@intentius/chant-lexicon-github 0.62.0 → 0.63.0

package/dist/components/generate-op-pipeline.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generate-op-pipeline.d.ts","sourceRoot":"","sources":["../../src/components/generate-op-pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsEG;AAIH,OAAO,KAAK,EACV,wBAAwB,IAAI,uBAAuB,EACnD,aAAa,EAEb,aAAa,EACb,gBAAgB,IAAI,sBAAsB,EAC1C,WAAW,EACX,SAAS,EACT,eAAe,EAChB,MAAM,0BAA0B,CAAC;AAElC,YAAY,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,CAAC;AAEhE;;;;;;GAMG;AACH,MAAM,WAAW,mBAAmB;IAClC;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB;;;;OAIG;IACH,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5B,2DAA2D;IAC3D,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,6DAA6D;IAC7D,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC;;;;OAIG;IACH,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,8DAA8D;IAC9D,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC;;;;;;;;;OASG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC1C;AAED,qFAAqF;AACrF,MAAM,WAAW,oBAAoB;IACnC,4FAA4F;IAC5F,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,mBAAmB,CAAC;CAC1B;AAqTD;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,IAAI,CA8BzE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,aAAa,GAAG,IAAI,CAwBhF;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,EACtC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,EAC1C,OAAO,EAAE,SAAS,GACjB,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,CAqClC;AA6BD;;;;;GAKG;AACH,MAAM,WAAW,wCAAwC;IACvD;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,eAAe,EAAE,EACtB,OAAO,GAAE,uBAA4B,EACrC,eAAe,GAAE,wCAA6C,GAC7D;IAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;IAAC,IAAI,EAAE,aAAa,EAAE,CAAA;CAAE,CA6F1D;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,mBAAmB,GAAG,MAAM,CAenE;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,eAAe,EAAE,EACtB,OAAO,GAAE,uBAA4B,GACpC,sBAAsB,CAMxB"}
+{"version":3,"file":"generate-op-pipeline.d.ts","sourceRoot":"","sources":["../../src/components/generate-op-pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsEG;AAIH,OAAO,KAAK,EACV,wBAAwB,IAAI,uBAAuB,EACnD,aAAa,EAEb,aAAa,EACb,gBAAgB,IAAI,sBAAsB,EAC1C,WAAW,EACX,SAAS,EACT,eAAe,EAChB,MAAM,0BAA0B,CAAC;AAElC,YAAY,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,CAAC;AAEhE;;;;;;GAMG;AACH,MAAM,WAAW,mBAAmB;IAClC;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB;;;;OAIG;IACH,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5B,2DAA2D;IAC3D,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,6DAA6D;IAC7D,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC;;;;OAIG;IACH,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,8DAA8D;IAC9D,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC;;;;;;;;;OASG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC1C;AAED,qFAAqF;AACrF,MAAM,WAAW,oBAAoB;IACnC,4FAA4F;IAC5F,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,mBAAmB,CAAC;CAC1B;AAmUD;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,IAAI,CA8BzE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,aAAa,GAAG,IAAI,CAwBhF;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,EACtC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,EAC1C,OAAO,EAAE,SAAS,GACjB,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,CAqClC;AA6BD;;;;;GAKG;AACH,MAAM,WAAW,wCAAwC;IACvD;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,eAAe,EAAE,EACtB,OAAO,GAAE,uBAA4B,EACrC,eAAe,GAAE,wCAA6C,GAC7D;IAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;IAAC,IAAI,EAAE,aAAa,EAAE,CAAA;CAAE,CA6F1D;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,mBAAmB,GAAG,MAAM,CAenE;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,eAAe,EAAE,EACtB,OAAO,GAAE,uBAA4B,GACpC,sBAAsB,CAMxB"}

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "1c9c51090ae4df5488b7a558b098177d5f40d9efccc4ab8b89bb5caf91d1b953",
+    "manifest.json": "ee70227500205251bb2525d85be15c82185d173f1942686400135abc08e56786",
     "meta.json": "dc3977afc2b6ddc4904de906d1b1e448b786b2aced9d82f8eade2ff915203344",
     "types/index.d.ts": "f207946d7ab52f712d0c09995366440a6bba8b39358057b0da38ff9c0acca429",
     "rules/deprecated-action-version.ts": "d41e6e532ab7f623af1bee4ac5279fcb2baada7defa1c5d022a5bc71983e8797",
@@ -77,5 +77,5 @@
     "skills/chant-github-patterns.md": "bb3abef289a8fdfcf07d6bb2d7289dcb2f38bc0cb0321ea320b78b45a6f548c0",
     "skills/chant-github-security.md": "aab111cb0871cad30281ce48d7da23663689619351029219e2be019a1a61e394"
   },
-  "composite": "92101a972617cf05fe02d8c0ff00f3ef87c8b769e768e1da63a6ed7730df17af"
+  "composite": "241cea113916c7340ca4cb0383b1e1c909eff2a6d4ffa0bb99b957499e41c71c"
 }

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "github",
-  "version": "0.62.0",
+  "version": "0.63.0",
   "chantVersion": ">=0.1.0",
   "namespace": "GitHub",
   "intrinsics": [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-github",
-  "version": "0.62.0",
+  "version": "0.63.0",
   "description": "GitHub Actions lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -61,7 +61,7 @@
     "typescript": "^5.9.3"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.62.0",
+    "@intentius/chant": "^0.63.0",
     "typescript": "^5.9.3"
   }
 }

package/src/components/generate-op-pipeline.test.ts

@@ -535,7 +535,11 @@ describe("generateGithubOpPipeline: the gated apply on push (#2243)", () => {
 
   test("a failing run stays a failing job: the pipe cannot swallow its exit code", () => {
     const step = pushDoc().jobs!["app-apply"].steps.find((s) => s.id === "chant-run");
-    expect(step?.run).toContain("set -o pipefail");
+    expect(step?.run).toContain(
+      '{ chant run app-apply --gated-exit 0 --json; echo "$?" >"$status"; } | tee "$json"',
+    );
+    expect(step?.run).toContain('code=$(cat "$status")');
+    expect(step?.run).toContain('[ "$code" -eq 0 ] || exit "$code"');
   });
 
   /**
@@ -544,16 +548,36 @@ describe("generateGithubOpPipeline: the gated apply on push (#2243)", () => {
    * shell on GitHub Actions is `sh`, not bash. `sh` rejects `set -o pipefail`
    * outright (`Illegal option -o pipefail`) and fails the step before `chant`
    * is ever reached, which is exactly what happened on a real run (choudoufu
-   * #1026, run 34312967579). The step that emits `pipefail` must declare
-   * `shell: bash` itself.
+   * #1026, run 34312967579). The exit-code capture above needs neither
+   * `pipefail` nor a `shell:` override to survive that — it is plain POSIX
+   * `sh`, so the default shell a `container:` job gets already runs it.
    */
-  test("the pipefail step declares shell: bash — its job runs in a container, whose default shell is sh (#2299)", () => {
+  test("the run step needs no shell override — its script is POSIX sh, not bash (#2299)", () => {
     const doc = pushDoc();
     const job = doc.jobs!["app-apply"];
     expect(job.container).toBe("node:22-slim");
     const step = job.steps.find((s) => s.id === "chant-run");
-    expect(step?.run).toContain("set -o pipefail");
-    expect(step?.shell).toBe("bash");
+    expect(step?.shell).toBeUndefined();
+    expect(step?.run).not.toContain("pipefail");
+  });
+
+  /**
+   * chant #2321 — #2307 fixed #2299 by pairing the `pipefail` line with an
+   * unconditional `shell: "bash"` on this step, which then broke every
+   * consumer whose `options.image` has no bash on it at all (alpine,
+   * distroless, …): `shell: bash` on such an image fails with `bash: not
+   * found` before `chant` is ever reached, a failure busybox `ash` never had
+   * before #2307 introduced the unconditional `shell: bash`. The fix removes
+   * the bash-ism instead of moving it, so a non-bash image's own default
+   * `sh` runs the step unchanged.
+   */
+  test("a consumer-set non-bash image's gated job can still start (#2321)", () => {
+    const doc = parseFile(generateGithubOpPipeline([pushSpec], { image: "alpine:3.20" }).files[0].yaml);
+    const job = doc.jobs!["app-apply"];
+    expect(job.container).toBe("alpine:3.20");
+    const step = job.steps.find((s) => s.id === "chant-run");
+    expect(step?.shell).toBeUndefined();
+    expect(step?.run).not.toContain("pipefail");
   });
 });
 

package/src/components/generate-op-pipeline.ts

@@ -245,26 +245,37 @@ const GATE_OUTPUT_SCRIPT =
  * `--json`, tee'd so the record is both in the log and on disk, then read for
  * the job's outputs.
  *
- * `set -o pipefail` is not decoration. Without it, a failing `chant run`
- * piped into `tee` comes back as `tee`'s own zero and turns a broken apply
- * green — the exact thing this whole change must not do. But `pipefail` is a
- * bash-ism: GitHub's (and Forgejo's) default shell for a job with no
- * `container:` is `bash --noprofile --norc -eo pipefail`, which already sets
- * it, but the default for a job that *does* carry `container:` — which every
- * Op job does, this one included (#2299) — is plain `sh`, which rejects `set
- * -o pipefail` outright (`Illegal option -o pipefail`) and fails the step
- * before `chant` ever runs. This generator's own Op job always sets
- * `container:` (see {@link buildGithubOpPipelineDocs}'s `container: image`),
- * so the failure is not a corner case — it is what every gated apply and
- * gated adopt does today.
+ * The exit-code capture below is not decoration. Piping straight into `tee`
+ * — `chant run ... | tee "$json"` — reports `tee`'s own zero as the step's
+ * result no matter what `chant run` exited with, and turns a broken apply
+ * green, which is the exact thing this step must not do. bash's fix for that
+ * is `set -o pipefail`, but `pipefail` is a bash-ism, and this generator's
+ * own Op job always sets `container:` (see {@link buildGithubOpPipelineDocs}'s
+ * `container: image`) — GitHub's (and Forgejo's) default shell for a
+ * `container:` job is plain `sh`, which rejects `set -o pipefail` outright
+ * (`Illegal option -o pipefail`) and fails the step before `chant` ever runs
+ * (#2299). #2307 first fixed that by pairing the `pipefail` line with an
+ * unconditional `shell: "bash"` on the step — which then broke every
+ * consumer whose `options.image` has no bash on it at all, e.g. an
+ * `alpine:*` or distroless image (#2321): busybox `ash` ran the old
+ * plain-pipe script fine, so pinning `shell: bash` regressed exactly the
+ * images that never needed pipefail's workaround in the first place.
  *
- * That is why this function returns the whole step record rather than just
- * the script text: `shell: "bash"` is bundled into the same return value as
- * the `pipefail` line, so nothing that calls it can get one without the
- * other. A future edit that inlines another `pipefail`-bearing script has to
- * either reuse this function or open a new call site that a reviewer can see
- * declares no shell — the property that made #2299 possible in the first
- * place is no longer available by accident.
+ * So this step needs no shell declaration and runs under whatever `sh` the
+ * consumer's image provides. It gets the same failure-cannot-hide guarantee
+ * `pipefail` gave, without the bash-ism, by capturing the invocation's own
+ * exit code into a file from *inside* the pipeline's first stage — where
+ * `tee` can never see it — and checking that file once the pipe finishes:
+ * `{ invocation; echo "$?" >status; } | tee "$json"` followed by `exit
+ * "$(cat "$status")"` when that is non-zero. `set +e` up front makes this
+ * work under any default shell a container job might get, `-e` included:
+ * GitHub's documented `sh` template is `sh -e {0}`, and without `set +e`
+ * `-e` would abort the brace group at the first failing command — before
+ * `echo "$?"` ever runs — which was verified by running both this script and
+ * that failure mode under bash and dash directly, `-e` on. Everything past
+ * that point (`set +e`, `{ }`, `$(...)`, `[ ]`) is POSIX `sh`, so it needs no
+ * `shell:` field to run correctly under `ash`, `dash`, or bash alike, and
+ * #2299 does not reopen: nothing here is a bash-only construct.
  *
  * The `node -e` line and the job's own `outputs:` mapping exist for exactly
  * one reader: the gate-notice job beside it, which is `needs:`-only readable
@@ -283,12 +294,15 @@ function gatedRunStep(
   env: Record<string, string>,
 ): Record<string, unknown> {
   const lines = [
-    "set -o pipefail",
+    "set +e",
     'json="${RUNNER_TEMP:-/tmp}/chant-run-' + op + '.json"',
-    `${invocation} | tee "$json"`,
+    'status="${RUNNER_TEMP:-/tmp}/chant-run-' + op + '.status"',
+    `{ ${invocation}; echo "$?" >"$status"; } | tee "$json"`,
+    'code=$(cat "$status")',
+    '[ "$code" -eq 0 ] || exit "$code"',
   ];
   if (emitOutputs) lines.push(`node -e '${GATE_OUTPUT_SCRIPT}' "$json"`);
-  return { id, run: lines.join("\n"), shell: "bash", env };
+  return { id, run: lines.join("\n"), env };
 }
 
 /**