@intentius/chant-lexicon-github 0.124.32 → 0.124.34

package/dist/components/ci-jobs.d.ts

@@ -35,6 +35,13 @@ export declare function jobTokenEnv(gh?: boolean): Record<string, string>;
  * names none).
  */
 export declare function onTrigger(trigger: OpTrigger): Record<string, unknown>;
+/**
+ * A push Op's concurrency group (#4169): one per commit under `build:
+ * "every"`, so no push cancels or replaces another's run; one per ref under
+ * `newest`, so the newest push waits and each build request's tag runs on its
+ * own; and the Op's own name otherwise, one run at a time.
+ */
+export declare function opConcurrencyGroup(jobName: string, trigger: OpTrigger): string;
 /**
  * A workflow document before emission. Every generator's document is one of
  * these; each leaves out the sections it has no use for.

package/dist/components/ci-jobs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ci-jobs.d.ts","sourceRoot":"","sources":["../../src/components/ci-jobs.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAG1D,qGAAqG;AACrG,eAAO,MAAM,eAAe,+BAA+B,CAAC;AAC5D,eAAO,MAAM,iBAAiB,iCAAiC,CAAC;AAEhE,iIAAiI;AACjI,wBAAgB,YAAY,CAAC,WAAW,UAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAEzE;AAED,yEAAyE;AACzE,wBAAgB,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAEjF;AAED,oDAAoD;AACpD,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAE1G;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAOpG;AAED,6DAA6D;AAC7D,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,gBAAgB,UAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAE5F;AAED,oGAAoG;AACpG,wBAAgB,WAAW,CAAC,EAAE,UAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAE9D;AAED;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,OAAO,EAAE,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CASrE;AAED;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,qGAAqG;IACrG,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,8BAA8B;IAC9B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,iCAAiC;IACjC,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5B,uEAAuE;IACvE,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,kCAAkC;IAClC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,kCAAkC;IAClC,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACtC,+EAA+E;IAC/E,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACtC,2BAA2B;IAC3B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,kFAAkF;AAClF,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,iBAAiB,GAAG,MAAM,CAW/D"}
+{"version":3,"file":"ci-jobs.d.ts","sourceRoot":"","sources":["../../src/components/ci-jobs.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAG1D,qGAAqG;AACrG,eAAO,MAAM,eAAe,+BAA+B,CAAC;AAC5D,eAAO,MAAM,iBAAiB,iCAAiC,CAAC;AAEhE,iIAAiI;AACjI,wBAAgB,YAAY,CAAC,WAAW,UAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAEzE;AAED,yEAAyE;AACzE,wBAAgB,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAEjF;AAED,oDAAoD;AACpD,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAE1G;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAOpG;AAED,6DAA6D;AAC7D,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,gBAAgB,UAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAE5F;AAED,oGAAoG;AACpG,wBAAgB,WAAW,CAAC,EAAE,UAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAE9D;AAED;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,OAAO,EAAE,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAYrE;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,GAAG,MAAM,CAG9E;AAED;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,qGAAqG;IACrG,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,8BAA8B;IAC9B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,iCAAiC;IACjC,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5B,uEAAuE;IACvE,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,kCAAkC;IAClC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,kCAAkC;IAClC,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACtC,+EAA+E;IAC/E,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACtC,2BAA2B;IAC3B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,kFAAkF;AAClF,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,iBAAiB,GAAG,MAAM,CAW/D"}

package/dist/components/ci-jobs.js

@@ -8,7 +8,7 @@
  * core's, in `@intentius/chant/ci-jobs`.
  */
 import { emitYAML, emitYAMLEntry } from "@intentius/chant/yaml";
-import { GITHUB_JOB_TOKEN, pushBranches } from "@intentius/chant/ci-jobs";
+import { BUILD_REQUEST_TAGS, GITHUB_JOB_TOKEN, pushBranches } from "@intentius/chant/ci-jobs";
 import { actionRef } from "../action-pins.js";
 /** The artifact actions every generated job uses, at the major the generators have always pinned. */
 export const UPLOAD_ARTIFACT = "actions/upload-artifact@v4";
@@ -60,9 +60,23 @@ export function onTrigger(trigger) {
         case "pull_request":
             return { pull_request: trigger.branches && trigger.branches.length > 0 ? { branches: trigger.branches } : {} };
         case "push":
-            return { push: { branches: pushBranches(trigger.branches) } };
+            // #4169: a newest build runs at each build request's tag too, and by hand.
+            return trigger.build === "newest"
+                ? { push: { branches: pushBranches(trigger.branches), tags: [BUILD_REQUEST_TAGS] }, workflow_dispatch: {} }
+                : { push: { branches: pushBranches(trigger.branches) } };
     }
 }
+/**
+ * A push Op's concurrency group (#4169): one per commit under `build:
+ * "every"`, so no push cancels or replaces another's run; one per ref under
+ * `newest`, so the newest push waits and each build request's tag runs on its
+ * own; and the Op's own name otherwise, one run at a time.
+ */
+export function opConcurrencyGroup(jobName, trigger) {
+    if (trigger.kind !== "push" || !trigger.build)
+        return jobName;
+    return trigger.build === "every" ? `${jobName}-\${{ github.sha }}` : `${jobName}-\${{ github.ref }}`;
+}
 /** Emit a workflow document as YAML, its sections in GitHub's customary order. */
 export function emitWorkflowYAML(doc) {
     const sections = [];

package/dist/components/generate-op-pipeline.js

@@ -72,7 +72,7 @@
 import { readFileSync } from "node:fs";
 import { assertEnvironment, assertSetupSteps, CI_IMAGE, ciJobName, environmentDoc, fillCommand, GITHUB_JOB_TOKEN, GITHUB_RUNNER, mergePermissions, nonEmpty, permissionsFor, setupStepDoc, } from "@intentius/chant/ci-jobs";
 import { memberPathFilter, resolveOpTrigger } from "@intentius/chant/lexicon";
-import { checkoutStep, concurrency, emitWorkflowYAML, jobTokenEnv, onTrigger, runSteps } from "./ci-jobs.js";
+import { checkoutStep, concurrency, emitWorkflowYAML, jobTokenEnv, onTrigger, opConcurrencyGroup, runSteps } from "./ci-jobs.js";
 // The setup, environment and permission checks are shared with the Op waves
 // generator and the forgejo lexicon (#3765); they stay importable from here.
 export { assertEnvironment, assertSetupSteps, mergePermissions };
@@ -339,8 +339,8 @@ export function buildGithubOpPipelineDocs(ops, options = {}) {
             on: onTrigger(trigger),
             ...nonEmpty("env", options.variables),
             // One run at a time per Op — a slow audit must not overlap its own next
-            // scheduled trigger.
-            concurrency: concurrency(jobName),
+            // scheduled trigger. A push Op's `build` (#4169) widens the group.
+            concurrency: concurrency(opConcurrencyGroup(jobName, trigger)),
             permissions: mergePermissions(spec.name, permissionsFor(findingMode, trigger), spec.permissions ?? {}, trigger),
             jobsDoc: {
                 [jobName]: {

package/dist/components/generate-pipeline.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generate-pipeline.d.ts","sourceRoot":"","sources":["../../src/components/generate-pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AAEH,OAAO,EAAyB,KAAK,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAgBjG,OAAO,KAAK,EACV,oBAAoB,IAAI,YAAY,EACpC,wBAAwB,IAAI,qBAAqB,EACjD,uBAAuB,IAAI,oBAAoB,EAEhD,MAAM,0BAA0B,CAAC;AAGlC,YAAY,EAAE,YAAY,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,CAAC;AAE1E;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;;;OAKG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,6FAA6F;IAC7F,WAAW,EAAE,MAAM,CAAC;IACpB,8DAA8D;IAC9D,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5B,mIAAmI;IACnI,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC;;;;;;OAMG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,qDAAqD;IACrD,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,uEAAuE;IACvE,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,0DAA0D;IAC1D,IAAI,EAAE,YAAY,EAAE,CAAC;CACtB;AAkMD;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,CAWpD;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,eAAe,EAAE,EAC7B,OAAO,GAAE,qBAA0B,GAClC,iBAAiB,CA+JnB;AA4CD;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,iBAAiB,GAAG,MAAM,CAE/D;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,eAAe,EAAE,EAC7B,OAAO,GAAE,qBAA0B,GAClC,oBAAoB,CAGtB"}
+{"version":3,"file":"generate-pipeline.d.ts","sourceRoot":"","sources":["../../src/components/generate-pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AAEH,OAAO,EAAyB,KAAK,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAiBjG,OAAO,KAAK,EACV,oBAAoB,IAAI,YAAY,EACpC,wBAAwB,IAAI,qBAAqB,EACjD,uBAAuB,IAAI,oBAAoB,EAEhD,MAAM,0BAA0B,CAAC;AAGlC,YAAY,EAAE,YAAY,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,CAAC;AAE1E;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;;;OAKG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,6FAA6F;IAC7F,WAAW,EAAE,MAAM,CAAC;IACpB,8DAA8D;IAC9D,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5B,mIAAmI;IACnI,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC;;;;;;OAMG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,qDAAqD;IACrD,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,uEAAuE;IACvE,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,0DAA0D;IAC1D,IAAI,EAAE,YAAY,EAAE,CAAC;CACtB;AAuMD;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,CAWpD;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,eAAe,EAAE,EAC7B,OAAO,GAAE,qBAA0B,GAClC,iBAAiB,CA+JnB;AA4CD;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,iBAAiB,GAAG,MAAM,CAE/D;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,eAAe,EAAE,EAC7B,OAAO,GAAE,qBAA0B,GAClC,oBAAoB,CAGtB"}

package/dist/components/generate-pipeline.js

@@ -59,7 +59,7 @@ import { resolveComponentGraph } from "@intentius/chant/components/driver";
 import { hasPublishStep, promoteArchivePaths } from "@intentius/chant/components/promote";
 import { GATED_WAVE_RECORD, gatedWaveJobs } from "@intentius/chant/components/gated-wave-pipeline";
 import { CI_IMAGE, ciJobName, dirnameOf, fillCommand, GITHUB_RUNNER } from "@intentius/chant/ci-jobs";
-import { PR_APPLY_RECORD, PR_LOOP_REPORT_DIR, prApplyGroup, prApplyRecordKey, prApplyWaveJobName, prLoopJobs, prLoopSetup, prLoopWaveJobs, prLoopWithWaves, } from "@intentius/chant/components/pr-pipeline";
+import { PR_APPLY_RECORD, PR_LOOP_REPORT_DIR, prApplyGroup, prRecordGroup, prApplyRecordKey, prApplyWaveJobName, prLoopJobs, prLoopSetup, prLoopWaveJobs, prLoopWithWaves, } from "@intentius/chant/components/pr-pipeline";
 import { memberRepoPath } from "@intentius/chant/lexicon";
 import { checkoutStep, concurrency, downloadArtifactStep, emitWorkflowYAML, keepRecordStep, runSteps, UPLOAD_ARTIFACT } from "./ci-jobs.js";
 /** The workflow artifact the gated-wave jobs hand their attempt record through, one per wave. */
@@ -105,7 +105,10 @@ function gatedWaveGithubDoc(components, env, image, beforeScript, extraScript, o
 }
 /**
  * The pull-request workflow (#3183): `plan` on each pull request into the
- * target branch, `apply` on each push to it. The plan job can comment and set
+ * target branch, and on each push to it `record` (#4168), or `apply` with
+ * `applyOnMerge`. The record job plans on the merged commit and writes the
+ * merge record, applying nothing, so it pushes to `chant/lifecycle` and runs
+ * one at a time per environment as the apply does. The plan job can comment and set
  * statuses but cannot push, since it runs the pull request's code; the apply
  * job can push, to record a pending fact on `chant/lifecycle`, and runs one
  * at a time per environment. Both keep their report as an artifact, and both
@@ -133,7 +136,7 @@ function prLoopGithubDoc(components, env, image, beforeScript, extraScript, opti
     const branch = loop.branch ?? "main";
     const member = options.member;
     const rooted = !member || member.dir === "." || member.dir === "";
-    const [plan, apply] = prLoopJobs(loop.forge ?? "github", env, loop, member?.name);
+    const [plan, apply, record] = prLoopJobs(loop.forge ?? "github", env, loop, member?.name);
     const reportPath = member ? memberRepoPath(member, PR_LOOP_REPORT_DIR) : PR_LOOP_REPORT_DIR;
     // The apply's attempt record (#3543) lives in the cache under the pushed
     // commit. Cache keys cannot be overwritten, so each attempt saves under
@@ -186,7 +189,9 @@ function prLoopGithubDoc(components, env, image, beforeScript, extraScript, opti
             prApplyWaveJobName(job.wave),
             applyJob(job, job.wave > 1 ? [prApplyWaveJobName(job.wave - 1)] : [], `Apply wave ${job.wave}, under the approval its plan has`),
         ])
-        : [["apply", applyJob(apply, [], "Apply the plan a reviewer approved")]];
+        : loop.applyOnMerge
+            ? [["apply", applyJob(apply, [], "Apply the plan a reviewer approved")]]
+            : [["record", { ...applyJob(record, [], "Record the plan on the merged commit; nothing applies"), concurrency: concurrency(prRecordGroup(env, member?.name)) }]];
     const jobsDoc = {
         plan: {
             if: "github.event_name == 'pull_request'",
@@ -210,7 +215,7 @@ function prLoopGithubDoc(components, env, image, beforeScript, extraScript, opti
             { jobName: "plan", component: "pull request plan", stage: "plan", needs: [] },
             ...applyNames.map((name, i) => ({
                 jobName: name,
-                component: loop.waveGate ? `pull request apply, wave ${i + 1}` : "pull request apply",
+                component: loop.waveGate ? `pull request apply, wave ${i + 1}` : loop.applyOnMerge ? "pull request apply" : "merge record",
                 stage: name,
                 needs: i > 0 ? [applyNames[i - 1]] : [],
             })),

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "1ac5c53834d0d9e3f294436372ef80c67d915538899782e8188f48379b1c884d",
+    "manifest.json": "5f90d39ad2f505ce370fa896da370421567132336d3404820974cd74a1dfe68f",
     "meta.json": "c50e0ef3845c370c3ad2210b8bba455980417c0f818aa6ed46e06d4fb8b1b9f9",
     "types/index.d.ts": "0ead95536e947ddfb98a5acf0ddb88547913b5a53a342df67711c59266f84b3e",
     "rules/deprecated-action-version.ts": "a9ba7cc924ff1c7055110416d8989273690415bfb5e8dcc32dc9431b9351f5ca",
@@ -78,5 +78,5 @@
     "skills/chant-github-patterns.md": "bb3abef289a8fdfcf07d6bb2d7289dcb2f38bc0cb0321ea320b78b45a6f548c0",
     "skills/chant-github-security.md": "aab111cb0871cad30281ce48d7da23663689619351029219e2be019a1a61e394"
   },
-  "composite": "fb2f379e45edbc503f525d77958b302d4f546273f1b09ba0f2d5e7d0cdde1e2f"
+  "composite": "58ec911a741a048aafa2e77b71308b47d28436478805c484a48867361d3220d0"
 }

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "github",
-  "version": "0.124.32",
+  "version": "0.124.34",
   "chantVersion": ">=0.1.0",
   "namespace": "GitHub",
   "intrinsics": [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-github",
-  "version": "0.124.32",
+  "version": "0.124.34",
   "description": "GitHub Actions lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -61,6 +61,6 @@
     "typescript": "^5.9.3"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.124.32"
+    "@intentius/chant": "^0.124.34"
   }
 }

package/src/components/__fixtures__/pr-loop-record.github.golden.yml

@@ -0,0 +1,74 @@
+name: chant-pr-prod
+
+on:
+  pull_request:
+    branches:
+      - main
+  push:
+    branches:
+      - main
+
+env:
+  CHANT_ENV: prod
+
+jobs:
+  plan:
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    container: node:22
+    permissions:
+      contents: read
+      pull-requests: write
+      statuses: write
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+      - run: command -v tofu >/dev/null 2>&1 || (curl -fsSL https://get.opentofu.org/install-opentofu.sh -o /tmp/install-opentofu.sh && sh /tmp/install-opentofu.sh --install-method standalone)
+      - name: Plan the members this pull request reaches
+        env:
+          BASE_SHA: '${{ github.event.pull_request.base.sha }}'
+          PR_NUMBER: '${{ github.event.pull_request.number }}'
+          GITHUB_TOKEN: '${{ github.token }}'
+          CHANT_RUNNER_KEY: '${{ secrets.CHANT_RUNNER_KEY }}'
+        run: chant ci run plan --in-place --no-push --base "$BASE_SHA" --pr "$PR_NUMBER" --env prod --gate pr-apply --forge github
+      - name: Keep the plan report
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: chant-pr-plan
+          path: .chant/pr
+          if-no-files-found: ignore
+          include-hidden-files: true
+  record:
+    if: github.event_name == 'push'
+    runs-on: ubuntu-latest
+    container: node:22
+    concurrency:
+      group: chant-record-prod
+      cancel-in-progress: false
+    permissions:
+      contents: write
+      pull-requests: write
+      statuses: write
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+      - run: command -v tofu >/dev/null 2>&1 || (curl -fsSL https://get.opentofu.org/install-opentofu.sh -o /tmp/install-opentofu.sh && sh /tmp/install-opentofu.sh --install-method standalone)
+      - name: Record the plan on the merged commit; nothing applies
+        env:
+          BASE_SHA: '${{ github.event.before }}'
+          GITHUB_TOKEN: '${{ github.token }}'
+          CHANT_RUNNER_KEY: '${{ secrets.CHANT_RUNNER_KEY }}'
+        run: |
+          if [ -z "$BASE_SHA" ] || [ "$BASE_SHA" = "0000000000000000000000000000000000000000" ]; then git fetch origin "main" && BASE_SHA="$(git merge-base FETCH_HEAD "$GITHUB_SHA")"; if [ "$BASE_SHA" = "$GITHUB_SHA" ]; then BASE_SHA="$(git rev-parse --verify --quiet "$GITHUB_SHA^" || echo 4b825dc642cb6eb9a060e54bf8d69288fbee4904)"; fi; fi; export BASE_SHA
+          chant ci run record --in-place --base "$BASE_SHA" --env prod --gate pr-apply --forge github
+      - name: Keep the record report
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: chant-pr-record
+          path: .chant/pr
+          if-no-files-found: ignore
+          include-hidden-files: true

package/src/components/ci-jobs.ts

@@ -9,7 +9,7 @@
  */
 
 import { emitYAML, emitYAMLEntry } from "@intentius/chant/yaml";
-import { GITHUB_JOB_TOKEN, pushBranches } from "@intentius/chant/ci-jobs";
+import { BUILD_REQUEST_TAGS, GITHUB_JOB_TOKEN, pushBranches } from "@intentius/chant/ci-jobs";
 import type { OpTrigger } from "@intentius/chant/lexicon";
 import { actionRef } from "../action-pins";
 
@@ -70,10 +70,24 @@ export function onTrigger(trigger: OpTrigger): Record<string, unknown> {
     case "pull_request":
       return { pull_request: trigger.branches && trigger.branches.length > 0 ? { branches: trigger.branches } : {} };
     case "push":
-      return { push: { branches: pushBranches(trigger.branches) } };
+      // #4169: a newest build runs at each build request's tag too, and by hand.
+      return trigger.build === "newest"
+        ? { push: { branches: pushBranches(trigger.branches), tags: [BUILD_REQUEST_TAGS] }, workflow_dispatch: {} }
+        : { push: { branches: pushBranches(trigger.branches) } };
   }
 }
 
+/**
+ * A push Op's concurrency group (#4169): one per commit under `build:
+ * "every"`, so no push cancels or replaces another's run; one per ref under
+ * `newest`, so the newest push waits and each build request's tag runs on its
+ * own; and the Op's own name otherwise, one run at a time.
+ */
+export function opConcurrencyGroup(jobName: string, trigger: OpTrigger): string {
+  if (trigger.kind !== "push" || !trigger.build) return jobName;
+  return trigger.build === "every" ? `${jobName}-\${{ github.sha }}` : `${jobName}-\${{ github.ref }}`;
+}
+
 /**
  * A workflow document before emission. Every generator's document is one of
  * these; each leaves out the sections it has no use for.

package/src/components/generate-op-pipeline.test.ts

@@ -208,6 +208,17 @@ describe("generateGithubOpPipeline: trigger kinds (#2084)", () => {
     expect(result.jobs[0].trigger).toEqual({ kind: "push", branches: ["release"] });
   });
 
+  test("a push trigger's build (#4169): newest runs at build request tags and by hand, one group per ref; every, one group per commit", () => {
+    const newest = parseFile(generateGithubOpPipeline([{ name: "suites", trigger: { kind: "push", build: "newest" } }]).files[0].yaml);
+    expect(newest.on).toEqual({ push: { branches: ["main"], tags: ["ci/build/**"] }, workflow_dispatch: {} });
+    expect(newest.concurrency).toEqual({ group: "suites-${{ github.ref }}", "cancel-in-progress": false });
+    const every = parseFile(generateGithubOpPipeline([{ name: "suites", trigger: { kind: "push", build: "every" } }]).files[0].yaml);
+    expect(every.on).toEqual({ push: { branches: ["main"] } });
+    expect(every.concurrency).toEqual({ group: "suites-${{ github.sha }}", "cancel-in-progress": false });
+    const plain = parseFile(generateGithubOpPipeline([{ name: "suites", trigger: { kind: "push" } }]).files[0].yaml);
+    expect(plain.concurrency).toEqual({ group: "suites", "cancel-in-progress": false });
+  });
+
   test("push trigger defaults to the repository default branch (main) when branches is omitted", () => {
     const result = generateGithubOpPipeline([{ name: "tf-apply", trigger: { kind: "push" } }]);
     const doc = parseFile(result.files[0].yaml);

package/src/components/generate-op-pipeline.ts

@@ -95,7 +95,7 @@ import type {
   PipelineMember,
   ScheduledOpSpec,
 } from "@intentius/chant/lexicon";
-import { checkoutStep, concurrency, emitWorkflowYAML, jobTokenEnv, onTrigger, runSteps } from "./ci-jobs";
+import { checkoutStep, concurrency, emitWorkflowYAML, jobTokenEnv, onTrigger, opConcurrencyGroup, runSteps } from "./ci-jobs";
 
 export type { GenerateGithubOpOptions, GenerateGithubOpResult };
 
@@ -455,8 +455,8 @@ export function buildGithubOpPipelineDocs(
       on: onTrigger(trigger),
       ...nonEmpty("env", options.variables),
       // One run at a time per Op — a slow audit must not overlap its own next
-      // scheduled trigger.
-      concurrency: concurrency(jobName),
+      // scheduled trigger. A push Op's `build` (#4169) widens the group.
+      concurrency: concurrency(opConcurrencyGroup(jobName, trigger)),
       permissions: mergePermissions(
         spec.name,
         permissionsFor(findingMode, trigger),

package/src/components/generate-pipeline.ts

@@ -64,6 +64,7 @@ import {
   PR_APPLY_RECORD,
   PR_LOOP_REPORT_DIR,
   prApplyGroup,
+  prRecordGroup,
   prApplyRecordKey,
   prApplyWaveJobName,
   prLoopJobs,
@@ -171,7 +172,10 @@ function gatedWaveGithubDoc(
 
 /**
  * The pull-request workflow (#3183): `plan` on each pull request into the
- * target branch, `apply` on each push to it. The plan job can comment and set
+ * target branch, and on each push to it `record` (#4168), or `apply` with
+ * `applyOnMerge`. The record job plans on the merged commit and writes the
+ * merge record, applying nothing, so it pushes to `chant/lifecycle` and runs
+ * one at a time per environment as the apply does. The plan job can comment and set
  * statuses but cannot push, since it runs the pull request's code; the apply
  * job can push, to record a pending fact on `chant/lifecycle`, and runs one
  * at a time per environment. Both keep their report as an artifact, and both
@@ -206,7 +210,7 @@ function prLoopGithubDoc(
   const branch = loop.branch ?? "main";
   const member = options.member;
   const rooted = !member || member.dir === "." || member.dir === "";
-  const [plan, apply] = prLoopJobs(loop.forge ?? "github", env, loop, member?.name);
+  const [plan, apply, record] = prLoopJobs(loop.forge ?? "github", env, loop, member?.name);
   const reportPath = member ? memberRepoPath(member, PR_LOOP_REPORT_DIR) : PR_LOOP_REPORT_DIR;
   // The apply's attempt record (#3543) lives in the cache under the pushed
   // commit. Cache keys cannot be overwritten, so each attempt saves under
@@ -259,7 +263,9 @@ function prLoopGithubDoc(
         prApplyWaveJobName(job.wave!),
         applyJob(job, job.wave! > 1 ? [prApplyWaveJobName(job.wave! - 1)] : [], `Apply wave ${job.wave}, under the approval its plan has`),
       ])
-    : [["apply", applyJob(apply, [], "Apply the plan a reviewer approved")]];
+    : loop.applyOnMerge
+      ? [["apply", applyJob(apply, [], "Apply the plan a reviewer approved")]]
+      : [["record", { ...applyJob(record, [], "Record the plan on the merged commit; nothing applies"), concurrency: concurrency(prRecordGroup(env, member?.name)) }]];
   const jobsDoc: Record<string, unknown> = {
     plan: {
       if: "github.event_name == 'pull_request'",
@@ -283,7 +289,7 @@ function prLoopGithubDoc(
       { jobName: "plan", component: "pull request plan", stage: "plan", needs: [] },
       ...applyNames.map((name, i) => ({
         jobName: name,
-        component: loop.waveGate ? `pull request apply, wave ${i + 1}` : "pull request apply",
+        component: loop.waveGate ? `pull request apply, wave ${i + 1}` : loop.applyOnMerge ? "pull request apply" : "merge record",
         stage: name,
         needs: i > 0 ? [applyNames[i - 1]] : [],
       })),

package/src/components/generate-pr-pipeline.test.ts

@@ -46,7 +46,7 @@ interface Job {
 }
 
 describe("the GitHub pull-request workflow", () => {
-  const result = generateGithubPipeline(ESTATE, { env: "prod", prLoop: {} });
+  const result = generateGithubPipeline(ESTATE, { env: "prod", prLoop: { applyOnMerge: true } });
   const doc = parseYAML(result.yaml) as { name: string; on: Record<string, unknown>; jobs: Record<string, Job> };
 
   test("matches its golden", () => {
@@ -72,8 +72,8 @@ describe("the GitHub pull-request workflow", () => {
     expect(doc.jobs.plan.permissions).toEqual({ contents: "read", "pull-requests": "write", statuses: "write" });
 
     const apply = doc.jobs.apply.steps.find((s) => s.run?.includes("ci run apply"))!;
-    // ci run builds pr-apply with --require-review unless told --no-require-review.
-    expect(apply.run).not.toContain("--no-require-review");
+    // #4168: ci run builds pr-apply without --require-review unless the pipeline asks for it.
+    expect(apply.run).not.toContain("--require-review");
     expect(apply.run).not.toContain("--no-push");
     expect(apply.env).toMatchObject({ BASE_SHA: "${{ github.event.before }}", CHANT_RUNNER_KEY: "${{ secrets.CHANT_RUNNER_KEY }}" });
     expect(doc.jobs.apply.permissions.contents).toBe("write");
@@ -89,7 +89,7 @@ describe("the GitHub pull-request workflow", () => {
     expect(lines[0]).toContain('[ "$BASE_SHA" = "0000000000000000000000000000000000000000" ]');
     expect(lines[0]).toContain('git merge-base FETCH_HEAD "$GITHUB_SHA"');
     expect(lines[1]).toMatch(/^chant ci run apply --in-place --base "\$BASE_SHA"/);
-    const trunk = parseYAML(generateGithubPipeline(ESTATE, { env: "prod", prLoop: { branch: "trunk" } }).yaml) as { jobs: Record<string, Job> };
+    const trunk = parseYAML(generateGithubPipeline(ESTATE, { env: "prod", prLoop: { applyOnMerge: true, branch: "trunk" } }).yaml) as { jobs: Record<string, Job> };
     expect(trunk.jobs.apply.steps.find((s) => s.run?.includes("ci run apply"))!.run).toContain('git fetch origin "trunk"');
     const plan = doc.jobs.plan.steps.find((s) => s.run?.includes("ci run plan"))!;
     expect(plan.run).not.toContain("0000000000000000000000000000000000000000");
@@ -121,27 +121,27 @@ describe("the GitHub pull-request workflow", () => {
 
   test("runs in an image with git and installs OpenTofu, unless the caller names an image", () => {
     expect(doc.jobs.plan.steps[1].run).toContain("install-opentofu");
-    const own = generateGithubPipeline(ESTATE, { env: "prod", image: "example/ci:1", prLoop: {} }).yaml;
+    const own = generateGithubPipeline(ESTATE, { env: "prod", image: "example/ci:1", prLoop: { applyOnMerge: true } }).yaml;
     expect(own).toContain("container: example/ci:1");
     expect(own).not.toContain("install-opentofu");
   });
 
   test("the gate, branch and review requirement are options", () => {
-    const yaml = generateGithubPipeline(ESTATE, { env: "prod", prLoop: { gate: "infra-apply", branch: "trunk", requireReview: false } }).yaml;
+    const yaml = generateGithubPipeline(ESTATE, { env: "prod", prLoop: { applyOnMerge: true, gate: "infra-apply", branch: "trunk", requireReview: true } }).yaml;
     expect(yaml).toContain("--gate infra-apply");
     expect(yaml).toContain("- trunk");
-    expect(yaml).toContain("--no-require-review");
+    expect(yaml).toContain("ci run apply --in-place --base \"$BASE_SHA\" --env prod --gate infra-apply --forge github --branch \"trunk\" --require-review");
     expect(yaml).toContain('--branch "trunk"');
   });
 
   test("refuses a promote job beside it, and a canary or a fixed base beside --wave-gate (#4003)", () => {
-    expect(() => generateGithubPipeline(ESTATE, { prLoop: {}, promoteTo: "prod" })).toThrow(/pull-request pipeline has no promote job/);
-    expect(() => generateGithubPipeline(ESTATE, { prLoop: {}, gatedWaves: { gate: "g", canary: ["net"] } })).toThrow(/takes no --canary/);
-    expect(() => generateGithubPipeline(ESTATE, { prLoop: {}, gatedWaves: { gate: "g", base: "HEAD~1" } })).toThrow(/takes no --base/);
+    expect(() => generateGithubPipeline(ESTATE, { prLoop: { applyOnMerge: true }, promoteTo: "prod" })).toThrow(/pull-request pipeline has no promote job/);
+    expect(() => generateGithubPipeline(ESTATE, { prLoop: { applyOnMerge: true }, gatedWaves: { gate: "g", canary: ["net"] } })).toThrow(/takes no --canary/);
+    expect(() => generateGithubPipeline(ESTATE, { prLoop: { applyOnMerge: true }, gatedWaves: { gate: "g", base: "HEAD~1" } })).toThrow(/takes no --base/);
   });
 
   test("events and reportUrl stream the run's events into the report artifact and copy the reports out (#4007)", () => {
-    const loud = parseYAML(generateGithubPipeline(ESTATE, { env: "prod", prLoop: { events: true, reportUrl: "s3://chant-reports/acme" } }).yaml) as { jobs: Record<string, Job> };
+    const loud = parseYAML(generateGithubPipeline(ESTATE, { env: "prod", prLoop: { applyOnMerge: true, events: true, reportUrl: "s3://chant-reports/acme" } }).yaml) as { jobs: Record<string, Job> };
     for (const job of ["plan", "apply"]) {
       const run = loud.jobs[job].steps.find((s) => s.run?.includes("chant ci run"))!;
       expect(run.run).toContain('--events-json --report-url "s3://chant-reports/acme"');
@@ -154,7 +154,7 @@ describe("the GitHub pull-request workflow", () => {
 
   test("inside a workspace member: runs in the member's directory and keeps its own gate, note and apply group (#3465)", () => {
     const member = { name: "network", dir: "infra/network", file: ".github/workflows/chant-pr.network.prod.yml" };
-    const scoped = generateGithubPipeline(ESTATE, { env: "prod", prLoop: {}, member });
+    const scoped = generateGithubPipeline(ESTATE, { env: "prod", prLoop: { applyOnMerge: true }, member });
     const mdoc = parseYAML(scoped.yaml) as {
       name: string;
       on: Record<string, unknown>;
@@ -192,7 +192,7 @@ describe("the GitHub pull-request workflow", () => {
   });
 
   test("a member at the workspace root keeps the root's paths but its own names", () => {
-    const yaml = generateGithubPipeline(ESTATE, { env: "prod", prLoop: {}, member: { name: "root", dir: "." } }).yaml;
+    const yaml = generateGithubPipeline(ESTATE, { env: "prod", prLoop: { applyOnMerge: true }, member: { name: "root", dir: "." } }).yaml;
     const mdoc = parseYAML(yaml) as { name: string; defaults?: unknown; jobs: Record<string, Job> };
     expect(mdoc.name).toBe("chant-pr.root.prod");
     expect(mdoc.defaults).toBeUndefined();
@@ -213,7 +213,7 @@ describe("the GitHub pull-request workflow", () => {
 });
 
 describe("the github pull-request pipeline with build (#4088)", () => {
-  const result = generateGithubPipeline(ESTATE, { env: "prod", prLoop: { build: true } });
+  const result = generateGithubPipeline(ESTATE, { env: "prod", prLoop: { applyOnMerge: true, build: true } });
   const doc = parseYAML(result.yaml) as Record<string, any>;
   const golden = join(import.meta.dirname, "__fixtures__", "pr-loop-build.github.golden.yml");
 
@@ -231,14 +231,60 @@ describe("the github pull-request pipeline with build (#4088)", () => {
   });
 
   test("buildCommand replaces the build line and turns the option on", () => {
-    const yaml = generateGithubPipeline(ESTATE, { env: "prod", prLoop: { buildCommand: "npm run build" } }).yaml;
+    const yaml = generateGithubPipeline(ESTATE, { env: "prod", prLoop: { applyOnMerge: true, buildCommand: "npm run build" } }).yaml;
     expect(yaml).toContain("npm run build");
     expect(yaml).not.toContain("chant build --env");
     expect(yaml).toContain("chant lint");
   });
 
   test("the default output carries neither line", () => {
-    const plain = generateGithubPipeline(ESTATE, { env: "prod", prLoop: {} }).yaml;
+    const plain = generateGithubPipeline(ESTATE, { env: "prod", prLoop: { applyOnMerge: true } }).yaml;
     expect(plain).not.toContain("chant lint");
   });
 });
+
+describe("the GitHub pull-request workflow records on merge by default (#4168)", () => {
+  const result = generateGithubPipeline(ESTATE, { env: "prod", prLoop: {} });
+  const doc = parseYAML(result.yaml) as { jobs: Record<string, Job> };
+  const golden = join(import.meta.dirname, "__fixtures__", "pr-loop-record.github.golden.yml");
+
+  test("matches its golden", () => {
+    if (process.env.UPDATE_GOLDEN) writeFileSync(golden, result.yaml);
+    expect(result.yaml).toBe(readFileSync(golden, "utf-8"));
+  });
+
+  test("a push runs the record job, which applies nothing and keeps no resume record", () => {
+    expect(result.jobs.map((j) => j.jobName)).toEqual(["plan", "record"]);
+    expect(doc.jobs.apply).toBeUndefined();
+    expect(doc.jobs.record.if).toBe("github.event_name == 'push'");
+    const run = doc.jobs.record.steps.find((s) => s.run?.includes("ci run record"))!;
+    expect(run.run!.trimEnd().split("\n")).toEqual([githubBaseFallback(), 'chant ci run record --in-place --base "$BASE_SHA" --env prod --gate pr-apply --forge github']);
+    expect(doc.jobs.record.steps.some((s) => s.uses?.startsWith("actions/cache"))).toBe(false);
+    // It writes the merge record and the change set to chant/lifecycle, one at a time per environment.
+    expect(doc.jobs.record.permissions.contents).toBe("write");
+    expect(doc.jobs.record.concurrency).toEqual({ group: "chant-record-prod", "cancel-in-progress": false });
+    expect(result.yaml).not.toContain("ci run apply");
+  });
+
+  test("a gate per wave gates the apply, so it needs applyOnMerge", () => {
+    expect(() => generateGithubPipeline(ESTATE, { env: "prod", prLoop: {}, gatedWaves: { gate: "release" } })).toThrow(/needs --apply-on-merge/);
+  });
+
+  test("the record job runs pr-record with the apply's flags", () => {
+    const [, , record] = prLoopJobs("github", "prod", { events: true, reportUrl: "s3://r/acme", waveGate: "w", requireReview: true, branch: "trunk" });
+    expect(record.jobName).toBe("record");
+    expect(record.command).toBe('chant components pr-record --base "$BASE_SHA" --env prod --gate pr-apply --output .chant/pr --forge github --events-json --report-url "s3://r/acme"');
+    expect(record.run.command).toBe('chant ci run record --in-place --base "$BASE_SHA" --env prod --gate pr-apply --forge github --branch "trunk" --events-json --report-url "s3://r/acme"');
+  });
+
+  test.skipIf(!hasActionlint())("passes actionlint", () => {
+    const dir = mkdtempSync(join(tmpdir(), "chant-pr-record-"));
+    try {
+      mkdirSync(join(dir, ".github", "workflows"), { recursive: true });
+      writeFileSync(join(dir, ".github", "workflows", "chant-pr.yml"), result.yaml);
+      execFileSync("actionlint", [join(dir, ".github", "workflows", "chant-pr.yml")], { cwd: dir, stdio: "pipe" });
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+});

package/src/components/generate-pr-waves-pipeline.test.ts

@@ -51,7 +51,7 @@ function hasActionlint(): boolean {
 }
 
 describe("the GitHub pull-request workflow with a gate per wave (#4003)", () => {
-  const result = generateGithubPipeline(ESTATE, { env: "prod", prLoop: {}, gatedWaves: { gate: "release" } });
+  const result = generateGithubPipeline(ESTATE, { env: "prod", prLoop: { applyOnMerge: true }, gatedWaves: { gate: "release" } });
   const doc = parseYAML(result.yaml) as { jobs: Record<string, Job> };
 
   test("matches its golden", () => {
@@ -78,7 +78,7 @@ describe("the GitHub pull-request workflow with a gate per wave (#4003)", () =>
       expect(job.concurrency).toEqual({ group: "chant-apply-prod", "cancel-in-progress": false });
       expect(job.permissions.contents).toBe("write");
       const run = job.steps.find((s) => s.run?.includes("ci run apply"))!.run!;
-      // #4156: through chant ci run, which runs pr-apply --require-review --wave-gate release --resume ... --wave <k>.
+      // #4156: through chant ci run, which runs pr-apply --wave-gate release (no --require-review since #4168) --resume ... --wave <k>.
       expect(run).toContain(`chant ci run apply --in-place --base "$BASE_SHA" --env prod --gate pr-apply --forge github --wave-gate release --wave ${k}`);
       expect(job.steps.find((s) => s.run?.includes("ci run apply"))!.env?.CHANT_RUNNER_KEY).toBe("${{ secrets.CHANT_RUNNER_KEY }}");
     }
@@ -98,7 +98,7 @@ describe("the GitHub pull-request workflow with a gate per wave (#4003)", () =>
   });
 
   test("without --wave-gate the workflow is the one apply job it was", () => {
-    const plain = generateGithubPipeline(ESTATE, { env: "prod", prLoop: {} });
+    const plain = generateGithubPipeline(ESTATE, { env: "prod", prLoop: { applyOnMerge: true } });
     expect(plain.jobs.map((j) => j.jobName)).toEqual(["plan", "apply"]);
     expect(plain.yaml).not.toContain("--wave");
   });