@intentius/chant-lexicon-gitlab 0.124.54 → 0.124.56

package/dist/components/generate-op-waves-pipeline.js

@@ -24,8 +24,9 @@
  * arrived, with `CHANT_FORGE_TOKEN` (a project access token with the `api`
  * scope and the Developer role; the job token cannot retry jobs).
  *
- * A `pr-review` wave (#3684) adds `<name>-record-plans`, run in merge request
- * pipelines only, which records the digests the merge request's head plans.
+ * A `pr-review` wave (#3684), or a `pull-request` wave (#4630), adds
+ * `<name>-record-plans`, run in merge request pipelines only, which records
+ * the digests the merge request's head plans.
  *
  * `runner` (on the spec, a wave or a job group, #3914) is the job's `tags:`; a
  * GitHub runner group is a spec error here. A wave's `jobs` renders its
@@ -37,14 +38,40 @@
  * entry per cloud, and its script starts by trading them for those
  * identities and unsetting the token variables, before any line of the
  * checkout runs.
+ *
+ * With `control` on the spec (#4617), a `control-dispatch` job in a
+ * `control` stage needs the last wave's jobs, whose artifacts hold every
+ * job's outcome file. It adds them up with `chant run wave --waves-outcome`
+ * (through the product's bin) into `CHANT_CONTROL_OUTCOME` and sends the
+ * control repo one dispatch carrying it and `$CI_COMMIT_SHA`. A last wave
+ * whose runs failed (exit 1) still lets it run; a wave that waits at its
+ * gate stops it with the waves, and it runs once the retried job carries
+ * on. A CI/CD variable reaches every job, so every other job starts by
+ * unsetting the control repo's token variables and the product's two
+ * secret names; the dispatch step reads the token from the product's
+ * variable alone and hands it to curl on its stdin (#4568).
+ *
+ * Each wave job's script starts with the apply-job guard (#4624,
+ * `@intentius/chant/ci-job-guard`), before the trade: it stops the job
+ * unless `CI_COMMIT_REF_NAME` is one of the spec's branches and protected,
+ * `CI_ENVIRONMENT_NAME` is the job's environment, and `CI_RUNNER_TAGS`
+ * holds each of the job's tags. A refused guard exits chant's `misplaced`
+ * (9), outside the job's allowed failure, so the job fails and the waves
+ * after it stop.
  */
 import { assertGitlabBranch, assertGitlabEnvironment, assertRunnerLabels, CI_IMAGE, environmentDoc, GITLAB_FULL_HISTORY, GITLAB_MERGE_REQUEST_SOURCE, GITLAB_SCHEDULE_SOURCE, gitlabIdTokensDoc, gitlabPushRule, gitlabSetupScript, gitlabTags, nonEmpty, pushBranches, } from "@intentius/chant/ci-jobs";
-import { opWaveGroupOf, opWaveJobs, opWaveOutcomeDir, opWavesResumeCommand } from "@intentius/chant/op/op-waves";
+import { opWaveGroupOf, opWaveJobs, opWaveOutcomeDir, opWavesControlTarget, opWavesLastJobs, OP_WAVES_APPROVAL_STATUS_VAR, opWavesApprovalStatusCommand, opWavesPostsApprovalStatus, opWavesOutcomeCommand, opWavesRecordPlansCommand, opWavesResumeCommand, } from "@intentius/chant/op/op-waves";
+import { CONTROL_OUTCOME_VAR, CONTROL_TOKEN_VARS, controlDispatchJob } from "@intentius/chant/control/dispatch";
 import { gitlabTradeIdTokens, gitlabTradeLines, TRADE_SPEC_ENV } from "@intentius/chant/ci-identity";
+import { JOB_GUARD_ENV, jobGuardLine, jobGuardSpec, opWaveJobLabel } from "@intentius/chant/ci-job-guard";
+import { CHANT_EXIT } from "@intentius/chant/exit-codes";
+import { resolveProductWords } from "@intentius/chant/ci-product-words";
 import { emitGitlabFile } from "./ci-jobs.js";
+/** The one exit an op-wave job allows as a failure (#4322): a run that failed. The guard's refusal (9) is outside it. */
+export const OP_WAVE_ALLOWED_EXIT = CHANT_EXIT.failed;
 /** Render an Op waves spec as one GitLab CI file, `<name>.gitlab-ci.yml` unless `opsFileName` names another. */
 export function generateGitlabOpWavesPipeline(spec, options) {
-    const jobs = opWaveJobs(spec, options.specFile);
+    const jobs = opWaveJobs(spec, options.specFile, { bin: options.bin });
     const image = options.image ?? CI_IMAGE;
     const subject = `Op waves "${spec.name}"`;
     const rules = pushBranches(spec.branches).map((branch) => {
@@ -69,8 +96,15 @@ export function generateGitlabOpWavesPipeline(spec, options) {
         }
     }
     const specTags = gitlabTags(spec.runner);
-    const byReview = spec.waves.some((w) => w.approval === "pr-review");
+    const product = resolveProductWords(options.words ?? {}).product;
+    // #4630: a pr-review or pull-request wave records each head's plans and posts the approval status.
+    const byReview = opWavesPostsApprovalStatus(spec);
     const stages = [...(byReview ? ["plans"] : []), ...spec.waves.map((wave, i) => `wave-${i + 1}-${wave.name}`)];
+    // #4617: the control repo's token variables, which every job but the dispatch drops first.
+    const control = spec.control ? opWavesControlTarget(spec.control) : undefined;
+    const dropControl = control ? [`unset ${[...new Set([...CONTROL_TOKEN_VARS, control.tokenSecret, control.readTokenSecret])].join(" ")}`] : [];
+    if (control)
+        stages.push("control");
     if (spec.resume)
         stages.push("resume");
     const entries = [["stages", stages]];
@@ -86,7 +120,19 @@ export function generateGitlabOpWavesPipeline(spec, options) {
                 ...(specTags ? { tags: specTags } : {}),
                 variables: { ...GITLAB_FULL_HISTORY },
                 rules: [{ if: GITLAB_MERGE_REQUEST_SOURCE }],
-                script: [...(options.beforeScript ?? []), ["chant", "run", "wave", "--spec", options.specFile, "--record-plans"].join(" ")],
+                script: [...dropControl, ...(options.beforeScript ?? []), opWavesRecordPlansCommand(options.specFile, options.bin).join(" ")],
+            },
+        ]);
+        // #4630: a GitLab approval starts no pipeline, so a schedule of the target branch posts every open merge request's status.
+        entries.push([
+            `${spec.name}-approval-status`,
+            {
+                stage: "plans",
+                image,
+                ...(specTags ? { tags: specTags } : {}),
+                variables: { ...GITLAB_FULL_HISTORY },
+                rules: [{ if: `${GITLAB_SCHEDULE_SOURCE} && $${OP_WAVES_APPROVAL_STATUS_VAR} == "1"` }],
+                script: [...dropControl, ...(options.beforeScript ?? []), opWavesApprovalStatusCommand(options.specFile, "gitlab", options.bin).join(" ")],
             },
         ]);
     }
@@ -100,6 +146,16 @@ export function generateGitlabOpWavesPipeline(spec, options) {
         const cloud = group?.cloud ?? wave.cloud;
         const declared = gitlabIdTokensDoc(group?.idTokens ?? wave.idTokens);
         const idTokens = cloud ? { ...declared, ...gitlabTradeIdTokens(cloud) } : declared;
+        // #4624: the apply-job guard, the script's first line, before the trade.
+        const runner = group?.runner ?? wave.runner ?? spec.runner;
+        const guard = jobGuardSpec({
+            forge: "gitlab",
+            job: opWaveJobLabel(spec.name, job),
+            product,
+            ...(environment ? { environment: environment.name } : {}),
+            branches: pushBranches(spec.branches),
+            ...(runner !== undefined ? { runner } : {}),
+        });
         entries.push([
             job.jobName,
             {
@@ -109,16 +165,52 @@ export function generateGitlabOpWavesPipeline(spec, options) {
                 resource_group: `${spec.name}-${wave.name}`,
                 ...(environment ? { environment: environmentDoc(environment) } : {}),
                 ...(idTokens ? { id_tokens: idTokens } : {}),
-                variables: { ...GITLAB_FULL_HISTORY, ...(wave.variables ?? {}), ...(group?.variables ?? {}), ...(cloud ? { [TRADE_SPEC_ENV]: JSON.stringify(cloud) } : {}) },
+                variables: { ...GITLAB_FULL_HISTORY, ...(wave.variables ?? {}), ...(group?.variables ?? {}), ...(cloud ? { [TRADE_SPEC_ENV]: JSON.stringify(cloud) } : {}), [JOB_GUARD_ENV]: JSON.stringify(guard) },
                 rules,
                 ...(job.needs.length > 0 ? { needs: job.needs } : {}),
-                script: [...(cloud ? gitlabTradeLines() : []), ...setup, ...(options.beforeScript ?? []), job.command.join(" "), ...(options.extraScript ?? [])],
-                // #4322: a run that failed, or was blocked, lets the next wave run; any other failure stops it.
-                allow_failure: { exit_codes: [1] },
+                script: [jobGuardLine(), ...(cloud ? gitlabTradeLines() : []), ...dropControl, ...setup, ...(options.beforeScript ?? []), job.command.join(" "), ...(options.extraScript ?? [])],
+                // #4322: a run that failed, or was blocked, lets the next wave run; any other failure stops it,
+                // a refused guard (9, #4624) included.
+                allow_failure: { exit_codes: [OP_WAVE_ALLOWED_EXIT] },
                 artifacts: { when: "always", paths: [...(job.kind === "decide" ? [job.record] : []), `${opWaveOutcomeDir(spec)}/`], expire_in: "30 days" },
             },
         ]);
     }
+    if (control) {
+        const dispatch = controlDispatchJob("gitlab", control, "$CI_COMMIT_SHA", {
+            ...(options.words ? { words: options.words } : {}),
+            ...(spec.control.sentCheck ? { sentCheck: spec.control.sentCheck } : {}),
+            ...(spec.control.markSent ? { markSent: spec.control.markSent } : {}),
+            outcome: true,
+        });
+        entries.push([
+            dispatch.name,
+            {
+                stage: "control",
+                image,
+                ...(specTags ? { tags: specTags } : {}),
+                rules,
+                // The last wave's jobs hand on every job's outcome file through their artifacts.
+                needs: opWavesLastJobs(jobs),
+                // The setup and the outcome run in a subshell without the control token, and only the outcome reaches stdout.
+                script: [
+                    [
+                        'outcome="$(',
+                        ...dropControl,
+                        "{ :",
+                        ...setupOf[0],
+                        ...(options.beforeScript ?? []),
+                        "} 1>&2",
+                        opWavesOutcomeCommand(options.specFile, options.bin).join(" "),
+                        ')" || exit 1',
+                    ].join("\n"),
+                    `export ${CONTROL_OUTCOME_VAR}="$outcome"`,
+                    ...Object.entries(dispatch.env).map(([k, v]) => `export ${k}="${v}"`),
+                    `bash <<'CONTROL_DISPATCH' || exit $?\n${dispatch.script}\nCONTROL_DISPATCH`,
+                ],
+            },
+        ]);
+    }
     if (spec.resume) {
         entries.push([
             `${spec.name}-resume`,
@@ -127,7 +219,7 @@ export function generateGitlabOpWavesPipeline(spec, options) {
                 image,
                 ...(specTags ? { tags: specTags } : {}),
                 rules: [{ if: GITLAB_SCHEDULE_SOURCE }],
-                script: [...(options.beforeScript ?? []), opWavesResumeCommand(spec).join(" ")],
+                script: [...dropControl, ...(options.beforeScript ?? []), opWavesResumeCommand(spec, options.bin).join(" ")],
             },
         ]);
     }
@@ -135,10 +227,16 @@ export function generateGitlabOpWavesPipeline(spec, options) {
         `# chant Op waves "${spec.name}": one stage per wave, each needing the one before.`,
         "# A wave that waits at its gate exits 3 and stops the waves after it; approve the",
         "# digest it prints, then retry the job. A job whose runs failed exits 1, an allowed",
-        "# failure, and the waves after it run what does not depend on those runs.",
+        "# failure, and the waves after it run what does not depend on those runs. A job",
+        "# whose guard finds it running where the spec did not set it to run exits 9 and",
+        "# stops the waves after it.",
         ...(spec.resume
             ? [`# The ${spec.name}-resume job retries it for you in a pipeline schedule; give the schedule the cron "${spec.resume.schedule}".`]
             : []),
+        ...(byReview
+            ? [`# The ${spec.name}-approval-status job posts each open merge request's approval status from a pipeline schedule that sets ${OP_WAVES_APPROVAL_STATUS_VAR}=1.`]
+            : []),
+        ...(control ? [`# After the last wave, the control-dispatch job tells ${control.repo} how the waves ended.`] : []),
     ];
     const name = options.opsFileName ?? `${spec.name}.gitlab-ci.yml`;
     return { files: [{ name, yaml: emitGitlabFile(entries, header) }], jobs };

package/dist/components/generate-pipeline.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generate-pipeline.d.ts","sourceRoot":"","sources":["../../src/components/generate-pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAWH,OAAO,EAAyB,KAAK,eAAe,EAAE,MAAM,oCAAoC,CAAC;AA0BjG,OAAO,KAAK,EACV,oBAAoB,IAAI,YAAY,EACpC,wBAAwB,IAAI,qBAAqB,EACjD,uBAAuB,IAAI,oBAAoB,EAEhD,MAAM,0BAA0B,CAAC;AAIlC,YAAY,EAAE,YAAY,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,CAAC;AAE1E;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,eAAe,EAAE,EAC7B,OAAO,GAAE,qBAA0B,GAClC,oBAAoB,CAkJtB"}
+{"version":3,"file":"generate-pipeline.d.ts","sourceRoot":"","sources":["../../src/components/generate-pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAaH,OAAO,EAAyB,KAAK,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAkCjG,OAAO,KAAK,EACV,oBAAoB,IAAI,YAAY,EACpC,wBAAwB,IAAI,qBAAqB,EACjD,uBAAuB,IAAI,oBAAoB,EAEhD,MAAM,0BAA0B,CAAC;AAIlC,YAAY,EAAE,YAAY,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,CAAC;AAE1E;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,eAAe,EAAE,EAC7B,OAAO,GAAE,qBAA0B,GAClC,oBAAoB,CAkJtB"}

package/dist/components/generate-pipeline.js

@@ -31,13 +31,15 @@
  * demonstration: one generator-option edit reflects in every job without
  * touching the component declarations.
  */
-import { assertGitlabBranch, CI_IMAGE, ciJobName, fillCommand, GITLAB_FULL_HISTORY, GITLAB_MERGE_REQUEST_SOURCE, gitlabPushRule, } from "@intentius/chant/ci-jobs";
+import { assertGitlabBranch, assertRunnerLabels, CI_IMAGE, ciJobName, fillCommand, GITLAB_FULL_HISTORY, GITLAB_MERGE_REQUEST_SOURCE, gitlabPushRule, gitlabTags, } from "@intentius/chant/ci-jobs";
 import { resolveComponentGraph } from "@intentius/chant/components/driver";
 import { hasPublishStep, promoteArchivePaths } from "@intentius/chant/components/promote";
 import { GATED_WAVE_RECORD, gatedWaveJobs } from "@intentius/chant/components/gated-wave-pipeline";
-import { PR_APPLY_RECORD, PR_LOOP_REPORT_DIR, prApplyGroup, prRecordGroup, prApplyRecordKey, prApplyWaveJobName, prLoopJobs, GITLAB_APPLY_PR_VAR, GITLAB_PLAN_NOTES_VAR, gitlabPlanJobName, prLoopPostJob, prLoopSetup, PR_PLAN_NOTE_JOB, prLoopWaveJobs, prLoopWithWaves, prEnvJobs, PR_ENV_REPORT_DIR, PR_ENV_POST_JOB, } from "@intentius/chant/components/pr-pipeline";
+import { PR_APPLY_RECORD, PR_LOOP_REPORT_DIR, prApplyGroup, prRecordGroup, prApplyRecordKey, prApplyWaveJobName, prLoopJobs, GITLAB_APPLY_PR_VAR, GITLAB_PLAN_NOTES_VAR, gitlabPlanJobName, prLoopPostJob, prLoopSetup, PR_PLAN_NOTE_JOB, prLoopWaveJobs, prLoopWithWaves, prEnvJobs, prCommentLockJobs, prCommentPreviewJob, PR_ENV_REPORT_DIR, PR_ENV_POST_JOB, PR_STALE_JOB, prStaleJob, prLoopJobStage, prLoopRunner, } from "@intentius/chant/components/pr-pipeline";
+import { REPO_APPLY_GROUP } from "@intentius/chant/components/repo-lock";
 import { memberGitlabChanges, memberRepoPath, memberShellDir } from "@intentius/chant/lexicon";
 import { FORGE_TOKEN_VARS, GITLAB_DROP_FORGE_TOKENS } from "@intentius/chant/ci-handover";
+import { CONTROL_TOKEN_VARS, controlDispatchJob, controlNoteCheckout } from "@intentius/chant/control/dispatch";
 import { gitlabTradeIdTokens, gitlabTradeLines, TRADE_SPEC_ENV } from "@intentius/chant/ci-identity";
 import { emitGitlabFile } from "./ci-jobs.js";
 /**
@@ -303,6 +305,8 @@ function gitlabApplyPrRule(branch) {
 function gitlabPlanNotesRule(branch) {
     return `$CI_PIPELINE_SOURCE =~ /^(schedule|web|api|trigger)$/ && $${GITLAB_PLAN_NOTES_VAR} == "1" && $CI_COMMIT_BRANCH == ${branch}`;
 }
+/** Drops the credentials GitLab's runner writes into origin's URL (#4620), before a merge request's code runs in a pipeline of the target branch. */
+const GITLAB_SCRUB_ORIGIN = `git remote set-url origin "$(git remote get-url origin | sed -E 's#//[^@/]*@#//#')"`;
 /** The rule of a pipeline for a pushed `ci/green/` tag (#4168 step 9), which runs the apply under apply on merge. */
 const GITLAB_GREEN_TAG_RULE = '$CI_COMMIT_TAG =~ /^ci\\/green\\//';
 function prLoopGitlabPipeline(components, env, image, beforeScript, extraScript, options) {
@@ -335,7 +339,7 @@ function prLoopGitlabPipeline(components, env, image, beforeScript, extraScript,
     // The command runs through chant ci run (#4156), which writes the job's run record, signed when the CHANT_RUNNER_KEY variable is set.
     // #4221: a wave job hands the commit it applies to the next wave as GREEN_SHA, through a dotenv report.
     const handOff = (job) => (job.wave ? [`echo "GREEN_SHA=$GREEN_SHA" > "$CI_PROJECT_DIR/${WAVE_GREEN_DOTENV}"`] : []);
-    const script = (job) => [...prLoopSetup(image), ...enter, ...beforeScript, ...(job.checkout ?? []), ...handOff(job), ...(job.setup ?? []), ...(job.build ?? []), job.run.command, ...extraScript];
+    const script = (job) => [...prLoopSetup(image, loop.engineSetup), ...enter, ...beforeScript, ...(job.checkout ?? []), ...handOff(job), ...(job.setup ?? []), ...(job.build ?? []), job.run.command, ...extraScript];
     // #4296: each job trades its OIDC token for its cloud identity before anything else in its script.
     const identity = loop.identity;
     const trading = (spec) => spec ? { id_tokens: gitlabTradeIdTokens(spec) } : {};
@@ -343,13 +347,45 @@ function prLoopGitlabPipeline(components, env, image, beforeScript, extraScript,
     const applySpec = (job) => (identity ? (job.jobName === "record" ? identity.plan : identity.apply) : undefined);
     // #4298: a pull request environment's jobs, in a stage of their own after the plan.
     const prEnv = loop.prEnvironment ? prEnvGitlabJobs(image, beforeScript, extraScript, enter, loop, member, named, onMergeRequest) : undefined;
-    const stages = ["plan", PR_PLAN_NOTE_JOB, ...applies.map((a) => a.stage), ...(prEnv ? [PR_ENV_STAGE, PR_ENV_POST_STAGE] : [])];
+    // #4568: once the last apply on merge succeeded, one job tells the control repo this member applied.
+    const lastGreen = loop.control && !loop.applyBeforeMerge && greens.length > 0 ? greens[greens.length - 1].name : undefined;
+    const control = loop.control && lastGreen
+        ? controlDispatchJob("gitlab", loop.control.target, loop.waveGate ? "$GREEN_SHA" : "$CI_COMMIT_SHA", {
+            ...(loop.words ? { words: loop.words } : {}),
+            ...(loop.control.sentCheck ? { sentCheck: loop.control.sentCheck } : {}),
+            ...(loop.control.markSent ? { markSent: loop.control.markSent } : {}),
+        })
+        : undefined;
+    const controlJob = control ? named(control.name) : undefined;
+    // A CI/CD variable reaches every job, so the plan job drops the control repo's tokens with the forge tokens.
+    const dropControl = loop.control
+        ? [`unset ${[...new Set([...CONTROL_TOKEN_VARS, loop.control.target.tokenSecret, loop.control.target.readTokenSecret])].join(" ")}`]
+        : [];
+    // #4588: `/<product> lock` and `/<product> unlock`: GitLab starts no pipeline on a note, so each runs in a
+    // pipeline of the target branch started with CHANT_LOCK_PR or CHANT_UNLOCK_PR set, as the apply before merge does.
+    const targetBranch = loop.branch ? JSON.stringify(loop.branch) : "$CI_DEFAULT_BRANCH";
+    const commentLocks = prCommentLockJobs("gitlab", loop).map((job) => ({
+        job,
+        name: named(job.jobName),
+        rule: `$CI_PIPELINE_SOURCE =~ /^(web|api|trigger)$/ && $${job.gitlabVar} =~ /^[0-9]+$/ && $CI_COMMIT_BRANCH == ${targetBranch}`,
+    }));
+    // #4620: `/<product> <plan word>`: a pipeline of the target branch started with CHANT_PREVIEW_PR set previews the merge request's head again.
+    const preview = prCommentPreviewJob("gitlab", env, loop, member?.name);
+    const previewRule = preview ? `$CI_PIPELINE_SOURCE =~ /^(web|api|trigger)$/ && $${preview.gitlabVar} =~ /^[0-9]+$/ && $CI_COMMIT_BRANCH == ${targetBranch}` : undefined;
+    const previewName = preview ? named(preview.jobName) : undefined;
+    const previewNoteName = preview ? named(preview.noteJobName) : undefined;
+    // #4628: a push to the target branch marks the open merge requests' notes posted against another commit stale.
+    const stale = prStaleJob("gitlab", env, loop, member?.name);
+    const staleName = stale ? named(PR_STALE_JOB) : undefined;
+    const stages = ["plan", PR_PLAN_NOTE_JOB, ...(stale ? [PR_STALE_JOB] : []), ...commentLocks.map((c) => c.job.jobName), ...(preview ? [preview.jobName, preview.noteJobName] : []), ...applies.map((a) => a.stage), ...(control ? [control.name] : []), ...(prEnv ? [PR_ENV_STAGE, PR_ENV_POST_STAGE] : [])];
     const noteJob = named(PR_PLAN_NOTE_JOB);
-    const post = prLoopPostJob("gitlab", env, member?.name);
+    const post = prLoopPostJob("gitlab", env, member?.name, loop.words ? { ...(loop.words.bin ? { bin: loop.words.bin } : {}) } : undefined, { ...(loop.staleNotes ? { staleNotes: true } : {}), ...(loop.respond ? { respond: loop.respond } : {}), ...(loop.decide ? { decide: loop.decide } : {}) });
+    // #4619: with a control repo named, the note job reads its chant/lifecycle, read-only, so pr-post marks the cross-stack edges.
+    const controlRead = loop.control ? controlNoteCheckout("gitlab", loop.control.target, loop.words ?? {}) : undefined;
     const doc = {
         // Included files merge their top-level keys, so a member's file carries
         // the rules every member shares and no name: two names would collide.
-        workflow: { ...(member ? {} : { name: `chant-pr-${env}` }), rules: [{ if: onMergeRequest }, { if: onMerge }, { if: onPlanNotes }, ...(greens.length > 0 ? [{ if: onGreen }] : []), ...(prEnv ? [{ if: GITLAB_SCHEDULE_RULE }] : [])] },
+        workflow: { ...(member ? {} : { name: `chant-pr-${env}` }), rules: [{ if: onMergeRequest }, { if: onMerge }, { if: onPlanNotes }, ...(greens.length > 0 ? [{ if: onGreen }] : []), ...commentLocks.map((c) => ({ if: c.rule })), ...(previewRule ? [{ if: previewRule }] : []), ...(prEnv ? [{ if: GITLAB_SCHEDULE_RULE }] : [])] },
         stages,
         variables: { ...options.variables, CHANT_ENV: env, ...GITLAB_FULL_HISTORY },
         [planJob]: {
@@ -360,7 +396,7 @@ function prLoopGitlabPipeline(components, env, image, beforeScript, extraScript,
             variables: { ...plan.run.env, ...tradeVars(identity?.plan) },
             // #4295: the merge request's code runs in this job, so the job's shell drops the forge tokens first.
             // #4296: with identity, the trade runs before that, and the same unset drops the token variables too.
-            script: [...(identity ? gitlabTradeLines(FORGE_TOKEN_VARS) : [GITLAB_DROP_FORGE_TOKENS]), ...script(plan)],
+            script: [...(identity ? gitlabTradeLines(FORGE_TOKEN_VARS) : [GITLAB_DROP_FORGE_TOKENS]), ...dropControl, ...script(plan)],
             artifacts: { when: "always", paths: [reportPath] },
         },
         // #4295, #4328: a job of the target branch's pipeline posts each open merge request's note and status from its plan job's report.
@@ -368,15 +404,68 @@ function prLoopGitlabPipeline(components, env, image, beforeScript, extraScript,
             stage: PR_PLAN_NOTE_JOB,
             image,
             rules: [{ if: onPlanNotes }],
-            script: [...enter, ...beforeScript, post.command],
+            ...(Object.keys(post.env).length > 0 ? { variables: post.env } : {}),
+            script: [...enter, ...beforeScript, ...(controlRead ? [controlRead.script] : []), post.command],
         },
+        ...(stale && staleName
+            ? {
+                // The pushed commit of the target branch: none of a merge request's code is here.
+                [staleName]: { stage: PR_STALE_JOB, image, rules: [{ if: onMerge }], variables: stale.env, script: [...enter, ...beforeScript, stale.command] },
+            }
+            : {}),
+        ...Object.fromEntries(commentLocks.map(({ job, name, rule }) => [
+            name,
+            // The target branch's commit, so none of the merge request's code runs here.
+            { stage: job.jobName, image, rules: [{ if: rule }], variables: job.env, script: [...enter, ...beforeScript, job.line] },
+        ])),
+        ...(preview && previewName && previewNoteName && previewRule
+            ? {
+                [previewName]: {
+                    stage: preview.jobName,
+                    image,
+                    rules: [{ if: previewRule }],
+                    ...trading(identity?.plan),
+                    variables: { ...preview.plan.run.env, ...tradeVars(identity?.plan) },
+                    // A pipeline of the target branch holds the protected tokens, so the job drops them before it checks out the merge request's head.
+                    script: [
+                        ...(identity ? gitlabTradeLines(FORGE_TOKEN_VARS) : [GITLAB_DROP_FORGE_TOKENS]),
+                        ...dropControl,
+                        "unset CHANT_RUNNER_KEY",
+                        ...("line" in preview.head ? [preview.head.line] : []),
+                        // The ledger while the clone can still fetch it: the plan reads the gate ledger from the local branch.
+                        "git fetch -q --no-tags origin '+refs/heads/chant/lifecycle:refs/heads/chant/lifecycle' 2>/dev/null || true",
+                        // The runner's clone keeps the job token in origin's URL; the merge request's code never sees it.
+                        GITLAB_SCRUB_ORIGIN,
+                        preview.base,
+                        ...prLoopSetup(image, loop.engineSetup),
+                        ...enter,
+                        ...beforeScript,
+                        ...(preview.plan.setup ?? []),
+                        ...(preview.plan.build ?? []),
+                        preview.plan.run.command,
+                        ...extraScript,
+                    ],
+                    artifacts: { when: "always", paths: [reportPath] },
+                },
+                [previewNoteName]: {
+                    stage: preview.noteJobName,
+                    image,
+                    needs: [{ job: previewName, artifacts: true }],
+                    rules: [{ if: previewRule, when: "always" }],
+                    variables: preview.post.env,
+                    // The target branch's commit: the job's own clone, where none of the merge request's code runs.
+                    script: [...enter, ...beforeScript, ...(controlRead ? [controlRead.script] : []), ...(preview.post.setup ?? []), preview.post.command],
+                },
+            }
+            : {}),
         ...Object.fromEntries(applies.map(({ job, name, stage }, i) => [
             name,
             {
                 stage,
                 image,
                 ...(i > 1 ? { needs: [applies[i - 1].name] } : {}),
-                resource_group: job.jobName === "record" ? prRecordGroup(env, member?.name) : prApplyGroup(env, member?.name),
+                // #4552: on the repo grain every apply of the repository shares one resource group.
+                resource_group: job.jobName === "record" ? prRecordGroup(env, member?.name) : loop.lockGrain === "repo" ? REPO_APPLY_GROUP : prApplyGroup(env, member?.name),
                 // #4291: a wave after the first runs after one that failed, and blocks only what depends on the failure.
                 rules: [{ if: job.jobName === "record" ? onMerge : onGreen, ...(job.wave && i > 1 ? { when: "always" } : {}) }],
                 ...trading(applySpec(job)),
@@ -397,20 +486,55 @@ function prLoopGitlabPipeline(components, env, image, beforeScript, extraScript,
                 artifacts: { when: "always", paths: [reportPath], ...(job.wave ? { reports: { dotenv: WAVE_GREEN_DOTENV } } : {}) },
             },
         ])),
+        ...(control && controlJob
+            ? {
+                [controlJob]: {
+                    stage: control.name,
+                    image,
+                    needs: [lastGreen],
+                    rules: [{ if: onGreen }],
+                    // The runner sets a needed job's dotenv values when the script starts, so the commit is read there.
+                    script: [
+                        ...Object.entries(control.env).map(([k, v]) => `export ${k}="${v}"`),
+                        `bash <<'CONTROL_DISPATCH' || exit $?\n${control.script}\nCONTROL_DISPATCH`,
+                    ],
+                },
+            }
+            : {}),
         ...(prEnv ? prEnv.jobs : {}),
     };
     const jobs = [
         { jobName: planJob, component: "merge request plan", stage: "plan", needs: [] },
         { jobName: noteJob, component: "merge request plan note", stage: PR_PLAN_NOTE_JOB, needs: [] },
+        ...(stale && staleName ? [{ jobName: staleName, component: "merge request stale notes", stage: PR_STALE_JOB, needs: [] }] : []),
+        ...commentLocks.map(({ job, name }) => ({ jobName: name, component: `merge request ${job.command} comment`, stage: job.jobName, needs: [] })),
+        ...(preview && previewName && previewNoteName
+            ? [
+                { jobName: previewName, component: "merge request preview comment", stage: preview.jobName, needs: [] },
+                { jobName: previewNoteName, component: "merge request preview comment note", stage: preview.noteJobName, needs: [previewName] },
+            ]
+            : []),
         ...applies.map(({ job, name, stage }, i) => ({
             jobName: name,
             component: job.wave ? `green apply, wave ${job.wave}` : job.jobName === "record" ? "merge record" : loop.applyBeforeMerge ? "apply before merge" : "green apply",
             stage,
             needs: i > 1 ? [applies[i - 1].name] : [],
         })),
+        ...(controlJob ? [{ jobName: controlJob, component: "control repo dispatch", stage: control.name, needs: [lastGreen] }] : []),
         ...(prEnv ? prEnv.listed : []),
     ];
-    const yaml = emitGitlabFile(["workflow", "stages", "variables", planJob, noteJob, ...applies.map((a) => a.name), ...Object.keys(prEnv?.jobs ?? {})].map((key) => [key, doc[key]]));
+    // #4625: each job on its stage's runner tags, the plan side's, the apply side's, or the default.
+    if (loop.runners) {
+        for (const stage of ["plan", "apply", "default"])
+            assertRunnerLabels("The merge-request pipeline", `runners.${stage}`, loop.runners[stage], "GitLab");
+        for (const job of jobs) {
+            const tags = gitlabTags(prLoopRunner(loop, prLoopJobStage(job.jobName, member?.name)));
+            const entry = doc[job.jobName];
+            if (tags && entry)
+                doc[job.jobName] = { ...entry, tags };
+        }
+    }
+    const yaml = emitGitlabFile(["workflow", "stages", "variables", planJob, noteJob, ...(staleName ? [staleName] : []), ...commentLocks.map((c) => c.name), ...(previewName && previewNoteName ? [previewName, previewNoteName] : []), ...applies.map((a) => a.name), ...(controlJob ? [controlJob] : []), ...Object.keys(prEnv?.jobs ?? {})].map((key) => [key, doc[key]]));
     return { yaml, stages, jobs, env };
 }
 /** The stage a pull request environment's jobs run in (#4298). */
@@ -434,7 +558,7 @@ function prEnvGitlabJobs(image, beforeScript, extraScript, enter, loop, member,
     const reportPath = member ? memberRepoPath(member, PR_ENV_REPORT_DIR) : PR_ENV_REPORT_DIR;
     const environment = "pr-$CI_MERGE_REQUEST_IID";
     const group = `chant-pr-env-${member ? `${member.name}-` : ""}$CI_MERGE_REQUEST_IID`;
-    const script = (j) => [...prLoopSetup(image), ...enter, ...beforeScript, ...(j.build ?? []), j.command, ...extraScript];
+    const script = (j) => [...prLoopSetup(image, loop.engineSetup), ...enter, ...beforeScript, ...(j.build ?? []), j.command, ...extraScript];
     const artifacts = { when: "always", paths: [reportPath] };
     // #4330: env-up, env-down and env-sweep trade the job's OIDC token for the pull request environments' identity first.
     const identity = loop.prEnvIdentity;

package/dist/components/review-jobs.d.ts

@@ -0,0 +1,72 @@
+/**
+ * The two jobs of a split review on GitLab (#4544): `ScheduledOpSpec.reviewAgent`.
+ *
+ * An Op that runs a `reviewAgent` step in `handoff` mode runs the change's
+ * code (`chant run` loads the merge request's Op files) beside a model.
+ * GitHub and Forgejo keep the write token out of that job with per-job
+ * permissions (`lexicons/github/src/components/review-jobs.ts`). GitLab has
+ * none: a merge request pipeline is built from the merge request's own files
+ * and every job in it gets the project's unprotected variables. So the token
+ * stays out of that pipeline altogether, the way the plan note does (#4328):
+ *
+ * - the review job runs in the merge request pipeline. Its script starts by
+ *   unsetting every forge token variable (`GITLAB_DROP_FORGE_TOKENS`), and it
+ *   keeps the review directory as its artifact. `CHANT_FORGE_TOKEN` is a
+ *   protected variable, which a merge request pipeline never gets.
+ * - the note job runs in a pipeline of the default branch, built from that
+ *   branch's files, that a pipeline schedule (or a person, the API or a
+ *   trigger) starts with `CHANT_REVIEW_NOTES` set to `1`. It checks nothing
+ *   out (`GIT_STRATEGY: none`), installs the chant release this lexicon
+ *   belongs to, and runs `postOpenReviewNotes` with the protected token: for
+ *   each open merge request whose newest pipeline's review job succeeded it
+ *   reads `review.json` from that job's artifacts as data and posts the note.
+ *   The Op's name, the review job's name and the branches come from this
+ *   file, never from the artifact.
+ */
+import type { OpTrigger } from "@intentius/chant/lexicon";
+/** The variable `reviewAgent` reads its handoff directory from (`REVIEW_DIR_ENV`, review-agent.ts). */
+export declare const REVIEW_DIR_ENV = "CHANT_REVIEW_DIR";
+/** Where the review job writes the review, from the directory its script runs in. */
+export declare const REVIEW_DIR = ".chant/review";
+/** The variable a pipeline of the default branch is started with to run the note jobs. */
+export declare const GITLAB_REVIEW_NOTES_VAR = "CHANT_REVIEW_NOTES";
+/** The name of the note job beside the Op's own job. */
+export declare function reviewNoteJobName(jobName: string): string;
+/**
+ * The note job's rule: a pipeline of the default branch that a pipeline
+ * schedule, a person, the API or a trigger started with `CHANT_REVIEW_NOTES`
+ * set to `1`. A merge request pipeline's own trigger job starts a pipeline
+ * whose source is `pipeline`, which this rule leaves out.
+ */
+export declare const GITLAB_REVIEW_NOTES_RULE = "$CI_PIPELINE_SOURCE =~ /^(schedule|web|api|trigger)$/ && $CHANT_REVIEW_NOTES == \"1\" && $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH";
+/**
+ * Refuse a spec whose review cannot be split the way this shape needs: a
+ * trigger with no merge request, a finding-mode that would post from the
+ * review job, or an additive scope other than `id-token: write`.
+ */
+export declare function assertReviewSplit(name: string, trigger: OpTrigger, findingMode: string, permissions: Record<string, string> | undefined): void;
+export interface GitlabReviewJobsInput {
+    /** The Op's name: what `chant run` targets and what keys the note. */
+    name: string;
+    /** The review job's name: the Op's job name. */
+    jobName: string;
+    stage: string;
+    image: string;
+    /** The review job's `rules:`, the Op's merge request rules. */
+    rules: unknown[];
+    /** The review job's script after the token unset: cd, setup, before-script, the invocation and the extra script. */
+    script: string[];
+    /** The Op's own per-job environment (`ScheduledOpSpec.variables`). */
+    variables?: Record<string, string>;
+    idTokens?: Record<string, unknown>;
+    /** The review directory from the repository root: `.chant/review`, under a workspace member's directory for a member. */
+    artifactDir: string;
+    /** The branches the merge requests merge into, from the trigger; the default branch when absent. */
+    branches?: readonly string[];
+}
+/** The review job and the note job of one split review. */
+export declare function gitlabReviewJobs(i: GitlabReviewJobsInput): {
+    review: Record<string, unknown>;
+    note: Record<string, unknown>;
+};
+//# sourceMappingURL=review-jobs.d.ts.map

package/dist/components/review-jobs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"review-jobs.d.ts","sourceRoot":"","sources":["../../src/components/review-jobs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAIH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAE1D,uGAAuG;AACvG,eAAO,MAAM,cAAc,qBAAqB,CAAC;AAEjD,qFAAqF;AACrF,eAAO,MAAM,UAAU,kBAAkB,CAAC;AAE1C,0FAA0F;AAC1F,eAAO,MAAM,uBAAuB,uBAAuB,CAAC;AAK5D,wDAAwD;AACxD,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,qIAA2I,CAAC;AAEjL;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,GAAG,IAAI,CAkB9I;AAyCD,MAAM,WAAW,qBAAqB;IACpC,sEAAsE;IACtE,IAAI,EAAE,MAAM,CAAC;IACb,gDAAgD;IAChD,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,+DAA+D;IAC/D,KAAK,EAAE,OAAO,EAAE,CAAC;IACjB,oHAAoH;IACpH,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,sEAAsE;IACtE,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,yHAAyH;IACzH,WAAW,EAAE,MAAM,CAAC;IACpB,oGAAoG;IACpG,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC9B;AAED,2DAA2D;AAC3D,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,qBAAqB,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAsB7H"}

package/dist/components/review-jobs.js

@@ -0,0 +1,124 @@
+/**
+ * The two jobs of a split review on GitLab (#4544): `ScheduledOpSpec.reviewAgent`.
+ *
+ * An Op that runs a `reviewAgent` step in `handoff` mode runs the change's
+ * code (`chant run` loads the merge request's Op files) beside a model.
+ * GitHub and Forgejo keep the write token out of that job with per-job
+ * permissions (`lexicons/github/src/components/review-jobs.ts`). GitLab has
+ * none: a merge request pipeline is built from the merge request's own files
+ * and every job in it gets the project's unprotected variables. So the token
+ * stays out of that pipeline altogether, the way the plan note does (#4328):
+ *
+ * - the review job runs in the merge request pipeline. Its script starts by
+ *   unsetting every forge token variable (`GITLAB_DROP_FORGE_TOKENS`), and it
+ *   keeps the review directory as its artifact. `CHANT_FORGE_TOKEN` is a
+ *   protected variable, which a merge request pipeline never gets.
+ * - the note job runs in a pipeline of the default branch, built from that
+ *   branch's files, that a pipeline schedule (or a person, the API or a
+ *   trigger) starts with `CHANT_REVIEW_NOTES` set to `1`. It checks nothing
+ *   out (`GIT_STRATEGY: none`), installs the chant release this lexicon
+ *   belongs to, and runs `postOpenReviewNotes` with the protected token: for
+ *   each open merge request whose newest pipeline's review job succeeded it
+ *   reads `review.json` from that job's artifacts as data and posts the note.
+ *   The Op's name, the review job's name and the branches come from this
+ *   file, never from the artifact.
+ */
+import { readFileSync } from "node:fs";
+import { GITLAB_DROP_FORGE_TOKENS } from "@intentius/chant/ci-handover";
+/** The variable `reviewAgent` reads its handoff directory from (`REVIEW_DIR_ENV`, review-agent.ts). */
+export const REVIEW_DIR_ENV = "CHANT_REVIEW_DIR";
+/** Where the review job writes the review, from the directory its script runs in. */
+export const REVIEW_DIR = ".chant/review";
+/** The variable a pipeline of the default branch is started with to run the note jobs. */
+export const GITLAB_REVIEW_NOTES_VAR = "CHANT_REVIEW_NOTES";
+/** How long a review artifact is kept: long enough for a schedule to come round and post it. */
+const REVIEW_ARTIFACT_EXPIRY = "7 days";
+/** The name of the note job beside the Op's own job. */
+export function reviewNoteJobName(jobName) {
+    return `${jobName}-note`;
+}
+/**
+ * The note job's rule: a pipeline of the default branch that a pipeline
+ * schedule, a person, the API or a trigger started with `CHANT_REVIEW_NOTES`
+ * set to `1`. A merge request pipeline's own trigger job starts a pipeline
+ * whose source is `pipeline`, which this rule leaves out.
+ */
+export const GITLAB_REVIEW_NOTES_RULE = `$CI_PIPELINE_SOURCE =~ /^(schedule|web|api|trigger)$/ && $${GITLAB_REVIEW_NOTES_VAR} == "1" && $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH`;
+/**
+ * Refuse a spec whose review cannot be split the way this shape needs: a
+ * trigger with no merge request, a finding-mode that would post from the
+ * review job, or an additive scope other than `id-token: write`.
+ */
+export function assertReviewSplit(name, trigger, findingMode, permissions) {
+    if (trigger.kind !== "pull_request") {
+        throw new Error(`Scheduled Op "${name}" sets reviewAgent, which posts the review as a note on the merge request that triggered the run, but its trigger is "${trigger.kind}". Give it a { kind: "pull_request" } trigger.`);
+    }
+    if (findingMode !== "report") {
+        throw new Error(`Scheduled Op "${name}" sets reviewAgent with findingMode "${findingMode}". The review job holds no forge token, and the note job posts from a pipeline of the default branch instead, so the Op's own finding-mode must be "report".`);
+    }
+    for (const [scope, level] of Object.entries(permissions ?? {})) {
+        if (level === "write" && scope !== "id-token") {
+            throw new Error(`Scheduled Op "${name}" sets reviewAgent and adds the permission "${scope}: write". The review job runs the change's code and may hold only "id-token: write".`);
+        }
+    }
+}
+/** The chant release the note job installs: this lexicon's own, which releases in lockstep with `@intentius/chant`. */
+function chantVersion() {
+    const pkg = JSON.parse(readFileSync(new URL("../../package.json", import.meta.url), "utf8"));
+    if (typeof pkg.version !== "string" || pkg.version === "") {
+        throw new Error("the gitlab lexicon's package.json has no version to pin the review note job's chant to");
+    }
+    return pkg.version;
+}
+/** What the note job runs under node. The inputs are JSON literals from this file; nothing comes from the merge request. */
+function noteModule(op, job, artifactDir, branches) {
+    return [
+        'import { forgeFromEnv } from "@intentius/chant/pr-forge";',
+        'import { postOpenReviewNotes } from "@intentius/chant/op/activities/review-agent";',
+        `const branches = ${JSON.stringify(branches ?? null)} ?? [process.env.CI_DEFAULT_BRANCH];`,
+        "const forge = forgeFromEnv(\"gitlab\");",
+        "let failed = false;",
+        "for (const branch of branches) {",
+        `  const { posts, warnings } = await postOpenReviewNotes({ forge, branch, job: ${JSON.stringify(job)}, artifactDir: ${JSON.stringify(artifactDir)}, op: ${JSON.stringify(op)} });`,
+        "  for (const p of posts) console.log(`!${p.pr} at ${p.head.slice(0, 12)}: ${p.skipped ?? `posted, risk ${p.risk}`}`);",
+        "  for (const w of warnings) { console.error(w); failed = true; }",
+        "}",
+        "if (failed) process.exitCode = 1;",
+    ].join("\n");
+}
+/** The note job's script: install the pinned chant outside any checkout and run {@link noteModule} with tsx. */
+function noteScript(version, module) {
+    return [
+        'dir="${TMPDIR:-/tmp}/chant-review-note"',
+        'mkdir -p "$dir"',
+        'cd "$dir"',
+        "echo '{\"private\":true}' > package.json",
+        `npm install --omit=peer --no-audit --no-fund --loglevel=error @intentius/chant@${version}`,
+        ["cat > note.mjs <<'NOTE'", module, "NOTE"].join("\n"),
+        "node --import tsx note.mjs",
+    ];
+}
+/** The review job and the note job of one split review. */
+export function gitlabReviewJobs(i) {
+    const review = {
+        stage: i.stage,
+        image: i.image,
+        resource_group: i.jobName,
+        ...(i.idTokens ? { id_tokens: i.idTokens } : {}),
+        variables: { ...(i.variables ?? {}), [REVIEW_DIR_ENV]: REVIEW_DIR },
+        rules: i.rules,
+        // The merge request's code runs in this job, so its shell drops every forge token first.
+        script: [GITLAB_DROP_FORGE_TOKENS, ...i.script],
+        artifacts: { paths: [i.artifactDir], expire_in: REVIEW_ARTIFACT_EXPIRY },
+    };
+    const note = {
+        stage: i.stage,
+        image: i.image,
+        resource_group: reviewNoteJobName(i.jobName),
+        // Nothing of the repository is needed: the review is read from the review job's artifacts through the API.
+        variables: { GIT_STRATEGY: "none" },
+        rules: [{ if: GITLAB_REVIEW_NOTES_RULE }],
+        script: noteScript(chantVersion(), noteModule(i.name, i.jobName, i.artifactDir, i.branches)),
+    };
+    return { review, note };
+}