge commit it answers
- * with the pull request that just merged. When it answers with nothing — a
- * direct push to the branch, a merge whose commit the API does not associate —
- * the notice becomes an issue instead, which is the `issue` finding mode's own
- * recipe and the reason this job carries `issues: write`.
+ * What the notice job runs under node (#3773): the sticky-comment recipe
+ * `reconcilePr`'s `comment` mode uses, through the same
+ * `@intentius/chant/pr-forge` clients, so it posts on GitHub, GitHub
+ * Enterprise Server and Forgejo alike. `forgeTargetFromEnv` reads the forge,
+ * the REST base, the repository, the commit and the token off the job's
+ * environment (`CHANT_FORGEJO_TOKEN`, then `GH_TOKEN`, then `GITHUB_TOKEN`),
+ * and `pullRequestFor` is the commit-to-pull-request lookup each forge spells
+ * its own way (`commits/{sha}/pulls` on GitHub, `commits/{sha}/pull` on
+ * Forgejo). A commit with no pull request, a direct push, gets a tracking
+ * issue keyed on the same marker, so a second gated push edits it rather
+ * than opening another.
  *
- * `$api_base` (chant #2305), resolved the same way `stickyCommentScript`
- * (`lexicons/github/src/composites/pr-plan-report.ts`) and `reconcilePr`'s
- * `githubApiBaseFrom` (`packages/core/src/op/activities/reconcile.ts`)
- * resolve it: `$GITHUB_API_URL` with a trailing slash trimmed, falling back
- * to `https://api.github.com`. This job never crosses to Forgejo today — the
- * forgejo generator's `gatedNoticeDoc` is never carried across the dialect
- * (#2294) — so github.com and GitHub Enterprise Server are the only hosts
- * that run this script, and both already resolved correctly under `gh`'s own
- * bare-path guess. Built from `$api_base` instead, the URL is byte-identical
- * on those two hosts, and the same anti-pattern that broke Forgejo elsewhere
- * (#2291, #2305) does not get a second copy here in case a future notice job
- * does reach Forgejo.
+ * Plain JavaScript in double-quoted strings, so the markdown backticks need
+ * no escaping and nothing in it reads as a `${{ }}` expression.
+ */
+const NOTICE_SCRIPT = [
+  'import { forgeClient, forgeTargetFromEnv } from "@intentius/chant/pr-forge";',
+  "const { CHANT_OP: op, CHANT_GATE: gate, CHANT_APPROVE: approve } = process.env;",
+  "const target = forgeTargetFromEnv(process.env);",
+  "const forge = forgeClient(target);",
+  'const marker = "<!-- chant-gate:" + op + " -->";',
+  'const fence = "```";',
+  "const body = [",
+  "  marker,",
+  '  "",',
+  '  "The `" + op + "` apply for " + target.sha + " stopped at gate `" + gate + "` and is waiting for an approval. Nothing was applied.",',
+  '  "",',
+  "  fence,",
+  '  approve + " --approver <you>",',
+  "  fence,",
+  '  "",',
+  '  "The pending fact is on `_gates/" + op + ".jsonl` on the `chant/lifecycle` branch. Approving is a commit: push it and this workflow runs again and applies.",',
+  '].join("\\n") + "\\n";',
+  "const pr = target.sha ? await forge.pullRequestFor(target.sha) : null;",
+  "const url = pr",
+  "  ? await forge.upsertNote(pr, marker, body)",
+  '  : await forge.upsertIssue(marker, op + " is waiting on gate " + gate, body);',
+  'console.log(url ?? (pr ? "commented on #" + pr : "kept the tracking issue"));',
+].join("\n");
+
+/**
+ * The notice step's shell (#3773). It installs the pinned chant into the
+ * runner's temp directory and runs {@link NOTICE_SCRIPT} with tsx, which
+ * chant depends on and which is how `chant` itself runs its TypeScript.
+ * `--omit=peer` keeps chant's optional vitest peer out: about 17 packages,
+ * a few seconds. The `package.json` written first stops npm from walking up
+ * to some other project root. No checkout and no `beforeScript`: the job
+ * reads nothing out of the repository.
  */
-function gateNoticeScript(): string {
+function gateNoticeScript(version: string): string {
   return [
-    'api_base="${GITHUB_API_URL%/}"',
-    'api_base="${api_base:-https://api.github.com}"',
-    'marker="<!-- chant-gate:$CHANT_OP -->"',
-    "body=$(printf '" + NOTICE_BODY_FORMAT + "' " +
-      '"$marker" "$CHANT_OP" "$GITHUB_SHA" "$CHANT_GATE" "$CHANT_APPROVE" "$CHANT_OP")',
-    'pr=$(gh api "$api_base/repos/$GITHUB_REPOSITORY/commits/$GITHUB_SHA/pulls" --jq ".[0].number // empty")',
-    'if [ -z "$pr" ]; then',
-    '  gh issue create --title "$CHANT_OP is waiting on gate $CHANT_GATE" --body "$body"',
-    "  exit 0",
-    "fi",
-    'id=$(gh api "$api_base/repos/$GITHUB_REPOSITORY/issues/$pr/comments" --paginate ' +
-      '--jq "map(select(.body | startswith(\\"$marker\\"))) | .[0].id // empty" ' +
-      '| grep -m1 -E "^[0-9]+$" || true)',
-    'if [ -n "$id" ]; then',
-    '  gh api --method PATCH "$api_base/repos/$GITHUB_REPOSITORY/issues/comments/$id" -f "body=$body" --jq .html_url',
-    "else",
-    '  gh api --method POST "$api_base/repos/$GITHUB_REPOSITORY/issues/$pr/comments" -f "body=$body" --jq .html_url',
-    "fi",
+    'dir="${RUNNER_TEMP:-/tmp}/chant-gate-notice"',
+    'mkdir -p "$dir"',
+    'cd "$dir"',
+    "echo '{\"private\":true}' > package.json",
+    `npm install --omit=peer --no-audit --no-fund --loglevel=error @intentius/chant@${version}`,
+    "cat > notice.mjs <<'NOTICE'",
+    NOTICE_SCRIPT,
+    "NOTICE",
+    "node --import tsx notice.mjs",
   ].join("\n");
 }
 
@@ -380,34 +392,35 @@ function gateNoticeScript(): string {
  * The follow-up job: `needs:` the apply, runs only when the apply reported
  * gated, and puts the pending state somewhere other than the Actions log.
  *
- * No `container:`. It needs `gh`, which GitHub-hosted runner images carry and
- * an Op's own image (`node:22-slim` by default) does not; it reads nothing out
- * of the repository, so it also needs no checkout.
+ * It runs in the Op's own image, which carries node and npm by construction
+ * (the apply's `node -e` output step needs them too), so it runs the same on
+ * GitHub's hosted runners and on a Forgejo runner. It checks nothing out.
  *
  * Its `permissions:` are its own, replacing the workflow-level set for this
  * job alone: `contents: read` for the commit-to-pull-request lookup,
  * `pull-requests: write` for the sticky comment, `issues: write` for the
- * fallback when the push has no pull request. Nothing wider — it opens no
- * branch and merges nothing.
+ * tracking issue when the push has no pull request. Nothing wider: it opens
+ * no branch and merges nothing. The Forgejo dialect drops them, as it drops
+ * every scope but `id-token`.
  */
-function gateNoticeJob(applyJobName: string): Record<string, unknown> {
+function gateNoticeJob(applyJobName: string, image: string): Record<string, unknown> {
   const output = (name: string) => "${{ needs." + applyJobName + ".outputs." + name + ' }}';
   return {
     needs: applyJobName,
     if: `needs.${applyJobName}.outputs.gated == 'true'`,
     "runs-on": "ubuntu-latest",
+    container: image,
     permissions: { contents: "read", issues: "write", "pull-requests": "write" },
     steps: [
       {
         name: "Report the pending gate",
         env: {
-          GH_TOKEN: "${{ github.token }}",
-          GH_REPO: "${{ github.repository }}",
+          GITHUB_TOKEN: "${{ github.token }}",
           CHANT_OP: output("op"),
           CHANT_GATE: output("gate"),
           CHANT_APPROVE: output("approve"),
         },
-        run: gateNoticeScript(),
+        run: gateNoticeScript(chantVersion()),
       },
     ],
   };
@@ -639,24 +652,6 @@ function setupStepDoc(step: OpSetupStep): Record<string, unknown> {
   };
 }
 
-/**
- * Internal knobs beside the public {@link GenerateGithubOpOptions} — not part
- * of that type because they are not something a project author sets, only
- * something a dialect on top of this builder (forgejo, #2294) needs to
- * change about the shape this function emits for every spec alike.
- */
-export interface BuildGithubOpPipelineDocsInternalOptions {
-  /**
-   * Whether a `push` job's outputs (`gated`/`op`/`gate`/`approve`) and the
-   * `node -e` step that writes them to `$GITHUB_OUTPUT` are emitted (#2294).
-   * Default true (github's own behavior, unchanged): the gate-notice job
-   * beside it reads them. The forgejo generator passes `false` — it never
-   * carries a gate-notice job (`gatedNoticeDoc` never crosses the dialect),
-   * so nothing would ever read them there.
-   */
-  emitGatedOutputs?: boolean;
-}
-
 /**
  * Build one `GithubOpPipelineDoc` per scheduled Op: its trigger, its `setup`
  * steps, least-privilege `permissions:` for its finding-mode plus whatever
@@ -672,9 +667,7 @@ export interface BuildGithubOpPipelineDocsInternalOptions {
 export function buildGithubOpPipelineDocs(
   ops: ScheduledOpSpec[],
   options: GenerateGithubOpOptions = {},
-  internalOptions: BuildGithubOpPipelineDocsInternalOptions = {},
 ): { files: GithubOpPipelineFile[]; jobs: OpPipelineJob[] } {
-  const emitGatedOutputs = internalOptions.emitGatedOutputs ?? true;
   const image = options.image ?? DEFAULT_IMAGE;
   const runCommand = options.runCommand ?? ["chant", "run", "{name}"];
   const beforeScript = options.beforeScript ?? [];
@@ -715,7 +708,7 @@ export function buildGithubOpPipelineDocs(
     for (const line of beforeScript) steps.push({ run: line });
     steps.push(
       gated
-        ? gatedRunStep(RUN_STEP_ID, spec.name, invocation, emitGatedOutputs, stepEnv)
+        ? gatedRunStep(RUN_STEP_ID, spec.name, invocation, stepEnv)
         : { run: invocation, env: stepEnv },
     );
     for (const line of extraScript) steps.push({ run: line });
@@ -747,7 +740,7 @@ export function buildGithubOpPipelineDocs(
           // behind the same reviewer would hold the message back until
           // somebody had already acted.
           ...(spec.environment ? { environment: environmentDoc(spec.environment) } : {}),
-          ...(gated && emitGatedOutputs
+          ...(gated
             ? {
                 outputs: Object.fromEntries(
                   ["gated", "op", "gate", "approve"].map((name) => [
@@ -760,7 +753,7 @@ export function buildGithubOpPipelineDocs(
           steps,
         },
       },
-      ...(gated ? { gatedNoticeDoc: { [`${jobName}-gate-notice`]: gateNoticeJob(jobName) } } : {}),
+      ...(gated ? { gatedNoticeDoc: { [`${jobName}-gate-notice`]: gateNoticeJob(jobName, image) } } : {}),
     };
 
     files.push({ name: `${spec.name}.yml`, doc });
@@ -827,9 +820,8 @@ export function emitOpPipelineYAML(doc: GithubOpPipelineDoc): string {
   if (doc.env && Object.keys(doc.env).length > 0) sections.push(emitYAMLEntry("env", doc.env));
   sections.push(emitYAMLEntry("concurrency", doc.concurrency));
   if (Object.keys(doc.permissions).length > 0) sections.push(emitYAMLEntry("permissions", doc.permissions));
-  // The gated-apply notice job rides in `jobs:` beside the Op's own job, but
-  // is carried separately on the doc so a dialect that cannot run it (forgejo,
-  // whose runner has no `gh` pointed at its own instance) drops it by omission.
+  // The gated-apply notice job rides in `jobs:` beside the Op's own job; it
+  // is carried separately on the doc so a dialect transforms it on its own.
   sections.push(emitYAMLEntry("jobs", { ...doc.jobsDoc, ...(doc.gatedNoticeDoc ?? {}) }));
   return sections.join("\n\n") + "\n";
 }

package/src/components/generate-op-waves-pipeline.test.ts

@@ -31,6 +31,15 @@ describe("generateGithubOpWavesPipeline", () => {
     expect(yaml).toContain("environment:\n      name: production");
   });
 
+  test("notify maps each variable it names from the secret of that name, and options.variables wins (#3761)", () => {
+    const notify = { webhook: "CHANT_WEBHOOK", key: "CHANT_WEBHOOK_KEY", slack: "CHANT_SLACK_WEBHOOK" };
+    const yaml = generateGithubOpWavesPipeline({ ...spec, notify }, { specFile: "waves.json", variables: { CHANT_SLACK_WEBHOOK: "${{ vars.SLACK }}" } }).files[0]!.yaml;
+    expect(yaml).toContain("env:\n  CHANT_WEBHOOK: '${{ secrets.CHANT_WEBHOOK }}'");
+    expect(yaml).toContain("CHANT_WEBHOOK_KEY: '${{ secrets.CHANT_WEBHOOK_KEY }}'");
+    expect(yaml).toContain("CHANT_SLACK_WEBHOOK: '${{ vars.SLACK }}'");
+    expect(generateGithubOpWavesPipeline(spec, { specFile: "waves.json" }).files[0]!.yaml).not.toContain("secrets.");
+  });
+
   test("resume renders a scheduled workflow that re-runs approved waves with actions: write (#3683)", () => {
     const { files } = generateGithubOpWavesPipeline({ ...spec, resume: { schedule: "*/10 * * * *" } }, { specFile: "waves.json" });
     expect(files.map((f) => f.name)).toEqual([`${spec.name}.yml`, `${spec.name}-resume.yml`]);
@@ -49,4 +58,19 @@ describe("generateGithubOpWavesPipeline", () => {
     expect(files[1]!.yaml).toContain("run: chant run wave --spec waves.json --record-plans");
     expect(files[0]!.yaml).toMatch(/permissions:\n\s+contents: write\n\s+pull-requests: read/);
   });
+
+  test("a wave-level plan and apply, and stage hooks, render the same jobs: chant run wave runs them (#3762)", () => {
+    const { plan: _plan, ...rest } = spec;
+    const waveLevel: OpWavesSpec = {
+      ...rest,
+      planWave: ["./bin/plan-wave", "{runs}", "{plans}"],
+      applyWave: ["./bin/apply-wave", "{runs}"],
+      hooks: { before: { apply: [{ command: ["./bin/check", "{runs}"], onFailure: "approve" }] } },
+    };
+    const plain = generateGithubOpWavesPipeline(spec, { specFile: "waves.json" });
+    const rendered = generateGithubOpWavesPipeline(waveLevel, { specFile: "waves.json" });
+    expect(rendered.files).toEqual(plain.files);
+    expect(rendered.jobs).toEqual(plain.jobs);
+    expect(() => generateGithubOpWavesPipeline({ ...waveLevel, hooks: { after: { apply: [{ command: ["./bin/smoke"], onFailure: "approve" }] } } }, { specFile: "waves.json" })).toThrow(/nothing left to hold/);
+  });
 });

package/src/components/generate-op-waves-pipeline.ts

@@ -23,8 +23,13 @@
  * `pull-requests: read`, so a wave can read the merged pull request's
  * reviews, and a second workflow, `<name>-plans.yml`, runs `chant run wave
  * --record-plans` on each pull request to record the digests its head plans.
+ *
+ * With `notify` on the spec (#3761), the workflow maps each variable it names
+ * from the repository secret of the same name, so a wave job can post to
+ * Slack, Teams or a signed webhook. `options.variables` wins over the mapping.
  */
 
+import { notifyVariables } from "@intentius/chant/notify";
 import { opWaveJobs, opWavesResumeCommand, type OpWavesSpec } from "@intentius/chant/op/op-waves";
 import type { OpWavesPipelineOptions, OpWavesPipelineResult } from "@intentius/chant/lexicon";
 import { actionRef } from "../action-pins";
@@ -102,10 +107,12 @@ export function buildGithubOpWavesDoc(
     };
   }
 
+  // #3761: the notify variables come from the secrets of the same name.
+  const env = { ...Object.fromEntries(notifyVariables(spec.notify).map((n) => [n, `\${{ secrets.${n} }}`])), ...(options.variables ?? {}) };
   const doc: GithubOpPipelineDoc = {
     name: spec.name,
     on: { push: { branches: spec.branches?.length ? spec.branches : ["main"] }, workflow_dispatch: {} },
-    ...(options.variables && Object.keys(options.variables).length > 0 ? { env: options.variables } : {}),
+    ...(Object.keys(env).length > 0 ? { env } : {}),
     concurrency: { group: spec.name, "cancel-in-progress": false },
     permissions: { contents: "write", ...(byReview ? { "pull-requests": "read" } : {}) },
     jobsDoc,

package/src/components/generate-pipeline.test.ts

@@ -338,7 +338,7 @@ describe("generateGithubPipeline: a promote job (#2575)", () => {
 
     const promote = jobs["promote-prod"];
     expect(promote.needs).toEqual(["api", "shared-alb", "worker"]);
-    expect(promote.container).toBe("node:22-slim");
+    expect(promote.container).toBe("node:22");
     const downloads = promote.steps.filter((s) => s.uses === "actions/download-artifact@v4");
     expect(downloads.map((s) => s.with)).toEqual([
       { name: "api-archive", path: "dist/images" },

package/src/components/generate-pipeline.ts

@@ -282,7 +282,7 @@ function toJobName(componentName: string): string {
   return componentName.replace(/([a-z0-9])([A-Z])/g, "$1-$2").toLowerCase();
 }
 
-const DEFAULT_IMAGE = "node:22-slim";
+const DEFAULT_IMAGE = "node:22";
 
 /** The file a producer dumps its resolved outputs to, and a dependent seeds from — one per component, matching gitlab's naming so both generators produce interchangeable artifacts. */
 function outputsFile(name: string): string {

package/src/composites/pr-plan-report.test.ts

@@ -20,7 +20,7 @@ import type { SerializerResult } from "@intentius/chant/serializer";
  * loosely-typed instance directly.
  */
 interface StepLike {
-  props: { name?: string; run?: string };
+  props: { name?: string; run?: string; env?: Record<string, string> };
 }
 interface JobLike {
   props: {
@@ -125,6 +125,19 @@ describe("PrPlanReport composite (#1983)", () => {
     expect(run).not.toMatch(/gh api[^\n]*"repos\//);
   });
 
+  // #2352: `gh` sends GH_TOKEN only to github.com and ghe.com hosts. Checked
+  // against a real Forgejo 16.0.5 instance with no `gh auth login`: GH_TOKEN
+  // alone posted with no Authorization header and got 401; with
+  // GH_ENTERPRISE_TOKEN beside it the POST got 201 and a re-run PATCHed.
+  test("the post step carries the token as GH_ENTERPRISE_TOKEN too, which a non-github.com host reads (#2352)", () => {
+    const { job } = PrPlanReport({ environment: "prod" });
+    const postStep = steps(job).find((s) => s.props.name === "Post or update PR comment")!;
+    expect(postStep.props.env).toEqual({
+      GH_TOKEN: "${{ secrets.GITHUB_TOKEN }}",
+      GH_ENTERPRISE_TOKEN: "${{ secrets.GITHUB_TOKEN }}",
+    });
+  });
+
   test("the emitted workflow passes the github lexicon's own lint — no errors, pinned actions included", () => {
     const { job } = PrPlanReport({ environment: "prod", before: ["aws sts get-caller-identity"] });
     const workflow = new Workflow({

package/src/composites/pr-plan-report.ts

@@ -73,6 +73,16 @@ export interface PrPlanReportProps {
  * does not serve `/api/v3` and answered 404 for GET and POST alike. On
  * github.com and GHES the resolved URL is byte-identical to `gh`'s own
  * guess, so this changes nothing there.
+ *
+ * The step that runs it sets the token twice, as `GH_TOKEN` and as
+ * `GH_ENTERPRISE_TOKEN` (chant #2352). `gh` sends `GH_TOKEN` only to
+ * github.com and `ghe.com` hosts and reads `GH_ENTERPRISE_TOKEN` for every
+ * other host, Forgejo and GitHub Enterprise Server included. With `GH_TOKEN`
+ * alone, this script's POST to a real Forgejo 16.0.5 instance went out with
+ * no `Authorization` header and answered 401 `token is required`; with both
+ * set it answered 201, and a second run PATCHed the same comment. On
+ * github.com `GH_TOKEN` still wins, so nothing changes there. The same fix
+ * `ghCredentialEnv` made for `reconcilePr` at runtime (#2333).
  */
 const stickyCommentScript = [
   'api_base="${GITHUB_API_URL%/}"',
@@ -151,7 +161,10 @@ export const PrPlanReport = Composite((props: PrPlanReportProps) => {
       ? [
           new Step({
             name: "Post or update PR comment",
-            env: { GH_TOKEN: "${{ secrets.GITHUB_TOKEN }}" },
+            env: {
+              GH_TOKEN: "${{ secrets.GITHUB_TOKEN }}",
+              GH_ENTERPRISE_TOKEN: "${{ secrets.GITHUB_TOKEN }}",
+            },
             run: stickyCommentScript,
           }),
         ]