@intentius/chant-lexicon-github 0.124.46 → 0.124.48

package/dist/action-pins.d.ts

@@ -1,44 +1,33 @@
 /**
- * The action versions the github lexicon emits, and the commit each release
- * tag points at.
+ * The action versions the github lexicon emits. The table is core's
+ * (`@intentius/chant/action-pins`, #4403); this file reads it, so an update is
+ * one change there (#4410). Each action here is its newest row in core's table,
+ * pinned at the commit of its latest release.
  *
- * Composites emit `<slug>@<major>` by default. With `pin: "sha"` they emit
- * `<slug>@<sha> # <version>`, the form GHA021 and GHA029 accept and GHA059
- * reads the version label from. The serializer writes the `# <version>` part
- * as a YAML comment, so GitHub sees only the SHA.
+ * Composites emit `<slug>@<sha> # <version>` by default, the form GHA021 and
+ * GHA029 accept and GHA059 reads the version label from. The serializer writes
+ * the `# <version>` part as a YAML comment, so GitHub sees only the SHA. With
+ * `pin: "tag"` they emit the major tag (`actions/checkout@v7`).
  *
- * Refresh a row by resolving the release tag to its commit:
+ * Refresh a row in core by resolving the release tag to its commit:
  *
  *   gh api repos/actions/checkout/commits/v7.0.1 --jq .sha
- *
- * Keep `major` on a version whose action runs on a Node runtime GitHub still
- * supports.
  */
 export interface ActionPin {
-    /** The major tag composites emit by default, such as `v7`. */
+    /** The major tag `pin: "tag"` emits, such as `v7`. */
     major: string;
     /** The release the SHA belongs to, written as the pin's comment. */
     version: string;
     /** The full commit SHA of `version`. */
     sha: string;
 }
-export declare const ACTION_PINS: {
-    readonly "actions/checkout": {
-        readonly major: "v7";
-        readonly version: "v7.0.1";
-        readonly sha: "3d3c42e5aac5ba805825da76410c181273ba90b1";
-    };
-    readonly "actions/setup-node": {
-        readonly major: "v7";
-        readonly version: "v7.0.0";
-        readonly sha: "820762786026740c76f36085b0efc47a31fe5020";
-    };
-};
-export type PinnedAction = keyof typeof ACTION_PINS;
+declare const SLUGS: readonly ["actions/checkout", "actions/setup-node", "actions/setup-go", "actions/setup-python", "actions/cache", "actions/upload-artifact", "actions/download-artifact", "oven-sh/setup-bun", "golangci/golangci-lint-action", "docker/login-action", "docker/setup-buildx-action", "docker/metadata-action", "docker/build-push-action"];
+export type PinnedAction = (typeof SLUGS)[number];
+export declare const ACTION_PINS: Record<PinnedAction, ActionPin>;
 /**
- * How a composite refers to its action: `"tag"` emits the major tag
- * (`actions/checkout@v7`), `"sha"` emits the pinned commit with its version
- * as a comment (`actions/checkout@3d3c…90b1 # v7.0.1`).
+ * How a composite refers to its action: `"sha"` (the default) emits the pinned
+ * commit with its version as a comment (`actions/checkout@3d3c…90b1 # v7.0.1`),
+ * `"tag"` emits the major tag (`actions/checkout@v7`).
  */
 export type ActionPinMode = "tag" | "sha";
 /** The `uses:` value for a pinned action. */
@@ -50,4 +39,5 @@ export declare function actionPin(slug: string): ActionPin | undefined;
  * an empty string for any other action.
  */
 export declare function pinFixHint(slug: string): string;
+export {};
 //# sourceMappingURL=action-pins.d.ts.map

package/dist/action-pins.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"action-pins.d.ts","sourceRoot":"","sources":["../src/action-pins.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,MAAM,WAAW,SAAS;IACxB,8DAA8D;IAC9D,KAAK,EAAE,MAAM,CAAC;IACd,oEAAoE;IACpE,OAAO,EAAE,MAAM,CAAC;IAChB,wCAAwC;IACxC,GAAG,EAAE,MAAM,CAAC;CACb;AAED,eAAO,MAAM,WAAW;;iBAEpB,KAAK,EAAE,IAAI;iBACX,OAAO,EAAE,QAAQ;iBACjB,GAAG,EAAE,0CAA0C;;;iBAG/C,KAAK,EAAE,IAAI;iBACX,OAAO,EAAE,QAAQ;iBACjB,GAAG,EAAE,0CAA0C;;CAEL,CAAC;AAE/C,MAAM,MAAM,YAAY,GAAG,MAAM,OAAO,WAAW,CAAC;AAEpD;;;;GAIG;AACH,MAAM,MAAM,aAAa,GAAG,KAAK,GAAG,KAAK,CAAC;AAE1C,6CAA6C;AAC7C,wBAAgB,SAAS,CAAC,IAAI,EAAE,YAAY,EAAE,GAAG,GAAE,aAAqB,GAAG,MAAM,CAGhF;AAED,4EAA4E;AAC5E,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,CAI7D;AAOD;;;GAGG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAI/C"}
+{"version":3,"file":"action-pins.d.ts","sourceRoot":"","sources":["../src/action-pins.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAIH,MAAM,WAAW,SAAS;IACxB,sDAAsD;IACtD,KAAK,EAAE,MAAM,CAAC;IACd,oEAAoE;IACpE,OAAO,EAAE,MAAM,CAAC;IAChB,wCAAwC;IACxC,GAAG,EAAE,MAAM,CAAC;CACb;AAED,QAAA,MAAM,KAAK,YACT,kBAAkB,EAClB,oBAAoB,EACpB,kBAAkB,EAClB,sBAAsB,EACtB,eAAe,EACf,yBAAyB,EACzB,2BAA2B,EAC3B,mBAAmB,EACnB,+BAA+B,EAC/B,qBAAqB,EACrB,4BAA4B,EAC5B,wBAAwB,EACxB,0BAA0B,CAClB,CAAC;AAEX,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC;AAUlD,eAAO,MAAM,WAAW,EAA2D,MAAM,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;AAEnH;;;;GAIG;AACH,MAAM,MAAM,aAAa,GAAG,KAAK,GAAG,KAAK,CAAC;AAE1C,6CAA6C;AAC7C,wBAAgB,SAAS,CAAC,IAAI,EAAE,YAAY,EAAE,GAAG,GAAE,aAAqB,GAAG,MAAM,CAGhF;AAED,4EAA4E;AAC5E,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,CAE7D;AAOD;;;GAGG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAM/C"}

package/dist/action-pins.js

@@ -1,41 +1,51 @@
 /**
- * The action versions the github lexicon emits, and the commit each release
- * tag points at.
+ * The action versions the github lexicon emits. The table is core's
+ * (`@intentius/chant/action-pins`, #4403); this file reads it, so an update is
+ * one change there (#4410). Each action here is its newest row in core's table,
+ * pinned at the commit of its latest release.
  *
- * Composites emit `<slug>@<major>` by default. With `pin: "sha"` they emit
- * `<slug>@<sha> # <version>`, the form GHA021 and GHA029 accept and GHA059
- * reads the version label from. The serializer writes the `# <version>` part
- * as a YAML comment, so GitHub sees only the SHA.
+ * Composites emit `<slug>@<sha> # <version>` by default, the form GHA021 and
+ * GHA029 accept and GHA059 reads the version label from. The serializer writes
+ * the `# <version>` part as a YAML comment, so GitHub sees only the SHA. With
+ * `pin: "tag"` they emit the major tag (`actions/checkout@v7`).
  *
- * Refresh a row by resolving the release tag to its commit:
+ * Refresh a row in core by resolving the release tag to its commit:
  *
  *   gh api repos/actions/checkout/commits/v7.0.1 --jq .sha
- *
- * Keep `major` on a version whose action runs on a Node runtime GitHub still
- * supports.
  */
-export const ACTION_PINS = {
-    "actions/checkout": {
-        major: "v7",
-        version: "v7.0.1",
-        sha: "3d3c42e5aac5ba805825da76410c181273ba90b1",
-    },
-    "actions/setup-node": {
-        major: "v7",
-        version: "v7.0.0",
-        sha: "820762786026740c76f36085b0efc47a31fe5020",
-    },
-};
+import { ACTION_PINS as CORE_PINS } from "@intentius/chant/action-pins";
+const SLUGS = [
+    "actions/checkout",
+    "actions/setup-node",
+    "actions/setup-go",
+    "actions/setup-python",
+    "actions/cache",
+    "actions/upload-artifact",
+    "actions/download-artifact",
+    "oven-sh/setup-bun",
+    "golangci/golangci-lint-action",
+    "docker/login-action",
+    "docker/setup-buildx-action",
+    "docker/metadata-action",
+    "docker/build-push-action",
+];
+/** The newest row of core's table for `slug`. */
+function newest(slug) {
+    const rows = Object.values(CORE_PINS).filter((p) => p.slug === slug);
+    if (rows.length === 0)
+        throw new Error(`action-pins: core's table has no row for ${slug}`);
+    const row = rows.reduce((a, b) => (Number(b.major.slice(1)) > Number(a.major.slice(1)) ? b : a));
+    return { major: row.major, version: row.tag, sha: row.sha };
+}
+export const ACTION_PINS = Object.fromEntries(SLUGS.map((s) => [s, newest(s)]));
 /** The `uses:` value for a pinned action. */
-export function actionRef(slug, pin = "tag") {
+export function actionRef(slug, pin = "sha") {
     const entry = ACTION_PINS[slug];
     return pin === "sha" ? `${slug}@${entry.sha} # ${entry.version}` : `${slug}@${entry.major}`;
 }
 /** The pin table entry for an action slug, if the lexicon maintains one. */
 export function actionPin(slug) {
-    return Object.prototype.hasOwnProperty.call(ACTION_PINS, slug)
-        ? ACTION_PINS[slug]
-        : undefined;
+    return Object.prototype.hasOwnProperty.call(ACTION_PINS, slug) ? ACTION_PINS[slug] : undefined;
 }
 const COMPOSITE_FOR = {
     "actions/checkout": "Checkout",
@@ -49,5 +59,7 @@ export function pinFixHint(slug) {
     if (!actionPin(slug))
         return "";
     const pinned = slug;
-    return ` Use \`uses: ${actionRef(pinned, "sha")}\`, which ${COMPOSITE_FOR[pinned]}({ pin: "sha" }) emits.`;
+    const composite = COMPOSITE_FOR[pinned];
+    const how = composite ? `, which ${composite}({ pin: "sha" }) emits` : "";
+    return ` Use \`uses: ${actionRef(pinned, "sha")}\`${how}.`;
 }

package/dist/components/ci-jobs.d.ts

@@ -9,8 +9,11 @@
  */
 import type { OpTrigger } from "@intentius/chant/lexicon";
 /** The artifact actions every generated job uses, at the major the generators have always pinned. */
-export declare const UPLOAD_ARTIFACT = "actions/upload-artifact@v4";
-export declare const DOWNLOAD_ARTIFACT = "actions/download-artifact@v4";
+export declare const UPLOAD_ARTIFACT: string;
+export declare const DOWNLOAD_ARTIFACT: string;
+export declare const CHECKOUT: string;
+export declare const CACHE_RESTORE: string;
+export declare const CACHE_SAVE: string;
 /** The checkout step; `fullHistory` fetches every commit, for a job that reads the base commit or measures a change with git. */
 export declare function checkoutStep(fullHistory?: boolean): Record<string, unknown>;
 /** One `run:` step per line, so each line is its own step in the log. */

package/dist/components/ci-jobs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ci-jobs.d.ts","sourceRoot":"","sources":["../../src/components/ci-jobs.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAG1D,qGAAqG;AACrG,eAAO,MAAM,eAAe,+BAA+B,CAAC;AAC5D,eAAO,MAAM,iBAAiB,iCAAiC,CAAC;AAEhE,iIAAiI;AACjI,wBAAgB,YAAY,CAAC,WAAW,UAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAEzE;AAED,yEAAyE;AACzE,wBAAgB,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAEjF;AAED,oDAAoD;AACpD,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAE1G;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAOpG;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,CAG7E;AAED,6DAA6D;AAC7D,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,gBAAgB,UAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAE5F;AAED,oGAAoG;AACpG,wBAAgB,WAAW,CAAC,EAAE,UAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAE9D;AAED;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,OAAO,EAAE,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAYrE;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,GAAG,MAAM,CAG9E;AAED;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,qGAAqG;IACrG,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,8BAA8B;IAC9B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,iCAAiC;IACjC,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5B,uEAAuE;IACvE,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,kCAAkC;IAClC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,kCAAkC;IAClC,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACtC,+EAA+E;IAC/E,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACtC,2BAA2B;IAC3B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,kFAAkF;AAClF,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,iBAAiB,GAAG,MAAM,CAW/D"}
+{"version":3,"file":"ci-jobs.d.ts","sourceRoot":"","sources":["../../src/components/ci-jobs.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAG1D,qGAAqG;AACrG,eAAO,MAAM,eAAe,QAAgC,CAAC;AAC7D,eAAO,MAAM,iBAAiB,QAAkC,CAAC;AACjE,eAAO,MAAM,QAAQ,QAA0B,CAAC;AAChD,eAAO,MAAM,aAAa,QAA8B,CAAC;AACzD,eAAO,MAAM,UAAU,QAA2B,CAAC;AAEnD,iIAAiI;AACjI,wBAAgB,YAAY,CAAC,WAAW,UAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAEzE;AAED,yEAAyE;AACzE,wBAAgB,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAEjF;AAED,oDAAoD;AACpD,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAE1G;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAOpG;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,CAG7E;AAED,6DAA6D;AAC7D,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,gBAAgB,UAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAE5F;AAED,oGAAoG;AACpG,wBAAgB,WAAW,CAAC,EAAE,UAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAE9D;AAED;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,OAAO,EAAE,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAYrE;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,GAAG,MAAM,CAG9E;AAED;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,qGAAqG;IACrG,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,8BAA8B;IAC9B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,iCAAiC;IACjC,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5B,uEAAuE;IACvE,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,kCAAkC;IAClC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,kCAAkC;IAClC,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACtC,+EAA+E;IAC/E,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACtC,2BAA2B;IAC3B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,kFAAkF;AAClF,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,iBAAiB,GAAG,MAAM,CAW/D"}

package/dist/components/ci-jobs.js

@@ -9,13 +9,16 @@
  */
 import { emitYAML, emitYAMLEntry } from "@intentius/chant/yaml";
 import { BUILD_REQUEST_TAGS, GITHUB_JOB_TOKEN, pushBranches } from "@intentius/chant/ci-jobs";
-import { actionRef } from "../action-pins.js";
+import { ACTION_PINS as PINS, tagComments, usesRef } from "@intentius/chant/action-pins";
 /** The artifact actions every generated job uses, at the major the generators have always pinned. */
-export const UPLOAD_ARTIFACT = "actions/upload-artifact@v4";
-export const DOWNLOAD_ARTIFACT = "actions/download-artifact@v4";
+export const UPLOAD_ARTIFACT = usesRef(PINS.uploadArtifact4);
+export const DOWNLOAD_ARTIFACT = usesRef(PINS.downloadArtifact4);
+export const CHECKOUT = usesRef(PINS.checkout7);
+export const CACHE_RESTORE = usesRef(PINS.cacheRestore4);
+export const CACHE_SAVE = usesRef(PINS.cacheSave4);
 /** The checkout step; `fullHistory` fetches every commit, for a job that reads the base commit or measures a change with git. */
 export function checkoutStep(fullHistory = false) {
-    return fullHistory ? { uses: actionRef("actions/checkout"), with: { "fetch-depth": 0 } } : { uses: actionRef("actions/checkout") };
+    return fullHistory ? { uses: CHECKOUT, with: { "fetch-depth": 0 } } : { uses: CHECKOUT };
 }
 /** One `run:` step per line, so each line is its own step in the log. */
 export function runSteps(lines) {
@@ -106,5 +109,5 @@ export function emitWorkflowYAML(doc) {
     if (doc.permissions && Object.keys(doc.permissions).length > 0)
         sections.push(emitYAMLEntry("permissions", doc.permissions));
     sections.push(emitYAMLEntry("jobs", doc.jobsDoc));
-    return sections.join("\n\n") + "\n";
+    return tagComments(sections.join("\n\n") + "\n");
 }

package/dist/components/generate-op-pipeline.d.ts

@@ -124,6 +124,13 @@ export interface GithubOpPipelineDoc {
      * artifact instead (#2256).
      */
     gatedNoticeDoc?: Record<string, unknown>;
+    /**
+     * The review note job (#4326), when the spec sets `reviewAgent`. Kept out
+     * of {@link jobsDoc} for the reason the gate notice is: a member's
+     * `working-directory` default belongs to the job that runs the Op, and a
+     * dialect transforms this job on its own terms.
+     */
+    reviewNoteDoc?: Record<string, unknown>;
 }
 /** One generated file: a suggested name plus its pipeline document, pre-emission. */
 export interface GithubOpPipelineFile {

package/dist/components/generate-op-pipeline.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generate-op-pipeline.d.ts","sourceRoot":"","sources":["../../src/components/generate-op-pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsEG;AAGH,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAOhB,gBAAgB,EAIjB,MAAM,0BAA0B,CAAC;AAElC,OAAO,KAAK,EACV,wBAAwB,IAAI,uBAAuB,EAEnD,aAAa,EACb,gBAAgB,IAAI,sBAAsB,EAG1C,eAAe,EAChB,MAAM,0BAA0B,CAAC;AAGlC,YAAY,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,CAAC;AAIhE,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,CAAC;AAEjE;;;;;;GAMG;AACH,MAAM,WAAW,mBAAmB;IAClC;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5B,2DAA2D;IAC3D,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,6DAA6D;IAC7D,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC;;;;OAIG;IACH,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,8DAA8D;IAC9D,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC;;;;;;;;OAQG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC1C;AAED,qFAAqF;AACrF,MAAM,WAAW,oBAAoB;IACnC,4FAA4F;IAC5F,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,mBAAmB,CAAC;CAC1B;AAuOD;;;;;;;;;;;GAWG;AACH,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,eAAe,EAAE,EACtB,OAAO,GAAE,uBAA4B,GACpC;IAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;IAAC,IAAI,EAAE,aAAa,EAAE,CAAA;CAAE,CA8F1D;AAwCD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,mBAAmB,GAAG,MAAM,CAMnE;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,eAAe,EAAE,EACtB,OAAO,GAAE,uBAA4B,GACpC,sBAAsB,CAMxB"}
+{"version":3,"file":"generate-op-pipeline.d.ts","sourceRoot":"","sources":["../../src/components/generate-op-pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsEG;AAGH,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAOhB,gBAAgB,EAIjB,MAAM,0BAA0B,CAAC;AAElC,OAAO,KAAK,EACV,wBAAwB,IAAI,uBAAuB,EAEnD,aAAa,EACb,gBAAgB,IAAI,sBAAsB,EAG1C,eAAe,EAChB,MAAM,0BAA0B,CAAC;AAIlC,YAAY,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,CAAC;AAIhE,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,CAAC;AAEjE;;;;;;GAMG;AACH,MAAM,WAAW,mBAAmB;IAClC;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5B,2DAA2D;IAC3D,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,6DAA6D;IAC7D,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC;;;;OAIG;IACH,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,8DAA8D;IAC9D,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC;;;;;;;;OAQG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACzC;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACzC;AAED,qFAAqF;AACrF,MAAM,WAAW,oBAAoB;IACnC,4FAA4F;IAC5F,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,mBAAmB,CAAC;CAC1B;AAuOD;;;;;;;;;;;GAWG;AACH,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,eAAe,EAAE,EACtB,OAAO,GAAE,uBAA4B,GACpC;IAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;IAAC,IAAI,EAAE,aAAa,EAAE,CAAA;CAAE,CAoH1D;AAwCD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,mBAAmB,GAAG,MAAM,CAMnE;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,eAAe,EAAE,EACtB,OAAO,GAAE,uBAA4B,GACpC,sBAAsB,CAMxB"}

package/dist/components/generate-op-pipeline.js

@@ -73,6 +73,7 @@ import { readFileSync } from "node:fs";
 import { assertEnvironment, assertSetupSteps, CI_IMAGE, ciJobName, environmentDoc, fillCommand, GITHUB_JOB_TOKEN, GITHUB_RUNNER, mergePermissions, nonEmpty, permissionsFor, setupStepDoc, } from "@intentius/chant/ci-jobs";
 import { memberPathFilter, resolveOpTrigger } from "@intentius/chant/lexicon";
 import { checkoutStep, concurrency, emitWorkflowYAML, jobTokenEnv, onTrigger, opConcurrencyGroup, runSteps } from "./ci-jobs.js";
+import { assertReviewSplit, reviewJobs, reviewNoteJobName } from "./review-jobs.js";
 // The setup, environment and permission checks are shared with the Op waves
 // generator and the forgejo lexicon (#3765); they stay importable from here.
 export { assertEnvironment, assertSetupSteps, mergePermissions };
@@ -316,7 +317,11 @@ export function buildGithubOpPipelineDocs(ops, options = {}) {
         const runParts = fillCommand(runCommand, spec.name);
         // A live-resolution read (rate limits) always benefits from a token;
         // creating an issue/PR additionally needs `gh` CLI's own token variable.
-        const stepEnv = jobTokenEnv(findingMode !== "report");
+        // A split review (#4326) runs the change's code beside a model: no step of that job holds a forge token.
+        const split = spec.reviewAgent === true;
+        if (split)
+            assertReviewSplit(spec.name, trigger, findingMode, spec.permissions);
+        const stepEnv = split ? {} : jobTokenEnv(findingMode !== "report");
         const setup = spec.setup ?? [];
         assertSetupSteps(spec.name, setup);
         if (spec.environment)
@@ -334,6 +339,19 @@ export function buildGithubOpPipelineDocs(ops, options = {}) {
             ? gatedRunStep(RUN_STEP_ID, spec.name, invocation, stepEnv)
             : { run: invocation, env: stepEnv });
         steps.push(...runSteps(extraScript));
+        const review = split
+            ? reviewJobs({
+                name: spec.name,
+                jobName,
+                image,
+                invocation,
+                setup: setup.map(setupStepDoc),
+                beforeScript,
+                extraScript,
+                ...(spec.variables ? { variables: spec.variables } : {}),
+                ...(options.member ? { member: options.member } : {}),
+            })
+            : undefined;
         const doc = {
             name: spec.name,
             on: onTrigger(trigger),
@@ -369,6 +387,11 @@ export function buildGithubOpPipelineDocs(ops, options = {}) {
             },
             ...(gated ? { gatedNoticeDoc: { [`${jobName}-gate-notice`]: gateNoticeJob(jobName, image) } } : {}),
         };
+        // A split review (#4326): the Op's job is the review job, and the note job rides beside it.
+        if (review) {
+            doc.jobsDoc = { [jobName]: { ...review.review, ...(spec.environment ? { environment: environmentDoc(spec.environment) } : {}) } };
+            doc.reviewNoteDoc = { [reviewNoteJobName(jobName)]: review.note };
+        }
         files.push({ name: `${spec.name}.yml`, doc });
     }
     if (options.member) {
@@ -422,8 +445,8 @@ export function emitOpPipelineYAML(doc) {
     // The gated-apply notice job rides in `jobs:` beside the Op's own job; it
     // is carried separately on the doc so a dialect transforms it on its own.
     // A dialect's `header` note (#2257) is absent on github.
-    const { gatedNoticeDoc, ...workflow } = doc;
-    return emitWorkflowYAML({ ...workflow, jobsDoc: { ...doc.jobsDoc, ...(gatedNoticeDoc ?? {}) } });
+    const { gatedNoticeDoc, reviewNoteDoc, ...workflow } = doc;
+    return emitWorkflowYAML({ ...workflow, jobsDoc: { ...doc.jobsDoc, ...(gatedNoticeDoc ?? {}), ...(reviewNoteDoc ?? {}) } });
 }
 /**
  * Synthesize one `.github/workflows/*.yml` per scheduled Op. Thin wrapper

package/dist/components/generate-op-waves-pipeline.d.ts

@@ -3,9 +3,17 @@
  *
  * One workflow for the whole spec, on a push to its branches (and by hand),
  * one run at a time. Each job is one of core's `opWaveJobs`: a wave, or a wide
- * wave's deciding job and share jobs, chained by `needs:` so a wave that waits
- * at its gate (exit 3) or fails stops every later wave. Re-running the failed
- * jobs after `chant approve` carries on from that wave.
+ * wave's deciding job and share jobs, chained by `needs:`. Re-running the
+ * failed jobs after `chant approve` carries on from that wave.
+ *
+ * Each job keeps its outcome file as an artifact whatever its exit code
+ * (#4322), and a job with `needs:` downloads every artifact of the run into
+ * the outcome directory first. A wave or deciding job after the first runs
+ * unless the run was cancelled (`if: !cancelled()`), so it runs after a
+ * failure in the wave before: it blocks the runs that depend on a failed one
+ * and applies the rest, and it stops by itself when an earlier wave waits at
+ * its gate (exit 3) or applied nothing for another reason. A share job still
+ * needs its deciding job to succeed.
  *
  * Every job checks out the full history, because the runner reads the gate
  * policy from the spec file at the base commit and records pending gates on
@@ -49,6 +57,8 @@ import { type GithubOpPipelineDoc } from "./generate-op-pipeline.js";
 export declare const OP_WAVES_IMAGE = "node:22";
 /** The artifact a wide wave's deciding job hands its share jobs. */
 export declare function opWaveRecordArtifact(spec: Pick<OpWavesSpec, "name">, wave: number): string;
+/** The artifact a job keeps its outcome file in (#4322). */
+export declare function opWaveOutcomeArtifact(spec: Pick<OpWavesSpec, "name">, jobName: string): string;
 /** The workflow document, before emission, and the jobs it holds. */
 export declare function buildGithubOpWavesDoc(spec: OpWavesSpec, options: OpWavesPipelineOptions): {
     doc: GithubOpPipelineDoc;

package/dist/components/generate-op-waves-pipeline.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generate-op-waves-pipeline.d.ts","sourceRoot":"","sources":["../../src/components/generate-op-waves-pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAEH,OAAO,EAAoE,KAAK,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAClI,OAAO,KAAK,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAiB9F,OAAO,EAAsB,KAAK,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAEtF,yFAAyF;AACzF,eAAO,MAAM,cAAc,YAAW,CAAC;AAEvC,oEAAoE;AACpE,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAE1F;AAED,qEAAqE;AACrE,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,WAAW,EACjB,OAAO,EAAE,sBAAsB,GAC9B;IAAE,GAAG,EAAE,mBAAmB,CAAC;IAAC,IAAI,EAAE,qBAAqB,CAAC,MAAM,CAAC,CAAC;IAAC,SAAS,CAAC,EAAE,mBAAmB,CAAC;IAAC,QAAQ,CAAC,EAAE,mBAAmB,CAAA;CAAE,CAgEpI;AAoDD,4EAA4E;AAC5E,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,sBAAsB,GAAG,qBAAqB,CAMvH"}
+{"version":3,"file":"generate-op-waves-pipeline.d.ts","sourceRoot":"","sources":["../../src/components/generate-op-waves-pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AAEH,OAAO,EAAsF,KAAK,WAAW,EAAE,MAAM,8BAA8B,CAAC;AACpJ,OAAO,KAAK,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAiB9F,OAAO,EAAsB,KAAK,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAEtF,yFAAyF;AACzF,eAAO,MAAM,cAAc,YAAW,CAAC;AAEvC,oEAAoE;AACpE,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAE1F;AAED,4DAA4D;AAC5D,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAE9F;AAED,qEAAqE;AACrE,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,WAAW,EACjB,OAAO,EAAE,sBAAsB,GAC9B;IAAE,GAAG,EAAE,mBAAmB,CAAC;IAAC,IAAI,EAAE,qBAAqB,CAAC,MAAM,CAAC,CAAC;IAAC,SAAS,CAAC,EAAE,mBAAmB,CAAC;IAAC,QAAQ,CAAC,EAAE,mBAAmB,CAAA;CAAE,CAuEpI;AAoDD,4EAA4E;AAC5E,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,sBAAsB,GAAG,qBAAqB,CAMvH"}

package/dist/components/generate-op-waves-pipeline.js

@@ -3,9 +3,17 @@
  *
  * One workflow for the whole spec, on a push to its branches (and by hand),
  * one run at a time. Each job is one of core's `opWaveJobs`: a wave, or a wide
- * wave's deciding job and share jobs, chained by `needs:` so a wave that waits
- * at its gate (exit 3) or fails stops every later wave. Re-running the failed
- * jobs after `chant approve` carries on from that wave.
+ * wave's deciding job and share jobs, chained by `needs:`. Re-running the
+ * failed jobs after `chant approve` carries on from that wave.
+ *
+ * Each job keeps its outcome file as an artifact whatever its exit code
+ * (#4322), and a job with `needs:` downloads every artifact of the run into
+ * the outcome directory first. A wave or deciding job after the first runs
+ * unless the run was cancelled (`if: !cancelled()`), so it runs after a
+ * failure in the wave before: it blocks the runs that depend on a failed one
+ * and applies the rest, and it stops by itself when an earlier wave waits at
+ * its gate (exit 3) or applied nothing for another reason. A share job still
+ * needs its deciding job to succeed.
  *
  * Every job checks out the full history, because the runner reads the gate
  * policy from the spec file at the base commit and records pending gates on
@@ -42,10 +50,10 @@
  * token is requested with, so the code the job runs holds no OIDC token
  * and cannot request one for another group's identity.
  */
-import { notifyVariables, opWaveGroupOf, opWaveJobs, opWavesResumeCommand } from "@intentius/chant/op/op-waves";
+import { notifyVariables, opWaveGroupOf, opWaveJobs, opWaveOutcomeDir, opWavesResumeCommand } from "@intentius/chant/op/op-waves";
 import { assertEnvironment, assertSetupSteps, CI_IMAGE, dirnameOf, environmentDoc, GITHUB_JOB_TOKEN, githubRunsOn, githubSecretEnv, idTokenAudienceEnv, nonEmpty, pushBranches, setupStepDoc, } from "@intentius/chant/ci-jobs";
 import { OIDC_REQUEST_VARS, TRADE_SPEC_ENV, tradeLine } from "@intentius/chant/ci-identity";
-import { checkoutStep, concurrency, downloadArtifactStep, keepRecordStep, runSteps } from "./ci-jobs.js";
+import { checkoutStep, concurrency, DOWNLOAD_ARTIFACT, downloadArtifactStep, keepRecordStep, runSteps } from "./ci-jobs.js";
 import { emitOpPipelineYAML } from "./generate-op-pipeline.js";
 /** The default image: it carries git, which the runner needs to read the base commit. */
 export const OP_WAVES_IMAGE = CI_IMAGE;
@@ -53,6 +61,10 @@ export const OP_WAVES_IMAGE = CI_IMAGE;
 export function opWaveRecordArtifact(spec, wave) {
     return `${spec.name}-wave-${wave}-decision`;
 }
+/** The artifact a job keeps its outcome file in (#4322). */
+export function opWaveOutcomeArtifact(spec, jobName) {
+    return `${spec.name}-${jobName}-outcome`;
+}
 /** The workflow document, before emission, and the jobs it holds. */
 export function buildGithubOpWavesDoc(spec, options) {
     const jobs = opWaveJobs(spec, options.specFile);
@@ -80,6 +92,10 @@ export function buildGithubOpWavesDoc(spec, options) {
         if (job.kind === "share") {
             steps.push(downloadArtifactStep(`Download wave ${job.wave}'s decision`, opWaveRecordArtifact(spec, job.wave), dirnameOf(job.record)));
         }
+        if (job.needs.length > 0) {
+            // #4322: every artifact of the run, so the job reads each earlier job's outcome file.
+            steps.push({ name: "Download the earlier jobs' outcomes", uses: DOWNLOAD_ARTIFACT, with: { path: opWaveOutcomeDir(spec) } });
+        }
         const later = [];
         later.push(...[...(wave.setup ?? []), ...(group?.setup ?? [])].map(setupStepDoc), ...runSteps(options.beforeScript ?? []));
         later.push({ name: describeJob(job.kind, job.wave, wave.name, job.share, job.group), run: job.command.join(" ") });
@@ -88,12 +104,15 @@ export function buildGithubOpWavesDoc(spec, options) {
         if (job.kind === "decide") {
             steps.push(keepRecordStep(`Keep wave ${job.wave}'s decision`, opWaveRecordArtifact(spec, job.wave), job.record));
         }
+        steps.push(keepRecordStep(`Keep the job's outcome`, opWaveOutcomeArtifact(spec, job.jobName), job.outcome));
         const environment = group?.environment ?? wave.environment;
         const idTokens = group?.idTokens ?? wave.idTokens;
         const idToken = idTokens !== undefined || cloud !== undefined;
         jobsDoc[job.jobName] = {
             "runs-on": githubRunsOn(group?.runner ?? wave.runner ?? spec.runner),
             ...(job.needs.length > 0 ? { needs: job.needs } : {}),
+            // #4322: a wave's jobs run after a failure in the wave before; a share job runs only on its deciding job's success.
+            ...(job.needs.length > 0 && job.kind !== "share" ? { if: "!cancelled()" } : {}),
             container: image,
             ...(environment ? { environment: environmentDoc(environment) } : {}),
             // #3914: a job's own permissions replace the workflow's, so they repeat them.

package/dist/components/generate-pipeline.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generate-pipeline.d.ts","sourceRoot":"","sources":["../../src/components/generate-pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AAEH,OAAO,EAAyB,KAAK,eAAe,EAAE,MAAM,oCAAoC,CAAC;AA4BjG,OAAO,KAAK,EACV,oBAAoB,IAAI,YAAY,EACpC,wBAAwB,IAAI,qBAAqB,EACjD,uBAAuB,IAAI,oBAAoB,EAEhD,MAAM,0BAA0B,CAAC;AAIlC,YAAY,EAAE,YAAY,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,CAAC;AAE1E;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;;;OAKG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,6FAA6F;IAC7F,WAAW,EAAE,MAAM,CAAC;IACpB,8DAA8D;IAC9D,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5B,mIAAmI;IACnI,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC;;;;;;OAMG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,qDAAqD;IACrD,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,uEAAuE;IACvE,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,0DAA0D;IAC1D,IAAI,EAAE,YAAY,EAAE,CAAC;CACtB;AAmcD;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,CAWpD;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,eAAe,EAAE,EAC7B,OAAO,GAAE,qBAA0B,GAClC,iBAAiB,CA+JnB;AA4CD;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,iBAAiB,GAAG,MAAM,CAE/D;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,eAAe,EAAE,EAC7B,OAAO,GAAE,qBAA0B,GAClC,oBAAoB,CAGtB"}
+{"version":3,"file":"generate-pipeline.d.ts","sourceRoot":"","sources":["../../src/components/generate-pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AAEH,OAAO,EAAyB,KAAK,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAgCjG,OAAO,KAAK,EACV,oBAAoB,IAAI,YAAY,EACpC,wBAAwB,IAAI,qBAAqB,EACjD,uBAAuB,IAAI,oBAAoB,EAEhD,MAAM,0BAA0B,CAAC;AAGlC,YAAY,EAAE,YAAY,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,CAAC;AAE1E;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;;;OAKG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,6FAA6F;IAC7F,WAAW,EAAE,MAAM,CAAC;IACpB,8DAA8D;IAC9D,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5B,mIAAmI;IACnI,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC;;;;;;OAMG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,qDAAqD;IACrD,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,uEAAuE;IACvE,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,0DAA0D;IAC1D,IAAI,EAAE,YAAY,EAAE,CAAC;CACtB;AAgfD;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,CAWpD;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,eAAe,EAAE,EAC7B,OAAO,GAAE,qBAA0B,GAClC,iBAAiB,CA+JnB;AA4CD;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,iBAAiB,GAAG,MAAM,CAE/D;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,eAAe,EAAE,EAC7B,OAAO,GAAE,qBAA0B,GAClC,oBAAoB,CAGtB"}

package/dist/components/generate-pipeline.js

@@ -61,10 +61,9 @@ import { GATED_WAVE_RECORD, gatedWaveJobs } from "@intentius/chant/components/ga
 import { CI_IMAGE, ciJobName, dirnameOf, fillCommand, GITHUB_JOB_TOKEN, GITHUB_RUNNER } from "@intentius/chant/ci-jobs";
 import { CHECKOUT_TOKEN_ENV, checkoutScript, dropForgeTokens, handoverOutputs, handoverTrap, takeOverScript } from "@intentius/chant/ci-handover";
 import { OIDC_REQUEST_VARS, TRADE_SPEC_ENV, tradeLine } from "@intentius/chant/ci-identity";
-import { APPLY_COMMENT, GREEN_TAG_PATTERN, GREEN_TICK_WORKFLOW, PR_APPLY_RECORD, PR_LOOP_REPORT_DIR, prApplyGroup, prRecordGroup, prApplyRecordKey, prApplyWaveJobName, prLoopJobs, prLoopPostJob, prLoopSetup, PR_PLAN_NOTE_JOB, prLoopWaveJobs, prLoopWithWaves, prEnvJobs, PR_ENV_REPORT_DIR, PR_ENV_SWEEP_CRON, PR_ENV_POST_JOB, } from "@intentius/chant/components/pr-pipeline";
+import { APPLY_COMMENT, GREEN_TAG_PATTERN, GREEN_TICK_WORKFLOW, PR_APPLY_RECORD, PR_LOOP_REPORT_DIR, prApplyGroup, prRecordGroup, prApplyRecordKey, prApplyWaveJobName, prLoopJobs, prLoopPostJob, prLoopSetup, PR_PLAN_NOTE_JOB, PR_LOCK_JOB, PR_UNLOCK_JOB, PR_UNLOCK_COMMAND, prLockCommand, prLoopWaveJobs, prLoopWithWaves, prEnvJobs, PR_ENV_REPORT_DIR, PR_ENV_SWEEP_CRON, PR_ENV_POST_JOB, } from "@intentius/chant/components/pr-pipeline";
 import { memberRepoPath } from "@intentius/chant/lexicon";
-import { afterEarlierWave, checkoutStep, concurrency, downloadArtifactStep, emitWorkflowYAML, keepRecordStep, runSteps, UPLOAD_ARTIFACT } from "./ci-jobs.js";
-import { actionRef } from "../action-pins.js";
+import { afterEarlierWave, CACHE_RESTORE, CACHE_SAVE, CHECKOUT, checkoutStep, concurrency, downloadArtifactStep, emitWorkflowYAML, keepRecordStep, runSteps, UPLOAD_ARTIFACT } from "./ci-jobs.js";
 /** The plan job's last step, whose outputs carry its report to the plan-note job (#4295). */
 const PLAN_STEP_ID = "plan";
 /** The output a gated apply wave hands the green commit it applies through, and the step that sets it (#4221). */
@@ -185,13 +184,13 @@ function prLoopGithubDoc(components, env, image, beforeScript, extraScript, opti
     const recordKey = (wave) => `${recordPrefix}\${{ github.run_id }}-\${{ github.run_attempt }}${wave ? `-wave-${wave}` : ""}`;
     const restoreRecord = (wave) => ({
         name: wave ? "Restore the newest record of this commit's apply" : "Restore the record of an earlier attempt at this commit",
-        uses: "actions/cache/restore@v4",
+        uses: CACHE_RESTORE,
         with: { path: recordPath, key: recordKey(wave), "restore-keys": recordPrefix },
     });
     const saveRecord = (wave) => ({
         name: wave ? "Keep the record for the next wave and a re-run" : "Keep the record for a re-run",
         if: "always()",
-        uses: "actions/cache/save@v4",
+        uses: CACHE_SAVE,
         with: { path: recordPath, key: recordKey(wave) },
     });
     // #4296: the step that trades the job's OIDC token for its cloud identity, before the checkout.
@@ -295,7 +294,7 @@ function prLoopGithubDoc(components, env, image, beforeScript, extraScript, opti
     const post = prLoopPostJob(forgeName, env, member?.name);
     const noteSteps = [
         // The target branch's commit: the chant this job runs is the target branch's, and none of the change's code is here.
-        { name: "Check out the target branch's commit", uses: actionRef("actions/checkout"), with: { ref: "${{ github.event.pull_request.base.sha }}" } },
+        { name: "Check out the target branch's commit", uses: CHECKOUT, with: { ref: "${{ github.event.pull_request.base.sha }}" } },
         ...runSteps(beforeScript),
         { name: "Take the plan report from the plan job", run: takeOverScript("plan", PR_LOOP_REPORT_DIR, forgeName) },
         { name: "Keep the plan report", if: "always()", uses: UPLOAD_ARTIFACT, with: { name: reportName(plan), path: reportPath, "if-no-files-found": "ignore", "include-hidden-files": true } },
@@ -303,9 +302,46 @@ function prLoopGithubDoc(components, env, image, beforeScript, extraScript, opti
     ];
     // #4298: with a pull request environment the pull_request trigger fires on close too, and the plan skips that event.
     const prEnv = loop.prEnvironment ? prEnvGithubJobs(loop.forge ?? "github", image, beforeScript, extraScript, loop, member) : undefined;
+    // #4327: with ci.locks: plan the pull_request trigger fires on close too, for the unlock job, and the plan skips that event.
+    const locks = loop.locks === "plan";
+    const closes = Boolean(prEnv) || locks;
+    const lockJobs = locks
+        ? {
+            [PR_LOCK_JOB]: {
+                // The plan job's outputs carry the report; a plan that was skipped or failed leaves this job skipped.
+                needs: ["plan"],
+                if: "github.event_name == 'pull_request'",
+                "runs-on": GITHUB_RUNNER,
+                container: image,
+                permissions: { contents: "write", "pull-requests": "read", statuses: "write" },
+                steps: [
+                    // The target branch's commit: this job pushes chant/lifecycle, so none of the change's code runs in it.
+                    { name: "Check out the target branch's commit", uses: CHECKOUT, with: { ref: "${{ github.event.pull_request.base.sha }}", "fetch-depth": 0 } },
+                    ...runSteps(beforeScript),
+                    { name: "Take the plan report from the plan job", run: takeOverScript("plan", PR_LOOP_REPORT_DIR, forgeName) },
+                    {
+                        name: "Lock the components the plan selected",
+                        env: { PR_NUMBER: "${{ github.event.pull_request.number }}", HEAD_SHA: "${{ github.event.pull_request.head.sha }}", GITHUB_TOKEN: GITHUB_JOB_TOKEN },
+                        run: prLockCommand(forgeName),
+                    },
+                ],
+            },
+            [PR_UNLOCK_JOB]: {
+                if: "github.event_name == 'pull_request' && github.event.action == 'closed'",
+                "runs-on": GITHUB_RUNNER,
+                container: image,
+                permissions: { contents: "write" },
+                steps: [
+                    { name: "Check out the target branch's commit", uses: CHECKOUT, with: { ref: "${{ github.event.pull_request.base.sha }}", "fetch-depth": 0 } },
+                    ...runSteps(beforeScript),
+                    { name: "Release the pull request's locks", env: { PR_NUMBER: "${{ github.event.pull_request.number }}" }, run: PR_UNLOCK_COMMAND },
+                ],
+            },
+        }
+        : {};
     const jobsDoc = {
         plan: {
-            if: prEnv ? "github.event_name == 'pull_request' && github.event.action != 'closed'" : "github.event_name == 'pull_request'",
+            if: closes ? "github.event_name == 'pull_request' && github.event.action != 'closed'" : "github.event_name == 'pull_request'",
             "runs-on": GITHUB_RUNNER,
             container: image,
             permissions: withIdToken({ contents: "read" }),
@@ -321,6 +357,7 @@ function prLoopGithubDoc(components, env, image, beforeScript, extraScript, opti
             permissions: { actions: "read", contents: "read", "pull-requests": "write", statuses: "write" },
             steps: noteSteps,
         },
+        ...lockJobs,
         ...Object.fromEntries(applyJobs),
         ...(prEnv ? prEnv.jobs : {}),
     };
@@ -330,6 +367,8 @@ function prLoopGithubDoc(components, env, image, beforeScript, extraScript, opti
         : forgejo
             ? { pull_request: { branches: [branch] }, push: { branches: [branch], tags: [GREEN_TAG_PATTERN] } }
             : { pull_request: { branches: [branch] }, push: { branches: [branch] }, workflow_run: { workflows: [GREEN_TICK_WORKFLOW], types: ["completed"] }, workflow_dispatch: {} };
+    if (closes)
+        on.pull_request = { branches: [branch], types: ["opened", "synchronize", "reopened", "closed"] };
     if (prEnv) {
         on.pull_request = { branches: [branch], types: ["opened", "synchronize", "reopened", "closed"] };
         on.schedule = [{ cron: PR_ENV_SWEEP_CRON }];
@@ -344,10 +383,16 @@ function prLoopGithubDoc(components, env, image, beforeScript, extraScript, opti
         ...(rooted ? {} : { defaults: { run: { "working-directory": member.dir } } }),
         env: { ...options.variables, CHANT_ENV: env },
         jobsDoc,
-        stages: ["plan", PR_PLAN_NOTE_JOB, ...applyNames, ...(prEnv ? ["env-up", PR_ENV_POST_JOB, "env-down", "env-sweep"] : [])],
+        stages: ["plan", PR_PLAN_NOTE_JOB, ...(locks ? [PR_LOCK_JOB, PR_UNLOCK_JOB] : []), ...applyNames, ...(prEnv ? ["env-up", PR_ENV_POST_JOB, "env-down", "env-sweep"] : [])],
         jobs: [
             { jobName: "plan", component: "pull request plan", stage: "plan", needs: [] },
             { jobName: PR_PLAN_NOTE_JOB, component: "pull request plan note", stage: PR_PLAN_NOTE_JOB, needs: ["plan"] },
+            ...(locks
+                ? [
+                    { jobName: PR_LOCK_JOB, component: "pull request lock", stage: PR_LOCK_JOB, needs: ["plan"] },
+                    { jobName: PR_UNLOCK_JOB, component: "pull request unlock", stage: PR_UNLOCK_JOB, needs: [] },
+                ]
+                : []),
             ...applyNames.map((name, i) => ({
                 jobName: name,
                 component: name === "record" ? "merge record" : loop.applyBeforeMerge ? "apply before merge" : loop.waveGate ? `green apply, wave ${i}` : "green apply",
@@ -426,7 +471,7 @@ function prEnvGithubJobs(forge, image, beforeScript, extraScript, loop, member)
         permissions: writes,
         steps: [
             // The target branch's commit: the chant this job runs is the target branch's, and none of the change's code is here.
-            { name: "Check out the target branch's commit", uses: actionRef("actions/checkout"), with: { ref: "${{ github.event.pull_request.base.sha }}", "fetch-depth": 0 } },
+            { name: "Check out the target branch's commit", uses: CHECKOUT, with: { ref: "${{ github.event.pull_request.base.sha }}", "fetch-depth": 0 } },
             ...runSteps(beforeScript),
             { name: "Take the environment's report from the env-up job", run: takeOverScript("env-up", PR_ENV_REPORT_DIR, forge) },
             keep("env-up"),
@@ -441,7 +486,7 @@ function prEnvGithubJobs(forge, image, beforeScript, extraScript, loop, member)
         permissions: withIdToken(writes),
         steps: [
             ...tradeStep,
-            { uses: actionRef("actions/checkout"), with: { "fetch-depth": 0, ...(ref ? { ref } : {}) } },
+            { uses: CHECKOUT, with: { "fetch-depth": 0, ...(ref ? { ref } : {}) } },
             ...runSteps(prLoopSetup(image)),
             ...runSteps(beforeScript),
             { name, env: j.env, run: j.command },