@intentius/chant-lexicon-gitlab 0.124.46 → 0.124.49

package/dist/components/generate-op-pipeline.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generate-op-pipeline.d.ts","sourceRoot":"","sources":["../../src/components/generate-op-pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyGG;AAeH,OAAO,KAAK,EACV,wBAAwB,IAAI,uBAAuB,EAInD,gBAAgB,IAAI,sBAAsB,EAE1C,eAAe,EAChB,MAAM,0BAA0B,CAAC;AAIlC,YAAY,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,CAAC;AA4HhE;;;;GAIG;AACH,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,eAAe,EAAE,EACtB,OAAO,GAAE,uBAA4B,GACpC,sBAAsB,CAsGxB"}
+{"version":3,"file":"generate-op-pipeline.d.ts","sourceRoot":"","sources":["../../src/components/generate-op-pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyGG;AAeH,OAAO,KAAK,EACV,wBAAwB,IAAI,uBAAuB,EAInD,gBAAgB,IAAI,sBAAsB,EAE1C,eAAe,EAChB,MAAM,0BAA0B,CAAC;AAIlC,YAAY,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,CAAC;AA8IhE;;;;GAIG;AACH,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,eAAe,EAAE,EACtB,OAAO,GAAE,uBAA4B,GACpC,sBAAsB,CAuGxB"}

package/dist/components/generate-op-pipeline.js

@@ -164,6 +164,22 @@ function assertTriggerSupportsMode(name, mode, trigger) {
         `no merge request to post on. Give it a { kind: "pull_request" } trigger, or use findingMode "issue" ` +
         `or "merge-request".`);
 }
+/**
+ * Refuse `reviewAgent` (#4326). The split posts the review from a second job
+ * that holds the forge write token, and a GitLab merge request pipeline hands
+ * every job the project's unprotected CI/CD variables, the review job's
+ * included. A token protected enough to stay out of it is not available to a
+ * job of that pipeline either, so the post has to start from a pipeline of
+ * the default branch, which this generator does not build. The refusal names
+ * the Op and the way out rather than emitting a review job that holds the token.
+ */
+function assertNoReviewSplit(spec) {
+    if (!spec.reviewAgent)
+        return;
+    throw new Error(`Scheduled Op "${spec.name}" sets reviewAgent, which keeps the model's job free of the forge write token and posts the note from a second job. ` +
+        `A GitLab merge request pipeline hands every job the project's unprotected variables, so the gitlab generator does not build that split. ` +
+        `Drop reviewAgent and run the review with findingMode "comment" (the model command still runs with a cleared environment), or generate this Op for GitHub or Forgejo.`);
+}
 /**
  * The follow-up line an Op with an `environment` adds under its own header
  * line (#2257). The `environment:` key on the job binds it to the
@@ -235,6 +251,7 @@ export function generateGitlabOpPipeline(ops, options = {}) {
         const findingMode = spec.findingMode ?? "report";
         const trigger = resolveOpTrigger(spec);
         assertTriggerSupportsMode(spec.name, findingMode, trigger);
+        assertNoReviewSplit(spec);
         if (trigger.kind === "cron")
             anyCron = true;
         const jobName = jobPrefix + ciJobName(spec.name);

package/dist/components/generate-op-waves-pipeline.d.ts

@@ -3,8 +3,16 @@
  *
  * One file, one stage per wave, on a push to the spec's branches. Each job is
  * one of core's `opWaveJobs`, and `needs:` chains them so a wave that waits at
- * its gate (exit 3) or fails stops every later wave; retrying the failed job
- * after `chant approve` carries on. `GIT_DEPTH: "0"` gives the runner the base
+ * its gate (exit 3) stops every later wave; retrying the failed job after
+ * `chant approve` carries on, and the jobs it skipped run after it.
+ *
+ * A job that exits 1 (a run failed, or was blocked) is an allowed failure
+ * (`allow_failure: exit_codes: [1]`, #4322), so the next wave's jobs run
+ * after it and block only the runs that depend on a failed one. Every job
+ * keeps the outcome directory as an artifact, holding the outcome files it
+ * received through `needs:` and its own, so each later job reads every
+ * earlier one. Any other non-zero exit still stops the waves after it.
+ * `GIT_DEPTH: "0"` gives the runner the base
  * commit it reads the gate policy at. A wide wave's deciding job keeps its
  * decision as an artifact, which GitLab hands each share job through `needs:`.
  * A wave's `environment` is the job's own `environment:`; protect it in the

package/dist/components/generate-op-waves-pipeline.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generate-op-waves-pipeline.d.ts","sourceRoot":"","sources":["../../src/components/generate-op-waves-pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAkBH,OAAO,EAAmD,KAAK,WAAW,EAAE,MAAM,8BAA8B,CAAC;AACjH,OAAO,KAAK,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAI9F,gHAAgH;AAChH,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,sBAAsB,GAAG,qBAAqB,CA4FvH"}
+{"version":3,"file":"generate-op-waves-pipeline.d.ts","sourceRoot":"","sources":["../../src/components/generate-op-waves-pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAkBH,OAAO,EAAqE,KAAK,WAAW,EAAE,MAAM,8BAA8B,CAAC;AACnI,OAAO,KAAK,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAI9F,gHAAgH;AAChH,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,sBAAsB,GAAG,qBAAqB,CA+FvH"}

package/dist/components/generate-op-waves-pipeline.js

@@ -3,8 +3,16 @@
  *
  * One file, one stage per wave, on a push to the spec's branches. Each job is
  * one of core's `opWaveJobs`, and `needs:` chains them so a wave that waits at
- * its gate (exit 3) or fails stops every later wave; retrying the failed job
- * after `chant approve` carries on. `GIT_DEPTH: "0"` gives the runner the base
+ * its gate (exit 3) stops every later wave; retrying the failed job after
+ * `chant approve` carries on, and the jobs it skipped run after it.
+ *
+ * A job that exits 1 (a run failed, or was blocked) is an allowed failure
+ * (`allow_failure: exit_codes: [1]`, #4322), so the next wave's jobs run
+ * after it and block only the runs that depend on a failed one. Every job
+ * keeps the outcome directory as an artifact, holding the outcome files it
+ * received through `needs:` and its own, so each later job reads every
+ * earlier one. Any other non-zero exit still stops the waves after it.
+ * `GIT_DEPTH: "0"` gives the runner the base
  * commit it reads the gate policy at. A wide wave's deciding job keeps its
  * decision as an artifact, which GitLab hands each share job through `needs:`.
  * A wave's `environment` is the job's own `environment:`; protect it in the
@@ -31,7 +39,7 @@
  * checkout runs.
  */
 import { assertGitlabBranch, assertGitlabEnvironment, assertRunnerLabels, CI_IMAGE, environmentDoc, GITLAB_FULL_HISTORY, GITLAB_MERGE_REQUEST_SOURCE, GITLAB_SCHEDULE_SOURCE, gitlabIdTokensDoc, gitlabPushRule, gitlabSetupScript, gitlabTags, nonEmpty, pushBranches, } from "@intentius/chant/ci-jobs";
-import { opWaveGroupOf, opWaveJobs, opWavesResumeCommand } from "@intentius/chant/op/op-waves";
+import { opWaveGroupOf, opWaveJobs, opWaveOutcomeDir, opWavesResumeCommand } from "@intentius/chant/op/op-waves";
 import { gitlabTradeIdTokens, gitlabTradeLines, TRADE_SPEC_ENV } from "@intentius/chant/ci-identity";
 import { emitGitlabFile } from "./ci-jobs.js";
 /** Render an Op waves spec as one GitLab CI file, `<name>.gitlab-ci.yml` unless `opsFileName` names another. */
@@ -105,7 +113,9 @@ export function generateGitlabOpWavesPipeline(spec, options) {
                 rules,
                 ...(job.needs.length > 0 ? { needs: job.needs } : {}),
                 script: [...(cloud ? gitlabTradeLines() : []), ...setup, ...(options.beforeScript ?? []), job.command.join(" "), ...(options.extraScript ?? [])],
-                ...(job.kind === "decide" ? { artifacts: { when: "always", paths: [job.record], expire_in: "30 days" } } : {}),
+                // #4322: a run that failed, or was blocked, lets the next wave run; any other failure stops it.
+                allow_failure: { exit_codes: [1] },
+                artifacts: { when: "always", paths: [...(job.kind === "decide" ? [job.record] : []), `${opWaveOutcomeDir(spec)}/`], expire_in: "30 days" },
             },
         ]);
     }
@@ -124,7 +134,8 @@ export function generateGitlabOpWavesPipeline(spec, options) {
     const header = [
         `# chant Op waves "${spec.name}": one stage per wave, each needing the one before.`,
         "# A wave that waits at its gate exits 3 and stops the waves after it; approve the",
-        "# digest it prints, then retry the job.",
+        "# digest it prints, then retry the job. A job whose runs failed exits 1, an allowed",
+        "# failure, and the waves after it run what does not depend on those runs.",
         ...(spec.resume
             ? [`# The ${spec.name}-resume job retries it for you in a pipeline schedule; give the schedule the cron "${spec.resume.schedule}".`]
             : []),

package/dist/components/generate-pipeline.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generate-pipeline.d.ts","sourceRoot":"","sources":["../../src/components/generate-pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAWH,OAAO,EAAyB,KAAK,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAwBjG,OAAO,KAAK,EACV,oBAAoB,IAAI,YAAY,EACpC,wBAAwB,IAAI,qBAAqB,EACjD,uBAAuB,IAAI,oBAAoB,EAEhD,MAAM,0BAA0B,CAAC;AAIlC,YAAY,EAAE,YAAY,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,CAAC;AAE1E;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,eAAe,EAAE,EAC7B,OAAO,GAAE,qBAA0B,GAClC,oBAAoB,CAkJtB"}
+{"version":3,"file":"generate-pipeline.d.ts","sourceRoot":"","sources":["../../src/components/generate-pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAWH,OAAO,EAAyB,KAAK,eAAe,EAAE,MAAM,oCAAoC,CAAC;AA0BjG,OAAO,KAAK,EACV,oBAAoB,IAAI,YAAY,EACpC,wBAAwB,IAAI,qBAAqB,EACjD,uBAAuB,IAAI,oBAAoB,EAEhD,MAAM,0BAA0B,CAAC;AAIlC,YAAY,EAAE,YAAY,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,CAAC;AAE1E;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,eAAe,EAAE,EAC7B,OAAO,GAAE,qBAA0B,GAClC,oBAAoB,CAkJtB"}

package/dist/components/generate-pipeline.js

@@ -35,7 +35,7 @@ import { assertGitlabBranch, CI_IMAGE, ciJobName, fillCommand, GITLAB_FULL_HISTO
 import { resolveComponentGraph } from "@intentius/chant/components/driver";
 import { hasPublishStep, promoteArchivePaths } from "@intentius/chant/components/promote";
 import { GATED_WAVE_RECORD, gatedWaveJobs } from "@intentius/chant/components/gated-wave-pipeline";
-import { PR_APPLY_RECORD, PR_LOOP_REPORT_DIR, prApplyGroup, prRecordGroup, prApplyRecordKey, prApplyWaveJobName, prLoopJobs, GITLAB_APPLY_PR_VAR, prLoopPostJob, prLoopSetup, PR_PLAN_NOTE_JOB, prLoopWaveJobs, prLoopWithWaves, prEnvJobs, PR_ENV_REPORT_DIR, PR_ENV_POST_JOB, } from "@intentius/chant/components/pr-pipeline";
+import { PR_APPLY_RECORD, PR_LOOP_REPORT_DIR, prApplyGroup, prRecordGroup, prApplyRecordKey, prApplyWaveJobName, prLoopJobs, GITLAB_APPLY_PR_VAR, GITLAB_PLAN_NOTES_VAR, gitlabPlanJobName, prLoopPostJob, prLoopSetup, PR_PLAN_NOTE_JOB, prLoopWaveJobs, prLoopWithWaves, prEnvJobs, PR_ENV_REPORT_DIR, PR_ENV_POST_JOB, } from "@intentius/chant/components/pr-pipeline";
 import { memberGitlabChanges, memberRepoPath, memberShellDir } from "@intentius/chant/lexicon";
 import { FORGE_TOKEN_VARS, GITLAB_DROP_FORGE_TOKENS } from "@intentius/chant/ci-handover";
 import { gitlabTradeIdTokens, gitlabTradeLines, TRADE_SPEC_ENV } from "@intentius/chant/ci-identity";
@@ -263,12 +263,16 @@ function gatedWaveGitlabPipeline(components, env, image, beforeScript, extraScri
  * The plan job holds no forge token while the merge request's code runs
  * (#4295, `@intentius/chant/ci-handover`): its script starts by unsetting
  * the token variables, and `pr-plan --no-status` writes the note and the
- * status into its report. The `plan-note` job after it, which GitLab hands
- * the report artifact, checks out the target branch's commit and posts them
- * with `chant components pr-post`. A CI/CD variable reaches every job of a
- * merge request pipeline, so `unset` keeps it from the plan's code, and
- * `CHANT_FORGE_TOKEN` as a protected variable keeps it from the pipeline
- * altogether.
+ * status into its report, which it keeps as its artifact. GitLab builds a
+ * merge request pipeline from the merge request's own files, so no job in it
+ * may hold the token (#4328): `CHANT_FORGE_TOKEN` and `CHANT_RUNNER_KEY` are
+ * protected variables, which a merge request pipeline never gets. The
+ * `plan-note` job runs in a pipeline of the target branch, built from that
+ * branch's files, that a pipeline schedule (or a person) starts with
+ * `CHANT_PLAN_NOTES` set to `1`. It runs `chant components pr-post --open`,
+ * which asks GitLab for each open merge request's plan job, reads the report
+ * from its artifacts and posts the note and the status for each job that
+ * settled since the last run.
  *
  * With `identity` (#4296, `@intentius/chant/ci-identity`) the plan, record
  * and apply jobs take an `id_tokens:` entry per cloud, and each script
@@ -290,6 +294,15 @@ const WAVE_GREEN_DOTENV = "chant-green.env";
 function gitlabApplyPrRule(branch) {
     return `$CI_PIPELINE_SOURCE =~ /^(web|api|trigger)$/ && $${GITLAB_APPLY_PR_VAR} =~ /^[0-9]+$/ && $CI_COMMIT_BRANCH == ${branch}`;
 }
+/**
+ * The rule of the plan-note job (#4328): a pipeline of `branch` that a
+ * pipeline schedule, a person or a trigger started with `CHANT_PLAN_NOTES`
+ * set to `1`. A merge request pipeline's own trigger job starts a pipeline
+ * whose source is `pipeline`, which this rule leaves out.
+ */
+function gitlabPlanNotesRule(branch) {
+    return `$CI_PIPELINE_SOURCE =~ /^(schedule|web|api|trigger)$/ && $${GITLAB_PLAN_NOTES_VAR} == "1" && $CI_COMMIT_BRANCH == ${branch}`;
+}
 /** The rule of a pipeline for a pushed `ci/green/` tag (#4168 step 9), which runs the apply under apply on merge. */
 const GITLAB_GREEN_TAG_RULE = '$CI_COMMIT_TAG =~ /^ci\\/green\\//';
 function prLoopGitlabPipeline(components, env, image, beforeScript, extraScript, options) {
@@ -298,7 +311,8 @@ function prLoopGitlabPipeline(components, env, image, beforeScript, extraScript,
     const rooted = !member || member.dir === "." || member.dir === "";
     const [plan, apply, record] = prLoopJobs("gitlab", env, loop, member?.name);
     const reportPath = member ? memberRepoPath(member, PR_LOOP_REPORT_DIR) : PR_LOOP_REPORT_DIR;
-    const planJob = member ? `${member.name}-plan` : "plan";
+    // #4328: the plan-note job's pr-post --open finds the plan job by this name.
+    const planJob = gitlabPlanJobName(member?.name);
     const named = (job) => (member ? `${member.name}-${job}` : job);
     const waveJobs = loop.waveGate ? prLoopWaveJobs(components, apply) : [];
     // #4168 step 9: a push to the branch records, and under apply on merge a ci/green/ tag pipeline applies.
@@ -313,6 +327,8 @@ function prLoopGitlabPipeline(components, env, image, beforeScript, extraScript,
         assertGitlabBranch("The merge-request pipeline", loop.branch);
     const onMerge = gitlabPushRule(loop.branch ? JSON.stringify(loop.branch) : "$CI_DEFAULT_BRANCH");
     // #4301: the apply before merge runs in a pipeline of the target branch a person starts with CHANT_APPLY_PR set.
+    // #4328: the plan notes are posted from a pipeline of the target branch, never from the merge request's own.
+    const onPlanNotes = gitlabPlanNotesRule(loop.branch ? JSON.stringify(loop.branch) : "$CI_DEFAULT_BRANCH");
     const onGreen = loop.applyBeforeMerge ? gitlabApplyPrRule(loop.branch ? JSON.stringify(loop.branch) : "$CI_DEFAULT_BRANCH") : GITLAB_GREEN_TAG_RULE;
     // A member's jobs start in its directory, after the image's install lines.
     const enter = rooted ? [] : [`cd ${memberShellDir(member)}`];
@@ -333,7 +349,7 @@ function prLoopGitlabPipeline(components, env, image, beforeScript, extraScript,
     const doc = {
         // Included files merge their top-level keys, so a member's file carries
         // the rules every member shares and no name: two names would collide.
-        workflow: { ...(member ? {} : { name: `chant-pr-${env}` }), rules: [{ if: onMergeRequest }, { if: onMerge }, ...(greens.length > 0 ? [{ if: onGreen }] : []), ...(prEnv ? [{ if: GITLAB_SCHEDULE_RULE }] : [])] },
+        workflow: { ...(member ? {} : { name: `chant-pr-${env}` }), rules: [{ if: onMergeRequest }, { if: onMerge }, { if: onPlanNotes }, ...(greens.length > 0 ? [{ if: onGreen }] : []), ...(prEnv ? [{ if: GITLAB_SCHEDULE_RULE }] : [])] },
         stages,
         variables: { ...options.variables, CHANT_ENV: env, ...GITLAB_FULL_HISTORY },
         [planJob]: {
@@ -347,14 +363,12 @@ function prLoopGitlabPipeline(components, env, image, beforeScript, extraScript,
             script: [...(identity ? gitlabTradeLines(FORGE_TOKEN_VARS) : [GITLAB_DROP_FORGE_TOKENS]), ...script(plan)],
             artifacts: { when: "always", paths: [reportPath] },
         },
-        // #4295: a fresh job at the target branch's commit posts the note and the status from the plan's report.
+        // #4295, #4328: a job of the target branch's pipeline posts each open merge request's note and status from its plan job's report.
         [noteJob]: {
             stage: PR_PLAN_NOTE_JOB,
             image,
-            needs: [planJob],
-            rules: [{ if: onMergeRequest, when: "always" }],
-            variables: post.env,
-            script: ['git checkout --quiet --detach "$BASE_SHA"', ...enter, ...beforeScript, post.command],
+            rules: [{ if: onPlanNotes }],
+            script: [...enter, ...beforeScript, post.command],
         },
         ...Object.fromEntries(applies.map(({ job, name, stage }, i) => [
             name,
@@ -387,7 +401,7 @@ function prLoopGitlabPipeline(components, env, image, beforeScript, extraScript,
     };
     const jobs = [
         { jobName: planJob, component: "merge request plan", stage: "plan", needs: [] },
-        { jobName: noteJob, component: "merge request plan note", stage: PR_PLAN_NOTE_JOB, needs: [planJob] },
+        { jobName: noteJob, component: "merge request plan note", stage: PR_PLAN_NOTE_JOB, needs: [] },
         ...applies.map(({ job, name, stage }, i) => ({
             jobName: name,
             component: job.wave ? `green apply, wave ${job.wave}` : job.jobName === "record" ? "merge record" : loop.applyBeforeMerge ? "apply before merge" : "green apply",
@@ -465,7 +479,8 @@ function prEnvGitlabJobs(image, beforeScript, extraScript, enter, loop, member,
             [named("env-sweep")]: {
                 stage: PR_ENV_STAGE,
                 image,
-                rules: [{ if: GITLAB_SCHEDULE_RULE }],
+                // #4328: not in the plan notes' schedule, which runs far more often than a sweep needs.
+                rules: [{ if: `${GITLAB_SCHEDULE_RULE} && $${GITLAB_PLAN_NOTES_VAR} != "1"` }],
                 resource_group: `chant-pr-env-sweep${member ? `-${member.name}` : ""}`,
                 ...trading,
                 variables: { ...sweep.env, ...tradeVars },

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "512e066f33446ad5ab2b6f4d3486a395e4a6117d03c4518037b4c1f5a3cc1690",
+    "manifest.json": "dc30895365f349bcbfaeb0990c8b0638219aba7d367239c2b505f788643e8ffc",
     "meta.json": "db082fbf90c5941c498b2bee0f106103449c1a4c257716ca2220f0dd490450b2",
     "types/index.d.ts": "a048a66ebe20da0cb5fc889054cac69044d9bf882e2c56b5c5bf113d1f3ba57c",
     "rules/artifact-no-expiry.ts": "0ca5bb972d4a542126e8a0229d43b55658394cb7dd9b9923b2c590bec1c2ad7d",
@@ -55,5 +55,5 @@
     "skills/chant-gitlab-migrate.md": "4853d04980560b379e5b0f7267dcb0a1e5d5879cb9e9931681ce76b2a5fe69d8",
     "skills/chant-gitlab-patterns.md": "6d9a44e9e8de4c3820be9d65381b0d2ede4cb3626aaaf0011e21838a9fbf556e"
   },
-  "composite": "0820ad847cb53d45adea410db693b97dc4c721a832366c65876dbf640f66fda1"
+  "composite": "6a7c912a036e6265bb02e2fe786dcbd81fade613ec38bf3c342b9886df92d122"
 }

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "gitlab",
-  "version": "0.124.46",
+  "version": "0.124.49",
   "chantVersion": ">=0.1.0",
   "namespace": "GitLab",
   "intrinsics": [

package/dist/plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,aAAa,EAAiC,MAAM,0BAA0B,CAAC;AAsB7F,eAAO,MAAM,YAAY,EAAE,aA4hB1B,CAAC"}
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,aAAa,EAAiC,MAAM,0BAA0B,CAAC;AAsB7F,eAAO,MAAM,YAAY,EAAE,aA6hB1B,CAAC"}

package/dist/plugin.js

@@ -305,7 +305,8 @@ export const test = new Job({
             async transform(content, opts) {
                 const { transform } = await import("./migrate/from-github/index.js");
                 const result = await transform(content, {
-                    emit: opts.emit,
+                    // "sql" is for sql targets (#4399); chant migrate refuses it for this pair.
+                    emit: opts.emit === "sql" ? undefined : opts.emit,
                     useComposites: opts.useComposites,
                     sourceFile: opts.sourceFile,
                     strict: opts.strict,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-gitlab",
-  "version": "0.124.46",
+  "version": "0.124.49",
   "description": "GitLab CI lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -67,8 +67,8 @@
     "typescript": "^5.9.3"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.124.46",
-    "@intentius/chant-lexicon-github": "^0.124.46"
+    "@intentius/chant": "^0.124.49",
+    "@intentius/chant-lexicon-github": "^0.124.49"
   },
   "peerDependenciesMeta": {
     "@intentius/chant-lexicon-github": {

package/src/components/__fixtures__/pr-loop-build.gitlab.golden.yml

@@ -3,6 +3,7 @@ workflow:
   rules:
     - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
     - if: '$CI_PIPELINE_SOURCE == "push" && $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'
+    - if: '$CI_PIPELINE_SOURCE =~ /^(schedule|web|api|trigger)$/ && $CHANT_PLAN_NOTES == "1" && $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'
     - if: '$CI_COMMIT_TAG =~ /^ci\/green\//'
 
 stages:
@@ -37,18 +38,10 @@ plan:
 plan-note:
   stage: plan-note
   image: node:22
-  needs:
-    - plan
   rules:
-    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
-      when: always
-  variables:
-    PR_NUMBER: '$CI_MERGE_REQUEST_IID'
-    HEAD_SHA: '$CI_COMMIT_SHA'
-    BASE_SHA: '$CI_MERGE_REQUEST_DIFF_BASE_SHA'
+    - if: '$CI_PIPELINE_SOURCE =~ /^(schedule|web|api|trigger)$/ && $CHANT_PLAN_NOTES == "1" && $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'
   script:
-    - git checkout --quiet --detach "$BASE_SHA"
-    - chant components pr-post --pr "$PR_NUMBER" --head "$HEAD_SHA" --env prod --output .chant/pr --forge gitlab
+    - chant components pr-post --open --env prod --output .chant/pr --forge gitlab
 
 record:
   stage: record

package/src/components/__fixtures__/pr-loop-record.gitlab.golden.yml

@@ -3,6 +3,7 @@ workflow:
   rules:
     - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
     - if: '$CI_PIPELINE_SOURCE == "push" && $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'
+    - if: '$CI_PIPELINE_SOURCE =~ /^(schedule|web|api|trigger)$/ && $CHANT_PLAN_NOTES == "1" && $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'
 
 stages:
   - plan
@@ -33,18 +34,10 @@ plan:
 plan-note:
   stage: plan-note
   image: node:22
-  needs:
-    - plan
   rules:
-    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
-      when: always
-  variables:
-    PR_NUMBER: '$CI_MERGE_REQUEST_IID'
-    HEAD_SHA: '$CI_COMMIT_SHA'
-    BASE_SHA: '$CI_MERGE_REQUEST_DIFF_BASE_SHA'
+    - if: '$CI_PIPELINE_SOURCE =~ /^(schedule|web|api|trigger)$/ && $CHANT_PLAN_NOTES == "1" && $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'
   script:
-    - git checkout --quiet --detach "$BASE_SHA"
-    - chant components pr-post --pr "$PR_NUMBER" --head "$HEAD_SHA" --env prod --output .chant/pr --forge gitlab
+    - chant components pr-post --open --env prod --output .chant/pr --forge gitlab
 
 record:
   stage: record

package/src/components/__fixtures__/pr-loop-waves.gitlab.golden.yml

@@ -3,6 +3,7 @@ workflow:
   rules:
     - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
     - if: '$CI_PIPELINE_SOURCE == "push" && $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'
+    - if: '$CI_PIPELINE_SOURCE =~ /^(schedule|web|api|trigger)$/ && $CHANT_PLAN_NOTES == "1" && $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'
     - if: '$CI_COMMIT_TAG =~ /^ci\/green\//'
 
 stages:
@@ -37,18 +38,10 @@ plan:
 plan-note:
   stage: plan-note
   image: node:22
-  needs:
-    - plan
   rules:
-    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
-      when: always
-  variables:
-    PR_NUMBER: '$CI_MERGE_REQUEST_IID'
-    HEAD_SHA: '$CI_COMMIT_SHA'
-    BASE_SHA: '$CI_MERGE_REQUEST_DIFF_BASE_SHA'
+    - if: '$CI_PIPELINE_SOURCE =~ /^(schedule|web|api|trigger)$/ && $CHANT_PLAN_NOTES == "1" && $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'
   script:
-    - git checkout --quiet --detach "$BASE_SHA"
-    - chant components pr-post --pr "$PR_NUMBER" --head "$HEAD_SHA" --env prod --output .chant/pr --forge gitlab
+    - chant components pr-post --open --env prod --output .chant/pr --forge gitlab
 
 record:
   stage: record

package/src/components/__fixtures__/pr-loop.gitlab.golden.yml

@@ -3,6 +3,7 @@ workflow:
   rules:
     - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
     - if: '$CI_PIPELINE_SOURCE == "push" && $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'
+    - if: '$CI_PIPELINE_SOURCE =~ /^(schedule|web|api|trigger)$/ && $CHANT_PLAN_NOTES == "1" && $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'
     - if: '$CI_COMMIT_TAG =~ /^ci\/green\//'
 
 stages:
@@ -35,18 +36,10 @@ plan:
 plan-note:
   stage: plan-note
   image: node:22
-  needs:
-    - plan
   rules:
-    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
-      when: always
-  variables:
-    PR_NUMBER: '$CI_MERGE_REQUEST_IID'
-    HEAD_SHA: '$CI_COMMIT_SHA'
-    BASE_SHA: '$CI_MERGE_REQUEST_DIFF_BASE_SHA'
+    - if: '$CI_PIPELINE_SOURCE =~ /^(schedule|web|api|trigger)$/ && $CHANT_PLAN_NOTES == "1" && $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'
   script:
-    - git checkout --quiet --detach "$BASE_SHA"
-    - chant components pr-post --pr "$PR_NUMBER" --head "$HEAD_SHA" --env prod --output .chant/pr --forge gitlab
+    - chant components pr-post --open --env prod --output .chant/pr --forge gitlab
 
 record:
   stage: record

package/src/components/__golden__/op-waves-jobs.yml

@@ -1,6 +1,7 @@
 # chant Op waves "migrations": one stage per wave, each needing the one before.
 # A wave that waits at its gate exits 3 and stops the waves after it; approve the
-# digest it prints, then retry the job.
+# digest it prints, then retry the job. A job whose runs failed exits 1, an allowed
+# failure, and the waves after it run what does not depend on those runs.
 
 stages:
   - wave-1-dev
@@ -19,6 +20,14 @@ wave-1-dev:
     - if: '$CI_PIPELINE_SOURCE == "push" && $CI_COMMIT_BRANCH == "main"'
   script:
     - chant run wave --spec waves.json --wave 1
+  allow_failure:
+    exit_codes:
+      - 1
+  artifacts:
+    when: always
+    paths:
+      - .chant/op-waves/migrations/outcomes/
+    expire_in: '30 days'
 
 wave-2-prod-decide:
   stage: wave-2-prod
@@ -37,10 +46,14 @@ wave-2-prod-decide:
     - wave-1-dev
   script:
     - chant run wave --spec waves.json --wave 2 --decide
+  allow_failure:
+    exit_codes:
+      - 1
   artifacts:
     when: always
     paths:
       - .chant/op-waves/migrations/wave-2.json
+      - .chant/op-waves/migrations/outcomes/
     expire_in: '30 days'
 
 wave-2-prod-us:
@@ -64,6 +77,14 @@ wave-2-prod-us:
   script:
     - echo us
     - chant run wave --spec waves.json --wave 2 --group us
+  allow_failure:
+    exit_codes:
+      - 1
+  artifacts:
+    when: always
+    paths:
+      - .chant/op-waves/migrations/outcomes/
+    expire_in: '30 days'
 
 wave-2-prod-eu:
   stage: wave-2-prod
@@ -84,3 +105,11 @@ wave-2-prod-eu:
     - wave-2-prod-decide
   script:
     - chant run wave --spec waves.json --wave 2 --group eu
+  allow_failure:
+    exit_codes:
+      - 1
+  artifacts:
+    when: always
+    paths:
+      - .chant/op-waves/migrations/outcomes/
+    expire_in: '30 days'

package/src/components/generate-op-pipeline.review.test.ts

@@ -0,0 +1,21 @@
+/**
+ * `reviewAgent` on GitLab (#4326): refused by name. A merge request pipeline
+ * hands every job the project's unprotected variables, so a review job there
+ * cannot be kept apart from a token that writes.
+ */
+
+import { describe, expect, test } from "vitest";
+import { generateGitlabOpPipeline } from "./generate-op-pipeline";
+
+describe("generateGitlabOpPipeline: reviewAgent", () => {
+  test("is refused, naming the Op and the way out", () => {
+    expect(() => generateGitlabOpPipeline([{ name: "pr-review", trigger: { kind: "pull_request" }, reviewAgent: true }])).toThrow(
+      /Scheduled Op "pr-review" sets reviewAgent.*unprotected variables.*findingMode "comment".*GitHub or Forgejo/s,
+    );
+  });
+
+  test("an Op without it generates as before", () => {
+    const out = generateGitlabOpPipeline([{ name: "pr-review", trigger: { kind: "pull_request" }, findingMode: "comment" }]);
+    expect(out.jobs.map((j) => j.jobName)).toEqual(["pr-review"]);
+  });
+});

package/src/components/generate-op-pipeline.ts

@@ -202,6 +202,24 @@ function assertTriggerSupportsMode(name: string, mode: OpFindingMode, trigger: O
   );
 }
 
+/**
+ * Refuse `reviewAgent` (#4326). The split posts the review from a second job
+ * that holds the forge write token, and a GitLab merge request pipeline hands
+ * every job the project's unprotected CI/CD variables, the review job's
+ * included. A token protected enough to stay out of it is not available to a
+ * job of that pipeline either, so the post has to start from a pipeline of
+ * the default branch, which this generator does not build. The refusal names
+ * the Op and the way out rather than emitting a review job that holds the token.
+ */
+function assertNoReviewSplit(spec: ScheduledOpSpec): void {
+  if (!spec.reviewAgent) return;
+  throw new Error(
+    `Scheduled Op "${spec.name}" sets reviewAgent, which keeps the model's job free of the forge write token and posts the note from a second job. ` +
+      `A GitLab merge request pipeline hands every job the project's unprotected variables, so the gitlab generator does not build that split. ` +
+      `Drop reviewAgent and run the review with findingMode "comment" (the model command still runs with a cleared environment), or generate this Op for GitHub or Forgejo.`,
+  );
+}
+
 /**
  * The follow-up line an Op with an `environment` adds under its own header
  * line (#2257). The `environment:` key on the job binds it to the
@@ -293,6 +311,7 @@ export function generateGitlabOpPipeline(
     const findingMode = spec.findingMode ?? "report";
     const trigger = resolveOpTrigger(spec);
     assertTriggerSupportsMode(spec.name, findingMode, trigger);
+    assertNoReviewSplit(spec);
     if (trigger.kind === "cron") anyCron = true;
 
     const jobName = jobPrefix + ciJobName(spec.name);

package/src/components/generate-op-waves-pipeline.ts

@@ -3,8 +3,16 @@
  *
  * One file, one stage per wave, on a push to the spec's branches. Each job is
  * one of core's `opWaveJobs`, and `needs:` chains them so a wave that waits at
- * its gate (exit 3) or fails stops every later wave; retrying the failed job
- * after `chant approve` carries on. `GIT_DEPTH: "0"` gives the runner the base
+ * its gate (exit 3) stops every later wave; retrying the failed job after
+ * `chant approve` carries on, and the jobs it skipped run after it.
+ *
+ * A job that exits 1 (a run failed, or was blocked) is an allowed failure
+ * (`allow_failure: exit_codes: [1]`, #4322), so the next wave's jobs run
+ * after it and block only the runs that depend on a failed one. Every job
+ * keeps the outcome directory as an artifact, holding the outcome files it
+ * received through `needs:` and its own, so each later job reads every
+ * earlier one. Any other non-zero exit still stops the waves after it.
+ * `GIT_DEPTH: "0"` gives the runner the base
  * commit it reads the gate policy at. A wide wave's deciding job keeps its
  * decision as an artifact, which GitLab hands each share job through `needs:`.
  * A wave's `environment` is the job's own `environment:`; protect it in the
@@ -47,7 +55,7 @@ import {
   nonEmpty,
   pushBranches,
 } from "@intentius/chant/ci-jobs";
-import { opWaveGroupOf, opWaveJobs, opWavesResumeCommand, type OpWavesSpec } from "@intentius/chant/op/op-waves";
+import { opWaveGroupOf, opWaveJobs, opWaveOutcomeDir, opWavesResumeCommand, type OpWavesSpec } from "@intentius/chant/op/op-waves";
 import type { OpWavesPipelineOptions, OpWavesPipelineResult } from "@intentius/chant/lexicon";
 import { gitlabTradeIdTokens, gitlabTradeLines, TRADE_SPEC_ENV } from "@intentius/chant/ci-identity";
 import { emitGitlabFile } from "./ci-jobs";
@@ -119,7 +127,9 @@ export function generateGitlabOpWavesPipeline(spec: OpWavesSpec, options: OpWave
         rules,
         ...(job.needs.length > 0 ? { needs: job.needs } : {}),
         script: [...(cloud ? gitlabTradeLines() : []), ...setup, ...(options.beforeScript ?? []), job.command.join(" "), ...(options.extraScript ?? [])],
-        ...(job.kind === "decide" ? { artifacts: { when: "always", paths: [job.record!], expire_in: "30 days" } } : {}),
+        // #4322: a run that failed, or was blocked, lets the next wave run; any other failure stops it.
+        allow_failure: { exit_codes: [1] },
+        artifacts: { when: "always", paths: [...(job.kind === "decide" ? [job.record!] : []), `${opWaveOutcomeDir(spec)}/`], expire_in: "30 days" },
       },
     ]);
   }
@@ -138,7 +148,8 @@ export function generateGitlabOpWavesPipeline(spec: OpWavesSpec, options: OpWave
   const header = [
     `# chant Op waves "${spec.name}": one stage per wave, each needing the one before.`,
     "# A wave that waits at its gate exits 3 and stops the waves after it; approve the",
-    "# digest it prints, then retry the job.",
+    "# digest it prints, then retry the job. A job whose runs failed exits 1, an allowed",
+    "# failure, and the waves after it run what does not depend on those runs.",
     ...(spec.resume
       ? [`# The ${spec.name}-resume job retries it for you in a pipeline schedule; give the schedule the cron "${spec.resume.schedule}".`]
       : []),

package/src/components/generate-pipeline.ts

@@ -53,6 +53,8 @@ import {
   prApplyWaveJobName,
   prLoopJobs,
   GITLAB_APPLY_PR_VAR,
+  GITLAB_PLAN_NOTES_VAR,
+  gitlabPlanJobName,
   prLoopPostJob,
   prLoopSetup,
   PR_PLAN_NOTE_JOB,
@@ -313,12 +315,16 @@ function gatedWaveGitlabPipeline(
  * The plan job holds no forge token while the merge request's code runs
  * (#4295, `@intentius/chant/ci-handover`): its script starts by unsetting
  * the token variables, and `pr-plan --no-status` writes the note and the
- * status into its report. The `plan-note` job after it, which GitLab hands
- * the report artifact, checks out the target branch's commit and posts them
- * with `chant components pr-post`. A CI/CD variable reaches every job of a
- * merge request pipeline, so `unset` keeps it from the plan's code, and
- * `CHANT_FORGE_TOKEN` as a protected variable keeps it from the pipeline
- * altogether.
+ * status into its report, which it keeps as its artifact. GitLab builds a
+ * merge request pipeline from the merge request's own files, so no job in it
+ * may hold the token (#4328): `CHANT_FORGE_TOKEN` and `CHANT_RUNNER_KEY` are
+ * protected variables, which a merge request pipeline never gets. The
+ * `plan-note` job runs in a pipeline of the target branch, built from that
+ * branch's files, that a pipeline schedule (or a person) starts with
+ * `CHANT_PLAN_NOTES` set to `1`. It runs `chant components pr-post --open`,
+ * which asks GitLab for each open merge request's plan job, reads the report
+ * from its artifacts and posts the note and the status for each job that
+ * settled since the last run.
  *
  * With `identity` (#4296, `@intentius/chant/ci-identity`) the plan, record
  * and apply jobs take an `id_tokens:` entry per cloud, and each script
@@ -342,6 +348,16 @@ function gitlabApplyPrRule(branch: string): string {
   return `$CI_PIPELINE_SOURCE =~ /^(web|api|trigger)$/ && $${GITLAB_APPLY_PR_VAR} =~ /^[0-9]+$/ && $CI_COMMIT_BRANCH == ${branch}`;
 }
 
+/**
+ * The rule of the plan-note job (#4328): a pipeline of `branch` that a
+ * pipeline schedule, a person or a trigger started with `CHANT_PLAN_NOTES`
+ * set to `1`. A merge request pipeline's own trigger job starts a pipeline
+ * whose source is `pipeline`, which this rule leaves out.
+ */
+function gitlabPlanNotesRule(branch: string): string {
+  return `$CI_PIPELINE_SOURCE =~ /^(schedule|web|api|trigger)$/ && $${GITLAB_PLAN_NOTES_VAR} == "1" && $CI_COMMIT_BRANCH == ${branch}`;
+}
+
 /** The rule of a pipeline for a pushed `ci/green/` tag (#4168 step 9), which runs the apply under apply on merge. */
 const GITLAB_GREEN_TAG_RULE = '$CI_COMMIT_TAG =~ /^ci\\/green\\//';
 
@@ -358,7 +374,8 @@ function prLoopGitlabPipeline(
   const rooted = !member || member.dir === "." || member.dir === "";
   const [plan, apply, record] = prLoopJobs("gitlab", env, loop, member?.name);
   const reportPath = member ? memberRepoPath(member, PR_LOOP_REPORT_DIR) : PR_LOOP_REPORT_DIR;
-  const planJob = member ? `${member.name}-plan` : "plan";
+  // #4328: the plan-note job's pr-post --open finds the plan job by this name.
+  const planJob = gitlabPlanJobName(member?.name);
   const named = (job: string) => (member ? `${member.name}-${job}` : job);
   const waveJobs = loop.waveGate ? prLoopWaveJobs(components, apply) : [];
   // #4168 step 9: a push to the branch records, and under apply on merge a ci/green/ tag pipeline applies.
@@ -372,6 +389,8 @@ function prLoopGitlabPipeline(
   if (loop.branch !== undefined) assertGitlabBranch("The merge-request pipeline", loop.branch);
   const onMerge = gitlabPushRule(loop.branch ? JSON.stringify(loop.branch) : "$CI_DEFAULT_BRANCH");
   // #4301: the apply before merge runs in a pipeline of the target branch a person starts with CHANT_APPLY_PR set.
+  // #4328: the plan notes are posted from a pipeline of the target branch, never from the merge request's own.
+  const onPlanNotes = gitlabPlanNotesRule(loop.branch ? JSON.stringify(loop.branch) : "$CI_DEFAULT_BRANCH");
   const onGreen = loop.applyBeforeMerge ? gitlabApplyPrRule(loop.branch ? JSON.stringify(loop.branch) : "$CI_DEFAULT_BRANCH") : GITLAB_GREEN_TAG_RULE;
   // A member's jobs start in its directory, after the image's install lines.
   const enter = rooted ? [] : [`cd ${memberShellDir(member!)}`];
@@ -393,7 +412,7 @@ function prLoopGitlabPipeline(
   const doc: Record<string, unknown> = {
     // Included files merge their top-level keys, so a member's file carries
     // the rules every member shares and no name: two names would collide.
-    workflow: { ...(member ? {} : { name: `chant-pr-${env}` }), rules: [{ if: onMergeRequest }, { if: onMerge }, ...(greens.length > 0 ? [{ if: onGreen }] : []), ...(prEnv ? [{ if: GITLAB_SCHEDULE_RULE }] : [])] },
+    workflow: { ...(member ? {} : { name: `chant-pr-${env}` }), rules: [{ if: onMergeRequest }, { if: onMerge }, { if: onPlanNotes }, ...(greens.length > 0 ? [{ if: onGreen }] : []), ...(prEnv ? [{ if: GITLAB_SCHEDULE_RULE }] : [])] },
     stages,
     variables: { ...options.variables, CHANT_ENV: env, ...GITLAB_FULL_HISTORY },
     [planJob]: {
@@ -407,14 +426,12 @@ function prLoopGitlabPipeline(
       script: [...(identity ? gitlabTradeLines(FORGE_TOKEN_VARS) : [GITLAB_DROP_FORGE_TOKENS]), ...script(plan)],
       artifacts: { when: "always", paths: [reportPath] },
     },
-    // #4295: a fresh job at the target branch's commit posts the note and the status from the plan's report.
+    // #4295, #4328: a job of the target branch's pipeline posts each open merge request's note and status from its plan job's report.
     [noteJob]: {
       stage: PR_PLAN_NOTE_JOB,
       image,
-      needs: [planJob],
-      rules: [{ if: onMergeRequest, when: "always" }],
-      variables: post.env,
-      script: ['git checkout --quiet --detach "$BASE_SHA"', ...enter, ...beforeScript, post.command],
+      rules: [{ if: onPlanNotes }],
+      script: [...enter, ...beforeScript, post.command],
     },
     ...Object.fromEntries(
       applies.map(({ job, name, stage }, i) => [
@@ -449,7 +466,7 @@ function prLoopGitlabPipeline(
   };
   const jobs: GeneratedJob[] = [
     { jobName: planJob, component: "merge request plan", stage: "plan", needs: [] },
-    { jobName: noteJob, component: "merge request plan note", stage: PR_PLAN_NOTE_JOB, needs: [planJob] },
+    { jobName: noteJob, component: "merge request plan note", stage: PR_PLAN_NOTE_JOB, needs: [] },
     ...applies.map(({ job, name, stage }, i) => ({
       jobName: name,
       component: job.wave ? `green apply, wave ${job.wave}` : job.jobName === "record" ? "merge record" : loop.applyBeforeMerge ? "apply before merge" : "green apply",
@@ -539,7 +556,8 @@ function prEnvGitlabJobs(
       [named("env-sweep")]: {
         stage: PR_ENV_STAGE,
         image,
-        rules: [{ if: GITLAB_SCHEDULE_RULE }],
+        // #4328: not in the plan notes' schedule, which runs far more often than a sweep needs.
+        rules: [{ if: `${GITLAB_SCHEDULE_RULE} && $${GITLAB_PLAN_NOTES_VAR} != "1"` }],
         resource_group: `chant-pr-env-sweep${member ? `-${member.name}` : ""}`,
         ...trading,
         variables: { ...sweep.env, ...tradeVars },

package/src/components/generate-pr-env-pipeline.test.ts

@@ -55,8 +55,8 @@ describe("the GitLab merge-request pipeline with a merge request environment", (
     expect(down.resource_group).toBe(up.resource_group);
   });
 
-  test("env-sweep runs from a pipeline schedule, which the workflow rules let start", () => {
-    expect(doc["env-sweep"]!.rules).toEqual([{ if: '$CI_PIPELINE_SOURCE == "schedule"' }]);
+  test("env-sweep runs from a pipeline schedule other than the plan notes' (#4328), which the workflow rules let start", () => {
+    expect(doc["env-sweep"]!.rules).toEqual([{ if: '$CI_PIPELINE_SOURCE == "schedule" && $CHANT_PLAN_NOTES != "1"' }]);
     expect(doc.workflow.rules).toContainEqual({ if: '$CI_PIPELINE_SOURCE == "schedule"' });
     expect(doc["env-sweep"]!.script.at(-1)).toBe("chant components pr-env sweep --forge gitlab --output .chant/pr-env");
   });

package/src/components/generate-pr-pipeline.test.ts

@@ -13,7 +13,7 @@ import { describe, expect, test } from "vitest";
 import { parseYAML } from "@intentius/chant/yaml";
 import type { DriverComponent } from "@intentius/chant/components/driver";
 import { generateGitlabPipeline } from "./generate-pipeline";
-import { greenCheckout, PR_LOOP_SETUP, prLoopJobs } from "@intentius/chant/components/pr-pipeline";
+import { gitlabPlanJobName, greenCheckout, PR_LOOP_SETUP, prLoopJobs } from "@intentius/chant/components/pr-pipeline";
 import { GITLAB_DROP_FORGE_TOKENS } from "@intentius/chant/ci-handover";
 
 const ESTATE: DriverComponent[] = [
@@ -129,7 +129,8 @@ describe("the GitLab merge-request pipeline", () => {
     expect(mdoc.plan).toBeUndefined();
     // Included files merge top-level keys: no name, so members do not collide on it.
     expect(mdoc.workflow.name).toBeUndefined();
-    expect(mdoc.workflow.rules).toHaveLength(3);
+    // The merge request, the push and the plan notes' pipeline (#4328), and the green tag.
+    expect(mdoc.workflow.rules).toHaveLength(4);
     const plan = mdoc["network-plan"] as Job;
     const apply = mdoc["network-apply"] as Job;
     expect(plan.script).toContain("cd infra/network");
@@ -143,6 +144,11 @@ describe("the GitLab merge-request pipeline", () => {
     expect(plan.artifacts).toEqual({ when: "always", paths: ["infra/network/.chant/pr"] });
     expect(apply.artifacts).toEqual({ when: "always", paths: ["infra/network/.chant/pr"] });
     expect(apply.cache).toEqual({ key: "chant-apply.network.prod-$CI_COMMIT_SHA", paths: ["infra/network/.chant/pr-resume/pr-apply.json"], when: "always" });
+    // #4328: the member's plan-note job finds the member's plan job by name and reads its artifact from the member's directory.
+    const note = mdoc["network-plan-note"] as Job;
+    expect(note.script.slice(0, 1)).toEqual(["cd infra/network"]);
+    expect(note.script.at(-1)).toBe("chant components pr-post --open --env prod --output .chant/pr --forge gitlab --member network");
+    expect(gitlabPlanJobName("network")).toBe("network-plan");
   });
 });
 
@@ -239,14 +245,16 @@ describe("the GitLab plan job holds no forge token while the merge request's cod
     expect(prLoopJobs("gitlab", "prod")[0]!.command.endsWith(" --no-status")).toBe(true);
   });
 
-  test("the plan-note job takes the plan's artifact, checks out the target branch's commit, and posts", () => {
+  test("the plan-note job runs in a pipeline of the target branch, never the merge request's, and posts every open merge request's plan (#4328)", () => {
     const note = doc["plan-note"]!;
     expect(note.stage).toBe("plan-note");
-    expect(note.needs).toEqual(["plan"]);
-    expect(note.rules).toEqual([{ if: '$CI_PIPELINE_SOURCE == "merge_request_event"', when: "always" }]);
-    expect(note.variables).toEqual({ PR_NUMBER: "$CI_MERGE_REQUEST_IID", HEAD_SHA: "$CI_COMMIT_SHA", BASE_SHA: "$CI_MERGE_REQUEST_DIFF_BASE_SHA" });
-    expect(note.script[0]).toBe('git checkout --quiet --detach "$BASE_SHA"');
-    expect(note.script.at(-1)).toBe('chant components pr-post --pr "$PR_NUMBER" --head "$HEAD_SHA" --env prod --output .chant/pr --forge gitlab');
+    expect(note.needs).toBeUndefined();
+    const rule = '$CI_PIPELINE_SOURCE =~ /^(schedule|web|api|trigger)$/ && $CHANT_PLAN_NOTES == "1" && $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH';
+    expect(note.rules).toEqual([{ if: rule }]);
+    expect(note.rules.some((r) => r.if.includes("merge_request_event"))).toBe(false);
+    expect((doc.workflow as unknown as { rules: Array<{ if: string }> }).rules).toContainEqual({ if: rule });
+    expect(note.variables).toBeUndefined();
+    expect(note.script.at(-1)).toBe("chant components pr-post --open --env prod --output .chant/pr --forge gitlab");
     // It runs no build, lint or plan: none of the merge request's code.
     expect(note.script.join("\n")).not.toMatch(/chant (build|lint|ci run)/);
     expect(result.stages).toEqual(["plan", "plan-note", "record"]);

package/src/components/generate-pr-waves-pipeline.test.ts

@@ -65,7 +65,7 @@ describe("the GitLab merge-request pipeline with a gate per wave (#4003)", () =>
     expect(doc.stages).toEqual(["plan", "plan-note", "record", "apply-wave-1", "apply-wave-2", "apply-wave-3"]);
     expect(result.jobs.map((j) => [j.jobName, j.needs])).toEqual([
       ["plan", []],
-      ["plan-note", ["plan"]],
+      ["plan-note", []],
       ["record", []],
       ["apply-wave-1", []],
       ["apply-wave-2", ["apply-wave-1"]],
@@ -90,7 +90,7 @@ describe("the GitLab merge-request pipeline with a gate per wave (#4003)", () =>
     const scoped = generateGitlabPipeline(ESTATE, { env: "prod", prLoop: { applyOnMerge: true }, gatedWaves: { gate: "release" }, member });
     expect(scoped.jobs.map((j) => [j.jobName, j.needs])).toEqual([
       ["network-plan", []],
-      ["network-plan-note", ["network-plan"]],
+      ["network-plan-note", []],
       ["network-record", []],
       ["network-apply-wave-1", []],
       ["network-apply-wave-2", ["network-apply-wave-1"]],

package/src/plugin.ts

@@ -337,7 +337,8 @@ export const test = new Job({
       async transform(content: string, opts) {
         const { transform } = await import("./migrate/from-github/index");
         const result = await transform(content, {
-          emit: opts.emit,
+          // "sql" is for sql targets (#4399); chant migrate refuses it for this pair.
+          emit: opts.emit === "sql" ? undefined : opts.emit,
           useComposites: opts.useComposites,
           sourceFile: opts.sourceFile,
           strict: opts.strict,