@intentius/chant-lexicon-gitlab 0.124.34 → 0.124.36

package/dist/components/generate-pipeline.js

@@ -256,6 +256,10 @@ function gatedWaveGitlabPipeline(components, env, image, beforeScript, extraScri
  * k-1 pushed, and a retry of a wave that stopped at its gate pulls the one it
  * pushed itself.
  */
+/** The dotenv report a gated apply wave hands the green commit it applies through (#4221). */
+const WAVE_GREEN_DOTENV = "chant-green.env";
+/** The rule of a pipeline for a pushed `ci/green/` tag (#4168 step 9), which runs the apply under apply on merge. */
+const GITLAB_GREEN_TAG_RULE = '$CI_COMMIT_TAG =~ /^ci\\/green\\//';
 function prLoopGitlabPipeline(components, env, image, beforeScript, extraScript, options) {
     const loop = options.prLoop;
     const member = options.member;
@@ -265,24 +269,29 @@ function prLoopGitlabPipeline(components, env, image, beforeScript, extraScript,
     const planJob = member ? `${member.name}-plan` : "plan";
     const named = (job) => (member ? `${member.name}-${job}` : job);
     const waveJobs = loop.waveGate ? prLoopWaveJobs(components, apply) : [];
-    const applies = loop.waveGate
+    // #4168 step 9: a push to the branch records, and under apply on merge a ci/green/ tag pipeline applies.
+    const greens = loop.waveGate
         ? waveJobs.map((job) => ({ job, name: named(prApplyWaveJobName(job.wave)), stage: prApplyWaveJobName(job.wave) }))
         : loop.applyOnMerge
             ? [{ job: apply, name: named("apply"), stage: "apply" }]
-            : [{ job: record, name: named("record"), stage: "record" }];
+            : [];
+    const applies = [{ job: record, name: named("record"), stage: "record" }, ...greens];
     const onMergeRequest = GITLAB_MERGE_REQUEST_SOURCE;
     if (loop.branch !== undefined)
         assertGitlabBranch("The merge-request pipeline", loop.branch);
     const onMerge = gitlabPushRule(loop.branch ? JSON.stringify(loop.branch) : "$CI_DEFAULT_BRANCH");
+    const onGreen = GITLAB_GREEN_TAG_RULE;
     // A member's jobs start in its directory, after the image's install lines.
     const enter = rooted ? [] : [`cd ${memberShellDir(member)}`];
     // The command runs through chant ci run (#4156), which writes the job's run record, signed when the CHANT_RUNNER_KEY variable is set.
-    const script = (job) => [...prLoopSetup(image), ...enter, ...beforeScript, ...(job.setup ?? []), ...(job.build ?? []), job.run.command, ...extraScript];
+    // #4221: a wave job hands the commit it applies to the next wave as GREEN_SHA, through a dotenv report.
+    const handOff = (job) => (job.wave ? [`echo "GREEN_SHA=$GREEN_SHA" > "$CI_PROJECT_DIR/${WAVE_GREEN_DOTENV}"`] : []);
+    const script = (job) => [...prLoopSetup(image), ...enter, ...beforeScript, ...(job.checkout ?? []), ...handOff(job), ...(job.setup ?? []), ...(job.build ?? []), job.run.command, ...extraScript];
     const stages = ["plan", ...applies.map((a) => a.stage)];
     const doc = {
         // Included files merge their top-level keys, so a member's file carries
         // the rules every member shares and no name: two names would collide.
-        workflow: { ...(member ? {} : { name: `chant-pr-${env}` }), rules: [{ if: onMergeRequest }, { if: onMerge }] },
+        workflow: { ...(member ? {} : { name: `chant-pr-${env}` }), rules: [{ if: onMergeRequest }, { if: onMerge }, ...(greens.length > 0 ? [{ if: onGreen }] : [])] },
         stages,
         variables: { ...options.variables, CHANT_ENV: env, ...GITLAB_FULL_HISTORY },
         [planJob]: {
@@ -298,9 +307,9 @@ function prLoopGitlabPipeline(components, env, image, beforeScript, extraScript,
             {
                 stage,
                 image,
-                ...(i > 0 ? { needs: [applies[i - 1].name] } : {}),
+                ...(i > 1 ? { needs: [applies[i - 1].name] } : {}),
                 resource_group: job.jobName === "record" ? prRecordGroup(env, member?.name) : prApplyGroup(env, member?.name),
-                rules: [{ if: onMerge }],
+                rules: [{ if: job.jobName === "record" ? onMerge : onGreen }],
                 variables: job.run.env,
                 script: script(job),
                 // The attempt record (#3543), kept under the pushed commit even when
@@ -315,7 +324,7 @@ function prLoopGitlabPipeline(components, env, image, beforeScript, extraScript,
                             when: "always",
                         },
                     }),
-                artifacts: { when: "always", paths: [reportPath] },
+                artifacts: { when: "always", paths: [reportPath], ...(job.wave ? { reports: { dotenv: WAVE_GREEN_DOTENV } } : {}) },
             },
         ])),
     };
@@ -323,9 +332,9 @@ function prLoopGitlabPipeline(components, env, image, beforeScript, extraScript,
         { jobName: planJob, component: "merge request plan", stage: "plan", needs: [] },
         ...applies.map(({ job, name, stage }, i) => ({
             jobName: name,
-            component: job.wave ? `merge request apply, wave ${job.wave}` : job.jobName === "record" ? "merge record" : "merge request apply",
+            component: job.wave ? `green apply, wave ${job.wave}` : job.jobName === "record" ? "merge record" : "green apply",
             stage,
-            needs: i > 0 ? [applies[i - 1].name] : [],
+            needs: i > 1 ? [applies[i - 1].name] : [],
         })),
     ];
     const yaml = emitGitlabFile(["workflow", "stages", "variables", planJob, ...applies.map((a) => a.name)].map((key) => [key, doc[key]]));

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "4f62190704fd273b241b9d720bc4c540ba40ec64fb082eaea1efa22c7716e890",
+    "manifest.json": "010ddb2b4be32c44dd4143e0edf74c071bd7172f669963e566fcf0f9bb98ee35",
     "meta.json": "db082fbf90c5941c498b2bee0f106103449c1a4c257716ca2220f0dd490450b2",
     "types/index.d.ts": "a048a66ebe20da0cb5fc889054cac69044d9bf882e2c56b5c5bf113d1f3ba57c",
     "rules/artifact-no-expiry.ts": "0ca5bb972d4a542126e8a0229d43b55658394cb7dd9b9923b2c590bec1c2ad7d",
@@ -55,5 +55,5 @@
     "skills/chant-gitlab-migrate.md": "4853d04980560b379e5b0f7267dcb0a1e5d5879cb9e9931681ce76b2a5fe69d8",
     "skills/chant-gitlab-patterns.md": "6d9a44e9e8de4c3820be9d65381b0d2ede4cb3626aaaf0011e21838a9fbf556e"
   },
-  "composite": "dbe731086396814e3bf4e1930b0c5d31ca7c0a4405044141643a616009002d10"
+  "composite": "6417e0110043d03afc8b64c4ec5e2b971f41d3e14b74df94ac1a5dfa5c192d34"
 }

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "gitlab",
-  "version": "0.124.34",
+  "version": "0.124.36",
   "chantVersion": ">=0.1.0",
   "namespace": "GitLab",
   "intrinsics": [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-gitlab",
-  "version": "0.124.34",
+  "version": "0.124.36",
   "description": "GitLab CI lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -67,8 +67,8 @@
     "typescript": "^5.9.3"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.124.34",
-    "@intentius/chant-lexicon-github": "^0.124.34"
+    "@intentius/chant": "^0.124.36",
+    "@intentius/chant-lexicon-github": "^0.124.36"
   },
   "peerDependenciesMeta": {
     "@intentius/chant-lexicon-github": {

package/src/components/__fixtures__/pr-loop-build.gitlab.golden.yml

@@ -3,9 +3,11 @@ workflow:
   rules:
     - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
     - if: '$CI_PIPELINE_SOURCE == "push" && $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'
+    - if: '$CI_COMMIT_TAG =~ /^ci\/green\//'
 
 stages:
   - plan
+  - record
   - apply
 
 variables:
@@ -30,10 +32,10 @@ plan:
     paths:
       - .chant/pr
 
-apply:
-  stage: apply
+record:
+  stage: record
   image: node:22
-  resource_group: chant-apply-prod
+  resource_group: chant-record-prod
   rules:
     - if: '$CI_PIPELINE_SOURCE == "push" && $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'
   variables:
@@ -43,7 +45,25 @@ apply:
     - if [ -z "$BASE_SHA" ] || [ "$BASE_SHA" = "0000000000000000000000000000000000000000" ]; then BASE_SHA="${CI_MERGE_REQUEST_DIFF_BASE_SHA:-}"; if [ -z "$BASE_SHA" ]; then git fetch origin $CI_DEFAULT_BRANCH && BASE_SHA="$(git merge-base FETCH_HEAD "$CI_COMMIT_SHA")"; if [ "$BASE_SHA" = "$CI_COMMIT_SHA" ]; then BASE_SHA="$(git rev-parse --verify --quiet "$CI_COMMIT_SHA^" || echo 4b825dc642cb6eb9a060e54bf8d69288fbee4904)"; fi; fi; fi; export BASE_SHA
     - chant build --env prod
     - chant lint
-    - chant ci run apply --in-place --base "$BASE_SHA" --env prod --gate pr-apply --forge gitlab
+    - chant ci run record --in-place --base "$BASE_SHA" --env prod --gate pr-apply --forge gitlab
+  artifacts:
+    when: always
+    paths:
+      - .chant/pr
+
+apply:
+  stage: apply
+  image: node:22
+  resource_group: chant-apply-prod
+  rules:
+    - if: '$CI_COMMIT_TAG =~ /^ci\/green\//'
+  variables: {}
+  script:
+    - command -v tofu >/dev/null 2>&1 || (curl -fsSL https://get.opentofu.org/install-opentofu.sh -o /tmp/install-opentofu.sh && sh /tmp/install-opentofu.sh --install-method standalone)
+    - git fetch --quiet --tags origin "+refs/heads/$CI_DEFAULT_BRANCH:refs/remotes/origin/$CI_DEFAULT_BRANCH" && GREEN_SHA="$(chant ci last-green)" && git checkout --quiet --detach "$GREEN_SHA"
+    - chant build --env prod
+    - chant lint
+    - chant ci run apply --in-place --env prod --gate pr-apply --forge gitlab
   cache:
     key: chant-apply-prod-$CI_COMMIT_SHA
     paths:

package/src/components/__fixtures__/pr-loop-waves.gitlab.golden.yml

@@ -3,9 +3,11 @@ workflow:
   rules:
     - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
     - if: '$CI_PIPELINE_SOURCE == "push" && $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'
+    - if: '$CI_COMMIT_TAG =~ /^ci\/green\//'
 
 stages:
   - plan
+  - record
   - apply-wave-1
   - apply-wave-2
   - apply-wave-3
@@ -30,10 +32,10 @@ plan:
     paths:
       - .chant/pr
 
-apply-wave-1:
-  stage: apply-wave-1
+record:
+  stage: record
   image: node:22
-  resource_group: chant-apply-prod
+  resource_group: chant-record-prod
   rules:
     - if: '$CI_PIPELINE_SOURCE == "push" && $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'
   variables:
@@ -41,7 +43,24 @@ apply-wave-1:
   script:
     - command -v tofu >/dev/null 2>&1 || (curl -fsSL https://get.opentofu.org/install-opentofu.sh -o /tmp/install-opentofu.sh && sh /tmp/install-opentofu.sh --install-method standalone)
     - if [ -z "$BASE_SHA" ] || [ "$BASE_SHA" = "0000000000000000000000000000000000000000" ]; then BASE_SHA="${CI_MERGE_REQUEST_DIFF_BASE_SHA:-}"; if [ -z "$BASE_SHA" ]; then git fetch origin $CI_DEFAULT_BRANCH && BASE_SHA="$(git merge-base FETCH_HEAD "$CI_COMMIT_SHA")"; if [ "$BASE_SHA" = "$CI_COMMIT_SHA" ]; then BASE_SHA="$(git rev-parse --verify --quiet "$CI_COMMIT_SHA^" || echo 4b825dc642cb6eb9a060e54bf8d69288fbee4904)"; fi; fi; fi; export BASE_SHA
-    - chant ci run apply --in-place --base "$BASE_SHA" --env prod --gate pr-apply --forge gitlab --wave-gate release --wave 1
+    - chant ci run record --in-place --base "$BASE_SHA" --env prod --gate pr-apply --forge gitlab
+  artifacts:
+    when: always
+    paths:
+      - .chant/pr
+
+apply-wave-1:
+  stage: apply-wave-1
+  image: node:22
+  resource_group: chant-apply-prod
+  rules:
+    - if: '$CI_COMMIT_TAG =~ /^ci\/green\//'
+  variables: {}
+  script:
+    - command -v tofu >/dev/null 2>&1 || (curl -fsSL https://get.opentofu.org/install-opentofu.sh -o /tmp/install-opentofu.sh && sh /tmp/install-opentofu.sh --install-method standalone)
+    - git fetch --quiet --tags origin "+refs/heads/$CI_DEFAULT_BRANCH:refs/remotes/origin/$CI_DEFAULT_BRANCH" && GREEN_SHA="$(chant ci last-green)" && git checkout --quiet --detach "$GREEN_SHA"
+    - echo "GREEN_SHA=$GREEN_SHA" > "$CI_PROJECT_DIR/chant-green.env"
+    - chant ci run apply --in-place --env prod --gate pr-apply --forge gitlab --wave-gate release --wave 1
   cache:
     key: chant-apply-prod-$CI_COMMIT_SHA
     paths:
@@ -51,6 +70,8 @@ apply-wave-1:
     when: always
     paths:
       - .chant/pr
+    reports:
+      dotenv: chant-green.env
 
 apply-wave-2:
   stage: apply-wave-2
@@ -59,13 +80,13 @@ apply-wave-2:
     - apply-wave-1
   resource_group: chant-apply-prod
   rules:
-    - if: '$CI_PIPELINE_SOURCE == "push" && $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'
-  variables:
-    BASE_SHA: '$CI_COMMIT_BEFORE_SHA'
+    - if: '$CI_COMMIT_TAG =~ /^ci\/green\//'
+  variables: {}
   script:
     - command -v tofu >/dev/null 2>&1 || (curl -fsSL https://get.opentofu.org/install-opentofu.sh -o /tmp/install-opentofu.sh && sh /tmp/install-opentofu.sh --install-method standalone)
-    - if [ -z "$BASE_SHA" ] || [ "$BASE_SHA" = "0000000000000000000000000000000000000000" ]; then BASE_SHA="${CI_MERGE_REQUEST_DIFF_BASE_SHA:-}"; if [ -z "$BASE_SHA" ]; then git fetch origin $CI_DEFAULT_BRANCH && BASE_SHA="$(git merge-base FETCH_HEAD "$CI_COMMIT_SHA")"; if [ "$BASE_SHA" = "$CI_COMMIT_SHA" ]; then BASE_SHA="$(git rev-parse --verify --quiet "$CI_COMMIT_SHA^" || echo 4b825dc642cb6eb9a060e54bf8d69288fbee4904)"; fi; fi; fi; export BASE_SHA
-    - chant ci run apply --in-place --base "$BASE_SHA" --env prod --gate pr-apply --forge gitlab --wave-gate release --wave 2
+    - test -n "$GREEN_SHA" && git fetch --quiet --tags origin "+refs/heads/$CI_DEFAULT_BRANCH:refs/remotes/origin/$CI_DEFAULT_BRANCH" && git checkout --quiet --detach "$GREEN_SHA"
+    - echo "GREEN_SHA=$GREEN_SHA" > "$CI_PROJECT_DIR/chant-green.env"
+    - chant ci run apply --in-place --env prod --gate pr-apply --forge gitlab --wave-gate release --wave 2
   cache:
     key: chant-apply-prod-$CI_COMMIT_SHA
     paths:
@@ -75,6 +96,8 @@ apply-wave-2:
     when: always
     paths:
       - .chant/pr
+    reports:
+      dotenv: chant-green.env
 
 apply-wave-3:
   stage: apply-wave-3
@@ -83,13 +106,13 @@ apply-wave-3:
     - apply-wave-2
   resource_group: chant-apply-prod
   rules:
-    - if: '$CI_PIPELINE_SOURCE == "push" && $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'
-  variables:
-    BASE_SHA: '$CI_COMMIT_BEFORE_SHA'
+    - if: '$CI_COMMIT_TAG =~ /^ci\/green\//'
+  variables: {}
   script:
     - command -v tofu >/dev/null 2>&1 || (curl -fsSL https://get.opentofu.org/install-opentofu.sh -o /tmp/install-opentofu.sh && sh /tmp/install-opentofu.sh --install-method standalone)
-    - if [ -z "$BASE_SHA" ] || [ "$BASE_SHA" = "0000000000000000000000000000000000000000" ]; then BASE_SHA="${CI_MERGE_REQUEST_DIFF_BASE_SHA:-}"; if [ -z "$BASE_SHA" ]; then git fetch origin $CI_DEFAULT_BRANCH && BASE_SHA="$(git merge-base FETCH_HEAD "$CI_COMMIT_SHA")"; if [ "$BASE_SHA" = "$CI_COMMIT_SHA" ]; then BASE_SHA="$(git rev-parse --verify --quiet "$CI_COMMIT_SHA^" || echo 4b825dc642cb6eb9a060e54bf8d69288fbee4904)"; fi; fi; fi; export BASE_SHA
-    - chant ci run apply --in-place --base "$BASE_SHA" --env prod --gate pr-apply --forge gitlab --wave-gate release --wave 3
+    - test -n "$GREEN_SHA" && git fetch --quiet --tags origin "+refs/heads/$CI_DEFAULT_BRANCH:refs/remotes/origin/$CI_DEFAULT_BRANCH" && git checkout --quiet --detach "$GREEN_SHA"
+    - echo "GREEN_SHA=$GREEN_SHA" > "$CI_PROJECT_DIR/chant-green.env"
+    - chant ci run apply --in-place --env prod --gate pr-apply --forge gitlab --wave-gate release --wave 3
   cache:
     key: chant-apply-prod-$CI_COMMIT_SHA
     paths:
@@ -99,3 +122,5 @@ apply-wave-3:
     when: always
     paths:
       - .chant/pr
+    reports:
+      dotenv: chant-green.env

package/src/components/__fixtures__/pr-loop.gitlab.golden.yml

@@ -3,9 +3,11 @@ workflow:
   rules:
     - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
     - if: '$CI_PIPELINE_SOURCE == "push" && $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'
+    - if: '$CI_COMMIT_TAG =~ /^ci\/green\//'
 
 stages:
   - plan
+  - record
   - apply
 
 variables:
@@ -28,10 +30,10 @@ plan:
     paths:
       - .chant/pr
 
-apply:
-  stage: apply
+record:
+  stage: record
   image: node:22
-  resource_group: chant-apply-prod
+  resource_group: chant-record-prod
   rules:
     - if: '$CI_PIPELINE_SOURCE == "push" && $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'
   variables:
@@ -39,7 +41,23 @@ apply:
   script:
     - command -v tofu >/dev/null 2>&1 || (curl -fsSL https://get.opentofu.org/install-opentofu.sh -o /tmp/install-opentofu.sh && sh /tmp/install-opentofu.sh --install-method standalone)
     - if [ -z "$BASE_SHA" ] || [ "$BASE_SHA" = "0000000000000000000000000000000000000000" ]; then BASE_SHA="${CI_MERGE_REQUEST_DIFF_BASE_SHA:-}"; if [ -z "$BASE_SHA" ]; then git fetch origin $CI_DEFAULT_BRANCH && BASE_SHA="$(git merge-base FETCH_HEAD "$CI_COMMIT_SHA")"; if [ "$BASE_SHA" = "$CI_COMMIT_SHA" ]; then BASE_SHA="$(git rev-parse --verify --quiet "$CI_COMMIT_SHA^" || echo 4b825dc642cb6eb9a060e54bf8d69288fbee4904)"; fi; fi; fi; export BASE_SHA
-    - chant ci run apply --in-place --base "$BASE_SHA" --env prod --gate pr-apply --forge gitlab
+    - chant ci run record --in-place --base "$BASE_SHA" --env prod --gate pr-apply --forge gitlab
+  artifacts:
+    when: always
+    paths:
+      - .chant/pr
+
+apply:
+  stage: apply
+  image: node:22
+  resource_group: chant-apply-prod
+  rules:
+    - if: '$CI_COMMIT_TAG =~ /^ci\/green\//'
+  variables: {}
+  script:
+    - command -v tofu >/dev/null 2>&1 || (curl -fsSL https://get.opentofu.org/install-opentofu.sh -o /tmp/install-opentofu.sh && sh /tmp/install-opentofu.sh --install-method standalone)
+    - git fetch --quiet --tags origin "+refs/heads/$CI_DEFAULT_BRANCH:refs/remotes/origin/$CI_DEFAULT_BRANCH" && GREEN_SHA="$(chant ci last-green)" && git checkout --quiet --detach "$GREEN_SHA"
+    - chant ci run apply --in-place --env prod --gate pr-apply --forge gitlab
   cache:
     key: chant-apply-prod-$CI_COMMIT_SHA
     paths:

package/src/components/generate-pipeline.ts

@@ -300,6 +300,12 @@ function gatedWaveGitlabPipeline(
  * k-1 pushed, and a retry of a wave that stopped at its gate pulls the one it
  * pushed itself.
  */
+/** The dotenv report a gated apply wave hands the green commit it applies through (#4221). */
+const WAVE_GREEN_DOTENV = "chant-green.env";
+
+/** The rule of a pipeline for a pushed `ci/green/` tag (#4168 step 9), which runs the apply under apply on merge. */
+const GITLAB_GREEN_TAG_RULE = '$CI_COMMIT_TAG =~ /^ci\\/green\\//';
+
 function prLoopGitlabPipeline(
   components: DriverComponent[],
   env: string,
@@ -316,23 +322,28 @@ function prLoopGitlabPipeline(
   const planJob = member ? `${member.name}-plan` : "plan";
   const named = (job: string) => (member ? `${member.name}-${job}` : job);
   const waveJobs = loop.waveGate ? prLoopWaveJobs(components, apply) : [];
-  const applies = loop.waveGate
+  // #4168 step 9: a push to the branch records, and under apply on merge a ci/green/ tag pipeline applies.
+  const greens = loop.waveGate
     ? waveJobs.map((job) => ({ job, name: named(prApplyWaveJobName(job.wave!)), stage: prApplyWaveJobName(job.wave!) }))
     : loop.applyOnMerge
       ? [{ job: apply, name: named("apply"), stage: "apply" }]
-      : [{ job: record, name: named("record"), stage: "record" }];
+      : [];
+  const applies = [{ job: record, name: named("record"), stage: "record" }, ...greens];
   const onMergeRequest = GITLAB_MERGE_REQUEST_SOURCE;
   if (loop.branch !== undefined) assertGitlabBranch("The merge-request pipeline", loop.branch);
   const onMerge = gitlabPushRule(loop.branch ? JSON.stringify(loop.branch) : "$CI_DEFAULT_BRANCH");
+  const onGreen = GITLAB_GREEN_TAG_RULE;
   // A member's jobs start in its directory, after the image's install lines.
   const enter = rooted ? [] : [`cd ${memberShellDir(member!)}`];
   // The command runs through chant ci run (#4156), which writes the job's run record, signed when the CHANT_RUNNER_KEY variable is set.
-  const script = (job: typeof plan): string[] => [...prLoopSetup(image), ...enter, ...beforeScript, ...(job.setup ?? []), ...(job.build ?? []), job.run.command, ...extraScript];
+  // #4221: a wave job hands the commit it applies to the next wave as GREEN_SHA, through a dotenv report.
+  const handOff = (job: typeof plan): string[] => (job.wave ? [`echo "GREEN_SHA=$GREEN_SHA" > "$CI_PROJECT_DIR/${WAVE_GREEN_DOTENV}"`] : []);
+  const script = (job: typeof plan): string[] => [...prLoopSetup(image), ...enter, ...beforeScript, ...(job.checkout ?? []), ...handOff(job), ...(job.setup ?? []), ...(job.build ?? []), job.run.command, ...extraScript];
   const stages = ["plan", ...applies.map((a) => a.stage)];
   const doc: Record<string, unknown> = {
     // Included files merge their top-level keys, so a member's file carries
     // the rules every member shares and no name: two names would collide.
-    workflow: { ...(member ? {} : { name: `chant-pr-${env}` }), rules: [{ if: onMergeRequest }, { if: onMerge }] },
+    workflow: { ...(member ? {} : { name: `chant-pr-${env}` }), rules: [{ if: onMergeRequest }, { if: onMerge }, ...(greens.length > 0 ? [{ if: onGreen }] : [])] },
     stages,
     variables: { ...options.variables, CHANT_ENV: env, ...GITLAB_FULL_HISTORY },
     [planJob]: {
@@ -349,9 +360,9 @@ function prLoopGitlabPipeline(
         {
           stage,
           image,
-          ...(i > 0 ? { needs: [applies[i - 1]!.name] } : {}),
+          ...(i > 1 ? { needs: [applies[i - 1]!.name] } : {}),
           resource_group: job.jobName === "record" ? prRecordGroup(env, member?.name) : prApplyGroup(env, member?.name),
-          rules: [{ if: onMerge }],
+          rules: [{ if: job.jobName === "record" ? onMerge : onGreen }],
           variables: job.run.env,
           script: script(job),
           // The attempt record (#3543), kept under the pushed commit even when
@@ -366,7 +377,7 @@ function prLoopGitlabPipeline(
                   when: "always",
                 },
               }),
-          artifacts: { when: "always", paths: [reportPath] },
+          artifacts: { when: "always", paths: [reportPath], ...(job.wave ? { reports: { dotenv: WAVE_GREEN_DOTENV } } : {}) },
         },
       ]),
     ),
@@ -375,9 +386,9 @@ function prLoopGitlabPipeline(
     { jobName: planJob, component: "merge request plan", stage: "plan", needs: [] },
     ...applies.map(({ job, name, stage }, i) => ({
       jobName: name,
-      component: job.wave ? `merge request apply, wave ${job.wave}` : job.jobName === "record" ? "merge record" : "merge request apply",
+      component: job.wave ? `green apply, wave ${job.wave}` : job.jobName === "record" ? "merge record" : "green apply",
       stage,
-      needs: i > 0 ? [applies[i - 1]!.name] : [],
+      needs: i > 1 ? [applies[i - 1]!.name] : [],
     })),
   ];
   const yaml = emitGitlabFile(["workflow", "stages", "variables", planJob, ...applies.map((a) => a.name)].map((key) => [key, doc[key]] as const));

package/src/components/generate-pr-pipeline.test.ts

@@ -12,7 +12,7 @@ import { describe, expect, test } from "vitest";
 import { parseYAML } from "@intentius/chant/yaml";
 import type { DriverComponent } from "@intentius/chant/components/driver";
 import { generateGitlabPipeline } from "./generate-pipeline";
-import { PR_LOOP_SETUP, prLoopJobs } from "@intentius/chant/components/pr-pipeline";
+import { greenCheckout, PR_LOOP_SETUP, prLoopJobs } from "@intentius/chant/components/pr-pipeline";
 
 const ESTATE: DriverComponent[] = [
   { name: "net", dependsOn: [], deploy: [{ phase: "Apply", steps: [{ kind: "terraform-apply", root: "net" }] }] },
@@ -30,11 +30,12 @@ interface Job {
   image?: string;
   artifacts: Record<string, unknown>;
   cache?: Record<string, unknown>;
+  needs?: string[];
 }
 
 describe("the GitLab merge-request pipeline", () => {
   const result = generateGitlabPipeline(ESTATE, { env: "prod", prLoop: { applyOnMerge: true } });
-  const doc = parseYAML(result.yaml) as { workflow: { rules: unknown[] }; variables: Record<string, string>; plan: Job; apply: Job };
+  const doc = parseYAML(result.yaml) as { workflow: { rules: unknown[] }; variables: Record<string, string>; plan: Job; record: Job; apply: Job };
 
   test("matches its golden", () => {
     if (process.env.UPDATE_GOLDEN) writeFileSync(GOLDEN, result.yaml);
@@ -50,15 +51,21 @@ describe("the GitLab merge-request pipeline", () => {
     expect(ok, JSON.stringify(validate.errors, null, 2)).toBe(true);
   });
 
-  test("plans in a merge request pipeline from its diff base, applies on a push to the default branch, one at a time", () => {
+  test("plans in a merge request pipeline from its diff base, records on a push to the default branch, applies on a ci/green/ tag, one at a time", () => {
     expect(doc.plan.rules).toEqual([{ if: '$CI_PIPELINE_SOURCE == "merge_request_event"' }]);
     expect(doc.plan.variables).toEqual({ BASE_SHA: "$CI_MERGE_REQUEST_DIFF_BASE_SHA", PR_NUMBER: "$CI_MERGE_REQUEST_IID" });
     expect(doc.plan.script).toEqual([
       ...PR_LOOP_SETUP,'chant ci run plan --in-place --no-push --base "$BASE_SHA" --pr "$PR_NUMBER" --env prod --gate pr-apply --forge gitlab']);
-    expect(doc.apply.rules).toEqual([{ if: '$CI_PIPELINE_SOURCE == "push" && $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH' }]);
-    expect(doc.apply.variables).toEqual({ BASE_SHA: "$CI_COMMIT_BEFORE_SHA" });
+    expect(doc.record.rules).toEqual([{ if: '$CI_PIPELINE_SOURCE == "push" && $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH' }]);
+    expect(doc.record.variables).toEqual({ BASE_SHA: "$CI_COMMIT_BEFORE_SHA" });
+    // #4168 step 9: a pushed ci/green/ tag runs the apply, which checks out the newest green commit and reads no push base.
+    expect(doc.apply.rules).toEqual([{ if: "$CI_COMMIT_TAG =~ /^ci\\/green\\//" }]);
+    expect(doc.workflow.rules).toContainEqual({ if: "$CI_COMMIT_TAG =~ /^ci\\/green\\//" });
+    expect(doc.apply.variables).toEqual({});
+    expect(doc.apply.script.at(-2)).toBe(greenCheckout("$CI_DEFAULT_BRANCH"));
+    expect(doc.apply.needs).toBeUndefined();
     // #4156: ci run builds pr-apply (with no --require-review since #4168), and GitLab hands CHANT_RUNNER_KEY to the job as a CI/CD variable when it has one.
-    expect(doc.apply.script.at(-1)).toBe('chant ci run apply --in-place --base "$BASE_SHA" --env prod --gate pr-apply --forge gitlab');
+    expect(doc.apply.script.at(-1)).toBe("chant ci run apply --in-place --env prod --gate pr-apply --forge gitlab");
     expect(result.yaml).not.toContain("CHANT_RUNNER_KEY");
     expect(doc.apply.resource_group).toBe("chant-apply-prod");
     expect(doc.variables.GIT_DEPTH).toBe("0");
@@ -84,10 +91,10 @@ describe("the GitLab merge-request pipeline", () => {
   });
 
   test("an all-zero CI_COMMIT_BEFORE_SHA falls back to the merge request diff base, then the target branch", () => {
-    const line = doc.apply.script.find((l) => l.includes("CI_MERGE_REQUEST_DIFF_BASE_SHA"))!;
+    const line = doc.record.script.find((l) => l.includes("CI_MERGE_REQUEST_DIFF_BASE_SHA"))!;
     expect(line).toContain("0000000000000000000000000000000000000000");
     expect(line).toContain("git fetch origin $CI_DEFAULT_BRANCH");
-    expect(doc.apply.script.indexOf(line)).toBeLessThan(doc.apply.script.length - 1);
+    expect(doc.record.script.indexOf(line)).toBeLessThan(doc.record.script.length - 1);
     expect(doc.plan.script.some((l) => l.includes("CI_MERGE_REQUEST_DIFF_BASE_SHA"))).toBe(false);
   });
 
@@ -114,11 +121,11 @@ describe("the GitLab merge-request pipeline", () => {
     const member = { name: "network", dir: "infra/network", file: ".gitlab/ci/chant-pr.network.prod.gitlab-ci.yml" };
     const scoped = generateGitlabPipeline(ESTATE, { env: "prod", prLoop: { applyOnMerge: true }, member });
     const mdoc = parseYAML(scoped.yaml) as Record<string, unknown> & { workflow: { name?: string; rules: unknown[] } };
-    expect(scoped.jobs.map((j) => j.jobName)).toEqual(["network-plan", "network-apply"]);
+    expect(scoped.jobs.map((j) => j.jobName)).toEqual(["network-plan", "network-record", "network-apply"]);
     expect(mdoc.plan).toBeUndefined();
     // Included files merge top-level keys: no name, so members do not collide on it.
     expect(mdoc.workflow.name).toBeUndefined();
-    expect(mdoc.workflow.rules).toHaveLength(2);
+    expect(mdoc.workflow.rules).toHaveLength(3);
     const plan = mdoc["network-plan"] as Job;
     const apply = mdoc["network-apply"] as Job;
     expect(plan.script).toContain("cd infra/network");

package/src/components/generate-pr-waves-pipeline.test.ts

@@ -42,6 +42,17 @@ describe("the GitLab merge-request pipeline with a gate per wave (#4003)", () =>
     expect(result.yaml).toBe(readFileSync(GOLDEN, "utf-8"));
   });
 
+  test("wave 1 takes the newest green commit, and each later wave applies the one wave 1 took (#4221)", () => {
+    for (const k of [1, 2, 3]) {
+      const job = doc[`apply-wave-${k}`] as { script: string[]; artifacts: { reports?: { dotenv?: string } } };
+      expect(job.artifacts.reports).toEqual({ dotenv: "chant-green.env" });
+      expect(job.script).toContain('echo "GREEN_SHA=$GREEN_SHA" > "$CI_PROJECT_DIR/chant-green.env"');
+      const lastGreen = job.script.some((l) => l.includes("chant ci last-green"));
+      expect(lastGreen).toBe(k === 1);
+      if (k > 1) expect(job.script.some((l) => l.startsWith('test -n "$GREEN_SHA"'))).toBe(true);
+    }
+  });
+
   test("validates against the vendored GitLab CI schema", () => {
     const req = createRequire(import.meta.url);
     const mod = req("ajv") as { default?: unknown };
@@ -51,9 +62,10 @@ describe("the GitLab merge-request pipeline with a gate per wave (#4003)", () =>
   });
 
   test("one apply job and stage per wave, each needing the one before, on the merge, one at a time", () => {
-    expect(doc.stages).toEqual(["plan", "apply-wave-1", "apply-wave-2", "apply-wave-3"]);
+    expect(doc.stages).toEqual(["plan", "record", "apply-wave-1", "apply-wave-2", "apply-wave-3"]);
     expect(result.jobs.map((j) => [j.jobName, j.needs])).toEqual([
       ["plan", []],
+      ["record", []],
       ["apply-wave-1", []],
       ["apply-wave-2", ["apply-wave-1"]],
       ["apply-wave-3", ["apply-wave-2"]],
@@ -64,7 +76,7 @@ describe("the GitLab merge-request pipeline with a gate per wave (#4003)", () =>
       expect(job.needs).toEqual(k > 1 ? [`apply-wave-${k - 1}`] : undefined);
       expect(job.resource_group).toBe("chant-apply-prod");
       // #4156: through chant ci run, which runs pr-apply --wave-gate release (no --require-review since #4168) --resume ... --wave <k>.
-      expect(job.script.at(-1)).toBe(`chant ci run apply --in-place --base "$BASE_SHA" --env prod --gate pr-apply --forge gitlab --wave-gate release --wave ${k}`);
+      expect(job.script.at(-1)).toBe(`chant ci run apply --in-place --env prod --gate pr-apply --forge gitlab --wave-gate release --wave ${k}`);
       // Every wave shares the commit's record, so wave k pulls what wave k-1 pushed.
       expect(job.cache).toEqual({ key: "chant-apply-prod-$CI_COMMIT_SHA", paths: [".chant/pr-resume/pr-apply.json"], when: "always" });
     }
@@ -77,12 +89,13 @@ describe("the GitLab merge-request pipeline with a gate per wave (#4003)", () =>
     const scoped = generateGitlabPipeline(ESTATE, { env: "prod", prLoop: { applyOnMerge: true }, gatedWaves: { gate: "release" }, member });
     expect(scoped.jobs.map((j) => [j.jobName, j.needs])).toEqual([
       ["network-plan", []],
+      ["network-record", []],
       ["network-apply-wave-1", []],
       ["network-apply-wave-2", ["network-apply-wave-1"]],
       ["network-apply-wave-3", ["network-apply-wave-2"]],
     ]);
     // ci run, started in the member's directory, passes --member network to pr-apply.
     expect(scoped.yaml).toContain("cd infra/network");
-    expect(scoped.yaml).toContain("chant ci run apply --in-place --base \"$BASE_SHA\" --env prod --gate pr-apply --forge gitlab --wave-gate release --wave 3");
+    expect(scoped.yaml).toContain("chant ci run apply --in-place --env prod --gate pr-apply --forge gitlab --wave-gate release --wave 3");
   });
 });