@intentius/chant-lexicon-github 0.124.31 → 0.124.32

package/dist/composites/checkout.js

@@ -0,0 +1,25 @@
+import { Composite, mergeDefaults } from "@intentius/chant";
+import { Step } from "../generated/index.js";
+import { actionRef } from "../action-pins.js";
+export const Checkout = Composite((props) => {
+    const { defaults } = props;
+    const withObj = {};
+    if (props.ref !== undefined)
+        withObj.ref = props.ref;
+    if (props.repository !== undefined)
+        withObj.repository = props.repository;
+    if (props.fetchDepth !== undefined)
+        withObj["fetch-depth"] = String(props.fetchDepth);
+    if (props.token !== undefined)
+        withObj.token = props.token;
+    if (props.submodules !== undefined)
+        withObj.submodules = String(props.submodules);
+    if (props.sshKey !== undefined)
+        withObj["ssh-key"] = props.sshKey;
+    const step = new Step(mergeDefaults({
+        name: "Checkout",
+        uses: actionRef("actions/checkout", props.pin),
+        ...(Object.keys(withObj).length > 0 ? { with: withObj } : {}),
+    }, defaults?.step));
+    return { step };
+}, "Checkout");

package/dist/composites/dependabot.js

@@ -0,0 +1,43 @@
+/**
+ * Dependency-update configuration (`.github/dependabot.yml`) as a chant
+ * resource, so it is emitted and lintable like workflows (#294).
+ *
+ * Two failure modes the post-synth checks target:
+ *   - an update that executes untrusted code from a freshly-pulled dependency
+ *     during the update itself (`insecure-external-code-execution: allow`), and
+ *   - a configuration with no cooldown — a version published seconds ago
+ *     (including a compromised one) is adopted before anyone can react.
+ *
+ * The `Dependabot` composite ships safe defaults: a cooldown window and an
+ * explicit deny on external code execution.
+ */
+var _a;
+import { DECLARABLE_MARKER } from "@intentius/chant/declarable";
+/** The `.github/dependabot.yml` resource. */
+export class DependabotConfig {
+    constructor(props) {
+        this[_a] = true;
+        this.lexicon = "github";
+        this.entityType = "GitHub::Dependabot::Config";
+        this.kind = "resource";
+        this.props = { version: 2, ...props };
+    }
+}
+_a = DECLARABLE_MARKER;
+/**
+ * Build a `DependabotConfig` with safe defaults: a cooldown window on every
+ * ecosystem and external code execution explicitly denied.
+ */
+export function Dependabot(props) {
+    const cooldownDays = props.cooldownDays ?? 7;
+    const limit = props.openPullRequestsLimit ?? 5;
+    const updates = props.ecosystems.map((e) => ({
+        packageEcosystem: e.packageEcosystem,
+        directory: e.directory ?? "/",
+        schedule: { interval: e.interval ?? "weekly" },
+        cooldown: { defaultDays: cooldownDays },
+        openPullRequestsLimit: limit,
+        insecureExternalCodeExecution: "deny",
+    }));
+    return new DependabotConfig({ version: 2, updates });
+}

package/dist/composites/deploy-environment.js

@@ -0,0 +1,38 @@
+import { Composite, mergeDefaults } from "@intentius/chant";
+import { Job, Step } from "../generated/index.js";
+import { actionRef } from "../action-pins.js";
+export const DeployEnvironment = Composite((props) => {
+    const { name, deployScript, cleanupScript = 'echo "Cleaning up..."', url, concurrencyGroup, cancelInProgress = true, runsOn = "ubuntu-latest", defaults, } = props;
+    const group = concurrencyGroup ?? `deploy-${name}`;
+    const deployScriptArr = Array.isArray(deployScript) ? deployScript : [deployScript];
+    const cleanupScriptArr = Array.isArray(cleanupScript) ? cleanupScript : [cleanupScript];
+    // ── Deploy job ─────────────────────────────────────────────────────
+    const deploySteps = [
+        new Step({ name: "Checkout", uses: actionRef("actions/checkout") }),
+        ...deployScriptArr.map((cmd) => new Step({ name: "Deploy", run: cmd })),
+    ];
+    const environment = { name };
+    if (url) {
+        environment.url = url;
+    }
+    const deployJob = new Job(mergeDefaults({
+        "runs-on": runsOn,
+        environment,
+        concurrency: {
+            group,
+            "cancel-in-progress": cancelInProgress,
+        },
+        steps: deploySteps,
+    }, defaults?.deployJob));
+    // ── Cleanup job ────────────────────────────────────────────────────
+    const cleanupSteps = [
+        new Step({ name: "Checkout", uses: actionRef("actions/checkout") }),
+        ...cleanupScriptArr.map((cmd) => new Step({ name: "Cleanup", run: cmd })),
+    ];
+    const cleanupJob = new Job(mergeDefaults({
+        "runs-on": runsOn,
+        environment: { name },
+        steps: cleanupSteps,
+    }, defaults?.cleanupJob));
+    return { deployJob, cleanupJob };
+}, "DeployEnvironment");

package/dist/composites/docker-build.js

@@ -0,0 +1,70 @@
+import { Composite, mergeDefaults } from "@intentius/chant";
+import { Job, Step, Workflow } from "../generated/index.js";
+import { actionRef } from "../action-pins.js";
+export const DockerBuild = Composite((props) => {
+    const { tag = "${{ github.sha }}", dockerfile = "Dockerfile", context = ".", registry = "ghcr.io", imageName = "ghcr.io/${{ github.repository }}", tagLatest = true, buildArgs, push = true, platforms, runsOn = "ubuntu-latest", defaults, } = props;
+    // ── Steps ──────────────────────────────────────────────────────────
+    const checkout = new Step({ name: "Checkout", uses: actionRef("actions/checkout") });
+    const login = new Step({
+        name: "Log in to container registry",
+        uses: "docker/login-action@v3",
+        with: {
+            registry,
+            username: "${{ github.actor }}",
+            password: "${{ secrets.GITHUB_TOKEN }}",
+        },
+    });
+    const setupBuildx = new Step({
+        name: "Set up Docker Buildx",
+        uses: "docker/setup-buildx-action@v3",
+    });
+    // Build tags for metadata action
+    const tags = [`${imageName}:${tag}`];
+    if (tagLatest) {
+        tags.push(`${imageName}:latest`);
+    }
+    const metadata = new Step({
+        name: "Extract metadata",
+        id: "meta",
+        uses: "docker/metadata-action@v5",
+        with: {
+            images: imageName,
+            tags: tags.join("\n"),
+        },
+    });
+    const buildPushWith = {
+        context,
+        file: dockerfile,
+        push: String(push),
+        tags: "${{ steps.meta.outputs.tags }}",
+        labels: "${{ steps.meta.outputs.labels }}",
+    };
+    if (platforms && platforms.length > 0) {
+        buildPushWith.platforms = platforms.join(",");
+    }
+    if (buildArgs) {
+        buildPushWith["build-args"] = Object.entries(buildArgs)
+            .map(([k, v]) => `${k}=${v}`)
+            .join("\n");
+    }
+    const buildPush = new Step({
+        name: "Build and push",
+        uses: "docker/build-push-action@v6",
+        with: buildPushWith,
+    });
+    const job = new Job(mergeDefaults({
+        "runs-on": runsOn,
+        steps: [checkout, login, setupBuildx, metadata, buildPush],
+    }, defaults?.job));
+    const workflow = new Workflow(mergeDefaults({
+        name: "Docker Build",
+        on: {
+            push: { branches: ["main"] },
+        },
+        permissions: {
+            contents: "read",
+            packages: "write",
+        },
+    }, defaults?.workflow));
+    return { workflow, job };
+}, "DockerBuild");

package/dist/composites/download-artifact.js

@@ -0,0 +1,18 @@
+import { Composite, mergeDefaults } from "@intentius/chant";
+import { Step } from "../generated/index.js";
+export const DownloadArtifact = Composite((props) => {
+    const { defaults } = props;
+    const withObj = {};
+    if (props.name !== undefined)
+        withObj.name = props.name;
+    if (props.path !== undefined)
+        withObj.path = props.path;
+    if (props.mergeMultiple !== undefined)
+        withObj["merge-multiple"] = String(props.mergeMultiple);
+    const step = new Step(mergeDefaults({
+        name: "Download Artifact",
+        uses: "actions/download-artifact@v4",
+        ...(Object.keys(withObj).length > 0 ? { with: withObj } : {}),
+    }, defaults?.step));
+    return { step };
+}, "DownloadArtifact");

package/dist/composites/go-ci.js

@@ -0,0 +1,62 @@
+import { Composite, mergeDefaults } from "@intentius/chant";
+import { Job, Step, Workflow } from "../generated/index.js";
+import { actionRef } from "../action-pins.js";
+export const GoCI = Composite((props) => {
+    const { goVersion = "1.22", testCommand = "go test ./... -v -race", buildCommand = "go build ./...", lintCommand = "golangci-lint run", runsOn = "ubuntu-latest", defaults, } = props;
+    // ── Build job ──────────────────────────────────────────────────────
+    const buildJob = new Job(mergeDefaults({
+        "runs-on": runsOn,
+        steps: [
+            new Step({ name: "Checkout", uses: actionRef("actions/checkout") }),
+            new Step({
+                name: "Setup Go",
+                uses: "actions/setup-go@v5",
+                with: { "go-version": goVersion },
+            }),
+            new Step({ name: "Build", run: buildCommand }),
+        ],
+    }, defaults?.buildJob));
+    // ── Test job ───────────────────────────────────────────────────────
+    const testJob = new Job(mergeDefaults({
+        "runs-on": runsOn,
+        steps: [
+            new Step({ name: "Checkout", uses: actionRef("actions/checkout") }),
+            new Step({
+                name: "Setup Go",
+                uses: "actions/setup-go@v5",
+                with: { "go-version": goVersion },
+            }),
+            new Step({ name: "Test", run: testCommand }),
+        ],
+    }, defaults?.testJob));
+    // ── Lint job (optional) ────────────────────────────────────────────
+    const lintJob = lintCommand !== null
+        ? new Job(mergeDefaults({
+            "runs-on": runsOn,
+            steps: [
+                new Step({ name: "Checkout", uses: actionRef("actions/checkout") }),
+                new Step({
+                    name: "Setup Go",
+                    uses: "actions/setup-go@v5",
+                    with: { "go-version": goVersion },
+                }),
+                new Step({
+                    name: "Lint",
+                    uses: "golangci/golangci-lint-action@v6",
+                    with: { args: lintCommand },
+                }),
+            ],
+        }, defaults?.lintJob))
+        : undefined;
+    const workflow = new Workflow(mergeDefaults({
+        name: "Go CI",
+        on: {
+            push: { branches: ["main"] },
+            pull_request: { branches: ["main"] },
+        },
+    }, defaults?.workflow));
+    if (lintJob) {
+        return { workflow, buildJob, testJob, lintJob };
+    }
+    return { workflow, buildJob, testJob };
+}, "GoCI");

package/dist/composites/index.js

@@ -0,0 +1,15 @@
+export { Checkout } from "./checkout.js";
+export { SetupNode } from "./setup-node.js";
+export { SetupGo } from "./setup-go.js";
+export { SetupPython } from "./setup-python.js";
+export { CacheAction } from "./cache.js";
+export { UploadArtifact } from "./upload-artifact.js";
+export { DownloadArtifact } from "./download-artifact.js";
+export { NodeCI } from "./node-ci.js";
+export { NodePipeline, BunPipeline, PnpmPipeline, YarnPipeline } from "./node-pipeline.js";
+export { PythonCI } from "./python-ci.js";
+export { DockerBuild } from "./docker-build.js";
+export { DeployEnvironment } from "./deploy-environment.js";
+export { GoCI } from "./go-ci.js";
+export { Dependabot, DependabotConfig } from "./dependabot.js";
+export { PrPlanReport } from "./pr-plan-report.js";

package/dist/composites/node-ci.js

@@ -0,0 +1,44 @@
+import { Composite, mergeDefaults } from "@intentius/chant";
+import { Job, Step, Workflow } from "../generated/index.js";
+import { actionRef } from "../action-pins.js";
+export const NodeCI = Composite((props) => {
+    const { nodeVersion = "22", packageManager = "npm", buildScript = "build", testScript = "test", installCommand, defaults, } = props;
+    const install = installCommand ?? (packageManager === "npm" ? "npm ci" : `${packageManager} install`);
+    const run = packageManager === "npm" ? "npm run" : packageManager;
+    const checkoutStep = new Step({
+        name: "Checkout",
+        uses: actionRef("actions/checkout"),
+    });
+    const setupNodeStep = new Step({
+        name: "Setup Node.js",
+        uses: actionRef("actions/setup-node"),
+        with: {
+            "node-version": nodeVersion,
+            cache: packageManager === "bun" ? undefined : packageManager,
+        },
+    });
+    const installStep = new Step({
+        name: "Install dependencies",
+        run: install,
+    });
+    const buildStep = new Step({
+        name: "Build",
+        run: `${run} ${buildScript}`,
+    });
+    const testStep = new Step({
+        name: "Test",
+        run: `${run} ${testScript}`,
+    });
+    const job = new Job(mergeDefaults({
+        "runs-on": "ubuntu-latest",
+        steps: [checkoutStep, setupNodeStep, installStep, buildStep, testStep],
+    }, defaults?.job));
+    const workflow = new Workflow(mergeDefaults({
+        name: "CI",
+        on: {
+            push: { branches: ["main"] },
+            pull_request: { branches: ["main"] },
+        },
+    }, defaults?.workflow));
+    return { workflow, job };
+}, "NodeCI");

package/dist/composites/node-pipeline.js

@@ -0,0 +1,96 @@
+import { Composite, withDefaults, mergeDefaults } from "@intentius/chant";
+import { Job, Step, Workflow } from "../generated/index.js";
+import { actionRef } from "../action-pins.js";
+const cacheConfig = {
+    npm: {
+        cache: "npm",
+        installCmd: "npm ci",
+        runPrefix: "npm run",
+        setupAction: actionRef("actions/setup-node"),
+    },
+    pnpm: {
+        cache: "pnpm",
+        installCmd: "pnpm install --frozen-lockfile",
+        runPrefix: "pnpm run",
+        setupAction: actionRef("actions/setup-node"),
+    },
+    yarn: {
+        cache: "yarn",
+        installCmd: "yarn install --frozen-lockfile",
+        runPrefix: "yarn",
+        setupAction: actionRef("actions/setup-node"),
+    },
+    bun: {
+        cache: undefined,
+        installCmd: "bun install --frozen-lockfile",
+        runPrefix: "bun run",
+        setupAction: "oven-sh/setup-bun@v2",
+    },
+};
+export const NodePipeline = Composite((props) => {
+    const { nodeVersion = "22", packageManager = "npm", buildScript = "build", testScript = "test", installCommand, buildArtifactPaths = ["dist/"], artifactName = "build-output", artifactRetentionDays = 1, runsOn = "ubuntu-latest", defaults, } = props;
+    const pm = cacheConfig[packageManager];
+    const install = installCommand ?? pm.installCmd;
+    const run = pm.runPrefix;
+    const isBun = packageManager === "bun";
+    // ── Build job steps ────────────────────────────────────────────────
+    const buildCheckout = new Step({ name: "Checkout", uses: actionRef("actions/checkout") });
+    const buildSetup = isBun
+        ? new Step({ name: "Setup Bun", uses: "oven-sh/setup-bun@v2" })
+        : new Step({
+            name: "Setup Node.js",
+            uses: actionRef("actions/setup-node"),
+            with: { "node-version": nodeVersion, cache: pm.cache },
+        });
+    const buildInstall = new Step({ name: "Install dependencies", run: install });
+    const buildRun = new Step({ name: "Build", run: `${run} ${buildScript}` });
+    const buildUpload = new Step({
+        name: "Upload build artifacts",
+        uses: "actions/upload-artifact@v4",
+        with: {
+            name: artifactName,
+            path: buildArtifactPaths.join("\n"),
+            "retention-days": String(artifactRetentionDays),
+        },
+    });
+    const buildJob = new Job(mergeDefaults({
+        "runs-on": runsOn,
+        steps: [buildCheckout, buildSetup, buildInstall, buildRun, buildUpload],
+    }, defaults?.buildJob));
+    // ── Test job steps ─────────────────────────────────────────────────
+    const testCheckout = new Step({ name: "Checkout", uses: actionRef("actions/checkout") });
+    const testSetup = isBun
+        ? new Step({ name: "Setup Bun", uses: "oven-sh/setup-bun@v2" })
+        : new Step({
+            name: "Setup Node.js",
+            uses: actionRef("actions/setup-node"),
+            with: { "node-version": nodeVersion, cache: pm.cache },
+        });
+    const testInstall = new Step({ name: "Install dependencies", run: install });
+    const testDownload = new Step({
+        name: "Download build artifacts",
+        uses: "actions/download-artifact@v4",
+        with: { name: artifactName },
+    });
+    const testRun = new Step({ name: "Test", run: `${run} ${testScript}` });
+    const testJob = new Job(mergeDefaults({
+        "runs-on": runsOn,
+        needs: ["build"],
+        steps: [testCheckout, testSetup, testInstall, testDownload, testRun],
+    }, defaults?.testJob));
+    // ── Workflow ───────────────────────────────────────────────────────
+    const workflow = new Workflow(mergeDefaults({
+        name: "Node Pipeline",
+        on: {
+            push: { branches: ["main"] },
+            pull_request: { branches: ["main"] },
+        },
+    }, defaults?.workflow));
+    return { workflow, buildJob, testJob };
+}, "NodePipeline");
+/** NodePipeline preset for Bun projects. */
+export const BunPipeline = withDefaults(NodePipeline, { packageManager: "bun" });
+/** NodePipeline preset for pnpm projects. */
+export const PnpmPipeline = withDefaults(NodePipeline, { packageManager: "pnpm" });
+/** NodePipeline preset for Yarn projects. */
+export const YarnPipeline = withDefaults(NodePipeline, { packageManager: "yarn" });

package/dist/composites/pr-plan-report.js

@@ -0,0 +1,129 @@
+import { Composite, mergeDefaults } from "@intentius/chant";
+import { Job, Step, Permissions } from "../generated/index.js";
+import { Checkout } from "./checkout.js";
+import { SetupNode } from "./setup-node.js";
+/**
+ * Sticky-comment script (#1223's mechanism), find the comment whose body
+ * starts with `$MARKER`, PATCH it if found, POST otherwise. No marketplace
+ * action, nothing extra to pin — `gh` ships on GitHub's hosted runners. The
+ * flag is `-F`, not `-f`: `gh api`'s `-F/--field` is the typed form that
+ * reads the value from a file when it starts with `@`, while `-f/--raw-field`
+ * adds the parameter as a literal string, so the `-f` form posted the eight
+ * characters `@plan.md` (#2236). Reading the body from the file the plan step
+ * wrote means a large or multi-line plan never has to survive shell quoting.
+ * `-F`'s type coercion of `true`/`false`/`null`/integers does not reach the
+ * body: gh resolves the leading `@` first and hands back the file's bytes as
+ * a string.
+ *
+ * `$api_base` (chant #2305) is `$GITHUB_API_URL` with any trailing slash
+ * trimmed, falling back to `https://api.github.com` when it is unset —
+ * `$GITHUB_API_URL` is already correct on every GitHub Actions and Forgejo
+ * Actions job (`https://api.github.com` on github.com, `<host>/api/v3` on
+ * GitHub Enterprise Server, `<host>/api/v1` on Forgejo), the same fact
+ * `githubApiBaseFrom` in `packages/core/src/op/activities/reconcile.ts`
+ * builds on for `reconcilePr`'s `postOrUpdateComment` (#2291). This script
+ * cannot import that helper — it is a shell string emitted into YAML, not a
+ * TypeScript call — so the equivalent base-URL construction is inlined here
+ * instead. Without it, every `gh api` call below took a bare relative path,
+ * which `gh` resolves against `/api/v3` for any host but github.com; that
+ * guess is right for GitHub Enterprise Server but wrong for Forgejo, which
+ * does not serve `/api/v3` and answered 404 for GET and POST alike. On
+ * github.com and GHES the resolved URL is byte-identical to `gh`'s own
+ * guess, so this changes nothing there.
+ *
+ * The step that runs it sets the token twice, as `GH_TOKEN` and as
+ * `GH_ENTERPRISE_TOKEN` (chant #2352). `gh` sends `GH_TOKEN` only to
+ * github.com and `ghe.com` hosts and reads `GH_ENTERPRISE_TOKEN` for every
+ * other host, Forgejo and GitHub Enterprise Server included. With `GH_TOKEN`
+ * alone, this script's POST to a real Forgejo 16.0.5 instance went out with
+ * no `Authorization` header and answered 401 `token is required`; with both
+ * set it answered 201, and a second run PATCHed the same comment. On
+ * github.com `GH_TOKEN` still wins, so nothing changes there. The same fix
+ * `ghCredentialEnv` made for `reconcilePr` at runtime (#2333).
+ */
+const stickyCommentScript = [
+    'api_base="${GITHUB_API_URL%/}"',
+    'api_base="${api_base:-https://api.github.com}"',
+    'comment_id=$(gh api "$api_base/repos/$REPO/issues/$PR_NUMBER/comments" --paginate ' +
+        '--jq "map(select(.body | startswith(\\"$MARKER\\"))) | .[0].id // empty")',
+    'if [ -n "$comment_id" ]; then',
+    '  gh api -X PATCH "$api_base/repos/$REPO/issues/comments/$comment_id" -F body=@plan.md > /dev/null',
+    "else",
+    '  gh api -X POST "$api_base/repos/$REPO/issues/$PR_NUMBER/comments" -F body=@plan.md > /dev/null',
+    "fi",
+].join("\n");
+/**
+ * A CI job that builds, plans, and posts `chant lifecycle plan --report
+ * markdown` as a sticky PR comment (#1983) — the compiled diff reaches the
+ * reviewer without being asked for.
+ *
+ * A sibling of the gitlab lexicon's `MrPlanReport`, but where GitLab renders
+ * a native merge-request widget from a counts artifact, GitHub has no such
+ * widget: the mechanism is the sticky-comment recipe `examples/github-pr-preview`
+ * proved (#1223), reused here rather than reinvented. The forgejo lexicon
+ * inherits this composite through its github re-export, since Forgejo Actions
+ * runs the same workflow shape and the Forgejo API accepts the same `gh api`
+ * calls against its GitHub-compatible surface — once they target a full URL
+ * rather than a bare relative path, which `stickyCommentScript` now does
+ * (#2305, the same fix #2291 made for `reconcilePr`'s `postOrUpdateComment`).
+ *
+ * Only meaningful on a `pull_request`-triggered workflow — the job guards on
+ * `github.event_name` since the comment targets `github.event.number`, which
+ * a push-triggered run does not have. The plan reads the live system, so wire
+ * cloud credentials via `before` or CI variables.
+ */
+export const PrPlanReport = Composite((props) => {
+    const { environment, lexicon, ownedOnly = false, runsOn = "ubuntu-latest", nodeVersion = "22", installCommand = "npm ci", before, postComment = true, marker = `<!-- chant-pr-plan-report:${environment} -->`, defaults: defs, } = props;
+    const planArgs = [
+        "lifecycle",
+        "plan",
+        environment,
+        ...(lexicon ? [lexicon] : []),
+        ...(ownedOnly ? ["--owned"] : []),
+        "--report",
+        "markdown",
+    ].join(" ");
+    const steps = [
+        Checkout({}).step,
+        SetupNode({ nodeVersion, cache: "npm" }).step,
+        new Step({ name: "Install", run: installCommand }),
+        ...(before ?? []).map((cmd) => new Step({ name: "Live credentials", run: cmd })),
+        new Step({ name: "Build", run: "npx chant build" }),
+        new Step({
+            name: `Plan ${environment}`,
+            // The marker (and an "updated for" footer, same spirit as the preview
+            // tutorial's) is prepended to the rendered plan before anything is
+            // posted, so the comment body itself carries the identity the search
+            // step below keys on.
+            run: [
+                `npx chant ${planArgs} > plan-body.md`,
+                '{ printf \'%s\\n\\n\' "$MARKER"; printf \'_Updated for %s._\\n\\n\' "$HEAD_SHA"; cat plan-body.md; } > plan.md',
+            ].join("\n"),
+        }),
+        ...(postComment
+            ? [
+                new Step({
+                    name: "Post or update PR comment",
+                    env: {
+                        GH_TOKEN: "${{ secrets.GITHUB_TOKEN }}",
+                        GH_ENTERPRISE_TOKEN: "${{ secrets.GITHUB_TOKEN }}",
+                    },
+                    run: stickyCommentScript,
+                }),
+            ]
+            : []),
+    ];
+    const job = new Job(mergeDefaults({
+        "runs-on": runsOn,
+        if: "github.event_name == 'pull_request'",
+        permissions: new Permissions({ contents: "read", "pull-requests": "write" }),
+        env: {
+            MARKER: marker,
+            HEAD_SHA: "${{ github.event.pull_request.head.sha }}",
+            PR_NUMBER: "${{ github.event.number }}",
+            REPO: "${{ github.repository }}",
+        },
+        steps,
+    }, defs?.job));
+    return { job };
+}, "PrPlanReport");

package/dist/composites/python-ci.js

@@ -0,0 +1,60 @@
+import { Composite, mergeDefaults } from "@intentius/chant";
+import { Job, Step, Workflow } from "../generated/index.js";
+import { actionRef } from "../action-pins.js";
+export const PythonCI = Composite((props) => {
+    const { pythonVersion = "3.12", testCommand = "pytest --junitxml=report.xml --cov", lintCommand = "ruff check .", requirementsFile = "requirements.txt", usePoetry = false, runsOn = "ubuntu-latest", defaults, } = props;
+    const cacheType = usePoetry ? "poetry" : "pip";
+    const installSteps = usePoetry
+        ? [
+            new Step({ name: "Install Poetry", run: "pip install poetry" }),
+            new Step({ name: "Install dependencies", run: "poetry install" }),
+        ]
+        : [
+            new Step({ name: "Install dependencies", run: `pip install -r ${requirementsFile}` }),
+        ];
+    // ── Test job ───────────────────────────────────────────────────────
+    const testJob = new Job(mergeDefaults({
+        "runs-on": runsOn,
+        steps: [
+            new Step({ name: "Checkout", uses: actionRef("actions/checkout") }),
+            new Step({
+                name: "Setup Python",
+                uses: "actions/setup-python@v5",
+                with: { "python-version": pythonVersion, cache: cacheType },
+            }),
+            ...installSteps,
+            new Step({ name: "Test", run: testCommand }),
+        ],
+    }, defaults?.testJob));
+    // ── Lint job (optional) ────────────────────────────────────────────
+    const lintJob = lintCommand !== null
+        ? new Job(mergeDefaults({
+            "runs-on": runsOn,
+            steps: [
+                new Step({ name: "Checkout", uses: actionRef("actions/checkout") }),
+                new Step({
+                    name: "Setup Python",
+                    uses: "actions/setup-python@v5",
+                    with: { "python-version": pythonVersion, cache: cacheType },
+                }),
+                ...installSteps.map((s) => {
+                    // Create fresh step instances for the lint job
+                    return new Step({ name: s.props.name, run: s.props.run });
+                }),
+                new Step({ name: "Lint", run: lintCommand }),
+            ],
+        }, defaults?.lintJob))
+        : undefined;
+    // ── Workflow ───────────────────────────────────────────────────────
+    const workflow = new Workflow(mergeDefaults({
+        name: "Python CI",
+        on: {
+            push: { branches: ["main"] },
+            pull_request: { branches: ["main"] },
+        },
+    }, defaults?.workflow));
+    if (lintJob) {
+        return { workflow, testJob, lintJob };
+    }
+    return { workflow, testJob };
+}, "PythonCI");

package/dist/composites/setup-go.js

@@ -0,0 +1,18 @@
+import { Composite, mergeDefaults } from "@intentius/chant";
+import { Step } from "../generated/index.js";
+export const SetupGo = Composite((props) => {
+    const { defaults } = props;
+    const withObj = {};
+    if (props.goVersion !== undefined)
+        withObj["go-version"] = props.goVersion;
+    if (props.goVersionFile !== undefined)
+        withObj["go-version-file"] = props.goVersionFile;
+    if (props.cache !== undefined)
+        withObj.cache = String(props.cache);
+    const step = new Step(mergeDefaults({
+        name: "Setup Go",
+        uses: "actions/setup-go@v5",
+        ...(Object.keys(withObj).length > 0 ? { with: withObj } : {}),
+    }, defaults?.step));
+    return { step };
+}, "SetupGo");

package/dist/composites/setup-node.js

@@ -0,0 +1,21 @@
+import { Composite, mergeDefaults } from "@intentius/chant";
+import { Step } from "../generated/index.js";
+import { actionRef } from "../action-pins.js";
+export const SetupNode = Composite((props) => {
+    const { defaults } = props;
+    const withObj = {};
+    if (props.nodeVersion !== undefined)
+        withObj["node-version"] = props.nodeVersion;
+    if (props.registryUrl !== undefined)
+        withObj["registry-url"] = props.registryUrl;
+    if (props.cache !== undefined)
+        withObj.cache = props.cache;
+    if (props.cacheFilePath !== undefined)
+        withObj["cache-dependency-path"] = props.cacheFilePath;
+    const step = new Step(mergeDefaults({
+        name: "Setup Node.js",
+        uses: actionRef("actions/setup-node", props.pin),
+        ...(Object.keys(withObj).length > 0 ? { with: withObj } : {}),
+    }, defaults?.step));
+    return { step };
+}, "SetupNode");