@intentius/chant-lexicon-gitlab 0.124.54 → 0.124.56

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "c8ef64c664ec8553272336feca077fab045ddab3d6c84cc50180ff99e603526d",
+    "manifest.json": "601276a64d47a1758b2b6e26d232c5f746ec007b05950d993fc37ef4f09e2250",
     "meta.json": "db082fbf90c5941c498b2bee0f106103449c1a4c257716ca2220f0dd490450b2",
     "types/index.d.ts": "a048a66ebe20da0cb5fc889054cac69044d9bf882e2c56b5c5bf113d1f3ba57c",
     "rules/artifact-no-expiry.ts": "0ca5bb972d4a542126e8a0229d43b55658394cb7dd9b9923b2c590bec1c2ad7d",
@@ -55,5 +55,5 @@
     "skills/chant-gitlab-migrate.md": "4853d04980560b379e5b0f7267dcb0a1e5d5879cb9e9931681ce76b2a5fe69d8",
     "skills/chant-gitlab-patterns.md": "6d9a44e9e8de4c3820be9d65381b0d2ede4cb3626aaaf0011e21838a9fbf556e"
   },
-  "composite": "91961711687524b02f38e71c0e81e7ee5a06fed36d763fa9b1296184fc0be51f"
+  "composite": "9ed920259d4f54b7734a8887fd98ea4e6357311cde69b7a84197365dc95505b5"
 }

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "gitlab",
-  "version": "0.124.54",
+  "version": "0.124.56",
   "chantVersion": ">=0.1.0",
   "namespace": "GitLab",
   "intrinsics": [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-gitlab",
-  "version": "0.124.54",
+  "version": "0.124.56",
   "description": "GitLab CI lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -67,8 +67,8 @@
     "typescript": "^5.9.3"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.124.54",
-    "@intentius/chant-lexicon-github": "^0.124.54"
+    "@intentius/chant": "^0.124.56",
+    "@intentius/chant-lexicon-github": "^0.124.56"
   },
   "peerDependenciesMeta": {
     "@intentius/chant-lexicon-github": {

package/src/components/__golden__/op-waves-jobs.yml

@@ -1,7 +1,9 @@
 # chant Op waves "migrations": one stage per wave, each needing the one before.
 # A wave that waits at its gate exits 3 and stops the waves after it; approve the
 # digest it prints, then retry the job. A job whose runs failed exits 1, an allowed
-# failure, and the waves after it run what does not depend on those runs.
+# failure, and the waves after it run what does not depend on those runs. A job
+# whose guard finds it running where the spec did not set it to run exits 9 and
+# stops the waves after it.
 
 stages:
   - wave-1-dev
@@ -16,9 +18,11 @@ wave-1-dev:
   resource_group: migrations-dev
   variables:
     GIT_DEPTH: '0'
+    CHANT_JOB_GUARD: '{"forge":"gitlab","job":"wave 1 (dev) of migrations","branches":["main"],"runnerTags":["docker","dev"]}'
   rules:
     - if: '$CI_PIPELINE_SOURCE == "push" && $CI_COMMIT_BRANCH == "main"'
   script:
+    - '(cd / && node -e ''"use strict";const E=process.env,A="chant-check-job";const shown=(v)=>v===undefined||v===null||v===""?"none":v;const fail=(m)=>{console.error("check-job: "+m);process.exit(9)};let x;try{x=JSON.parse(E.CHANT_JOB_GUARD||"")}catch(e){fail("CHANT_JOB_GUARD is not JSON")}if(!x||!["github","gitlab","forgejo"].includes(x.forge)||!Array.isArray(x.branches))fail("CHANT_JOB_GUARD is not a guard spec");const tags=(r)=>{if(r===undefined)return undefined;const t=r.trim();if(t.startsWith("[")){try{const v=JSON.parse(t);if(Array.isArray(v))return v.map(String)}catch(e){}}return t===""?[]:t.split(",").map((s)=>s.trim()).filter((s)=>s!=="")};const claimsOf=(tok)=>{const p=tok.split(".")[1];if(!p)throw new Error("the forge\u0027s OIDC token is not a JWT");const c=JSON.parse(Buffer.from(p.replace(/-/g,"+").replace(/_/g,"/"),"base64").toString("utf-8"));if(!c||typeof c!=="object")throw new Error("the forge\u0027s OIDC token has no claims");return c};async function seenOf(){if(x.forge==="gitlab")return{forgeEnvironment:E.CI_ENVIRONMENT_NAME||null,ref:E.CI_COMMIT_REF_NAME,refProtected:E.CI_COMMIT_REF_PROTECTED,runnerTags:tags(E.CI_RUNNER_TAGS)};const s={ref:E.GITHUB_REF};let c;if(x.forge==="github"&&x.forgeEnvironment!==undefined){try{if(!E.ACTIONS_ID_TOKEN_REQUEST_URL||!E.ACTIONS_ID_TOKEN_REQUEST_TOKEN)throw new Error("the job may request no OIDC token (no ACTIONS_ID_TOKEN_REQUEST_URL); it needs the id-token: write permission");const r=await fetch(E.ACTIONS_ID_TOKEN_REQUEST_URL+"&audience="+encodeURIComponent(A),{headers:{authorization:"bearer "+E.ACTIONS_ID_TOKEN_REQUEST_TOKEN}});if(!r.ok)throw new Error("the OIDC token request answered "+r.status);const v=(await r.json()).value;if(typeof v!=="string")throw new Error("the OIDC token request answered no token");c=claimsOf(v);s.forgeEnvironment=typeof c.environment==="string"&&c.environment!==""?c.environment:null}catch(e){s.forgeEnvironmentError=e&&e.message?e.message:String(e)}}const run=c&&typeof c.runner_environment==="string"?c.runner_environment:E.RUNNER_ENVIRONMENT;if(run)s.runnerEnvironment=run;return s}seenOf().then((s)=>{const P=[],C=[],S=[];const fe=x.forgeEnvironment;if(x.forge==="forgejo")S.push("forge environment (Forgejo has none)");else if(fe!==undefined){if(s.forgeEnvironmentError!==undefined)P.push("forge environment: expected "+fe+", and it could not be read: "+s.forgeEnvironmentError);else if(s.forgeEnvironment!==fe)P.push("forge environment: expected "+fe+", found "+shown(s.forgeEnvironment));else C.push("forge environment "+fe)}const b=x.branches.filter((v)=>v!=="");if(b.length===0)P.push("ref: the job names no branch to run from");else if(x.forge==="gitlab"){if(!s.ref||!b.includes(s.ref))P.push("ref: expected "+b.join(" or ")+", found "+shown(s.ref));else C.push("ref "+s.ref);if(s.refProtected!=="true")P.push("ref: expected a protected ref (CI_COMMIT_REF_PROTECTED true), found "+shown(s.refProtected));else C.push("protected ref")}else{const refs=b.map((v)=>"refs/heads/"+v);if(!s.ref||!refs.includes(s.ref))P.push("ref: expected "+refs.join(" or ")+", found "+shown(s.ref));else C.push("ref "+s.ref)}if(x.forge==="gitlab"){const w=x.runnerTags||[];if(w.length>0){const h=s.runnerTags;const miss=w.filter((t)=>!(h||[]).includes(t));if(h===undefined)P.push("runner: expected tags "+w.join(", ")+", and the job has no CI_RUNNER_TAGS");else if(miss.length>0)P.push("runner: expected tags "+w.join(", ")+", found "+(h.length?h.join(", "):"none"));else C.push("runner tags "+w.join(", "))}}else if(x.selfHosted){if(s.runnerEnvironment===undefined)S.push("runner (the runner says nothing about itself: no RUNNER_ENVIRONMENT)");else if(s.runnerEnvironment!=="self-hosted")P.push("runner: expected self-hosted, found "+s.runnerEnvironment);else C.push("self-hosted runner")}const at=(x.product||"chant")+" check-job: "+x.job;if(P.length>0){for(const p of P)console.error(at+": "+p);console.error(at+": this job does not run where the spec set it to run, so it stops before any credential is taken or code checked out");process.exit(9)}console.log(at+": "+(C.length?C.join(", "):"nothing to check")+(S.length?"; not checked: "+S.join(", "):""))}).catch((e)=>fail(e&&e.message?e.message:String(e)));'')'
     - chant run wave --spec waves.json --wave 1
   allow_failure:
     exit_codes:
@@ -40,11 +44,13 @@ wave-2-prod-decide:
       aud: plan.example
   variables:
     GIT_DEPTH: '0'
+    CHANT_JOB_GUARD: '{"forge":"gitlab","job":"the deciding job of wave 2 (prod) of migrations","branches":["main"],"runnerTags":["plan"]}'
   rules:
     - if: '$CI_PIPELINE_SOURCE == "push" && $CI_COMMIT_BRANCH == "main"'
   needs:
     - wave-1-dev
   script:
+    - '(cd / && node -e ''"use strict";const E=process.env,A="chant-check-job";const shown=(v)=>v===undefined||v===null||v===""?"none":v;const fail=(m)=>{console.error("check-job: "+m);process.exit(9)};let x;try{x=JSON.parse(E.CHANT_JOB_GUARD||"")}catch(e){fail("CHANT_JOB_GUARD is not JSON")}if(!x||!["github","gitlab","forgejo"].includes(x.forge)||!Array.isArray(x.branches))fail("CHANT_JOB_GUARD is not a guard spec");const tags=(r)=>{if(r===undefined)return undefined;const t=r.trim();if(t.startsWith("[")){try{const v=JSON.parse(t);if(Array.isArray(v))return v.map(String)}catch(e){}}return t===""?[]:t.split(",").map((s)=>s.trim()).filter((s)=>s!=="")};const claimsOf=(tok)=>{const p=tok.split(".")[1];if(!p)throw new Error("the forge\u0027s OIDC token is not a JWT");const c=JSON.parse(Buffer.from(p.replace(/-/g,"+").replace(/_/g,"/"),"base64").toString("utf-8"));if(!c||typeof c!=="object")throw new Error("the forge\u0027s OIDC token has no claims");return c};async function seenOf(){if(x.forge==="gitlab")return{forgeEnvironment:E.CI_ENVIRONMENT_NAME||null,ref:E.CI_COMMIT_REF_NAME,refProtected:E.CI_COMMIT_REF_PROTECTED,runnerTags:tags(E.CI_RUNNER_TAGS)};const s={ref:E.GITHUB_REF};let c;if(x.forge==="github"&&x.forgeEnvironment!==undefined){try{if(!E.ACTIONS_ID_TOKEN_REQUEST_URL||!E.ACTIONS_ID_TOKEN_REQUEST_TOKEN)throw new Error("the job may request no OIDC token (no ACTIONS_ID_TOKEN_REQUEST_URL); it needs the id-token: write permission");const r=await fetch(E.ACTIONS_ID_TOKEN_REQUEST_URL+"&audience="+encodeURIComponent(A),{headers:{authorization:"bearer "+E.ACTIONS_ID_TOKEN_REQUEST_TOKEN}});if(!r.ok)throw new Error("the OIDC token request answered "+r.status);const v=(await r.json()).value;if(typeof v!=="string")throw new Error("the OIDC token request answered no token");c=claimsOf(v);s.forgeEnvironment=typeof c.environment==="string"&&c.environment!==""?c.environment:null}catch(e){s.forgeEnvironmentError=e&&e.message?e.message:String(e)}}const run=c&&typeof c.runner_environment==="string"?c.runner_environment:E.RUNNER_ENVIRONMENT;if(run)s.runnerEnvironment=run;return s}seenOf().then((s)=>{const P=[],C=[],S=[];const fe=x.forgeEnvironment;if(x.forge==="forgejo")S.push("forge environment (Forgejo has none)");else if(fe!==undefined){if(s.forgeEnvironmentError!==undefined)P.push("forge environment: expected "+fe+", and it could not be read: "+s.forgeEnvironmentError);else if(s.forgeEnvironment!==fe)P.push("forge environment: expected "+fe+", found "+shown(s.forgeEnvironment));else C.push("forge environment "+fe)}const b=x.branches.filter((v)=>v!=="");if(b.length===0)P.push("ref: the job names no branch to run from");else if(x.forge==="gitlab"){if(!s.ref||!b.includes(s.ref))P.push("ref: expected "+b.join(" or ")+", found "+shown(s.ref));else C.push("ref "+s.ref);if(s.refProtected!=="true")P.push("ref: expected a protected ref (CI_COMMIT_REF_PROTECTED true), found "+shown(s.refProtected));else C.push("protected ref")}else{const refs=b.map((v)=>"refs/heads/"+v);if(!s.ref||!refs.includes(s.ref))P.push("ref: expected "+refs.join(" or ")+", found "+shown(s.ref));else C.push("ref "+s.ref)}if(x.forge==="gitlab"){const w=x.runnerTags||[];if(w.length>0){const h=s.runnerTags;const miss=w.filter((t)=>!(h||[]).includes(t));if(h===undefined)P.push("runner: expected tags "+w.join(", ")+", and the job has no CI_RUNNER_TAGS");else if(miss.length>0)P.push("runner: expected tags "+w.join(", ")+", found "+(h.length?h.join(", "):"none"));else C.push("runner tags "+w.join(", "))}}else if(x.selfHosted){if(s.runnerEnvironment===undefined)S.push("runner (the runner says nothing about itself: no RUNNER_ENVIRONMENT)");else if(s.runnerEnvironment!=="self-hosted")P.push("runner: expected self-hosted, found "+s.runnerEnvironment);else C.push("self-hosted runner")}const at=(x.product||"chant")+" check-job: "+x.job;if(P.length>0){for(const p of P)console.error(at+": "+p);console.error(at+": this job does not run where the spec set it to run, so it stops before any credential is taken or code checked out");process.exit(9)}console.log(at+": "+(C.length?C.join(", "):"nothing to check")+(S.length?"; not checked: "+S.join(", "):""))}).catch((e)=>fail(e&&e.message?e.message:String(e)));'')'
     - chant run wave --spec waves.json --wave 2 --decide
   allow_failure:
     exit_codes:
@@ -70,11 +76,13 @@ wave-2-prod-us:
   variables:
     GIT_DEPTH: '0'
     REGION: us
+    CHANT_JOB_GUARD: '{"forge":"gitlab","job":"job group us of wave 2 (prod) of migrations","forgeEnvironment":"prod-us","branches":["main"],"runnerTags":["us-apply"]}'
   rules:
     - if: '$CI_PIPELINE_SOURCE == "push" && $CI_COMMIT_BRANCH == "main"'
   needs:
     - wave-2-prod-decide
   script:
+    - '(cd / && node -e ''"use strict";const E=process.env,A="chant-check-job";const shown=(v)=>v===undefined||v===null||v===""?"none":v;const fail=(m)=>{console.error("check-job: "+m);process.exit(9)};let x;try{x=JSON.parse(E.CHANT_JOB_GUARD||"")}catch(e){fail("CHANT_JOB_GUARD is not JSON")}if(!x||!["github","gitlab","forgejo"].includes(x.forge)||!Array.isArray(x.branches))fail("CHANT_JOB_GUARD is not a guard spec");const tags=(r)=>{if(r===undefined)return undefined;const t=r.trim();if(t.startsWith("[")){try{const v=JSON.parse(t);if(Array.isArray(v))return v.map(String)}catch(e){}}return t===""?[]:t.split(",").map((s)=>s.trim()).filter((s)=>s!=="")};const claimsOf=(tok)=>{const p=tok.split(".")[1];if(!p)throw new Error("the forge\u0027s OIDC token is not a JWT");const c=JSON.parse(Buffer.from(p.replace(/-/g,"+").replace(/_/g,"/"),"base64").toString("utf-8"));if(!c||typeof c!=="object")throw new Error("the forge\u0027s OIDC token has no claims");return c};async function seenOf(){if(x.forge==="gitlab")return{forgeEnvironment:E.CI_ENVIRONMENT_NAME||null,ref:E.CI_COMMIT_REF_NAME,refProtected:E.CI_COMMIT_REF_PROTECTED,runnerTags:tags(E.CI_RUNNER_TAGS)};const s={ref:E.GITHUB_REF};let c;if(x.forge==="github"&&x.forgeEnvironment!==undefined){try{if(!E.ACTIONS_ID_TOKEN_REQUEST_URL||!E.ACTIONS_ID_TOKEN_REQUEST_TOKEN)throw new Error("the job may request no OIDC token (no ACTIONS_ID_TOKEN_REQUEST_URL); it needs the id-token: write permission");const r=await fetch(E.ACTIONS_ID_TOKEN_REQUEST_URL+"&audience="+encodeURIComponent(A),{headers:{authorization:"bearer "+E.ACTIONS_ID_TOKEN_REQUEST_TOKEN}});if(!r.ok)throw new Error("the OIDC token request answered "+r.status);const v=(await r.json()).value;if(typeof v!=="string")throw new Error("the OIDC token request answered no token");c=claimsOf(v);s.forgeEnvironment=typeof c.environment==="string"&&c.environment!==""?c.environment:null}catch(e){s.forgeEnvironmentError=e&&e.message?e.message:String(e)}}const run=c&&typeof c.runner_environment==="string"?c.runner_environment:E.RUNNER_ENVIRONMENT;if(run)s.runnerEnvironment=run;return s}seenOf().then((s)=>{const P=[],C=[],S=[];const fe=x.forgeEnvironment;if(x.forge==="forgejo")S.push("forge environment (Forgejo has none)");else if(fe!==undefined){if(s.forgeEnvironmentError!==undefined)P.push("forge environment: expected "+fe+", and it could not be read: "+s.forgeEnvironmentError);else if(s.forgeEnvironment!==fe)P.push("forge environment: expected "+fe+", found "+shown(s.forgeEnvironment));else C.push("forge environment "+fe)}const b=x.branches.filter((v)=>v!=="");if(b.length===0)P.push("ref: the job names no branch to run from");else if(x.forge==="gitlab"){if(!s.ref||!b.includes(s.ref))P.push("ref: expected "+b.join(" or ")+", found "+shown(s.ref));else C.push("ref "+s.ref);if(s.refProtected!=="true")P.push("ref: expected a protected ref (CI_COMMIT_REF_PROTECTED true), found "+shown(s.refProtected));else C.push("protected ref")}else{const refs=b.map((v)=>"refs/heads/"+v);if(!s.ref||!refs.includes(s.ref))P.push("ref: expected "+refs.join(" or ")+", found "+shown(s.ref));else C.push("ref "+s.ref)}if(x.forge==="gitlab"){const w=x.runnerTags||[];if(w.length>0){const h=s.runnerTags;const miss=w.filter((t)=>!(h||[]).includes(t));if(h===undefined)P.push("runner: expected tags "+w.join(", ")+", and the job has no CI_RUNNER_TAGS");else if(miss.length>0)P.push("runner: expected tags "+w.join(", ")+", found "+(h.length?h.join(", "):"none"));else C.push("runner tags "+w.join(", "))}}else if(x.selfHosted){if(s.runnerEnvironment===undefined)S.push("runner (the runner says nothing about itself: no RUNNER_ENVIRONMENT)");else if(s.runnerEnvironment!=="self-hosted")P.push("runner: expected self-hosted, found "+s.runnerEnvironment);else C.push("self-hosted runner")}const at=(x.product||"chant")+" check-job: "+x.job;if(P.length>0){for(const p of P)console.error(at+": "+p);console.error(at+": this job does not run where the spec set it to run, so it stops before any credential is taken or code checked out");process.exit(9)}console.log(at+": "+(C.length?C.join(", "):"nothing to check")+(S.length?"; not checked: "+S.join(", "):""))}).catch((e)=>fail(e&&e.message?e.message:String(e)));'')'
     - echo us
     - chant run wave --spec waves.json --wave 2 --group us
   allow_failure:
@@ -99,11 +107,13 @@ wave-2-prod-eu:
       aud: eu.example
   variables:
     GIT_DEPTH: '0'
+    CHANT_JOB_GUARD: '{"forge":"gitlab","job":"job group eu of wave 2 (prod) of migrations","forgeEnvironment":"prod-eu","branches":["main"],"runnerTags":["eu-apply"]}'
   rules:
     - if: '$CI_PIPELINE_SOURCE == "push" && $CI_COMMIT_BRANCH == "main"'
   needs:
     - wave-2-prod-decide
   script:
+    - '(cd / && node -e ''"use strict";const E=process.env,A="chant-check-job";const shown=(v)=>v===undefined||v===null||v===""?"none":v;const fail=(m)=>{console.error("check-job: "+m);process.exit(9)};let x;try{x=JSON.parse(E.CHANT_JOB_GUARD||"")}catch(e){fail("CHANT_JOB_GUARD is not JSON")}if(!x||!["github","gitlab","forgejo"].includes(x.forge)||!Array.isArray(x.branches))fail("CHANT_JOB_GUARD is not a guard spec");const tags=(r)=>{if(r===undefined)return undefined;const t=r.trim();if(t.startsWith("[")){try{const v=JSON.parse(t);if(Array.isArray(v))return v.map(String)}catch(e){}}return t===""?[]:t.split(",").map((s)=>s.trim()).filter((s)=>s!=="")};const claimsOf=(tok)=>{const p=tok.split(".")[1];if(!p)throw new Error("the forge\u0027s OIDC token is not a JWT");const c=JSON.parse(Buffer.from(p.replace(/-/g,"+").replace(/_/g,"/"),"base64").toString("utf-8"));if(!c||typeof c!=="object")throw new Error("the forge\u0027s OIDC token has no claims");return c};async function seenOf(){if(x.forge==="gitlab")return{forgeEnvironment:E.CI_ENVIRONMENT_NAME||null,ref:E.CI_COMMIT_REF_NAME,refProtected:E.CI_COMMIT_REF_PROTECTED,runnerTags:tags(E.CI_RUNNER_TAGS)};const s={ref:E.GITHUB_REF};let c;if(x.forge==="github"&&x.forgeEnvironment!==undefined){try{if(!E.ACTIONS_ID_TOKEN_REQUEST_URL||!E.ACTIONS_ID_TOKEN_REQUEST_TOKEN)throw new Error("the job may request no OIDC token (no ACTIONS_ID_TOKEN_REQUEST_URL); it needs the id-token: write permission");const r=await fetch(E.ACTIONS_ID_TOKEN_REQUEST_URL+"&audience="+encodeURIComponent(A),{headers:{authorization:"bearer "+E.ACTIONS_ID_TOKEN_REQUEST_TOKEN}});if(!r.ok)throw new Error("the OIDC token request answered "+r.status);const v=(await r.json()).value;if(typeof v!=="string")throw new Error("the OIDC token request answered no token");c=claimsOf(v);s.forgeEnvironment=typeof c.environment==="string"&&c.environment!==""?c.environment:null}catch(e){s.forgeEnvironmentError=e&&e.message?e.message:String(e)}}const run=c&&typeof c.runner_environment==="string"?c.runner_environment:E.RUNNER_ENVIRONMENT;if(run)s.runnerEnvironment=run;return s}seenOf().then((s)=>{const P=[],C=[],S=[];const fe=x.forgeEnvironment;if(x.forge==="forgejo")S.push("forge environment (Forgejo has none)");else if(fe!==undefined){if(s.forgeEnvironmentError!==undefined)P.push("forge environment: expected "+fe+", and it could not be read: "+s.forgeEnvironmentError);else if(s.forgeEnvironment!==fe)P.push("forge environment: expected "+fe+", found "+shown(s.forgeEnvironment));else C.push("forge environment "+fe)}const b=x.branches.filter((v)=>v!=="");if(b.length===0)P.push("ref: the job names no branch to run from");else if(x.forge==="gitlab"){if(!s.ref||!b.includes(s.ref))P.push("ref: expected "+b.join(" or ")+", found "+shown(s.ref));else C.push("ref "+s.ref);if(s.refProtected!=="true")P.push("ref: expected a protected ref (CI_COMMIT_REF_PROTECTED true), found "+shown(s.refProtected));else C.push("protected ref")}else{const refs=b.map((v)=>"refs/heads/"+v);if(!s.ref||!refs.includes(s.ref))P.push("ref: expected "+refs.join(" or ")+", found "+shown(s.ref));else C.push("ref "+s.ref)}if(x.forge==="gitlab"){const w=x.runnerTags||[];if(w.length>0){const h=s.runnerTags;const miss=w.filter((t)=>!(h||[]).includes(t));if(h===undefined)P.push("runner: expected tags "+w.join(", ")+", and the job has no CI_RUNNER_TAGS");else if(miss.length>0)P.push("runner: expected tags "+w.join(", ")+", found "+(h.length?h.join(", "):"none"));else C.push("runner tags "+w.join(", "))}}else if(x.selfHosted){if(s.runnerEnvironment===undefined)S.push("runner (the runner says nothing about itself: no RUNNER_ENVIRONMENT)");else if(s.runnerEnvironment!=="self-hosted")P.push("runner: expected self-hosted, found "+s.runnerEnvironment);else C.push("self-hosted runner")}const at=(x.product||"chant")+" check-job: "+x.job;if(P.length>0){for(const p of P)console.error(at+": "+p);console.error(at+": this job does not run where the spec set it to run, so it stops before any credential is taken or code checked out");process.exit(9)}console.log(at+": "+(C.length?C.join(", "):"nothing to check")+(S.length?"; not checked: "+S.join(", "):""))}).catch((e)=>fail(e&&e.message?e.message:String(e)));'')'
     - chant run wave --spec waves.json --wave 2 --group eu
   allow_failure:
     exit_codes:

package/src/components/agent-jobs.ts

@@ -0,0 +1,176 @@
+/**
+ * The agent jobs on GitLab (#4616): `ScheduledOpSpec.agent`. What each job
+ * does is @intentius/chant/ci-agent's; this file lays them out in GitLab's
+ * terms.
+ *
+ * GitLab starts no pipeline on a note, and every job in a pipeline gets the
+ * same protected variables. So:
+ *
+ * - a comment agent runs in a pipeline of the default branch that the API, a
+ *   trigger or a person starts with `CHANT_AGENT_PR` (the merge request's
+ *   iid) and `CHANT_AGENT_ASK` (the ask). Whoever starts that pipeline is
+ *   who asked. A drift agent follows the drift Op's job in its scheduled
+ *   pipeline and runs when that job's run exited with chant's `drift` code.
+ * - the agent job unsets every forge token variable and drops the job token
+ *   from the remote before the model runs, and keeps the agent directory as
+ *   an artifact. It holds the model's key.
+ * - the push job runs in the same pipeline under environment
+ *   `<agent>-push`, takes the artifact, and pushes with `tokenEnv`
+ *   (`CHANT_FORGE_TOKEN` by default). Scope that variable to the
+ *   `<agent>-push` environment, protected and masked, so the agent job never
+ *   holds it.
+ *
+ * A workspace member's drift Op runs in the member's directory, so its
+ * artifact holds `<member>/.chant/agent` (#4619). Both agent jobs run at
+ * the repository root and take `dir`, that path, as their agent directory.
+ */
+
+import { GITLAB_DROP_FORGE_TOKENS } from "@intentius/chant/ci-handover";
+import { gitlabTags, type CiRunner } from "@intentius/chant/ci-jobs";
+import {
+  AGENT_DECISION_FILE,
+  AGENT_DIR,
+  AGENT_DRIFT_FILE,
+  AGENT_GITLAB_TOKEN_ENV,
+  AGENT_HEAD_REF,
+  agentCommandLines,
+  agentGitAuthLines,
+  agentHeadFetchLine,
+  agentSettingsEnv,
+  GITLAB_AGENT_ASK_VAR,
+  GITLAB_AGENT_PR_VAR,
+  type AgentSettings,
+} from "@intentius/chant/ci-agent";
+import { CHANT_EXIT } from "@intentius/chant/exit-codes";
+
+/** The dotenv the drift Op's job leaves, which says whether it found drift. */
+const DRIFT_DOTENV = `${AGENT_DIR}/drift.env`;
+const AGENT_ARTIFACT_EXPIRY = "7 days";
+
+/** The comment agent's rule: a pipeline of the default branch started with the merge request and the ask. */
+export const GITLAB_AGENT_RULE = `$CI_PIPELINE_SOURCE =~ /^(web|api|trigger|chat)$/ && $${GITLAB_AGENT_PR_VAR} =~ /^[0-9]+$/ && $${GITLAB_AGENT_ASK_VAR} && $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH`;
+
+export function gitlabAgentPushJobName(jobName: string): string {
+  return `${jobName}-push`;
+}
+
+/** The environment the push job runs under, which the push token is scoped to. */
+export function gitlabAgentEnvironment(jobName: string): string {
+  return `${jobName}-push`;
+}
+
+/** The remote without the job token GitLab put in its URL. */
+const PLAIN_REMOTE = 'git remote set-url origin "$CI_SERVER_URL/$CI_PROJECT_PATH.git"';
+/** The ledger branch, for the run count and the record. */
+const LEDGER_FETCH = "git fetch -q --no-tags origin '+refs/heads/chant/lifecycle:refs/heads/chant/lifecycle' 2>/dev/null || true";
+
+/**
+ * The drift Op's script lines (#4616): the run with its output kept for the
+ * agent, and `CHANT_AGENT_DRIFT=1` in a dotenv when it exits with chant's
+ * `drift` code. The job still exits with the run's code.
+ */
+export function gitlabDriftRunLines(invocation: string): string[] {
+  return [
+    `mkdir -p ${AGENT_DIR}`,
+    `set +e; { ${invocation}; echo "$?" > ${AGENT_DIR}/code; } 2>&1 | tee ${AGENT_DIR}/${AGENT_DRIFT_FILE}; code=$(cat ${AGENT_DIR}/code); set -e`,
+    `if [ "$code" -eq ${CHANT_EXIT.drift} ]; then echo "CHANT_AGENT_DRIFT=1" > ${DRIFT_DOTENV}; else echo "CHANT_AGENT_DRIFT=0" > ${DRIFT_DOTENV}; fi`,
+    'exit "$code"',
+  ];
+}
+
+/** The drift Op job's artifacts: the output for the agent and the dotenv. */
+export function gitlabDriftArtifacts(dir: string): Record<string, unknown> {
+  return { when: "always", paths: [dir], reports: { dotenv: `${dir}/drift.env` }, expire_in: AGENT_ARTIFACT_EXPIRY };
+}
+
+export interface GitlabAgentJobsInput {
+  jobName: string;
+  stage: string;
+  image: string;
+  settings: AgentSettings;
+  runner?: CiRunner;
+  /** Setup and before-script lines, run before chant in both jobs. */
+  script: readonly string[];
+  /** The variable holding the push token. Default {@link AGENT_GITLAB_TOKEN_ENV}. */
+  tokenEnv?: string;
+  bin?: string;
+  /** For a drift agent: the Op's job and its rules. */
+  after?: { job: string; rules: unknown[] };
+  /** The agent directory from the repository root: where the drift Op's artifact put the drift. Default {@link AGENT_DIR}. */
+  dir?: string;
+}
+
+/** The agent job and the push job. */
+export function gitlabAgentJobs(i: GitlabAgentJobsInput): { agent: Record<string, unknown>; push: Record<string, unknown> } {
+  const s = i.settings;
+  const dir = i.dir ?? AGENT_DIR;
+  const lines = agentCommandLines("gitlab", i.bin, dir);
+  const comment = s.on === "comment";
+  const tags = gitlabTags(i.runner);
+  const variables = { ...agentSettingsEnv(s), GIT_DEPTH: "0" };
+  const rules = comment ? [{ if: GITLAB_AGENT_RULE }] : i.after!.rules.map((r) => ({ ...(r as Record<string, unknown>), when: "always" }));
+  const head = comment ? [agentHeadFetchLine("gitlab", GITLAB_AGENT_PR_VAR)] : [];
+  // A drift agent's job runs whatever the drift check found, and stops here when it found none.
+  const driftGate = comment ? [] : [`if [ "\${CHANT_AGENT_DRIFT:-0}" != "1" ]; then echo "no drift, so the agent does not run"; exit 0; fi`];
+  const agent: Record<string, unknown> = {
+    stage: i.stage,
+    image: i.image,
+    ...(tags ? { tags } : {}),
+    resource_group: i.jobName,
+    timeout: `${s.timeout + 15} minutes`,
+    variables,
+    rules,
+    ...(comment ? {} : { needs: [{ job: i.after!.job, artifacts: true }] }),
+    script: [
+      ...driftGate,
+      ...head,
+      LEDGER_FETCH,
+      PLAIN_REMOTE,
+      ...i.script,
+      // No forge token reaches the model: the decision needs none on GitLab, and the push job checks the merge request.
+      GITLAB_DROP_FORGE_TOKENS,
+      lines.prepare,
+      lines.run,
+    ],
+    artifacts: { when: "always", paths: [dir], expire_in: AGENT_ARTIFACT_EXPIRY },
+  };
+  const tokenVar = i.tokenEnv ?? AGENT_GITLAB_TOKEN_ENV;
+  const push: Record<string, unknown> = {
+    stage: i.stage,
+    image: i.image,
+    ...(tags ? { tags } : {}),
+    resource_group: gitlabAgentPushJobName(i.jobName),
+    environment: { name: gitlabAgentEnvironment(i.jobName), action: "access" },
+    variables,
+    rules,
+    needs: [{ job: i.jobName, artifacts: true }],
+    script: [
+      // The agent job leaves a decision whenever it ran; with none, the drift check found nothing.
+      ...(comment ? [] : [`if [ ! -f ${dir}/${AGENT_DECISION_FILE} ]; then echo "the agent did not run"; exit 0; fi`]),
+      ...head,
+      LEDGER_FETCH,
+      PLAIN_REMOTE,
+      ...i.script,
+      `export CHANT_GITLAB_TOKEN="$${tokenVar}"`,
+      ...agentGitAuthLines(tokenVar, "oauth2"),
+      lines.land,
+    ],
+  };
+  return { agent, push };
+}
+
+/** The header lines a file with agent jobs carries: how to start a comment agent and where the token goes. */
+export function gitlabAgentHeader(jobName: string, s: AgentSettings, tokenVar = AGENT_GITLAB_TOKEN_ENV): string[] {
+  return [
+    comment(s)
+      ? `#   ${jobName}: answers ${s.comment} from a pipeline of the default branch started with ${GITLAB_AGENT_PR_VAR}=<iid> and ${GITLAB_AGENT_ASK_VAR}=<ask>`
+      : `#   ${jobName}: after the drift check exits ${CHANT_EXIT.drift}, opens or updates a merge request from ${s.branch}`,
+    `#     ${gitlabAgentPushJobName(jobName)} pushes with ${tokenVar}: scope it to environment ${gitlabAgentEnvironment(jobName)}, protected and masked; the model's key is ${s.keyEnv}`,
+    `#     the fetched head is ${AGENT_HEAD_REF}; runs are limited to ${s.maxRuns ?? "no fixed number of"} a day on the ledger` +
+      (s.maxCostUsd !== undefined ? `, and to $${s.maxCostUsd} a day of recorded cost` : ""),
+  ];
+}
+
+function comment(s: AgentSettings): boolean {
+  return s.on === "comment";
+}

package/src/components/control-pipeline.ts

@@ -0,0 +1,38 @@
+/**
+ * The control repo's own pipeline (#4568) on GitLab: a member's pipeline
+ * trigger starts it with `CHANT_CONTROL_MEMBER` and `CHANT_CONTROL_OP` set,
+ * and its one job runs the member's dependents with `chant workspace run
+ * --dependents-of`. The pieces are core's (`controlPipelineSpec` in
+ * `@intentius/chant/control/dispatch`); the file is one the control repo's
+ * `.gitlab-ci.yml` includes. The member's side, the `control-dispatch` job,
+ * comes from the pull request loop's `control` option
+ * (./generate-pipeline.ts).
+ */
+
+import { CI_IMAGE, GITLAB_FULL_HISTORY } from "@intentius/chant/ci-jobs";
+import { controlPipelineSpec } from "@intentius/chant/control/dispatch";
+import type { CiProductWords, CiProductWordsInput } from "@intentius/chant/ci-product-words";
+import { emitGitlabFile } from "./ci-jobs";
+
+/** A control repo's pipeline file: where it goes, its text, and what a person still sets up. */
+export interface ControlPipelineFile {
+  path: string;
+  content: string;
+  notes: string[];
+}
+
+/** The control repo's pipeline on GitLab: `.gitlab/<product>-dependents.yml`. */
+export function generateControlPipeline(options: { words?: CiProductWordsInput | CiProductWords; image?: string; command?: string } = {}): ControlPipelineFile {
+  const spec = controlPipelineSpec("gitlab", options.words ?? {}, options.command ? { command: options.command } : {});
+  const job = {
+    stage: "deploy",
+    image: options.image ?? CI_IMAGE,
+    // The full history, so the job reads and appends to chant/lifecycle (#4617).
+    variables: { ...GITLAB_FULL_HISTORY },
+    rules: [{ if: spec.rule }],
+    // One member at a time: two applies upstream should not run the same dependents side by side.
+    resource_group: spec.group,
+    script: [`bash <<'DEPENDENTS' || exit $?\n${spec.script}\nDEPENDENTS`],
+  };
+  return { path: spec.path, content: emitGitlabFile([["dependents", job]], spec.header), notes: spec.notes };
+}

package/src/components/generate-op-pipeline.agent.test.ts

@@ -0,0 +1,99 @@
+/**
+ * The agent jobs on GitLab (#4616): the comment agent in a pipeline of the
+ * default branch started with the merge request and the ask, the drift agent
+ * after a drift check, the push token scoped to the push job's environment,
+ * and a runner as tags.
+ */
+
+import { describe, expect, test } from "vitest";
+import { parseYAML } from "@intentius/chant/yaml";
+import type { ScheduledOpSpec } from "@intentius/chant/lexicon";
+import { generateGitlabOpPipeline } from "./generate-op-pipeline";
+
+type Job = { rules?: Array<{ if?: string; when?: string }>; needs?: Array<{ job: string }>; tags?: string[]; timeout?: string; environment?: { name: string }; script: string[]; artifacts?: { paths?: string[]; reports?: Record<string, string> }; variables?: Record<string, string> };
+const gen = (spec: ScheduledOpSpec) => {
+  const out = generateGitlabOpPipeline([spec]);
+  return { doc: parseYAML(out.files[0]!.yaml) as unknown as Record<string, Job>, yaml: out.files[0]!.yaml };
+};
+
+describe("the comment agent on GitLab", () => {
+  const { doc, yaml } = gen({ name: "chant-agent", runner: ["agents"], agent: { on: "comment", comment: "/chant agent", maxRuns: 4 } });
+  const agent = doc["chant-agent"]!;
+  const push = doc["chant-agent-push"]!;
+
+  test("runs in a pipeline of the default branch started with the merge request and the ask", () => {
+    expect(agent.rules?.[0]?.if).toContain("$CHANT_AGENT_PR =~ /^[0-9]+$/");
+    expect(agent.rules?.[0]?.if).toContain("$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH");
+    expect(agent.tags).toEqual(["agents"]);
+    expect(agent.timeout).toBe("45 minutes");
+  });
+
+  test("the agent job drops every forge token before the decision and the model", () => {
+    const unset = agent.script.findIndex((l) => l.startsWith("unset "));
+    const prepare = agent.script.findIndex((l) => l.includes("chant agent prepare"));
+    expect(unset).toBeGreaterThan(-1);
+    expect(unset).toBeLessThan(prepare);
+    expect(agent.script.at(-1)).toContain("chant agent run --forge gitlab");
+    expect(agent.artifacts?.paths).toEqual([".chant/agent"]);
+  });
+
+  test("the push job runs under its own environment with the push token", () => {
+    expect(push.environment?.name).toBe("chant-agent-push");
+    expect(push.needs).toEqual([{ job: "chant-agent", artifacts: true }]);
+    expect(push.script.join("\n")).toContain('export CHANT_GITLAB_TOKEN="$CHANT_FORGE_TOKEN"');
+    expect(push.script.at(-1)).toContain("chant agent land --forge gitlab");
+    expect(yaml).toContain("scope it to environment chant-agent-push");
+  });
+});
+
+describe("the drift agent on GitLab", () => {
+  const { doc } = gen({ name: "drift-app", trigger: { kind: "cron", schedule: "0 6 * * *" }, agent: { on: "drift" } });
+
+  test("the drift check keeps its output and a dotenv that says it found drift", () => {
+    const op = doc["drift-app"]!;
+    expect(op.script.join("\n")).toContain('echo "CHANT_AGENT_DRIFT=1"');
+    expect(op.artifacts?.reports).toEqual({ dotenv: ".chant/agent/drift.env" });
+  });
+
+  test("the agent and push jobs follow it whatever it exited, and stop when it found none", () => {
+    const agent = doc["drift-app-agent"]!;
+    expect(agent.needs).toEqual([{ job: "drift-app", artifacts: true }]);
+    expect(agent.rules?.every((r) => r.when === "always")).toBe(true);
+    expect(agent.script[0]).toContain('"${CHANT_AGENT_DRIFT:-0}" != "1"');
+    expect(doc["drift-app-agent-push"]!.script[0]).toContain("decision.json");
+  });
+
+  test("a runner group is refused", () => {
+    expect(() => gen({ name: "drift-app", trigger: { kind: "cron", schedule: "0 6 * * *" }, runner: { group: "infra" } })).toThrow(/runner group/);
+  });
+});
+
+// #4619: a member's drift Op runs in the member's directory, and its artifact keeps the drift there.
+describe("the drift agent of a workspace member on GitLab", () => {
+  const out = generateGitlabOpPipeline([{ name: "drift-app", trigger: { kind: "cron", schedule: "0 6 * * *" }, agent: { on: "drift", maxCostUsd: 4 } }], { member: { name: "app", dir: "stacks/app" } });
+  const doc = parseYAML(out.files[0]!.yaml) as unknown as Record<string, Job>;
+  const op = doc["app-drift-app"]!;
+  const agent = doc["app-drift-app-agent"]!;
+  const push = doc["app-drift-app-agent-push"]!;
+
+  test("the drift check runs in the member's directory and keeps the drift under it", () => {
+    expect(op.script[0]).toBe("cd stacks/app");
+    expect(op.artifacts?.paths).toEqual(["stacks/app/.chant/agent"]);
+    expect(op.artifacts?.reports).toEqual({ dotenv: "stacks/app/.chant/agent/drift.env" });
+  });
+
+  test("the agent and push jobs read the member's own drift output", () => {
+    expect(agent.script.some((l) => l.startsWith("cd "))).toBe(false);
+    expect(agent.script.find((l) => l.includes("agent prepare"))).toBe("chant agent prepare --forge gitlab --output stacks/app/.chant/agent");
+    expect(agent.script.at(-1)).toBe("chant agent run --forge gitlab --output stacks/app/.chant/agent");
+    expect(agent.artifacts?.paths).toEqual(["stacks/app/.chant/agent"]);
+    expect(push.script[0]).toContain("stacks/app/.chant/agent/decision.json");
+    expect(push.script.at(-1)).toBe("chant agent land --forge gitlab --output stacks/app/.chant/agent");
+  });
+
+  test("the money limit reaches both jobs and the file's header", () => {
+    expect(agent.variables?.CHANT_AGENT_MAX_COST_USD).toBe("4");
+    expect(push.variables?.CHANT_AGENT_MAX_COST_USD).toBe("4");
+    expect(out.files[0]!.yaml).toContain("and to $4 a day of recorded cost");
+  });
+});

package/src/components/generate-op-pipeline.cloud.test.ts

@@ -0,0 +1,40 @@
+/** #4631: a GitLab scheduled Op job trades first, and an update on drift is a job of its own on the run's dotenv. */
+import { describe, expect, test } from "vitest";
+import { parseYAML } from "@intentius/chant/yaml";
+import type { ScheduledOpSpec } from "@intentius/chant/lexicon";
+import { generateGitlabOpPipeline } from "./generate-op-pipeline";
+
+interface Job { needs?: unknown; rules?: Array<Record<string, unknown>>; id_tokens?: Record<string, { aud: string }>; variables?: Record<string, string>; script: string[]; artifacts?: Record<string, unknown> }
+
+const PREVIEW = { aws: { role: "arn:aws:iam::1:role/preview", region: "us-east-1", audience: "sts.amazonaws.com" } };
+const UPDATE = { aws: { role: "arn:aws:iam::1:role/update", region: "us-east-1", audience: "sts.amazonaws.com" } };
+const spec: ScheduledOpSpec = { name: "drift-dev", trigger: { kind: "cron", schedule: "0 6 * * *" }, findingMode: "issue", cloud: PREVIEW, update: { command: "plywood up", cloud: UPDATE } };
+
+describe("cloud identities on a GitLab scheduled Op (#4631)", () => {
+  const doc = parseYAML(generateGitlabOpPipeline([spec]).files[0]!.yaml) as unknown as Record<string, Job>;
+  const check = doc["drift-dev"]!;
+  const update = doc["drift-dev-update"]!;
+
+  test("the check's script trades first and unsets the token variables, with an id token per cloud", () => {
+    expect(check.id_tokens).toEqual({ CHANT_ID_TOKEN_AWS: { aud: "sts.amazonaws.com" } });
+    expect(JSON.parse(check.variables!.CHANT_CLOUD_TRADE!)).toEqual(PREVIEW);
+    expect(check.script[0]).toContain("node -e");
+    expect(check.script[1]).toMatch(/^unset .*CHANT_ID_TOKEN_AWS/);
+    expect(check.script.join("\n")).toContain('echo "CHANT_AGENT_DRIFT=1"');
+    expect(check.artifacts).toMatchObject({ reports: { dotenv: ".chant/agent/drift.env" } });
+    expect(JSON.stringify(check)).not.toContain("role/update");
+  });
+
+  test("the update job needs the check, stops with no drift, and trades for its own identity", () => {
+    expect(update.needs).toEqual([{ job: "drift-dev", artifacts: true }]);
+    expect(update.rules!.every((r) => r.when === "always")).toBe(true);
+    expect(update.script[0]).toContain('"${CHANT_AGENT_DRIFT:-0}" != "1"');
+    expect(JSON.parse(update.variables!.CHANT_CLOUD_TRADE!)).toEqual(UPDATE);
+    expect(update.script.at(-1)).toBe("plywood up");
+  });
+
+  test("update.permissions has no GitLab form", () => {
+    expect(() => generateGitlabOpPipeline([{ ...spec, update: { command: "x", permissions: { issues: "write" } } }])).toThrow(/no GitLab form/);
+    expect(() => generateGitlabOpPipeline([{ ...spec, update: { command: "x", permissions: { contents: "write" } } }])).toThrow(/no GitLab form/);
+  });
+});

package/src/components/generate-op-pipeline.review.test.ts

@@ -1,21 +1,86 @@
 /**
- * `reviewAgent` on GitLab (#4326): refused by name. A merge request pipeline
- * hands every job the project's unprotected variables, so a review job there
- * cannot be kept apart from a token that writes.
+ * `reviewAgent` on GitLab (#4544): the review job runs in the merge request
+ * pipeline with no forge token and keeps its review as an artifact; the note
+ * job runs in a pipeline of the default branch, checks nothing out, and posts
+ * with the protected token.
  */
 
 import { describe, expect, test } from "vitest";
+import { FORGE_TOKEN_VARS } from "@intentius/chant/ci-handover";
+import { parseYAML } from "@intentius/chant/yaml";
+import type { ComponentPipelineOptions, ScheduledOpSpec } from "@intentius/chant/lexicon";
 import { generateGitlabOpPipeline } from "./generate-op-pipeline";
 
+const spec: ScheduledOpSpec = { name: "pr-review", trigger: { kind: "pull_request" }, reviewAgent: true };
+
+function generated(specs: ScheduledOpSpec[] = [spec], options: ComponentPipelineOptions = {}) {
+  const out = generateGitlabOpPipeline(specs, options);
+  return { out, doc: parseYAML(out.files[0].yaml) as Record<string, Record<string, unknown>> };
+}
+
+const ruleText = (job: Record<string, unknown>): string => JSON.stringify(job.rules);
+const inMergeRequestPipeline = (job: Record<string, unknown>): boolean => ruleText(job).includes("merge_request_event");
+
 describe("generateGitlabOpPipeline: reviewAgent", () => {
-  test("is refused, naming the Op and the way out", () => {
-    expect(() => generateGitlabOpPipeline([{ name: "pr-review", trigger: { kind: "pull_request" }, reviewAgent: true }])).toThrow(
-      /Scheduled Op "pr-review" sets reviewAgent.*unprotected variables.*findingMode "comment".*GitHub or Forgejo/s,
-    );
+  test("emits the review job and its note job", () => {
+    const { out, doc } = generated();
+    expect(out.jobs.map((j) => j.jobName)).toEqual(["pr-review"]);
+    expect(Object.keys(doc)).toEqual(["stages", "pr-review", "pr-review-note"]);
+    expect(out.files[0].yaml).toContain('CHANT_REVIEW_NOTES="1"');
+    expect(out.files[0].yaml).toContain("protected, masked CI/CD variable");
+  });
+
+  test("the review job runs in the merge request pipeline, drops every forge token first and keeps the review as an artifact", () => {
+    const { doc } = generated();
+    const review = doc["pr-review"];
+    expect(inMergeRequestPipeline(review)).toBe(true);
+    const script = review.script as string[];
+    expect(script[0]).toBe(`unset ${FORGE_TOKEN_VARS.join(" ")}`);
+    expect(script).toContain("chant run pr-review");
+    expect(review.variables).toEqual({ CHANT_REVIEW_DIR: ".chant/review" });
+    expect(review.artifacts).toEqual({ paths: [".chant/review"], expire_in: "7 days" });
+  });
+
+  test("no job of the merge request pipeline holds a write token", () => {
+    const { doc } = generated([spec, { name: "lint", trigger: { kind: "pull_request" } }], { variables: { FOO: "bar" } });
+    const writeTokens = ["CHANT_FORGE_TOKEN", "CHANT_RUNNER_KEY", "GITLAB_TOKEN", "CHANT_GITLAB_TOKEN"];
+    for (const [name, job] of Object.entries(doc)) {
+      if (name === "stages" || name === "variables" || !inMergeRequestPipeline(job)) continue;
+      const text = JSON.stringify({ variables: job.variables ?? {}, script: (job.script as string[]).filter((l) => !l.startsWith("unset ")) });
+      for (const token of writeTokens) expect(text, `${name} ${token}`).not.toContain(token);
+    }
+    expect(Object.keys(doc.variables ?? {})).toEqual(["FOO"]);
+  });
+
+  test("the note job runs only in a pipeline of the default branch, checks nothing out and treats the artifact as data", () => {
+    const { doc } = generated([{ ...spec, trigger: { kind: "pull_request", branches: ["main", "release"] } }]);
+    const note = doc["pr-review-note"];
+    expect(inMergeRequestPipeline(note)).toBe(false);
+    expect(note.rules).toEqual([{ if: '$CI_PIPELINE_SOURCE =~ /^(schedule|web|api|trigger)$/ && $CHANT_REVIEW_NOTES == "1" && $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH' }]);
+    expect(note.variables).toEqual({ GIT_STRATEGY: "none" });
+    const script = (note.script as string[]).join("\n");
+    expect(script).toMatch(/npm install .*@intentius\/chant@\d+\.\d+\.\d+/);
+    expect(script).toContain("postOpenReviewNotes");
+    expect(script).toContain('const branches = ["main","release"]');
+    expect(script).toContain('job: "pr-review", artifactDir: ".chant/review", op: "pr-review"');
+    expect(script).not.toContain("chant run");
+  });
+
+  test("a workspace member's review keeps its artifact under the member's directory", () => {
+    const { doc } = generated([spec], { member: { name: "web", dir: "apps/web" } });
+    expect(doc["web-pr-review"].artifacts).toEqual({ paths: ["apps/web/.chant/review"], expire_in: "7 days" });
+    expect((doc["web-pr-review-note"].script as string[]).join("\n")).toContain('job: "web-pr-review", artifactDir: "apps/web/.chant/review"');
+  });
+
+  test("is refused on a trigger with no merge request, a posting finding-mode, or a write scope", () => {
+    expect(() => generateGitlabOpPipeline([{ ...spec, trigger: { kind: "push" } }])).toThrow(/sets reviewAgent.*trigger is "push"/s);
+    expect(() => generateGitlabOpPipeline([{ ...spec, findingMode: "comment" }])).toThrow(/findingMode "comment".*must be "report"/s);
+    expect(() => generateGitlabOpPipeline([{ ...spec, permissions: { "pull-requests": "write" } }])).toThrow(/"pull-requests: write"/);
   });
 
   test("an Op without it generates as before", () => {
     const out = generateGitlabOpPipeline([{ name: "pr-review", trigger: { kind: "pull_request" }, findingMode: "comment" }]);
     expect(out.jobs.map((j) => j.jobName)).toEqual(["pr-review"]);
+    expect(out.files[0].yaml).not.toContain("CHANT_REVIEW_NOTES");
   });
 });