@intentius/chant-lexicon-github 0.124.31 → 0.124.33

package/dist/variables.js

@@ -0,0 +1,41 @@
+/**
+ * GitHub Actions predefined context variable references.
+ *
+ * These provide type-safe access to GitHub and Runner context values
+ * that expand to `${{ context.property }}` expressions in YAML.
+ */
+import { Expression } from "./expression.js";
+export const GitHub = {
+    Ref: /* @__PURE__ */ new Expression("github.ref"),
+    RefName: /* @__PURE__ */ new Expression("github.ref_name"),
+    RefType: /* @__PURE__ */ new Expression("github.ref_type"),
+    Sha: /* @__PURE__ */ new Expression("github.sha"),
+    Actor: /* @__PURE__ */ new Expression("github.actor"),
+    TriggeringActor: /* @__PURE__ */ new Expression("github.triggering_actor"),
+    Repository: /* @__PURE__ */ new Expression("github.repository"),
+    RepositoryOwner: /* @__PURE__ */ new Expression("github.repository_owner"),
+    EventName: /* @__PURE__ */ new Expression("github.event_name"),
+    Event: /* @__PURE__ */ new Expression("github.event"),
+    RunId: /* @__PURE__ */ new Expression("github.run_id"),
+    RunNumber: /* @__PURE__ */ new Expression("github.run_number"),
+    RunAttempt: /* @__PURE__ */ new Expression("github.run_attempt"),
+    Workflow: /* @__PURE__ */ new Expression("github.workflow"),
+    WorkflowRef: /* @__PURE__ */ new Expression("github.workflow_ref"),
+    Workspace: /* @__PURE__ */ new Expression("github.workspace"),
+    Token: /* @__PURE__ */ new Expression("github.token"),
+    Job: /* @__PURE__ */ new Expression("github.job"),
+    HeadRef: /* @__PURE__ */ new Expression("github.head_ref"),
+    BaseRef: /* @__PURE__ */ new Expression("github.base_ref"),
+    ServerUrl: /* @__PURE__ */ new Expression("github.server_url"),
+    ApiUrl: /* @__PURE__ */ new Expression("github.api_url"),
+    GraphqlUrl: /* @__PURE__ */ new Expression("github.graphql_url"),
+    Action: /* @__PURE__ */ new Expression("github.action"),
+    ActionPath: /* @__PURE__ */ new Expression("github.action_path"),
+};
+export const Runner = {
+    Os: /* @__PURE__ */ new Expression("runner.os"),
+    Arch: /* @__PURE__ */ new Expression("runner.arch"),
+    Name: /* @__PURE__ */ new Expression("runner.name"),
+    Temp: /* @__PURE__ */ new Expression("runner.temp"),
+    ToolCache: /* @__PURE__ */ new Expression("runner.tool_cache"),
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-github",
-  "version": "0.124.31",
+  "version": "0.124.33",
   "description": "GitHub Actions lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -32,17 +32,17 @@
     ".": {
       "development": "./src/index.ts",
       "types": "./dist/index.d.ts",
-      "default": "./src/index.ts"
+      "default": "./dist/index.js"
     },
     "./*": {
       "development": "./src/*.ts",
       "types": "./dist/*.d.ts",
-      "default": "./src/*.ts"
+      "default": "./dist/*.js"
     },
     "./lint/post-synth": {
       "development": "./src/lint/post-synth/index.ts",
       "types": "./dist/lint/post-synth/index.d.ts",
-      "default": "./src/lint/post-synth/index.ts"
+      "default": "./dist/lint/post-synth/index.js"
     },
     "./manifest": "./dist/manifest.json",
     "./meta": "./dist/meta.json",
@@ -54,13 +54,13 @@
     "validate": "tsx src/validate-cli.ts",
     "docs": "tsx src/codegen/docs-cli.ts",
     "prepack": "npm run generate && npm run bundle && npm run validate && npm run build",
-    "build": "../../scripts/tsc7.sh -p tsconfig.build.json && tsc-alias -p tsconfig.build.json && find dist -type f \\( -name \"*.js\" -o -name \"*.js.map\" \\) -delete"
+    "build": "../../scripts/tsc7.sh -p tsconfig.build.json --sourceMap false && tsc-alias -p tsconfig.build.json"
   },
   "devDependencies": {
     "@intentius/chant": "*",
     "typescript": "^5.9.3"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.124.31"
+    "@intentius/chant": "^0.124.33"
   }
 }

package/src/codegen/package.ts

@@ -5,7 +5,7 @@
 import { readFileSync } from "fs";
 import { githubPlugin } from "../plugin";
 import { join, dirname } from "path";
-import { fileURLToPath } from "url";
+import { moduleSourceDir } from "@intentius/chant/module-source";
 import type { IntrinsicDef } from "@intentius/chant/lexicon";
 import {
   packagePipeline,
@@ -17,7 +17,7 @@ import { generate } from "./generate";
 
 export type { PackageOptions, PackageResult };
 
-const pkgDir = dirname(dirname(fileURLToPath(import.meta.url)));
+const pkgDir = dirname(moduleSourceDir(import.meta.url));
 
 /**
  * Package the GitHub Actions lexicon into a distributable BundleSpec.

package/src/components/__fixtures__/pr-loop-build.github.golden.yml

@@ -34,7 +34,8 @@ jobs:
           BASE_SHA: '${{ github.event.pull_request.base.sha }}'
           PR_NUMBER: '${{ github.event.pull_request.number }}'
           GITHUB_TOKEN: '${{ github.token }}'
-        run: chant components pr-plan --base "$BASE_SHA" --pr "$PR_NUMBER" --env prod --gate pr-apply --output .chant/pr --forge github
+          CHANT_RUNNER_KEY: '${{ secrets.CHANT_RUNNER_KEY }}'
+        run: chant ci run plan --in-place --no-push --base "$BASE_SHA" --pr "$PR_NUMBER" --env prod --gate pr-apply --forge github
       - name: Keep the plan report
         if: always()
         uses: actions/upload-artifact@v4
@@ -73,7 +74,10 @@ jobs:
         env:
           BASE_SHA: '${{ github.event.before }}'
           GITHUB_TOKEN: '${{ github.token }}'
-        run: chant components pr-apply --base "$BASE_SHA" --env prod --gate pr-apply --output .chant/pr --forge github --require-review --resume .chant/pr-resume/pr-apply.json
+          CHANT_RUNNER_KEY: '${{ secrets.CHANT_RUNNER_KEY }}'
+        run: |
+          if [ -z "$BASE_SHA" ] || [ "$BASE_SHA" = "0000000000000000000000000000000000000000" ]; then git fetch origin "main" && BASE_SHA="$(git merge-base FETCH_HEAD "$GITHUB_SHA")"; if [ "$BASE_SHA" = "$GITHUB_SHA" ]; then BASE_SHA="$(git rev-parse --verify --quiet "$GITHUB_SHA^" || echo 4b825dc642cb6eb9a060e54bf8d69288fbee4904)"; fi; fi; export BASE_SHA
+          chant ci run apply --in-place --base "$BASE_SHA" --env prod --gate pr-apply --forge github
       - name: Keep the record for a re-run
         if: always()
         uses: actions/cache/save@v4

package/src/components/__fixtures__/pr-loop-record.github.golden.yml

@@ -0,0 +1,74 @@
+name: chant-pr-prod
+
+on:
+  pull_request:
+    branches:
+      - main
+  push:
+    branches:
+      - main
+
+env:
+  CHANT_ENV: prod
+
+jobs:
+  plan:
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    container: node:22
+    permissions:
+      contents: read
+      pull-requests: write
+      statuses: write
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+      - run: command -v tofu >/dev/null 2>&1 || (curl -fsSL https://get.opentofu.org/install-opentofu.sh -o /tmp/install-opentofu.sh && sh /tmp/install-opentofu.sh --install-method standalone)
+      - name: Plan the members this pull request reaches
+        env:
+          BASE_SHA: '${{ github.event.pull_request.base.sha }}'
+          PR_NUMBER: '${{ github.event.pull_request.number }}'
+          GITHUB_TOKEN: '${{ github.token }}'
+          CHANT_RUNNER_KEY: '${{ secrets.CHANT_RUNNER_KEY }}'
+        run: chant ci run plan --in-place --no-push --base "$BASE_SHA" --pr "$PR_NUMBER" --env prod --gate pr-apply --forge github
+      - name: Keep the plan report
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: chant-pr-plan
+          path: .chant/pr
+          if-no-files-found: ignore
+          include-hidden-files: true
+  record:
+    if: github.event_name == 'push'
+    runs-on: ubuntu-latest
+    container: node:22
+    concurrency:
+      group: chant-record-prod
+      cancel-in-progress: false
+    permissions:
+      contents: write
+      pull-requests: write
+      statuses: write
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+      - run: command -v tofu >/dev/null 2>&1 || (curl -fsSL https://get.opentofu.org/install-opentofu.sh -o /tmp/install-opentofu.sh && sh /tmp/install-opentofu.sh --install-method standalone)
+      - name: Record the plan on the merged commit; nothing applies
+        env:
+          BASE_SHA: '${{ github.event.before }}'
+          GITHUB_TOKEN: '${{ github.token }}'
+          CHANT_RUNNER_KEY: '${{ secrets.CHANT_RUNNER_KEY }}'
+        run: |
+          if [ -z "$BASE_SHA" ] || [ "$BASE_SHA" = "0000000000000000000000000000000000000000" ]; then git fetch origin "main" && BASE_SHA="$(git merge-base FETCH_HEAD "$GITHUB_SHA")"; if [ "$BASE_SHA" = "$GITHUB_SHA" ]; then BASE_SHA="$(git rev-parse --verify --quiet "$GITHUB_SHA^" || echo 4b825dc642cb6eb9a060e54bf8d69288fbee4904)"; fi; fi; export BASE_SHA
+          chant ci run record --in-place --base "$BASE_SHA" --env prod --gate pr-apply --forge github
+      - name: Keep the record report
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: chant-pr-record
+          path: .chant/pr
+          if-no-files-found: ignore
+          include-hidden-files: true

package/src/components/__fixtures__/pr-loop-waves.github.golden.yml

@@ -0,0 +1,178 @@
+name: chant-pr-prod
+
+on:
+  pull_request:
+    branches:
+      - main
+  push:
+    branches:
+      - main
+
+env:
+  CHANT_ENV: prod
+
+jobs:
+  plan:
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    container: node:22
+    permissions:
+      contents: read
+      pull-requests: write
+      statuses: write
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+      - run: command -v tofu >/dev/null 2>&1 || (curl -fsSL https://get.opentofu.org/install-opentofu.sh -o /tmp/install-opentofu.sh && sh /tmp/install-opentofu.sh --install-method standalone)
+      - name: Plan the members this pull request reaches
+        env:
+          BASE_SHA: '${{ github.event.pull_request.base.sha }}'
+          PR_NUMBER: '${{ github.event.pull_request.number }}'
+          GITHUB_TOKEN: '${{ github.token }}'
+          CHANT_RUNNER_KEY: '${{ secrets.CHANT_RUNNER_KEY }}'
+        run: chant ci run plan --in-place --no-push --base "$BASE_SHA" --pr "$PR_NUMBER" --env prod --gate pr-apply --forge github --wave-gate release
+      - name: Keep the plan report
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: chant-pr-plan
+          path: .chant/pr
+          if-no-files-found: ignore
+          include-hidden-files: true
+  apply-wave-1:
+    if: github.event_name == 'push'
+    runs-on: ubuntu-latest
+    container: node:22
+    concurrency:
+      group: chant-apply-prod
+      cancel-in-progress: false
+    permissions:
+      contents: write
+      pull-requests: write
+      statuses: write
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+      - run: command -v tofu >/dev/null 2>&1 || (curl -fsSL https://get.opentofu.org/install-opentofu.sh -o /tmp/install-opentofu.sh && sh /tmp/install-opentofu.sh --install-method standalone)
+      - name: Restore the newest record of this commit's apply
+        uses: actions/cache/restore@v4
+        with:
+          path: .chant/pr-resume/pr-apply.json
+          key: chant-apply-prod-${{ github.sha }}-${{ github.run_id }}-${{ github.run_attempt }}-wave-1
+          restore-keys: chant-apply-prod-${{ github.sha }}-
+      - name: Apply wave 1, under the approval its plan has
+        env:
+          BASE_SHA: '${{ github.event.before }}'
+          GITHUB_TOKEN: '${{ github.token }}'
+          CHANT_RUNNER_KEY: '${{ secrets.CHANT_RUNNER_KEY }}'
+        run: |
+          if [ -z "$BASE_SHA" ] || [ "$BASE_SHA" = "0000000000000000000000000000000000000000" ]; then git fetch origin "main" && BASE_SHA="$(git merge-base FETCH_HEAD "$GITHUB_SHA")"; if [ "$BASE_SHA" = "$GITHUB_SHA" ]; then BASE_SHA="$(git rev-parse --verify --quiet "$GITHUB_SHA^" || echo 4b825dc642cb6eb9a060e54bf8d69288fbee4904)"; fi; fi; export BASE_SHA
+          chant ci run apply --in-place --base "$BASE_SHA" --env prod --gate pr-apply --forge github --wave-gate release --wave 1
+      - name: Keep the record for the next wave and a re-run
+        if: always()
+        uses: actions/cache/save@v4
+        with:
+          path: .chant/pr-resume/pr-apply.json
+          key: chant-apply-prod-${{ github.sha }}-${{ github.run_id }}-${{ github.run_attempt }}-wave-1
+      - name: Keep the wave 1 apply report
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: chant-pr-apply-wave-1
+          path: .chant/pr
+          if-no-files-found: ignore
+          include-hidden-files: true
+  apply-wave-2:
+    if: github.event_name == 'push'
+    runs-on: ubuntu-latest
+    needs:
+      - apply-wave-1
+    container: node:22
+    concurrency:
+      group: chant-apply-prod
+      cancel-in-progress: false
+    permissions:
+      contents: write
+      pull-requests: write
+      statuses: write
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+      - run: command -v tofu >/dev/null 2>&1 || (curl -fsSL https://get.opentofu.org/install-opentofu.sh -o /tmp/install-opentofu.sh && sh /tmp/install-opentofu.sh --install-method standalone)
+      - name: Restore the newest record of this commit's apply
+        uses: actions/cache/restore@v4
+        with:
+          path: .chant/pr-resume/pr-apply.json
+          key: chant-apply-prod-${{ github.sha }}-${{ github.run_id }}-${{ github.run_attempt }}-wave-2
+          restore-keys: chant-apply-prod-${{ github.sha }}-
+      - name: Apply wave 2, under the approval its plan has
+        env:
+          BASE_SHA: '${{ github.event.before }}'
+          GITHUB_TOKEN: '${{ github.token }}'
+          CHANT_RUNNER_KEY: '${{ secrets.CHANT_RUNNER_KEY }}'
+        run: |
+          if [ -z "$BASE_SHA" ] || [ "$BASE_SHA" = "0000000000000000000000000000000000000000" ]; then git fetch origin "main" && BASE_SHA="$(git merge-base FETCH_HEAD "$GITHUB_SHA")"; if [ "$BASE_SHA" = "$GITHUB_SHA" ]; then BASE_SHA="$(git rev-parse --verify --quiet "$GITHUB_SHA^" || echo 4b825dc642cb6eb9a060e54bf8d69288fbee4904)"; fi; fi; export BASE_SHA
+          chant ci run apply --in-place --base "$BASE_SHA" --env prod --gate pr-apply --forge github --wave-gate release --wave 2
+      - name: Keep the record for the next wave and a re-run
+        if: always()
+        uses: actions/cache/save@v4
+        with:
+          path: .chant/pr-resume/pr-apply.json
+          key: chant-apply-prod-${{ github.sha }}-${{ github.run_id }}-${{ github.run_attempt }}-wave-2
+      - name: Keep the wave 2 apply report
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: chant-pr-apply-wave-2
+          path: .chant/pr
+          if-no-files-found: ignore
+          include-hidden-files: true
+  apply-wave-3:
+    if: github.event_name == 'push'
+    runs-on: ubuntu-latest
+    needs:
+      - apply-wave-2
+    container: node:22
+    concurrency:
+      group: chant-apply-prod
+      cancel-in-progress: false
+    permissions:
+      contents: write
+      pull-requests: write
+      statuses: write
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+      - run: command -v tofu >/dev/null 2>&1 || (curl -fsSL https://get.opentofu.org/install-opentofu.sh -o /tmp/install-opentofu.sh && sh /tmp/install-opentofu.sh --install-method standalone)
+      - name: Restore the newest record of this commit's apply
+        uses: actions/cache/restore@v4
+        with:
+          path: .chant/pr-resume/pr-apply.json
+          key: chant-apply-prod-${{ github.sha }}-${{ github.run_id }}-${{ github.run_attempt }}-wave-3
+          restore-keys: chant-apply-prod-${{ github.sha }}-
+      - name: Apply wave 3, under the approval its plan has
+        env:
+          BASE_SHA: '${{ github.event.before }}'
+          GITHUB_TOKEN: '${{ github.token }}'
+          CHANT_RUNNER_KEY: '${{ secrets.CHANT_RUNNER_KEY }}'
+        run: |
+          if [ -z "$BASE_SHA" ] || [ "$BASE_SHA" = "0000000000000000000000000000000000000000" ]; then git fetch origin "main" && BASE_SHA="$(git merge-base FETCH_HEAD "$GITHUB_SHA")"; if [ "$BASE_SHA" = "$GITHUB_SHA" ]; then BASE_SHA="$(git rev-parse --verify --quiet "$GITHUB_SHA^" || echo 4b825dc642cb6eb9a060e54bf8d69288fbee4904)"; fi; fi; export BASE_SHA
+          chant ci run apply --in-place --base "$BASE_SHA" --env prod --gate pr-apply --forge github --wave-gate release --wave 3
+      - name: Keep the record for the next wave and a re-run
+        if: always()
+        uses: actions/cache/save@v4
+        with:
+          path: .chant/pr-resume/pr-apply.json
+          key: chant-apply-prod-${{ github.sha }}-${{ github.run_id }}-${{ github.run_attempt }}-wave-3
+      - name: Keep the wave 3 apply report
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: chant-pr-apply-wave-3
+          path: .chant/pr
+          if-no-files-found: ignore
+          include-hidden-files: true

package/src/components/__fixtures__/pr-loop.github.golden.yml

@@ -30,7 +30,8 @@ jobs:
           BASE_SHA: '${{ github.event.pull_request.base.sha }}'
           PR_NUMBER: '${{ github.event.pull_request.number }}'
           GITHUB_TOKEN: '${{ github.token }}'
-        run: chant components pr-plan --base "$BASE_SHA" --pr "$PR_NUMBER" --env prod --gate pr-apply --output .chant/pr --forge github
+          CHANT_RUNNER_KEY: '${{ secrets.CHANT_RUNNER_KEY }}'
+        run: chant ci run plan --in-place --no-push --base "$BASE_SHA" --pr "$PR_NUMBER" --env prod --gate pr-apply --forge github
       - name: Keep the plan report
         if: always()
         uses: actions/upload-artifact@v4
@@ -65,7 +66,10 @@ jobs:
         env:
           BASE_SHA: '${{ github.event.before }}'
           GITHUB_TOKEN: '${{ github.token }}'
-        run: chant components pr-apply --base "$BASE_SHA" --env prod --gate pr-apply --output .chant/pr --forge github --require-review --resume .chant/pr-resume/pr-apply.json
+          CHANT_RUNNER_KEY: '${{ secrets.CHANT_RUNNER_KEY }}'
+        run: |
+          if [ -z "$BASE_SHA" ] || [ "$BASE_SHA" = "0000000000000000000000000000000000000000" ]; then git fetch origin "main" && BASE_SHA="$(git merge-base FETCH_HEAD "$GITHUB_SHA")"; if [ "$BASE_SHA" = "$GITHUB_SHA" ]; then BASE_SHA="$(git rev-parse --verify --quiet "$GITHUB_SHA^" || echo 4b825dc642cb6eb9a060e54bf8d69288fbee4904)"; fi; fi; export BASE_SHA
+          chant ci run apply --in-place --base "$BASE_SHA" --env prod --gate pr-apply --forge github
       - name: Keep the record for a re-run
         if: always()
         uses: actions/cache/save@v4

package/src/components/ci-jobs.ts

@@ -9,7 +9,7 @@
  */
 
 import { emitYAML, emitYAMLEntry } from "@intentius/chant/yaml";
-import { GITHUB_JOB_TOKEN, pushBranches } from "@intentius/chant/ci-jobs";
+import { BUILD_REQUEST_TAGS, GITHUB_JOB_TOKEN, pushBranches } from "@intentius/chant/ci-jobs";
 import type { OpTrigger } from "@intentius/chant/lexicon";
 import { actionRef } from "../action-pins";
 
@@ -70,10 +70,24 @@ export function onTrigger(trigger: OpTrigger): Record<string, unknown> {
     case "pull_request":
       return { pull_request: trigger.branches && trigger.branches.length > 0 ? { branches: trigger.branches } : {} };
     case "push":
-      return { push: { branches: pushBranches(trigger.branches) } };
+      // #4169: a newest build runs at each build request's tag too, and by hand.
+      return trigger.build === "newest"
+        ? { push: { branches: pushBranches(trigger.branches), tags: [BUILD_REQUEST_TAGS] }, workflow_dispatch: {} }
+        : { push: { branches: pushBranches(trigger.branches) } };
   }
 }
 
+/**
+ * A push Op's concurrency group (#4169): one per commit under `build:
+ * "every"`, so no push cancels or replaces another's run; one per ref under
+ * `newest`, so the newest push waits and each build request's tag runs on its
+ * own; and the Op's own name otherwise, one run at a time.
+ */
+export function opConcurrencyGroup(jobName: string, trigger: OpTrigger): string {
+  if (trigger.kind !== "push" || !trigger.build) return jobName;
+  return trigger.build === "every" ? `${jobName}-\${{ github.sha }}` : `${jobName}-\${{ github.ref }}`;
+}
+
 /**
  * A workflow document before emission. Every generator's document is one of
  * these; each leaves out the sections it has no use for.

package/src/components/generate-op-pipeline.test.ts

@@ -208,6 +208,17 @@ describe("generateGithubOpPipeline: trigger kinds (#2084)", () => {
     expect(result.jobs[0].trigger).toEqual({ kind: "push", branches: ["release"] });
   });
 
+  test("a push trigger's build (#4169): newest runs at build request tags and by hand, one group per ref; every, one group per commit", () => {
+    const newest = parseFile(generateGithubOpPipeline([{ name: "suites", trigger: { kind: "push", build: "newest" } }]).files[0].yaml);
+    expect(newest.on).toEqual({ push: { branches: ["main"], tags: ["ci/build/**"] }, workflow_dispatch: {} });
+    expect(newest.concurrency).toEqual({ group: "suites-${{ github.ref }}", "cancel-in-progress": false });
+    const every = parseFile(generateGithubOpPipeline([{ name: "suites", trigger: { kind: "push", build: "every" } }]).files[0].yaml);
+    expect(every.on).toEqual({ push: { branches: ["main"] } });
+    expect(every.concurrency).toEqual({ group: "suites-${{ github.sha }}", "cancel-in-progress": false });
+    const plain = parseFile(generateGithubOpPipeline([{ name: "suites", trigger: { kind: "push" } }]).files[0].yaml);
+    expect(plain.concurrency).toEqual({ group: "suites", "cancel-in-progress": false });
+  });
+
   test("push trigger defaults to the repository default branch (main) when branches is omitted", () => {
     const result = generateGithubOpPipeline([{ name: "tf-apply", trigger: { kind: "push" } }]);
     const doc = parseFile(result.files[0].yaml);

package/src/components/generate-op-pipeline.ts

@@ -95,7 +95,7 @@ import type {
   PipelineMember,
   ScheduledOpSpec,
 } from "@intentius/chant/lexicon";
-import { checkoutStep, concurrency, emitWorkflowYAML, jobTokenEnv, onTrigger, runSteps } from "./ci-jobs";
+import { checkoutStep, concurrency, emitWorkflowYAML, jobTokenEnv, onTrigger, opConcurrencyGroup, runSteps } from "./ci-jobs";
 
 export type { GenerateGithubOpOptions, GenerateGithubOpResult };
 
@@ -455,8 +455,8 @@ export function buildGithubOpPipelineDocs(
       on: onTrigger(trigger),
       ...nonEmpty("env", options.variables),
       // One run at a time per Op — a slow audit must not overlap its own next
-      // scheduled trigger.
-      concurrency: concurrency(jobName),
+      // scheduled trigger. A push Op's `build` (#4169) widens the group.
+      concurrency: concurrency(opConcurrencyGroup(jobName, trigger)),
       permissions: mergePermissions(
         spec.name,
         permissionsFor(findingMode, trigger),