@intentius/chant-lexicon-github 0.124.33 → 0.124.35

package/dist/components/generate-pipeline.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generate-pipeline.d.ts","sourceRoot":"","sources":["../../src/components/generate-pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AAEH,OAAO,EAAyB,KAAK,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAiBjG,OAAO,KAAK,EACV,oBAAoB,IAAI,YAAY,EACpC,wBAAwB,IAAI,qBAAqB,EACjD,uBAAuB,IAAI,oBAAoB,EAEhD,MAAM,0BAA0B,CAAC;AAGlC,YAAY,EAAE,YAAY,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,CAAC;AAE1E;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;;;OAKG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,6FAA6F;IAC7F,WAAW,EAAE,MAAM,CAAC;IACpB,8DAA8D;IAC9D,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5B,mIAAmI;IACnI,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC;;;;;;OAMG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,qDAAqD;IACrD,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,uEAAuE;IACvE,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,0DAA0D;IAC1D,IAAI,EAAE,YAAY,EAAE,CAAC;CACtB;AAuMD;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,CAWpD;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,eAAe,EAAE,EAC7B,OAAO,GAAE,qBAA0B,GAClC,iBAAiB,CA+JnB;AA4CD;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,iBAAiB,GAAG,MAAM,CAE/D;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,eAAe,EAAE,EAC7B,OAAO,GAAE,qBAA0B,GAClC,oBAAoB,CAGtB"}
+{"version":3,"file":"generate-pipeline.d.ts","sourceRoot":"","sources":["../../src/components/generate-pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AAEH,OAAO,EAAyB,KAAK,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAmBjG,OAAO,KAAK,EACV,oBAAoB,IAAI,YAAY,EACpC,wBAAwB,IAAI,qBAAqB,EACjD,uBAAuB,IAAI,oBAAoB,EAEhD,MAAM,0BAA0B,CAAC;AAGlC,YAAY,EAAE,YAAY,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,CAAC;AAE1E;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;;;OAKG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,6FAA6F;IAC7F,WAAW,EAAE,MAAM,CAAC;IACpB,8DAA8D;IAC9D,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5B,mIAAmI;IACnI,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC;;;;;;OAMG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,qDAAqD;IACrD,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,uEAAuE;IACvE,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,0DAA0D;IAC1D,IAAI,EAAE,YAAY,EAAE,CAAC;CACtB;AA+ND;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,CAWpD;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,eAAe,EAAE,EAC7B,OAAO,GAAE,qBAA0B,GAClC,iBAAiB,CA+JnB;AA4CD;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,iBAAiB,GAAG,MAAM,CAE/D;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,eAAe,EAAE,EAC7B,OAAO,GAAE,qBAA0B,GAClC,oBAAoB,CAGtB"}

package/dist/components/generate-pipeline.js

@@ -59,9 +59,12 @@ import { resolveComponentGraph } from "@intentius/chant/components/driver";
 import { hasPublishStep, promoteArchivePaths } from "@intentius/chant/components/promote";
 import { GATED_WAVE_RECORD, gatedWaveJobs } from "@intentius/chant/components/gated-wave-pipeline";
 import { CI_IMAGE, ciJobName, dirnameOf, fillCommand, GITHUB_RUNNER } from "@intentius/chant/ci-jobs";
-import { PR_APPLY_RECORD, PR_LOOP_REPORT_DIR, prApplyGroup, prRecordGroup, prApplyRecordKey, prApplyWaveJobName, prLoopJobs, prLoopSetup, prLoopWaveJobs, prLoopWithWaves, } from "@intentius/chant/components/pr-pipeline";
+import { GREEN_TAG_PATTERN, GREEN_TICK_WORKFLOW, PR_APPLY_RECORD, PR_LOOP_REPORT_DIR, prApplyGroup, prRecordGroup, prApplyRecordKey, prApplyWaveJobName, prLoopJobs, prLoopSetup, prLoopWaveJobs, prLoopWithWaves, } from "@intentius/chant/components/pr-pipeline";
 import { memberRepoPath } from "@intentius/chant/lexicon";
 import { checkoutStep, concurrency, downloadArtifactStep, emitWorkflowYAML, keepRecordStep, runSteps, UPLOAD_ARTIFACT } from "./ci-jobs.js";
+/** The output a gated apply wave hands the green commit it applies through, and the step that sets it (#4221). */
+const WAVE_GREEN_OUTPUT = "green-sha";
+const WAVE_STEP_ID = "apply";
 /** The workflow artifact the gated-wave jobs hand their attempt record through, one per wave. */
 function waveRecordArtifact(wave) {
     return `fan-out-record-wave-${wave}`;
@@ -164,7 +167,15 @@ function prLoopGithubDoc(components, env, image, beforeScript, extraScript, opti
         ...(job.jobName === "apply" ? [restoreRecord(job.wave)] : []),
         // The job's setup lines (#4004) run in the command's shell, so a value they settle reaches it.
         // The command runs through chant ci run (#4156), which writes the job's run record, signed when the CHANT_RUNNER_KEY secret is set.
-        { name, env: job.run.env, run: [...(job.setup ?? []), job.run.command].join("\n") },
+        // #4221: a wave job hands the commit it applies to the next wave as the job output `green-sha`.
+        job.wave
+            ? {
+                name,
+                id: WAVE_STEP_ID,
+                env: { ...job.run.env, ...(job.wave > 1 ? { GREEN_SHA: `\${{ needs.${prApplyWaveJobName(job.wave - 1)}.outputs.${WAVE_GREEN_OUTPUT} }}` } : {}) },
+                run: [...(job.checkout ?? []), `echo "${WAVE_GREEN_OUTPUT}=$GREEN_SHA" >> "$GITHUB_OUTPUT"`, ...(job.setup ?? []), job.run.command].join("\n"),
+            }
+            : { name, env: job.run.env, run: [...(job.checkout ?? []), ...(job.setup ?? []), job.run.command].join("\n") },
         ...runSteps(extraScript),
         ...(job.jobName === "apply" ? [saveRecord(job.wave)] : []),
         {
@@ -174,24 +185,31 @@ function prLoopGithubDoc(components, env, image, beforeScript, extraScript, opti
             with: { name: reportName(job), path: reportPath, "if-no-files-found": "ignore", "include-hidden-files": true },
         },
     ];
+    // #4168 step 9: under apply on merge the apply runs on a green signal, and a push to the branch records.
+    const forgejo = loop.forge === "forgejo";
+    const onGreen = forgejo ? "startsWith(github.ref, 'refs/tags/ci/green/')" : "github.event_name == 'workflow_run' || github.event_name == 'workflow_dispatch'";
+    const onPush = loop.applyOnMerge && forgejo ? "github.event_name == 'push' && startsWith(github.ref, 'refs/heads/')" : "github.event_name == 'push'";
     const applyJob = (job, needs, name) => ({
-        if: "github.event_name == 'push'",
+        if: job.jobName === "record" ? onPush : onGreen,
         "runs-on": GITHUB_RUNNER,
         ...(needs.length > 0 ? { needs } : {}),
         container: image,
         concurrency: concurrency(prApplyGroup(env, member?.name)),
         permissions: { contents: "write", "pull-requests": "write", statuses: "write" },
+        ...(job.wave ? { outputs: { [WAVE_GREEN_OUTPUT]: `\${{ steps.${WAVE_STEP_ID}.outputs.${WAVE_GREEN_OUTPUT} }}` } } : {}),
         steps: steps(job, name),
     });
     const waveJobs = loop.waveGate ? prLoopWaveJobs(components, apply) : [];
-    const applyJobs = loop.waveGate
+    const recordJob = ["record", { ...applyJob(record, [], "Record the plan on the merged commit; nothing applies"), concurrency: concurrency(prRecordGroup(env, member?.name)) }];
+    const greenJobs = loop.waveGate
         ? waveJobs.map((job) => [
             prApplyWaveJobName(job.wave),
-            applyJob(job, job.wave > 1 ? [prApplyWaveJobName(job.wave - 1)] : [], `Apply wave ${job.wave}, under the approval its plan has`),
+            applyJob(job, job.wave > 1 ? [prApplyWaveJobName(job.wave - 1)] : [], job.wave === 1 ? "Apply wave 1 of the newest green commit, under the approval its plan has" : `Apply wave ${job.wave} of the green commit wave 1 took, under the approval its plan has`),
         ])
         : loop.applyOnMerge
-            ? [["apply", applyJob(apply, [], "Apply the plan a reviewer approved")]]
-            : [["record", { ...applyJob(record, [], "Record the plan on the merged commit; nothing applies"), concurrency: concurrency(prRecordGroup(env, member?.name)) }]];
+            ? [["apply", applyJob(apply, [], "Apply the newest green commit under the merged changes' approvals")]]
+            : [];
+    const applyJobs = [recordJob, ...greenJobs];
     const jobsDoc = {
         plan: {
             if: "github.event_name == 'pull_request'",
@@ -206,7 +224,11 @@ function prLoopGithubDoc(components, env, image, beforeScript, extraScript, opti
     return {
         name: member ? `chant-pr.${member.name}.${env}` : `chant-pr-${env}`,
         environment: env,
-        on: { pull_request: { branches: [branch] }, push: { branches: [branch] } },
+        on: !loop.applyOnMerge
+            ? { pull_request: { branches: [branch] }, push: { branches: [branch] } }
+            : forgejo
+                ? { pull_request: { branches: [branch] }, push: { branches: [branch], tags: [GREEN_TAG_PATTERN] } }
+                : { pull_request: { branches: [branch] }, push: { branches: [branch] }, workflow_run: { workflows: [GREEN_TICK_WORKFLOW], types: ["completed"] }, workflow_dispatch: {} },
         ...(rooted ? {} : { defaults: { run: { "working-directory": member.dir } } }),
         env: { ...options.variables, CHANT_ENV: env },
         jobsDoc,
@@ -215,9 +237,10 @@ function prLoopGithubDoc(components, env, image, beforeScript, extraScript, opti
             { jobName: "plan", component: "pull request plan", stage: "plan", needs: [] },
             ...applyNames.map((name, i) => ({
                 jobName: name,
-                component: loop.waveGate ? `pull request apply, wave ${i + 1}` : loop.applyOnMerge ? "pull request apply" : "merge record",
+                component: name === "record" ? "merge record" : loop.waveGate ? `green apply, wave ${i}` : "green apply",
                 stage: name,
-                needs: i > 0 ? [applyNames[i - 1]] : [],
+                // The record runs on a push and the apply on a green commit, so only the waves need each other.
+                needs: i > 1 ? [applyNames[i - 1]] : [],
             })),
         ],
     };

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "9c78c00139143cc8d96fd21acb1eff97778c2bf41264338ef1b8db4c21397e78",
+    "manifest.json": "3090b1e50a456840a260fd6554142bfa22caa3357a0bbdcbbb52d8cf8852a3bd",
     "meta.json": "c50e0ef3845c370c3ad2210b8bba455980417c0f818aa6ed46e06d4fb8b1b9f9",
     "types/index.d.ts": "0ead95536e947ddfb98a5acf0ddb88547913b5a53a342df67711c59266f84b3e",
     "rules/deprecated-action-version.ts": "a9ba7cc924ff1c7055110416d8989273690415bfb5e8dcc32dc9431b9351f5ca",
@@ -78,5 +78,5 @@
     "skills/chant-github-patterns.md": "bb3abef289a8fdfcf07d6bb2d7289dcb2f38bc0cb0321ea320b78b45a6f548c0",
     "skills/chant-github-security.md": "aab111cb0871cad30281ce48d7da23663689619351029219e2be019a1a61e394"
   },
-  "composite": "eccd339f1b356ff129a1d9808a859812e5158c02e021b09b877469f242e9a8b7"
+  "composite": "76bee507e1094451f0435711785b080f9d494a9aacb86319f3f2f40c84d24433"
 }

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "github",
-  "version": "0.124.33",
+  "version": "0.124.35",
   "chantVersion": ">=0.1.0",
   "namespace": "GitHub",
   "intrinsics": [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-github",
-  "version": "0.124.33",
+  "version": "0.124.35",
   "description": "GitHub Actions lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -61,6 +61,6 @@
     "typescript": "^5.9.3"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.124.33"
+    "@intentius/chant": "^0.124.35"
   }
 }

package/src/components/__fixtures__/pr-loop-build.github.golden.yml

@@ -7,6 +7,12 @@ on:
   push:
     branches:
       - main
+  workflow_run:
+    workflows:
+      - chant-ci-green
+    types:
+      - completed
+  workflow_dispatch: {}
 
 env:
   CHANT_ENV: prod
@@ -44,10 +50,46 @@ jobs:
           path: .chant/pr
           if-no-files-found: ignore
           include-hidden-files: true
-  apply:
+  record:
     if: github.event_name == 'push'
     runs-on: ubuntu-latest
     container: node:22
+    concurrency:
+      group: chant-record-prod
+      cancel-in-progress: false
+    permissions:
+      contents: write
+      pull-requests: write
+      statuses: write
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+      - run: command -v tofu >/dev/null 2>&1 || (curl -fsSL https://get.opentofu.org/install-opentofu.sh -o /tmp/install-opentofu.sh && sh /tmp/install-opentofu.sh --install-method standalone)
+      - name: Build the templates
+        run: chant build --env prod
+      - name: Lint the project
+        run: chant lint
+      - name: Record the plan on the merged commit; nothing applies
+        env:
+          BASE_SHA: '${{ github.event.before }}'
+          GITHUB_TOKEN: '${{ github.token }}'
+          CHANT_RUNNER_KEY: '${{ secrets.CHANT_RUNNER_KEY }}'
+        run: |
+          if [ -z "$BASE_SHA" ] || [ "$BASE_SHA" = "0000000000000000000000000000000000000000" ]; then git fetch origin "main" && BASE_SHA="$(git merge-base FETCH_HEAD "$GITHUB_SHA")"; if [ "$BASE_SHA" = "$GITHUB_SHA" ]; then BASE_SHA="$(git rev-parse --verify --quiet "$GITHUB_SHA^" || echo 4b825dc642cb6eb9a060e54bf8d69288fbee4904)"; fi; fi; export BASE_SHA
+          chant ci run record --in-place --base "$BASE_SHA" --env prod --gate pr-apply --forge github
+      - name: Keep the record report
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: chant-pr-record
+          path: .chant/pr
+          if-no-files-found: ignore
+          include-hidden-files: true
+  apply:
+    if: github.event_name == 'workflow_run' || github.event_name == 'workflow_dispatch'
+    runs-on: ubuntu-latest
+    container: node:22
     concurrency:
       group: chant-apply-prod
       cancel-in-progress: false
@@ -70,14 +112,13 @@ jobs:
           path: .chant/pr-resume/pr-apply.json
           key: chant-apply-prod-${{ github.sha }}-${{ github.run_id }}-${{ github.run_attempt }}
           restore-keys: chant-apply-prod-${{ github.sha }}-
-      - name: Apply the plan a reviewer approved
+      - name: Apply the newest green commit under the merged changes' approvals
         env:
-          BASE_SHA: '${{ github.event.before }}'
           GITHUB_TOKEN: '${{ github.token }}'
           CHANT_RUNNER_KEY: '${{ secrets.CHANT_RUNNER_KEY }}'
         run: |
-          if [ -z "$BASE_SHA" ] || [ "$BASE_SHA" = "0000000000000000000000000000000000000000" ]; then git fetch origin "main" && BASE_SHA="$(git merge-base FETCH_HEAD "$GITHUB_SHA")"; if [ "$BASE_SHA" = "$GITHUB_SHA" ]; then BASE_SHA="$(git rev-parse --verify --quiet "$GITHUB_SHA^" || echo 4b825dc642cb6eb9a060e54bf8d69288fbee4904)"; fi; fi; export BASE_SHA
-          chant ci run apply --in-place --base "$BASE_SHA" --env prod --gate pr-apply --forge github
+          git fetch --quiet --tags origin "+refs/heads/main:refs/remotes/origin/main" && GREEN_SHA="$(chant ci last-green)" && git checkout --quiet --detach "$GREEN_SHA"
+          chant ci run apply --in-place --env prod --gate pr-apply --forge github
       - name: Keep the record for a re-run
         if: always()
         uses: actions/cache/save@v4

package/src/components/__fixtures__/pr-loop-waves.github.golden.yml

@@ -7,6 +7,12 @@ on:
   push:
     branches:
       - main
+  workflow_run:
+    workflows:
+      - chant-ci-green
+    types:
+      - completed
+  workflow_dispatch: {}
 
 env:
   CHANT_ENV: prod
@@ -40,10 +46,42 @@ jobs:
           path: .chant/pr
           if-no-files-found: ignore
           include-hidden-files: true
-  apply-wave-1:
+  record:
     if: github.event_name == 'push'
     runs-on: ubuntu-latest
     container: node:22
+    concurrency:
+      group: chant-record-prod
+      cancel-in-progress: false
+    permissions:
+      contents: write
+      pull-requests: write
+      statuses: write
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+      - run: command -v tofu >/dev/null 2>&1 || (curl -fsSL https://get.opentofu.org/install-opentofu.sh -o /tmp/install-opentofu.sh && sh /tmp/install-opentofu.sh --install-method standalone)
+      - name: Record the plan on the merged commit; nothing applies
+        env:
+          BASE_SHA: '${{ github.event.before }}'
+          GITHUB_TOKEN: '${{ github.token }}'
+          CHANT_RUNNER_KEY: '${{ secrets.CHANT_RUNNER_KEY }}'
+        run: |
+          if [ -z "$BASE_SHA" ] || [ "$BASE_SHA" = "0000000000000000000000000000000000000000" ]; then git fetch origin "main" && BASE_SHA="$(git merge-base FETCH_HEAD "$GITHUB_SHA")"; if [ "$BASE_SHA" = "$GITHUB_SHA" ]; then BASE_SHA="$(git rev-parse --verify --quiet "$GITHUB_SHA^" || echo 4b825dc642cb6eb9a060e54bf8d69288fbee4904)"; fi; fi; export BASE_SHA
+          chant ci run record --in-place --base "$BASE_SHA" --env prod --gate pr-apply --forge github
+      - name: Keep the record report
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: chant-pr-record
+          path: .chant/pr
+          if-no-files-found: ignore
+          include-hidden-files: true
+  apply-wave-1:
+    if: github.event_name == 'workflow_run' || github.event_name == 'workflow_dispatch'
+    runs-on: ubuntu-latest
+    container: node:22
     concurrency:
       group: chant-apply-prod
       cancel-in-progress: false
@@ -51,6 +89,8 @@ jobs:
       contents: write
       pull-requests: write
       statuses: write
+    outputs:
+      green-sha: '${{ steps.apply.outputs.green-sha }}'
     steps:
       - uses: actions/checkout@v7
         with:
@@ -62,14 +102,15 @@ jobs:
           path: .chant/pr-resume/pr-apply.json
           key: chant-apply-prod-${{ github.sha }}-${{ github.run_id }}-${{ github.run_attempt }}-wave-1
           restore-keys: chant-apply-prod-${{ github.sha }}-
-      - name: Apply wave 1, under the approval its plan has
+      - name: Apply wave 1 of the newest green commit, under the approval its plan has
+        id: apply
         env:
-          BASE_SHA: '${{ github.event.before }}'
           GITHUB_TOKEN: '${{ github.token }}'
           CHANT_RUNNER_KEY: '${{ secrets.CHANT_RUNNER_KEY }}'
         run: |
-          if [ -z "$BASE_SHA" ] || [ "$BASE_SHA" = "0000000000000000000000000000000000000000" ]; then git fetch origin "main" && BASE_SHA="$(git merge-base FETCH_HEAD "$GITHUB_SHA")"; if [ "$BASE_SHA" = "$GITHUB_SHA" ]; then BASE_SHA="$(git rev-parse --verify --quiet "$GITHUB_SHA^" || echo 4b825dc642cb6eb9a060e54bf8d69288fbee4904)"; fi; fi; export BASE_SHA
-          chant ci run apply --in-place --base "$BASE_SHA" --env prod --gate pr-apply --forge github --wave-gate release --wave 1
+          git fetch --quiet --tags origin "+refs/heads/main:refs/remotes/origin/main" && GREEN_SHA="$(chant ci last-green)" && git checkout --quiet --detach "$GREEN_SHA"
+          echo "green-sha=$GREEN_SHA" >> "$GITHUB_OUTPUT"
+          chant ci run apply --in-place --env prod --gate pr-apply --forge github --wave-gate release --wave 1
       - name: Keep the record for the next wave and a re-run
         if: always()
         uses: actions/cache/save@v4
@@ -85,7 +126,7 @@ jobs:
           if-no-files-found: ignore
           include-hidden-files: true
   apply-wave-2:
-    if: github.event_name == 'push'
+    if: github.event_name == 'workflow_run' || github.event_name == 'workflow_dispatch'
     runs-on: ubuntu-latest
     needs:
       - apply-wave-1
@@ -97,6 +138,8 @@ jobs:
       contents: write
       pull-requests: write
       statuses: write
+    outputs:
+      green-sha: '${{ steps.apply.outputs.green-sha }}'
     steps:
       - uses: actions/checkout@v7
         with:
@@ -108,14 +151,16 @@ jobs:
           path: .chant/pr-resume/pr-apply.json
           key: chant-apply-prod-${{ github.sha }}-${{ github.run_id }}-${{ github.run_attempt }}-wave-2
           restore-keys: chant-apply-prod-${{ github.sha }}-
-      - name: Apply wave 2, under the approval its plan has
+      - name: Apply wave 2 of the green commit wave 1 took, under the approval its plan has
+        id: apply
         env:
-          BASE_SHA: '${{ github.event.before }}'
           GITHUB_TOKEN: '${{ github.token }}'
           CHANT_RUNNER_KEY: '${{ secrets.CHANT_RUNNER_KEY }}'
+          GREEN_SHA: '${{ needs.apply-wave-1.outputs.green-sha }}'
         run: |
-          if [ -z "$BASE_SHA" ] || [ "$BASE_SHA" = "0000000000000000000000000000000000000000" ]; then git fetch origin "main" && BASE_SHA="$(git merge-base FETCH_HEAD "$GITHUB_SHA")"; if [ "$BASE_SHA" = "$GITHUB_SHA" ]; then BASE_SHA="$(git rev-parse --verify --quiet "$GITHUB_SHA^" || echo 4b825dc642cb6eb9a060e54bf8d69288fbee4904)"; fi; fi; export BASE_SHA
-          chant ci run apply --in-place --base "$BASE_SHA" --env prod --gate pr-apply --forge github --wave-gate release --wave 2
+          test -n "$GREEN_SHA" && git fetch --quiet --tags origin "+refs/heads/main:refs/remotes/origin/main" && git checkout --quiet --detach "$GREEN_SHA"
+          echo "green-sha=$GREEN_SHA" >> "$GITHUB_OUTPUT"
+          chant ci run apply --in-place --env prod --gate pr-apply --forge github --wave-gate release --wave 2
       - name: Keep the record for the next wave and a re-run
         if: always()
         uses: actions/cache/save@v4
@@ -131,7 +176,7 @@ jobs:
           if-no-files-found: ignore
           include-hidden-files: true
   apply-wave-3:
-    if: github.event_name == 'push'
+    if: github.event_name == 'workflow_run' || github.event_name == 'workflow_dispatch'
     runs-on: ubuntu-latest
     needs:
       - apply-wave-2
@@ -143,6 +188,8 @@ jobs:
       contents: write
       pull-requests: write
       statuses: write
+    outputs:
+      green-sha: '${{ steps.apply.outputs.green-sha }}'
     steps:
       - uses: actions/checkout@v7
         with:
@@ -154,14 +201,16 @@ jobs:
           path: .chant/pr-resume/pr-apply.json
           key: chant-apply-prod-${{ github.sha }}-${{ github.run_id }}-${{ github.run_attempt }}-wave-3
           restore-keys: chant-apply-prod-${{ github.sha }}-
-      - name: Apply wave 3, under the approval its plan has
+      - name: Apply wave 3 of the green commit wave 1 took, under the approval its plan has
+        id: apply
         env:
-          BASE_SHA: '${{ github.event.before }}'
           GITHUB_TOKEN: '${{ github.token }}'
           CHANT_RUNNER_KEY: '${{ secrets.CHANT_RUNNER_KEY }}'
+          GREEN_SHA: '${{ needs.apply-wave-2.outputs.green-sha }}'
         run: |
-          if [ -z "$BASE_SHA" ] || [ "$BASE_SHA" = "0000000000000000000000000000000000000000" ]; then git fetch origin "main" && BASE_SHA="$(git merge-base FETCH_HEAD "$GITHUB_SHA")"; if [ "$BASE_SHA" = "$GITHUB_SHA" ]; then BASE_SHA="$(git rev-parse --verify --quiet "$GITHUB_SHA^" || echo 4b825dc642cb6eb9a060e54bf8d69288fbee4904)"; fi; fi; export BASE_SHA
-          chant ci run apply --in-place --base "$BASE_SHA" --env prod --gate pr-apply --forge github --wave-gate release --wave 3
+          test -n "$GREEN_SHA" && git fetch --quiet --tags origin "+refs/heads/main:refs/remotes/origin/main" && git checkout --quiet --detach "$GREEN_SHA"
+          echo "green-sha=$GREEN_SHA" >> "$GITHUB_OUTPUT"
+          chant ci run apply --in-place --env prod --gate pr-apply --forge github --wave-gate release --wave 3
       - name: Keep the record for the next wave and a re-run
         if: always()
         uses: actions/cache/save@v4

package/src/components/__fixtures__/pr-loop.github.golden.yml

@@ -7,6 +7,12 @@ on:
   push:
     branches:
       - main
+  workflow_run:
+    workflows:
+      - chant-ci-green
+    types:
+      - completed
+  workflow_dispatch: {}
 
 env:
   CHANT_ENV: prod
@@ -40,10 +46,42 @@ jobs:
           path: .chant/pr
           if-no-files-found: ignore
           include-hidden-files: true
-  apply:
+  record:
     if: github.event_name == 'push'
     runs-on: ubuntu-latest
     container: node:22
+    concurrency:
+      group: chant-record-prod
+      cancel-in-progress: false
+    permissions:
+      contents: write
+      pull-requests: write
+      statuses: write
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+      - run: command -v tofu >/dev/null 2>&1 || (curl -fsSL https://get.opentofu.org/install-opentofu.sh -o /tmp/install-opentofu.sh && sh /tmp/install-opentofu.sh --install-method standalone)
+      - name: Record the plan on the merged commit; nothing applies
+        env:
+          BASE_SHA: '${{ github.event.before }}'
+          GITHUB_TOKEN: '${{ github.token }}'
+          CHANT_RUNNER_KEY: '${{ secrets.CHANT_RUNNER_KEY }}'
+        run: |
+          if [ -z "$BASE_SHA" ] || [ "$BASE_SHA" = "0000000000000000000000000000000000000000" ]; then git fetch origin "main" && BASE_SHA="$(git merge-base FETCH_HEAD "$GITHUB_SHA")"; if [ "$BASE_SHA" = "$GITHUB_SHA" ]; then BASE_SHA="$(git rev-parse --verify --quiet "$GITHUB_SHA^" || echo 4b825dc642cb6eb9a060e54bf8d69288fbee4904)"; fi; fi; export BASE_SHA
+          chant ci run record --in-place --base "$BASE_SHA" --env prod --gate pr-apply --forge github
+      - name: Keep the record report
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: chant-pr-record
+          path: .chant/pr
+          if-no-files-found: ignore
+          include-hidden-files: true
+  apply:
+    if: github.event_name == 'workflow_run' || github.event_name == 'workflow_dispatch'
+    runs-on: ubuntu-latest
+    container: node:22
     concurrency:
       group: chant-apply-prod
       cancel-in-progress: false
@@ -62,14 +100,13 @@ jobs:
           path: .chant/pr-resume/pr-apply.json
           key: chant-apply-prod-${{ github.sha }}-${{ github.run_id }}-${{ github.run_attempt }}
           restore-keys: chant-apply-prod-${{ github.sha }}-
-      - name: Apply the plan a reviewer approved
+      - name: Apply the newest green commit under the merged changes' approvals
         env:
-          BASE_SHA: '${{ github.event.before }}'
           GITHUB_TOKEN: '${{ github.token }}'
           CHANT_RUNNER_KEY: '${{ secrets.CHANT_RUNNER_KEY }}'
         run: |
-          if [ -z "$BASE_SHA" ] || [ "$BASE_SHA" = "0000000000000000000000000000000000000000" ]; then git fetch origin "main" && BASE_SHA="$(git merge-base FETCH_HEAD "$GITHUB_SHA")"; if [ "$BASE_SHA" = "$GITHUB_SHA" ]; then BASE_SHA="$(git rev-parse --verify --quiet "$GITHUB_SHA^" || echo 4b825dc642cb6eb9a060e54bf8d69288fbee4904)"; fi; fi; export BASE_SHA
-          chant ci run apply --in-place --base "$BASE_SHA" --env prod --gate pr-apply --forge github
+          git fetch --quiet --tags origin "+refs/heads/main:refs/remotes/origin/main" && GREEN_SHA="$(chant ci last-green)" && git checkout --quiet --detach "$GREEN_SHA"
+          chant ci run apply --in-place --env prod --gate pr-apply --forge github
       - name: Keep the record for a re-run
         if: always()
         uses: actions/cache/save@v4

package/src/components/generate-pipeline.ts

@@ -61,6 +61,8 @@ import { hasPublishStep, promoteArchivePaths } from "@intentius/chant/components
 import { GATED_WAVE_RECORD, gatedWaveJobs } from "@intentius/chant/components/gated-wave-pipeline";
 import { CI_IMAGE, ciJobName, dirnameOf, fillCommand, GITHUB_RUNNER } from "@intentius/chant/ci-jobs";
 import {
+  GREEN_TAG_PATTERN,
+  GREEN_TICK_WORKFLOW,
   PR_APPLY_RECORD,
   PR_LOOP_REPORT_DIR,
   prApplyGroup,
@@ -120,6 +122,10 @@ export interface GithubPipelineDoc {
   jobs: GeneratedJob[];
 }
 
+/** The output a gated apply wave hands the green commit it applies through, and the step that sets it (#4221). */
+const WAVE_GREEN_OUTPUT = "green-sha";
+const WAVE_STEP_ID = "apply";
+
 /** The workflow artifact the gated-wave jobs hand their attempt record through, one per wave. */
 function waveRecordArtifact(wave: number): string {
   return `fan-out-record-wave-${wave}`;
@@ -238,7 +244,15 @@ function prLoopGithubDoc(
     ...(job.jobName === "apply" ? [restoreRecord(job.wave)] : []),
     // The job's setup lines (#4004) run in the command's shell, so a value they settle reaches it.
     // The command runs through chant ci run (#4156), which writes the job's run record, signed when the CHANT_RUNNER_KEY secret is set.
-    { name, env: job.run.env, run: [...(job.setup ?? []), job.run.command].join("\n") },
+    // #4221: a wave job hands the commit it applies to the next wave as the job output `green-sha`.
+    job.wave
+      ? {
+          name,
+          id: WAVE_STEP_ID,
+          env: { ...job.run.env, ...(job.wave > 1 ? { GREEN_SHA: `\${{ needs.${prApplyWaveJobName(job.wave - 1)}.outputs.${WAVE_GREEN_OUTPUT} }}` } : {}) },
+          run: [...(job.checkout ?? []), `echo "${WAVE_GREEN_OUTPUT}=$GREEN_SHA" >> "$GITHUB_OUTPUT"`, ...(job.setup ?? []), job.run.command].join("\n"),
+        }
+      : { name, env: job.run.env, run: [...(job.checkout ?? []), ...(job.setup ?? []), job.run.command].join("\n") },
     ...runSteps(extraScript),
     ...(job.jobName === "apply" ? [saveRecord(job.wave)] : []),
     {
@@ -248,24 +262,31 @@ function prLoopGithubDoc(
       with: { name: reportName(job), path: reportPath, "if-no-files-found": "ignore", "include-hidden-files": true },
     },
   ];
+  // #4168 step 9: under apply on merge the apply runs on a green signal, and a push to the branch records.
+  const forgejo = loop.forge === "forgejo";
+  const onGreen = forgejo ? "startsWith(github.ref, 'refs/tags/ci/green/')" : "github.event_name == 'workflow_run' || github.event_name == 'workflow_dispatch'";
+  const onPush = loop.applyOnMerge && forgejo ? "github.event_name == 'push' && startsWith(github.ref, 'refs/heads/')" : "github.event_name == 'push'";
   const applyJob = (job: typeof plan, needs: string[], name: string) => ({
-    if: "github.event_name == 'push'",
+    if: job.jobName === "record" ? onPush : onGreen,
     "runs-on": GITHUB_RUNNER,
     ...(needs.length > 0 ? { needs } : {}),
     container: image,
     concurrency: concurrency(prApplyGroup(env, member?.name)),
     permissions: { contents: "write", "pull-requests": "write", statuses: "write" },
+    ...(job.wave ? { outputs: { [WAVE_GREEN_OUTPUT]: `\${{ steps.${WAVE_STEP_ID}.outputs.${WAVE_GREEN_OUTPUT} }}` } } : {}),
     steps: steps(job, name),
   });
   const waveJobs = loop.waveGate ? prLoopWaveJobs(components, apply) : [];
-  const applyJobs: Array<[string, Record<string, unknown>]> = loop.waveGate
+  const recordJob: [string, Record<string, unknown>] = ["record", { ...applyJob(record, [], "Record the plan on the merged commit; nothing applies"), concurrency: concurrency(prRecordGroup(env, member?.name)) }];
+  const greenJobs: Array<[string, Record<string, unknown>]> = loop.waveGate
     ? waveJobs.map((job) => [
         prApplyWaveJobName(job.wave!),
-        applyJob(job, job.wave! > 1 ? [prApplyWaveJobName(job.wave! - 1)] : [], `Apply wave ${job.wave}, under the approval its plan has`),
+        applyJob(job, job.wave! > 1 ? [prApplyWaveJobName(job.wave! - 1)] : [], job.wave === 1 ? "Apply wave 1 of the newest green commit, under the approval its plan has" : `Apply wave ${job.wave} of the green commit wave 1 took, under the approval its plan has`),
       ])
     : loop.applyOnMerge
-      ? [["apply", applyJob(apply, [], "Apply the plan a reviewer approved")]]
-      : [["record", { ...applyJob(record, [], "Record the plan on the merged commit; nothing applies"), concurrency: concurrency(prRecordGroup(env, member?.name)) }]];
+      ? [["apply", applyJob(apply, [], "Apply the newest green commit under the merged changes' approvals")]]
+      : [];
+  const applyJobs: Array<[string, Record<string, unknown>]> = [recordJob, ...greenJobs];
   const jobsDoc: Record<string, unknown> = {
     plan: {
       if: "github.event_name == 'pull_request'",
@@ -280,7 +301,11 @@ function prLoopGithubDoc(
   return {
     name: member ? `chant-pr.${member.name}.${env}` : `chant-pr-${env}`,
     environment: env,
-    on: { pull_request: { branches: [branch] }, push: { branches: [branch] } },
+    on: !loop.applyOnMerge
+      ? { pull_request: { branches: [branch] }, push: { branches: [branch] } }
+      : forgejo
+        ? { pull_request: { branches: [branch] }, push: { branches: [branch], tags: [GREEN_TAG_PATTERN] } }
+        : { pull_request: { branches: [branch] }, push: { branches: [branch] }, workflow_run: { workflows: [GREEN_TICK_WORKFLOW], types: ["completed"] }, workflow_dispatch: {} },
     ...(rooted ? {} : { defaults: { run: { "working-directory": member!.dir } } }),
     env: { ...options.variables, CHANT_ENV: env },
     jobsDoc,
@@ -289,9 +314,10 @@ function prLoopGithubDoc(
       { jobName: "plan", component: "pull request plan", stage: "plan", needs: [] },
       ...applyNames.map((name, i) => ({
         jobName: name,
-        component: loop.waveGate ? `pull request apply, wave ${i + 1}` : loop.applyOnMerge ? "pull request apply" : "merge record",
+        component: name === "record" ? "merge record" : loop.waveGate ? `green apply, wave ${i}` : "green apply",
         stage: name,
-        needs: i > 0 ? [applyNames[i - 1]] : [],
+        // The record runs on a push and the apply on a green commit, so only the waves need each other.
+        needs: i > 1 ? [applyNames[i - 1]] : [],
       })),
     ],
   };

package/src/components/generate-pr-pipeline.test.ts

@@ -11,7 +11,7 @@ import { join } from "node:path";
 import { describe, expect, test } from "vitest";
 import { parseYAML } from "@intentius/chant/yaml";
 import type { DriverComponent } from "@intentius/chant/components/driver";
-import { githubBaseFallback, prApplyGroup, prApplyRecordKey, prLoopJobs } from "@intentius/chant/components/pr-pipeline";
+import { githubBaseFallback, greenCheckout, prApplyGroup, prApplyRecordKey, prLoopJobs } from "@intentius/chant/components/pr-pipeline";
 import { generateGithubPipeline } from "./generate-pipeline";
 
 const ESTATE: DriverComponent[] = [
@@ -54,12 +54,15 @@ describe("the GitHub pull-request workflow", () => {
     expect(result.yaml).toBe(readFileSync(GOLDEN, "utf-8"));
   });
 
-  test("plans on a pull request into main and applies on a push to it", () => {
+  test("plans on a pull request into main, records on a push to it, and applies once the tick ran (#4168 step 9)", () => {
     expect(doc.name).toBe("chant-pr-prod");
-    expect(doc.on).toEqual({ pull_request: { branches: ["main"] }, push: { branches: ["main"] } });
+    // A tag the tick pushes with the job token starts no workflow, so the apply follows the tick's workflow instead.
+    expect(doc.on).toEqual({ pull_request: { branches: ["main"] }, push: { branches: ["main"] }, workflow_run: { workflows: ["chant-ci-green"], types: ["completed"] }, workflow_dispatch: {} });
     expect(doc.jobs.plan.if).toBe("github.event_name == 'pull_request'");
-    expect(doc.jobs.apply.if).toBe("github.event_name == 'push'");
-    expect(result.jobs.map((j) => j.jobName)).toEqual(["plan", "apply"]);
+    expect(doc.jobs.record.if).toBe("github.event_name == 'push'");
+    expect(doc.jobs.apply.if).toBe("github.event_name == 'workflow_run' || github.event_name == 'workflow_dispatch'");
+    expect(result.jobs.map((j) => j.jobName)).toEqual(["plan", "record", "apply"]);
+    expect(result.jobs.find((j) => j.jobName === "apply")!.needs).toEqual([]);
   });
 
   test("the plan job measures from the pull request's base and cannot push; the apply job can, one at a time", () => {
@@ -75,26 +78,35 @@ describe("the GitHub pull-request workflow", () => {
     // #4168: ci run builds pr-apply without --require-review unless the pipeline asks for it.
     expect(apply.run).not.toContain("--require-review");
     expect(apply.run).not.toContain("--no-push");
-    expect(apply.env).toMatchObject({ BASE_SHA: "${{ github.event.before }}", CHANT_RUNNER_KEY: "${{ secrets.CHANT_RUNNER_KEY }}" });
+    // #4168 step 9: the apply measures from the last applied green commit, so it reads no push base.
+    expect(apply.env).toEqual({ GITHUB_TOKEN: "${{ github.token }}", CHANT_RUNNER_KEY: "${{ secrets.CHANT_RUNNER_KEY }}" });
     expect(doc.jobs.apply.permissions.contents).toBe("write");
     expect(doc.jobs.apply.concurrency).toEqual({ group: "chant-apply-prod", "cancel-in-progress": false });
     for (const job of Object.values(doc.jobs)) expect(job.steps[0].with).toEqual({ "fetch-depth": 0 });
   });
 
-  test("a first push's all-zero github.event.before is settled in the apply's own shell, before pr-apply reads it (#4004)", () => {
-    const apply = doc.jobs.apply.steps.find((s) => s.run?.includes("ci run apply"))!;
-    const lines = apply.run!.trimEnd().split("\n");
+  test("a first push's all-zero github.event.before is settled in the record's own shell, before pr-record reads it (#4004)", () => {
+    const record = doc.jobs.record.steps.find((s) => s.run?.includes("ci run record"))!;
+    const lines = record.run!.trimEnd().split("\n");
     expect(lines).toHaveLength(2);
     expect(lines[0]).toBe(githubBaseFallback());
     expect(lines[0]).toContain('[ "$BASE_SHA" = "0000000000000000000000000000000000000000" ]');
     expect(lines[0]).toContain('git merge-base FETCH_HEAD "$GITHUB_SHA"');
-    expect(lines[1]).toMatch(/^chant ci run apply --in-place --base "\$BASE_SHA"/);
-    const trunk = parseYAML(generateGithubPipeline(ESTATE, { env: "prod", prLoop: { applyOnMerge: true, branch: "trunk" } }).yaml) as { jobs: Record<string, Job> };
-    expect(trunk.jobs.apply.steps.find((s) => s.run?.includes("ci run apply"))!.run).toContain('git fetch origin "trunk"');
+    expect(lines[1]).toMatch(/^chant ci run record --in-place --base "\$BASE_SHA"/);
     const plan = doc.jobs.plan.steps.find((s) => s.run?.includes("ci run plan"))!;
     expect(plan.run).not.toContain("0000000000000000000000000000000000000000");
   });
 
+  test("the apply checks out the newest green commit of the branch before it runs (#4168 step 9)", () => {
+    const apply = doc.jobs.apply.steps.find((s) => s.run?.includes("ci run apply"))!;
+    const lines = apply.run!.trimEnd().split("\n");
+    expect(lines).toEqual([greenCheckout('"main"'), "chant ci run apply --in-place --env prod --gate pr-apply --forge github"]);
+    expect(lines[0]).toContain('GREEN_SHA="$(chant ci last-green)"');
+    const trunk = parseYAML(generateGithubPipeline(ESTATE, { env: "prod", prLoop: { applyOnMerge: true, branch: "trunk" } }).yaml) as { jobs: Record<string, Job> };
+    expect(trunk.jobs.apply.steps.find((s) => s.run?.includes("ci run apply"))!.run).toContain('"+refs/heads/trunk:refs/remotes/origin/trunk"');
+    expect(prLoopJobs("github", "prod")[1]!.command).toMatch(/^chant components pr-apply --green /);
+  });
+
   test("the apply resumes from a record the cache keeps for the pushed commit across a re-run (#3543)", () => {
     const steps = doc.jobs.apply.steps;
     const restore = steps.findIndex((s) => s.uses === "actions/cache/restore@v4");
@@ -130,7 +142,7 @@ describe("the GitHub pull-request workflow", () => {
     const yaml = generateGithubPipeline(ESTATE, { env: "prod", prLoop: { applyOnMerge: true, gate: "infra-apply", branch: "trunk", requireReview: true } }).yaml;
     expect(yaml).toContain("--gate infra-apply");
     expect(yaml).toContain("- trunk");
-    expect(yaml).toContain("ci run apply --in-place --base \"$BASE_SHA\" --env prod --gate infra-apply --forge github --branch \"trunk\" --require-review");
+    expect(yaml).toContain("ci run apply --in-place --env prod --gate infra-apply --forge github --branch \"trunk\" --require-review");
     expect(yaml).toContain('--branch "trunk"');
   });
 
@@ -163,7 +175,7 @@ describe("the GitHub pull-request workflow", () => {
     };
     expect(mdoc.name).toBe("chant-pr.network.prod");
     // No path filter: a change outside the member can reach it.
-    expect(mdoc.on).toEqual({ pull_request: { branches: ["main"] }, push: { branches: ["main"] } });
+    expect(mdoc.on).toEqual({ pull_request: { branches: ["main"] }, push: { branches: ["main"] }, workflow_run: { workflows: ["chant-ci-green"], types: ["completed"] }, workflow_dispatch: {} });
     expect(mdoc.defaults).toEqual({ run: { "working-directory": "infra/network" } });
     const plan = mdoc.jobs.plan.steps.find((s) => s.run?.includes("ci run plan"))!;
     // ci run finds the member from the directory it runs in and passes --member to pr-plan and pr-apply.

package/src/components/generate-pr-waves-pipeline.test.ts

@@ -59,10 +59,31 @@ describe("the GitHub pull-request workflow with a gate per wave (#4003)", () =>
     expect(result.yaml).toBe(readFileSync(GOLDEN, "utf-8"));
   });
 
-  test("keeps the plan job, and writes one apply job per wave, each needing the one before", () => {
-    expect(Object.keys(doc.jobs)).toEqual(["plan", "apply-wave-1", "apply-wave-2", "apply-wave-3"]);
+  test("wave 1 takes the newest green commit, and each later wave applies the one wave 1 took (#4221)", () => {
+    const jobs = doc.jobs as unknown as Record<string, { outputs?: Record<string, string>; steps: Array<{ id?: string; run?: string; env?: Record<string, string> }> }>;
+    const waves = Object.keys(jobs).filter((name) => name.startsWith("apply-wave-")).length;
+    expect(waves).toBeGreaterThan(1);
+    for (let k = 1; k <= waves; k++) {
+      const job = jobs[`apply-wave-${k}`]!;
+      expect(job.outputs).toEqual({ "green-sha": "${{ steps.apply.outputs.green-sha }}" });
+      const step = job.steps.find((s) => s.id === "apply")!;
+      expect(step.run).toContain('echo "green-sha=$GREEN_SHA" >> "$GITHUB_OUTPUT"');
+      if (k === 1) {
+        expect(step.run).toContain('GREEN_SHA="$(chant ci last-green)"');
+        expect(step.env?.GREEN_SHA).toBeUndefined();
+      } else {
+        expect(step.run).not.toContain("chant ci last-green");
+        expect(step.run).toContain('test -n "$GREEN_SHA"');
+        expect(step.env?.GREEN_SHA).toBe(`\${{ needs.apply-wave-${k - 1}.outputs.green-sha }}`);
+      }
+    }
+  });
+
+  test("keeps the plan and record jobs, and writes one apply job per wave, each needing the one before", () => {
+    expect(Object.keys(doc.jobs)).toEqual(["plan", "record", "apply-wave-1", "apply-wave-2", "apply-wave-3"]);
     expect(result.jobs.map((j) => [j.jobName, j.needs])).toEqual([
       ["plan", []],
+      ["record", []],
       ["apply-wave-1", []],
       ["apply-wave-2", ["apply-wave-1"]],
       ["apply-wave-3", ["apply-wave-2"]],
@@ -74,12 +95,13 @@ describe("the GitHub pull-request workflow with a gate per wave (#4003)", () =>
     expect(plan.run).not.toContain("--wave ");
     for (const k of [1, 2, 3]) {
       const job = doc.jobs[`apply-wave-${k}`]!;
-      expect(job.if).toBe("github.event_name == 'push'");
+      // #4168 step 9: the waves apply the newest green commit once the tick ran.
+      expect(job.if).toBe("github.event_name == 'workflow_run' || github.event_name == 'workflow_dispatch'");
       expect(job.concurrency).toEqual({ group: "chant-apply-prod", "cancel-in-progress": false });
       expect(job.permissions.contents).toBe("write");
       const run = job.steps.find((s) => s.run?.includes("ci run apply"))!.run!;
       // #4156: through chant ci run, which runs pr-apply --wave-gate release (no --require-review since #4168) --resume ... --wave <k>.
-      expect(run).toContain(`chant ci run apply --in-place --base "$BASE_SHA" --env prod --gate pr-apply --forge github --wave-gate release --wave ${k}`);
+      expect(run).toContain(`chant ci run apply --in-place --env prod --gate pr-apply --forge github --wave-gate release --wave ${k}`);
       expect(job.steps.find((s) => s.run?.includes("ci run apply"))!.env?.CHANT_RUNNER_KEY).toBe("${{ secrets.CHANT_RUNNER_KEY }}");
     }
   });
@@ -99,7 +121,7 @@ describe("the GitHub pull-request workflow with a gate per wave (#4003)", () =>
 
   test("without --wave-gate the workflow is the one apply job it was", () => {
     const plain = generateGithubPipeline(ESTATE, { env: "prod", prLoop: { applyOnMerge: true } });
-    expect(plain.jobs.map((j) => j.jobName)).toEqual(["plan", "apply"]);
+    expect(plain.jobs.map((j) => j.jobName)).toEqual(["plan", "record", "apply"]);
     expect(plain.yaml).not.toContain("--wave");
   });