@intentius/chant-lexicon-github 0.61.0 → 0.63.0

package/dist/components/generate-op-pipeline.d.ts

@@ -57,6 +57,17 @@
  * environment protection is repository configuration, not a token scope — and
  * {@link assertEnvironment} refuses only what would emit as configured and
  * bind nothing.
+ *
+ * A fourth is per-Op credentials (#2290): a spec's `variables` emits the Op's
+ * own job-level `env:`, beside (and layered over, on a key collision)
+ * `options.variables`'s workflow-level `env:`. `options.variables` keeps
+ * meaning what it always has — set once, landing on every generated file — so
+ * a caller who declares nothing per-Op sees byte-identical output; a spec's
+ * own `variables` is the way one Op's job can hold a credential no other Op's
+ * job receives, which a workflow-level declaration can never express because
+ * every generated file here has exactly the one Op job (plus, on a `push`
+ * trigger, the gate-notice job beside it — job-level `env:` does not reach
+ * that job either, same as `environment:` above does not).
  */
 import type { ComponentPipelineOptions as GenerateGithubOpOptions, OpEnvironment, OpPipelineJob, OpPipelineResult as GenerateGithubOpResult, OpSetupStep, OpTrigger, ScheduledOpSpec } from "@intentius/chant/lexicon";
 export type { GenerateGithubOpOptions, GenerateGithubOpResult };
@@ -157,6 +168,23 @@ export declare function assertEnvironment(name: string, environment: OpEnvironme
  *    push run, grants write access no step in the generated job can spend.
  */
 export declare function mergePermissions(name: string, base: Record<string, "read" | "write">, additive: Record<string, "read" | "write">, trigger: OpTrigger): Record<string, "read" | "write">;
+/**
+ * Internal knobs beside the public {@link GenerateGithubOpOptions} — not part
+ * of that type because they are not something a project author sets, only
+ * something a dialect on top of this builder (forgejo, #2294) needs to
+ * change about the shape this function emits for every spec alike.
+ */
+export interface BuildGithubOpPipelineDocsInternalOptions {
+    /**
+     * Whether a `push` job's outputs (`gated`/`op`/`gate`/`approve`) and the
+     * `node -e` step that writes them to `$GITHUB_OUTPUT` are emitted (#2294).
+     * Default true (github's own behavior, unchanged): the gate-notice job
+     * beside it reads them. The forgejo generator passes `false` — it never
+     * carries a gate-notice job (`gatedNoticeDoc` never crosses the dialect),
+     * so nothing would ever read them there.
+     */
+    emitGatedOutputs?: boolean;
+}
 /**
  * Build one `GithubOpPipelineDoc` per scheduled Op: its trigger, its `setup`
  * steps, least-privilege `permissions:` for its finding-mode plus whatever
@@ -169,7 +197,7 @@ export declare function mergePermissions(name: string, base: Record<string, "rea
  * assertSetupSteps}), or a `permissions` entry that is not additive ({@link
  * mergePermissions}).
  */
-export declare function buildGithubOpPipelineDocs(ops: ScheduledOpSpec[], options?: GenerateGithubOpOptions): {
+export declare function buildGithubOpPipelineDocs(ops: ScheduledOpSpec[], options?: GenerateGithubOpOptions, internalOptions?: BuildGithubOpPipelineDocsInternalOptions): {
     files: GithubOpPipelineFile[];
     jobs: OpPipelineJob[];
 };

package/dist/components/generate-op-pipeline.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generate-op-pipeline.d.ts","sourceRoot":"","sources":["../../src/components/generate-op-pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2DG;AAIH,OAAO,KAAK,EACV,wBAAwB,IAAI,uBAAuB,EACnD,aAAa,EAEb,aAAa,EACb,gBAAgB,IAAI,sBAAsB,EAC1C,WAAW,EACX,SAAS,EACT,eAAe,EAChB,MAAM,0BAA0B,CAAC;AAElC,YAAY,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,CAAC;AAEhE;;;;;;GAMG;AACH,MAAM,WAAW,mBAAmB;IAClC;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB;;;;OAIG;IACH,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5B,2DAA2D;IAC3D,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,6DAA6D;IAC7D,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC;;;;OAIG;IACH,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,8DAA8D;IAC9D,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC;;;;;;;;;OASG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC1C;AAED,qFAAqF;AACrF,MAAM,WAAW,oBAAoB;IACnC,4FAA4F;IAC5F,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,mBAAmB,CAAC;CAC1B;AAsQD;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,IAAI,CA8BzE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,aAAa,GAAG,IAAI,CAwBhF;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,EACtC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,EAC1C,OAAO,EAAE,SAAS,GACjB,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,CAqClC;AA6BD;;;;;;;;;;;GAWG;AACH,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,eAAe,EAAE,EACtB,OAAO,GAAE,uBAA4B,GACpC;IAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;IAAC,IAAI,EAAE,aAAa,EAAE,CAAA;CAAE,CAuF1D;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,mBAAmB,GAAG,MAAM,CAenE;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,eAAe,EAAE,EACtB,OAAO,GAAE,uBAA4B,GACpC,sBAAsB,CAMxB"}
+{"version":3,"file":"generate-op-pipeline.d.ts","sourceRoot":"","sources":["../../src/components/generate-op-pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsEG;AAIH,OAAO,KAAK,EACV,wBAAwB,IAAI,uBAAuB,EACnD,aAAa,EAEb,aAAa,EACb,gBAAgB,IAAI,sBAAsB,EAC1C,WAAW,EACX,SAAS,EACT,eAAe,EAChB,MAAM,0BAA0B,CAAC;AAElC,YAAY,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,CAAC;AAEhE;;;;;;GAMG;AACH,MAAM,WAAW,mBAAmB;IAClC;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB;;;;OAIG;IACH,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5B,2DAA2D;IAC3D,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,6DAA6D;IAC7D,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC;;;;OAIG;IACH,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,8DAA8D;IAC9D,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC;;;;;;;;;OASG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC1C;AAED,qFAAqF;AACrF,MAAM,WAAW,oBAAoB;IACnC,4FAA4F;IAC5F,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,mBAAmB,CAAC;CAC1B;AAmUD;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,IAAI,CA8BzE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,aAAa,GAAG,IAAI,CAwBhF;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,EACtC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,EAC1C,OAAO,EAAE,SAAS,GACjB,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,CAqClC;AA6BD;;;;;GAKG;AACH,MAAM,WAAW,wCAAwC;IACvD;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,eAAe,EAAE,EACtB,OAAO,GAAE,uBAA4B,EACrC,eAAe,GAAE,wCAA6C,GAC7D;IAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;IAAC,IAAI,EAAE,aAAa,EAAE,CAAA;CAAE,CA6F1D;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,mBAAmB,GAAG,MAAM,CAenE;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,eAAe,EAAE,EACtB,OAAO,GAAE,uBAA4B,GACpC,sBAAsB,CAMxB"}

package/dist/composites/pr-plan-report.d.ts

@@ -51,7 +51,9 @@ export interface PrPlanReportProps {
  * proved (#1223), reused here rather than reinvented. The forgejo lexicon
  * inherits this composite through its github re-export, since Forgejo Actions
  * runs the same workflow shape and the Forgejo API accepts the same `gh api`
- * calls against its GitHub-compatible surface.
+ * calls against its GitHub-compatible surface — once they target a full URL
+ * rather than a bare relative path, which `stickyCommentScript` now does
+ * (#2305, the same fix #2291 made for `reconcilePr`'s `postOrUpdateComment`).
  *
  * Only meaningful on a `pull_request`-triggered workflow — the job guards on
  * `github.event_name` since the comment targets `github.event.number`, which

package/dist/composites/pr-plan-report.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pr-plan-report.d.ts","sourceRoot":"","sources":["../../src/composites/pr-plan-report.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,GAAG,EAAqB,MAAM,oBAAoB,CAAC;AAI5D,MAAM,WAAW,iBAAiB;IAChC;;;OAGG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB,4EAA4E;IAC5E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kEAAkE;IAClE,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,+CAA+C;IAC/C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iEAAiE;IACjE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,+DAA+D;IAC/D,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,6DAA6D;IAC7D,QAAQ,CAAC,EAAE;QACT,GAAG,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;KACrD,CAAC;CACH;AAyBD;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,YAAY;;EAkEP,CAAC"}
+{"version":3,"file":"pr-plan-report.d.ts","sourceRoot":"","sources":["../../src/composites/pr-plan-report.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,GAAG,EAAqB,MAAM,oBAAoB,CAAC;AAI5D,MAAM,WAAW,iBAAiB;IAChC;;;OAGG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB,4EAA4E;IAC5E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kEAAkE;IAClE,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,+CAA+C;IAC/C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iEAAiE;IACjE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,+DAA+D;IAC/D,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,6DAA6D;IAC7D,QAAQ,CAAC,EAAE;QACT,GAAG,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;KACrD,CAAC;CACH;AA2CD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,YAAY;;EAkEP,CAAC"}

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "81759e8725dbe9f79f6747195efe17ce7e0504182857c99a317784b02c7ef629",
+    "manifest.json": "ee70227500205251bb2525d85be15c82185d173f1942686400135abc08e56786",
     "meta.json": "dc3977afc2b6ddc4904de906d1b1e448b786b2aced9d82f8eade2ff915203344",
     "types/index.d.ts": "f207946d7ab52f712d0c09995366440a6bba8b39358057b0da38ff9c0acca429",
     "rules/deprecated-action-version.ts": "d41e6e532ab7f623af1bee4ac5279fcb2baada7defa1c5d022a5bc71983e8797",
@@ -77,5 +77,5 @@
     "skills/chant-github-patterns.md": "bb3abef289a8fdfcf07d6bb2d7289dcb2f38bc0cb0321ea320b78b45a6f548c0",
     "skills/chant-github-security.md": "aab111cb0871cad30281ce48d7da23663689619351029219e2be019a1a61e394"
   },
-  "composite": "b47a71d4987ee8534216ed299add82e196f2ba21026e79bf6490473bb8df525c"
+  "composite": "241cea113916c7340ca4cb0383b1e1c909eff2a6d4ffa0bb99b957499e41c71c"
 }

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "github",
-  "version": "0.61.0",
+  "version": "0.63.0",
   "chantVersion": ">=0.1.0",
   "namespace": "GitHub",
   "intrinsics": [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-github",
-  "version": "0.61.0",
+  "version": "0.63.0",
   "description": "GitHub Actions lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -61,7 +61,7 @@
     "typescript": "^5.9.3"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.61.0",
+    "@intentius/chant": "^0.63.0",
     "typescript": "^5.9.3"
   }
 }

package/src/components/generate-op-pipeline.test.ts

@@ -21,6 +21,7 @@ interface ParsedStep {
   id?: string;
   uses?: string;
   run?: string;
+  shell?: string;
   env?: Record<string, string>;
 }
 
@@ -32,6 +33,7 @@ interface ParsedJob {
   if?: string;
   permissions?: Record<string, string>;
   outputs?: Record<string, string>;
+  env?: Record<string, string>;
   steps: ParsedStep[];
 }
 
@@ -494,11 +496,31 @@ describe("generateGithubOpPipeline: the gated apply on push (#2243)", () => {
     // container image does not.
     expect(notice.container).toBeUndefined();
     const script = notice.steps[0].run ?? "";
-    expect(script).toContain('gh api "repos/$GITHUB_REPOSITORY/commits/$GITHUB_SHA/pulls"');
+    expect(script).toContain('gh api "$api_base/repos/$GITHUB_REPOSITORY/commits/$GITHUB_SHA/pulls"');
     expect(script).toContain('marker="<!-- chant-gate:$CHANT_OP -->"');
     expect(script).toContain("gh issue create");
   });
 
+  // chant #2305 — same anti-pattern `stickyCommentScript`
+  // (`lexicons/github/src/composites/pr-plan-report.ts`) and `reconcilePr`'s
+  // `postOrUpdateComment` (#2291) had: a bare relative path, which `gh`
+  // resolves against `/api/v3` for any host but github.com. This job never
+  // reaches Forgejo today (the forgejo generator never carries
+  // `gatedNoticeDoc` across the dialect, #2294), so the fix changes nothing
+  // observable on github.com or GHES — it only stops a future Forgejo notice
+  // job from inheriting the same bug.
+  test("the notice job's gh api calls resolve their base from $GITHUB_API_URL, not a bare path (#2305)", () => {
+    const script = pushDoc().jobs!["app-apply-gate-notice"].steps[0].run ?? "";
+    expect(script).toContain('api_base="${GITHUB_API_URL%/}"');
+    expect(script).toContain('api_base="${api_base:-https://api.github.com}"');
+    expect(script).toContain('gh api "$api_base/repos/$GITHUB_REPOSITORY/commits/$GITHUB_SHA/pulls"');
+    expect(script).toContain('gh api "$api_base/repos/$GITHUB_REPOSITORY/issues/$pr/comments"');
+    expect(script).toContain('gh api --method PATCH "$api_base/repos/$GITHUB_REPOSITORY/issues/comments/$id"');
+    expect(script).toContain('gh api --method POST "$api_base/repos/$GITHUB_REPOSITORY/issues/$pr/comments"');
+    // No bare-path call survives.
+    expect(script).not.toMatch(/gh api[^\n]*"repos\//);
+  });
+
   test("the notice job's permissions are its two posting paths and the lookup", () => {
     const notice = pushDoc().jobs!["app-apply-gate-notice"];
     expect(notice.permissions).toEqual({
@@ -513,7 +535,49 @@ describe("generateGithubOpPipeline: the gated apply on push (#2243)", () => {
 
   test("a failing run stays a failing job: the pipe cannot swallow its exit code", () => {
     const step = pushDoc().jobs!["app-apply"].steps.find((s) => s.id === "chant-run");
-    expect(step?.run).toContain("set -o pipefail");
+    expect(step?.run).toContain(
+      '{ chant run app-apply --gated-exit 0 --json; echo "$?" >"$status"; } | tee "$json"',
+    );
+    expect(step?.run).toContain('code=$(cat "$status")');
+    expect(step?.run).toContain('[ "$code" -eq 0 ] || exit "$code"');
+  });
+
+  /**
+   * chant #2299 — every Op job carries `container:` (this generator sets one
+   * unconditionally, default `node:22-slim`), and a container job's default
+   * shell on GitHub Actions is `sh`, not bash. `sh` rejects `set -o pipefail`
+   * outright (`Illegal option -o pipefail`) and fails the step before `chant`
+   * is ever reached, which is exactly what happened on a real run (choudoufu
+   * #1026, run 34312967579). The exit-code capture above needs neither
+   * `pipefail` nor a `shell:` override to survive that — it is plain POSIX
+   * `sh`, so the default shell a `container:` job gets already runs it.
+   */
+  test("the run step needs no shell override — its script is POSIX sh, not bash (#2299)", () => {
+    const doc = pushDoc();
+    const job = doc.jobs!["app-apply"];
+    expect(job.container).toBe("node:22-slim");
+    const step = job.steps.find((s) => s.id === "chant-run");
+    expect(step?.shell).toBeUndefined();
+    expect(step?.run).not.toContain("pipefail");
+  });
+
+  /**
+   * chant #2321 — #2307 fixed #2299 by pairing the `pipefail` line with an
+   * unconditional `shell: "bash"` on this step, which then broke every
+   * consumer whose `options.image` has no bash on it at all (alpine,
+   * distroless, …): `shell: bash` on such an image fails with `bash: not
+   * found` before `chant` is ever reached, a failure busybox `ash` never had
+   * before #2307 introduced the unconditional `shell: bash`. The fix removes
+   * the bash-ism instead of moving it, so a non-bash image's own default
+   * `sh` runs the step unchanged.
+   */
+  test("a consumer-set non-bash image's gated job can still start (#2321)", () => {
+    const doc = parseFile(generateGithubOpPipeline([pushSpec], { image: "alpine:3.20" }).files[0].yaml);
+    const job = doc.jobs!["app-apply"];
+    expect(job.container).toBe("alpine:3.20");
+    const step = job.steps.find((s) => s.id === "chant-run");
+    expect(step?.shell).toBeUndefined();
+    expect(step?.run).not.toContain("pipefail");
   });
 });
 
@@ -642,3 +706,67 @@ describe("generateGithubOpPipeline: a deployment environment on the Op's job (#2
     ).toThrow(/has an empty `url`/);
   });
 });
+
+/**
+ * chant #2290 — per-Op credentials, so a pull-request job need not hold the
+ * apply credential. `variables` lands as the Op's own job-level `env:`, one
+ * level more specific than `options.variables`'s workflow-level `env:`, and
+ * never on the gate-notice job beside it.
+ */
+describe("generateGithubOpPipeline: per-Op variables on the job (#2290)", () => {
+  const CREDENTIAL = { AWS_ACCESS_KEY_ID: "${{ secrets.AWS_ACCESS_KEY_ID }}" };
+
+  test("a spec with no variables emits no job-level env:, even when options.variables is set", () => {
+    const doc = parseFile(
+      generateGithubOpPipeline([{ name: "live-check", trigger: { kind: "pull_request", branches: ["main"] } }], {
+        variables: { CHANT_FORGE: "github" },
+      }).files[0].yaml,
+    );
+    expect(doc.jobs!["live-check"].env).toBeUndefined();
+  });
+
+  test("a spec's own variables land as the job's env:, beside the workflow env:", () => {
+    const doc = parseFile(
+      generateGithubOpPipeline(
+        [{ name: "live-apply", trigger: { kind: "push", branches: ["main"] }, variables: CREDENTIAL }],
+        { variables: { CHANT_FORGE: "github" } },
+      ).files[0].yaml,
+    );
+    expect(doc.jobs!["live-apply"].env).toEqual(CREDENTIAL);
+  });
+
+  test("a per-Op key wins over a same-named forge-wide one", () => {
+    const doc = parseFile(
+      generateGithubOpPipeline(
+        [
+          {
+            name: "live-apply",
+            trigger: { kind: "push", branches: ["main"] },
+            variables: { CHANT_FORGE: "overridden" },
+          },
+        ],
+        { variables: { CHANT_FORGE: "github" } },
+      ).files[0].yaml,
+    );
+    expect(doc.jobs!["live-apply"].env).toEqual({ CHANT_FORGE: "overridden" });
+  });
+
+  test("the gate-notice job never carries the Op's own job-level variables", () => {
+    const doc = parseFile(
+      generateGithubOpPipeline([
+        { name: "live-apply", trigger: { kind: "push", branches: ["main"] }, variables: CREDENTIAL },
+      ]).files[0].yaml,
+    );
+    expect(doc.jobs!["live-apply-gate-notice"].env).toBeUndefined();
+  });
+
+  test("a spec declaring variables changes exactly the job's env: block and nothing else", () => {
+    const spec: ScheduledOpSpec = { name: "actions-audit", schedule: "0 6 * * *" };
+    const before = generateGithubOpPipeline([spec]).files[0].yaml;
+    const after = generateGithubOpPipeline([{ ...spec, variables: CREDENTIAL }]).files[0].yaml;
+    expect(after).toContain("    env:\n      AWS_ACCESS_KEY_ID: '${{ secrets.AWS_ACCESS_KEY_ID }}'\n");
+    expect(
+      after.replace("    env:\n      AWS_ACCESS_KEY_ID: '${{ secrets.AWS_ACCESS_KEY_ID }}'\n", ""),
+    ).toBe(before);
+  });
+});

package/src/components/generate-op-pipeline.ts

@@ -57,6 +57,17 @@
  * environment protection is repository configuration, not a token scope — and
  * {@link assertEnvironment} refuses only what would emit as configured and
  * bind nothing.
+ *
+ * A fourth is per-Op credentials (#2290): a spec's `variables` emits the Op's
+ * own job-level `env:`, beside (and layered over, on a key collision)
+ * `options.variables`'s workflow-level `env:`. `options.variables` keeps
+ * meaning what it always has — set once, landing on every generated file — so
+ * a caller who declares nothing per-Op sees byte-identical output; a spec's
+ * own `variables` is the way one Op's job can hold a credential no other Op's
+ * job receives, which a workflow-level declaration can never express because
+ * every generated file here has exactly the one Op job (plus, on a `push`
+ * trigger, the gate-notice job beside it — job-level `env:` does not reach
+ * that job either, same as `environment:` above does not).
  */
 
 import { emitYAML } from "@intentius/chant/yaml";
@@ -234,18 +245,64 @@ const GATE_OUTPUT_SCRIPT =
  * `--json`, tee'd so the record is both in the log and on disk, then read for
  * the job's outputs.
  *
- * `set -o pipefail` is not decoration. GitHub's default shell is `bash -e`,
- * which does not set it, so a failing `chant run` piped into `tee` would come
- * back as `tee`'s zero and turn a broken apply green — the exact thing this
- * whole change must not do.
+ * The exit-code capture below is not decoration. Piping straight into `tee`
+ * — `chant run ... | tee "$json"` — reports `tee`'s own zero as the step's
+ * result no matter what `chant run` exited with, and turns a broken apply
+ * green, which is the exact thing this step must not do. bash's fix for that
+ * is `set -o pipefail`, but `pipefail` is a bash-ism, and this generator's
+ * own Op job always sets `container:` (see {@link buildGithubOpPipelineDocs}'s
+ * `container: image`) — GitHub's (and Forgejo's) default shell for a
+ * `container:` job is plain `sh`, which rejects `set -o pipefail` outright
+ * (`Illegal option -o pipefail`) and fails the step before `chant` ever runs
+ * (#2299). #2307 first fixed that by pairing the `pipefail` line with an
+ * unconditional `shell: "bash"` on the step — which then broke every
+ * consumer whose `options.image` has no bash on it at all, e.g. an
+ * `alpine:*` or distroless image (#2321): busybox `ash` ran the old
+ * plain-pipe script fine, so pinning `shell: bash` regressed exactly the
+ * images that never needed pipefail's workaround in the first place.
+ *
+ * So this step needs no shell declaration and runs under whatever `sh` the
+ * consumer's image provides. It gets the same failure-cannot-hide guarantee
+ * `pipefail` gave, without the bash-ism, by capturing the invocation's own
+ * exit code into a file from *inside* the pipeline's first stage — where
+ * `tee` can never see it — and checking that file once the pipe finishes:
+ * `{ invocation; echo "$?" >status; } | tee "$json"` followed by `exit
+ * "$(cat "$status")"` when that is non-zero. `set +e` up front makes this
+ * work under any default shell a container job might get, `-e` included:
+ * GitHub's documented `sh` template is `sh -e {0}`, and without `set +e`
+ * `-e` would abort the brace group at the first failing command — before
+ * `echo "$?"` ever runs — which was verified by running both this script and
+ * that failure mode under bash and dash directly, `-e` on. Everything past
+ * that point (`set +e`, `{ }`, `$(...)`, `[ ]`) is POSIX `sh`, so it needs no
+ * `shell:` field to run correctly under `ash`, `dash`, or bash alike, and
+ * #2299 does not reopen: nothing here is a bash-only construct.
+ *
+ * The `node -e` line and the job's own `outputs:` mapping exist for exactly
+ * one reader: the gate-notice job beside it, which is `needs:`-only readable
+ * through `steps.<id>.outputs`/`needs.<job>.outputs`. `emitOutputs: false`
+ * (forgejo, #2294 — the notice job does not cross the dialect at all) drops
+ * that line: nothing on Forgejo reads `$GITHUB_OUTPUT` for this job, and
+ * keeping the line would be a wired-up mechanism with no reader, which is the
+ * exact thing #2294 is about. The tee'd invocation survives either way — it's
+ * what puts the run's own JSON record in the log, gate-notice job or not.
  */
-function gatedRunScript(op: string, invocation: string): string {
-  return [
-    "set -o pipefail",
+function gatedRunStep(
+  id: string,
+  op: string,
+  invocation: string,
+  emitOutputs: boolean,
+  env: Record<string, string>,
+): Record<string, unknown> {
+  const lines = [
+    "set +e",
     'json="${RUNNER_TEMP:-/tmp}/chant-run-' + op + '.json"',
-    `${invocation} | tee "$json"`,
-    `node -e '${GATE_OUTPUT_SCRIPT}' "$json"`,
-  ].join("\n");
+    'status="${RUNNER_TEMP:-/tmp}/chant-run-' + op + '.status"',
+    `{ ${invocation}; echo "$?" >"$status"; } | tee "$json"`,
+    'code=$(cat "$status")',
+    '[ "$code" -eq 0 ] || exit "$code"',
+  ];
+  if (emitOutputs) lines.push(`node -e '${GATE_OUTPUT_SCRIPT}' "$json"`);
+  return { id, run: lines.join("\n"), env };
 }
 
 /**
@@ -274,24 +331,39 @@ const NOTICE_BODY_FORMAT =
  * direct push to the branch, a merge whose commit the API does not associate —
  * the notice becomes an issue instead, which is the `issue` finding mode's own
  * recipe and the reason this job carries `issues: write`.
+ *
+ * `$api_base` (chant #2305), resolved the same way `stickyCommentScript`
+ * (`lexicons/github/src/composites/pr-plan-report.ts`) and `reconcilePr`'s
+ * `githubApiBaseFrom` (`packages/core/src/op/activities/reconcile.ts`)
+ * resolve it: `$GITHUB_API_URL` with a trailing slash trimmed, falling back
+ * to `https://api.github.com`. This job never crosses to Forgejo today — the
+ * forgejo generator's `gatedNoticeDoc` is never carried across the dialect
+ * (#2294) — so github.com and GitHub Enterprise Server are the only hosts
+ * that run this script, and both already resolved correctly under `gh`'s own
+ * bare-path guess. Built from `$api_base` instead, the URL is byte-identical
+ * on those two hosts, and the same anti-pattern that broke Forgejo elsewhere
+ * (#2291, #2305) does not get a second copy here in case a future notice job
+ * does reach Forgejo.
  */
 function gateNoticeScript(): string {
   return [
+    'api_base="${GITHUB_API_URL%/}"',
+    'api_base="${api_base:-https://api.github.com}"',
     'marker="<!-- chant-gate:$CHANT_OP -->"',
     "body=$(printf '" + NOTICE_BODY_FORMAT + "' " +
       '"$marker" "$CHANT_OP" "$GITHUB_SHA" "$CHANT_GATE" "$CHANT_APPROVE" "$CHANT_OP")',
-    'pr=$(gh api "repos/$GITHUB_REPOSITORY/commits/$GITHUB_SHA/pulls" --jq ".[0].number // empty")',
+    'pr=$(gh api "$api_base/repos/$GITHUB_REPOSITORY/commits/$GITHUB_SHA/pulls" --jq ".[0].number // empty")',
     'if [ -z "$pr" ]; then',
     '  gh issue create --title "$CHANT_OP is waiting on gate $CHANT_GATE" --body "$body"',
     "  exit 0",
     "fi",
-    'id=$(gh api "repos/$GITHUB_REPOSITORY/issues/$pr/comments" --paginate ' +
+    'id=$(gh api "$api_base/repos/$GITHUB_REPOSITORY/issues/$pr/comments" --paginate ' +
       '--jq "map(select(.body | startswith(\\"$marker\\"))) | .[0].id // empty" ' +
       '| grep -m1 -E "^[0-9]+$" || true)',
     'if [ -n "$id" ]; then',
-    '  gh api --method PATCH "repos/$GITHUB_REPOSITORY/issues/comments/$id" -f "body=$body" --jq .html_url',
+    '  gh api --method PATCH "$api_base/repos/$GITHUB_REPOSITORY/issues/comments/$id" -f "body=$body" --jq .html_url',
     "else",
-    '  gh api --method POST "repos/$GITHUB_REPOSITORY/issues/$pr/comments" -f "body=$body" --jq .html_url',
+    '  gh api --method POST "$api_base/repos/$GITHUB_REPOSITORY/issues/$pr/comments" -f "body=$body" --jq .html_url',
     "fi",
   ].join("\n");
 }
@@ -559,6 +631,24 @@ function setupStepDoc(step: OpSetupStep): Record<string, unknown> {
   };
 }
 
+/**
+ * Internal knobs beside the public {@link GenerateGithubOpOptions} — not part
+ * of that type because they are not something a project author sets, only
+ * something a dialect on top of this builder (forgejo, #2294) needs to
+ * change about the shape this function emits for every spec alike.
+ */
+export interface BuildGithubOpPipelineDocsInternalOptions {
+  /**
+   * Whether a `push` job's outputs (`gated`/`op`/`gate`/`approve`) and the
+   * `node -e` step that writes them to `$GITHUB_OUTPUT` are emitted (#2294).
+   * Default true (github's own behavior, unchanged): the gate-notice job
+   * beside it reads them. The forgejo generator passes `false` — it never
+   * carries a gate-notice job (`gatedNoticeDoc` never crosses the dialect),
+   * so nothing would ever read them there.
+   */
+  emitGatedOutputs?: boolean;
+}
+
 /**
  * Build one `GithubOpPipelineDoc` per scheduled Op: its trigger, its `setup`
  * steps, least-privilege `permissions:` for its finding-mode plus whatever
@@ -574,7 +664,9 @@ function setupStepDoc(step: OpSetupStep): Record<string, unknown> {
 export function buildGithubOpPipelineDocs(
   ops: ScheduledOpSpec[],
   options: GenerateGithubOpOptions = {},
+  internalOptions: BuildGithubOpPipelineDocsInternalOptions = {},
 ): { files: GithubOpPipelineFile[]; jobs: OpPipelineJob[] } {
+  const emitGatedOutputs = internalOptions.emitGatedOutputs ?? true;
   const image = options.image ?? DEFAULT_IMAGE;
   const runCommand = options.runCommand ?? ["chant", "run", "{name}"];
   const beforeScript = options.beforeScript ?? [];
@@ -615,7 +707,7 @@ export function buildGithubOpPipelineDocs(
     for (const line of beforeScript) steps.push({ run: line });
     steps.push(
       gated
-        ? { id: RUN_STEP_ID, run: gatedRunScript(spec.name, invocation), env: stepEnv }
+        ? gatedRunStep(RUN_STEP_ID, spec.name, invocation, emitGatedOutputs, stepEnv)
         : { run: invocation, env: stepEnv },
     );
     for (const line of extraScript) steps.push({ run: line });
@@ -636,12 +728,17 @@ export function buildGithubOpPipelineDocs(
         [jobName]: {
           "runs-on": "ubuntu-latest",
           container: image,
+          // Per-Op credentials (#2290): job-level `env:`, one level more
+          // specific than `options.variables`'s workflow-level `env:` above,
+          // and never on the notice job beside it — same reason `environment:`
+          // isn't either, it's this Op's own job alone.
+          ...(spec.variables && Object.keys(spec.variables).length > 0 ? { env: spec.variables } : {}),
           // On this Op's own job and never on the notice job beside it: the
           // notice exists to say a chant gate is pending, and putting it
           // behind the same reviewer would hold the message back until
           // somebody had already acted.
           ...(spec.environment ? { environment: environmentDoc(spec.environment) } : {}),
-          ...(gated
+          ...(gated && emitGatedOutputs
             ? {
                 outputs: Object.fromEntries(
                   ["gated", "op", "gate", "approve"].map((name) => [

package/src/composites/pr-plan-report.test.ts

@@ -89,8 +89,8 @@ describe("PrPlanReport composite (#1983)", () => {
     const { job } = PrPlanReport({ environment: "prod" });
     const postStep = steps(job).find((s) => s.props.name === "Post or update PR comment")!;
     const run = postStep.props.run!;
-    expect(run).toContain('gh api -X PATCH "repos/$REPO/issues/comments/$comment_id" -F body=@plan.md');
-    expect(run).toContain('gh api -X POST "repos/$REPO/issues/$PR_NUMBER/comments" -F body=@plan.md');
+    expect(run).toContain('gh api -X PATCH "$api_base/repos/$REPO/issues/comments/$comment_id" -F body=@plan.md');
+    expect(run).toContain('gh api -X POST "$api_base/repos/$REPO/issues/$PR_NUMBER/comments" -F body=@plan.md');
     expect(run).not.toContain("-f body=@");
     // The plan step writes the marker as plan.md's first line, so the body the
     // -F read now starts with `$MARKER` and the jq `startswith` search finds
@@ -101,6 +101,30 @@ describe("PrPlanReport composite (#1983)", () => {
     expect(planStep.props.run).toContain("> plan.md");
   });
 
+  // chant #2305 — this script's three `gh api` calls used to take a bare
+  // relative path (`repos/$REPO/...`), which `gh` resolves against `/api/v3`
+  // for any host but github.com. GitHub Enterprise Server serves that path,
+  // so the bug was invisible there; Forgejo does not, and answers 404 for
+  // GET and POST alike (settled against a real instance in #2291/#2304, the
+  // same fix this composite gets here). Every call now targets `$api_base`,
+  // built from `$GITHUB_API_URL` the same way `githubApiBaseFrom`
+  // (`packages/core/src/op/activities/reconcile.ts`) reads it for
+  // `reconcilePr`, with the github.com fallback inlined since this is a shell
+  // string emitted into YAML rather than a TypeScript call.
+  test("the sticky-comment script resolves its API base from $GITHUB_API_URL, not a bare path (#2305)", () => {
+    const { job } = PrPlanReport({ environment: "prod" });
+    const postStep = steps(job).find((s) => s.props.name === "Post or update PR comment")!;
+    const run = postStep.props.run!;
+    expect(run).toContain('api_base="${GITHUB_API_URL%/}"');
+    expect(run).toContain('api_base="${api_base:-https://api.github.com}"');
+    expect(run).toContain('gh api "$api_base/repos/$REPO/issues/$PR_NUMBER/comments" --paginate');
+    expect(run).toContain('gh api -X PATCH "$api_base/repos/$REPO/issues/comments/$comment_id"');
+    expect(run).toContain('gh api -X POST "$api_base/repos/$REPO/issues/$PR_NUMBER/comments"');
+    // No bare-path call survives: every `gh api` invocation is immediately
+    // followed by `"$api_base/repos/`, never by `"repos/` on its own.
+    expect(run).not.toMatch(/gh api[^\n]*"repos\//);
+  });
+
   test("the emitted workflow passes the github lexicon's own lint — no errors, pinned actions included", () => {
     const { job } = PrPlanReport({ environment: "prod", before: ["aws sts get-caller-identity"] });
     const workflow = new Workflow({

package/src/composites/pr-plan-report.ts

@@ -46,25 +46,43 @@ export interface PrPlanReportProps {
 }
 
 /**
- * Sticky-comment script (#1223's mechanism, reused as-is): find the comment
- * whose body starts with `$MARKER`, PATCH it if found, POST otherwise. No
- * marketplace action, nothing extra to pin — `gh` ships on GitHub's hosted
- * runners. The flag is `-F`, not `-f`: `gh api`'s `-F/--field` is the typed
- * form that reads the value from a file when it starts with `@`, while
- * `-f/--raw-field` adds the parameter as a literal string, so the `-f` form
- * posted the eight characters `@plan.md` (#2236). Reading the body from the
- * file the plan step wrote means a large or multi-line plan never has to
- * survive shell quoting. `-F`'s type coercion of `true`/`false`/`null`/
- * integers does not reach the body: gh resolves the leading `@` first and
- * hands back the file's bytes as a string.
+ * Sticky-comment script (#1223's mechanism), find the comment whose body
+ * starts with `$MARKER`, PATCH it if found, POST otherwise. No marketplace
+ * action, nothing extra to pin — `gh` ships on GitHub's hosted runners. The
+ * flag is `-F`, not `-f`: `gh api`'s `-F/--field` is the typed form that
+ * reads the value from a file when it starts with `@`, while `-f/--raw-field`
+ * adds the parameter as a literal string, so the `-f` form posted the eight
+ * characters `@plan.md` (#2236). Reading the body from the file the plan step
+ * wrote means a large or multi-line plan never has to survive shell quoting.
+ * `-F`'s type coercion of `true`/`false`/`null`/integers does not reach the
+ * body: gh resolves the leading `@` first and hands back the file's bytes as
+ * a string.
+ *
+ * `$api_base` (chant #2305) is `$GITHUB_API_URL` with any trailing slash
+ * trimmed, falling back to `https://api.github.com` when it is unset —
+ * `$GITHUB_API_URL` is already correct on every GitHub Actions and Forgejo
+ * Actions job (`https://api.github.com` on github.com, `<host>/api/v3` on
+ * GitHub Enterprise Server, `<host>/api/v1` on Forgejo), the same fact
+ * `githubApiBaseFrom` in `packages/core/src/op/activities/reconcile.ts`
+ * builds on for `reconcilePr`'s `postOrUpdateComment` (#2291). This script
+ * cannot import that helper — it is a shell string emitted into YAML, not a
+ * TypeScript call — so the equivalent base-URL construction is inlined here
+ * instead. Without it, every `gh api` call below took a bare relative path,
+ * which `gh` resolves against `/api/v3` for any host but github.com; that
+ * guess is right for GitHub Enterprise Server but wrong for Forgejo, which
+ * does not serve `/api/v3` and answered 404 for GET and POST alike. On
+ * github.com and GHES the resolved URL is byte-identical to `gh`'s own
+ * guess, so this changes nothing there.
  */
 const stickyCommentScript = [
-  'comment_id=$(gh api "repos/$REPO/issues/$PR_NUMBER/comments" --paginate ' +
+  'api_base="${GITHUB_API_URL%/}"',
+  'api_base="${api_base:-https://api.github.com}"',
+  'comment_id=$(gh api "$api_base/repos/$REPO/issues/$PR_NUMBER/comments" --paginate ' +
     '--jq "map(select(.body | startswith(\\"$MARKER\\"))) | .[0].id // empty")',
   'if [ -n "$comment_id" ]; then',
-  '  gh api -X PATCH "repos/$REPO/issues/comments/$comment_id" -F body=@plan.md > /dev/null',
+  '  gh api -X PATCH "$api_base/repos/$REPO/issues/comments/$comment_id" -F body=@plan.md > /dev/null',
   "else",
-  '  gh api -X POST "repos/$REPO/issues/$PR_NUMBER/comments" -F body=@plan.md > /dev/null',
+  '  gh api -X POST "$api_base/repos/$REPO/issues/$PR_NUMBER/comments" -F body=@plan.md > /dev/null',
   "fi",
 ].join("\n");
 
@@ -79,7 +97,9 @@ const stickyCommentScript = [
  * proved (#1223), reused here rather than reinvented. The forgejo lexicon
  * inherits this composite through its github re-export, since Forgejo Actions
  * runs the same workflow shape and the Forgejo API accepts the same `gh api`
- * calls against its GitHub-compatible surface.
+ * calls against its GitHub-compatible surface — once they target a full URL
+ * rather than a bare relative path, which `stickyCommentScript` now does
+ * (#2305, the same fix #2291 made for `reconcilePr`'s `postOrUpdateComment`).
  *
  * Only meaningful on a `pull_request`-triggered workflow — the job guards on
  * `github.event_name` since the comment targets `github.event.number`, which