@intentius/chant-lexicon-github 0.124.45 → 0.124.48

package/dist/components/review-jobs.d.ts

@@ -0,0 +1,55 @@
+/**
+ * The two jobs of a split review (#4326): `ScheduledOpSpec.reviewAgent`.
+ *
+ * An Op that runs a `reviewAgent` step in `handoff` mode runs the change's
+ * code (`chant run` loads the pull request's Op files) beside a model. This
+ * generator keeps the forge write token out of that job and posts the note
+ * from another one, as terragucci's review does (`render-review.ts`: the
+ * `review` and `review-note` jobs):
+ *
+ * - the review job holds `contents: read` and no forge token in any step's
+ *   environment, bar the checkout script's fetches (`checkoutScript`,
+ *   ../../../../packages/core/src/ci-handover.ts). Every later step starts
+ *   without the token variables (`dropForgeTokens`). The `chant run` step is
+ *   its last, and it hands the review directory on as the job's outputs
+ *   (`handoverTrap`), in place of an artifact upload that would start beside
+ *   whatever the change's code left running.
+ * - the note job checks nothing out. It takes the outputs back as data
+ *   (`takeOverScript`), installs the chant release this lexicon belongs to
+ *   and runs `postReviewNote` with the job's token. The Op's name comes from
+ *   this file, not from the review, which the change's code wrote.
+ *
+ * Forgejo's runner ignores `permissions:` and may put its token in a step's
+ * environment, so the review job drops the token variables on both forges.
+ */
+import type { OpTrigger, PipelineMember } from "@intentius/chant/lexicon";
+/** The name of the note job beside the Op's own job. */
+export declare function reviewNoteJobName(jobName: string): string;
+/**
+ * Refuse a spec whose review cannot be split the way this shape needs:
+ * a trigger with no pull request to post on, a finding-mode that would give
+ * the review job a write scope, or an additive scope that would.
+ */
+export declare function assertReviewSplit(name: string, trigger: OpTrigger, findingMode: string, permissions: Record<string, string> | undefined): void;
+export interface ReviewJobsInput {
+    /** The Op's name: what `chant run` targets and what keys the note. */
+    name: string;
+    /** The Op's job name. */
+    jobName: string;
+    image: string;
+    /** The invocation of the Op, `chant run <name>` by default. */
+    invocation: string;
+    /** Setup steps, as built by `setupStepDoc`. */
+    setup: Array<Record<string, unknown>>;
+    beforeScript: readonly string[];
+    extraScript: readonly string[];
+    /** The Op's own per-job environment (`ScheduledOpSpec.variables`). */
+    variables?: Record<string, string>;
+    member?: PipelineMember;
+}
+/** The review job and the note job of one split review. */
+export declare function reviewJobs(i: ReviewJobsInput): {
+    review: Record<string, unknown>;
+    note: Record<string, unknown>;
+};
+//# sourceMappingURL=review-jobs.d.ts.map

package/dist/components/review-jobs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"review-jobs.d.ts","sourceRoot":"","sources":["../../src/components/review-jobs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAKH,OAAO,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAW1E,wDAAwD;AACxD,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,GAAG,IAAI,CAkB9I;AAuCD,MAAM,WAAW,eAAe;IAC9B,sEAAsE;IACtE,IAAI,EAAE,MAAM,CAAC;IACb,yBAAyB;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,+DAA+D;IAC/D,UAAU,EAAE,MAAM,CAAC;IACnB,+CAA+C;IAC/C,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACtC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/B,sEAAsE;IACtE,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC,MAAM,CAAC,EAAE,cAAc,CAAC;CACzB;AAED,2DAA2D;AAC3D,wBAAgB,UAAU,CAAC,CAAC,EAAE,eAAe,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAwCjH"}

package/dist/components/review-jobs.js

@@ -0,0 +1,130 @@
+/**
+ * The two jobs of a split review (#4326): `ScheduledOpSpec.reviewAgent`.
+ *
+ * An Op that runs a `reviewAgent` step in `handoff` mode runs the change's
+ * code (`chant run` loads the pull request's Op files) beside a model. This
+ * generator keeps the forge write token out of that job and posts the note
+ * from another one, as terragucci's review does (`render-review.ts`: the
+ * `review` and `review-note` jobs):
+ *
+ * - the review job holds `contents: read` and no forge token in any step's
+ *   environment, bar the checkout script's fetches (`checkoutScript`,
+ *   ../../../../packages/core/src/ci-handover.ts). Every later step starts
+ *   without the token variables (`dropForgeTokens`). The `chant run` step is
+ *   its last, and it hands the review directory on as the job's outputs
+ *   (`handoverTrap`), in place of an artifact upload that would start beside
+ *   whatever the change's code left running.
+ * - the note job checks nothing out. It takes the outputs back as data
+ *   (`takeOverScript`), installs the chant release this lexicon belongs to
+ *   and runs `postReviewNote` with the job's token. The Op's name comes from
+ *   this file, not from the review, which the change's code wrote.
+ *
+ * Forgejo's runner ignores `permissions:` and may put its token in a step's
+ * environment, so the review job drops the token variables on both forges.
+ */
+import { readFileSync } from "node:fs";
+import { GITHUB_JOB_TOKEN, GITHUB_RUNNER } from "@intentius/chant/ci-jobs";
+import { CHECKOUT_TOKEN_ENV, checkoutScript, dropForgeTokens, handoverOutputs, handoverTrap, takeOverScript } from "@intentius/chant/ci-handover";
+/** The variable `reviewAgent` reads its handoff directory from (`REVIEW_DIR_ENV`, review-agent.ts). */
+const REVIEW_DIR_ENV = "CHANT_REVIEW_DIR";
+/** Where the review job writes the review, from the directory the step starts in. */
+const REVIEW_DIR = ".chant/review";
+/** The id of the review job's `chant run` step, which its outputs come from. */
+const REVIEW_STEP_ID = "chant-review";
+/** The name of the note job beside the Op's own job. */
+export function reviewNoteJobName(jobName) {
+    return `${jobName}-note`;
+}
+/**
+ * Refuse a spec whose review cannot be split the way this shape needs:
+ * a trigger with no pull request to post on, a finding-mode that would give
+ * the review job a write scope, or an additive scope that would.
+ */
+export function assertReviewSplit(name, trigger, findingMode, permissions) {
+    if (trigger.kind !== "pull_request") {
+        throw new Error(`Scheduled Op "${name}" sets reviewAgent, which posts the review as a note on the pull request that triggered the run, but its trigger is "${trigger.kind}". Give it a { kind: "pull_request" } trigger.`);
+    }
+    if (findingMode !== "report") {
+        throw new Error(`Scheduled Op "${name}" sets reviewAgent with findingMode "${findingMode}". The review job holds no forge write token, and the note job posts instead, so the Op's own finding-mode must be "report".`);
+    }
+    for (const [scope, level] of Object.entries(permissions ?? {})) {
+        if (level === "write" && scope !== "id-token") {
+            throw new Error(`Scheduled Op "${name}" sets reviewAgent and adds the permission "${scope}: write". The review job runs the change's code and may hold only "id-token: write" beyond contents: read.`);
+        }
+    }
+}
+/** The chant release the note job installs: this lexicon's own, which releases in lockstep with `@intentius/chant`. */
+function chantVersion() {
+    const pkg = JSON.parse(readFileSync(new URL("../../package.json", import.meta.url), "utf8"));
+    if (typeof pkg.version !== "string" || pkg.version === "") {
+        throw new Error("the github lexicon's package.json has no version to pin the review note job's chant to");
+    }
+    return pkg.version;
+}
+/** What the note job runs under node: `postReviewNote` over the review the review job handed on. Plain JavaScript, no `${{ }}`. */
+const NOTE_SCRIPT = [
+    'import { postReviewNote } from "@intentius/chant/op/activities/review-agent";',
+    `const { CHANT_OP: op, ${REVIEW_DIR_ENV}: dir } = process.env;`,
+    "const result = await postReviewNote({ op, dir });",
+    "console.log(result.reason);",
+    "if (!result.posted) process.exitCode = 1;",
+].join("\n");
+/** Where the note job puts the review it took back: outside any checkout, which it has none of. */
+const NOTE_DIR = '"${RUNNER_TEMP:-/tmp}/chant-review"';
+/** The note step's shell: install the pinned chant beside the review and run {@link NOTE_SCRIPT} with tsx. */
+function noteScript(version) {
+    return [
+        `review=${NOTE_DIR}`,
+        'dir="${RUNNER_TEMP:-/tmp}/chant-review-note"',
+        'mkdir -p "$dir"',
+        'cd "$dir"',
+        "echo '{\"private\":true}' > package.json",
+        `npm install --omit=peer --no-audit --no-fund --loglevel=error @intentius/chant@${version}`,
+        "cat > note.mjs <<'NOTE'",
+        NOTE_SCRIPT,
+        "NOTE",
+        `${REVIEW_DIR_ENV}="$review" node --import tsx note.mjs`,
+    ].join("\n");
+}
+/** The review job and the note job of one split review. */
+export function reviewJobs(i) {
+    const drop = dropForgeTokens("sh");
+    const rooted = !i.member || i.member.dir === "." || i.member.dir === "";
+    const headStep = (line) => ({ run: `${drop}\n${line}` });
+    const review = {
+        "runs-on": GITHUB_RUNNER,
+        container: i.image,
+        ...(i.variables && Object.keys(i.variables).length > 0 ? { env: i.variables } : {}),
+        outputs: handoverOutputs(REVIEW_STEP_ID, "github"),
+        steps: [
+            // A script, not actions/checkout: the token reaches the fetches alone, and the base branch's history comes with them for the diff.
+            {
+                name: "Check out the change",
+                ...(rooted ? {} : { "working-directory": "." }),
+                env: { [CHECKOUT_TOKEN_ENV]: GITHUB_JOB_TOKEN },
+                run: checkoutScript(true),
+            },
+            ...i.setup,
+            ...i.beforeScript.map(headStep),
+            // The job's last step: it hands the review directory on as the job's outputs when it ends, however it ends.
+            {
+                id: REVIEW_STEP_ID,
+                name: "Run the Op and keep its review",
+                env: { [REVIEW_DIR_ENV]: REVIEW_DIR },
+                run: [drop, ...handoverTrap(REVIEW_DIR, "github"), i.invocation, ...i.extraScript].join("\n"),
+            },
+        ],
+    };
+    const note = {
+        needs: i.jobName,
+        if: `needs.${i.jobName}.result == 'success'`,
+        "runs-on": GITHUB_RUNNER,
+        container: i.image,
+        permissions: { "pull-requests": "write" },
+        steps: [
+            { name: "Take the review from the review job", run: takeOverScript(i.jobName, NOTE_DIR, "github") },
+            { name: "Post the review as a note", env: { GITHUB_TOKEN: GITHUB_JOB_TOKEN, CHANT_OP: i.name }, run: noteScript(chantVersion()) },
+        ],
+    };
+    return { review, note };
+}

package/dist/composites/cache.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cache.d.ts","sourceRoot":"","sources":["../../src/composites/cache.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAE1C,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,QAAQ,CAAC,EAAE;QACT,IAAI,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;KACvD,CAAC;CACH;AAED,eAAO,MAAM,WAAW;;EAeb,CAAC"}
+{"version":3,"file":"cache.d.ts","sourceRoot":"","sources":["../../src/composites/cache.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAE1C,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,QAAQ,CAAC,EAAE;QACT,IAAI,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;KACvD,CAAC;CACH;AAED,eAAO,MAAM,WAAW;;EAeb,CAAC"}

package/dist/composites/cache.js

@@ -1,4 +1,5 @@
 import { Composite, mergeDefaults } from "@intentius/chant";
+import { actionRef } from "../action-pins.js";
 import { Step } from "../generated/index.js";
 export const CacheAction = Composite((props) => {
     const { defaults } = props;
@@ -10,7 +11,7 @@ export const CacheAction = Composite((props) => {
         withObj["restore-keys"] = props.restoreKeys.join("\n");
     const step = new Step(mergeDefaults({
         name: "Cache",
-        uses: "actions/cache@v4",
+        uses: actionRef("actions/cache"),
         with: withObj,
     }, defaults?.step));
     return { step };

package/dist/composites/checkout.d.ts

@@ -8,9 +8,9 @@ export interface CheckoutProps {
     submodules?: boolean | string;
     sshKey?: string;
     /**
-     * `"tag"` (default) emits the action's major tag. `"sha"` emits the commit
-     * SHA from the lexicon's pin table with the version as a YAML comment, which
-     * passes GHA021, GHA029 and GHA059.
+     * `"sha"` (default) emits the commit SHA from the pin table with the version as
+     * a YAML comment, which passes GHA021, GHA029 and GHA059. `"tag"` emits the
+     * action's major tag.
      */
     pin?: ActionPinMode;
     defaults?: {

package/dist/composites/checkout.js

@@ -18,7 +18,7 @@ export const Checkout = Composite((props) => {
         withObj["ssh-key"] = props.sshKey;
     const step = new Step(mergeDefaults({
         name: "Checkout",
-        uses: actionRef("actions/checkout", props.pin),
+        uses: actionRef("actions/checkout", props.pin ?? "sha"),
         ...(Object.keys(withObj).length > 0 ? { with: withObj } : {}),
     }, defaults?.step));
     return { step };

package/dist/composites/docker-build.js

@@ -7,7 +7,7 @@ export const DockerBuild = Composite((props) => {
     const checkout = new Step({ name: "Checkout", uses: actionRef("actions/checkout") });
     const login = new Step({
         name: "Log in to container registry",
-        uses: "docker/login-action@v3",
+        uses: actionRef("docker/login-action"),
         with: {
             registry,
             username: "${{ github.actor }}",
@@ -16,7 +16,7 @@ export const DockerBuild = Composite((props) => {
     });
     const setupBuildx = new Step({
         name: "Set up Docker Buildx",
-        uses: "docker/setup-buildx-action@v3",
+        uses: actionRef("docker/setup-buildx-action"),
     });
     // Build tags for metadata action
     const tags = [`${imageName}:${tag}`];
@@ -26,7 +26,7 @@ export const DockerBuild = Composite((props) => {
     const metadata = new Step({
         name: "Extract metadata",
         id: "meta",
-        uses: "docker/metadata-action@v5",
+        uses: actionRef("docker/metadata-action"),
         with: {
             images: imageName,
             tags: tags.join("\n"),
@@ -49,7 +49,7 @@ export const DockerBuild = Composite((props) => {
     }
     const buildPush = new Step({
         name: "Build and push",
-        uses: "docker/build-push-action@v6",
+        uses: actionRef("docker/build-push-action"),
         with: buildPushWith,
     });
     const job = new Job(mergeDefaults({

package/dist/composites/download-artifact.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"download-artifact.d.ts","sourceRoot":"","sources":["../../src/composites/download-artifact.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAE1C,MAAM,WAAW,qBAAqB;IACpC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,EAAE;QACT,IAAI,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;KACvD,CAAC;CACH;AAED,eAAO,MAAM,gBAAgB;;EAcP,CAAC"}
+{"version":3,"file":"download-artifact.d.ts","sourceRoot":"","sources":["../../src/composites/download-artifact.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAE1C,MAAM,WAAW,qBAAqB;IACpC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,EAAE;QACT,IAAI,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;KACvD,CAAC;CACH;AAED,eAAO,MAAM,gBAAgB;;EAcP,CAAC"}

package/dist/composites/download-artifact.js

@@ -1,4 +1,5 @@
 import { Composite, mergeDefaults } from "@intentius/chant";
+import { actionRef } from "../action-pins.js";
 import { Step } from "../generated/index.js";
 export const DownloadArtifact = Composite((props) => {
     const { defaults } = props;
@@ -11,7 +12,7 @@ export const DownloadArtifact = Composite((props) => {
         withObj["merge-multiple"] = String(props.mergeMultiple);
     const step = new Step(mergeDefaults({
         name: "Download Artifact",
-        uses: "actions/download-artifact@v4",
+        uses: actionRef("actions/download-artifact"),
         ...(Object.keys(withObj).length > 0 ? { with: withObj } : {}),
     }, defaults?.step));
     return { step };

package/dist/composites/go-ci.js

@@ -10,7 +10,7 @@ export const GoCI = Composite((props) => {
             new Step({ name: "Checkout", uses: actionRef("actions/checkout") }),
             new Step({
                 name: "Setup Go",
-                uses: "actions/setup-go@v5",
+                uses: actionRef("actions/setup-go"),
                 with: { "go-version": goVersion },
             }),
             new Step({ name: "Build", run: buildCommand }),
@@ -23,7 +23,7 @@ export const GoCI = Composite((props) => {
             new Step({ name: "Checkout", uses: actionRef("actions/checkout") }),
             new Step({
                 name: "Setup Go",
-                uses: "actions/setup-go@v5",
+                uses: actionRef("actions/setup-go"),
                 with: { "go-version": goVersion },
             }),
             new Step({ name: "Test", run: testCommand }),
@@ -37,12 +37,12 @@ export const GoCI = Composite((props) => {
                 new Step({ name: "Checkout", uses: actionRef("actions/checkout") }),
                 new Step({
                     name: "Setup Go",
-                    uses: "actions/setup-go@v5",
+                    uses: actionRef("actions/setup-go"),
                     with: { "go-version": goVersion },
                 }),
                 new Step({
                     name: "Lint",
-                    uses: "golangci/golangci-lint-action@v6",
+                    uses: actionRef("golangci/golangci-lint-action"),
                     with: { args: lintCommand },
                 }),
             ],

package/dist/composites/node-pipeline.js

@@ -24,7 +24,7 @@ const cacheConfig = {
         cache: undefined,
         installCmd: "bun install --frozen-lockfile",
         runPrefix: "bun run",
-        setupAction: "oven-sh/setup-bun@v2",
+        setupAction: actionRef("oven-sh/setup-bun"),
     },
 };
 export const NodePipeline = Composite((props) => {
@@ -36,7 +36,7 @@ export const NodePipeline = Composite((props) => {
     // ── Build job steps ────────────────────────────────────────────────
     const buildCheckout = new Step({ name: "Checkout", uses: actionRef("actions/checkout") });
     const buildSetup = isBun
-        ? new Step({ name: "Setup Bun", uses: "oven-sh/setup-bun@v2" })
+        ? new Step({ name: "Setup Bun", uses: actionRef("oven-sh/setup-bun") })
         : new Step({
             name: "Setup Node.js",
             uses: actionRef("actions/setup-node"),
@@ -46,7 +46,7 @@ export const NodePipeline = Composite((props) => {
     const buildRun = new Step({ name: "Build", run: `${run} ${buildScript}` });
     const buildUpload = new Step({
         name: "Upload build artifacts",
-        uses: "actions/upload-artifact@v4",
+        uses: actionRef("actions/upload-artifact"),
         with: {
             name: artifactName,
             path: buildArtifactPaths.join("\n"),
@@ -60,7 +60,7 @@ export const NodePipeline = Composite((props) => {
     // ── Test job steps ─────────────────────────────────────────────────
     const testCheckout = new Step({ name: "Checkout", uses: actionRef("actions/checkout") });
     const testSetup = isBun
-        ? new Step({ name: "Setup Bun", uses: "oven-sh/setup-bun@v2" })
+        ? new Step({ name: "Setup Bun", uses: actionRef("oven-sh/setup-bun") })
         : new Step({
             name: "Setup Node.js",
             uses: actionRef("actions/setup-node"),
@@ -69,7 +69,7 @@ export const NodePipeline = Composite((props) => {
     const testInstall = new Step({ name: "Install dependencies", run: install });
     const testDownload = new Step({
         name: "Download build artifacts",
-        uses: "actions/download-artifact@v4",
+        uses: actionRef("actions/download-artifact"),
         with: { name: artifactName },
     });
     const testRun = new Step({ name: "Test", run: `${run} ${testScript}` });

package/dist/composites/python-ci.js

@@ -19,7 +19,7 @@ export const PythonCI = Composite((props) => {
             new Step({ name: "Checkout", uses: actionRef("actions/checkout") }),
             new Step({
                 name: "Setup Python",
-                uses: "actions/setup-python@v5",
+                uses: actionRef("actions/setup-python"),
                 with: { "python-version": pythonVersion, cache: cacheType },
             }),
             ...installSteps,
@@ -34,7 +34,7 @@ export const PythonCI = Composite((props) => {
                 new Step({ name: "Checkout", uses: actionRef("actions/checkout") }),
                 new Step({
                     name: "Setup Python",
-                    uses: "actions/setup-python@v5",
+                    uses: actionRef("actions/setup-python"),
                     with: { "python-version": pythonVersion, cache: cacheType },
                 }),
                 ...installSteps.map((s) => {

package/dist/composites/setup-go.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"setup-go.d.ts","sourceRoot":"","sources":["../../src/composites/setup-go.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAE1C,MAAM,WAAW,YAAY;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,QAAQ,CAAC,EAAE;QACT,IAAI,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;KACvD,CAAC;CACH;AAED,eAAO,MAAM,OAAO;;EAcP,CAAC"}
+{"version":3,"file":"setup-go.d.ts","sourceRoot":"","sources":["../../src/composites/setup-go.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAE1C,MAAM,WAAW,YAAY;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,QAAQ,CAAC,EAAE;QACT,IAAI,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;KACvD,CAAC;CACH;AAED,eAAO,MAAM,OAAO;;EAcP,CAAC"}

package/dist/composites/setup-go.js

@@ -1,4 +1,5 @@
 import { Composite, mergeDefaults } from "@intentius/chant";
+import { actionRef } from "../action-pins.js";
 import { Step } from "../generated/index.js";
 export const SetupGo = Composite((props) => {
     const { defaults } = props;
@@ -11,7 +12,7 @@ export const SetupGo = Composite((props) => {
         withObj.cache = String(props.cache);
     const step = new Step(mergeDefaults({
         name: "Setup Go",
-        uses: "actions/setup-go@v5",
+        uses: actionRef("actions/setup-go"),
         ...(Object.keys(withObj).length > 0 ? { with: withObj } : {}),
     }, defaults?.step));
     return { step };

package/dist/composites/setup-node.d.ts

@@ -6,9 +6,9 @@ export interface SetupNodeProps {
     cache?: string;
     cacheFilePath?: string;
     /**
-     * `"tag"` (default) emits the action's major tag. `"sha"` emits the commit
-     * SHA from the lexicon's pin table with the version as a YAML comment, which
-     * passes GHA021, GHA029 and GHA059.
+     * `"sha"` (default) emits the commit SHA from the pin table with the version as
+     * a YAML comment, which passes GHA021, GHA029 and GHA059. `"tag"` emits the
+     * action's major tag.
      */
     pin?: ActionPinMode;
     defaults?: {

package/dist/composites/setup-node.js

@@ -14,7 +14,7 @@ export const SetupNode = Composite((props) => {
         withObj["cache-dependency-path"] = props.cacheFilePath;
     const step = new Step(mergeDefaults({
         name: "Setup Node.js",
-        uses: actionRef("actions/setup-node", props.pin),
+        uses: actionRef("actions/setup-node", props.pin ?? "sha"),
         ...(Object.keys(withObj).length > 0 ? { with: withObj } : {}),
     }, defaults?.step));
     return { step };

package/dist/composites/setup-python.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"setup-python.d.ts","sourceRoot":"","sources":["../../src/composites/setup-python.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAE1C,MAAM,WAAW,gBAAgB;IAC/B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE;QACT,IAAI,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;KACvD,CAAC;CACH;AAED,eAAO,MAAM,WAAW;;EAcP,CAAC"}
+{"version":3,"file":"setup-python.d.ts","sourceRoot":"","sources":["../../src/composites/setup-python.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAE1C,MAAM,WAAW,gBAAgB;IAC/B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE;QACT,IAAI,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;KACvD,CAAC;CACH;AAED,eAAO,MAAM,WAAW;;EAcP,CAAC"}

package/dist/composites/setup-python.js

@@ -1,4 +1,5 @@
 import { Composite, mergeDefaults } from "@intentius/chant";
+import { actionRef } from "../action-pins.js";
 import { Step } from "../generated/index.js";
 export const SetupPython = Composite((props) => {
     const { defaults } = props;
@@ -11,7 +12,7 @@ export const SetupPython = Composite((props) => {
         withObj.architecture = props.architecture;
     const step = new Step(mergeDefaults({
         name: "Setup Python",
-        uses: "actions/setup-python@v5",
+        uses: actionRef("actions/setup-python"),
         ...(Object.keys(withObj).length > 0 ? { with: withObj } : {}),
     }, defaults?.step));
     return { step };

package/dist/composites/upload-artifact.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"upload-artifact.d.ts","sourceRoot":"","sources":["../../src/composites/upload-artifact.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAE1C,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,EAAE;QACT,IAAI,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;KACvD,CAAC;CACH;AAED,eAAO,MAAM,cAAc;;EAgBP,CAAC"}
+{"version":3,"file":"upload-artifact.d.ts","sourceRoot":"","sources":["../../src/composites/upload-artifact.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAE1C,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,EAAE;QACT,IAAI,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;KACvD,CAAC;CACH;AAED,eAAO,MAAM,cAAc;;EAgBP,CAAC"}

package/dist/composites/upload-artifact.js

@@ -1,4 +1,5 @@
 import { Composite, mergeDefaults } from "@intentius/chant";
+import { actionRef } from "../action-pins.js";
 import { Step } from "../generated/index.js";
 export const UploadArtifact = Composite((props) => {
     const { defaults } = props;
@@ -12,7 +13,7 @@ export const UploadArtifact = Composite((props) => {
         withObj["compression-level"] = String(props.compressionLevel);
     const step = new Step(mergeDefaults({
         name: "Upload Artifact",
-        uses: "actions/upload-artifact@v4",
+        uses: actionRef("actions/upload-artifact"),
         with: withObj,
     }, defaults?.step));
     return { step };

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "7b16495d7bcf5730a4297a1f5d7161d95dc75afe6ee026e72a7572889f953166",
+    "manifest.json": "2ab0288c67ef2f7a4bb7460a92ba6c3b41b4a9df4a621345b785232106686f03",
     "meta.json": "c50e0ef3845c370c3ad2210b8bba455980417c0f818aa6ed46e06d4fb8b1b9f9",
     "types/index.d.ts": "0ead95536e947ddfb98a5acf0ddb88547913b5a53a342df67711c59266f84b3e",
     "rules/deprecated-action-version.ts": "a9ba7cc924ff1c7055110416d8989273690415bfb5e8dcc32dc9431b9351f5ca",
@@ -78,5 +78,5 @@
     "skills/chant-github-patterns.md": "bb3abef289a8fdfcf07d6bb2d7289dcb2f38bc0cb0321ea320b78b45a6f548c0",
     "skills/chant-github-security.md": "aab111cb0871cad30281ce48d7da23663689619351029219e2be019a1a61e394"
   },
-  "composite": "1b42a70a674560e0669fbf3639c0e35712fbf1fe34700e1d6449aac5cd04190e"
+  "composite": "16abcb23dd004ef25298433d5f4d8fbbe6f21bd10e7ab5db5706818ba499f918"
 }

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "github",
-  "version": "0.124.45",
+  "version": "0.124.48",
   "chantVersion": ">=0.1.0",
   "namespace": "GitHub",
   "intrinsics": [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-github",
-  "version": "0.124.45",
+  "version": "0.124.48",
   "description": "GitHub Actions lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -61,6 +61,6 @@
     "typescript": "^5.9.3"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.124.45"
+    "@intentius/chant": "^0.124.48"
   }
 }

package/src/action-pins.test.ts

@@ -6,7 +6,12 @@ import { Workflow, Job } from "./generated/index";
 import { Checkout } from "./composites/checkout";
 import { SetupNode } from "./composites/setup-node";
 import { githubSerializer } from "./serializer";
+import { ACTION_PINS as CORE_PINS } from "@intentius/chant/action-pins";
 import { ACTION_PINS, actionRef } from "./action-pins";
+import { CacheAction } from "./composites/cache";
+import { DockerBuild } from "./composites/docker-build";
+import { GoCI } from "./composites/go-ci";
+import { UploadArtifact } from "./composites/upload-artifact";
 import { gha021 } from "./lint/post-synth/gha021";
 import { gha029 } from "./lint/post-synth/gha029";
 import { gha059 } from "./lint/post-synth/gha059";
@@ -47,15 +52,33 @@ describe("action pins (#2510)", () => {
     }
   });
 
-  test("Checkout and SetupNode default to the current major, not v4", () => {
-    expect((Checkout({}).step.props as { uses?: string }).uses).toBe("actions/checkout@v7");
-    expect((SetupNode({}).step.props as { uses?: string }).uses).toBe("actions/setup-node@v7");
+  test("every row is a row of core's table (#4410)", () => {
+    const coreShas = new Set(Object.values(CORE_PINS).map((p) => p.sha));
+    for (const [slug, pin] of Object.entries(ACTION_PINS)) {
+      expect({ slug, inCore: coreShas.has(pin.sha) }).toEqual({ slug, inCore: true });
+    }
+    expect(ACTION_PINS["actions/setup-node"].sha).toBe(CORE_PINS.setupNode7.sha);
+  });
+
+  test("composites default to the pinned SHA with the release comment (#4410)", () => {
+    const uses = (c: { step: unknown }) => ((c.step as { props: unknown }).props as { uses?: string }).uses;
+    expect(uses(Checkout({}))).toBe(actionRef("actions/checkout", "sha"));
+    expect(uses(SetupNode({}))).toBe(actionRef("actions/setup-node", "sha"));
+    expect(uses(CacheAction({ path: "p", key: "k" }))).toBe(actionRef("actions/cache", "sha"));
+    expect(uses(UploadArtifact({ name: "n", path: "p" }))).toBe(actionRef("actions/upload-artifact", "sha"));
+    expect(actionRef("actions/checkout", "sha")).toMatch(/^actions\/checkout@[0-9a-f]{40} # v\d+\.\d+\.\d+$/);
+  });
+
+  test("pin: \"tag\" still emits the major tag, and an explicit ref wins", () => {
+    expect((Checkout({ pin: "tag" }).step.props as { uses?: string }).uses).toBe("actions/checkout@v7");
+    const mine = CacheAction({ path: "p", key: "k", defaults: { step: { uses: "actions/cache@v3" } } });
+    expect((mine.step.props as { uses?: string }).uses).toBe("actions/cache@v3");
   });
 
   test("pin: \"sha\" writes the SHA as the ref and the version as a YAML comment", () => {
     const yaml = workflowYaml("sha");
     expect(yaml).toContain(`uses: actions/checkout@${ACTION_PINS["actions/checkout"].sha} # v7.0.1\n`);
-    expect(yaml).toContain(`uses: actions/setup-node@${ACTION_PINS["actions/setup-node"].sha} # v7.0.0\n`);
+    expect(yaml).toContain(`uses: actions/setup-node@${ACTION_PINS["actions/setup-node"].sha} # ${ACTION_PINS["actions/setup-node"].version}\n`);
     expect(yaml).not.toMatch(/uses: '/);
   });
 
@@ -63,8 +86,8 @@ describe("action pins (#2510)", () => {
     expect(pinningFindings(workflowYaml("sha"))).toEqual([]);
   });
 
-  test("the default tag warning names the exact fix", () => {
-    const messages = pinningFindings(workflowYaml()).map((d) => d.message);
+  test("the tag warning names the exact fix", () => {
+    const messages = pinningFindings(workflowYaml("tag")).map((d) => d.message);
     expect(messages).toHaveLength(2);
     expect(messages[0]).toContain(`\`uses: ${actionRef("actions/checkout", "sha")}\``);
     expect(messages[0]).toContain(`Checkout({ pin: "sha" })`);