@intentius/chant-lexicon-github 0.79.0 → 0.81.0

package/dist/components/generate-op-pipeline.d.ts

@@ -88,6 +88,12 @@ export interface GithubOpPipelineDoc {
      * rather than only in a build warning.
      */
     header?: string[];
+    /**
+     * The workflow's `name:` (#2580): the Op's name, so the Actions UI lists
+     * the workflow by its Op instead of its file name. The forgejo generator
+     * copies it too (#2601), since Forgejo Actions reads the key the same way.
+     */
+    name?: string;
     /**
      * The `on:` trigger mapping, per {@link ScheduledOpSpec}'s trigger kind
      * (#2084): `{ schedule, workflow_dispatch }` for cron, `{ pull_request }`

package/dist/components/generate-op-pipeline.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generate-op-pipeline.d.ts","sourceRoot":"","sources":["../../src/components/generate-op-pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsEG;AAIH,OAAO,KAAK,EACV,wBAAwB,IAAI,uBAAuB,EACnD,aAAa,EAEb,aAAa,EACb,gBAAgB,IAAI,sBAAsB,EAC1C,WAAW,EACX,SAAS,EACT,eAAe,EAChB,MAAM,0BAA0B,CAAC;AAElC,YAAY,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,CAAC;AAEhE;;;;;;GAMG;AACH,MAAM,WAAW,mBAAmB;IAClC;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB;;;;OAIG;IACH,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5B,2DAA2D;IAC3D,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,6DAA6D;IAC7D,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC;;;;OAIG;IACH,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,8DAA8D;IAC9D,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC;;;;;;;;;OASG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC1C;AAED,qFAAqF;AACrF,MAAM,WAAW,oBAAoB;IACnC,4FAA4F;IAC5F,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,mBAAmB,CAAC;CAC1B;AAmUD;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,IAAI,CA8BzE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,aAAa,GAAG,IAAI,CAwBhF;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,EACtC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,EAC1C,OAAO,EAAE,SAAS,GACjB,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,CAqClC;AA6BD;;;;;GAKG;AACH,MAAM,WAAW,wCAAwC;IACvD;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,eAAe,EAAE,EACtB,OAAO,GAAE,uBAA4B,EACrC,eAAe,GAAE,wCAA6C,GAC7D;IAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;IAAC,IAAI,EAAE,aAAa,EAAE,CAAA;CAAE,CA6F1D;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,mBAAmB,GAAG,MAAM,CAenE;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,eAAe,EAAE,EACtB,OAAO,GAAE,uBAA4B,GACpC,sBAAsB,CAMxB"}
+{"version":3,"file":"generate-op-pipeline.d.ts","sourceRoot":"","sources":["../../src/components/generate-op-pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsEG;AAIH,OAAO,KAAK,EACV,wBAAwB,IAAI,uBAAuB,EACnD,aAAa,EAEb,aAAa,EACb,gBAAgB,IAAI,sBAAsB,EAC1C,WAAW,EACX,SAAS,EAET,eAAe,EAChB,MAAM,0BAA0B,CAAC;AAElC,YAAY,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,CAAC;AAEhE;;;;;;GAMG;AACH,MAAM,WAAW,mBAAmB;IAClC;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5B,2DAA2D;IAC3D,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,6DAA6D;IAC7D,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC;;;;OAIG;IACH,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,8DAA8D;IAC9D,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC;;;;;;;;;OASG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC1C;AAED,qFAAqF;AACrF,MAAM,WAAW,oBAAoB;IACnC,4FAA4F;IAC5F,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,mBAAmB,CAAC;CAC1B;AAmUD;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,IAAI,CA8BzE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,aAAa,GAAG,IAAI,CAwBhF;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,EACtC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,EAC1C,OAAO,EAAE,SAAS,GACjB,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,CAqClC;AA6BD;;;;;GAKG;AACH,MAAM,WAAW,wCAAwC;IACvD;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,eAAe,EAAE,EACtB,OAAO,GAAE,uBAA4B,EACrC,eAAe,GAAE,wCAA6C,GAC7D;IAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;IAAC,IAAI,EAAE,aAAa,EAAE,CAAA;CAAE,CAkG1D;AAwCD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,mBAAmB,GAAG,MAAM,CAgBnE;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,eAAe,EAAE,EACtB,OAAO,GAAE,uBAA4B,GACpC,sBAAsB,CAMxB"}

package/dist/components/generate-pipeline.d.ts

@@ -35,6 +35,18 @@
  *    uses, and matches gitlab's artifact-passing 1:1 in intent — only the
  *    transport differs (explicit upload/download steps vs. GitLab's implicit
  *    `needs:` artifact passing).
+ *  - With `options.promoteTo` (#2575), one more job needs every component
+ *    job and runs `chant components promote`. A promote publishes from the
+ *    build archive on disk, so each component job uploads the files its
+ *    build steps wrote and the promote job downloads them to the same paths.
+ *    Each component job with a publish step also writes the digest its run
+ *    recorded (`--digest-file`) to a job output, and the promote job passes
+ *    it back as `--digest <component>=<digest>` (#2602), so it promotes the
+ *    release this run built rather than whatever is latest in the source
+ *    environment.
+ *  - For a workspace member (`options.member`, #2542) the workflow keeps its
+ *    triggers, and its `run:` steps start in the member's directory. See
+ *    `scopeToMember`.
  *
  * Cross-cutting changes (e.g. "sign every image before deploy") are made by
  * editing `GenerateGithubOptions.extraScript`/`beforeScript` (or the
@@ -65,6 +77,8 @@ export interface GithubPipelineDoc {
     environment: string;
     /** The `on:` trigger mapping (a bare `workflow_dispatch`). */
     on: Record<string, unknown>;
+    /** The workflow's `defaults:`, set only for a workspace member: its jobs' `run:` steps start in the member's directory (#2542). */
+    defaults?: Record<string, unknown>;
     /**
      * The `env:` mapping: the caller's `variables`, plus `CHANT_ENV` naming the
      * deployed environment (#2046) — the machine-readable identity on the
@@ -80,6 +94,12 @@ export interface GithubPipelineDoc {
     /** Every generated job, for the machine-readable view. */
     jobs: GeneratedJob[];
 }
+/**
+ * The directory `actions/upload-artifact` roots a set of files at: the
+ * deepest directory that holds all of them. Downloading into it puts each
+ * file back at the path it was uploaded from.
+ */
+export declare function artifactRoot(paths: string[]): string;
 /**
  * Synthesize a `.github/workflows/*.yml` pipeline from a set of components:
  * one job per component, `needs:` expressing the wave-ordered dependency DAG

package/dist/components/generate-pipeline.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generate-pipeline.d.ts","sourceRoot":"","sources":["../../src/components/generate-pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AAGH,OAAO,EAAyB,KAAK,eAAe,EAAE,MAAM,oCAAoC,CAAC;AACjG,OAAO,KAAK,EACV,oBAAoB,IAAI,YAAY,EACpC,wBAAwB,IAAI,qBAAqB,EACjD,uBAAuB,IAAI,oBAAoB,EAChD,MAAM,0BAA0B,CAAC;AAElC,YAAY,EAAE,YAAY,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,CAAC;AAE1E;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;;;OAKG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,6FAA6F;IAC7F,WAAW,EAAE,MAAM,CAAC;IACpB,8DAA8D;IAC9D,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5B;;;;;;OAMG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,qDAAqD;IACrD,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,uEAAuE;IACvE,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,0DAA0D;IAC1D,IAAI,EAAE,YAAY,EAAE,CAAC;CACtB;AAmBD;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,eAAe,EAAE,EAC7B,OAAO,GAAE,qBAA0B,GAClC,iBAAiB,CA0FnB;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,iBAAiB,GAAG,MAAM,CAS/D;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,eAAe,EAAE,EAC7B,OAAO,GAAE,qBAA0B,GAClC,oBAAoB,CAGtB"}
+{"version":3,"file":"generate-pipeline.d.ts","sourceRoot":"","sources":["../../src/components/generate-pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AAGH,OAAO,EAAyB,KAAK,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAGjG,OAAO,KAAK,EACV,oBAAoB,IAAI,YAAY,EACpC,wBAAwB,IAAI,qBAAqB,EACjD,uBAAuB,IAAI,oBAAoB,EAEhD,MAAM,0BAA0B,CAAC;AAElC,YAAY,EAAE,YAAY,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,CAAC;AAE1E;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;;;OAKG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,6FAA6F;IAC7F,WAAW,EAAE,MAAM,CAAC;IACpB,8DAA8D;IAC9D,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5B,mIAAmI;IACnI,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC;;;;;;OAMG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,qDAAqD;IACrD,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,uEAAuE;IACvE,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,0DAA0D;IAC1D,IAAI,EAAE,YAAY,EAAE,CAAC;CACtB;AA6BD;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,CAWpD;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,eAAe,EAAE,EAC7B,OAAO,GAAE,qBAA0B,GAClC,iBAAiB,CAmKnB;AA4CD;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,iBAAiB,GAAG,MAAM,CAU/D;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,eAAe,EAAE,EAC7B,OAAO,GAAE,qBAA0B,GAClC,oBAAoB,CAGtB"}

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "ced24be037a4771c506d5c508c101750dc089c8b26dece0259cfca096577175b",
+    "manifest.json": "93741ee90f059cadf2ce97f95fca567e0e981e78e2cc50c75a85f614e117583e",
     "meta.json": "c50e0ef3845c370c3ad2210b8bba455980417c0f818aa6ed46e06d4fb8b1b9f9",
     "types/index.d.ts": "bdd54a4145a39a9dd4f7bbc8c500191acb6bc9057a87da0040475afac84db397",
     "rules/deprecated-action-version.ts": "d41e6e532ab7f623af1bee4ac5279fcb2baada7defa1c5d022a5bc71983e8797",
@@ -77,5 +77,5 @@
     "skills/chant-github-patterns.md": "bb3abef289a8fdfcf07d6bb2d7289dcb2f38bc0cb0321ea320b78b45a6f548c0",
     "skills/chant-github-security.md": "aab111cb0871cad30281ce48d7da23663689619351029219e2be019a1a61e394"
   },
-  "composite": "06574aff8eec2ef2e8bcbd09e2f1012920840d23301938b7e12d286984e12e80"
+  "composite": "7df3ad6322ccb0443c9fe7a07446d7a26c61bc4039099b893e9fb0f0c2d15d49"
 }

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "github",
-  "version": "0.79.0",
+  "version": "0.81.0",
   "chantVersion": ">=0.1.0",
   "namespace": "GitHub",
   "intrinsics": [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-github",
-  "version": "0.79.0",
+  "version": "0.81.0",
   "description": "GitHub Actions lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -61,7 +61,7 @@
     "typescript": "^5.9.3"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.79.0",
+    "@intentius/chant": "^0.81.0",
     "typescript": "^5.9.3"
   }
 }

package/src/components/generate-op-pipeline.test.ts

@@ -597,10 +597,13 @@ describe("generateGithubOpPipeline: a deployment environment on the Op's job (#2
    * The exact document a spec with no `environment` emitted before the option
    * existed, produced by the generator at the commit this change branched
    * from. The claim the option makes is that it is additive; this is what
-   * makes that claim falsifiable rather than a sentence in a PR body.
+   * makes that claim falsifiable rather than a sentence in a PR body. The
+   * `name:` line came later, from #2580, for every spec alike.
    */
   const AUDIT_YAML_BEFORE_2257 =
     [
+      "name: actions-audit",
+      "",
       "on:",
       "  schedule:",
       "    - cron: '0 6 * * *'",

package/src/components/generate-op-pipeline.ts

@@ -71,7 +71,7 @@
  */
 
 import { emitYAML } from "@intentius/chant/yaml";
-import { resolveOpTrigger } from "@intentius/chant/lexicon";
+import { memberPathFilter, resolveOpTrigger } from "@intentius/chant/lexicon";
 import type {
   ComponentPipelineOptions as GenerateGithubOpOptions,
   OpEnvironment,
@@ -80,6 +80,7 @@ import type {
   OpPipelineResult as GenerateGithubOpResult,
   OpSetupStep,
   OpTrigger,
+  PipelineMember,
   ScheduledOpSpec,
 } from "@intentius/chant/lexicon";
 
@@ -102,6 +103,12 @@ export interface GithubOpPipelineDoc {
    * rather than only in a build warning.
    */
   header?: string[];
+  /**
+   * The workflow's `name:` (#2580): the Op's name, so the Actions UI lists
+   * the workflow by its Op instead of its file name. The forgejo generator
+   * copies it too (#2601), since Forgejo Actions reads the key the same way.
+   */
+  name?: string;
   /**
    * The `on:` trigger mapping, per {@link ScheduledOpSpec}'s trigger kind
    * (#2084): `{ schedule, workflow_dispatch }` for cron, `{ pull_request }`
@@ -713,6 +720,7 @@ export function buildGithubOpPipelineDocs(
     for (const line of extraScript) steps.push({ run: line });
 
     const doc: GithubOpPipelineDoc = {
+      name: spec.name,
       on: onFor(trigger),
       ...(options.variables && Object.keys(options.variables).length > 0 ? { env: options.variables } : {}),
       // One run at a time per Op — a slow audit must not overlap its own next
@@ -757,9 +765,51 @@ export function buildGithubOpPipelineDocs(
     files.push({ name: `${spec.name}.yml`, doc });
   }
 
+  if (options.member) {
+    const member = options.member;
+    return { files: files.map((f) => scopeOpFileToMember(f, member)), jobs };
+  }
   return { files, jobs };
 }
 
+/**
+ * Scope one Op's workflow to a workspace member (#2542, #2524 D19). The file
+ * and the workflow take the member's name (`<member>-<op>.yml`, `<member>/<op>`)
+ * and so does the concurrency group, which GitHub keys across the whole
+ * repository. A `push` or `pull_request` trigger is filtered to the member's
+ * paths and this file; a cron trigger has no paths to filter. The Op's own
+ * job starts its `run:` steps in the member's directory. The gate-notice job
+ * checks nothing out and keeps the default.
+ */
+function scopeOpFileToMember(file: GithubOpPipelineFile, member: PipelineMember): GithubOpPipelineFile {
+  const name = `${member.name}-${file.name}`;
+  const paths = memberPathFilter(member, member.fileDir ? `${member.fileDir}/${name}` : undefined);
+  const on: Record<string, unknown> = { ...file.doc.on };
+  for (const event of ["push", "pull_request"]) {
+    if (event in on) on[event] = { ...(on[event] as Record<string, unknown>), paths };
+  }
+  const rooted = member.dir === "." || member.dir === "";
+  const jobsDoc = rooted
+    ? file.doc.jobsDoc
+    : Object.fromEntries(
+        Object.entries(file.doc.jobsDoc).map(([job, props]) => {
+          const { steps, ...rest } = props as Record<string, unknown>;
+          return [job, { ...rest, defaults: { run: { "working-directory": member.dir } }, steps }];
+        }),
+      );
+  const group = (file.doc.concurrency as { group?: unknown }).group;
+  return {
+    name,
+    doc: {
+      ...file.doc,
+      ...(file.doc.name ? { name: `${member.name}/${file.doc.name}` } : {}),
+      on,
+      concurrency: { ...file.doc.concurrency, ...(typeof group === "string" ? { group: `${member.name}-${group}` } : {}) },
+      jobsDoc,
+    },
+  };
+}
+
 /**
  * Emit a `GithubOpPipelineDoc`'s `on`/`env`/`concurrency`/`permissions`/`jobs`
  * mappings as workflow YAML. Shared with the forgejo dialect (#969), which
@@ -771,6 +821,7 @@ export function emitOpPipelineYAML(doc: GithubOpPipelineDoc): string {
   // one. Absent on github, so an unannotated document is emitted exactly as
   // it was before the field existed.
   if (doc.header && doc.header.length > 0) sections.push(doc.header.join("\n"));
+  if (doc.name) sections.push("name: " + emitYAML(doc.name, 0));
   sections.push("on:" + emitYAML(doc.on, 1));
   if (doc.env && Object.keys(doc.env).length > 0) sections.push("env:" + emitYAML(doc.env, 1));
   sections.push("concurrency:" + emitYAML(doc.concurrency, 1));

package/src/components/generate-pipeline.member.test.ts

@@ -0,0 +1,121 @@
+/**
+ * A workspace member's pipelines (#2542, #2524 D19): the component workflow
+ * and the Op workflows, scoped to one member through `options.member`.
+ * Without `options.member` both generators are unchanged, which the other
+ * suites in this directory hold.
+ */
+
+import { describe, test, expect } from "vitest";
+import { parseYAML } from "@intentius/chant/yaml";
+import type { DriverComponent } from "@intentius/chant/components/driver";
+import type { PipelineMember } from "@intentius/chant/lexicon";
+import { buildGithubPipelineDoc, generateGithubPipeline } from "./generate-pipeline";
+import { generateGithubOpPipeline } from "./generate-op-pipeline";
+
+const components: DriverComponent[] = [
+  { name: "shared-alb", dependsOn: [], deploy: [] },
+  {
+    name: "api",
+    dependsOn: ["shared-alb"],
+    deploy: [
+      { phase: "Build", steps: [{ kind: "docker-build", context: ".", into: "dist/api.tar" }] },
+      { phase: "Publish", steps: [{ kind: "publish-image", from: "archive:dist/api.tar" }] },
+    ],
+  },
+];
+
+const api: PipelineMember = { name: "api", dir: "services/api", file: ".github/workflows/chant-api-staging.yml" };
+
+interface Step {
+  uses?: string;
+  run?: string;
+  with?: Record<string, unknown>;
+}
+type Doc = {
+  name: string;
+  on: Record<string, { paths?: string[]; branches?: string[] } | null>;
+  defaults?: { run: { "working-directory": string } };
+  jobs: Record<string, { steps: Step[]; defaults?: { run: { "working-directory": string } } }>;
+};
+
+describe("generateGithubPipeline for a workspace member", () => {
+  test("the triggers are the plain pipeline's: no push or pull_request is added to a deploy pipeline", () => {
+    const member = parseYAML(generateGithubPipeline(components, { env: "staging", member: api }).yaml) as unknown as Doc;
+    const plain = parseYAML(generateGithubPipeline(components, { env: "staging" }).yaml) as unknown as Doc;
+    expect(member.on).toEqual(plain.on);
+    expect(Object.keys(member.on)).toEqual(["workflow_dispatch"]);
+  });
+
+  test("run steps start in the member's directory, and the name carries the member", () => {
+    const doc = parseYAML(generateGithubPipeline(components, { env: "staging", member: api }).yaml) as unknown as Doc;
+    expect(doc.defaults).toEqual({ run: { "working-directory": "services/api" } });
+    expect(doc.name).toBe("chant-components-api-staging");
+  });
+
+  test("artifact paths move under the member's directory, where the run steps write them", () => {
+    const doc = parseYAML(generateGithubPipeline(components, { env: "staging", promoteTo: "prod", member: api }).yaml) as unknown as Doc;
+    const shared = doc.jobs["shared-alb"].steps.find((s) => s.uses?.startsWith("actions/upload-artifact"));
+    expect(shared?.with?.path).toBe("services/api/shared-alb.outputs.json");
+    const download = doc.jobs["api"].steps.find((s) => s.uses?.startsWith("actions/download-artifact"));
+    expect(download?.with?.path).toBe("services/api");
+    const archive = doc.jobs["api"].steps.find((s) => (s.with?.name as string | undefined) === "api-archive");
+    expect(archive?.with?.path).toBe("services/api/dist/api.tar");
+    const promoteDownload = doc.jobs["promote-prod"].steps.find((s) => s.uses?.startsWith("actions/download-artifact"));
+    expect(promoteDownload?.with?.path).toBe("services/api/dist");
+    // The digest the promote job pins (#2602) is written and read by run
+    // steps, so it needs no path change.
+    expect(doc.jobs["api"].steps.some((s) => s.run?.includes("--digest-file api.digest"))).toBe(true);
+    expect(doc.jobs["promote-prod"].steps.some((s) => s.run?.includes('--digest "api=${{ needs.api.outputs.digest }}"'))).toBe(true);
+    // The run lines themselves are unchanged: they run in the member's directory.
+    expect(doc.jobs["api"].steps.some((s) => s.run?.includes("--seed-outputs shared-alb.outputs.json"))).toBe(true);
+  });
+
+  test("a member at the root keeps the root as its directory", () => {
+    const root: PipelineMember = { name: "platform", dir: ".", exclude: ["services/api", "examples/a"], file: ".github/workflows/chant-platform-prod.yml" };
+    const doc = buildGithubPipelineDoc(components, { env: "prod", member: root });
+    expect(doc.on).toEqual({ workflow_dispatch: {} });
+    expect(doc.defaults).toBeUndefined();
+    const upload = (doc.jobsDoc["shared-alb"] as { steps: Step[] }).steps.find((s) => s.uses?.startsWith("actions/upload-artifact"));
+    expect(upload?.with?.path).toBe("shared-alb.outputs.json");
+  });
+
+  test("two members' pipelines differ only where the member does", () => {
+    const web: PipelineMember = { name: "web", dir: "apps/web", file: ".github/workflows/chant-web-staging.yml" };
+    const a = generateGithubPipeline(components, { env: "staging", member: api });
+    const b = generateGithubPipeline(components, { env: "staging", member: web });
+    expect(a.yaml).not.toBe(b.yaml);
+    expect(a.jobs).toEqual(b.jobs);
+  });
+});
+
+describe("generateGithubOpPipeline for a workspace member", () => {
+  const member: PipelineMember = { name: "api", dir: "services/api", fileDir: ".github/workflows" };
+
+  test("files, workflow names and concurrency groups carry the member's name", () => {
+    const result = generateGithubOpPipeline([{ name: "nightly", trigger: { kind: "cron", schedule: "0 6 * * *" } }], { member });
+    expect(result.files.map((f) => f.name)).toEqual(["api-nightly.yml"]);
+    const doc = parseYAML(result.files[0].yaml) as unknown as Doc & { concurrency: { group: string } };
+    expect(doc.name).toBe("api/nightly");
+    expect(doc.concurrency.group).toBe("api-nightly");
+    // A cron trigger has no paths to filter.
+    expect(JSON.stringify(doc.on)).not.toContain("paths");
+    expect(doc.jobs["nightly"].defaults).toEqual({ run: { "working-directory": "services/api" } });
+  });
+
+  test("push and pull_request triggers are filtered to the member and the Op's own file", () => {
+    const result = generateGithubOpPipeline(
+      [
+        { name: "plan", trigger: { kind: "pull_request" } },
+        { name: "apply", trigger: { kind: "push" } },
+      ],
+      { member },
+    );
+    const plan = parseYAML(result.files[0].yaml) as unknown as Doc;
+    expect(plan.on.pull_request).toEqual({ paths: ["services/api/**", ".github/workflows/api-plan.yml"] });
+    const apply = parseYAML(result.files[1].yaml) as unknown as Doc;
+    expect(apply.on.push).toEqual({ branches: ["main"], paths: ["services/api/**", ".github/workflows/api-apply.yml"] });
+    // The gate-notice job checks nothing out, so it keeps the default directory.
+    expect(apply.jobs["apply-gate-notice"].defaults).toBeUndefined();
+    expect(apply.jobs["apply"].defaults).toEqual({ run: { "working-directory": "services/api" } });
+  });
+});

package/src/components/generate-pipeline.test.ts

@@ -19,7 +19,7 @@
 
 import { describe, test, expect } from "vitest";
 import { parseYAML } from "@intentius/chant/yaml";
-import { generateGithubPipeline } from "./generate-pipeline";
+import { artifactRoot, generateGithubPipeline } from "./generate-pipeline";
 import { resolveComponentGraph, DependencyCycleError, UnknownDependencyError, type DriverComponent } from "@intentius/chant/components/driver";
 import { searchService } from "@intentius/chant/components/pilots/alb-ecs.pilot";
 import { ordersTable } from "@intentius/chant/components/pilots/dynamodb.pilot";
@@ -35,6 +35,7 @@ function pilotComponents(): DriverComponent[] {
 
 interface ParsedStep {
   name?: string;
+  id?: string;
   uses?: string;
   run?: string;
   with?: Record<string, unknown>;
@@ -44,6 +45,7 @@ interface ParsedJob {
   "runs-on"?: string;
   container?: string;
   needs?: string[];
+  outputs?: Record<string, string>;
   steps: ParsedStep[];
 }
 
@@ -295,3 +297,127 @@ describe("generateGithubPipeline: options", () => {
     expect(runLines(jobs["shared-alb"])[0]).toContain("--env production");
   });
 });
+
+/** Two services that build and publish, one depending on the other, plus infra that builds nothing. */
+function promotableComponents(): DriverComponent[] {
+  const service = (name: string, into: string, dependsOn: string[] = []): DriverComponent => ({
+    name,
+    dependsOn,
+    deploy: [
+      { phase: "Build", steps: [{ kind: "docker-build", context: ".", into }] },
+      { phase: "Publish", steps: [{ kind: "publish-image", from: `archive:${into}`, to: "$env.registry" }] },
+    ],
+  });
+  return [
+    { name: "shared-alb", dependsOn: [], deploy: [] },
+    service("api", "dist/images/api.tar", ["shared-alb"]),
+    service("worker", "worker.tar"),
+  ];
+}
+
+describe("generateGithubPipeline: a promote job (#2575)", () => {
+  test("without promoteTo the pipeline is unchanged: no archive upload, no promote job", () => {
+    const yaml = generateGithubPipeline(promotableComponents(), { env: "staging" }).yaml;
+    expect(yaml).not.toContain("promote");
+    expect(yaml).not.toContain("build archive");
+  });
+
+  test("each building job uploads its archive, and the promote job downloads it back to the same path", () => {
+    const result = generateGithubPipeline(promotableComponents(), { env: "staging", promoteTo: "prod" });
+    const jobs = parsedJobs(result.yaml);
+
+    const upload = jobs["api"].steps.find((s) => s.name === "Upload api build archive")!;
+    expect(upload.uses).toBe("actions/upload-artifact@v4");
+    expect(upload.with).toEqual({
+      name: "api-archive",
+      path: "dist/images/api.tar",
+      "if-no-files-found": "error",
+      "include-hidden-files": true,
+    });
+    expect(jobs["shared-alb"].steps.some((s) => s.name?.includes("build archive"))).toBe(false);
+
+    const promote = jobs["promote-prod"];
+    expect(promote.needs).toEqual(["api", "shared-alb", "worker"]);
+    expect(promote.container).toBe("node:22-slim");
+    const downloads = promote.steps.filter((s) => s.uses === "actions/download-artifact@v4");
+    expect(downloads.map((s) => s.with)).toEqual([
+      { name: "api-archive", path: "dist/images" },
+      { name: "worker-archive", path: "." },
+    ]);
+    expect(runLines(promote)).toEqual([
+      'chant components promote --from staging --to prod --digest "api=${{ needs.api.outputs.digest }}" --digest "worker=${{ needs.worker.outputs.digest }}"',
+    ]);
+
+    // The machine-readable views stay one entry per component.
+    expect(result.jobs.map((j) => j.component).sort()).toEqual(["api", "shared-alb", "worker"]);
+  });
+
+  test("the promote job runs the same beforeScript and extraScript, and promoteCommand replaces its command", () => {
+    const result = generateGithubPipeline(promotableComponents(), {
+      env: "staging",
+      promoteTo: "prod",
+      beforeScript: ["npm ci"],
+      extraScript: ["echo done"],
+      promoteCommand: ["npx", "chant", "components", "promote", "--from", "staging", "--to", "prod"],
+    });
+    expect(runLines(parsedJobs(result.yaml)["promote-prod"])).toEqual([
+      "npm ci",
+      'npx chant components promote --from staging --to prod --digest "api=${{ needs.api.outputs.digest }}" --digest "worker=${{ needs.worker.outputs.digest }}"',
+      "echo done",
+    ]);
+  });
+
+  test("a build step writing to a path known only at run time is refused", () => {
+    const components: DriverComponent[] = [
+      { name: "api", deploy: [{ phase: "Build", steps: [{ kind: "docker-build", into: "$env.archive" }] }] },
+    ];
+    expect(() => generateGithubPipeline(components, { promoteTo: "prod" })).toThrow(/not a literal path/);
+    expect(() => generateGithubPipeline(components)).not.toThrow();
+  });
+
+  test("a component whose job name is the promote job's is refused", () => {
+    const components: DriverComponent[] = [
+      { name: "promote-prod", deploy: [{ phase: "Publish", steps: [{ kind: "publish-image", from: "archive:a.tar" }] }] },
+    ];
+    expect(() => generateGithubPipeline(components, { promoteTo: "prod" })).toThrow(/same name as a component job/);
+  });
+
+  test("each publishing job hands the digest its run recorded to the promote job, which pins it (#2602)", () => {
+    const jobs = parsedJobs(generateGithubPipeline(promotableComponents(), { env: "staging", promoteTo: "prod" }).yaml);
+
+    for (const name of ["api", "worker"]) {
+      const job = jobs[name];
+      // The run writes `<component>=<digest>` for the release it recorded ...
+      expect(runLines(job).find((l) => l.startsWith("chant run"))).toContain(`--digest-file ${name}.digest`);
+      // ... a step turns it into a step output, and the job exposes it.
+      const record = job.steps.find((s) => s.name === `Record ${name} digest`)!;
+      expect(record.id).toBe("digest");
+      expect(record.run).toBe(`echo "digest=$(cut -d= -f2- ${name}.digest)" >> "$GITHUB_OUTPUT"`);
+      expect(job.outputs).toEqual({ digest: "${{ steps.digest.outputs.digest }}" });
+    }
+
+    // shared-alb publishes nothing, so it records no release and is not pinned.
+    expect(jobs["shared-alb"].outputs).toBeUndefined();
+    expect(runLines(jobs["shared-alb"]).join("\n")).not.toContain("--digest-file");
+
+    const promote = runLines(jobs["promote-prod"]).find((l) => l.includes("components promote"))!;
+    expect(promote).toContain('--digest "api=${{ needs.api.outputs.digest }}"');
+    expect(promote).toContain('--digest "worker=${{ needs.worker.outputs.digest }}"');
+    expect(promote).not.toContain("shared-alb=");
+  });
+
+  test("with no component that publishes, there is no release to pin, and generation fails", () => {
+    const components: DriverComponent[] = [{ name: "shared-alb", dependsOn: [], deploy: [] }];
+    expect(() => generateGithubPipeline(components, { promoteTo: "prod" })).toThrow(/no component has a publish step/);
+    expect(() => generateGithubPipeline(components)).not.toThrow();
+  });
+
+  test("artifactRoot is the deepest directory holding every file", () => {
+    expect(artifactRoot(["archive"])).toBe(".");
+    expect(artifactRoot(["dist/a.tar"])).toBe("dist");
+    expect(artifactRoot(["dist/a/x.tar", "dist/b/y.zip"])).toBe("dist");
+    expect(artifactRoot(["dist/a.tar", "b.zip"])).toBe(".");
+    expect(artifactRoot(["./dist/a.tar"])).toBe("dist");
+    expect(artifactRoot(["/tmp/out/a.tar", "/tmp/out/b.tar"])).toBe("/tmp/out");
+  });
+});

package/src/components/generate-pipeline.ts

@@ -35,6 +35,18 @@
  *    uses, and matches gitlab's artifact-passing 1:1 in intent — only the
  *    transport differs (explicit upload/download steps vs. GitLab's implicit
  *    `needs:` artifact passing).
+ *  - With `options.promoteTo` (#2575), one more job needs every component
+ *    job and runs `chant components promote`. A promote publishes from the
+ *    build archive on disk, so each component job uploads the files its
+ *    build steps wrote and the promote job downloads them to the same paths.
+ *    Each component job with a publish step also writes the digest its run
+ *    recorded (`--digest-file`) to a job output, and the promote job passes
+ *    it back as `--digest <component>=<digest>` (#2602), so it promotes the
+ *    release this run built rather than whatever is latest in the source
+ *    environment.
+ *  - For a workspace member (`options.member`, #2542) the workflow keeps its
+ *    triggers, and its `run:` steps start in the member's directory. See
+ *    `scopeToMember`.
  *
  * Cross-cutting changes (e.g. "sign every image before deploy") are made by
  * editing `GenerateGithubOptions.extraScript`/`beforeScript` (or the
@@ -46,10 +58,13 @@
 
 import { emitYAML } from "@intentius/chant/yaml";
 import { resolveComponentGraph, type DriverComponent } from "@intentius/chant/components/driver";
+import { hasPublishStep, promoteArchivePaths } from "@intentius/chant/components/promote";
+import { memberRepoPath } from "@intentius/chant/lexicon";
 import type {
   ComponentPipelineJob as GeneratedJob,
   ComponentPipelineOptions as GenerateGithubOptions,
   ComponentPipelineResult as GenerateGithubResult,
+  PipelineMember,
 } from "@intentius/chant/lexicon";
 
 export type { GeneratedJob, GenerateGithubOptions, GenerateGithubResult };
@@ -73,6 +88,8 @@ export interface GithubPipelineDoc {
   environment: string;
   /** The `on:` trigger mapping (a bare `workflow_dispatch`). */
   on: Record<string, unknown>;
+  /** The workflow's `defaults:`, set only for a workspace member: its jobs' `run:` steps start in the member's directory (#2542). */
+  defaults?: Record<string, unknown>;
   /**
    * The `env:` mapping: the caller's `variables`, plus `CHANT_ENV` naming the
    * deployed environment (#2046) — the machine-readable identity on the
@@ -106,6 +123,34 @@ function artifactName(name: string): string {
   return `${name}-outputs`;
 }
 
+/** The file a component job writes the digest its run recorded to, for the promote job (#2602). */
+function digestFile(name: string): string {
+  return `${name}.digest`;
+}
+
+/** The workflow artifact name a component's build archive is uploaded under, for the promote job (#2575). */
+function archiveArtifactName(name: string): string {
+  return `${name}-archive`;
+}
+
+/**
+ * The directory `actions/upload-artifact` roots a set of files at: the
+ * deepest directory that holds all of them. Downloading into it puts each
+ * file back at the path it was uploaded from.
+ */
+export function artifactRoot(paths: string[]): string {
+  const dirs = paths.map((p) => {
+    const parts = p.replace(/\/+$/, "").split("/");
+    parts.pop();
+    return parts.filter((part) => part !== "" && part !== ".");
+  });
+  const common: string[] = [];
+  for (let i = 0; dirs.every((d) => i < d.length && d[i] === dirs[0][i]); i++) common.push(dirs[0][i]);
+  const absolute = paths.every((p) => p.startsWith("/"));
+  if (common.length === 0) return absolute ? "/" : ".";
+  return (absolute ? "/" : "") + common.join("/");
+}
+
 /**
  * Synthesize a `.github/workflows/*.yml` pipeline from a set of components:
  * one job per component, `needs:` expressing the wave-ordered dependency DAG
@@ -139,6 +184,25 @@ export function buildGithubPipelineDoc(
   const dependedUpon = new Set<string>();
   for (const c of components) for (const dep of c.dependsOn ?? []) dependedUpon.add(dep);
 
+  // A promote job (#2575) runs on its own runner, and a promote publishes from
+  // the build archive on disk, so each component job uploads the files its
+  // build steps wrote and the promote job downloads them.
+  const promoteTo = options.promoteTo;
+  const archives = new Map<string, string[]>();
+  // The components the promote job pins to this run's digest (#2602): those
+  // with a publish step, the only ones whose deploy records a release.
+  const pinned = new Set<string>();
+  if (promoteTo !== undefined) {
+    for (const c of components) {
+      const paths = promoteArchivePaths(c);
+      if (paths.length > 0) archives.set(c.name, paths);
+      if (hasPublishStep(c)) pinned.add(c.name);
+    }
+    if (pinned.size === 0) {
+      throw new Error("no component has a publish step, so no deploy records a release for the promote job to promote");
+    }
+  }
+
   const stages = waves.map((_, i) => `wave-${i + 1}`);
   const jobs: GeneratedJob[] = [];
   const jobNameByComponent = new Map<string, string>();
@@ -163,6 +227,7 @@ export function buildGithubPipelineDoc(
       const runParts = runCommand.map((part) => part.replace("{name}", name));
       for (const dep of component.dependsOn ?? []) runParts.push("--seed-outputs", outputsFile(dep));
       if (dependedUpon.has(name)) runParts.push("--dump-outputs", outputsFile(name));
+      if (pinned.has(name)) runParts.push("--digest-file", digestFile(name));
 
       // One step per script line — mirrors gitlab's `script:` array of
       // discrete shell lines, rather than a single multi-line `run:` block, so
@@ -181,6 +246,15 @@ export function buildGithubPipelineDoc(
       steps.push({ run: runParts.join(" ") });
       for (const line of extraScript) steps.push({ run: line });
 
+      // The file holds `<component>=<digest>`; the job output holds the digest.
+      if (pinned.has(name)) {
+        steps.push({
+          name: `Record ${name} digest`,
+          id: "digest",
+          run: `echo "digest=$(cut -d= -f2- ${digestFile(name)})" >> "$GITHUB_OUTPUT"`,
+        });
+      }
+
       if (dependedUpon.has(name)) {
         steps.push({
           name: `Upload ${name} outputs`,
@@ -189,17 +263,60 @@ export function buildGithubPipelineDoc(
         });
       }
 
+      const archive = archives.get(name);
+      if (archive) {
+        steps.push({
+          name: `Upload ${name} build archive`,
+          uses: "actions/upload-artifact@v4",
+          with: {
+            name: archiveArtifactName(name),
+            path: archive.join("\n"),
+            "if-no-files-found": "error",
+            "include-hidden-files": true,
+          },
+        });
+      }
+
       const jobProps: Record<string, unknown> = {
         "runs-on": "ubuntu-latest",
         ...(needs.length > 0 ? { needs } : {}),
         container: image,
+        ...(pinned.has(name) ? { outputs: { digest: "${{ steps.digest.outputs.digest }}" } } : {}),
         steps,
       };
       jobsDoc[jobName] = jobProps;
     }
   });
 
-  return {
+  if (promoteTo !== undefined) {
+    const promoteJob = `promote-${toJobName(promoteTo)}`;
+    if (promoteJob in jobsDoc) {
+      throw new Error(`the promote job "${promoteJob}" has the same name as a component job; rename the component`);
+    }
+    const command = [...(options.promoteCommand ?? ["chant", "components", "promote", "--from", env, "--to", promoteTo])];
+    for (const name of [...pinned].sort()) {
+      command.push("--digest", `"${name}=\${{ needs.${jobNameByComponent.get(name)!}.outputs.digest }}"`);
+    }
+    const steps: Array<Record<string, unknown>> = [{ uses: "actions/checkout@v4" }];
+    for (const [name, paths] of archives) {
+      steps.push({
+        name: `Download ${name} build archive`,
+        uses: "actions/download-artifact@v4",
+        with: { name: archiveArtifactName(name), path: artifactRoot(paths) },
+      });
+    }
+    for (const line of beforeScript) steps.push({ run: line });
+    steps.push({ run: command.join(" ") });
+    for (const line of extraScript) steps.push({ run: line });
+    jobsDoc[promoteJob] = {
+      "runs-on": "ubuntu-latest",
+      needs: [...jobNameByComponent.values()].sort(),
+      container: image,
+      steps,
+    };
+  }
+
+  const doc: GithubPipelineDoc = {
     name: `chant-components-${env}`,
     environment: env,
     on: { workflow_dispatch: {} },
@@ -208,6 +325,49 @@ export function buildGithubPipelineDoc(
     stages,
     jobs,
   };
+  return options.member ? scopeToMember(doc, options.member) : doc;
+}
+
+/**
+ * Scope a pipeline to one workspace member (#2542, #2524 D19). Its name
+ * carries the member's name, and every `run:` step starts in the member's
+ * directory through `defaults.run.working-directory`.
+ *
+ * The triggers stay exactly the plain pipeline's. A deploy pipeline gains no
+ * `push` or `pull_request` trigger for a member, and its only trigger,
+ * `workflow_dispatch`, takes no `paths:` filter.
+ *
+ * `working-directory` applies to `run:` steps only. The artifact actions
+ * resolve `path` against the repository root, so each upload and download
+ * path moves under the member's directory, where the `run:` steps read and
+ * write the files.
+ */
+function scopeToMember(doc: GithubPipelineDoc, member: PipelineMember): GithubPipelineDoc {
+  const rooted = member.dir === "." || member.dir === "";
+  const jobsDoc: Record<string, unknown> = {};
+  for (const [name, job] of Object.entries(doc.jobsDoc)) {
+    const props = job as { steps?: Array<Record<string, unknown>> };
+    jobsDoc[name] = rooted || !props.steps ? job : { ...props, steps: props.steps.map((step) => memberArtifactStep(step, member)) };
+  }
+  return {
+    ...doc,
+    name: `chant-components-${member.name}-${doc.environment}`,
+    ...(rooted ? {} : { defaults: { run: { "working-directory": member.dir } } }),
+    jobsDoc,
+  };
+}
+
+/** An `actions/upload-artifact` or `download-artifact` step with its `path` moved under the member's directory. */
+function memberArtifactStep(step: Record<string, unknown>, member: PipelineMember): Record<string, unknown> {
+  const uses = typeof step.uses === "string" ? step.uses : "";
+  if (!/^actions\/(upload|download)-artifact@/.test(uses)) return step;
+  const withProps = step.with as Record<string, unknown> | undefined;
+  if (!withProps || typeof withProps.path !== "string") return step;
+  const path = withProps.path
+    .split("\n")
+    .map((line) => memberRepoPath(member, line))
+    .join("\n");
+  return { ...step, with: { ...withProps, path } };
 }
 
 /**
@@ -221,6 +381,7 @@ export function emitPipelineYAML(doc: GithubPipelineDoc): string {
   if (doc.env && Object.keys(doc.env).length > 0) {
     sections.push("env:" + emitYAML(doc.env, 1));
   }
+  if (doc.defaults) sections.push("defaults:" + emitYAML(doc.defaults, 1));
   sections.push("jobs:" + emitYAML(doc.jobsDoc, 1));
   return sections.join("\n\n") + "\n";
 }