@intentius/chant-lexicon-github 0.124.54 → 0.124.56

package/src/components/__golden__/op-waves-jobs.yml

@@ -20,6 +20,10 @@ jobs:
       - dev
     container: node:22
     steps:
+      - name: Check the job runs where the spec set it to run
+        env:
+          CHANT_JOB_GUARD: '{"forge":"github","job":"wave 1 (dev) of migrations","branches":["main"],"selfHosted":true}'
+        run: '(cd / && node -e ''"use strict";const E=process.env,A="chant-check-job";const shown=(v)=>v===undefined||v===null||v===""?"none":v;const fail=(m)=>{console.error("check-job: "+m);process.exit(9)};let x;try{x=JSON.parse(E.CHANT_JOB_GUARD||"")}catch(e){fail("CHANT_JOB_GUARD is not JSON")}if(!x||!["github","gitlab","forgejo"].includes(x.forge)||!Array.isArray(x.branches))fail("CHANT_JOB_GUARD is not a guard spec");const tags=(r)=>{if(r===undefined)return undefined;const t=r.trim();if(t.startsWith("[")){try{const v=JSON.parse(t);if(Array.isArray(v))return v.map(String)}catch(e){}}return t===""?[]:t.split(",").map((s)=>s.trim()).filter((s)=>s!=="")};const claimsOf=(tok)=>{const p=tok.split(".")[1];if(!p)throw new Error("the forge\u0027s OIDC token is not a JWT");const c=JSON.parse(Buffer.from(p.replace(/-/g,"+").replace(/_/g,"/"),"base64").toString("utf-8"));if(!c||typeof c!=="object")throw new Error("the forge\u0027s OIDC token has no claims");return c};async function seenOf(){if(x.forge==="gitlab")return{forgeEnvironment:E.CI_ENVIRONMENT_NAME||null,ref:E.CI_COMMIT_REF_NAME,refProtected:E.CI_COMMIT_REF_PROTECTED,runnerTags:tags(E.CI_RUNNER_TAGS)};const s={ref:E.GITHUB_REF};let c;if(x.forge==="github"&&x.forgeEnvironment!==undefined){try{if(!E.ACTIONS_ID_TOKEN_REQUEST_URL||!E.ACTIONS_ID_TOKEN_REQUEST_TOKEN)throw new Error("the job may request no OIDC token (no ACTIONS_ID_TOKEN_REQUEST_URL); it needs the id-token: write permission");const r=await fetch(E.ACTIONS_ID_TOKEN_REQUEST_URL+"&audience="+encodeURIComponent(A),{headers:{authorization:"bearer "+E.ACTIONS_ID_TOKEN_REQUEST_TOKEN}});if(!r.ok)throw new Error("the OIDC token request answered "+r.status);const v=(await r.json()).value;if(typeof v!=="string")throw new Error("the OIDC token request answered no token");c=claimsOf(v);s.forgeEnvironment=typeof c.environment==="string"&&c.environment!==""?c.environment:null}catch(e){s.forgeEnvironmentError=e&&e.message?e.message:String(e)}}const run=c&&typeof c.runner_environment==="string"?c.runner_environment:E.RUNNER_ENVIRONMENT;if(run)s.runnerEnvironment=run;return s}seenOf().then((s)=>{const P=[],C=[],S=[];const fe=x.forgeEnvironment;if(x.forge==="forgejo")S.push("forge environment (Forgejo has none)");else if(fe!==undefined){if(s.forgeEnvironmentError!==undefined)P.push("forge environment: expected "+fe+", and it could not be read: "+s.forgeEnvironmentError);else if(s.forgeEnvironment!==fe)P.push("forge environment: expected "+fe+", found "+shown(s.forgeEnvironment));else C.push("forge environment "+fe)}const b=x.branches.filter((v)=>v!=="");if(b.length===0)P.push("ref: the job names no branch to run from");else if(x.forge==="gitlab"){if(!s.ref||!b.includes(s.ref))P.push("ref: expected "+b.join(" or ")+", found "+shown(s.ref));else C.push("ref "+s.ref);if(s.refProtected!=="true")P.push("ref: expected a protected ref (CI_COMMIT_REF_PROTECTED true), found "+shown(s.refProtected));else C.push("protected ref")}else{const refs=b.map((v)=>"refs/heads/"+v);if(!s.ref||!refs.includes(s.ref))P.push("ref: expected "+refs.join(" or ")+", found "+shown(s.ref));else C.push("ref "+s.ref)}if(x.forge==="gitlab"){const w=x.runnerTags||[];if(w.length>0){const h=s.runnerTags;const miss=w.filter((t)=>!(h||[]).includes(t));if(h===undefined)P.push("runner: expected tags "+w.join(", ")+", and the job has no CI_RUNNER_TAGS");else if(miss.length>0)P.push("runner: expected tags "+w.join(", ")+", found "+(h.length?h.join(", "):"none"));else C.push("runner tags "+w.join(", "))}}else if(x.selfHosted){if(s.runnerEnvironment===undefined)S.push("runner (the runner says nothing about itself: no RUNNER_ENVIRONMENT)");else if(s.runnerEnvironment!=="self-hosted")P.push("runner: expected self-hosted, found "+s.runnerEnvironment);else C.push("self-hosted runner")}const at=(x.product||"chant")+" check-job: "+x.job;if(P.length>0){for(const p of P)console.error(at+": "+p);console.error(at+": this job does not run where the spec set it to run, so it stops before any credential is taken or code checked out");process.exit(9)}console.log(at+": "+(C.length?C.join(", "):"nothing to check")+(S.length?"; not checked: "+S.join(", "):""))}).catch((e)=>fail(e&&e.message?e.message:String(e)));'')'
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
@@ -47,6 +51,10 @@ jobs:
       STAGE: apply
       PLAN_TOKEN_AUDIENCE: plan.example
     steps:
+      - name: Check the job runs where the spec set it to run
+        env:
+          CHANT_JOB_GUARD: '{"forge":"github","job":"the deciding job of wave 2 (prod) of migrations","branches":["main"]}'
+        run: '(cd / && node -e ''"use strict";const E=process.env,A="chant-check-job";const shown=(v)=>v===undefined||v===null||v===""?"none":v;const fail=(m)=>{console.error("check-job: "+m);process.exit(9)};let x;try{x=JSON.parse(E.CHANT_JOB_GUARD||"")}catch(e){fail("CHANT_JOB_GUARD is not JSON")}if(!x||!["github","gitlab","forgejo"].includes(x.forge)||!Array.isArray(x.branches))fail("CHANT_JOB_GUARD is not a guard spec");const tags=(r)=>{if(r===undefined)return undefined;const t=r.trim();if(t.startsWith("[")){try{const v=JSON.parse(t);if(Array.isArray(v))return v.map(String)}catch(e){}}return t===""?[]:t.split(",").map((s)=>s.trim()).filter((s)=>s!=="")};const claimsOf=(tok)=>{const p=tok.split(".")[1];if(!p)throw new Error("the forge\u0027s OIDC token is not a JWT");const c=JSON.parse(Buffer.from(p.replace(/-/g,"+").replace(/_/g,"/"),"base64").toString("utf-8"));if(!c||typeof c!=="object")throw new Error("the forge\u0027s OIDC token has no claims");return c};async function seenOf(){if(x.forge==="gitlab")return{forgeEnvironment:E.CI_ENVIRONMENT_NAME||null,ref:E.CI_COMMIT_REF_NAME,refProtected:E.CI_COMMIT_REF_PROTECTED,runnerTags:tags(E.CI_RUNNER_TAGS)};const s={ref:E.GITHUB_REF};let c;if(x.forge==="github"&&x.forgeEnvironment!==undefined){try{if(!E.ACTIONS_ID_TOKEN_REQUEST_URL||!E.ACTIONS_ID_TOKEN_REQUEST_TOKEN)throw new Error("the job may request no OIDC token (no ACTIONS_ID_TOKEN_REQUEST_URL); it needs the id-token: write permission");const r=await fetch(E.ACTIONS_ID_TOKEN_REQUEST_URL+"&audience="+encodeURIComponent(A),{headers:{authorization:"bearer "+E.ACTIONS_ID_TOKEN_REQUEST_TOKEN}});if(!r.ok)throw new Error("the OIDC token request answered "+r.status);const v=(await r.json()).value;if(typeof v!=="string")throw new Error("the OIDC token request answered no token");c=claimsOf(v);s.forgeEnvironment=typeof c.environment==="string"&&c.environment!==""?c.environment:null}catch(e){s.forgeEnvironmentError=e&&e.message?e.message:String(e)}}const run=c&&typeof c.runner_environment==="string"?c.runner_environment:E.RUNNER_ENVIRONMENT;if(run)s.runnerEnvironment=run;return s}seenOf().then((s)=>{const P=[],C=[],S=[];const fe=x.forgeEnvironment;if(x.forge==="forgejo")S.push("forge environment (Forgejo has none)");else if(fe!==undefined){if(s.forgeEnvironmentError!==undefined)P.push("forge environment: expected "+fe+", and it could not be read: "+s.forgeEnvironmentError);else if(s.forgeEnvironment!==fe)P.push("forge environment: expected "+fe+", found "+shown(s.forgeEnvironment));else C.push("forge environment "+fe)}const b=x.branches.filter((v)=>v!=="");if(b.length===0)P.push("ref: the job names no branch to run from");else if(x.forge==="gitlab"){if(!s.ref||!b.includes(s.ref))P.push("ref: expected "+b.join(" or ")+", found "+shown(s.ref));else C.push("ref "+s.ref);if(s.refProtected!=="true")P.push("ref: expected a protected ref (CI_COMMIT_REF_PROTECTED true), found "+shown(s.refProtected));else C.push("protected ref")}else{const refs=b.map((v)=>"refs/heads/"+v);if(!s.ref||!refs.includes(s.ref))P.push("ref: expected "+refs.join(" or ")+", found "+shown(s.ref));else C.push("ref "+s.ref)}if(x.forge==="gitlab"){const w=x.runnerTags||[];if(w.length>0){const h=s.runnerTags;const miss=w.filter((t)=>!(h||[]).includes(t));if(h===undefined)P.push("runner: expected tags "+w.join(", ")+", and the job has no CI_RUNNER_TAGS");else if(miss.length>0)P.push("runner: expected tags "+w.join(", ")+", found "+(h.length?h.join(", "):"none"));else C.push("runner tags "+w.join(", "))}}else if(x.selfHosted){if(s.runnerEnvironment===undefined)S.push("runner (the runner says nothing about itself: no RUNNER_ENVIRONMENT)");else if(s.runnerEnvironment!=="self-hosted")P.push("runner: expected self-hosted, found "+s.runnerEnvironment);else C.push("self-hosted runner")}const at=(x.product||"chant")+" check-job: "+x.job;if(P.length>0){for(const p of P)console.error(at+": "+p);console.error(at+": this job does not run where the spec set it to run, so it stops before any credential is taken or code checked out");process.exit(9)}console.log(at+": "+(C.length?C.join(", "):"nothing to check")+(S.length?"; not checked: "+S.join(", "):""))}).catch((e)=>fail(e&&e.message?e.message:String(e)));'')'
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
@@ -92,6 +100,10 @@ jobs:
       REGION: us
       CLOUD_TOKEN_AUDIENCE: us.example
     steps:
+      - name: Check the job runs where the spec set it to run
+        env:
+          CHANT_JOB_GUARD: '{"forge":"github","job":"share 1 of job group us of wave 2 (prod) of migrations","forgeEnvironment":"prod-us","branches":["main"]}'
+        run: '(cd / && node -e ''"use strict";const E=process.env,A="chant-check-job";const shown=(v)=>v===undefined||v===null||v===""?"none":v;const fail=(m)=>{console.error("check-job: "+m);process.exit(9)};let x;try{x=JSON.parse(E.CHANT_JOB_GUARD||"")}catch(e){fail("CHANT_JOB_GUARD is not JSON")}if(!x||!["github","gitlab","forgejo"].includes(x.forge)||!Array.isArray(x.branches))fail("CHANT_JOB_GUARD is not a guard spec");const tags=(r)=>{if(r===undefined)return undefined;const t=r.trim();if(t.startsWith("[")){try{const v=JSON.parse(t);if(Array.isArray(v))return v.map(String)}catch(e){}}return t===""?[]:t.split(",").map((s)=>s.trim()).filter((s)=>s!=="")};const claimsOf=(tok)=>{const p=tok.split(".")[1];if(!p)throw new Error("the forge\u0027s OIDC token is not a JWT");const c=JSON.parse(Buffer.from(p.replace(/-/g,"+").replace(/_/g,"/"),"base64").toString("utf-8"));if(!c||typeof c!=="object")throw new Error("the forge\u0027s OIDC token has no claims");return c};async function seenOf(){if(x.forge==="gitlab")return{forgeEnvironment:E.CI_ENVIRONMENT_NAME||null,ref:E.CI_COMMIT_REF_NAME,refProtected:E.CI_COMMIT_REF_PROTECTED,runnerTags:tags(E.CI_RUNNER_TAGS)};const s={ref:E.GITHUB_REF};let c;if(x.forge==="github"&&x.forgeEnvironment!==undefined){try{if(!E.ACTIONS_ID_TOKEN_REQUEST_URL||!E.ACTIONS_ID_TOKEN_REQUEST_TOKEN)throw new Error("the job may request no OIDC token (no ACTIONS_ID_TOKEN_REQUEST_URL); it needs the id-token: write permission");const r=await fetch(E.ACTIONS_ID_TOKEN_REQUEST_URL+"&audience="+encodeURIComponent(A),{headers:{authorization:"bearer "+E.ACTIONS_ID_TOKEN_REQUEST_TOKEN}});if(!r.ok)throw new Error("the OIDC token request answered "+r.status);const v=(await r.json()).value;if(typeof v!=="string")throw new Error("the OIDC token request answered no token");c=claimsOf(v);s.forgeEnvironment=typeof c.environment==="string"&&c.environment!==""?c.environment:null}catch(e){s.forgeEnvironmentError=e&&e.message?e.message:String(e)}}const run=c&&typeof c.runner_environment==="string"?c.runner_environment:E.RUNNER_ENVIRONMENT;if(run)s.runnerEnvironment=run;return s}seenOf().then((s)=>{const P=[],C=[],S=[];const fe=x.forgeEnvironment;if(x.forge==="forgejo")S.push("forge environment (Forgejo has none)");else if(fe!==undefined){if(s.forgeEnvironmentError!==undefined)P.push("forge environment: expected "+fe+", and it could not be read: "+s.forgeEnvironmentError);else if(s.forgeEnvironment!==fe)P.push("forge environment: expected "+fe+", found "+shown(s.forgeEnvironment));else C.push("forge environment "+fe)}const b=x.branches.filter((v)=>v!=="");if(b.length===0)P.push("ref: the job names no branch to run from");else if(x.forge==="gitlab"){if(!s.ref||!b.includes(s.ref))P.push("ref: expected "+b.join(" or ")+", found "+shown(s.ref));else C.push("ref "+s.ref);if(s.refProtected!=="true")P.push("ref: expected a protected ref (CI_COMMIT_REF_PROTECTED true), found "+shown(s.refProtected));else C.push("protected ref")}else{const refs=b.map((v)=>"refs/heads/"+v);if(!s.ref||!refs.includes(s.ref))P.push("ref: expected "+refs.join(" or ")+", found "+shown(s.ref));else C.push("ref "+s.ref)}if(x.forge==="gitlab"){const w=x.runnerTags||[];if(w.length>0){const h=s.runnerTags;const miss=w.filter((t)=>!(h||[]).includes(t));if(h===undefined)P.push("runner: expected tags "+w.join(", ")+", and the job has no CI_RUNNER_TAGS");else if(miss.length>0)P.push("runner: expected tags "+w.join(", ")+", found "+(h.length?h.join(", "):"none"));else C.push("runner tags "+w.join(", "))}}else if(x.selfHosted){if(s.runnerEnvironment===undefined)S.push("runner (the runner says nothing about itself: no RUNNER_ENVIRONMENT)");else if(s.runnerEnvironment!=="self-hosted")P.push("runner: expected self-hosted, found "+s.runnerEnvironment);else C.push("self-hosted runner")}const at=(x.product||"chant")+" check-job: "+x.job;if(P.length>0){for(const p of P)console.error(at+": "+p);console.error(at+": this job does not run where the spec set it to run, so it stops before any credential is taken or code checked out");process.exit(9)}console.log(at+": "+(C.length?C.join(", "):"nothing to check")+(S.length?"; not checked: "+S.join(", "):""))}).catch((e)=>fail(e&&e.message?e.message:String(e)));'')'
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
@@ -134,6 +146,10 @@ jobs:
       REGION: us
       CLOUD_TOKEN_AUDIENCE: us.example
     steps:
+      - name: Check the job runs where the spec set it to run
+        env:
+          CHANT_JOB_GUARD: '{"forge":"github","job":"share 2 of job group us of wave 2 (prod) of migrations","forgeEnvironment":"prod-us","branches":["main"]}'
+        run: '(cd / && node -e ''"use strict";const E=process.env,A="chant-check-job";const shown=(v)=>v===undefined||v===null||v===""?"none":v;const fail=(m)=>{console.error("check-job: "+m);process.exit(9)};let x;try{x=JSON.parse(E.CHANT_JOB_GUARD||"")}catch(e){fail("CHANT_JOB_GUARD is not JSON")}if(!x||!["github","gitlab","forgejo"].includes(x.forge)||!Array.isArray(x.branches))fail("CHANT_JOB_GUARD is not a guard spec");const tags=(r)=>{if(r===undefined)return undefined;const t=r.trim();if(t.startsWith("[")){try{const v=JSON.parse(t);if(Array.isArray(v))return v.map(String)}catch(e){}}return t===""?[]:t.split(",").map((s)=>s.trim()).filter((s)=>s!=="")};const claimsOf=(tok)=>{const p=tok.split(".")[1];if(!p)throw new Error("the forge\u0027s OIDC token is not a JWT");const c=JSON.parse(Buffer.from(p.replace(/-/g,"+").replace(/_/g,"/"),"base64").toString("utf-8"));if(!c||typeof c!=="object")throw new Error("the forge\u0027s OIDC token has no claims");return c};async function seenOf(){if(x.forge==="gitlab")return{forgeEnvironment:E.CI_ENVIRONMENT_NAME||null,ref:E.CI_COMMIT_REF_NAME,refProtected:E.CI_COMMIT_REF_PROTECTED,runnerTags:tags(E.CI_RUNNER_TAGS)};const s={ref:E.GITHUB_REF};let c;if(x.forge==="github"&&x.forgeEnvironment!==undefined){try{if(!E.ACTIONS_ID_TOKEN_REQUEST_URL||!E.ACTIONS_ID_TOKEN_REQUEST_TOKEN)throw new Error("the job may request no OIDC token (no ACTIONS_ID_TOKEN_REQUEST_URL); it needs the id-token: write permission");const r=await fetch(E.ACTIONS_ID_TOKEN_REQUEST_URL+"&audience="+encodeURIComponent(A),{headers:{authorization:"bearer "+E.ACTIONS_ID_TOKEN_REQUEST_TOKEN}});if(!r.ok)throw new Error("the OIDC token request answered "+r.status);const v=(await r.json()).value;if(typeof v!=="string")throw new Error("the OIDC token request answered no token");c=claimsOf(v);s.forgeEnvironment=typeof c.environment==="string"&&c.environment!==""?c.environment:null}catch(e){s.forgeEnvironmentError=e&&e.message?e.message:String(e)}}const run=c&&typeof c.runner_environment==="string"?c.runner_environment:E.RUNNER_ENVIRONMENT;if(run)s.runnerEnvironment=run;return s}seenOf().then((s)=>{const P=[],C=[],S=[];const fe=x.forgeEnvironment;if(x.forge==="forgejo")S.push("forge environment (Forgejo has none)");else if(fe!==undefined){if(s.forgeEnvironmentError!==undefined)P.push("forge environment: expected "+fe+", and it could not be read: "+s.forgeEnvironmentError);else if(s.forgeEnvironment!==fe)P.push("forge environment: expected "+fe+", found "+shown(s.forgeEnvironment));else C.push("forge environment "+fe)}const b=x.branches.filter((v)=>v!=="");if(b.length===0)P.push("ref: the job names no branch to run from");else if(x.forge==="gitlab"){if(!s.ref||!b.includes(s.ref))P.push("ref: expected "+b.join(" or ")+", found "+shown(s.ref));else C.push("ref "+s.ref);if(s.refProtected!=="true")P.push("ref: expected a protected ref (CI_COMMIT_REF_PROTECTED true), found "+shown(s.refProtected));else C.push("protected ref")}else{const refs=b.map((v)=>"refs/heads/"+v);if(!s.ref||!refs.includes(s.ref))P.push("ref: expected "+refs.join(" or ")+", found "+shown(s.ref));else C.push("ref "+s.ref)}if(x.forge==="gitlab"){const w=x.runnerTags||[];if(w.length>0){const h=s.runnerTags;const miss=w.filter((t)=>!(h||[]).includes(t));if(h===undefined)P.push("runner: expected tags "+w.join(", ")+", and the job has no CI_RUNNER_TAGS");else if(miss.length>0)P.push("runner: expected tags "+w.join(", ")+", found "+(h.length?h.join(", "):"none"));else C.push("runner tags "+w.join(", "))}}else if(x.selfHosted){if(s.runnerEnvironment===undefined)S.push("runner (the runner says nothing about itself: no RUNNER_ENVIRONMENT)");else if(s.runnerEnvironment!=="self-hosted")P.push("runner: expected self-hosted, found "+s.runnerEnvironment);else C.push("self-hosted runner")}const at=(x.product||"chant")+" check-job: "+x.job;if(P.length>0){for(const p of P)console.error(at+": "+p);console.error(at+": this job does not run where the spec set it to run, so it stops before any credential is taken or code checked out");process.exit(9)}console.log(at+": "+(C.length?C.join(", "):"nothing to check")+(S.length?"; not checked: "+S.join(", "):""))}).catch((e)=>fail(e&&e.message?e.message:String(e)));'')'
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
@@ -172,6 +188,10 @@ jobs:
       STAGE: apply
       PLAN_TOKEN_AUDIENCE: plan.example
     steps:
+      - name: Check the job runs where the spec set it to run
+        env:
+          CHANT_JOB_GUARD: '{"forge":"github","job":"job group eu of wave 2 (prod) of migrations","forgeEnvironment":"prod-eu","branches":["main"]}'
+        run: '(cd / && node -e ''"use strict";const E=process.env,A="chant-check-job";const shown=(v)=>v===undefined||v===null||v===""?"none":v;const fail=(m)=>{console.error("check-job: "+m);process.exit(9)};let x;try{x=JSON.parse(E.CHANT_JOB_GUARD||"")}catch(e){fail("CHANT_JOB_GUARD is not JSON")}if(!x||!["github","gitlab","forgejo"].includes(x.forge)||!Array.isArray(x.branches))fail("CHANT_JOB_GUARD is not a guard spec");const tags=(r)=>{if(r===undefined)return undefined;const t=r.trim();if(t.startsWith("[")){try{const v=JSON.parse(t);if(Array.isArray(v))return v.map(String)}catch(e){}}return t===""?[]:t.split(",").map((s)=>s.trim()).filter((s)=>s!=="")};const claimsOf=(tok)=>{const p=tok.split(".")[1];if(!p)throw new Error("the forge\u0027s OIDC token is not a JWT");const c=JSON.parse(Buffer.from(p.replace(/-/g,"+").replace(/_/g,"/"),"base64").toString("utf-8"));if(!c||typeof c!=="object")throw new Error("the forge\u0027s OIDC token has no claims");return c};async function seenOf(){if(x.forge==="gitlab")return{forgeEnvironment:E.CI_ENVIRONMENT_NAME||null,ref:E.CI_COMMIT_REF_NAME,refProtected:E.CI_COMMIT_REF_PROTECTED,runnerTags:tags(E.CI_RUNNER_TAGS)};const s={ref:E.GITHUB_REF};let c;if(x.forge==="github"&&x.forgeEnvironment!==undefined){try{if(!E.ACTIONS_ID_TOKEN_REQUEST_URL||!E.ACTIONS_ID_TOKEN_REQUEST_TOKEN)throw new Error("the job may request no OIDC token (no ACTIONS_ID_TOKEN_REQUEST_URL); it needs the id-token: write permission");const r=await fetch(E.ACTIONS_ID_TOKEN_REQUEST_URL+"&audience="+encodeURIComponent(A),{headers:{authorization:"bearer "+E.ACTIONS_ID_TOKEN_REQUEST_TOKEN}});if(!r.ok)throw new Error("the OIDC token request answered "+r.status);const v=(await r.json()).value;if(typeof v!=="string")throw new Error("the OIDC token request answered no token");c=claimsOf(v);s.forgeEnvironment=typeof c.environment==="string"&&c.environment!==""?c.environment:null}catch(e){s.forgeEnvironmentError=e&&e.message?e.message:String(e)}}const run=c&&typeof c.runner_environment==="string"?c.runner_environment:E.RUNNER_ENVIRONMENT;if(run)s.runnerEnvironment=run;return s}seenOf().then((s)=>{const P=[],C=[],S=[];const fe=x.forgeEnvironment;if(x.forge==="forgejo")S.push("forge environment (Forgejo has none)");else if(fe!==undefined){if(s.forgeEnvironmentError!==undefined)P.push("forge environment: expected "+fe+", and it could not be read: "+s.forgeEnvironmentError);else if(s.forgeEnvironment!==fe)P.push("forge environment: expected "+fe+", found "+shown(s.forgeEnvironment));else C.push("forge environment "+fe)}const b=x.branches.filter((v)=>v!=="");if(b.length===0)P.push("ref: the job names no branch to run from");else if(x.forge==="gitlab"){if(!s.ref||!b.includes(s.ref))P.push("ref: expected "+b.join(" or ")+", found "+shown(s.ref));else C.push("ref "+s.ref);if(s.refProtected!=="true")P.push("ref: expected a protected ref (CI_COMMIT_REF_PROTECTED true), found "+shown(s.refProtected));else C.push("protected ref")}else{const refs=b.map((v)=>"refs/heads/"+v);if(!s.ref||!refs.includes(s.ref))P.push("ref: expected "+refs.join(" or ")+", found "+shown(s.ref));else C.push("ref "+s.ref)}if(x.forge==="gitlab"){const w=x.runnerTags||[];if(w.length>0){const h=s.runnerTags;const miss=w.filter((t)=>!(h||[]).includes(t));if(h===undefined)P.push("runner: expected tags "+w.join(", ")+", and the job has no CI_RUNNER_TAGS");else if(miss.length>0)P.push("runner: expected tags "+w.join(", ")+", found "+(h.length?h.join(", "):"none"));else C.push("runner tags "+w.join(", "))}}else if(x.selfHosted){if(s.runnerEnvironment===undefined)S.push("runner (the runner says nothing about itself: no RUNNER_ENVIRONMENT)");else if(s.runnerEnvironment!=="self-hosted")P.push("runner: expected self-hosted, found "+s.runnerEnvironment);else C.push("self-hosted runner")}const at=(x.product||"chant")+" check-job: "+x.job;if(P.length>0){for(const p of P)console.error(at+": "+p);console.error(at+": this job does not run where the spec set it to run, so it stops before any credential is taken or code checked out");process.exit(9)}console.log(at+": "+(C.length?C.join(", "):"nothing to check")+(S.length?"; not checked: "+S.join(", "):""))}).catch((e)=>fail(e&&e.message?e.message:String(e)));'')'
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0

package/src/components/agent-jobs.ts

@@ -0,0 +1,177 @@
+/**
+ * The agent jobs on GitHub and Forgejo (#4616): `ScheduledOpSpec.agent`.
+ * What each job does is @intentius/chant/ci-agent's; this file lays them
+ * out so the model never shares a job with a write token:
+ *
+ * - the agent job holds `contents: read` and `pull-requests: read`. Its
+ *   checkout script alone sees the job token, for the fetches (the target
+ *   branch's commit, chant/lifecycle for the run count, and for a comment
+ *   the pull request's head). `chant agent prepare` reads with the job
+ *   token; `chant agent run` is the last step and starts without any forge
+ *   token, with the model's key from its secret, and hands the agent
+ *   directory on as the job's outputs (`handoverTrap`).
+ * - the push job checks out the target branch's commit, takes the agent
+ *   directory back as data and runs `chant agent land` with the push token:
+ *   `tokenEnv`'s secret, else the job token. A push made with the job token
+ *   starts no workflow on GitHub, so the pull request is planned again only
+ *   with a token of a user or an app.
+ *
+ * Forgejo's runner ignores `permissions:` and has no author association, so
+ * there `chant agent prepare` asks the forge whether the commenter can write,
+ * and both jobs drop the token variables before any step that does not need
+ * them.
+ */
+
+import { CHECKOUT_TOKEN_ENV, checkoutScript, dropForgeTokens, handoverOutputs, handoverTrap, takeOverScript } from "@intentius/chant/ci-handover";
+import { githubRunsOn, GITHUB_JOB_TOKEN, githubSecret, githubSecretOrJobToken, type CiRunner } from "@intentius/chant/ci-jobs";
+import {
+  AGENT_DECISION_FILE,
+  AGENT_DIR,
+  AGENT_DRIFT_FILE,
+  AGENT_PATCH_FILE,
+  AGENT_RC_FILE,
+  agentCommandLines,
+  agentGitAuthLines,
+  agentHeadFetchLine,
+  agentSettingsEnv,
+  type AgentSettings,
+} from "@intentius/chant/ci-agent";
+import { CHANT_EXIT } from "@intentius/chant/exit-codes";
+
+/** The agent step's id, which the agent job's outputs come from. */
+export const AGENT_STEP_ID = "chant-agent";
+/** The drift Op's run step id, whose outputs carry the drift and the code. */
+export const AGENT_DRIFT_STEP_ID = "chant-run";
+/** The variable the push step holds its token in, for git's header and the forge client. */
+const PUSH_TOKEN_ENV = "CHANT_AGENT_TOKEN";
+
+/** The files the handover keeps when the agent directory is too large to hand on whole. */
+const HANDED = { label: "chant-agent", noteFiles: [AGENT_DECISION_FILE, AGENT_RC_FILE, AGENT_PATCH_FILE, "prompt.sha256"] } as const;
+const DRIFT_HANDED = { label: "chant-agent", noteFiles: [AGENT_DRIFT_FILE] } as const;
+
+/** The name of the push job beside the agent job. */
+export function agentPushJobName(jobName: string): string {
+  return `${jobName}-push`;
+}
+
+/** The agent job's name for a drift Op's job. */
+export function agentJobName(jobName: string, on: AgentSettings["on"]): string {
+  return on === "drift" ? `${jobName}-agent` : jobName;
+}
+
+export interface GithubAgentJobsInput {
+  forge: "github" | "forgejo";
+  /** The agent job's name. */
+  jobName: string;
+  image: string;
+  settings: AgentSettings;
+  runner?: CiRunner;
+  /** Setup steps, as built by `setupStepDoc`. */
+  setup: Array<Record<string, unknown>>;
+  beforeScript: readonly string[];
+  /** The secret holding the push token; absent: the job token. */
+  tokenEnv?: string;
+  /** The command in place of `chant`: the product's bin. */
+  bin?: string;
+  /** For a drift agent: the Op's job, which handed the drift on. */
+  after?: string;
+}
+
+/** The comment condition of the agent job: a pull request comment that starts with the agent's line, from a writer on GitHub. */
+export function agentCommentIf(forge: "github" | "forgejo", comment: string): string {
+  return [
+    "github.event_name == 'issue_comment'",
+    forge === "forgejo" ? "(github.event.issue.pull_request || github.event.is_pull)" : "github.event.issue.pull_request",
+    `startsWith(github.event.comment.body, '${comment.replace(/'/g, "''")} ')`,
+    ...(forge === "forgejo" ? [] : ["contains(fromJSON('[\"OWNER\",\"MEMBER\",\"COLLABORATOR\"]'), github.event.comment.author_association)"]),
+  ].join(" && ");
+}
+
+/**
+ * The drift Op's run step (#4616): the run with its output kept as the
+ * drift for the agent, `drift=true` among the step's outputs when it exits
+ * with chant's `drift` code, and the output handed on. The step still exits
+ * with the run's code.
+ */
+export function driftRunStep(invocation: string, env: Record<string, string>, forge: "github" | "forgejo"): Record<string, unknown> {
+  return {
+    id: AGENT_DRIFT_STEP_ID,
+    env,
+    run: [
+      "set +e",
+      `mkdir -p ${AGENT_DIR}`,
+      ...handoverTrap(AGENT_DIR, forge, DRIFT_HANDED),
+      `{ ${invocation}; echo "$?" >"\${RUNNER_TEMP:-/tmp}/chant-run.code"; } 2>&1 | tee ${AGENT_DIR}/${AGENT_DRIFT_FILE}`,
+      'code=$(cat "${RUNNER_TEMP:-/tmp}/chant-run.code")',
+      `if [ "$code" -eq ${CHANT_EXIT.drift} ]; then echo "drift=true" >>"$GITHUB_OUTPUT"; fi`,
+      'exit "$code"',
+    ].join("\n"),
+  };
+}
+
+/** The drift Op job's outputs: the handed-on drift and the drift flag. */
+export function driftRunOutputs(forge: "github" | "forgejo"): Record<string, string> {
+  return { ...handoverOutputs(AGENT_DRIFT_STEP_ID, forge), drift: `\${{ steps.${AGENT_DRIFT_STEP_ID}.outputs.drift }}` };
+}
+
+/** The agent job and the push job. */
+export function githubAgentJobs(i: GithubAgentJobsInput): { agent: Record<string, unknown>; push: Record<string, unknown> } {
+  const s = i.settings;
+  const lines = agentCommandLines(i.forge, i.bin);
+  const drop = dropForgeTokens("sh");
+  const comment = s.on === "comment";
+  const settingsEnv = agentSettingsEnv(s);
+  const checkout = (head: boolean): Record<string, unknown> => ({
+    name: head ? "Check out the target branch's commit and the pull request's head" : "Check out the commit the drift check ran on",
+    env: { [CHECKOUT_TOKEN_ENV]: GITHUB_JOB_TOKEN, ...(head ? { PR_NUMBER: "${{ github.event.issue.number }}" } : {}) },
+    // The ledger branch too: prepare counts the agent's runs on it, and land appends to it.
+    run: [checkoutScript(true, true), ...(head ? [agentHeadFetchLine(i.forge, "PR_NUMBER")] : [])].join("\n"),
+  });
+  const before = i.beforeScript.map((line) => ({ run: `${drop}\n${line}` }));
+  const timeout = s.timeout + 15;
+  const agent: Record<string, unknown> = {
+    ...(comment ? { if: agentCommentIf(i.forge, s.comment!) } : { needs: i.after, if: `always() && needs.${i.after}.outputs.drift == 'true'` }),
+    "runs-on": githubRunsOn(i.runner),
+    container: i.image,
+    "timeout-minutes": timeout,
+    permissions: { contents: "read", "pull-requests": "read" },
+    env: settingsEnv,
+    outputs: handoverOutputs(AGENT_STEP_ID, i.forge),
+    steps: [
+      checkout(comment),
+      ...(comment ? [] : [{ name: "Take the drift from the drift check", run: takeOverScript(i.after!, AGENT_DIR, i.forge) }]),
+      ...i.setup,
+      ...before,
+      // Reads only: the comment, the commenter's access, the pull request's head and the ledger.
+      { name: "Decide whether the agent runs", env: { GITHUB_TOKEN: GITHUB_JOB_TOKEN }, run: lines.prepare },
+      // The job's last step: the model's key and no forge token, and the agent directory handed on however it ends.
+      {
+        id: AGENT_STEP_ID,
+        name: "Run the agent",
+        env: { [s.keyEnv]: githubSecret(s.keyEnv) },
+        run: [drop, ...handoverTrap(AGENT_DIR, i.forge, HANDED), lines.run].join("\n"),
+      },
+    ],
+  };
+  const token = i.tokenEnv ? githubSecretOrJobToken(i.tokenEnv) : GITHUB_JOB_TOKEN;
+  const push: Record<string, unknown> = {
+    needs: i.jobName,
+    if: `always() && needs.${i.jobName}.result == 'success'`,
+    "runs-on": githubRunsOn(i.runner),
+    container: i.image,
+    permissions: { contents: "write", "pull-requests": "write", issues: "write" },
+    env: settingsEnv,
+    steps: [
+      checkout(comment),
+      { name: "Take the change from the agent job", run: takeOverScript(i.jobName, AGENT_DIR, i.forge) },
+      ...i.setup,
+      ...before,
+      {
+        name: comment ? "Push the change to the pull request" : "Open or update the agent's pull request",
+        env: { [PUSH_TOKEN_ENV]: token, GITHUB_TOKEN: token, ...(i.forge === "forgejo" ? { CHANT_FORGEJO_TOKEN: token } : {}) },
+        run: [...agentGitAuthLines(PUSH_TOKEN_ENV, "x-access-token"), lines.land].join("\n"),
+      },
+    ],
+  };
+  return { agent, push };
+}

package/src/components/control-pipeline.ts

@@ -0,0 +1,65 @@
+/**
+ * The control repo's own workflow (#4568) on GitHub, and on Forgejo through
+ * its dialect: a member's dispatch starts it, and it runs the member's
+ * dependents with `chant workspace run --dependents-of`. The pieces are
+ * core's (`controlPipelineSpec` in `@intentius/chant/control/dispatch`);
+ * this file writes them as a workflow. The member's side, the
+ * `control-dispatch` job, comes from the pull request loop's `control`
+ * option (./generate-pipeline.ts).
+ */
+
+import { CI_IMAGE, GITHUB_RUNNER } from "@intentius/chant/ci-jobs";
+import { controlPipelineSpec } from "@intentius/chant/control/dispatch";
+import type { CiProductWords, CiProductWordsInput } from "@intentius/chant/ci-product-words";
+import { CHECKOUT, concurrency, emitWorkflowYAML, type GithubWorkflowDoc } from "./ci-jobs";
+
+/** A control repo's pipeline file: where it goes, its text, and what a person still sets up. */
+export interface ControlPipelineFile {
+  path: string;
+  content: string;
+  notes: string[];
+}
+
+/** What {@link controlGithubDoc} and the generators take. */
+export interface ControlPipelineOptions {
+  words?: CiProductWordsInput | CiProductWords;
+  /** The image the job runs in. Default chant's CI image. */
+  image?: string;
+  /** The command the job runs chant with. Default `npx --no-install chant`. */
+  command?: string;
+}
+
+/** The control repo's workflow document for a GitHub-shaped forge, before emission. Forgejo transforms it first. */
+export function controlGithubDoc(forge: "github" | "forgejo", options: ControlPipelineOptions = {}): { doc: GithubWorkflowDoc; path: string; notes: string[] } {
+  const spec = controlPipelineSpec(forge, options.words ?? {}, options.command ? { command: options.command } : {});
+  const doc: GithubWorkflowDoc = {
+    header: spec.header,
+    name: spec.path.split("/").pop()!.replace(/\.yml$/, ""),
+    on: {
+      ...(forge === "github" ? { repository_dispatch: { types: [spec.event] } } : {}),
+      workflow_dispatch: { inputs: spec.inputs },
+    },
+    // #4617: contents: write pushes the record of each dispatch that carries an outcome to chant/lifecycle.
+    permissions: { contents: "write" },
+    // One run per member at a time, and none cancelled: a later apply of the same member waits for the one running.
+    concurrency: concurrency(spec.group),
+    jobsDoc: {
+      dependents: {
+        "runs-on": GITHUB_RUNNER,
+        container: options.image ?? CI_IMAGE,
+        steps: [
+          // The full history, so the job reads and appends to chant/lifecycle (#4617).
+          { uses: CHECKOUT, with: { "fetch-depth": 0 } },
+          { name: "Run the dependents of the member that applied", shell: "bash", env: spec.env, run: spec.script },
+        ],
+      },
+    },
+  };
+  return { doc, path: spec.path, notes: spec.notes };
+}
+
+/** The control repo's workflow on GitHub: `.github/workflows/<product>-dependents.yml`. */
+export function generateControlPipeline(options: ControlPipelineOptions = {}): ControlPipelineFile {
+  const { doc, path, notes } = controlGithubDoc("github", options);
+  return { path, content: emitWorkflowYAML(doc), notes };
+}

package/src/components/generate-op-pipeline.agent.test.ts

@@ -0,0 +1,147 @@
+/**
+ * The agent jobs (#4616): `ScheduledOpSpec.agent` and `runner`. The model's
+ * job holds a read token and the model's key; only the push job writes.
+ */
+
+import { describe, expect, test } from "vitest";
+import { parseYAML } from "@intentius/chant/yaml";
+import { FORGE_TOKEN_VARS } from "@intentius/chant/ci-handover";
+import type { ScheduledOpSpec } from "@intentius/chant/lexicon";
+import { generateGithubOpPipeline } from "./generate-op-pipeline";
+
+interface Step {
+  id?: string;
+  name?: string;
+  run?: string;
+  env?: Record<string, string>;
+}
+interface Job {
+  needs?: string;
+  if?: string;
+  "runs-on"?: unknown;
+  "timeout-minutes"?: number;
+  permissions?: Record<string, string>;
+  env?: Record<string, string>;
+  outputs?: Record<string, string>;
+  steps: Step[];
+}
+interface Doc {
+  on: Record<string, unknown>;
+  permissions?: Record<string, string>;
+  jobs: Record<string, Job>;
+}
+
+const gen = (spec: ScheduledOpSpec) => {
+  const out = generateGithubOpPipeline([spec]);
+  return { doc: parseYAML(out.files[0]!.yaml) as unknown as Doc, name: out.files[0]!.name, jobs: out.jobs };
+};
+
+const COMMENT: ScheduledOpSpec = { name: "chant-agent", agent: { on: "comment", comment: "/chant agent", maxRuns: 3, timeout: 20 } };
+
+describe("the comment agent", () => {
+  const { doc, name } = gen(COMMENT);
+  const agent = doc.jobs["chant-agent"]!;
+  const push = doc.jobs["chant-agent-push"]!;
+
+  test("is a workflow of its own on pull request comments from a writer", () => {
+    expect(name).toBe("chant-agent.yml");
+    expect(doc.on).toEqual({ issue_comment: { types: ["created"] } });
+    expect(agent.if).toContain("startsWith(github.event.comment.body, '/chant agent ')");
+    expect(agent.if).toContain("author_association");
+  });
+
+  test("the agent job reads, stops at its timeout, and runs the model with its key and no forge token", () => {
+    expect(agent.permissions).toEqual({ contents: "read", "pull-requests": "read" });
+    expect(agent["timeout-minutes"]).toBe(35);
+    expect(agent.env).toMatchObject({ CHANT_AGENT_NAME: "chant-agent", CHANT_AGENT_ON: "comment", CHANT_AGENT_MAX_RUNS: "3", CHANT_AGENT_TIMEOUT: "20" });
+    const run = agent.steps.at(-1)!;
+    expect(run.id).toBe("chant-agent");
+    expect(run.env).toEqual({ ANTHROPIC_API_KEY: "${{ secrets.ANTHROPIC_API_KEY }}" });
+    expect(run.run).toContain("chant agent run --forge github");
+    expect(run.run).toContain("trap chant_handover EXIT");
+    expect(Object.keys(run.env ?? {}).filter((n) => (FORGE_TOKEN_VARS as readonly string[]).includes(n))).toEqual([]);
+    expect(agent.steps[0]!.run).toContain("refs/pull/$PR_NUMBER/head:refs/chant/agent-head");
+    expect(agent.steps.some((s) => s.run?.includes("chant agent prepare"))).toBe(true);
+  });
+
+  test("the push job holds the write token, takes the change as data and lands it", () => {
+    expect(push.needs).toBe("chant-agent");
+    expect(push.permissions).toEqual({ contents: "write", "pull-requests": "write", issues: "write" });
+    const land = push.steps.at(-1)!;
+    expect(land.run).toContain("chant agent land --forge github");
+    expect(land.env?.CHANT_AGENT_TOKEN).toBe("${{ github.token }}");
+    expect(push.steps.some((s) => s.run?.includes("needs.chant-agent.outputs.report_0"))).toBe(true);
+  });
+
+  test("a push token secret replaces the job token, and the runner names where both jobs run", () => {
+    const { doc: d } = gen({ ...COMMENT, runner: ["self-hosted", "agents"], agent: { ...COMMENT.agent!, tokenEnv: "AGENT_PUSH_TOKEN" } });
+    expect(d.jobs["chant-agent"]!["runs-on"]).toEqual(["self-hosted", "agents"]);
+    expect(d.jobs["chant-agent-push"]!["runs-on"]).toEqual(["self-hosted", "agents"]);
+    expect(d.jobs["chant-agent-push"]!.steps.at(-1)!.env?.CHANT_AGENT_TOKEN).toBe("${{ secrets.AGENT_PUSH_TOKEN || github.token }}");
+  });
+
+  test("refuses settings no job could run", () => {
+    expect(() => gen({ name: "a", agent: { on: "comment" } })).toThrow(/comment/);
+  });
+});
+
+describe("the drift agent", () => {
+  const DRIFT: ScheduledOpSpec = { name: "drift-app", trigger: { kind: "cron", schedule: "0 6 * * *" }, findingMode: "issue", agent: { on: "drift", maxRuns: 1 } };
+  const { doc } = gen(DRIFT);
+  const op = doc.jobs["drift-app"]!;
+  const agent = doc.jobs["drift-app-agent"]!;
+  const push = doc.jobs["drift-app-agent-push"]!;
+
+  test("the Op's job keeps its output and says when it found drift", () => {
+    const run = op.steps.find((s) => s.id === "chant-run")!;
+    expect(run.run).toContain('if [ "$code" -eq 2 ]; then echo "drift=true"');
+    expect(run.run).toContain("tee .chant/agent/drift.txt");
+    expect(op.outputs?.drift).toBe("${{ steps.chant-run.outputs.drift }}");
+  });
+
+  test("the agent job follows it on drift and takes its output", () => {
+    expect(agent.needs).toBe("drift-app");
+    expect(agent.if).toBe("always() && needs.drift-app.outputs.drift == 'true'");
+    expect(agent.steps.some((s) => s.run?.includes("needs.drift-app.outputs.report_0"))).toBe(true);
+    expect(agent.env?.CHANT_AGENT_BRANCH).toBe("chant/agent/drift-app");
+  });
+
+  test("the push job opens or updates the agent's pull request", () => {
+    expect(push.needs).toBe("drift-app-agent");
+    expect(push.steps.at(-1)!.name).toBe("Open or update the agent's pull request");
+  });
+
+  test("refuses a drift agent on a push trigger", () => {
+    expect(() => gen({ ...DRIFT, trigger: { kind: "push" } })).toThrow(/drift agent/);
+  });
+});
+
+describe("the runner field", () => {
+  test("names the Op job's runner, a group included", () => {
+    const { doc } = gen({ name: "drift-app", trigger: { kind: "cron", schedule: "0 6 * * *" }, runner: { group: "infra", labels: ["linux"] } });
+    expect(doc.jobs["drift-app"]!["runs-on"]).toEqual({ group: "infra", labels: ["linux"] });
+    expect(gen({ name: "drift-app", trigger: { kind: "cron", schedule: "0 6 * * *" } }).doc.jobs["drift-app"]!["runs-on"]).toBe("ubuntu-latest");
+  });
+});
+
+// #4619: a member's drift Op runs in the member's directory and hands its output on; the agent job takes it at the root.
+describe("the drift agent of a workspace member", () => {
+  const out = generateGithubOpPipeline([{ name: "drift-app", trigger: { kind: "cron", schedule: "0 6 * * *" }, findingMode: "issue", agent: { on: "drift", maxCostUsd: 2.5 } }], { member: { name: "app", dir: "stacks/app" } });
+  const doc = parseYAML(out.files[0]!.yaml) as unknown as Doc & { jobs: Record<string, Job & { defaults?: { run?: { "working-directory"?: string } } }> };
+  const op = doc.jobs["drift-app"]!;
+  const agent = doc.jobs["drift-app-agent"]!;
+
+  test("the drift check runs in the member's directory and hands on the member's own output", () => {
+    expect(op.defaults?.run?.["working-directory"]).toBe("stacks/app");
+    expect(op.steps.find((s) => s.id === "chant-run")!.run).toContain("tee .chant/agent/drift.txt");
+  });
+
+  test("the agent job runs at the root and takes that output into its agent directory", () => {
+    expect(agent.defaults).toBeUndefined();
+    const take = agent.steps.find((s) => s.name === "Take the drift from the drift check")!;
+    expect(take.run).toContain("needs.drift-app.outputs.report_0");
+    expect(take.run).toContain(" .chant/agent <<");
+    expect(agent.steps.some((s) => s.run?.includes("chant agent prepare --forge github --output .chant/agent"))).toBe(true);
+    expect(agent.env?.CHANT_AGENT_MAX_COST_USD).toBe("2.5");
+  });
+});

package/src/components/generate-op-pipeline.cloud.test.ts

@@ -0,0 +1,96 @@
+/**
+ * #4631: cloud identities on a scheduled Op's job, traded before the
+ * checkout, and an update on drift in a job of its own that alone holds
+ * the update's identity.
+ */
+import { describe, expect, test } from "vitest";
+import { parseYAML } from "@intentius/chant/yaml";
+import type { ScheduledOpSpec } from "@intentius/chant/lexicon";
+import { generateGithubOpPipeline } from "./generate-op-pipeline";
+
+interface Step { id?: string; name?: string; uses?: string; run?: string; env?: Record<string, string> }
+interface Job { needs?: string; if?: string; permissions?: Record<string, string>; outputs?: Record<string, string>; environment?: unknown; steps: Step[] }
+interface Doc { permissions?: Record<string, string>; jobs: Record<string, Job> }
+
+const PREVIEW = { aws: { role: "arn:aws:iam::1:role/preview", region: "us-east-1", audience: "sts.amazonaws.com" } };
+const UPDATE = { aws: { role: "arn:aws:iam::1:role/update", region: "us-east-1", audience: "sts.amazonaws.com" } };
+const DRIFT: ScheduledOpSpec = { name: "plywood-drift-dev", trigger: { kind: "cron", schedule: "0 6 * * *" }, findingMode: "issue", cloud: PREVIEW };
+
+const gen = (spec: ScheduledOpSpec) => parseYAML(generateGithubOpPipeline([spec]).files[0]!.yaml) as unknown as Doc;
+
+describe("a scheduled Op's cloud identities (#4631)", () => {
+  test("the trade runs before the checkout, and every later run step drops the token request variables", () => {
+    const doc = gen(DRIFT);
+    const job = doc.jobs["plywood-drift-dev"]!;
+    expect(job.steps[0]!.name).toBe("Trade the job's OIDC token for its cloud identities");
+    expect(JSON.parse(job.steps[0]!.env!.CHANT_CLOUD_TRADE!)).toEqual(PREVIEW);
+    expect(job.steps[1]!.uses).toMatch(/^actions\/checkout@/);
+    for (const step of job.steps.slice(2)) if (step.run) expect(step.run).toMatch(/^unset ACTIONS_ID_TOKEN_REQUEST_TOKEN ACTIONS_ID_TOKEN_REQUEST_URL/);
+  });
+
+  test("the finding-mode's permissions stay; the job alone adds id-token: write", () => {
+    const plain = gen({ ...DRIFT, cloud: undefined } as ScheduledOpSpec);
+    const doc = gen(DRIFT);
+    expect(doc.permissions).toEqual(plain.permissions);
+    expect(doc.jobs["plywood-drift-dev"]!.permissions).toEqual({ ...plain.permissions, "id-token": "write" });
+  });
+
+  test("a malformed cloud and a cloud on a review split are refused", () => {
+    expect(() => gen({ ...DRIFT, cloud: { aws: { region: "us-east-1" } } as never })).toThrow(/audience/);
+    expect(() => gen({ name: "review", trigger: { kind: "pull_request" }, reviewAgent: true, cloud: PREVIEW })).toThrow(/no cloud identity/);
+  });
+});
+
+describe("an update on drift (#4631)", () => {
+  const spec: ScheduledOpSpec = { ...DRIFT, update: { command: "npx --no-install plywood up", cloud: UPDATE, environment: { name: "production" } } };
+  const doc = gen(spec);
+  const check = doc.jobs["plywood-drift-dev"]!;
+  const update = doc.jobs["plywood-drift-dev-update"]!;
+
+  test("the check says when it found drift, and holds only its own identity", () => {
+    expect(check.outputs).toEqual({ drift: "${{ steps.drift-check.outputs.drift }}" });
+    const run = check.steps.find((s) => s.id === "drift-check")!;
+    expect(run.run).toContain('if [ "$code" -eq 2 ]; then echo "drift=true"');
+    expect(JSON.stringify(check)).not.toContain("role/update");
+  });
+
+  test("the update job runs after a drift, trades for its own identity first, and runs the command", () => {
+    expect(update.needs).toBe("plywood-drift-dev");
+    expect(update.if).toBe("always() && needs.plywood-drift-dev.outputs.drift == 'true'");
+    expect(update.permissions).toEqual({ contents: "read", "id-token": "write" });
+    expect(update.environment).toEqual({ name: "production" });
+    expect(JSON.parse(update.steps[0]!.env!.CHANT_CLOUD_TRADE!)).toEqual(UPDATE);
+    expect(update.steps[1]!.uses).toMatch(/^actions\/checkout@/);
+    expect(update.steps.at(-1)!.run).toMatch(/^unset .*\nnpx --no-install plywood up\n?$/);
+  });
+
+  test("an update on a push trigger, or with no command, is refused", () => {
+    expect(() => gen({ name: "apply", trigger: { kind: "push" }, update: { command: "x" } })).toThrow(/cron or pull_request/);
+    expect(() => gen({ ...DRIFT, update: { command: " " } })).toThrow(/command/);
+  });
+});
+
+describe("contents: write on the update job (#4631, 2026-10-28 ruling)", () => {
+  const plain = gen(DRIFT);
+  const spec: ScheduledOpSpec = { ...DRIFT, update: { command: "npx --no-install plywood up", cloud: UPDATE, permissions: { contents: "write" } } };
+  const doc = gen(spec);
+
+  test("the update job may raise contents to write, so it records on chant/lifecycle", () => {
+    expect(doc.jobs["plywood-drift-dev-update"]!.permissions).toEqual({ contents: "write", "id-token": "write" });
+  });
+
+  test("the drift check's job and the workflow keep their scopes", () => {
+    expect(doc.permissions).toEqual(plain.permissions);
+    expect(doc.jobs["plywood-drift-dev"]!.permissions).toEqual(plain.jobs["plywood-drift-dev"]!.permissions);
+    expect(doc.jobs["plywood-drift-dev"]!.permissions!.contents).not.toBe("write");
+  });
+
+  test("the identity scoping stays: the check holds the preview identity, the update its own", () => {
+    expect(JSON.stringify(doc.jobs["plywood-drift-dev"])).not.toContain("role/update");
+    expect(JSON.parse(doc.jobs["plywood-drift-dev-update"]!.steps[0]!.env!.CHANT_CLOUD_TRADE!)).toEqual(UPDATE);
+  });
+
+  test("contents restated at read is still refused", () => {
+    expect(() => gen({ ...DRIFT, update: { command: "x", permissions: { contents: "read" } } })).toThrow(/contents may only be raised to write/);
+  });
+});

package/src/components/generate-op-pipeline.notice.test.ts

@@ -87,7 +87,8 @@ async function fakeForge(routes: Record<string, (body?: Record<string, unknown>)
 }
 
 async function runNotice(env: Record<string, string>): Promise<string> {
-  const { stdout } = await run(process.execPath, ["--import", "tsx", "notice.mjs"], {
+  // chant here is the source tree, with no dist/: the development condition picks src/*.ts over the import condition's dist/*.js (#4591).
+  const { stdout } = await run(process.execPath, ["--conditions=development", "--import", "tsx", "notice.mjs"], {
     cwd: jobDir(),
     env: {
       PATH: process.env.PATH ?? "",