@intentius/chant-lexicon-github 0.80.0 → 0.82.0

package/dist/components/generate-op-pipeline.d.ts

@@ -90,8 +90,8 @@ export interface GithubOpPipelineDoc {
     header?: string[];
     /**
      * The workflow's `name:` (#2580): the Op's name, so the Actions UI lists
-     * the workflow by its Op instead of its file name. The forgejo dialect
-     * does not copy it, so forgejo output is unchanged.
+     * the workflow by its Op instead of its file name. The forgejo generator
+     * copies it too (#2601), since Forgejo Actions reads the key the same way.
      */
     name?: string;
     /**

package/dist/components/generate-op-pipeline.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generate-op-pipeline.d.ts","sourceRoot":"","sources":["../../src/components/generate-op-pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsEG;AAIH,OAAO,KAAK,EACV,wBAAwB,IAAI,uBAAuB,EACnD,aAAa,EAEb,aAAa,EACb,gBAAgB,IAAI,sBAAsB,EAC1C,WAAW,EACX,SAAS,EACT,eAAe,EAChB,MAAM,0BAA0B,CAAC;AAElC,YAAY,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,CAAC;AAEhE;;;;;;GAMG;AACH,MAAM,WAAW,mBAAmB;IAClC;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5B,2DAA2D;IAC3D,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,6DAA6D;IAC7D,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC;;;;OAIG;IACH,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,8DAA8D;IAC9D,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC;;;;;;;;;OASG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC1C;AAED,qFAAqF;AACrF,MAAM,WAAW,oBAAoB;IACnC,4FAA4F;IAC5F,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,mBAAmB,CAAC;CAC1B;AAmUD;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,IAAI,CA8BzE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,aAAa,GAAG,IAAI,CAwBhF;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,EACtC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,EAC1C,OAAO,EAAE,SAAS,GACjB,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,CAqClC;AA6BD;;;;;GAKG;AACH,MAAM,WAAW,wCAAwC;IACvD;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,eAAe,EAAE,EACtB,OAAO,GAAE,uBAA4B,EACrC,eAAe,GAAE,wCAA6C,GAC7D;IAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;IAAC,IAAI,EAAE,aAAa,EAAE,CAAA;CAAE,CA8F1D;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,mBAAmB,GAAG,MAAM,CAgBnE;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,eAAe,EAAE,EACtB,OAAO,GAAE,uBAA4B,GACpC,sBAAsB,CAMxB"}
+{"version":3,"file":"generate-op-pipeline.d.ts","sourceRoot":"","sources":["../../src/components/generate-op-pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsEG;AAIH,OAAO,KAAK,EACV,wBAAwB,IAAI,uBAAuB,EACnD,aAAa,EAEb,aAAa,EACb,gBAAgB,IAAI,sBAAsB,EAC1C,WAAW,EACX,SAAS,EAET,eAAe,EAChB,MAAM,0BAA0B,CAAC;AAElC,YAAY,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,CAAC;AAEhE;;;;;;GAMG;AACH,MAAM,WAAW,mBAAmB;IAClC;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5B,2DAA2D;IAC3D,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,6DAA6D;IAC7D,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC;;;;OAIG;IACH,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,8DAA8D;IAC9D,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC;;;;;;;;;OASG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC1C;AAED,qFAAqF;AACrF,MAAM,WAAW,oBAAoB;IACnC,4FAA4F;IAC5F,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,mBAAmB,CAAC;CAC1B;AAmUD;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,IAAI,CA8BzE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,aAAa,GAAG,IAAI,CAwBhF;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,EACtC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,EAC1C,OAAO,EAAE,SAAS,GACjB,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,CAqClC;AA6BD;;;;;GAKG;AACH,MAAM,WAAW,wCAAwC;IACvD;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,eAAe,EAAE,EACtB,OAAO,GAAE,uBAA4B,EACrC,eAAe,GAAE,wCAA6C,GAC7D;IAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;IAAC,IAAI,EAAE,aAAa,EAAE,CAAA;CAAE,CAkG1D;AAwCD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,mBAAmB,GAAG,MAAM,CAgBnE;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,eAAe,EAAE,EACtB,OAAO,GAAE,uBAA4B,GACpC,sBAAsB,CAMxB"}

package/dist/components/generate-pipeline.d.ts

@@ -39,6 +39,14 @@
  *    job and runs `chant components promote`. A promote publishes from the
  *    build archive on disk, so each component job uploads the files its
  *    build steps wrote and the promote job downloads them to the same paths.
+ *    Each component job with a publish step also writes the digest its run
+ *    recorded (`--digest-file`) to a job output, and the promote job passes
+ *    it back as `--digest <component>=<digest>` (#2602), so it promotes the
+ *    release this run built rather than whatever is latest in the source
+ *    environment.
+ *  - For a workspace member (`options.member`, #2542) the workflow keeps its
+ *    triggers, and its `run:` steps start in the member's directory. See
+ *    `scopeToMember`.
  *
  * Cross-cutting changes (e.g. "sign every image before deploy") are made by
  * editing `GenerateGithubOptions.extraScript`/`beforeScript` (or the
@@ -69,6 +77,8 @@ export interface GithubPipelineDoc {
     environment: string;
     /** The `on:` trigger mapping (a bare `workflow_dispatch`). */
     on: Record<string, unknown>;
+    /** The workflow's `defaults:`, set only for a workspace member: its jobs' `run:` steps start in the member's directory (#2542). */
+    defaults?: Record<string, unknown>;
     /**
      * The `env:` mapping: the caller's `variables`, plus `CHANT_ENV` naming the
      * deployed environment (#2046) — the machine-readable identity on the

package/dist/components/generate-pipeline.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generate-pipeline.d.ts","sourceRoot":"","sources":["../../src/components/generate-pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AAGH,OAAO,EAAyB,KAAK,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAEjG,OAAO,KAAK,EACV,oBAAoB,IAAI,YAAY,EACpC,wBAAwB,IAAI,qBAAqB,EACjD,uBAAuB,IAAI,oBAAoB,EAChD,MAAM,0BAA0B,CAAC;AAElC,YAAY,EAAE,YAAY,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,CAAC;AAE1E;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;;;OAKG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,6FAA6F;IAC7F,WAAW,EAAE,MAAM,CAAC;IACpB,8DAA8D;IAC9D,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5B;;;;;;OAMG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,qDAAqD;IACrD,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,uEAAuE;IACvE,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,0DAA0D;IAC1D,IAAI,EAAE,YAAY,EAAE,CAAC;CACtB;AAwBD;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,CAWpD;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,eAAe,EAAE,EAC7B,OAAO,GAAE,qBAA0B,GAClC,iBAAiB,CA6InB;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,iBAAiB,GAAG,MAAM,CAS/D;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,eAAe,EAAE,EAC7B,OAAO,GAAE,qBAA0B,GAClC,oBAAoB,CAGtB"}
+{"version":3,"file":"generate-pipeline.d.ts","sourceRoot":"","sources":["../../src/components/generate-pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AAGH,OAAO,EAAyB,KAAK,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAGjG,OAAO,KAAK,EACV,oBAAoB,IAAI,YAAY,EACpC,wBAAwB,IAAI,qBAAqB,EACjD,uBAAuB,IAAI,oBAAoB,EAEhD,MAAM,0BAA0B,CAAC;AAElC,YAAY,EAAE,YAAY,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,CAAC;AAE1E;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;;;OAKG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,6FAA6F;IAC7F,WAAW,EAAE,MAAM,CAAC;IACpB,8DAA8D;IAC9D,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5B,mIAAmI;IACnI,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC;;;;;;OAMG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,qDAAqD;IACrD,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,uEAAuE;IACvE,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,0DAA0D;IAC1D,IAAI,EAAE,YAAY,EAAE,CAAC;CACtB;AA6BD;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,CAWpD;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,eAAe,EAAE,EAC7B,OAAO,GAAE,qBAA0B,GAClC,iBAAiB,CAmKnB;AA4CD;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,iBAAiB,GAAG,MAAM,CAU/D;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,eAAe,EAAE,EAC7B,OAAO,GAAE,qBAA0B,GAClC,oBAAoB,CAGtB"}

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "7c9fa1fee6182c66eda6e2ea0f281b518e72064c620740702f1c48dfbbdd46f1",
+    "manifest.json": "e2c34c0eb49fff6d71f126a0752d31e9804d0dd4ee74cdd6ee2cad3494cdab9b",
     "meta.json": "c50e0ef3845c370c3ad2210b8bba455980417c0f818aa6ed46e06d4fb8b1b9f9",
     "types/index.d.ts": "bdd54a4145a39a9dd4f7bbc8c500191acb6bc9057a87da0040475afac84db397",
     "rules/deprecated-action-version.ts": "d41e6e532ab7f623af1bee4ac5279fcb2baada7defa1c5d022a5bc71983e8797",
@@ -77,5 +77,5 @@
     "skills/chant-github-patterns.md": "bb3abef289a8fdfcf07d6bb2d7289dcb2f38bc0cb0321ea320b78b45a6f548c0",
     "skills/chant-github-security.md": "aab111cb0871cad30281ce48d7da23663689619351029219e2be019a1a61e394"
   },
-  "composite": "1809da7db679ed9d9380d1fa046864be900a4d0b5e5209152dfd61d5460dde3f"
+  "composite": "e4124f381061044d53cc93be2a0a0f34899ca7bd4636aaff8c894a7c06aa74c0"
 }

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "github",
-  "version": "0.80.0",
+  "version": "0.82.0",
   "chantVersion": ">=0.1.0",
   "namespace": "GitHub",
   "intrinsics": [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-github",
-  "version": "0.80.0",
+  "version": "0.82.0",
   "description": "GitHub Actions lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -61,7 +61,7 @@
     "typescript": "^5.9.3"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.80.0",
+    "@intentius/chant": "^0.82.0",
     "typescript": "^5.9.3"
   }
 }

package/src/components/generate-op-pipeline.ts

@@ -71,7 +71,7 @@
  */
 
 import { emitYAML } from "@intentius/chant/yaml";
-import { resolveOpTrigger } from "@intentius/chant/lexicon";
+import { memberPathFilter, resolveOpTrigger } from "@intentius/chant/lexicon";
 import type {
   ComponentPipelineOptions as GenerateGithubOpOptions,
   OpEnvironment,
@@ -80,6 +80,7 @@ import type {
   OpPipelineResult as GenerateGithubOpResult,
   OpSetupStep,
   OpTrigger,
+  PipelineMember,
   ScheduledOpSpec,
 } from "@intentius/chant/lexicon";
 
@@ -104,8 +105,8 @@ export interface GithubOpPipelineDoc {
   header?: string[];
   /**
    * The workflow's `name:` (#2580): the Op's name, so the Actions UI lists
-   * the workflow by its Op instead of its file name. The forgejo dialect
-   * does not copy it, so forgejo output is unchanged.
+   * the workflow by its Op instead of its file name. The forgejo generator
+   * copies it too (#2601), since Forgejo Actions reads the key the same way.
    */
   name?: string;
   /**
@@ -764,9 +765,51 @@ export function buildGithubOpPipelineDocs(
     files.push({ name: `${spec.name}.yml`, doc });
   }
 
+  if (options.member) {
+    const member = options.member;
+    return { files: files.map((f) => scopeOpFileToMember(f, member)), jobs };
+  }
   return { files, jobs };
 }
 
+/**
+ * Scope one Op's workflow to a workspace member (#2542, #2524 D19). The file
+ * and the workflow take the member's name (`<member>-<op>.yml`, `<member>/<op>`)
+ * and so does the concurrency group, which GitHub keys across the whole
+ * repository. A `push` or `pull_request` trigger is filtered to the member's
+ * paths and this file; a cron trigger has no paths to filter. The Op's own
+ * job starts its `run:` steps in the member's directory. The gate-notice job
+ * checks nothing out and keeps the default.
+ */
+function scopeOpFileToMember(file: GithubOpPipelineFile, member: PipelineMember): GithubOpPipelineFile {
+  const name = `${member.name}-${file.name}`;
+  const paths = memberPathFilter(member, member.fileDir ? `${member.fileDir}/${name}` : undefined);
+  const on: Record<string, unknown> = { ...file.doc.on };
+  for (const event of ["push", "pull_request"]) {
+    if (event in on) on[event] = { ...(on[event] as Record<string, unknown>), paths };
+  }
+  const rooted = member.dir === "." || member.dir === "";
+  const jobsDoc = rooted
+    ? file.doc.jobsDoc
+    : Object.fromEntries(
+        Object.entries(file.doc.jobsDoc).map(([job, props]) => {
+          const { steps, ...rest } = props as Record<string, unknown>;
+          return [job, { ...rest, defaults: { run: { "working-directory": member.dir } }, steps }];
+        }),
+      );
+  const group = (file.doc.concurrency as { group?: unknown }).group;
+  return {
+    name,
+    doc: {
+      ...file.doc,
+      ...(file.doc.name ? { name: `${member.name}/${file.doc.name}` } : {}),
+      on,
+      concurrency: { ...file.doc.concurrency, ...(typeof group === "string" ? { group: `${member.name}-${group}` } : {}) },
+      jobsDoc,
+    },
+  };
+}
+
 /**
  * Emit a `GithubOpPipelineDoc`'s `on`/`env`/`concurrency`/`permissions`/`jobs`
  * mappings as workflow YAML. Shared with the forgejo dialect (#969), which

package/src/components/generate-pipeline.member.test.ts

@@ -0,0 +1,121 @@
+/**
+ * A workspace member's pipelines (#2542, #2524 D19): the component workflow
+ * and the Op workflows, scoped to one member through `options.member`.
+ * Without `options.member` both generators are unchanged, which the other
+ * suites in this directory hold.
+ */
+
+import { describe, test, expect } from "vitest";
+import { parseYAML } from "@intentius/chant/yaml";
+import type { DriverComponent } from "@intentius/chant/components/driver";
+import type { PipelineMember } from "@intentius/chant/lexicon";
+import { buildGithubPipelineDoc, generateGithubPipeline } from "./generate-pipeline";
+import { generateGithubOpPipeline } from "./generate-op-pipeline";
+
+const components: DriverComponent[] = [
+  { name: "shared-alb", dependsOn: [], deploy: [] },
+  {
+    name: "api",
+    dependsOn: ["shared-alb"],
+    deploy: [
+      { phase: "Build", steps: [{ kind: "docker-build", context: ".", into: "dist/api.tar" }] },
+      { phase: "Publish", steps: [{ kind: "publish-image", from: "archive:dist/api.tar" }] },
+    ],
+  },
+];
+
+const api: PipelineMember = { name: "api", dir: "services/api", file: ".github/workflows/chant-api-staging.yml" };
+
+interface Step {
+  uses?: string;
+  run?: string;
+  with?: Record<string, unknown>;
+}
+type Doc = {
+  name: string;
+  on: Record<string, { paths?: string[]; branches?: string[] } | null>;
+  defaults?: { run: { "working-directory": string } };
+  jobs: Record<string, { steps: Step[]; defaults?: { run: { "working-directory": string } } }>;
+};
+
+describe("generateGithubPipeline for a workspace member", () => {
+  test("the triggers are the plain pipeline's: no push or pull_request is added to a deploy pipeline", () => {
+    const member = parseYAML(generateGithubPipeline(components, { env: "staging", member: api }).yaml) as unknown as Doc;
+    const plain = parseYAML(generateGithubPipeline(components, { env: "staging" }).yaml) as unknown as Doc;
+    expect(member.on).toEqual(plain.on);
+    expect(Object.keys(member.on)).toEqual(["workflow_dispatch"]);
+  });
+
+  test("run steps start in the member's directory, and the name carries the member", () => {
+    const doc = parseYAML(generateGithubPipeline(components, { env: "staging", member: api }).yaml) as unknown as Doc;
+    expect(doc.defaults).toEqual({ run: { "working-directory": "services/api" } });
+    expect(doc.name).toBe("chant-components-api-staging");
+  });
+
+  test("artifact paths move under the member's directory, where the run steps write them", () => {
+    const doc = parseYAML(generateGithubPipeline(components, { env: "staging", promoteTo: "prod", member: api }).yaml) as unknown as Doc;
+    const shared = doc.jobs["shared-alb"].steps.find((s) => s.uses?.startsWith("actions/upload-artifact"));
+    expect(shared?.with?.path).toBe("services/api/shared-alb.outputs.json");
+    const download = doc.jobs["api"].steps.find((s) => s.uses?.startsWith("actions/download-artifact"));
+    expect(download?.with?.path).toBe("services/api");
+    const archive = doc.jobs["api"].steps.find((s) => (s.with?.name as string | undefined) === "api-archive");
+    expect(archive?.with?.path).toBe("services/api/dist/api.tar");
+    const promoteDownload = doc.jobs["promote-prod"].steps.find((s) => s.uses?.startsWith("actions/download-artifact"));
+    expect(promoteDownload?.with?.path).toBe("services/api/dist");
+    // The digest the promote job pins (#2602) is written and read by run
+    // steps, so it needs no path change.
+    expect(doc.jobs["api"].steps.some((s) => s.run?.includes("--digest-file api.digest"))).toBe(true);
+    expect(doc.jobs["promote-prod"].steps.some((s) => s.run?.includes('--digest "api=${{ needs.api.outputs.digest }}"'))).toBe(true);
+    // The run lines themselves are unchanged: they run in the member's directory.
+    expect(doc.jobs["api"].steps.some((s) => s.run?.includes("--seed-outputs shared-alb.outputs.json"))).toBe(true);
+  });
+
+  test("a member at the root keeps the root as its directory", () => {
+    const root: PipelineMember = { name: "platform", dir: ".", exclude: ["services/api", "examples/a"], file: ".github/workflows/chant-platform-prod.yml" };
+    const doc = buildGithubPipelineDoc(components, { env: "prod", member: root });
+    expect(doc.on).toEqual({ workflow_dispatch: {} });
+    expect(doc.defaults).toBeUndefined();
+    const upload = (doc.jobsDoc["shared-alb"] as { steps: Step[] }).steps.find((s) => s.uses?.startsWith("actions/upload-artifact"));
+    expect(upload?.with?.path).toBe("shared-alb.outputs.json");
+  });
+
+  test("two members' pipelines differ only where the member does", () => {
+    const web: PipelineMember = { name: "web", dir: "apps/web", file: ".github/workflows/chant-web-staging.yml" };
+    const a = generateGithubPipeline(components, { env: "staging", member: api });
+    const b = generateGithubPipeline(components, { env: "staging", member: web });
+    expect(a.yaml).not.toBe(b.yaml);
+    expect(a.jobs).toEqual(b.jobs);
+  });
+});
+
+describe("generateGithubOpPipeline for a workspace member", () => {
+  const member: PipelineMember = { name: "api", dir: "services/api", fileDir: ".github/workflows" };
+
+  test("files, workflow names and concurrency groups carry the member's name", () => {
+    const result = generateGithubOpPipeline([{ name: "nightly", trigger: { kind: "cron", schedule: "0 6 * * *" } }], { member });
+    expect(result.files.map((f) => f.name)).toEqual(["api-nightly.yml"]);
+    const doc = parseYAML(result.files[0].yaml) as unknown as Doc & { concurrency: { group: string } };
+    expect(doc.name).toBe("api/nightly");
+    expect(doc.concurrency.group).toBe("api-nightly");
+    // A cron trigger has no paths to filter.
+    expect(JSON.stringify(doc.on)).not.toContain("paths");
+    expect(doc.jobs["nightly"].defaults).toEqual({ run: { "working-directory": "services/api" } });
+  });
+
+  test("push and pull_request triggers are filtered to the member and the Op's own file", () => {
+    const result = generateGithubOpPipeline(
+      [
+        { name: "plan", trigger: { kind: "pull_request" } },
+        { name: "apply", trigger: { kind: "push" } },
+      ],
+      { member },
+    );
+    const plan = parseYAML(result.files[0].yaml) as unknown as Doc;
+    expect(plan.on.pull_request).toEqual({ paths: ["services/api/**", ".github/workflows/api-plan.yml"] });
+    const apply = parseYAML(result.files[1].yaml) as unknown as Doc;
+    expect(apply.on.push).toEqual({ branches: ["main"], paths: ["services/api/**", ".github/workflows/api-apply.yml"] });
+    // The gate-notice job checks nothing out, so it keeps the default directory.
+    expect(apply.jobs["apply-gate-notice"].defaults).toBeUndefined();
+    expect(apply.jobs["apply"].defaults).toEqual({ run: { "working-directory": "services/api" } });
+  });
+});

package/src/components/generate-pipeline.test.ts

@@ -35,6 +35,7 @@ function pilotComponents(): DriverComponent[] {
 
 interface ParsedStep {
   name?: string;
+  id?: string;
   uses?: string;
   run?: string;
   with?: Record<string, unknown>;
@@ -44,6 +45,7 @@ interface ParsedJob {
   "runs-on"?: string;
   container?: string;
   needs?: string[];
+  outputs?: Record<string, string>;
   steps: ParsedStep[];
 }
 
@@ -342,7 +344,9 @@ describe("generateGithubPipeline: a promote job (#2575)", () => {
       { name: "api-archive", path: "dist/images" },
       { name: "worker-archive", path: "." },
     ]);
-    expect(runLines(promote)).toEqual(["chant components promote --from staging --to prod"]);
+    expect(runLines(promote)).toEqual([
+      'chant components promote --from staging --to prod --digest "api=${{ needs.api.outputs.digest }}" --digest "worker=${{ needs.worker.outputs.digest }}"',
+    ]);
 
     // The machine-readable views stay one entry per component.
     expect(result.jobs.map((j) => j.component).sort()).toEqual(["api", "shared-alb", "worker"]);
@@ -358,7 +362,7 @@ describe("generateGithubPipeline: a promote job (#2575)", () => {
     });
     expect(runLines(parsedJobs(result.yaml)["promote-prod"])).toEqual([
       "npm ci",
-      "npx chant components promote --from staging --to prod",
+      'npx chant components promote --from staging --to prod --digest "api=${{ needs.api.outputs.digest }}" --digest "worker=${{ needs.worker.outputs.digest }}"',
       "echo done",
     ]);
   });
@@ -372,10 +376,42 @@ describe("generateGithubPipeline: a promote job (#2575)", () => {
   });
 
   test("a component whose job name is the promote job's is refused", () => {
-    const components: DriverComponent[] = [{ name: "promote-prod", deploy: [] }];
+    const components: DriverComponent[] = [
+      { name: "promote-prod", deploy: [{ phase: "Publish", steps: [{ kind: "publish-image", from: "archive:a.tar" }] }] },
+    ];
     expect(() => generateGithubPipeline(components, { promoteTo: "prod" })).toThrow(/same name as a component job/);
   });
 
+  test("each publishing job hands the digest its run recorded to the promote job, which pins it (#2602)", () => {
+    const jobs = parsedJobs(generateGithubPipeline(promotableComponents(), { env: "staging", promoteTo: "prod" }).yaml);
+
+    for (const name of ["api", "worker"]) {
+      const job = jobs[name];
+      // The run writes `<component>=<digest>` for the release it recorded ...
+      expect(runLines(job).find((l) => l.startsWith("chant run"))).toContain(`--digest-file ${name}.digest`);
+      // ... a step turns it into a step output, and the job exposes it.
+      const record = job.steps.find((s) => s.name === `Record ${name} digest`)!;
+      expect(record.id).toBe("digest");
+      expect(record.run).toBe(`echo "digest=$(cut -d= -f2- ${name}.digest)" >> "$GITHUB_OUTPUT"`);
+      expect(job.outputs).toEqual({ digest: "${{ steps.digest.outputs.digest }}" });
+    }
+
+    // shared-alb publishes nothing, so it records no release and is not pinned.
+    expect(jobs["shared-alb"].outputs).toBeUndefined();
+    expect(runLines(jobs["shared-alb"]).join("\n")).not.toContain("--digest-file");
+
+    const promote = runLines(jobs["promote-prod"]).find((l) => l.includes("components promote"))!;
+    expect(promote).toContain('--digest "api=${{ needs.api.outputs.digest }}"');
+    expect(promote).toContain('--digest "worker=${{ needs.worker.outputs.digest }}"');
+    expect(promote).not.toContain("shared-alb=");
+  });
+
+  test("with no component that publishes, there is no release to pin, and generation fails", () => {
+    const components: DriverComponent[] = [{ name: "shared-alb", dependsOn: [], deploy: [] }];
+    expect(() => generateGithubPipeline(components, { promoteTo: "prod" })).toThrow(/no component has a publish step/);
+    expect(() => generateGithubPipeline(components)).not.toThrow();
+  });
+
   test("artifactRoot is the deepest directory holding every file", () => {
     expect(artifactRoot(["archive"])).toBe(".");
     expect(artifactRoot(["dist/a.tar"])).toBe("dist");

package/src/components/generate-pipeline.ts

@@ -39,6 +39,14 @@
  *    job and runs `chant components promote`. A promote publishes from the
  *    build archive on disk, so each component job uploads the files its
  *    build steps wrote and the promote job downloads them to the same paths.
+ *    Each component job with a publish step also writes the digest its run
+ *    recorded (`--digest-file`) to a job output, and the promote job passes
+ *    it back as `--digest <component>=<digest>` (#2602), so it promotes the
+ *    release this run built rather than whatever is latest in the source
+ *    environment.
+ *  - For a workspace member (`options.member`, #2542) the workflow keeps its
+ *    triggers, and its `run:` steps start in the member's directory. See
+ *    `scopeToMember`.
  *
  * Cross-cutting changes (e.g. "sign every image before deploy") are made by
  * editing `GenerateGithubOptions.extraScript`/`beforeScript` (or the
@@ -50,11 +58,13 @@
 
 import { emitYAML } from "@intentius/chant/yaml";
 import { resolveComponentGraph, type DriverComponent } from "@intentius/chant/components/driver";
-import { promoteArchivePaths } from "@intentius/chant/components/promote";
+import { hasPublishStep, promoteArchivePaths } from "@intentius/chant/components/promote";
+import { memberRepoPath } from "@intentius/chant/lexicon";
 import type {
   ComponentPipelineJob as GeneratedJob,
   ComponentPipelineOptions as GenerateGithubOptions,
   ComponentPipelineResult as GenerateGithubResult,
+  PipelineMember,
 } from "@intentius/chant/lexicon";
 
 export type { GeneratedJob, GenerateGithubOptions, GenerateGithubResult };
@@ -78,6 +88,8 @@ export interface GithubPipelineDoc {
   environment: string;
   /** The `on:` trigger mapping (a bare `workflow_dispatch`). */
   on: Record<string, unknown>;
+  /** The workflow's `defaults:`, set only for a workspace member: its jobs' `run:` steps start in the member's directory (#2542). */
+  defaults?: Record<string, unknown>;
   /**
    * The `env:` mapping: the caller's `variables`, plus `CHANT_ENV` naming the
    * deployed environment (#2046) — the machine-readable identity on the
@@ -111,6 +123,11 @@ function artifactName(name: string): string {
   return `${name}-outputs`;
 }
 
+/** The file a component job writes the digest its run recorded to, for the promote job (#2602). */
+function digestFile(name: string): string {
+  return `${name}.digest`;
+}
+
 /** The workflow artifact name a component's build archive is uploaded under, for the promote job (#2575). */
 function archiveArtifactName(name: string): string {
   return `${name}-archive`;
@@ -172,10 +189,17 @@ export function buildGithubPipelineDoc(
   // build steps wrote and the promote job downloads them.
   const promoteTo = options.promoteTo;
   const archives = new Map<string, string[]>();
+  // The components the promote job pins to this run's digest (#2602): those
+  // with a publish step, the only ones whose deploy records a release.
+  const pinned = new Set<string>();
   if (promoteTo !== undefined) {
     for (const c of components) {
       const paths = promoteArchivePaths(c);
       if (paths.length > 0) archives.set(c.name, paths);
+      if (hasPublishStep(c)) pinned.add(c.name);
+    }
+    if (pinned.size === 0) {
+      throw new Error("no component has a publish step, so no deploy records a release for the promote job to promote");
     }
   }
 
@@ -203,6 +227,7 @@ export function buildGithubPipelineDoc(
       const runParts = runCommand.map((part) => part.replace("{name}", name));
       for (const dep of component.dependsOn ?? []) runParts.push("--seed-outputs", outputsFile(dep));
       if (dependedUpon.has(name)) runParts.push("--dump-outputs", outputsFile(name));
+      if (pinned.has(name)) runParts.push("--digest-file", digestFile(name));
 
       // One step per script line — mirrors gitlab's `script:` array of
       // discrete shell lines, rather than a single multi-line `run:` block, so
@@ -221,6 +246,15 @@ export function buildGithubPipelineDoc(
       steps.push({ run: runParts.join(" ") });
       for (const line of extraScript) steps.push({ run: line });
 
+      // The file holds `<component>=<digest>`; the job output holds the digest.
+      if (pinned.has(name)) {
+        steps.push({
+          name: `Record ${name} digest`,
+          id: "digest",
+          run: `echo "digest=$(cut -d= -f2- ${digestFile(name)})" >> "$GITHUB_OUTPUT"`,
+        });
+      }
+
       if (dependedUpon.has(name)) {
         steps.push({
           name: `Upload ${name} outputs`,
@@ -247,6 +281,7 @@ export function buildGithubPipelineDoc(
         "runs-on": "ubuntu-latest",
         ...(needs.length > 0 ? { needs } : {}),
         container: image,
+        ...(pinned.has(name) ? { outputs: { digest: "${{ steps.digest.outputs.digest }}" } } : {}),
         steps,
       };
       jobsDoc[jobName] = jobProps;
@@ -258,7 +293,10 @@ export function buildGithubPipelineDoc(
     if (promoteJob in jobsDoc) {
       throw new Error(`the promote job "${promoteJob}" has the same name as a component job; rename the component`);
     }
-    const command = options.promoteCommand ?? ["chant", "components", "promote", "--from", env, "--to", promoteTo];
+    const command = [...(options.promoteCommand ?? ["chant", "components", "promote", "--from", env, "--to", promoteTo])];
+    for (const name of [...pinned].sort()) {
+      command.push("--digest", `"${name}=\${{ needs.${jobNameByComponent.get(name)!}.outputs.digest }}"`);
+    }
     const steps: Array<Record<string, unknown>> = [{ uses: "actions/checkout@v4" }];
     for (const [name, paths] of archives) {
       steps.push({
@@ -278,7 +316,7 @@ export function buildGithubPipelineDoc(
     };
   }
 
-  return {
+  const doc: GithubPipelineDoc = {
     name: `chant-components-${env}`,
     environment: env,
     on: { workflow_dispatch: {} },
@@ -287,6 +325,49 @@ export function buildGithubPipelineDoc(
     stages,
     jobs,
   };
+  return options.member ? scopeToMember(doc, options.member) : doc;
+}
+
+/**
+ * Scope a pipeline to one workspace member (#2542, #2524 D19). Its name
+ * carries the member's name, and every `run:` step starts in the member's
+ * directory through `defaults.run.working-directory`.
+ *
+ * The triggers stay exactly the plain pipeline's. A deploy pipeline gains no
+ * `push` or `pull_request` trigger for a member, and its only trigger,
+ * `workflow_dispatch`, takes no `paths:` filter.
+ *
+ * `working-directory` applies to `run:` steps only. The artifact actions
+ * resolve `path` against the repository root, so each upload and download
+ * path moves under the member's directory, where the `run:` steps read and
+ * write the files.
+ */
+function scopeToMember(doc: GithubPipelineDoc, member: PipelineMember): GithubPipelineDoc {
+  const rooted = member.dir === "." || member.dir === "";
+  const jobsDoc: Record<string, unknown> = {};
+  for (const [name, job] of Object.entries(doc.jobsDoc)) {
+    const props = job as { steps?: Array<Record<string, unknown>> };
+    jobsDoc[name] = rooted || !props.steps ? job : { ...props, steps: props.steps.map((step) => memberArtifactStep(step, member)) };
+  }
+  return {
+    ...doc,
+    name: `chant-components-${member.name}-${doc.environment}`,
+    ...(rooted ? {} : { defaults: { run: { "working-directory": member.dir } } }),
+    jobsDoc,
+  };
+}
+
+/** An `actions/upload-artifact` or `download-artifact` step with its `path` moved under the member's directory. */
+function memberArtifactStep(step: Record<string, unknown>, member: PipelineMember): Record<string, unknown> {
+  const uses = typeof step.uses === "string" ? step.uses : "";
+  if (!/^actions\/(upload|download)-artifact@/.test(uses)) return step;
+  const withProps = step.with as Record<string, unknown> | undefined;
+  if (!withProps || typeof withProps.path !== "string") return step;
+  const path = withProps.path
+    .split("\n")
+    .map((line) => memberRepoPath(member, line))
+    .join("\n");
+  return { ...step, with: { ...withProps, path } };
 }
 
 /**
@@ -300,6 +381,7 @@ export function emitPipelineYAML(doc: GithubPipelineDoc): string {
   if (doc.env && Object.keys(doc.env).length > 0) {
     sections.push("env:" + emitYAML(doc.env, 1));
   }
+  if (doc.defaults) sections.push("defaults:" + emitYAML(doc.defaults, 1));
   sections.push("jobs:" + emitYAML(doc.jobsDoc, 1));
   return sections.join("\n\n") + "\n";
 }