@intentius/chant-lexicon-github 0.124.43 → 0.124.45

package/dist/components/generate-op-waves-pipeline.d.ts

@@ -34,6 +34,13 @@
  * environment, variables over the wave's, setup after the wave's, and id
  * tokens. A job with id tokens gets `permissions:` of its own, the
  * workflow's plus `id-token: write`, and each audience as `<NAME>_AUDIENCE`.
+ *
+ * A job whose wave or group gives `cloud` (#4332, `cloudIdentityWave` in
+ * `@intentius/chant/ci-identity`) gets `id-token: write` and starts with a
+ * step that trades the job's OIDC token for those identities, before the
+ * checkout. Every later run step starts with an unset of the variables a
+ * token is requested with, so the code the job runs holds no OIDC token
+ * and cannot request one for another group's identity.
  */
 import { type OpWavesSpec } from "@intentius/chant/op/op-waves";
 import type { OpWavesPipelineOptions, OpWavesPipelineResult } from "@intentius/chant/lexicon";

package/dist/components/generate-op-waves-pipeline.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generate-op-waves-pipeline.d.ts","sourceRoot":"","sources":["../../src/components/generate-op-waves-pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,OAAO,EAAoE,KAAK,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAClI,OAAO,KAAK,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAgB9F,OAAO,EAAsB,KAAK,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAEtF,yFAAyF;AACzF,eAAO,MAAM,cAAc,YAAW,CAAC;AAEvC,oEAAoE;AACpE,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAE1F;AAED,qEAAqE;AACrE,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,WAAW,EACjB,OAAO,EAAE,sBAAsB,GAC9B;IAAE,GAAG,EAAE,mBAAmB,CAAC;IAAC,IAAI,EAAE,qBAAqB,CAAC,MAAM,CAAC,CAAC;IAAC,SAAS,CAAC,EAAE,mBAAmB,CAAC;IAAC,QAAQ,CAAC,EAAE,mBAAmB,CAAA;CAAE,CA2DpI;AA0CD,4EAA4E;AAC5E,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,sBAAsB,GAAG,qBAAqB,CAMvH"}
+{"version":3,"file":"generate-op-waves-pipeline.d.ts","sourceRoot":"","sources":["../../src/components/generate-op-waves-pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAEH,OAAO,EAAoE,KAAK,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAClI,OAAO,KAAK,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAiB9F,OAAO,EAAsB,KAAK,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAEtF,yFAAyF;AACzF,eAAO,MAAM,cAAc,YAAW,CAAC;AAEvC,oEAAoE;AACpE,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAE1F;AAED,qEAAqE;AACrE,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,WAAW,EACjB,OAAO,EAAE,sBAAsB,GAC9B;IAAE,GAAG,EAAE,mBAAmB,CAAC;IAAC,IAAI,EAAE,qBAAqB,CAAC,MAAM,CAAC,CAAC;IAAC,SAAS,CAAC,EAAE,mBAAmB,CAAC;IAAC,QAAQ,CAAC,EAAE,mBAAmB,CAAA;CAAE,CAgEpI;AAoDD,4EAA4E;AAC5E,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,sBAAsB,GAAG,qBAAqB,CAMvH"}

package/dist/components/generate-op-waves-pipeline.js

@@ -34,9 +34,17 @@
  * environment, variables over the wave's, setup after the wave's, and id
  * tokens. A job with id tokens gets `permissions:` of its own, the
  * workflow's plus `id-token: write`, and each audience as `<NAME>_AUDIENCE`.
+ *
+ * A job whose wave or group gives `cloud` (#4332, `cloudIdentityWave` in
+ * `@intentius/chant/ci-identity`) gets `id-token: write` and starts with a
+ * step that trades the job's OIDC token for those identities, before the
+ * checkout. Every later run step starts with an unset of the variables a
+ * token is requested with, so the code the job runs holds no OIDC token
+ * and cannot request one for another group's identity.
  */
 import { notifyVariables, opWaveGroupOf, opWaveJobs, opWavesResumeCommand } from "@intentius/chant/op/op-waves";
 import { assertEnvironment, assertSetupSteps, CI_IMAGE, dirnameOf, environmentDoc, GITHUB_JOB_TOKEN, githubRunsOn, githubSecretEnv, idTokenAudienceEnv, nonEmpty, pushBranches, setupStepDoc, } from "@intentius/chant/ci-jobs";
+import { OIDC_REQUEST_VARS, TRADE_SPEC_ENV, tradeLine } from "@intentius/chant/ci-identity";
 import { checkoutStep, concurrency, downloadArtifactStep, keepRecordStep, runSteps } from "./ci-jobs.js";
 import { emitOpPipelineYAML } from "./generate-op-pipeline.js";
 /** The default image: it carries git, which the runner needs to read the base commit. */
@@ -66,25 +74,30 @@ export function buildGithubOpWavesDoc(spec, options) {
         const wave = spec.waves[job.wave - 1];
         // #3914: a job group's job runs with the group's settings over the wave's.
         const group = opWaveGroupOf(spec, job);
-        const steps = [checkoutStep(true)];
+        // #4332: the job's cloud identities, traded before the checkout.
+        const cloud = group?.cloud ?? wave.cloud;
+        const steps = [...(cloud ? [tradeStep(cloud)] : []), checkoutStep(true)];
         if (job.kind === "share") {
             steps.push(downloadArtifactStep(`Download wave ${job.wave}'s decision`, opWaveRecordArtifact(spec, job.wave), dirnameOf(job.record)));
         }
-        steps.push(...[...(wave.setup ?? []), ...(group?.setup ?? [])].map(setupStepDoc), ...runSteps(options.beforeScript ?? []));
-        steps.push({ name: describeJob(job.kind, job.wave, wave.name, job.share, job.group), run: job.command.join(" ") });
-        steps.push(...runSteps(options.extraScript ?? []));
+        const later = [];
+        later.push(...[...(wave.setup ?? []), ...(group?.setup ?? [])].map(setupStepDoc), ...runSteps(options.beforeScript ?? []));
+        later.push({ name: describeJob(job.kind, job.wave, wave.name, job.share, job.group), run: job.command.join(" ") });
+        later.push(...runSteps(options.extraScript ?? []));
+        steps.push(...(cloud ? later.map(withoutTokenRequest) : later));
         if (job.kind === "decide") {
             steps.push(keepRecordStep(`Keep wave ${job.wave}'s decision`, opWaveRecordArtifact(spec, job.wave), job.record));
         }
         const environment = group?.environment ?? wave.environment;
         const idTokens = group?.idTokens ?? wave.idTokens;
+        const idToken = idTokens !== undefined || cloud !== undefined;
         jobsDoc[job.jobName] = {
             "runs-on": githubRunsOn(group?.runner ?? wave.runner ?? spec.runner),
             ...(job.needs.length > 0 ? { needs: job.needs } : {}),
             container: image,
             ...(environment ? { environment: environmentDoc(environment) } : {}),
             // #3914: a job's own permissions replace the workflow's, so they repeat them.
-            ...(idTokens ? { permissions: { ...permissions, "id-token": "write" } } : {}),
+            ...(idToken ? { permissions: { ...permissions, "id-token": "write" } } : {}),
             ...nonEmpty("env", group || idTokens ? { ...wave.variables, ...group?.variables, ...idTokenAudienceEnv(idTokens) } : wave.variables),
             steps,
         };
@@ -137,6 +150,14 @@ function buildPlansDoc(spec, options) {
         jobsDoc: { "record-plans": { "runs-on": githubRunsOn(spec.runner), container: options.image ?? OP_WAVES_IMAGE, steps } },
     };
 }
+/** The step that trades the job's OIDC token for `cloud` (#4332), writing the credentials to GITHUB_ENV. */
+function tradeStep(cloud) {
+    return { name: "Trade the job's OIDC token for its cloud identities", env: { [TRADE_SPEC_ENV]: JSON.stringify(cloud) }, run: tradeLine("$GITHUB_ENV", "github-env") };
+}
+/** A run step after the trade (#4332), with the token request variables unset first. A `uses:` step is left as it is. */
+function withoutTokenRequest(step) {
+    return typeof step.run === "string" ? { ...step, run: `unset ${OIDC_REQUEST_VARS.join(" ")}\n${step.run}` } : step;
+}
 function describeJob(kind, wave, name, share, group) {
     if (kind === "decide")
         return `Plan wave ${wave} (${name}) and decide its gate`;

package/dist/components/generate-pipeline.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generate-pipeline.d.ts","sourceRoot":"","sources":["../../src/components/generate-pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AAEH,OAAO,EAAyB,KAAK,eAAe,EAAE,MAAM,oCAAoC,CAAC;AA4BjG,OAAO,KAAK,EACV,oBAAoB,IAAI,YAAY,EACpC,wBAAwB,IAAI,qBAAqB,EACjD,uBAAuB,IAAI,oBAAoB,EAEhD,MAAM,0BAA0B,CAAC;AAIlC,YAAY,EAAE,YAAY,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,CAAC;AAE1E;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;;;OAKG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,6FAA6F;IAC7F,WAAW,EAAE,MAAM,CAAC;IACpB,8DAA8D;IAC9D,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5B,mIAAmI;IACnI,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC;;;;;;OAMG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,qDAAqD;IACrD,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,uEAAuE;IACvE,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,0DAA0D;IAC1D,IAAI,EAAE,YAAY,EAAE,CAAC;CACtB;AA2bD;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,CAWpD;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,eAAe,EAAE,EAC7B,OAAO,GAAE,qBAA0B,GAClC,iBAAiB,CA+JnB;AA4CD;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,iBAAiB,GAAG,MAAM,CAE/D;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,eAAe,EAAE,EAC7B,OAAO,GAAE,qBAA0B,GAClC,oBAAoB,CAGtB"}
+{"version":3,"file":"generate-pipeline.d.ts","sourceRoot":"","sources":["../../src/components/generate-pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AAEH,OAAO,EAAyB,KAAK,eAAe,EAAE,MAAM,oCAAoC,CAAC;AA4BjG,OAAO,KAAK,EACV,oBAAoB,IAAI,YAAY,EACpC,wBAAwB,IAAI,qBAAqB,EACjD,uBAAuB,IAAI,oBAAoB,EAEhD,MAAM,0BAA0B,CAAC;AAIlC,YAAY,EAAE,YAAY,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,CAAC;AAE1E;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;;;OAKG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,6FAA6F;IAC7F,WAAW,EAAE,MAAM,CAAC;IACpB,8DAA8D;IAC9D,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5B,mIAAmI;IACnI,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC;;;;;;OAMG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,qDAAqD;IACrD,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,uEAAuE;IACvE,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,0DAA0D;IAC1D,IAAI,EAAE,YAAY,EAAE,CAAC;CACtB;AAmcD;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,CAWpD;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,eAAe,EAAE,EAC7B,OAAO,GAAE,qBAA0B,GAClC,iBAAiB,CA+JnB;AA4CD;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,iBAAiB,GAAG,MAAM,CAE/D;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,eAAe,EAAE,EAC7B,OAAO,GAAE,qBAA0B,GAClC,oBAAoB,CAGtB"}

package/dist/components/generate-pipeline.js

@@ -382,17 +382,24 @@ function prEnvGithubJobs(forge, image, beforeScript, extraScript, loop, member)
     const writes = { contents: "write", "pull-requests": "write", statuses: "write" };
     const keep = (name) => ({ name: `Keep the ${name} report`, if: "always()", uses: UPLOAD_ARTIFACT, with: { name: `chant-pr-${name}`, path: reportPath, "if-no-files-found": "ignore", "include-hidden-files": true } });
     const opened = "github.event_name == 'pull_request' && github.event.action != 'closed'";
-    // #4295: env-up runs the change's code and holds no forge token while it does.
-    const drop = dropForgeTokens("sh");
+    // #4330: env-up, env-down and env-sweep trade the job's OIDC token for the pull request environments' identity, before the checkout.
+    const identity = loop.prEnvIdentity;
+    const tradeStep = identity
+        ? [{ name: "Trade the job's OIDC token for the pull request environment's identity", ...(rooted ? {} : { "working-directory": "." }), env: { [TRADE_SPEC_ENV]: JSON.stringify(identity) }, run: tradeLine("$GITHUB_ENV", "github-env") }]
+        : [];
+    const withIdToken = (permissions) => (identity ? { ...permissions, "id-token": "write" } : permissions);
+    // #4295: env-up runs the change's code and holds no forge token while it does; #4330: nor the token request variables.
+    const drop = dropForgeTokens("sh", identity ? OIDC_REQUEST_VARS : []);
     const headStep = (line, name, env) => ({ ...(name ? { name } : {}), ...(env ? { env } : {}), run: `${drop}\n${line}` });
     const upJob = {
         if: opened,
         "runs-on": GITHUB_RUNNER,
         container: image,
         concurrency: concurrency(group),
-        permissions: { contents: "read" },
+        permissions: withIdToken({ contents: "read" }),
         outputs: handoverOutputs(PR_ENV_UP_STEP_ID, forge),
         steps: [
+            ...tradeStep,
             {
                 name: "Check out the change",
                 ...(rooted ? {} : { "working-directory": "." }),
@@ -431,8 +438,9 @@ function prEnvGithubJobs(forge, image, beforeScript, extraScript, loop, member)
         "runs-on": GITHUB_RUNNER,
         container: image,
         concurrency: concurrency(groupName),
-        permissions: writes,
+        permissions: withIdToken(writes),
         steps: [
+            ...tradeStep,
             { uses: actionRef("actions/checkout"), with: { "fetch-depth": 0, ...(ref ? { ref } : {}) } },
             ...runSteps(prLoopSetup(image)),
             ...runSteps(beforeScript),

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "8da3ed450430477d84f2ff5930a00bc4ec0135806fa52f08aed7323a7f016be3",
+    "manifest.json": "7b16495d7bcf5730a4297a1f5d7161d95dc75afe6ee026e72a7572889f953166",
     "meta.json": "c50e0ef3845c370c3ad2210b8bba455980417c0f818aa6ed46e06d4fb8b1b9f9",
     "types/index.d.ts": "0ead95536e947ddfb98a5acf0ddb88547913b5a53a342df67711c59266f84b3e",
     "rules/deprecated-action-version.ts": "a9ba7cc924ff1c7055110416d8989273690415bfb5e8dcc32dc9431b9351f5ca",
@@ -78,5 +78,5 @@
     "skills/chant-github-patterns.md": "bb3abef289a8fdfcf07d6bb2d7289dcb2f38bc0cb0321ea320b78b45a6f548c0",
     "skills/chant-github-security.md": "aab111cb0871cad30281ce48d7da23663689619351029219e2be019a1a61e394"
   },
-  "composite": "898dc84e00b121dbe97351f6dc17767bde8532a89c51d89a13820d7364d54d74"
+  "composite": "1b42a70a674560e0669fbf3639c0e35712fbf1fe34700e1d6449aac5cd04190e"
 }

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "github",
-  "version": "0.124.43",
+  "version": "0.124.45",
   "chantVersion": ">=0.1.0",
   "namespace": "GitHub",
   "intrinsics": [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-github",
-  "version": "0.124.43",
+  "version": "0.124.45",
   "description": "GitHub Actions lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -61,6 +61,6 @@
     "typescript": "^5.9.3"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.124.43"
+    "@intentius/chant": "^0.124.45"
   }
 }

package/src/components/generate-op-waves-pipeline.identity.test.ts

@@ -0,0 +1,141 @@
+/**
+ * #4332: an Op wave's apply split into one job per cloud identity. The
+ * deciding job trades its OIDC token for every plan identity of the wave's
+ * targets before the checkout, each group's job for its group's apply
+ * identities alone, and every later run step starts without the variables
+ * a token is requested with. The behaviour test runs the deciding job's
+ * trade step and its command step with `sh`, as a runner does, against the
+ * local emulator (@intentius/chant/__fixtures__/oidc-emulator), with the
+ * command replaced by a probe. Test values only.
+ */
+
+import { execFile } from "node:child_process";
+import { mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { promisify } from "node:util";
+import { afterAll, beforeAll, describe, expect, test } from "vitest";
+import { parseYAML } from "@intentius/chant/yaml";
+import type { OpWavesSpec } from "@intentius/chant/op/op-waves";
+import { CLOUD_TARGETS_ENV, cloudIdentityWave, OIDC_REQUEST_VARS, resolveCloudIdentity, TRADE_SPEC_ENV, tradeIdentities, type CloudIdentityDeclaration } from "@intentius/chant/ci-identity";
+import { emulatedCredentials, EMULATED_JWT_PREFIX, startOidcEmulator, type OidcEmulator } from "@intentius/chant/__fixtures__/oidc-emulator";
+import { generateGithubOpWavesPipeline } from "./generate-op-waves-pipeline";
+
+const run = promisify(execFile);
+const role = (n: string) => `arn:aws:iam::111111111111:role/${n}`;
+
+const DECL: CloudIdentityDeclaration = {
+  aws: {
+    rules: [
+      { targets: ["envs/prod/**"], plan: role("prod-plan"), apply: role("prod-apply") },
+      { targets: ["envs/staging/**"], plan: role("staging-plan"), apply: role("staging-apply") },
+      { plan: role("own-plan"), apply: role("own-apply") },
+    ],
+  },
+};
+const ROOTS = ["envs/prod/net", "envs/staging/net", "shared/dns"];
+
+function specFor(decl: CloudIdentityDeclaration, roots: string[]): OpWavesSpec {
+  return {
+    name: "tf-apply",
+    op: "tf-apply",
+    planWave: ["./bin/plan", "{runs}", "{plans}"],
+    applyWave: ["./bin/apply", "{runs}"],
+    waves: [{ name: "wave-1", runs: roots.map((target) => ({ target })), ...cloudIdentityWave(decl, "prod", "infra", roots) }],
+  };
+}
+
+interface Step {
+  name?: string;
+  uses?: string;
+  run?: string;
+  env?: Record<string, string>;
+}
+interface Job {
+  permissions?: Record<string, string>;
+  steps: Step[];
+}
+
+const jobsOf = (spec: OpWavesSpec): Record<string, Job> => (parseYAML(generateGithubOpWavesPipeline(spec, { specFile: ".chant/op-waves/tf-apply.spec.json", beforeScript: ["npm ci"] }).files[0]!.yaml) as { jobs: Record<string, Job> }).jobs;
+const tradeOf = (job: Job): unknown => JSON.parse(job.steps[0]!.env![TRADE_SPEC_ENV]!);
+const UNSET = `unset ${OIDC_REQUEST_VARS.join(" ")}`;
+
+describe("an Op wave's jobs by cloud identity (#4332)", () => {
+  const jobs = jobsOf(specFor(DECL, ROOTS));
+  const plan = resolveCloudIdentity(DECL, "prod", "infra")!.plan;
+
+  test("one deciding job and a job per identity", () => {
+    expect(Object.keys(jobs)).toEqual(["wave-1-wave-1-decide", "wave-1-wave-1-envs-prod", "wave-1-wave-1-envs-staging", "wave-1-wave-1-default"]);
+  });
+
+  test("the deciding job trades for every plan identity, before the checkout, and names no apply identity", () => {
+    const decide = jobs["wave-1-wave-1-decide"]!;
+    expect(decide.steps[0]!.name).toBe("Trade the job's OIDC token for its cloud identities");
+    expect(decide.steps[0]!.run).toMatch(/^\(cd \/ && node -e '/);
+    expect(decide.steps[1]!.uses).toMatch(/^actions\/checkout@/);
+    expect(tradeOf(decide)).toEqual(plan);
+    expect(decide.permissions).toEqual({ contents: "write", "id-token": "write" });
+    for (const id of [role("prod-apply"), role("staging-apply"), role("own-apply")]) expect(JSON.stringify(decide)).not.toContain(id);
+  });
+
+  test("each group's job trades for its own apply identity and holds no other group's", () => {
+    const want: Record<string, string> = { "wave-1-wave-1-envs-prod": role("prod-apply"), "wave-1-wave-1-envs-staging": role("staging-apply"), "wave-1-wave-1-default": role("own-apply") };
+    for (const [name, id] of Object.entries(want)) {
+      const job = jobs[name]!;
+      expect(tradeIdentities(tradeOf(job) as never)).toEqual([id]);
+      expect(job.steps[1]!.uses).toMatch(/^actions\/checkout@/);
+      for (const other of Object.values(want).filter((o) => o !== id)) expect(JSON.stringify(job)).not.toContain(other);
+    }
+  });
+
+  test("every run step after the trade starts by unsetting the token request variables", () => {
+    for (const job of Object.values(jobs)) {
+      const runs = job.steps.slice(1).filter((s) => s.run !== undefined);
+      expect(runs.length).toBeGreaterThan(0);
+      for (const s of runs) expect(s.run!.split("\n")[0]).toBe(UNSET);
+    }
+  });
+
+  test("a wave with no cloud trades nothing and requests no token", () => {
+    const plain = jobsOf(specFor({}, ROOTS));
+    expect(Object.keys(plain)).toEqual(["wave-1-wave-1"]);
+    for (const job of Object.values(plain)) {
+      expect(job.permissions?.["id-token"]).toBeUndefined();
+      expect(JSON.stringify(job)).not.toContain(TRADE_SPEC_ENV);
+    }
+  });
+});
+
+const dirs: string[] = [];
+let emu: OidcEmulator;
+beforeAll(async () => {
+  emu = await startOidcEmulator();
+});
+afterAll(async () => {
+  await emu.close();
+  for (const d of dirs) rmSync(d, { recursive: true, force: true });
+});
+
+describe("the deciding job, run step by step against the emulator (#4332)", () => {
+  test("its command step sees the plan identities through the targets file, and cannot request a token", async () => {
+    const decide = jobsOf(specFor(DECL, ROOTS))["wave-1-wave-1-decide"]!;
+    const temp = mkdtempSync(join(tmpdir(), "chant-op-waves-identity-"));
+    dirs.push(temp);
+    const githubEnv = join(temp, "github-env");
+    writeFileSync(githubEnv, "");
+    const base = { PATH: process.env.PATH ?? "/usr/bin:/bin", HOME: process.env.HOME ?? "/tmp", RUNNER_TEMP: temp, ...emu.requestEnv };
+    const spec = emu.pointAt(JSON.parse(decide.steps[0]!.env![TRADE_SPEC_ENV]!));
+    await run("sh", ["-c", decide.steps[0]!.run!.replace("$GITHUB_ENV", githubEnv)], { env: { ...base, [TRADE_SPEC_ENV]: JSON.stringify(spec) } });
+    const traded = Object.fromEntries(readFileSync(githubEnv, "utf-8").split("\n").filter(Boolean).map((l) => [l.slice(0, l.indexOf("=")), l.slice(l.indexOf("=") + 1)]));
+    expect(traded.AWS_ACCESS_KEY_ID).toBe(emulatedCredentials(role("own-plan")).accessKeyId);
+    const before = emu.log.minted.length;
+    // The command step with the command replaced by a probe: what it sees, and a token request.
+    const step = decide.steps.find((s) => s.run?.includes("chant run wave"))!;
+    const probe = `node -e 'const e=process.env;const f=JSON.parse(require("fs").readFileSync(e.${CLOUD_TARGETS_ENV},"utf8"));console.log("roles:"+Object.keys(f.clouds.aws.vars).join(","));console.log("request:"+(e.ACTIONS_ID_TOKEN_REQUEST_URL&&e.ACTIONS_ID_TOKEN_REQUEST_TOKEN?"yes":"no"))'`;
+    const r = await run("sh", ["-e", "-c", `${step.run!.split("\n")[0]}\n${probe}`], { env: { ...base, ...traded } });
+    expect(r.stdout).toContain(`roles:${[role("own-plan"), role("prod-plan"), role("staging-plan")].join(",")}`);
+    expect(r.stdout).toContain("request:no");
+    expect(r.stdout).not.toContain(EMULATED_JWT_PREFIX);
+    expect(emu.log.minted.length).toBe(before);
+  });
+});

package/src/components/generate-op-waves-pipeline.ts

@@ -34,6 +34,13 @@
  * environment, variables over the wave's, setup after the wave's, and id
  * tokens. A job with id tokens gets `permissions:` of its own, the
  * workflow's plus `id-token: write`, and each audience as `<NAME>_AUDIENCE`.
+ *
+ * A job whose wave or group gives `cloud` (#4332, `cloudIdentityWave` in
+ * `@intentius/chant/ci-identity`) gets `id-token: write` and starts with a
+ * step that trades the job's OIDC token for those identities, before the
+ * checkout. Every later run step starts with an unset of the variables a
+ * token is requested with, so the code the job runs holds no OIDC token
+ * and cannot request one for another group's identity.
  */
 
 import { notifyVariables, opWaveGroupOf, opWaveJobs, opWavesResumeCommand, type OpWavesSpec } from "@intentius/chant/op/op-waves";
@@ -52,6 +59,7 @@ import {
   pushBranches,
   setupStepDoc,
 } from "@intentius/chant/ci-jobs";
+import { OIDC_REQUEST_VARS, TRADE_SPEC_ENV, tradeLine, type CloudTradeSpec } from "@intentius/chant/ci-identity";
 import { checkoutStep, concurrency, downloadArtifactStep, keepRecordStep, runSteps } from "./ci-jobs";
 import { emitOpPipelineYAML, type GithubOpPipelineDoc } from "./generate-op-pipeline";
 
@@ -86,25 +94,30 @@ export function buildGithubOpWavesDoc(
     const wave = spec.waves[job.wave - 1]!;
     // #3914: a job group's job runs with the group's settings over the wave's.
     const group = opWaveGroupOf(spec, job);
-    const steps: Array<Record<string, unknown>> = [checkoutStep(true)];
+    // #4332: the job's cloud identities, traded before the checkout.
+    const cloud = group?.cloud ?? wave.cloud;
+    const steps: Array<Record<string, unknown>> = [...(cloud ? [tradeStep(cloud)] : []), checkoutStep(true)];
     if (job.kind === "share") {
       steps.push(downloadArtifactStep(`Download wave ${job.wave}'s decision`, opWaveRecordArtifact(spec, job.wave), dirnameOf(job.record!)));
     }
-    steps.push(...[...(wave.setup ?? []), ...(group?.setup ?? [])].map(setupStepDoc), ...runSteps(options.beforeScript ?? []));
-    steps.push({ name: describeJob(job.kind, job.wave, wave.name, job.share, job.group), run: job.command.join(" ") });
-    steps.push(...runSteps(options.extraScript ?? []));
+    const later: Array<Record<string, unknown>> = [];
+    later.push(...[...(wave.setup ?? []), ...(group?.setup ?? [])].map(setupStepDoc), ...runSteps(options.beforeScript ?? []));
+    later.push({ name: describeJob(job.kind, job.wave, wave.name, job.share, job.group), run: job.command.join(" ") });
+    later.push(...runSteps(options.extraScript ?? []));
+    steps.push(...(cloud ? later.map(withoutTokenRequest) : later));
     if (job.kind === "decide") {
       steps.push(keepRecordStep(`Keep wave ${job.wave}'s decision`, opWaveRecordArtifact(spec, job.wave), job.record!));
     }
     const environment = group?.environment ?? wave.environment;
     const idTokens = group?.idTokens ?? wave.idTokens;
+    const idToken = idTokens !== undefined || cloud !== undefined;
     jobsDoc[job.jobName] = {
       "runs-on": githubRunsOn(group?.runner ?? wave.runner ?? spec.runner),
       ...(job.needs.length > 0 ? { needs: job.needs } : {}),
       container: image,
       ...(environment ? { environment: environmentDoc(environment) } : {}),
       // #3914: a job's own permissions replace the workflow's, so they repeat them.
-      ...(idTokens ? { permissions: { ...permissions, "id-token": "write" } } : {}),
+      ...(idToken ? { permissions: { ...permissions, "id-token": "write" } } : {}),
       ...nonEmpty("env", group || idTokens ? { ...wave.variables, ...group?.variables, ...idTokenAudienceEnv(idTokens) } : wave.variables),
       steps,
     };
@@ -161,6 +174,16 @@ function buildPlansDoc(spec: OpWavesSpec, options: OpWavesPipelineOptions): Gith
   };
 }
 
+/** The step that trades the job's OIDC token for `cloud` (#4332), writing the credentials to GITHUB_ENV. */
+function tradeStep(cloud: CloudTradeSpec): Record<string, unknown> {
+  return { name: "Trade the job's OIDC token for its cloud identities", env: { [TRADE_SPEC_ENV]: JSON.stringify(cloud) }, run: tradeLine("$GITHUB_ENV", "github-env") };
+}
+
+/** A run step after the trade (#4332), with the token request variables unset first. A `uses:` step is left as it is. */
+function withoutTokenRequest(step: Record<string, unknown>): Record<string, unknown> {
+  return typeof step.run === "string" ? { ...step, run: `unset ${OIDC_REQUEST_VARS.join(" ")}\n${step.run}` } : step;
+}
+
 function describeJob(kind: "wave" | "decide" | "share", wave: number, name: string, share?: number, group?: string): string {
   if (kind === "decide") return `Plan wave ${wave} (${name}) and decide its gate`;
   if (group !== undefined) return `Apply ${share !== undefined ? `share ${share} of ` : ""}job group ${group} of wave ${wave} (${name})`;

package/src/components/generate-pipeline.ts

@@ -475,17 +475,24 @@ function prEnvGithubJobs(
   const keep = (name: string) => ({ name: `Keep the ${name} report`, if: "always()", uses: UPLOAD_ARTIFACT, with: { name: `chant-pr-${name}`, path: reportPath, "if-no-files-found": "ignore", "include-hidden-files": true } });
   const opened = "github.event_name == 'pull_request' && github.event.action != 'closed'";
 
-  // #4295: env-up runs the change's code and holds no forge token while it does.
-  const drop = dropForgeTokens("sh");
+  // #4330: env-up, env-down and env-sweep trade the job's OIDC token for the pull request environments' identity, before the checkout.
+  const identity = loop.prEnvIdentity;
+  const tradeStep: Array<Record<string, unknown>> = identity
+    ? [{ name: "Trade the job's OIDC token for the pull request environment's identity", ...(rooted ? {} : { "working-directory": "." }), env: { [TRADE_SPEC_ENV]: JSON.stringify(identity) }, run: tradeLine("$GITHUB_ENV", "github-env") }]
+    : [];
+  const withIdToken = (permissions: Record<string, string>): Record<string, string> => (identity ? { ...permissions, "id-token": "write" } : permissions);
+  // #4295: env-up runs the change's code and holds no forge token while it does; #4330: nor the token request variables.
+  const drop = dropForgeTokens("sh", identity ? OIDC_REQUEST_VARS : []);
   const headStep = (line: string, name?: string, env?: Record<string, string>): Record<string, unknown> => ({ ...(name ? { name } : {}), ...(env ? { env } : {}), run: `${drop}\n${line}` });
   const upJob = {
     if: opened,
     "runs-on": GITHUB_RUNNER,
     container: image,
     concurrency: concurrency(group),
-    permissions: { contents: "read" },
+    permissions: withIdToken({ contents: "read" }),
     outputs: handoverOutputs(PR_ENV_UP_STEP_ID, forge),
     steps: [
+      ...tradeStep,
       {
         name: "Check out the change",
         ...(rooted ? {} : { "working-directory": "." }),
@@ -524,8 +531,9 @@ function prEnvGithubJobs(
     "runs-on": GITHUB_RUNNER,
     container: image,
     concurrency: concurrency(groupName),
-    permissions: writes,
+    permissions: withIdToken(writes),
     steps: [
+      ...tradeStep,
       { uses: actionRef("actions/checkout"), with: { "fetch-depth": 0, ...(ref ? { ref } : {}) } },
       ...runSteps(prLoopSetup(image)),
       ...runSteps(beforeScript),

package/src/components/generate-pr-env-pipeline.test.ts

@@ -204,3 +204,31 @@ describe("env-up's steps, run, see no forge token and hand the report and record
     expect(readFileSync(join(postWork, ".chant", "pr-env", "pr-env-up.json"), "utf-8")).toBe('{"stage":"up"}\n');
   });
 });
+
+describe("the environment's cloud identity (#4330)", () => {
+  const prEnvIdentity = { aws: { role: "arn:aws:iam::000000000000:role/pr-env-apply", region: "us-east-1", audience: "sts.amazonaws.com", endpoint: "http://localhost:4566" } };
+  const jobs = (parseYAML(generateGithubPipeline(ESTATE, { env: "staging", prLoop: { prEnvironment: true, prEnvIdentity } }).yaml) as { jobs: Record<string, Job> }).jobs;
+
+  test("env-up trades its OIDC token before the checkout, and every later step starts without the token request variables", () => {
+    const up = jobs["env-up"]!;
+    expect(up.permissions).toEqual({ contents: "read", "id-token": "write" });
+    expect(up.steps[0]!.name).toMatch(/Trade the job's OIDC token/);
+    expect(JSON.parse(up.steps[0]!.env!.CHANT_CLOUD_TRADE!)).toEqual(prEnvIdentity);
+    expect(up.steps[1]!.name).toBe("Check out the change");
+    for (const step of up.steps.slice(2)) expect(step.run).toContain("ACTIONS_ID_TOKEN_REQUEST_TOKEN");
+  });
+
+  test("env-down and env-sweep trade for the same identity, and env-post trades for none", () => {
+    for (const name of ["env-down", "env-sweep"]) {
+      expect(jobs[name]!.permissions["id-token"]).toBe("write");
+      expect(jobs[name]!.steps[0]!.env?.CHANT_CLOUD_TRADE).toBe(JSON.stringify(prEnvIdentity));
+    }
+    expect(jobs["env-post"]!.permissions["id-token"]).toBeUndefined();
+    expect(JSON.stringify(jobs["env-post"]!.steps)).not.toContain("CHANT_CLOUD_TRADE");
+  });
+
+  test("without one, no environment job asks for an OIDC token", () => {
+    const plain = (parseYAML(generateGithubPipeline(ESTATE, { env: "staging", prLoop: { prEnvironment: true } }).yaml) as { jobs: Record<string, Job> }).jobs;
+    for (const name of ["env-up", "env-down", "env-sweep"]) expect(plain[name]!.permissions["id-token"]).toBeUndefined();
+  });
+});