@intentius/chant-lexicon-github 0.124.55 → 0.124.56

package/src/components/generate-pipeline.ts

@@ -59,7 +59,7 @@
 import { resolveComponentGraph, type DriverComponent } from "@intentius/chant/components/driver";
 import { hasPublishStep, promoteArchivePaths } from "@intentius/chant/components/promote";
 import { GATED_WAVE_RECORD, gatedWaveJobs } from "@intentius/chant/components/gated-wave-pipeline";
-import { CI_IMAGE, ciJobName, dirnameOf, fillCommand, GITHUB_JOB_TOKEN, GITHUB_RUNNER } from "@intentius/chant/ci-jobs";
+import { CI_IMAGE, ciJobName, dirnameOf, fillCommand, GITHUB_JOB_TOKEN, GITHUB_RUNNER, githubRunsOn } from "@intentius/chant/ci-jobs";
 import { CHECKOUT_TOKEN_ENV, checkoutScript, dropForgeTokens, handoverOutputs, handoverTrap, takeOverScript } from "@intentius/chant/ci-handover";
 import { OIDC_REQUEST_VARS, TRADE_SPEC_ENV, tradeLine, type CloudTradeSpec } from "@intentius/chant/ci-identity";
 import {
@@ -87,6 +87,10 @@ import {
   prLoopWaveJobs,
   prLoopWithWaves,
   prEnvJobs,
+  prLoopJobStage,
+  prStaleJob,
+  PR_STALE_JOB,
+  prLoopRunner,
   PR_ENV_REPORT_DIR,
   PR_ENV_SWEEP_CRON,
   PR_ENV_POST_JOB,
@@ -415,7 +419,25 @@ function prLoopGithubDoc(
       },
     ]);
   }
-  const post = prLoopPostJob(forgeName, env, member?.name, loop.words ? resolveProductWords(loop.words) : undefined);
+  const post = prLoopPostJob(forgeName, env, member?.name, loop.words ? resolveProductWords(loop.words) : undefined, { ...(loop.staleNotes ? { staleNotes: true } : {}), ...(loop.respond ? { respond: loop.respond } : {}), ...(loop.decide ? { decide: loop.decide } : {}) });
+  // #4628: on a push to the target branch, the open pull requests' notes posted against another commit are marked stale.
+  const stale = prStaleJob(forgeName, env, loop, member?.name);
+  const staleJobs: Record<string, unknown> = stale
+    ? {
+        [PR_STALE_JOB]: {
+          if: "github.event_name == 'push' && startsWith(github.ref, 'refs/heads/')",
+          "runs-on": GITHUB_RUNNER,
+          container: image,
+          permissions: { contents: "read", "pull-requests": "write", statuses: "write" },
+          steps: [
+            // The pushed commit: the target branch's, so none of a pull request's code is here.
+            { name: "Check out the target branch's commit", uses: CHECKOUT },
+            ...runSteps(beforeScript),
+            { name: "Mark the open pull requests' notes stale", ...(rooted ? {} : { "working-directory": "." }), env: stale.env, run: stale.command },
+          ],
+        },
+      }
+    : {};
   // #4619: with a control repo named, the note job reads its chant/lifecycle, read-only, so pr-post marks the cross-stack edges.
   const controlRead = loop.control ? controlNoteCheckout(forgeName, loop.control.target, loop.words ?? {}) : undefined;
   const noteSteps: Array<Record<string, unknown>> = [
@@ -563,6 +585,7 @@ function prLoopGithubDoc(
     ...lockJobs,
     ...commentLockJobs,
     ...previewJobs,
+    ...staleJobs,
     ...Object.fromEntries(applyJobs),
     ...Object.fromEntries(controlJobs),
     ...(prEnv ? prEnv.jobs : {}),
@@ -580,6 +603,12 @@ function prLoopGithubDoc(
   }
   // #4301: a /chant apply comment starts the apply before merge. #4588: and a lock or unlock comment its job.
   if (loop.applyBeforeMerge || commentLocks.length > 0 || preview) on.issue_comment = { types: ["created"] };
+  // #4625: each job on its stage's runner, the plan side's, the apply side's, or the default.
+  if (loop.runners) {
+    for (const [name, job] of Object.entries(jobsDoc) as Array<[string, Record<string, unknown>]>) {
+      job["runs-on"] = githubRunsOn(prLoopRunner(loop, prLoopJobStage(name)));
+    }
+  }
   return {
     name: member ? `chant-pr.${member.name}.${env}` : `chant-pr-${env}`,
     environment: env,
@@ -587,10 +616,11 @@ function prLoopGithubDoc(
     ...(rooted ? {} : { defaults: { run: { "working-directory": member!.dir } } }),
     env: { ...options.variables, CHANT_ENV: env },
     jobsDoc,
-    stages: ["plan", PR_PLAN_NOTE_JOB, ...(locks ? [PR_LOCK_JOB, PR_UNLOCK_JOB] : []), ...commentLocks.map((j) => j.jobName), ...(preview ? [preview.jobName, preview.noteJobName] : []), ...applyNames, ...controlJobs.map(([name]) => name), ...(prEnv ? ["env-up", PR_ENV_POST_JOB, "env-down", "env-sweep"] : [])],
+    stages: ["plan", PR_PLAN_NOTE_JOB, ...(locks ? [PR_LOCK_JOB, PR_UNLOCK_JOB] : []), ...commentLocks.map((j) => j.jobName), ...(preview ? [preview.jobName, preview.noteJobName] : []), ...(stale ? [PR_STALE_JOB] : []), ...applyNames, ...controlJobs.map(([name]) => name), ...(prEnv ? ["env-up", PR_ENV_POST_JOB, "env-down", "env-sweep"] : [])],
     jobs: [
       { jobName: "plan", component: "pull request plan", stage: "plan", needs: [] },
       { jobName: PR_PLAN_NOTE_JOB, component: "pull request plan note", stage: PR_PLAN_NOTE_JOB, needs: ["plan"] },
+      ...(stale ? [{ jobName: PR_STALE_JOB, component: "pull request stale notes", stage: PR_STALE_JOB, needs: [] }] : []),
       ...(locks
         ? [
             { jobName: PR_LOCK_JOB, component: "pull request lock", stage: PR_LOCK_JOB, needs: ["plan"] },

package/src/components/generate-pr-pipeline.comment-targets.test.ts

@@ -0,0 +1,24 @@
+/**
+ * The preview comment's --target on GitHub (#4626): the preview step runs
+ * `pr-plan --comment-targets` with the comment body in CHANT_PREVIEW_COMMENT,
+ * and the body never appears in the shell line. Written for the
+ * ci-products post-merge pass.
+ */
+import { expect, test } from "vitest";
+import { parseYAML } from "@intentius/chant/yaml";
+import type { DriverComponent } from "@intentius/chant/components/driver";
+import { generateGithubPipeline } from "./generate-pipeline";
+
+const ESTATE: DriverComponent[] = [{ name: "net", dependsOn: [], deploy: [{ phase: "Apply", steps: [{ kind: "terraform-apply", root: "net" }] }] }];
+const WORDS = { product: "plywood", stages: { plan: "preview", apply: "up" }, commands: { preview: "plan" as const }, bin: "npx --no-install plywood" };
+
+test("the preview step reads the comment from a variable (#4626)", () => {
+  const doc = parseYAML(generateGithubPipeline(ESTATE, { env: "prod", prLoop: { previewComment: true, words: WORDS } }).yaml) as { jobs: Record<string, { steps: Array<{ name?: string; run?: string; env?: Record<string, string> }> }> };
+  const step = doc.jobs["comment-preview"]!.steps.find((s) => s.name === "Preview the members this pull request reaches")!;
+  expect(step.run).toContain("npx --no-install plywood ci run plan");
+  expect(step.run).toContain("--comment-targets");
+  expect(step.env!.CHANT_PREVIEW_COMMENT).toBe("${{ github.event.comment.body }}");
+  expect(step.run).not.toContain("comment.body");
+  const plan = doc.jobs.plan!.steps.find((s) => s.name === "Plan the members this pull request reaches")!;
+  expect(plan.run).not.toContain("--comment-targets");
+});

package/src/components/generate-pr-pipeline.respond.test.ts

@@ -0,0 +1,47 @@
+/**
+ * The pull request loop's responses, description check and merge on GitHub
+ * (#4629, #4636), as `chant build --pr-loop --respond --decide-backend
+ * --decide-model --merge auto` sets them: the note job asks the decide
+ * service, and the apply job carries CHANT_RESPOND and the merge.
+ */
+import { describe, expect, test } from "vitest";
+import { parseYAML } from "@intentius/chant/yaml";
+import type { DriverComponent } from "@intentius/chant/components/driver";
+import { generateGithubPipeline } from "./generate-pipeline";
+
+const ESTATE: DriverComponent[] = [{ name: "net", dependsOn: [], deploy: [{ phase: "Apply", steps: [{ kind: "terraform-apply", root: "net" }] }] }];
+
+type Step = { name?: string; run?: string; env?: Record<string, string> };
+type Doc = { jobs: Record<string, { steps: Step[] }> };
+const gen = (prLoop: Record<string, unknown>) => parseYAML(generateGithubPipeline(ESTATE, { env: "prod", prLoop }).yaml) as Doc;
+
+describe("responses and the merge on GitHub (#4629, #4636)", () => {
+  const doc = gen({
+    applyBeforeMerge: true,
+    applyMerge: { tokenEnv: "CHANT_MERGE_TOKEN", method: "squash" },
+    respond: { "wave-refused": "off", description: "check" },
+    decide: { backend: "review", model: "m-1" },
+  });
+
+  test("the note job carries the responses and asks the decide service", () => {
+    const post = doc.jobs["plan-note"]!.steps.at(-1)!;
+    expect(post.run).toMatch(/--decide-backend "review" --decide-model "m-1"$/);
+    expect(post.env!.CHANT_RESPOND).toBe("wave-refused=off,description=check");
+  });
+
+  test("the apply job carries the responses and the merge", () => {
+    const steps = Object.values(doc.jobs).flatMap((j) => j.steps);
+    const apply = steps.find((s) => s.run?.includes("--apply-before-merge"))!;
+    expect(apply.run).toContain("--merge auto --merge-token-env CHANT_MERGE_TOKEN --merge-method squash");
+    expect(apply.env!.CHANT_RESPOND).toBe("wave-refused=off,description=check");
+    expect(apply.env!.CHANT_MERGE_TOKEN).toBe("${{ secrets.CHANT_MERGE_TOKEN }}");
+  });
+
+  test("without them, neither job changes", () => {
+    const plain = gen({ applyBeforeMerge: true });
+    const post = plain.jobs["plan-note"]!.steps.at(-1)!;
+    expect(post.run).not.toContain("--decide-backend");
+    expect(post.env!.CHANT_RESPOND).toBeUndefined();
+    expect(JSON.stringify(plain)).not.toContain("--merge auto");
+  });
+});

package/src/components/generate-pr-pipeline.runners.test.ts

@@ -0,0 +1,61 @@
+/**
+ * The pull request loop's runners, variables and passed secrets on GitHub
+ * (#4625): every job on its stage's runner, and the jobs that plan or apply
+ * with the variables and the secrets mapped from the repository's. Written
+ * for the ci-products post-merge pass.
+ */
+
+import { describe, expect, test } from "vitest";
+import { parseYAML } from "@intentius/chant/yaml";
+import type { DriverComponent } from "@intentius/chant/components/driver";
+import { generateGithubPipeline } from "./generate-pipeline";
+
+const ESTATE: DriverComponent[] = [{ name: "net", dependsOn: [], deploy: [{ phase: "Apply", steps: [{ kind: "terraform-apply", root: "net" }] }] }];
+const WORDS = { product: "plywood", stages: { plan: "preview", apply: "up" }, commands: { preview: "plan" as const, lock: "lock" as const, unlock: "unlock" as const } };
+
+type Step = { name?: string; run?: string; env?: Record<string, string> };
+type Doc = { jobs: Record<string, { "runs-on": unknown; steps: Step[] }> };
+
+const doc = parseYAML(
+  generateGithubPipeline(ESTATE, {
+    env: "prod",
+    prLoop: {
+      words: WORDS,
+      previewComment: true,
+      locks: "plan",
+      applyOnMerge: true,
+      runners: { plan: ["self-hosted", "big"], apply: "deployer", default: "small" },
+      variables: { REGION: "eu-west-1" },
+      secrets: { DB_PASSWORD: "PROD_DB_PASSWORD" },
+      parallelism: 2,
+    },
+  }).yaml,
+) as Doc;
+
+describe("the GitHub pull request loop's runners and variables (#4625)", () => {
+  test("every job runs on its stage's runner", () => {
+    expect(doc.jobs.plan!["runs-on"]).toEqual(["self-hosted", "big"]);
+    expect(doc.jobs["comment-preview"]!["runs-on"]).toEqual(["self-hosted", "big"]);
+    expect(doc.jobs.apply!["runs-on"]).toBe("deployer");
+    expect(doc.jobs.record!["runs-on"]).toBe("deployer");
+    for (const name of ["plan-note", "comment-preview-note", "lock", "unlock", "comment-lock", "comment-unlock"]) expect(doc.jobs[name]!["runs-on"], name).toBe("small");
+  });
+
+  test("the plan step gets the variable and the secret, and still drops the forge tokens first", () => {
+    const step = doc.jobs.plan!.steps.find((s) => s.name === "Plan the members this pull request reaches")!;
+    expect(step.env).toMatchObject({ REGION: "eu-west-1", DB_PASSWORD: "${{ secrets.PROD_DB_PASSWORD }}" });
+    expect(step.env).not.toHaveProperty("GITHUB_TOKEN");
+    expect(step.run!.split("\n")[0]).toContain("unset");
+    expect(step.run).toContain("--parallelism 2");
+  });
+
+  test("the apply step gets them too", () => {
+    const step = doc.jobs.apply!.steps.find((s) => s.run?.includes("ci run apply"))!;
+    expect(step.env).toMatchObject({ REGION: "eu-west-1", DB_PASSWORD: "${{ secrets.PROD_DB_PASSWORD }}" });
+  });
+
+  test("without runners every job keeps the forge's default", () => {
+    const plain = parseYAML(generateGithubPipeline(ESTATE, { env: "prod", prLoop: {} }).yaml) as Doc;
+    expect(plain.jobs.plan!["runs-on"]).toBe("ubuntu-latest");
+  });
+});

package/src/components/generate-pr-pipeline.stale-notes.test.ts

@@ -0,0 +1,42 @@
+/**
+ * Stale marking on GitHub (#4628): with staleNotes the note job passes the
+ * target branch's commit, and a stale-notes job on a push to the branch
+ * runs `pr-post --stale` at the pushed commit with a token that may edit the
+ * notes and set the statuses. Written for the ci-products post-merge pass.
+ */
+import { describe, expect, test } from "vitest";
+import { parseYAML } from "@intentius/chant/yaml";
+import type { DriverComponent } from "@intentius/chant/components/driver";
+import { generateGithubPipeline } from "./generate-pipeline";
+
+const ESTATE: DriverComponent[] = [{ name: "net", dependsOn: [], deploy: [{ phase: "Apply", steps: [{ kind: "terraform-apply", root: "net" }] }] }];
+const WORDS = { product: "plywood", stages: { plan: "preview", apply: "up" }, commands: { preview: "plan" as const }, bin: "npx --no-install plywood" };
+
+type Step = { name?: string; run?: string; env?: Record<string, string>; uses?: string };
+type Doc = { jobs: Record<string, { if?: string; permissions?: Record<string, string>; steps: Step[] }> };
+const gen = (prLoop: Record<string, unknown>) => parseYAML(generateGithubPipeline(ESTATE, { env: "prod", prLoop }).yaml) as Doc;
+
+describe("stale notes on GitHub (#4628)", () => {
+  const doc = gen({ words: WORDS, staleNotes: true, previewComment: true });
+
+  test("the note job passes the target branch's commit", () => {
+    const post = doc.jobs["plan-note"]!.steps.at(-1)!;
+    expect(post.run).toContain('--tip "$TIP_SHA"');
+    expect(post.env!.TIP_SHA).toBe("${{ github.event.pull_request.base.sha }}");
+  });
+
+  test("a stale-notes job on a push marks the open notes stale, naming the preview comment", () => {
+    const job = doc.jobs["stale-notes"]!;
+    expect(job.if).toBe("github.event_name == 'push' && startsWith(github.ref, 'refs/heads/')");
+    expect(job.permissions).toEqual({ contents: "read", "pull-requests": "write", statuses: "write" });
+    const step = job.steps.at(-1)!;
+    expect(step.run).toBe('npx --no-install plywood components pr-post --stale --tip "$TIP_SHA" --env prod --forge github --preview-comment');
+    expect(step.env).toEqual({ TIP_SHA: "${{ github.sha }}", GITHUB_TOKEN: "${{ github.token }}" });
+  });
+
+  test("without staleNotes, no job and no tip", () => {
+    const plain = gen({ words: WORDS });
+    expect(plain.jobs["stale-notes"]).toBeUndefined();
+    expect(plain.jobs["plan-note"]!.steps.at(-1)!.run).not.toContain("--tip");
+  });
+});