@intentius/chant-lexicon-github 0.124.45 → 0.124.48

package/src/action-pins.ts

@@ -1,22 +1,23 @@
 /**
- * The action versions the github lexicon emits, and the commit each release
- * tag points at.
+ * The action versions the github lexicon emits. The table is core's
+ * (`@intentius/chant/action-pins`, #4403); this file reads it, so an update is
+ * one change there (#4410). Each action here is its newest row in core's table,
+ * pinned at the commit of its latest release.
  *
- * Composites emit `<slug>@<major>` by default. With `pin: "sha"` they emit
- * `<slug>@<sha> # <version>`, the form GHA021 and GHA029 accept and GHA059
- * reads the version label from. The serializer writes the `# <version>` part
- * as a YAML comment, so GitHub sees only the SHA.
+ * Composites emit `<slug>@<sha> # <version>` by default, the form GHA021 and
+ * GHA029 accept and GHA059 reads the version label from. The serializer writes
+ * the `# <version>` part as a YAML comment, so GitHub sees only the SHA. With
+ * `pin: "tag"` they emit the major tag (`actions/checkout@v7`).
  *
- * Refresh a row by resolving the release tag to its commit:
+ * Refresh a row in core by resolving the release tag to its commit:
  *
  *   gh api repos/actions/checkout/commits/v7.0.1 --jq .sha
- *
- * Keep `major` on a version whose action runs on a Node runtime GitHub still
- * supports.
  */
 
+import { ACTION_PINS as CORE_PINS, type ActionPin as CorePin } from "@intentius/chant/action-pins";
+
 export interface ActionPin {
-  /** The major tag composites emit by default, such as `v7`. */
+  /** The major tag `pin: "tag"` emits, such as `v7`. */
   major: string;
   /** The release the SHA belongs to, written as the pin's comment. */
   version: string;
@@ -24,42 +25,53 @@ export interface ActionPin {
   sha: string;
 }
 
-export const ACTION_PINS = {
-  "actions/checkout": {
-    major: "v7",
-    version: "v7.0.1",
-    sha: "3d3c42e5aac5ba805825da76410c181273ba90b1",
-  },
-  "actions/setup-node": {
-    major: "v7",
-    version: "v7.0.0",
-    sha: "820762786026740c76f36085b0efc47a31fe5020",
-  },
-} as const satisfies Record<string, ActionPin>;
+const SLUGS = [
+  "actions/checkout",
+  "actions/setup-node",
+  "actions/setup-go",
+  "actions/setup-python",
+  "actions/cache",
+  "actions/upload-artifact",
+  "actions/download-artifact",
+  "oven-sh/setup-bun",
+  "golangci/golangci-lint-action",
+  "docker/login-action",
+  "docker/setup-buildx-action",
+  "docker/metadata-action",
+  "docker/build-push-action",
+] as const;
+
+export type PinnedAction = (typeof SLUGS)[number];
+
+/** The newest row of core's table for `slug`. */
+function newest(slug: string): ActionPin {
+  const rows = (Object.values(CORE_PINS) as CorePin[]).filter((p) => p.slug === slug);
+  if (rows.length === 0) throw new Error(`action-pins: core's table has no row for ${slug}`);
+  const row = rows.reduce((a, b) => (Number(b.major.slice(1)) > Number(a.major.slice(1)) ? b : a));
+  return { major: row.major, version: row.tag, sha: row.sha };
+}
 
-export type PinnedAction = keyof typeof ACTION_PINS;
+export const ACTION_PINS = Object.fromEntries(SLUGS.map((s) => [s, newest(s)])) as Record<PinnedAction, ActionPin>;
 
 /**
- * How a composite refers to its action: `"tag"` emits the major tag
- * (`actions/checkout@v7`), `"sha"` emits the pinned commit with its version
- * as a comment (`actions/checkout@3d3c…90b1 # v7.0.1`).
+ * How a composite refers to its action: `"sha"` (the default) emits the pinned
+ * commit with its version as a comment (`actions/checkout@3d3c…90b1 # v7.0.1`),
+ * `"tag"` emits the major tag (`actions/checkout@v7`).
  */
 export type ActionPinMode = "tag" | "sha";
 
 /** The `uses:` value for a pinned action. */
-export function actionRef(slug: PinnedAction, pin: ActionPinMode = "tag"): string {
-  const entry: ActionPin = ACTION_PINS[slug];
+export function actionRef(slug: PinnedAction, pin: ActionPinMode = "sha"): string {
+  const entry = ACTION_PINS[slug];
   return pin === "sha" ? `${slug}@${entry.sha} # ${entry.version}` : `${slug}@${entry.major}`;
 }
 
 /** The pin table entry for an action slug, if the lexicon maintains one. */
 export function actionPin(slug: string): ActionPin | undefined {
-  return Object.prototype.hasOwnProperty.call(ACTION_PINS, slug)
-    ? ACTION_PINS[slug as PinnedAction]
-    : undefined;
+  return Object.prototype.hasOwnProperty.call(ACTION_PINS, slug) ? ACTION_PINS[slug as PinnedAction] : undefined;
 }
 
-const COMPOSITE_FOR: Record<PinnedAction, string> = {
+const COMPOSITE_FOR: Partial<Record<PinnedAction, string>> = {
   "actions/checkout": "Checkout",
   "actions/setup-node": "SetupNode",
 };
@@ -71,5 +83,7 @@ const COMPOSITE_FOR: Record<PinnedAction, string> = {
 export function pinFixHint(slug: string): string {
   if (!actionPin(slug)) return "";
   const pinned = slug as PinnedAction;
-  return ` Use \`uses: ${actionRef(pinned, "sha")}\`, which ${COMPOSITE_FOR[pinned]}({ pin: "sha" }) emits.`;
+  const composite = COMPOSITE_FOR[pinned];
+  const how = composite ? `, which ${composite}({ pin: "sha" }) emits` : "";
+  return ` Use \`uses: ${actionRef(pinned, "sha")}\`${how}.`;
 }

package/src/components/__fixtures__/pr-loop-build.github.golden.yml

@@ -71,7 +71,6 @@ jobs:
         env:
           BASE_SHA: '${{ github.event.pull_request.base.sha }}'
           PR_NUMBER: '${{ github.event.pull_request.number }}'
-          CHANT_RUNNER_KEY: '${{ secrets.CHANT_RUNNER_KEY }}'
         run: |
           if [ -z "${CHANT_NO_FORGE_TOKEN:-}" ] && [ "${0#*/}" != "$0" ] && [ -f "$0" ] && ! { [ "${0##*/}" = sh ] || [ "${0##*/}" = bash ] || [ "${0##*/}" = dash ]; } && command -v env >/dev/null 2>&1 && command -v sh >/dev/null 2>&1; then exec env -u CHANT_FORGE_TOKEN -u CHANT_GITHUB_TOKEN -u CHANT_FORGEJO_TOKEN -u CHANT_GITLAB_TOKEN -u CHANT_CHECKOUT_TOKEN -u GITHUB_TOKEN -u GH_TOKEN -u FORGEJO_TOKEN -u GITEA_TOKEN -u GITLAB_TOKEN -u CI_JOB_TOKEN -u ACTIONS_RUNTIME_TOKEN CHANT_NO_FORGE_TOKEN=1 sh -e "$0"; fi; unset CHANT_FORGE_TOKEN CHANT_GITHUB_TOKEN CHANT_FORGEJO_TOKEN CHANT_GITLAB_TOKEN CHANT_CHECKOUT_TOKEN GITHUB_TOKEN GH_TOKEN FORGEJO_TOKEN GITEA_TOKEN GITLAB_TOKEN CI_JOB_TOKEN ACTIONS_RUNTIME_TOKEN
           chant_report="$PWD/.chant/pr"
@@ -91,7 +90,7 @@ jobs:
       statuses: write
     steps:
       - name: Check out the target branch's commit
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: '${{ github.event.pull_request.base.sha }}'
       - name: Take the plan report from the plan job
@@ -102,7 +101,7 @@ jobs:
           END_OF_REPORT
       - name: Keep the plan report
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: chant-pr-plan
           path: .chant/pr
@@ -128,7 +127,7 @@ jobs:
       pull-requests: write
       statuses: write
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
       - run: command -v tofu >/dev/null 2>&1 || (curl -fsSL https://get.opentofu.org/install-opentofu.sh -o /tmp/install-opentofu.sh && sh /tmp/install-opentofu.sh --install-method standalone)
@@ -146,7 +145,7 @@ jobs:
           chant ci run record --in-place --base "$BASE_SHA" --env prod --gate pr-apply --forge github
       - name: Keep the record report
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: chant-pr-record
           path: .chant/pr
@@ -164,7 +163,7 @@ jobs:
       pull-requests: write
       statuses: write
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
       - run: command -v tofu >/dev/null 2>&1 || (curl -fsSL https://get.opentofu.org/install-opentofu.sh -o /tmp/install-opentofu.sh && sh /tmp/install-opentofu.sh --install-method standalone)
@@ -173,7 +172,7 @@ jobs:
       - name: Lint the project
         run: chant lint
       - name: Restore the record of an earlier attempt at this commit
-        uses: actions/cache/restore@v4
+        uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: .chant/pr-resume/pr-apply.json
           key: chant-apply-prod-${{ github.sha }}-${{ github.run_id }}-${{ github.run_attempt }}
@@ -187,13 +186,13 @@ jobs:
           chant ci run apply --in-place --env prod --gate pr-apply --forge github
       - name: Keep the record for a re-run
         if: always()
-        uses: actions/cache/save@v4
+        uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: .chant/pr-resume/pr-apply.json
           key: chant-apply-prod-${{ github.sha }}-${{ github.run_id }}-${{ github.run_attempt }}
       - name: Keep the apply report
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: chant-pr-apply
           path: .chant/pr

package/src/components/__fixtures__/pr-loop-record.github.golden.yml

@@ -57,7 +57,6 @@ jobs:
         env:
           BASE_SHA: '${{ github.event.pull_request.base.sha }}'
           PR_NUMBER: '${{ github.event.pull_request.number }}'
-          CHANT_RUNNER_KEY: '${{ secrets.CHANT_RUNNER_KEY }}'
         run: |
           if [ -z "${CHANT_NO_FORGE_TOKEN:-}" ] && [ "${0#*/}" != "$0" ] && [ -f "$0" ] && ! { [ "${0##*/}" = sh ] || [ "${0##*/}" = bash ] || [ "${0##*/}" = dash ]; } && command -v env >/dev/null 2>&1 && command -v sh >/dev/null 2>&1; then exec env -u CHANT_FORGE_TOKEN -u CHANT_GITHUB_TOKEN -u CHANT_FORGEJO_TOKEN -u CHANT_GITLAB_TOKEN -u CHANT_CHECKOUT_TOKEN -u GITHUB_TOKEN -u GH_TOKEN -u FORGEJO_TOKEN -u GITEA_TOKEN -u GITLAB_TOKEN -u CI_JOB_TOKEN -u ACTIONS_RUNTIME_TOKEN CHANT_NO_FORGE_TOKEN=1 sh -e "$0"; fi; unset CHANT_FORGE_TOKEN CHANT_GITHUB_TOKEN CHANT_FORGEJO_TOKEN CHANT_GITLAB_TOKEN CHANT_CHECKOUT_TOKEN GITHUB_TOKEN GH_TOKEN FORGEJO_TOKEN GITEA_TOKEN GITLAB_TOKEN CI_JOB_TOKEN ACTIONS_RUNTIME_TOKEN
           chant_report="$PWD/.chant/pr"
@@ -77,7 +76,7 @@ jobs:
       statuses: write
     steps:
       - name: Check out the target branch's commit
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: '${{ github.event.pull_request.base.sha }}'
       - name: Take the plan report from the plan job
@@ -88,7 +87,7 @@ jobs:
           END_OF_REPORT
       - name: Keep the plan report
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: chant-pr-plan
           path: .chant/pr
@@ -114,7 +113,7 @@ jobs:
       pull-requests: write
       statuses: write
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
       - run: command -v tofu >/dev/null 2>&1 || (curl -fsSL https://get.opentofu.org/install-opentofu.sh -o /tmp/install-opentofu.sh && sh /tmp/install-opentofu.sh --install-method standalone)
@@ -128,7 +127,7 @@ jobs:
           chant ci run record --in-place --base "$BASE_SHA" --env prod --gate pr-apply --forge github
       - name: Keep the record report
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: chant-pr-record
           path: .chant/pr

package/src/components/__fixtures__/pr-loop-waves.github.golden.yml

@@ -63,7 +63,6 @@ jobs:
         env:
           BASE_SHA: '${{ github.event.pull_request.base.sha }}'
           PR_NUMBER: '${{ github.event.pull_request.number }}'
-          CHANT_RUNNER_KEY: '${{ secrets.CHANT_RUNNER_KEY }}'
         run: |
           if [ -z "${CHANT_NO_FORGE_TOKEN:-}" ] && [ "${0#*/}" != "$0" ] && [ -f "$0" ] && ! { [ "${0##*/}" = sh ] || [ "${0##*/}" = bash ] || [ "${0##*/}" = dash ]; } && command -v env >/dev/null 2>&1 && command -v sh >/dev/null 2>&1; then exec env -u CHANT_FORGE_TOKEN -u CHANT_GITHUB_TOKEN -u CHANT_FORGEJO_TOKEN -u CHANT_GITLAB_TOKEN -u CHANT_CHECKOUT_TOKEN -u GITHUB_TOKEN -u GH_TOKEN -u FORGEJO_TOKEN -u GITEA_TOKEN -u GITLAB_TOKEN -u CI_JOB_TOKEN -u ACTIONS_RUNTIME_TOKEN CHANT_NO_FORGE_TOKEN=1 sh -e "$0"; fi; unset CHANT_FORGE_TOKEN CHANT_GITHUB_TOKEN CHANT_FORGEJO_TOKEN CHANT_GITLAB_TOKEN CHANT_CHECKOUT_TOKEN GITHUB_TOKEN GH_TOKEN FORGEJO_TOKEN GITEA_TOKEN GITLAB_TOKEN CI_JOB_TOKEN ACTIONS_RUNTIME_TOKEN
           chant_report="$PWD/.chant/pr"
@@ -83,7 +82,7 @@ jobs:
       statuses: write
     steps:
       - name: Check out the target branch's commit
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: '${{ github.event.pull_request.base.sha }}'
       - name: Take the plan report from the plan job
@@ -94,7 +93,7 @@ jobs:
           END_OF_REPORT
       - name: Keep the plan report
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: chant-pr-plan
           path: .chant/pr
@@ -120,7 +119,7 @@ jobs:
       pull-requests: write
       statuses: write
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
       - run: command -v tofu >/dev/null 2>&1 || (curl -fsSL https://get.opentofu.org/install-opentofu.sh -o /tmp/install-opentofu.sh && sh /tmp/install-opentofu.sh --install-method standalone)
@@ -134,7 +133,7 @@ jobs:
           chant ci run record --in-place --base "$BASE_SHA" --env prod --gate pr-apply --forge github
       - name: Keep the record report
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: chant-pr-record
           path: .chant/pr
@@ -154,12 +153,12 @@ jobs:
     outputs:
       green-sha: '${{ steps.apply.outputs.green-sha }}'
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
       - run: command -v tofu >/dev/null 2>&1 || (curl -fsSL https://get.opentofu.org/install-opentofu.sh -o /tmp/install-opentofu.sh && sh /tmp/install-opentofu.sh --install-method standalone)
       - name: Restore the newest record of this commit's apply
-        uses: actions/cache/restore@v4
+        uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: .chant/pr-resume/pr-apply.json
           key: chant-apply-prod-${{ github.sha }}-${{ github.run_id }}-${{ github.run_attempt }}-wave-1
@@ -175,13 +174,13 @@ jobs:
           chant ci run apply --in-place --env prod --gate pr-apply --forge github --wave-gate release --wave 1
       - name: Keep the record for the next wave and a re-run
         if: always()
-        uses: actions/cache/save@v4
+        uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: .chant/pr-resume/pr-apply.json
           key: chant-apply-prod-${{ github.sha }}-${{ github.run_id }}-${{ github.run_attempt }}-wave-1
       - name: Keep the wave 1 apply report
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: chant-pr-apply-wave-1
           path: .chant/pr
@@ -203,12 +202,12 @@ jobs:
     outputs:
       green-sha: '${{ steps.apply.outputs.green-sha }}'
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
       - run: command -v tofu >/dev/null 2>&1 || (curl -fsSL https://get.opentofu.org/install-opentofu.sh -o /tmp/install-opentofu.sh && sh /tmp/install-opentofu.sh --install-method standalone)
       - name: Restore the newest record of this commit's apply
-        uses: actions/cache/restore@v4
+        uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: .chant/pr-resume/pr-apply.json
           key: chant-apply-prod-${{ github.sha }}-${{ github.run_id }}-${{ github.run_attempt }}-wave-2
@@ -225,13 +224,13 @@ jobs:
           chant ci run apply --in-place --env prod --gate pr-apply --forge github --wave-gate release --wave 2
       - name: Keep the record for the next wave and a re-run
         if: always()
-        uses: actions/cache/save@v4
+        uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: .chant/pr-resume/pr-apply.json
           key: chant-apply-prod-${{ github.sha }}-${{ github.run_id }}-${{ github.run_attempt }}-wave-2
       - name: Keep the wave 2 apply report
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: chant-pr-apply-wave-2
           path: .chant/pr
@@ -253,12 +252,12 @@ jobs:
     outputs:
       green-sha: '${{ steps.apply.outputs.green-sha }}'
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
       - run: command -v tofu >/dev/null 2>&1 || (curl -fsSL https://get.opentofu.org/install-opentofu.sh -o /tmp/install-opentofu.sh && sh /tmp/install-opentofu.sh --install-method standalone)
       - name: Restore the newest record of this commit's apply
-        uses: actions/cache/restore@v4
+        uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: .chant/pr-resume/pr-apply.json
           key: chant-apply-prod-${{ github.sha }}-${{ github.run_id }}-${{ github.run_attempt }}-wave-3
@@ -275,13 +274,13 @@ jobs:
           chant ci run apply --in-place --env prod --gate pr-apply --forge github --wave-gate release --wave 3
       - name: Keep the record for the next wave and a re-run
         if: always()
-        uses: actions/cache/save@v4
+        uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: .chant/pr-resume/pr-apply.json
           key: chant-apply-prod-${{ github.sha }}-${{ github.run_id }}-${{ github.run_attempt }}-wave-3
       - name: Keep the wave 3 apply report
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: chant-pr-apply-wave-3
           path: .chant/pr

package/src/components/__fixtures__/pr-loop.github.golden.yml

@@ -63,7 +63,6 @@ jobs:
         env:
           BASE_SHA: '${{ github.event.pull_request.base.sha }}'
           PR_NUMBER: '${{ github.event.pull_request.number }}'
-          CHANT_RUNNER_KEY: '${{ secrets.CHANT_RUNNER_KEY }}'
         run: |
           if [ -z "${CHANT_NO_FORGE_TOKEN:-}" ] && [ "${0#*/}" != "$0" ] && [ -f "$0" ] && ! { [ "${0##*/}" = sh ] || [ "${0##*/}" = bash ] || [ "${0##*/}" = dash ]; } && command -v env >/dev/null 2>&1 && command -v sh >/dev/null 2>&1; then exec env -u CHANT_FORGE_TOKEN -u CHANT_GITHUB_TOKEN -u CHANT_FORGEJO_TOKEN -u CHANT_GITLAB_TOKEN -u CHANT_CHECKOUT_TOKEN -u GITHUB_TOKEN -u GH_TOKEN -u FORGEJO_TOKEN -u GITEA_TOKEN -u GITLAB_TOKEN -u CI_JOB_TOKEN -u ACTIONS_RUNTIME_TOKEN CHANT_NO_FORGE_TOKEN=1 sh -e "$0"; fi; unset CHANT_FORGE_TOKEN CHANT_GITHUB_TOKEN CHANT_FORGEJO_TOKEN CHANT_GITLAB_TOKEN CHANT_CHECKOUT_TOKEN GITHUB_TOKEN GH_TOKEN FORGEJO_TOKEN GITEA_TOKEN GITLAB_TOKEN CI_JOB_TOKEN ACTIONS_RUNTIME_TOKEN
           chant_report="$PWD/.chant/pr"
@@ -83,7 +82,7 @@ jobs:
       statuses: write
     steps:
       - name: Check out the target branch's commit
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: '${{ github.event.pull_request.base.sha }}'
       - name: Take the plan report from the plan job
@@ -94,7 +93,7 @@ jobs:
           END_OF_REPORT
       - name: Keep the plan report
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: chant-pr-plan
           path: .chant/pr
@@ -120,7 +119,7 @@ jobs:
       pull-requests: write
       statuses: write
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
       - run: command -v tofu >/dev/null 2>&1 || (curl -fsSL https://get.opentofu.org/install-opentofu.sh -o /tmp/install-opentofu.sh && sh /tmp/install-opentofu.sh --install-method standalone)
@@ -134,7 +133,7 @@ jobs:
           chant ci run record --in-place --base "$BASE_SHA" --env prod --gate pr-apply --forge github
       - name: Keep the record report
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: chant-pr-record
           path: .chant/pr
@@ -152,12 +151,12 @@ jobs:
       pull-requests: write
       statuses: write
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
       - run: command -v tofu >/dev/null 2>&1 || (curl -fsSL https://get.opentofu.org/install-opentofu.sh -o /tmp/install-opentofu.sh && sh /tmp/install-opentofu.sh --install-method standalone)
       - name: Restore the record of an earlier attempt at this commit
-        uses: actions/cache/restore@v4
+        uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: .chant/pr-resume/pr-apply.json
           key: chant-apply-prod-${{ github.sha }}-${{ github.run_id }}-${{ github.run_attempt }}
@@ -171,13 +170,13 @@ jobs:
           chant ci run apply --in-place --env prod --gate pr-apply --forge github
       - name: Keep the record for a re-run
         if: always()
-        uses: actions/cache/save@v4
+        uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: .chant/pr-resume/pr-apply.json
           key: chant-apply-prod-${{ github.sha }}-${{ github.run_id }}-${{ github.run_attempt }}
       - name: Keep the apply report
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: chant-pr-apply
           path: .chant/pr

package/src/components/__golden__/op-waves-jobs.yml

@@ -20,15 +20,25 @@ jobs:
       - dev
     container: node:22
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
       - name: Plan, gate and apply wave 1 (dev)
         run: chant run wave --spec waves.json --wave 1
+      - name: Keep the job's outcome
+        if: always()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: migrations-wave-1-dev-outcome
+          path: .chant/op-waves/migrations/outcomes/outcome-wave-1.json
+          if-no-files-found: ignore
+          include-hidden-files: true
+          overwrite: true
   wave-2-prod-decide:
     runs-on: plan
     needs:
       - wave-1-dev
+    if: '!cancelled()'
     container: node:22
     permissions:
       contents: write
@@ -37,20 +47,33 @@ jobs:
       STAGE: apply
       PLAN_TOKEN_AUDIENCE: plan.example
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
+      - name: Download the earlier jobs' outcomes
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        with:
+          path: .chant/op-waves/migrations/outcomes
       - name: Plan wave 2 (prod) and decide its gate
         run: chant run wave --spec waves.json --wave 2 --decide
       - name: Keep wave 2's decision
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: migrations-wave-2-decision
           path: .chant/op-waves/migrations/wave-2.json
           if-no-files-found: ignore
           include-hidden-files: true
           overwrite: true
+      - name: Keep the job's outcome
+        if: always()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: migrations-wave-2-prod-decide-outcome
+          path: .chant/op-waves/migrations/outcomes/outcome-wave-2.json
+          if-no-files-found: ignore
+          include-hidden-files: true
+          overwrite: true
   wave-2-prod-us-share-1:
     runs-on:
       group: prod-apply
@@ -69,17 +92,30 @@ jobs:
       REGION: us
       CLOUD_TOKEN_AUDIENCE: us.example
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
       - name: Download wave 2's decision
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
         with:
           name: migrations-wave-2-decision
           path: .chant/op-waves/migrations
+      - name: Download the earlier jobs' outcomes
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        with:
+          path: .chant/op-waves/migrations/outcomes
       - run: echo us
       - name: Apply share 1 of job group us of wave 2 (prod)
         run: chant run wave --spec waves.json --wave 2 --group us --share 1
+      - name: Keep the job's outcome
+        if: always()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: migrations-wave-2-prod-us-share-1-outcome
+          path: .chant/op-waves/migrations/outcomes/outcome-wave-2-group-us-share-1.json
+          if-no-files-found: ignore
+          include-hidden-files: true
+          overwrite: true
   wave-2-prod-us-share-2:
     runs-on:
       group: prod-apply
@@ -98,17 +134,30 @@ jobs:
       REGION: us
       CLOUD_TOKEN_AUDIENCE: us.example
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
       - name: Download wave 2's decision
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
         with:
           name: migrations-wave-2-decision
           path: .chant/op-waves/migrations
+      - name: Download the earlier jobs' outcomes
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        with:
+          path: .chant/op-waves/migrations/outcomes
       - run: echo us
       - name: Apply share 2 of job group us of wave 2 (prod)
         run: chant run wave --spec waves.json --wave 2 --group us --share 2
+      - name: Keep the job's outcome
+        if: always()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: migrations-wave-2-prod-us-share-2-outcome
+          path: .chant/op-waves/migrations/outcomes/outcome-wave-2-group-us-share-2.json
+          if-no-files-found: ignore
+          include-hidden-files: true
+          overwrite: true
   wave-2-prod-eu:
     runs-on: eu-apply
     needs:
@@ -123,13 +172,26 @@ jobs:
       STAGE: apply
       PLAN_TOKEN_AUDIENCE: plan.example
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
       - name: Download wave 2's decision
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
         with:
           name: migrations-wave-2-decision
           path: .chant/op-waves/migrations
+      - name: Download the earlier jobs' outcomes
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        with:
+          path: .chant/op-waves/migrations/outcomes
       - name: Apply job group eu of wave 2 (prod)
         run: chant run wave --spec waves.json --wave 2 --group eu
+      - name: Keep the job's outcome
+        if: always()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: migrations-wave-2-prod-eu-outcome
+          path: .chant/op-waves/migrations/outcomes/outcome-wave-2-group-eu.json
+          if-no-files-found: ignore
+          include-hidden-files: true
+          overwrite: true

package/src/components/ci-jobs.ts

@@ -11,15 +11,18 @@
 import { emitYAML, emitYAMLEntry } from "@intentius/chant/yaml";
 import { BUILD_REQUEST_TAGS, GITHUB_JOB_TOKEN, pushBranches } from "@intentius/chant/ci-jobs";
 import type { OpTrigger } from "@intentius/chant/lexicon";
-import { actionRef } from "../action-pins";
+import { ACTION_PINS as PINS, tagComments, usesRef } from "@intentius/chant/action-pins";
 
 /** The artifact actions every generated job uses, at the major the generators have always pinned. */
-export const UPLOAD_ARTIFACT = "actions/upload-artifact@v4";
-export const DOWNLOAD_ARTIFACT = "actions/download-artifact@v4";
+export const UPLOAD_ARTIFACT = usesRef(PINS.uploadArtifact4);
+export const DOWNLOAD_ARTIFACT = usesRef(PINS.downloadArtifact4);
+export const CHECKOUT = usesRef(PINS.checkout7);
+export const CACHE_RESTORE = usesRef(PINS.cacheRestore4);
+export const CACHE_SAVE = usesRef(PINS.cacheSave4);
 
 /** The checkout step; `fullHistory` fetches every commit, for a job that reads the base commit or measures a change with git. */
 export function checkoutStep(fullHistory = false): Record<string, unknown> {
-  return fullHistory ? { uses: actionRef("actions/checkout"), with: { "fetch-depth": 0 } } : { uses: actionRef("actions/checkout") };
+  return fullHistory ? { uses: CHECKOUT, with: { "fetch-depth": 0 } } : { uses: CHECKOUT };
 }
 
 /** One `run:` step per line, so each line is its own step in the log. */
@@ -135,5 +138,5 @@ export function emitWorkflowYAML(doc: GithubWorkflowDoc): string {
   if (doc.concurrency) sections.push(emitYAMLEntry("concurrency", doc.concurrency));
   if (doc.permissions && Object.keys(doc.permissions).length > 0) sections.push(emitYAMLEntry("permissions", doc.permissions));
   sections.push(emitYAMLEntry("jobs", doc.jobsDoc));
-  return sections.join("\n\n") + "\n";
+  return tagComments(sections.join("\n\n") + "\n");
 }