@intentius/chant-lexicon-github 0.124.55 → 0.124.57

package/dist/components/generate-op-pipeline.d.ts

@@ -104,8 +104,8 @@ export interface GithubOpPipelineDoc {
     on: Record<string, unknown>;
     /** The `env:` mapping, when `options.variables` is set. */
     env?: Record<string, unknown>;
-    /** The `concurrency:` mapping — one run at a time per Op. */
-    concurrency: Record<string, unknown>;
+    /** The `concurrency:` mapping — one run at a time per Op. Absent on a waves file (ruling for ci-products 2026-10-28). */
+    concurrency?: Record<string, unknown>;
     /**
      * The `permissions:` mapping for this Op's finding-mode. GitHub-only:
      * Forgejo Actions ignores `permissions:` entirely, so the forgejo dialect

package/dist/components/generate-op-pipeline.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generate-op-pipeline.d.ts","sourceRoot":"","sources":["../../src/components/generate-op-pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsEG;AAGH,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAOhB,gBAAgB,EAIjB,MAAM,0BAA0B,CAAC;AAElC,OAAO,KAAK,EACV,wBAAwB,IAAI,uBAAuB,EAEnD,aAAa,EACb,gBAAgB,IAAI,sBAAsB,EAG1C,eAAe,EAChB,MAAM,0BAA0B,CAAC;AAOlC,YAAY,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,CAAC;AAIhE,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,CAAC;AAEjE;;;;;;GAMG;AACH,MAAM,WAAW,mBAAmB;IAClC;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5B,2DAA2D;IAC3D,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,6DAA6D;IAC7D,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC;;;;OAIG;IACH,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,8DAA8D;IAC9D,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC;;;;;;;;OAQG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACzC;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACxC;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,qFAAqF;AACrF,MAAM,WAAW,oBAAoB;IACnC,4FAA4F;IAC5F,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,mBAAmB,CAAC;CAC1B;AAuOD;;;;;;;;;;;GAWG;AACH,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,eAAe,EAAE,EACtB,OAAO,GAAE,uBAA4B,EACrC,KAAK,GAAE,QAAQ,GAAG,SAAoB,GACrC;IAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;IAAC,IAAI,EAAE,aAAa,EAAE,CAAA;CAAE,CAgL1D;AAwCD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,mBAAmB,GAAG,MAAM,CAMnE;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,eAAe,EAAE,EACtB,OAAO,GAAE,uBAA4B,GACpC,sBAAsB,CAMxB"}
+{"version":3,"file":"generate-op-pipeline.d.ts","sourceRoot":"","sources":["../../src/components/generate-op-pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsEG;AAGH,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAOhB,gBAAgB,EAIjB,MAAM,0BAA0B,CAAC;AAElC,OAAO,KAAK,EACV,wBAAwB,IAAI,uBAAuB,EAEnD,aAAa,EACb,gBAAgB,IAAI,sBAAsB,EAG1C,eAAe,EAChB,MAAM,0BAA0B,CAAC;AAUlC,YAAY,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,CAAC;AAIhE,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,CAAC;AAEjE;;;;;;GAMG;AACH,MAAM,WAAW,mBAAmB;IAClC;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5B,2DAA2D;IAC3D,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,yHAAyH;IACzH,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACtC;;;;OAIG;IACH,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,8DAA8D;IAC9D,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC;;;;;;;;OAQG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACzC;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACxC;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,qFAAqF;AACrF,MAAM,WAAW,oBAAoB;IACnC,4FAA4F;IAC5F,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,mBAAmB,CAAC;CAC1B;AAuOD;;;;;;;;;;;GAWG;AACH,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,eAAe,EAAE,EACtB,OAAO,GAAE,uBAA4B,EACrC,KAAK,GAAE,QAAQ,GAAG,SAAoB,GACrC;IAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;IAAC,IAAI,EAAE,aAAa,EAAE,CAAA;CAAE,CAuM1D;AAwCD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,mBAAmB,GAAG,MAAM,CAMnE;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,eAAe,EAAE,EACtB,OAAO,GAAE,uBAA4B,GACpC,sBAAsB,CAMxB"}

package/dist/components/generate-op-pipeline.js

@@ -77,6 +77,9 @@ import { assertReviewSplit, reviewJobs, reviewNoteJobName } from "./review-jobs.
 import { resolveAgentSpec } from "@intentius/chant/ci-agent";
 import { activeProductWords } from "@intentius/chant/ci-product-words";
 import { agentJobName, agentPushJobName, driftRunOutputs, driftRunStep, githubAgentJobs } from "./agent-jobs.js";
+import { assertScheduledOpCloud, scheduledOpUpdateJobName, withoutTokenRequestLine } from "@intentius/chant/scheduled-op-cloud";
+import { TRADE_SPEC_ENV, tradeLine } from "@intentius/chant/ci-identity";
+import { CHANT_EXIT } from "@intentius/chant/exit-codes";
 // The setup, environment and permission checks are shared with the Op waves
 // generator and the forgejo lexicon (#3765); they stay importable from here.
 export { assertEnvironment, assertSetupSteps, mergePermissions };
@@ -313,6 +316,8 @@ export function buildGithubOpPipelineDocs(ops, options = {}, forge = "github") {
     const jobs = [];
     const words = activeProductWords();
     for (const spec of ops) {
+        // #4631: the job's cloud identities and the update on drift, checked before anything renders.
+        assertScheduledOpCloud(spec);
         // #4616: the comment agent is a workflow of its own, on pull request comments; the spec's trigger is not read.
         if (spec.agent?.on === "comment") {
             const settings = resolveAgentSpec(spec.name, spec.agent, words.product);
@@ -364,6 +369,8 @@ export function buildGithubOpPipelineDocs(ops, options = {}, forge = "github") {
             throw new Error(`Scheduled Op "${spec.name}" sets a drift agent, which follows a drift check's run; give it a cron or pull_request trigger and no reviewAgent.`);
         }
         const stepEnv = split ? {} : jobTokenEnv(findingMode !== "report");
+        const cloud = spec.cloud;
+        const update = spec.update;
         const setup = spec.setup ?? [];
         assertSetupSteps(spec.name, setup);
         if (spec.environment)
@@ -376,13 +383,17 @@ export function buildGithubOpPipelineDocs(ops, options = {}, forge = "github") {
         const invocation = gated
             ? [...runParts, ...GATED_EXIT_FLAG, "--json"].join(" ")
             : runParts.join(" ");
-        const steps = [checkoutStep(), ...setup.map(setupStepDoc), ...runSteps(beforeScript)];
-        steps.push(gated
+        const later = [...setup.map(setupStepDoc), ...runSteps(beforeScript)];
+        later.push(gated
             ? gatedRunStep(RUN_STEP_ID, spec.name, invocation, stepEnv)
             : driftAgent
                 ? driftRunStep(invocation, stepEnv, forge)
-                : { run: invocation, env: stepEnv });
-        steps.push(...runSteps(extraScript));
+                : update
+                    ? driftFlagStep(invocation, stepEnv)
+                    : { run: invocation, env: stepEnv });
+        later.push(...runSteps(extraScript));
+        // #4631: the trade before the checkout, and every step after it without the token request variables.
+        const steps = cloud ? [tradeStep(cloud), checkoutStep(), ...later.map(withoutTokenRequest)] : [checkoutStep(), ...later];
         const review = split
             ? reviewJobs({
                 name: spec.name,
@@ -396,6 +407,7 @@ export function buildGithubOpPipelineDocs(ops, options = {}, forge = "github") {
                 ...(options.member ? { member: options.member } : {}),
             })
             : undefined;
+        const workflowPermissions = mergePermissions(spec.name, permissionsFor(findingMode, trigger), spec.permissions ?? {}, trigger);
         const doc = {
             name: spec.name,
             on: onTrigger(trigger),
@@ -403,7 +415,7 @@ export function buildGithubOpPipelineDocs(ops, options = {}, forge = "github") {
             // One run at a time per Op — a slow audit must not overlap its own next
             // scheduled trigger. A push Op's `build` (#4169) widens the group.
             concurrency: concurrency(opConcurrencyGroup(jobName, trigger)),
-            permissions: mergePermissions(spec.name, permissionsFor(findingMode, trigger), spec.permissions ?? {}, trigger),
+            permissions: workflowPermissions,
             jobsDoc: {
                 [jobName]: {
                     "runs-on": githubRunsOn(spec.runner),
@@ -418,6 +430,8 @@ export function buildGithubOpPipelineDocs(ops, options = {}, forge = "github") {
                     // behind the same reviewer would hold the message back until
                     // somebody had already acted.
                     ...(spec.environment ? { environment: environmentDoc(spec.environment) } : {}),
+                    // #4631: the trade needs id-token: write, on this job alone; the finding-mode's scopes stay as they are.
+                    ...(cloud ? { permissions: { ...workflowPermissions, "id-token": "write" } } : {}),
                     ...(gated
                         ? {
                             outputs: Object.fromEntries(["gated", "op", "gate", "approve"].map((name) => [
@@ -427,9 +441,21 @@ export function buildGithubOpPipelineDocs(ops, options = {}, forge = "github") {
                         }
                         : driftAgent
                             ? { outputs: driftRunOutputs(forge) }
-                            : {}),
+                            : update
+                                ? { outputs: { drift: `\${{ steps.${DRIFT_FLAG_STEP_ID}.outputs.drift }}` } }
+                                : {}),
                     steps,
                 },
+                ...(update
+                    ? {
+                        [scheduledOpUpdateJobName(jobName)]: updateJob(jobName, update, {
+                            image,
+                            ...(spec.runner !== undefined ? { runner: spec.runner } : {}),
+                            setup: setup.map(setupStepDoc),
+                            beforeScript,
+                        }),
+                    }
+                    : {}),
             },
             ...(gated ? { gatedNoticeDoc: { [`${jobName}-gate-notice`]: gateNoticeJob(jobName, image, spec.runner) } } : {}),
         };
@@ -487,14 +513,14 @@ function scopeOpFileToMember(file, member) {
             const { steps, ...rest } = props;
             return [job, { ...rest, defaults: { run: { "working-directory": member.dir } }, steps }];
         }));
-    const group = file.doc.concurrency.group;
+    const group = file.doc.concurrency?.group;
     return {
         name,
         doc: {
             ...file.doc,
             ...(file.doc.name ? { name: `${member.name}/${file.doc.name}` } : {}),
             on,
-            concurrency: { ...file.doc.concurrency, ...(typeof group === "string" ? { group: `${member.name}-${group}` } : {}) },
+            ...(file.doc.concurrency ? { concurrency: { ...file.doc.concurrency, ...(typeof group === "string" ? { group: `${member.name}-${group}` } : {}) } } : {}),
             jobsDoc,
         },
     };
@@ -524,3 +550,42 @@ export function generateGithubOpPipeline(ops, options = {}) {
         jobs,
     };
 }
+/** The id of the run step that says whether an update's drift check found drift (#4631). */
+const DRIFT_FLAG_STEP_ID = "drift-check";
+/** The Op's run step when an update follows it (#4631): `drift=true` as an output on chant's drift code, and the run's own exit code. */
+function driftFlagStep(invocation, env) {
+    return {
+        id: DRIFT_FLAG_STEP_ID,
+        env,
+        run: ["set +e", invocation, "code=$?", `if [ "$code" -eq ${CHANT_EXIT.drift} ]; then echo "drift=true" >>"$GITHUB_OUTPUT"; fi`, 'exit "$code"'].join("\n"),
+    };
+}
+/** The trade step (#4631), as an op wave job's (#4332): the job's OIDC token for `cloud`, written to GITHUB_ENV. */
+function tradeStep(cloud) {
+    return { name: "Trade the job's OIDC token for its cloud identities", env: { [TRADE_SPEC_ENV]: JSON.stringify(cloud) }, run: tradeLine("$GITHUB_ENV", "github-env") };
+}
+/** A run step after the trade, with the token request variables unset first. A `uses:` step is left as it is. */
+function withoutTokenRequest(step) {
+    return typeof step.run === "string" ? { ...step, run: withoutTokenRequestLine(step.run) } : step;
+}
+/**
+ * The update job (#4631): after the Op's job, only when its run found
+ * drift; its own trade for `update.cloud` before its checkout, then the
+ * update's command. Its permissions are `contents: read`, `id-token: write`
+ * with a cloud, and the update's own scopes, which may raise `contents` to
+ * `write` so the update records on `chant/lifecycle` (2026-10-28 ruling).
+ * The Op's own job keeps its scopes.
+ */
+function updateJob(after, update, i) {
+    const later = [...i.setup, ...runSteps(i.beforeScript), { name: "Update what drifted", run: update.command }];
+    return {
+        needs: after,
+        if: `always() && needs.${after}.outputs.drift == 'true'`,
+        "runs-on": githubRunsOn(i.runner),
+        container: i.image,
+        permissions: { contents: "read", ...(update.cloud ? { "id-token": "write" } : {}), ...(update.permissions ?? {}) },
+        ...nonEmpty("env", update.variables),
+        ...(update.environment ? { environment: environmentDoc(update.environment) } : {}),
+        steps: update.cloud ? [tradeStep(update.cloud), checkoutStep(), ...later.map(withoutTokenRequest)] : [checkoutStep(), ...later],
+    };
+}

package/dist/components/generate-op-waves-pipeline.d.ts

@@ -1,8 +1,8 @@
 /**
  * Op waves → GitHub Actions workflow (#3679).
  *
- * One workflow for the whole spec, on a push to its branches (and by hand),
- * one run at a time. Each job is one of core's `opWaveJobs`: a wave, or a wide
+ * One workflow for the whole spec, on a push to its branches (and by hand).
+ * Each job is one of core's `opWaveJobs`: a wave, or a wide
  * wave's deciding job and share jobs, chained by `needs:`. Re-running the
  * failed jobs after `chant approve` carries on from that wave.
  *
@@ -34,6 +34,8 @@
  * `pull-requests: read`, so a wave can read the merged pull request's
  * reviews, and a second workflow, `<name>-plans.yml`, runs `chant run wave
  * --record-plans` on each pull request to record the digests its head plans.
+ * A `pull-request` wave (#4630) gets the plans workflow too, for the approval
+ * status before merge; it asks for no `pull-requests: read` on the waves.
  *
  * With `notify` on the spec (#3761), the workflow maps each variable it names
  * from the repository secret of the same name, so a wave job can post to
@@ -62,6 +64,15 @@
  * step holds the control token: the `tokenSecret` secret, mapped into
  * `CHANT_CONTROL_TOKEN` and handed to curl on its stdin
  * (`controlDispatchScript`, #4568).
+ *
+ * Every wave, deciding and share job starts with the apply-job guard
+ * (#4624, `@intentius/chant/ci-job-guard`), before the trade and the
+ * checkout: it stops the job unless `GITHUB_REF` is one of the spec's
+ * branches, the job runs in its forge environment (read from an OIDC
+ * token's claims, so only in a job that may request one), and, for a
+ * runner whose labels include `self-hosted`, on a self-hosted runner. The
+ * forgejo generator passes `forge: "forgejo"`, which checks the ref and
+ * runner only.
  */
 import { type OpWavesSpec } from "@intentius/chant/op/op-waves";
 import type { OpWavesPipelineOptions, OpWavesPipelineResult } from "@intentius/chant/lexicon";
@@ -73,7 +84,9 @@ export declare function opWaveRecordArtifact(spec: Pick<OpWavesSpec, "name">, wa
 /** The artifact a job keeps its outcome file in (#4322). */
 export declare function opWaveOutcomeArtifact(spec: Pick<OpWavesSpec, "name">, jobName: string): string;
 /** The workflow document, before emission, and the jobs it holds. */
-export declare function buildGithubOpWavesDoc(spec: OpWavesSpec, options: OpWavesPipelineOptions): {
+export declare function buildGithubOpWavesDoc(spec: OpWavesSpec, options: OpWavesPipelineOptions, dialect?: {
+    forge?: "github" | "forgejo";
+}): {
     doc: GithubOpPipelineDoc;
     jobs: OpWavesPipelineResult["jobs"];
     resumeDoc?: GithubOpPipelineDoc;

package/dist/components/generate-op-waves-pipeline.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generate-op-waves-pipeline.d.ts","sourceRoot":"","sources":["../../src/components/generate-op-waves-pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgEG;AAEH,OAAO,EAUL,KAAK,WAAW,EACjB,MAAM,8BAA8B,CAAC;AAEtC,OAAO,KAAK,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAiB9F,OAAO,EAAsB,KAAK,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAEtF,yFAAyF;AACzF,eAAO,MAAM,cAAc,YAAW,CAAC;AAEvC,oEAAoE;AACpE,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAE1F;AAED,4DAA4D;AAC5D,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAE9F;AAED,qEAAqE;AACrE,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,WAAW,EACjB,OAAO,EAAE,sBAAsB,GAC9B;IAAE,GAAG,EAAE,mBAAmB,CAAC;IAAC,IAAI,EAAE,qBAAqB,CAAC,MAAM,CAAC,CAAC;IAAC,SAAS,CAAC,EAAE,mBAAmB,CAAC;IAAC,QAAQ,CAAC,EAAE,mBAAmB,CAAA;CAAE,CA6EpI;AAkGD,4EAA4E;AAC5E,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,sBAAsB,GAAG,qBAAqB,CAMvH"}
+{"version":3,"file":"generate-op-waves-pipeline.d.ts","sourceRoot":"","sources":["../../src/components/generate-op-waves-pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2EG;AAEH,OAAO,EAaL,KAAK,WAAW,EACjB,MAAM,8BAA8B,CAAC;AAEtC,OAAO,KAAK,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAmB9F,OAAO,EAAsB,KAAK,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAEtF,yFAAyF;AACzF,eAAO,MAAM,cAAc,YAAW,CAAC;AAEvC,oEAAoE;AACpE,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAE1F;AAED,4DAA4D;AAC5D,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAE9F;AAED,qEAAqE;AACrE,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,WAAW,EACjB,OAAO,EAAE,sBAAsB,EAC/B,OAAO,GAAE;IAAE,KAAK,CAAC,EAAE,QAAQ,GAAG,SAAS,CAAA;CAAO,GAC7C;IAAE,GAAG,EAAE,mBAAmB,CAAC;IAAC,IAAI,EAAE,qBAAqB,CAAC,MAAM,CAAC,CAAC;IAAC,SAAS,CAAC,EAAE,mBAAmB,CAAC;IAAC,QAAQ,CAAC,EAAE,mBAAmB,CAAA;CAAE,CAgGpI;AAoID,4EAA4E;AAC5E,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,sBAAsB,GAAG,qBAAqB,CAMvH"}

package/dist/components/generate-op-waves-pipeline.js

@@ -1,8 +1,8 @@
 /**
  * Op waves → GitHub Actions workflow (#3679).
  *
- * One workflow for the whole spec, on a push to its branches (and by hand),
- * one run at a time. Each job is one of core's `opWaveJobs`: a wave, or a wide
+ * One workflow for the whole spec, on a push to its branches (and by hand).
+ * Each job is one of core's `opWaveJobs`: a wave, or a wide
  * wave's deciding job and share jobs, chained by `needs:`. Re-running the
  * failed jobs after `chant approve` carries on from that wave.
  *
@@ -34,6 +34,8 @@
  * `pull-requests: read`, so a wave can read the merged pull request's
  * reviews, and a second workflow, `<name>-plans.yml`, runs `chant run wave
  * --record-plans` on each pull request to record the digests its head plans.
+ * A `pull-request` wave (#4630) gets the plans workflow too, for the approval
+ * status before merge; it asks for no `pull-requests: read` on the waves.
  *
  * With `notify` on the spec (#3761), the workflow maps each variable it names
  * from the repository secret of the same name, so a wave job can post to
@@ -62,11 +64,22 @@
  * step holds the control token: the `tokenSecret` secret, mapped into
  * `CHANT_CONTROL_TOKEN` and handed to curl on its stdin
  * (`controlDispatchScript`, #4568).
+ *
+ * Every wave, deciding and share job starts with the apply-job guard
+ * (#4624, `@intentius/chant/ci-job-guard`), before the trade and the
+ * checkout: it stops the job unless `GITHUB_REF` is one of the spec's
+ * branches, the job runs in its forge environment (read from an OIDC
+ * token's claims, so only in a job that may request one), and, for a
+ * runner whose labels include `self-hosted`, on a self-hosted runner. The
+ * forgejo generator passes `forge: "forgejo"`, which checks the ref and
+ * runner only.
  */
-import { notifyVariables, opWaveGroupOf, opWaveJobs, opWaveOutcomeDir, opWavesControlTarget, opWavesLastJobs, opWavesOutcomeCommand, opWavesRecordPlansCommand, opWavesResumeCommand, } from "@intentius/chant/op/op-waves";
+import { notifyVariables, opWaveGroupOf, opWaveJobs, opWaveJobTimeout, opWaveOutcomeDir, opWavesControlTarget, opWavesLastJobs, opWavesApprovalStatusCommand, opWavesPostsApprovalStatus, opWavesOutcomeCommand, opWavesRecordPlansCommand, opWavesResumeCommand, } from "@intentius/chant/op/op-waves";
 import { CONTROL_OUTCOME_VAR, controlDispatchJob } from "@intentius/chant/control/dispatch";
 import { assertEnvironment, assertSetupSteps, CI_IMAGE, dirnameOf, environmentDoc, GITHUB_JOB_TOKEN, githubRunsOn, githubSecretEnv, idTokenAudienceEnv, nonEmpty, pushBranches, setupStepDoc, } from "@intentius/chant/ci-jobs";
 import { OIDC_REQUEST_VARS, TRADE_SPEC_ENV, tradeLine } from "@intentius/chant/ci-identity";
+import { JOB_GUARD_ENV, jobGuardLine, jobGuardSpec, opWaveJobLabel } from "@intentius/chant/ci-job-guard";
+import { resolveProductWords } from "@intentius/chant/ci-product-words";
 import { checkoutStep, concurrency, DOWNLOAD_ARTIFACT, downloadArtifactStep, keepRecordStep, runSteps } from "./ci-jobs.js";
 import { emitOpPipelineYAML } from "./generate-op-pipeline.js";
 /** The default image: it carries git, which the runner needs to read the base commit. */
@@ -80,10 +93,14 @@ export function opWaveOutcomeArtifact(spec, jobName) {
     return `${spec.name}-${jobName}-outcome`;
 }
 /** The workflow document, before emission, and the jobs it holds. */
-export function buildGithubOpWavesDoc(spec, options) {
+export function buildGithubOpWavesDoc(spec, options, dialect = {}) {
     const jobs = opWaveJobs(spec, options.specFile, { bin: options.bin });
+    const forge = dialect.forge ?? "github";
+    const product = resolveProductWords(options.words ?? {}).product;
     const image = options.image ?? OP_WAVES_IMAGE;
     const byReview = spec.waves.some((w) => w.approval === "pr-review");
+    // #4630: a pr-review or pull-request wave gets the plans workflow and its approval status.
+    const statusBeforeMerge = opWavesPostsApprovalStatus(spec);
     for (const wave of spec.waves) {
         assertSetupSteps(`${spec.name}/${wave.name}`, wave.setup ?? []);
         if (wave.environment)
@@ -95,6 +112,8 @@ export function buildGithubOpWavesDoc(spec, options) {
         }
     }
     const permissions = { contents: "write", ...(byReview ? { "pull-requests": "read" } : {}) };
+    // The ruling for ci-products (2026-10-28): every wave job carries its timeout and the lock wait under it.
+    const timeout = opWaveJobTimeout(options.jobTimeoutMinutes);
     const jobsDoc = {};
     for (const job of jobs) {
         const wave = spec.waves[job.wave - 1];
@@ -102,7 +121,21 @@ export function buildGithubOpWavesDoc(spec, options) {
         const group = opWaveGroupOf(spec, job);
         // #4332: the job's cloud identities, traded before the checkout.
         const cloud = group?.cloud ?? wave.cloud;
-        const steps = [...(cloud ? [tradeStep(cloud)] : []), checkoutStep(true)];
+        const environment = group?.environment ?? wave.environment;
+        const idTokens = group?.idTokens ?? wave.idTokens;
+        const idToken = idTokens !== undefined || cloud !== undefined;
+        const runner = group?.runner ?? wave.runner ?? spec.runner;
+        // #4624: the guard first, before the trade and the checkout.
+        const guard = guardStep({
+            forge,
+            job: opWaveJobLabel(spec.name, job),
+            product,
+            ...(environment && forge === "github" ? { environment: environment.name } : {}),
+            branches: pushBranches(spec.branches),
+            ...(runner !== undefined ? { runner } : {}),
+            idToken,
+        });
+        const steps = [guard, ...(cloud ? [tradeStep(cloud)] : []), checkoutStep(true)];
         if (job.kind === "share") {
             steps.push(downloadArtifactStep(`Download wave ${job.wave}'s decision`, opWaveRecordArtifact(spec, job.wave), dirnameOf(job.record)));
         }
@@ -119,11 +152,8 @@ export function buildGithubOpWavesDoc(spec, options) {
             steps.push(keepRecordStep(`Keep wave ${job.wave}'s decision`, opWaveRecordArtifact(spec, job.wave), job.record));
         }
         steps.push(keepRecordStep(`Keep the job's outcome`, opWaveOutcomeArtifact(spec, job.jobName), job.outcome));
-        const environment = group?.environment ?? wave.environment;
-        const idTokens = group?.idTokens ?? wave.idTokens;
-        const idToken = idTokens !== undefined || cloud !== undefined;
         jobsDoc[job.jobName] = {
-            "runs-on": githubRunsOn(group?.runner ?? wave.runner ?? spec.runner),
+            "runs-on": githubRunsOn(runner),
             ...(job.needs.length > 0 ? { needs: job.needs } : {}),
             // #4322: a wave's jobs run after a failure in the wave before; a share job runs only on its deciding job's success.
             ...(job.needs.length > 0 && job.kind !== "share" ? { if: "!cancelled()" } : {}),
@@ -131,7 +161,8 @@ export function buildGithubOpWavesDoc(spec, options) {
             ...(environment ? { environment: environmentDoc(environment) } : {}),
             // #3914: a job's own permissions replace the workflow's, so they repeat them.
             ...(idToken ? { permissions: { ...permissions, "id-token": "write" } } : {}),
-            ...nonEmpty("env", group || idTokens ? { ...wave.variables, ...group?.variables, ...idTokenAudienceEnv(idTokens) } : wave.variables),
+            "timeout-minutes": timeout.minutes,
+            env: { ...timeout.env, ...(group || idTokens ? { ...wave.variables, ...group?.variables, ...idTokenAudienceEnv(idTokens) } : wave.variables) },
             steps,
         };
     }
@@ -146,7 +177,8 @@ export function buildGithubOpWavesDoc(spec, options) {
         name: spec.name,
         on: { push: { branches: pushBranches(spec.branches) }, workflow_dispatch: {} },
         ...nonEmpty("env", env),
-        concurrency: concurrency(spec.name),
+        // The ruling for ci-products (2026-10-28): no workflow-level concurrency group. Runs on the target and repo grains wait for
+        // their rows on chant's ledger, oldest commit first; plunge stacks on the resource grain lease their resource rows and run.
         permissions,
         jobsDoc,
     };
@@ -154,7 +186,7 @@ export function buildGithubOpWavesDoc(spec, options) {
         doc,
         jobs,
         ...(spec.resume ? { resumeDoc: buildResumeDoc(spec, options) } : {}),
-        ...(byReview ? { plansDoc: buildPlansDoc(spec, options) } : {}),
+        ...(statusBeforeMerge ? { plansDoc: buildPlansDoc(spec, options, forge) } : {}),
     };
 }
 /**
@@ -213,20 +245,53 @@ function buildResumeDoc(spec, options) {
         jobsDoc: { resume: { "runs-on": githubRunsOn(spec.runner), container: options.image ?? OP_WAVES_IMAGE, steps } },
     };
 }
-/** The pull request workflow a `pr-review` wave needs (#3684): record the digests each head plans. */
-function buildPlansDoc(spec, options) {
+/**
+ * The pull request workflow a `pr-review` wave needs (#3684): record the
+ * digests each head plans. The `approval-status` job after it (#4630) posts
+ * `<product>/approval` on the head, and runs alone on each review submitted
+ * or dismissed. It holds a read token that may write statuses and nothing
+ * else. A `pull-request` wave gets the same workflow: the record keeps its
+ * change set, and the status reads the pull request's own approval of it.
+ */
+function buildPlansDoc(spec, options, forge) {
     const steps = [checkoutStep(true), ...(spec.waves[0]?.setup ?? []).map(setupStepDoc), ...runSteps(options.beforeScript ?? [])];
     steps.push({ name: "Plan every wave at the head and record its digests", run: opWavesRecordPlansCommand(options.specFile, options.bin).join(" ") });
+    const statusSteps = [checkoutStep(true), ...runSteps(options.beforeScript ?? [])];
+    statusSteps.push({
+        name: "Post the approval status on the head",
+        run: opWavesApprovalStatusCommand(options.specFile, forge, options.bin).join(" "),
+        env: {
+            GITHUB_TOKEN: GITHUB_JOB_TOKEN,
+            PR_NUMBER: "${{ github.event.pull_request.number }}",
+            HEAD_SHA: "${{ github.event.pull_request.head.sha }}",
+            BASE_SHA: "${{ github.event.pull_request.base.sha }}",
+        },
+    });
     return {
         name: `${spec.name}-plans`,
-        on: { pull_request: { branches: pushBranches(spec.branches) } },
+        on: { pull_request: { branches: pushBranches(spec.branches) }, pull_request_review: { types: ["submitted", "dismissed"] } },
         ...nonEmpty("env", options.variables),
-        concurrency: concurrency(spec.name + "-plans-${{ github.event.number }}", true),
+        concurrency: concurrency(spec.name + "-plans-${{ github.event_name }}-${{ github.event.pull_request.number }}", true),
         // contents: write pushes the record to chant/lifecycle.
         permissions: { contents: "write" },
-        jobsDoc: { "record-plans": { "runs-on": githubRunsOn(spec.runner), container: options.image ?? OP_WAVES_IMAGE, steps } },
+        jobsDoc: {
+            "record-plans": { if: "github.event_name == 'pull_request'", "runs-on": githubRunsOn(spec.runner), container: options.image ?? OP_WAVES_IMAGE, steps },
+            "approval-status": {
+                needs: ["record-plans"],
+                // On a review the record-plans job is skipped, and the status reads the plans an earlier push recorded.
+                if: "${{ always() && (needs.record-plans.result == 'success' || needs.record-plans.result == 'skipped') }}",
+                "runs-on": githubRunsOn(spec.runner),
+                container: options.image ?? OP_WAVES_IMAGE,
+                permissions: { contents: "read", "pull-requests": "read", statuses: "write" },
+                steps: statusSteps,
+            },
+        },
     };
 }
+/** The apply-job guard step (#4624): the job's expectation in CHANT_JOB_GUARD, checked by `node -e` from `/`. */
+function guardStep(input) {
+    return { name: "Check the job runs where the spec set it to run", env: { [JOB_GUARD_ENV]: JSON.stringify(jobGuardSpec(input)) }, run: jobGuardLine() };
+}
 /** The step that trades the job's OIDC token for `cloud` (#4332), writing the credentials to GITHUB_ENV. */
 function tradeStep(cloud) {
     return { name: "Trade the job's OIDC token for its cloud identities", env: { [TRADE_SPEC_ENV]: JSON.stringify(cloud) }, run: tradeLine("$GITHUB_ENV", "github-env") };

package/dist/components/generate-pipeline.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generate-pipeline.d.ts","sourceRoot":"","sources":["../../src/components/generate-pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AAEH,OAAO,EAAyB,KAAK,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAuCjG,OAAO,KAAK,EACV,oBAAoB,IAAI,YAAY,EACpC,wBAAwB,IAAI,qBAAqB,EACjD,uBAAuB,IAAI,oBAAoB,EAEhD,MAAM,0BAA0B,CAAC;AAGlC,YAAY,EAAE,YAAY,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,CAAC;AAE1E;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;;;OAKG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,6FAA6F;IAC7F,WAAW,EAAE,MAAM,CAAC;IACpB,8DAA8D;IAC9D,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5B,mIAAmI;IACnI,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC;;;;;;OAMG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,qDAAqD;IACrD,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,uEAAuE;IACvE,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,0DAA0D;IAC1D,IAAI,EAAE,YAAY,EAAE,CAAC;CACtB;AAsmBD;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,CAWpD;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,eAAe,EAAE,EAC7B,OAAO,GAAE,qBAA0B,GAClC,iBAAiB,CA+JnB;AA4CD;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,iBAAiB,GAAG,MAAM,CAE/D;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,eAAe,EAAE,EAC7B,OAAO,GAAE,qBAA0B,GAClC,oBAAoB,CAGtB"}
+{"version":3,"file":"generate-pipeline.d.ts","sourceRoot":"","sources":["../../src/components/generate-pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AAEH,OAAO,EAAyB,KAAK,eAAe,EAAE,MAAM,oCAAoC,CAAC;AA2CjG,OAAO,KAAK,EACV,oBAAoB,IAAI,YAAY,EACpC,wBAAwB,IAAI,qBAAqB,EACjD,uBAAuB,IAAI,oBAAoB,EAEhD,MAAM,0BAA0B,CAAC;AAGlC,YAAY,EAAE,YAAY,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,CAAC;AAE1E;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;;;OAKG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,6FAA6F;IAC7F,WAAW,EAAE,MAAM,CAAC;IACpB,8DAA8D;IAC9D,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5B,mIAAmI;IACnI,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC;;;;;;OAMG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,qDAAqD;IACrD,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,uEAAuE;IACvE,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,0DAA0D;IAC1D,IAAI,EAAE,YAAY,EAAE,CAAC;CACtB;AAkoBD;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,CAWpD;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,eAAe,EAAE,EAC7B,OAAO,GAAE,qBAA0B,GAClC,iBAAiB,CA+JnB;AA4CD;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,iBAAiB,GAAG,MAAM,CAE/D;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,eAAe,EAAE,EAC7B,OAAO,GAAE,qBAA0B,GAClC,oBAAoB,CAGtB"}

package/dist/components/generate-pipeline.js

@@ -58,10 +58,10 @@
 import { resolveComponentGraph } from "@intentius/chant/components/driver";
 import { hasPublishStep, promoteArchivePaths } from "@intentius/chant/components/promote";
 import { GATED_WAVE_RECORD, gatedWaveJobs } from "@intentius/chant/components/gated-wave-pipeline";
-import { CI_IMAGE, ciJobName, dirnameOf, fillCommand, GITHUB_JOB_TOKEN, GITHUB_RUNNER } from "@intentius/chant/ci-jobs";
+import { CI_IMAGE, ciJobName, dirnameOf, fillCommand, GITHUB_JOB_TOKEN, GITHUB_RUNNER, githubRunsOn } from "@intentius/chant/ci-jobs";
 import { CHECKOUT_TOKEN_ENV, checkoutScript, dropForgeTokens, handoverOutputs, handoverTrap, takeOverScript } from "@intentius/chant/ci-handover";
 import { OIDC_REQUEST_VARS, TRADE_SPEC_ENV, tradeLine } from "@intentius/chant/ci-identity";
-import { prApplyComment, GREEN_TAG_PATTERN, GREEN_TICK_WORKFLOW, PR_APPLY_RECORD, PR_LOOP_REPORT_DIR, prApplyGroup, prRecordGroup, prApplyRecordKey, prApplyWaveJobName, prLoopJobs, prLoopPostJob, prLoopSetup, PR_PLAN_NOTE_JOB, PR_LOCK_JOB, PR_UNLOCK_JOB, PR_UNLOCK_COMMAND, prLockCommand, prCommentLockJobs, prCommentPreviewJob, PREVIEW_REF_ENV, PREVIEW_HEAD_OUTPUT, prLoopWaveJobs, prLoopWithWaves, prEnvJobs, PR_ENV_REPORT_DIR, PR_ENV_SWEEP_CRON, PR_ENV_POST_JOB, } from "@intentius/chant/components/pr-pipeline";
+import { prApplyComment, GREEN_TAG_PATTERN, GREEN_TICK_WORKFLOW, PR_APPLY_RECORD, PR_LOOP_REPORT_DIR, prApplyGroup, prRecordGroup, prApplyRecordKey, prApplyWaveJobName, prLoopJobs, prLoopPostJob, prLoopSetup, PR_PLAN_NOTE_JOB, PR_LOCK_JOB, PR_UNLOCK_JOB, prUnlockCommand, prLockCommand, prCommentLockJobs, prCommentPreviewJob, PREVIEW_REF_ENV, PREVIEW_HEAD_OUTPUT, prLoopWaveJobs, prLoopWithWaves, prEnvJobs, prLoopJobStage, prStaleJob, PR_STALE_JOB, prLoopRunner, PR_ENV_REPORT_DIR, PR_ENV_SWEEP_CRON, PR_ENV_POST_JOB, } from "@intentius/chant/components/pr-pipeline";
 import { forgejoRepoLockLines, REPO_APPLY_GROUP } from "@intentius/chant/components/repo-lock";
 import { memberRepoPath } from "@intentius/chant/lexicon";
 import { productStatusContext, resolveProductWords } from "@intentius/chant/ci-product-words";
@@ -322,7 +322,25 @@ function prLoopGithubDoc(components, env, image, beforeScript, extraScript, opti
             },
         ]);
     }
-    const post = prLoopPostJob(forgeName, env, member?.name, loop.words ? resolveProductWords(loop.words) : undefined);
+    const post = prLoopPostJob(forgeName, env, member?.name, loop.words ? resolveProductWords(loop.words) : undefined, { ...(loop.staleNotes ? { staleNotes: true } : {}), ...(loop.respond ? { respond: loop.respond } : {}), ...(loop.decide ? { decide: loop.decide } : {}) });
+    // #4628: on a push to the target branch, the open pull requests' notes posted against another commit are marked stale.
+    const stale = prStaleJob(forgeName, env, loop, member?.name);
+    const staleJobs = stale
+        ? {
+            [PR_STALE_JOB]: {
+                if: "github.event_name == 'push' && startsWith(github.ref, 'refs/heads/')",
+                "runs-on": GITHUB_RUNNER,
+                container: image,
+                permissions: { contents: "read", "pull-requests": "write", statuses: "write" },
+                steps: [
+                    // The pushed commit: the target branch's, so none of a pull request's code is here.
+                    { name: "Check out the target branch's commit", uses: CHECKOUT },
+                    ...runSteps(beforeScript),
+                    { name: "Mark the open pull requests' notes stale", ...(rooted ? {} : { "working-directory": "." }), env: stale.env, run: stale.command },
+                ],
+            },
+        }
+        : {};
     // #4619: with a control repo named, the note job reads its chant/lifecycle, read-only, so pr-post marks the cross-stack edges.
     const controlRead = loop.control ? controlNoteCheckout(forgeName, loop.control.target, loop.words ?? {}) : undefined;
     const noteSteps = [
@@ -338,6 +356,8 @@ function prLoopGithubDoc(components, env, image, beforeScript, extraScript, opti
     const prEnv = loop.prEnvironment ? prEnvGithubJobs(loop.forge ?? "github", image, beforeScript, extraScript, loop, member) : undefined;
     // #4327: with ci.locks: plan the pull_request trigger fires on close too, for the unlock job, and the plan skips that event.
     const locks = loop.locks === "plan";
+    // plywood#22: the lock lines run through the product's bin, as its other job lines do.
+    const lockBin = resolveProductWords(loop.words).bin;
     const closes = Boolean(prEnv) || locks;
     const lockJobs = locks
         ? {
@@ -356,7 +376,7 @@ function prLoopGithubDoc(components, env, image, beforeScript, extraScript, opti
                     {
                         name: "Lock the components the plan selected",
                         env: { PR_NUMBER: "${{ github.event.pull_request.number }}", HEAD_SHA: "${{ github.event.pull_request.head.sha }}", GITHUB_TOKEN: GITHUB_JOB_TOKEN },
-                        run: prLockCommand(forgeName),
+                        run: prLockCommand(forgeName, lockBin),
                     },
                 ],
             },
@@ -368,7 +388,7 @@ function prLoopGithubDoc(components, env, image, beforeScript, extraScript, opti
                 steps: [
                     { name: "Check out the target branch's commit", uses: CHECKOUT, with: { ref: "${{ github.event.pull_request.base.sha }}", "fetch-depth": 0 } },
                     ...runSteps(beforeScript),
-                    { name: "Release the pull request's locks", env: { PR_NUMBER: "${{ github.event.pull_request.number }}" }, run: PR_UNLOCK_COMMAND },
+                    { name: "Release the pull request's locks", env: { PR_NUMBER: "${{ github.event.pull_request.number }}" }, run: prUnlockCommand(lockBin) },
                 ],
             },
         }
@@ -468,6 +488,7 @@ function prLoopGithubDoc(components, env, image, beforeScript, extraScript, opti
         ...lockJobs,
         ...commentLockJobs,
         ...previewJobs,
+        ...staleJobs,
         ...Object.fromEntries(applyJobs),
         ...Object.fromEntries(controlJobs),
         ...(prEnv ? prEnv.jobs : {}),
@@ -487,6 +508,12 @@ function prLoopGithubDoc(components, env, image, beforeScript, extraScript, opti
     // #4301: a /chant apply comment starts the apply before merge. #4588: and a lock or unlock comment its job.
     if (loop.applyBeforeMerge || commentLocks.length > 0 || preview)
         on.issue_comment = { types: ["created"] };
+    // #4625: each job on its stage's runner, the plan side's, the apply side's, or the default.
+    if (loop.runners) {
+        for (const [name, job] of Object.entries(jobsDoc)) {
+            job["runs-on"] = githubRunsOn(prLoopRunner(loop, prLoopJobStage(name)));
+        }
+    }
     return {
         name: member ? `chant-pr.${member.name}.${env}` : `chant-pr-${env}`,
         environment: env,
@@ -494,10 +521,11 @@ function prLoopGithubDoc(components, env, image, beforeScript, extraScript, opti
         ...(rooted ? {} : { defaults: { run: { "working-directory": member.dir } } }),
         env: { ...options.variables, CHANT_ENV: env },
         jobsDoc,
-        stages: ["plan", PR_PLAN_NOTE_JOB, ...(locks ? [PR_LOCK_JOB, PR_UNLOCK_JOB] : []), ...commentLocks.map((j) => j.jobName), ...(preview ? [preview.jobName, preview.noteJobName] : []), ...applyNames, ...controlJobs.map(([name]) => name), ...(prEnv ? ["env-up", PR_ENV_POST_JOB, "env-down", "env-sweep"] : [])],
+        stages: ["plan", PR_PLAN_NOTE_JOB, ...(locks ? [PR_LOCK_JOB, PR_UNLOCK_JOB] : []), ...commentLocks.map((j) => j.jobName), ...(preview ? [preview.jobName, preview.noteJobName] : []), ...(stale ? [PR_STALE_JOB] : []), ...applyNames, ...controlJobs.map(([name]) => name), ...(prEnv ? ["env-up", PR_ENV_POST_JOB, "env-down", "env-sweep"] : [])],
         jobs: [
             { jobName: "plan", component: "pull request plan", stage: "plan", needs: [] },
             { jobName: PR_PLAN_NOTE_JOB, component: "pull request plan note", stage: PR_PLAN_NOTE_JOB, needs: ["plan"] },
+            ...(stale ? [{ jobName: PR_STALE_JOB, component: "pull request stale notes", stage: PR_STALE_JOB, needs: [] }] : []),
             ...(locks
                 ? [
                     { jobName: PR_LOCK_JOB, component: "pull request lock", stage: PR_LOCK_JOB, needs: ["plan"] },

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "3513bb8a86e9d8cf394877a70b42741598681301a7c892fa94a65856cd1742ac",
+    "manifest.json": "eab8cbe3ae719023202bcc5ffdbbbd5ca8dd0d263d22ca405024ff9991cf07b6",
     "meta.json": "c50e0ef3845c370c3ad2210b8bba455980417c0f818aa6ed46e06d4fb8b1b9f9",
     "types/index.d.ts": "0ead95536e947ddfb98a5acf0ddb88547913b5a53a342df67711c59266f84b3e",
     "rules/deprecated-action-version.ts": "a9ba7cc924ff1c7055110416d8989273690415bfb5e8dcc32dc9431b9351f5ca",
@@ -78,5 +78,5 @@
     "skills/chant-github-patterns.md": "bb3abef289a8fdfcf07d6bb2d7289dcb2f38bc0cb0321ea320b78b45a6f548c0",
     "skills/chant-github-security.md": "aab111cb0871cad30281ce48d7da23663689619351029219e2be019a1a61e394"
   },
-  "composite": "d2ef289d1dabdd39c05090b1dc9e881fa69fd0934c0cb3a197d8ca9abb4f5a45"
+  "composite": "c581b6a6d25abd873cb8aba19d5ccd648c178312acdbdac07a30900b9b685b5a"
 }

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "github",
-  "version": "0.124.55",
+  "version": "0.124.57",
   "chantVersion": ">=0.1.0",
   "namespace": "GitHub",
   "intrinsics": [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-github",
-  "version": "0.124.55",
+  "version": "0.124.57",
   "description": "GitHub Actions lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -61,6 +61,6 @@
     "typescript": "^5.9.3"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.124.55"
+    "@intentius/chant": "^0.124.57"
   }
 }