@intentius/chant-lexicon-gitlab 0.124.32 → 0.124.33

package/dist/components/generate-op-pipeline.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generate-op-pipeline.d.ts","sourceRoot":"","sources":["../../src/components/generate-op-pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyGG;AAeH,OAAO,KAAK,EACV,wBAAwB,IAAI,uBAAuB,EAInD,gBAAgB,IAAI,sBAAsB,EAE1C,eAAe,EAChB,MAAM,0BAA0B,CAAC;AAIlC,YAAY,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,CAAC;AAqHhE;;;;GAIG;AACH,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,eAAe,EAAE,EACtB,OAAO,GAAE,uBAA4B,GACpC,sBAAsB,CAsGxB"}
+{"version":3,"file":"generate-op-pipeline.d.ts","sourceRoot":"","sources":["../../src/components/generate-op-pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyGG;AAeH,OAAO,KAAK,EACV,wBAAwB,IAAI,uBAAuB,EAInD,gBAAgB,IAAI,sBAAsB,EAE1C,eAAe,EAChB,MAAM,0BAA0B,CAAC;AAIlC,YAAY,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,CAAC;AA4HhE;;;;GAIG;AACH,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,eAAe,EAAE,EACtB,OAAO,GAAE,uBAA4B,GACpC,sBAAsB,CAsGxB"}

package/dist/components/generate-op-pipeline.js

@@ -191,8 +191,14 @@ function headerLineFor(spec, trigger, jobName, mode) {
         }
         case "push": {
             const branches = pushBranches(trigger.branches);
+            // #4169: GitLab cancels a waiting pipeline when a newer commit's starts, under the project's auto-cancel setting.
+            const build = trigger.build === "newest"
+                ? "; builds the newest commit and each ci/build/<sha> tag: keep Settings > CI/CD > Auto-cancel redundant pipelines on"
+                : trigger.build === "every"
+                    ? "; builds every commit: turn Settings > CI/CD > Auto-cancel redundant pipelines off"
+                    : "";
             return (`#   ${jobName}: push to ${branches.join(", ")}, finding-mode ${mode}${tokenNote}` +
-                ` — a gated apply stays green, its pending gate in the log and in ${gateSummaryPath(jobName)}`);
+                ` — a gated apply stays green, its pending gate in the log and in ${gateSummaryPath(jobName)}${build}`);
         }
     }
 }

package/dist/components/generate-pipeline.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generate-pipeline.d.ts","sourceRoot":"","sources":["../../src/components/generate-pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAWH,OAAO,EAAyB,KAAK,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAejG,OAAO,KAAK,EACV,oBAAoB,IAAI,YAAY,EACpC,wBAAwB,IAAI,qBAAqB,EACjD,uBAAuB,IAAI,oBAAoB,EAEhD,MAAM,0BAA0B,CAAC;AAIlC,YAAY,EAAE,YAAY,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,CAAC;AAE1E;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,eAAe,EAAE,EAC7B,OAAO,GAAE,qBAA0B,GAClC,oBAAoB,CAkJtB"}
+{"version":3,"file":"generate-pipeline.d.ts","sourceRoot":"","sources":["../../src/components/generate-pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAWH,OAAO,EAAyB,KAAK,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAgBjG,OAAO,KAAK,EACV,oBAAoB,IAAI,YAAY,EACpC,wBAAwB,IAAI,qBAAqB,EACjD,uBAAuB,IAAI,oBAAoB,EAEhD,MAAM,0BAA0B,CAAC;AAIlC,YAAY,EAAE,YAAY,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,CAAC;AAE1E;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,eAAe,EAAE,EAC7B,OAAO,GAAE,qBAA0B,GAClC,oBAAoB,CAkJtB"}

package/dist/components/generate-pipeline.js

@@ -35,7 +35,7 @@ import { assertGitlabBranch, CI_IMAGE, ciJobName, fillCommand, GITLAB_FULL_HISTO
 import { resolveComponentGraph } from "@intentius/chant/components/driver";
 import { hasPublishStep, promoteArchivePaths } from "@intentius/chant/components/promote";
 import { GATED_WAVE_RECORD, gatedWaveJobs } from "@intentius/chant/components/gated-wave-pipeline";
-import { PR_APPLY_RECORD, PR_LOOP_REPORT_DIR, prApplyGroup, prApplyRecordKey, prApplyWaveJobName, prLoopJobs, prLoopSetup, prLoopWaveJobs, prLoopWithWaves, } from "@intentius/chant/components/pr-pipeline";
+import { PR_APPLY_RECORD, PR_LOOP_REPORT_DIR, prApplyGroup, prRecordGroup, prApplyRecordKey, prApplyWaveJobName, prLoopJobs, prLoopSetup, prLoopWaveJobs, prLoopWithWaves, } from "@intentius/chant/components/pr-pipeline";
 import { memberGitlabChanges, memberRepoPath, memberShellDir } from "@intentius/chant/lexicon";
 import { emitGitlabFile } from "./ci-jobs.js";
 /**
@@ -229,8 +229,8 @@ function gatedWaveGitlabPipeline(components, env, image, beforeScript, extraScri
 }
 /**
  * The merge-request pipeline (#3183): `plan` in each merge request pipeline,
- * `apply` on each push to the target branch, one apply at a time per
- * environment (`resource_group`). `GIT_DEPTH: "0"` gives both the history
+ * and on each push to the target branch `record` (#4168), or `apply` with
+ * `applyOnMerge`, one at a time per environment (`resource_group`). `GIT_DEPTH: "0"` gives both the history
  * they measure the change with. The jobs talk to GitLab with
  * `CHANT_FORGE_TOKEN`, a project or group access token with the `api` scope
  * set as a masked CI/CD variable, since a job token cannot write notes.
@@ -260,14 +260,16 @@ function prLoopGitlabPipeline(components, env, image, beforeScript, extraScript,
     const loop = options.prLoop;
     const member = options.member;
     const rooted = !member || member.dir === "." || member.dir === "";
-    const [plan, apply] = prLoopJobs("gitlab", env, loop, member?.name);
+    const [plan, apply, record] = prLoopJobs("gitlab", env, loop, member?.name);
     const reportPath = member ? memberRepoPath(member, PR_LOOP_REPORT_DIR) : PR_LOOP_REPORT_DIR;
     const planJob = member ? `${member.name}-plan` : "plan";
     const named = (job) => (member ? `${member.name}-${job}` : job);
     const waveJobs = loop.waveGate ? prLoopWaveJobs(components, apply) : [];
     const applies = loop.waveGate
         ? waveJobs.map((job) => ({ job, name: named(prApplyWaveJobName(job.wave)), stage: prApplyWaveJobName(job.wave) }))
-        : [{ job: apply, name: named("apply"), stage: "apply" }];
+        : loop.applyOnMerge
+            ? [{ job: apply, name: named("apply"), stage: "apply" }]
+            : [{ job: record, name: named("record"), stage: "record" }];
     const onMergeRequest = GITLAB_MERGE_REQUEST_SOURCE;
     if (loop.branch !== undefined)
         assertGitlabBranch("The merge-request pipeline", loop.branch);
@@ -297,17 +299,22 @@ function prLoopGitlabPipeline(components, env, image, beforeScript, extraScript,
                 stage,
                 image,
                 ...(i > 0 ? { needs: [applies[i - 1].name] } : {}),
-                resource_group: prApplyGroup(env, member?.name),
+                resource_group: job.jobName === "record" ? prRecordGroup(env, member?.name) : prApplyGroup(env, member?.name),
                 rules: [{ if: onMerge }],
                 variables: job.run.env,
                 script: script(job),
                 // The attempt record (#3543), kept under the pushed commit even when
                 // the job fails, so a retry finishes the apply under the same approval.
-                cache: {
-                    key: prApplyRecordKey(env, "$CI_COMMIT_SHA", member?.name),
-                    paths: [member ? memberRepoPath(member, PR_APPLY_RECORD) : PR_APPLY_RECORD],
-                    when: "always",
-                },
+                // The record job (#4168) applies nothing and keeps none.
+                ...(job.jobName === "record"
+                    ? {}
+                    : {
+                        cache: {
+                            key: prApplyRecordKey(env, "$CI_COMMIT_SHA", member?.name),
+                            paths: [member ? memberRepoPath(member, PR_APPLY_RECORD) : PR_APPLY_RECORD],
+                            when: "always",
+                        },
+                    }),
                 artifacts: { when: "always", paths: [reportPath] },
             },
         ])),
@@ -316,7 +323,7 @@ function prLoopGitlabPipeline(components, env, image, beforeScript, extraScript,
         { jobName: planJob, component: "merge request plan", stage: "plan", needs: [] },
         ...applies.map(({ job, name, stage }, i) => ({
             jobName: name,
-            component: job.wave ? `merge request apply, wave ${job.wave}` : "merge request apply",
+            component: job.wave ? `merge request apply, wave ${job.wave}` : job.jobName === "record" ? "merge record" : "merge request apply",
             stage,
             needs: i > 0 ? [applies[i - 1].name] : [],
         })),

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "be91342ce1ba95512e87deebcd929d0afcadc076160491773630b2e7b62097de",
+    "manifest.json": "ebb9c8f2b23dabf3657d08be03ccb5ac5aa083073552df047f3d84f56ee8b288",
     "meta.json": "db082fbf90c5941c498b2bee0f106103449c1a4c257716ca2220f0dd490450b2",
     "types/index.d.ts": "a048a66ebe20da0cb5fc889054cac69044d9bf882e2c56b5c5bf113d1f3ba57c",
     "rules/artifact-no-expiry.ts": "0ca5bb972d4a542126e8a0229d43b55658394cb7dd9b9923b2c590bec1c2ad7d",
@@ -55,5 +55,5 @@
     "skills/chant-gitlab-migrate.md": "4853d04980560b379e5b0f7267dcb0a1e5d5879cb9e9931681ce76b2a5fe69d8",
     "skills/chant-gitlab-patterns.md": "6d9a44e9e8de4c3820be9d65381b0d2ede4cb3626aaaf0011e21838a9fbf556e"
   },
-  "composite": "b0fefd5cf9a9c881b5a84df608913c43c5995c4b319d2ee76a89555a635de276"
+  "composite": "8da150c5882bad8c14689fa870f26cff56ae3edb1d262d88ae5f11749ad2a3f7"
 }

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "gitlab",
-  "version": "0.124.32",
+  "version": "0.124.33",
   "chantVersion": ">=0.1.0",
   "namespace": "GitLab",
   "intrinsics": [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-gitlab",
-  "version": "0.124.32",
+  "version": "0.124.33",
   "description": "GitLab CI lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -67,8 +67,8 @@
     "typescript": "^5.9.3"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.124.32",
-    "@intentius/chant-lexicon-github": "^0.124.32"
+    "@intentius/chant": "^0.124.33",
+    "@intentius/chant-lexicon-github": "^0.124.33"
   },
   "peerDependenciesMeta": {
     "@intentius/chant-lexicon-github": {

package/src/components/__fixtures__/pr-loop-record.gitlab.golden.yml

@@ -0,0 +1,46 @@
+workflow:
+  name: chant-pr-prod
+  rules:
+    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
+    - if: '$CI_PIPELINE_SOURCE == "push" && $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'
+
+stages:
+  - plan
+  - record
+
+variables:
+  CHANT_ENV: prod
+  GIT_DEPTH: '0'
+
+plan:
+  stage: plan
+  image: node:22
+  rules:
+    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
+  variables:
+    BASE_SHA: '$CI_MERGE_REQUEST_DIFF_BASE_SHA'
+    PR_NUMBER: '$CI_MERGE_REQUEST_IID'
+  script:
+    - command -v tofu >/dev/null 2>&1 || (curl -fsSL https://get.opentofu.org/install-opentofu.sh -o /tmp/install-opentofu.sh && sh /tmp/install-opentofu.sh --install-method standalone)
+    - chant ci run plan --in-place --no-push --base "$BASE_SHA" --pr "$PR_NUMBER" --env prod --gate pr-apply --forge gitlab
+  artifacts:
+    when: always
+    paths:
+      - .chant/pr
+
+record:
+  stage: record
+  image: node:22
+  resource_group: chant-record-prod
+  rules:
+    - if: '$CI_PIPELINE_SOURCE == "push" && $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'
+  variables:
+    BASE_SHA: '$CI_COMMIT_BEFORE_SHA'
+  script:
+    - command -v tofu >/dev/null 2>&1 || (curl -fsSL https://get.opentofu.org/install-opentofu.sh -o /tmp/install-opentofu.sh && sh /tmp/install-opentofu.sh --install-method standalone)
+    - if [ -z "$BASE_SHA" ] || [ "$BASE_SHA" = "0000000000000000000000000000000000000000" ]; then BASE_SHA="${CI_MERGE_REQUEST_DIFF_BASE_SHA:-}"; if [ -z "$BASE_SHA" ]; then git fetch origin $CI_DEFAULT_BRANCH && BASE_SHA="$(git merge-base FETCH_HEAD "$CI_COMMIT_SHA")"; if [ "$BASE_SHA" = "$CI_COMMIT_SHA" ]; then BASE_SHA="$(git rev-parse --verify --quiet "$CI_COMMIT_SHA^" || echo 4b825dc642cb6eb9a060e54bf8d69288fbee4904)"; fi; fi; fi; export BASE_SHA
+    - chant ci run record --in-place --base "$BASE_SHA" --env prod --gate pr-apply --forge gitlab
+  artifacts:
+    when: always
+    paths:
+      - .chant/pr

package/src/components/generate-op-pipeline.test.ts

@@ -185,6 +185,16 @@ describe("generateGitlabOpPipeline: the merge_request and push triggers (#2084,
     ]);
   });
 
+  test("a newest push build also runs at a build request's tag, and the header says how auto-cancel must be set (#4169)", () => {
+    const newest = generateGitlabOpPipeline([{ name: "suites", trigger: { kind: "push", build: "newest" } }]);
+    const job = parseYAML(newest.files[0].yaml)["suites"] as { rules: Array<{ if: string }> };
+    expect(job.rules.map((r) => r.if)).toEqual(['$CI_PIPELINE_SOURCE == "push" && $CI_COMMIT_BRANCH == "main"', "$CI_COMMIT_TAG =~ /^ci\\/build\\//"]);
+    expect(newest.files[0].yaml).toContain("Auto-cancel redundant pipelines on");
+    const every = generateGitlabOpPipeline([{ name: "suites", trigger: { kind: "push", build: "every" } }]);
+    expect((parseYAML(every.files[0].yaml)["suites"] as { rules: unknown[] }).rules).toHaveLength(1);
+    expect(every.files[0].yaml).toContain("Auto-cancel redundant pipelines off");
+  });
+
   test("an unfiltered push trigger defaults to main, the same branch github's generator assumes", () => {
     const result = generateGitlabOpPipeline([{ name: "tf-apply", trigger: { kind: "push" } }]);
     const job = parseYAML(result.files[0].yaml)["tf-apply"] as { rules: Array<{ if: string }> };

package/src/components/generate-op-pipeline.ts

@@ -239,9 +239,16 @@ function headerLineFor(
     }
     case "push": {
       const branches = pushBranches(trigger.branches);
+      // #4169: GitLab cancels a waiting pipeline when a newer commit's starts, under the project's auto-cancel setting.
+      const build =
+        trigger.build === "newest"
+          ? "; builds the newest commit and each ci/build/<sha> tag: keep Settings > CI/CD > Auto-cancel redundant pipelines on"
+          : trigger.build === "every"
+            ? "; builds every commit: turn Settings > CI/CD > Auto-cancel redundant pipelines off"
+            : "";
       return (
         `#   ${jobName}: push to ${branches.join(", ")}, finding-mode ${mode}${tokenNote}` +
-        ` — a gated apply stays green, its pending gate in the log and in ${gateSummaryPath(jobName)}`
+        ` — a gated apply stays green, its pending gate in the log and in ${gateSummaryPath(jobName)}${build}`
       );
     }
   }

package/src/components/generate-pipeline.ts

@@ -48,6 +48,7 @@ import {
   PR_APPLY_RECORD,
   PR_LOOP_REPORT_DIR,
   prApplyGroup,
+  prRecordGroup,
   prApplyRecordKey,
   prApplyWaveJobName,
   prLoopJobs,
@@ -272,8 +273,8 @@ function gatedWaveGitlabPipeline(
 
 /**
  * The merge-request pipeline (#3183): `plan` in each merge request pipeline,
- * `apply` on each push to the target branch, one apply at a time per
- * environment (`resource_group`). `GIT_DEPTH: "0"` gives both the history
+ * and on each push to the target branch `record` (#4168), or `apply` with
+ * `applyOnMerge`, one at a time per environment (`resource_group`). `GIT_DEPTH: "0"` gives both the history
  * they measure the change with. The jobs talk to GitLab with
  * `CHANT_FORGE_TOKEN`, a project or group access token with the `api` scope
  * set as a masked CI/CD variable, since a job token cannot write notes.
@@ -310,14 +311,16 @@ function prLoopGitlabPipeline(
   const loop = options.prLoop!;
   const member = options.member;
   const rooted = !member || member.dir === "." || member.dir === "";
-  const [plan, apply] = prLoopJobs("gitlab", env, loop, member?.name);
+  const [plan, apply, record] = prLoopJobs("gitlab", env, loop, member?.name);
   const reportPath = member ? memberRepoPath(member, PR_LOOP_REPORT_DIR) : PR_LOOP_REPORT_DIR;
   const planJob = member ? `${member.name}-plan` : "plan";
   const named = (job: string) => (member ? `${member.name}-${job}` : job);
   const waveJobs = loop.waveGate ? prLoopWaveJobs(components, apply) : [];
   const applies = loop.waveGate
     ? waveJobs.map((job) => ({ job, name: named(prApplyWaveJobName(job.wave!)), stage: prApplyWaveJobName(job.wave!) }))
-    : [{ job: apply, name: named("apply"), stage: "apply" }];
+    : loop.applyOnMerge
+      ? [{ job: apply, name: named("apply"), stage: "apply" }]
+      : [{ job: record, name: named("record"), stage: "record" }];
   const onMergeRequest = GITLAB_MERGE_REQUEST_SOURCE;
   if (loop.branch !== undefined) assertGitlabBranch("The merge-request pipeline", loop.branch);
   const onMerge = gitlabPushRule(loop.branch ? JSON.stringify(loop.branch) : "$CI_DEFAULT_BRANCH");
@@ -347,17 +350,22 @@ function prLoopGitlabPipeline(
           stage,
           image,
           ...(i > 0 ? { needs: [applies[i - 1]!.name] } : {}),
-          resource_group: prApplyGroup(env, member?.name),
+          resource_group: job.jobName === "record" ? prRecordGroup(env, member?.name) : prApplyGroup(env, member?.name),
           rules: [{ if: onMerge }],
           variables: job.run.env,
           script: script(job),
           // The attempt record (#3543), kept under the pushed commit even when
           // the job fails, so a retry finishes the apply under the same approval.
-          cache: {
-            key: prApplyRecordKey(env, "$CI_COMMIT_SHA", member?.name),
-            paths: [member ? memberRepoPath(member, PR_APPLY_RECORD) : PR_APPLY_RECORD],
-            when: "always",
-          },
+          // The record job (#4168) applies nothing and keeps none.
+          ...(job.jobName === "record"
+            ? {}
+            : {
+                cache: {
+                  key: prApplyRecordKey(env, "$CI_COMMIT_SHA", member?.name),
+                  paths: [member ? memberRepoPath(member, PR_APPLY_RECORD) : PR_APPLY_RECORD],
+                  when: "always",
+                },
+              }),
           artifacts: { when: "always", paths: [reportPath] },
         },
       ]),
@@ -367,7 +375,7 @@ function prLoopGitlabPipeline(
     { jobName: planJob, component: "merge request plan", stage: "plan", needs: [] },
     ...applies.map(({ job, name, stage }, i) => ({
       jobName: name,
-      component: job.wave ? `merge request apply, wave ${job.wave}` : "merge request apply",
+      component: job.wave ? `merge request apply, wave ${job.wave}` : job.jobName === "record" ? "merge record" : "merge request apply",
       stage,
       needs: i > 0 ? [applies[i - 1]!.name] : [],
     })),

package/src/components/generate-pr-pipeline.test.ts

@@ -33,7 +33,7 @@ interface Job {
 }
 
 describe("the GitLab merge-request pipeline", () => {
-  const result = generateGitlabPipeline(ESTATE, { env: "prod", prLoop: {} });
+  const result = generateGitlabPipeline(ESTATE, { env: "prod", prLoop: { applyOnMerge: true } });
   const doc = parseYAML(result.yaml) as { workflow: { rules: unknown[] }; variables: Record<string, string>; plan: Job; apply: Job };
 
   test("matches its golden", () => {
@@ -57,7 +57,7 @@ describe("the GitLab merge-request pipeline", () => {
       ...PR_LOOP_SETUP,'chant ci run plan --in-place --no-push --base "$BASE_SHA" --pr "$PR_NUMBER" --env prod --gate pr-apply --forge gitlab']);
     expect(doc.apply.rules).toEqual([{ if: '$CI_PIPELINE_SOURCE == "push" && $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH' }]);
     expect(doc.apply.variables).toEqual({ BASE_SHA: "$CI_COMMIT_BEFORE_SHA" });
-    // #4156: ci run builds pr-apply with --require-review, and GitLab hands CHANT_RUNNER_KEY to the job as a CI/CD variable when it has one.
+    // #4156: ci run builds pr-apply (with no --require-review since #4168), and GitLab hands CHANT_RUNNER_KEY to the job as a CI/CD variable when it has one.
     expect(doc.apply.script.at(-1)).toBe('chant ci run apply --in-place --base "$BASE_SHA" --env prod --gate pr-apply --forge gitlab');
     expect(result.yaml).not.toContain("CHANT_RUNNER_KEY");
     expect(doc.apply.resource_group).toBe("chant-apply-prod");
@@ -66,7 +66,7 @@ describe("the GitLab merge-request pipeline", () => {
   });
 
   test("events and reportUrl stream the run's events into the report artifact and copy the reports out (#4007)", () => {
-    const loud = parseYAML(generateGitlabPipeline(ESTATE, { env: "prod", prLoop: { events: true, reportUrl: "$CHANT_REPORT_URL" } }).yaml) as { plan: Job; apply: Job };
+    const loud = parseYAML(generateGitlabPipeline(ESTATE, { env: "prod", prLoop: { applyOnMerge: true, events: true, reportUrl: "$CHANT_REPORT_URL" } }).yaml) as { plan: Job; apply: Job };
     for (const job of [loud.plan, loud.apply]) {
       expect(job.script.at(-1)).toContain('--events-json --report-url "$CHANT_REPORT_URL"');
       expect(job.variables.CHANT_RUN_EVENTS_DIR).toBe(".chant/pr/run-events");
@@ -78,7 +78,7 @@ describe("the GitLab merge-request pipeline", () => {
   test("runs in an image with git and installs OpenTofu, unless the caller names an image", () => {
     expect(doc.plan.image).toBe("node:22");
     expect(doc.apply.script[0]).toBe(PR_LOOP_SETUP[0]);
-    const own = generateGitlabPipeline(ESTATE, { env: "prod", image: "example/ci:1", prLoop: {} }).yaml;
+    const own = generateGitlabPipeline(ESTATE, { env: "prod", image: "example/ci:1", prLoop: { applyOnMerge: true } }).yaml;
     expect(own).toContain("image: example/ci:1");
     expect(own).not.toContain("install-opentofu");
   });
@@ -92,7 +92,7 @@ describe("the GitLab merge-request pipeline", () => {
   });
 
   test("a named branch replaces the default branch in the apply rule", () => {
-    const yaml = generateGitlabPipeline(ESTATE, { env: "prod", prLoop: { branch: "trunk" } }).yaml;
+    const yaml = generateGitlabPipeline(ESTATE, { env: "prod", prLoop: { applyOnMerge: true, branch: "trunk" } }).yaml;
     expect(yaml).toContain('$CI_COMMIT_BRANCH == "trunk"');
   });
 
@@ -106,13 +106,13 @@ describe("the GitLab merge-request pipeline", () => {
   });
 
   test("refuses a promote job beside it, and a canary beside --wave-gate (#4003)", () => {
-    expect(() => generateGitlabPipeline(ESTATE, { prLoop: {}, promoteTo: "prod" })).toThrow(/pull-request pipeline has no promote job/);
-    expect(() => generateGitlabPipeline(ESTATE, { prLoop: {}, gatedWaves: { gate: "g", canary: ["net"] } })).toThrow(/takes no --canary/);
+    expect(() => generateGitlabPipeline(ESTATE, { prLoop: { applyOnMerge: true }, promoteTo: "prod" })).toThrow(/pull-request pipeline has no promote job/);
+    expect(() => generateGitlabPipeline(ESTATE, { prLoop: { applyOnMerge: true }, gatedWaves: { gate: "g", canary: ["net"] } })).toThrow(/takes no --canary/);
   });
 
   test("inside a workspace member: member-named jobs that cd into the member, with no changes rule (#3465)", () => {
     const member = { name: "network", dir: "infra/network", file: ".gitlab/ci/chant-pr.network.prod.gitlab-ci.yml" };
-    const scoped = generateGitlabPipeline(ESTATE, { env: "prod", prLoop: {}, member });
+    const scoped = generateGitlabPipeline(ESTATE, { env: "prod", prLoop: { applyOnMerge: true }, member });
     const mdoc = parseYAML(scoped.yaml) as Record<string, unknown> & { workflow: { name?: string; rules: unknown[] } };
     expect(scoped.jobs.map((j) => j.jobName)).toEqual(["network-plan", "network-apply"]);
     expect(mdoc.plan).toBeUndefined();
@@ -137,12 +137,12 @@ describe("the GitLab merge-request pipeline", () => {
 
 describe("the merge-request pipeline's branch (#3765)", () => {
   test("a branch that would break the rules: expression is refused, as an Op's is", () => {
-    expect(() => generateGitlabPipeline(ESTATE, { env: "prod", prLoop: { branch: "re$lease" } })).toThrow(/filters on branch "re\$lease"/);
+    expect(() => generateGitlabPipeline(ESTATE, { env: "prod", prLoop: { applyOnMerge: true, branch: "re$lease" } })).toThrow(/filters on branch "re\$lease"/);
   });
 });
 
 describe("the gitlab pull-request pipeline with build (#4088)", () => {
-  const result = generateGitlabPipeline(ESTATE, { env: "prod", prLoop: { build: true } });
+  const result = generateGitlabPipeline(ESTATE, { env: "prod", prLoop: { applyOnMerge: true, build: true } });
   const doc = parseYAML(result.yaml) as Record<string, any>;
   const golden = join(import.meta.dirname, "__fixtures__", "pr-loop-build.gitlab.golden.yml");
 
@@ -161,14 +161,52 @@ describe("the gitlab pull-request pipeline with build (#4088)", () => {
   });
 
   test("buildCommand replaces the build line and turns the option on", () => {
-    const yaml = generateGitlabPipeline(ESTATE, { env: "prod", prLoop: { buildCommand: "npm run build" } }).yaml;
+    const yaml = generateGitlabPipeline(ESTATE, { env: "prod", prLoop: { applyOnMerge: true, buildCommand: "npm run build" } }).yaml;
     expect(yaml).toContain("npm run build");
     expect(yaml).not.toContain("chant build --env");
     expect(yaml).toContain("chant lint");
   });
 
   test("the default output carries neither line", () => {
-    const plain = generateGitlabPipeline(ESTATE, { env: "prod", prLoop: {} }).yaml;
+    const plain = generateGitlabPipeline(ESTATE, { env: "prod", prLoop: { applyOnMerge: true } }).yaml;
     expect(plain).not.toContain("chant lint");
   });
 });
+
+describe("the GitLab merge-request pipeline records on merge by default (#4168)", () => {
+  const result = generateGitlabPipeline(ESTATE, { env: "prod", prLoop: {} });
+  const doc = parseYAML(result.yaml) as Record<string, unknown> & { stages: string[]; record: Job };
+  const golden = join(import.meta.dirname, "__fixtures__", "pr-loop-record.gitlab.golden.yml");
+
+  test("matches its golden", () => {
+    if (process.env.UPDATE_GOLDEN) writeFileSync(golden, result.yaml);
+    expect(result.yaml).toBe(readFileSync(golden, "utf-8"));
+  });
+
+  test("validates against the vendored GitLab CI schema", () => {
+    const req = createRequire(import.meta.url);
+    const mod = req("ajv") as { default?: unknown };
+    const Ajv = (mod.default ?? mod) as new (opts: object) => { compile(s: object): ((d: unknown) => boolean) & { errors?: unknown } };
+    const validate = new Ajv({ strict: false, allErrors: true }).compile(JSON.parse(readFileSync(SCHEMA, "utf-8")));
+    expect(validate(doc), JSON.stringify(validate.errors, null, 2)).toBe(true);
+  });
+
+  test("a push to the default branch runs the record job, which applies nothing and keeps no cache", () => {
+    expect(doc.stages).toEqual(["plan", "record"]);
+    expect(doc.apply).toBeUndefined();
+    expect(doc.record.rules).toEqual([{ if: '$CI_PIPELINE_SOURCE == "push" && $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH' }]);
+    expect(doc.record.script.at(-1)).toBe('chant ci run record --in-place --base "$BASE_SHA" --env prod --gate pr-apply --forge gitlab');
+    expect(doc.record.resource_group).toBe("chant-record-prod");
+    expect(doc.record.cache).toBeUndefined();
+  });
+
+  test("a gate per wave gates the apply, so it needs applyOnMerge", () => {
+    expect(() => generateGitlabPipeline(ESTATE, { env: "prod", prLoop: {}, gatedWaves: { gate: "release" } })).toThrow(/needs --apply-on-merge/);
+  });
+
+  test("inside a workspace member the record job takes the member's name and group", () => {
+    const scoped = parseYAML(generateGitlabPipeline(ESTATE, { env: "prod", prLoop: {}, member: { name: "network", dir: "infra/network" } }).yaml) as Record<string, Job>;
+    expect(scoped["network-record"].resource_group).toBe("chant-record.network.prod");
+    expect(scoped["network-record"].script.at(-1)).toContain("chant ci run record");
+  });
+});

package/src/components/generate-pr-waves-pipeline.test.ts

@@ -34,7 +34,7 @@ interface Job {
 }
 
 describe("the GitLab merge-request pipeline with a gate per wave (#4003)", () => {
-  const result = generateGitlabPipeline(ESTATE, { env: "prod", prLoop: {}, gatedWaves: { gate: "release" } });
+  const result = generateGitlabPipeline(ESTATE, { env: "prod", prLoop: { applyOnMerge: true }, gatedWaves: { gate: "release" } });
   const doc = parseYAML(result.yaml) as Record<string, unknown> & { stages: string[] };
 
   test("matches its golden", () => {
@@ -63,7 +63,7 @@ describe("the GitLab merge-request pipeline with a gate per wave (#4003)", () =>
       expect(job.stage).toBe(`apply-wave-${k}`);
       expect(job.needs).toEqual(k > 1 ? [`apply-wave-${k - 1}`] : undefined);
       expect(job.resource_group).toBe("chant-apply-prod");
-      // #4156: through chant ci run, which runs pr-apply --require-review --wave-gate release --resume ... --wave <k>.
+      // #4156: through chant ci run, which runs pr-apply --wave-gate release (no --require-review since #4168) --resume ... --wave <k>.
       expect(job.script.at(-1)).toBe(`chant ci run apply --in-place --base "$BASE_SHA" --env prod --gate pr-apply --forge gitlab --wave-gate release --wave ${k}`);
       // Every wave shares the commit's record, so wave k pulls what wave k-1 pushed.
       expect(job.cache).toEqual({ key: "chant-apply-prod-$CI_COMMIT_SHA", paths: [".chant/pr-resume/pr-apply.json"], when: "always" });
@@ -74,7 +74,7 @@ describe("the GitLab merge-request pipeline with a gate per wave (#4003)", () =>
 
   test("inside a workspace member the wave jobs carry the member's name", () => {
     const member = { name: "network", dir: "infra/network", file: ".gitlab/ci/chant-pr.network.prod.gitlab-ci.yml" };
-    const scoped = generateGitlabPipeline(ESTATE, { env: "prod", prLoop: {}, gatedWaves: { gate: "release" }, member });
+    const scoped = generateGitlabPipeline(ESTATE, { env: "prod", prLoop: { applyOnMerge: true }, gatedWaves: { gate: "release" }, member });
     expect(scoped.jobs.map((j) => [j.jobName, j.needs])).toEqual([
       ["network-plan", []],
       ["network-apply-wave-1", []],