@intentius/chant-lexicon-pulumi 0.124.55 → 0.124.57

package/dist/run.js

@@ -28,6 +28,12 @@
  * - for a review stack alone (`pr-<n>`, INTENTIUS/plywood#15), `stack
  *   init`, `destroy --yes` and `stack rm --yes`, through
  *   {@link runReviewStackPulumi} and {@link runReviewStackPlunge} only;
+ * - for the check stage (#4633, `./check-step.ts`), `pulumi install` and
+ *   `pulumi about --json [--stack <stack>]`, or the same under `plunge`,
+ *   through {@link runCheckPulumi} alone. The install fetches the program's
+ *   dependencies and plugins; `about` reads the engine, plugins and backend.
+ *   Neither writes a stack, and both run with no forge token or cloud
+ *   credential in their environment;
  * - for a member on plunge, its engine graph (#4529, ruled on #4520), as
  *   exactly one of `plunge graph --json`, `plunge graph --json --stack
  *   <stack>`, `plunge graph --json --versions` and `plunge graph --json
@@ -267,19 +273,25 @@ export function engineRunnerAt(bin) {
  * that is not empty and does not start with `-`; `[…]` is optional; `…`
  * repeats.
  *
- * `up` is refused with `--skip-preview`, `--refresh`, `--show-secrets`,
- * `--replace`, `--target-replace`, `--target-dependents`, `--exclude`,
- * `--remote`, `--continue-on-error`, `--config` and any flag not here, since
- * none of them is in the list.
+ * `up` is refused with `--skip-preview`, `--show-secrets`, `--replace`,
+ * `--target-replace`, `--exclude`, `--remote`, `--continue-on-error`,
+ * `--config` and any flag not here, since none of them is in the list.
+ * `--refresh` and `--target-dependents` (#4627) come in the tail's order,
+ * `--target-dependents` only after a `--target`. plunge's `up --plan`
+ * applies a saved plan whose preview did the refresh, so it takes no
+ * `--refresh`.
  */
 export const PULUMI_APPLY_COMMANDS = [
-    "plunge up --plan <file> --yes --json --stack <stack> [--config-file <file>] [--target <urn>]... [--policy-pack <dir> [--policy-pack-config <file>]]...",
-    "pulumi up --yes --json --stack <stack> [--config-file <file>] [--target <urn>]... [--policy-pack <dir> [--policy-pack-config <file>]]...",
+    "plunge up --plan <file> --yes --json --stack <stack> [--config-file <file>] [--target <urn>... [--target-dependents]] [--policy-pack <dir> [--policy-pack-config <file>]]...",
+    "pulumi up --yes --json --stack <stack> [--config-file <file>] [--refresh] [--target <urn>... [--target-dependents]] [--policy-pack <dir> [--policy-pack-config <file>]]...",
 ];
 function tailArgs(t) {
+    const targets = t.targets ?? [];
     return [
         ...(t.configFile ? ["--config-file", t.configFile] : []),
-        ...(t.targets ?? []).flatMap((u) => ["--target", u]),
+        ...(t.refresh ? ["--refresh"] : []),
+        ...targets.flatMap((u) => ["--target", u]),
+        ...(t.targetDependents && targets.length > 0 ? ["--target-dependents"] : []),
         ...(t.policyPacks ?? []).flatMap((p) => ["--policy-pack", p.dir, ...(p.config ? ["--policy-pack-config", p.config] : [])]),
     ];
 }
@@ -301,19 +313,25 @@ export function pulumiUpArgs(opts) {
     return ["up", "--yes", "--json", "--stack", opts.stack, ...tailArgs(opts)];
 }
 const isValue = (v) => typeof v === "string" && v.length > 0 && !v.startsWith("-");
-/** Whether `rest` is exactly an apply tail, in its order. */
-function wellFormedTail(rest) {
+/** Whether `rest` is exactly an apply tail, in its order; `refresh` says whether `--refresh` may stand in it (#4627). */
+function wellFormedTail(rest, refresh = true) {
     let i = 0;
     if (rest[i] === "--config-file") {
         if (!isValue(rest[i + 1]))
             return false;
         i += 2;
     }
+    if (refresh && rest[i] === "--refresh")
+        i += 1;
+    let targets = 0;
     while (rest[i] === "--target") {
         if (!isValue(rest[i + 1]))
             return false;
         i += 2;
+        targets++;
     }
+    if (targets > 0 && rest[i] === "--target-dependents")
+        i += 1;
     while (rest[i] === "--policy-pack") {
         if (!isValue(rest[i + 1]))
             return false;
@@ -335,7 +353,7 @@ function allowedPlungeUp(args) {
         args[4] === "--json" &&
         args[5] === "--stack" &&
         isValue(args[6]) &&
-        wellFormedTail(args.slice(7)));
+        wellFormedTail(args.slice(7), false));
 }
 /** Exactly `pulumi up --yes --json --stack <stack>` and a tail. */
 function allowedPulumiUp(args) {
@@ -559,11 +577,11 @@ export async function runReviewStackPlunge(run, args, cwd, env) {
     return run(args, env ? { cwd, env } : { cwd });
 }
 /**
- * The install chant runs in a release's recorded copy of a program (#4542),
+ * The install chant runs in a program's directory before its first engine
+ * run, a release's recorded copy (#4542) or a job's checkout (plywood#22),
  * for `./release-copy.ts` alone: exactly `pulumi install` or `plunge
- * install`, no flag. The cut records tracked files only, so the copy has no
- * `node_modules` or virtualenv; the CLI's install follows `Pulumi.yaml`'s
- * runtime options and the recorded lockfile.
+ * install`, no flag. Neither has `node_modules` or a virtualenv; the CLI's
+ * install follows `Pulumi.yaml`'s runtime options and the lockfile.
  */
 export const PULUMI_INSTALL_COMMANDS = ["pulumi install", "plunge install"];
 /** Run `install` with no flag in a release copy, refusing any other argv. The runner picks the binary. */
@@ -573,6 +591,29 @@ export async function runReleaseInstall(run, args, cwd, env) {
     }
     return run(args, env ? { cwd, env } : { cwd });
 }
+/**
+ * The two argv the check stage runs for a member (#4633, `./check-step.ts`):
+ * `install` with no flag, and `about --json`, optionally with `--stack
+ * <stack>`. Under `pulumi` or `plunge`; the runner picks the binary.
+ */
+export const PULUMI_CHECK_COMMANDS = ["pulumi install", "pulumi about --json [--stack <stack>]", "plunge install", "plunge about --json [--stack <stack>]"];
+/** Whether `args` is one of {@link PULUMI_CHECK_COMMANDS}' argv. */
+export function allowedCheck(args) {
+    if (args.length === 1)
+        return args[0] === "install";
+    if (args[0] !== "about" || args[1] !== "--json")
+        return false;
+    if (args.length === 2)
+        return true;
+    return args.length === 4 && args[2] === "--stack" && isValue(args[3]);
+}
+/** Run a check-stage argv, refusing any other. The runner picks the binary. */
+export async function runCheckPulumi(run, args, cwd, env) {
+    if (!allowedCheck(args)) {
+        throw new Error(`the check stage runs only ${PULUMI_CHECK_COMMANDS.join(", ")} for a Pulumi member, not ${args.join(" ")}`);
+    }
+    return run(args, env ? { cwd, env } : { cwd });
+}
 export { pulumiMemberEngine, readPlywoodEngine } from "./member-engine.js";
 /** The argv chant runs for a member's applied outputs, after `pulumi` (#4455). Secrets stay blinded. */
 export function pulumiStackOutputArgs(opts = {}) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-pulumi",
-  "version": "0.124.55",
+  "version": "0.124.57",
   "type": "module",
   "files": [
     "src/",
@@ -54,7 +54,7 @@
     "access": "public"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.124.55",
+    "@intentius/chant": "^0.124.57",
     "zod": "^4.3.6"
   },
   "description": "pulumi lexicon for chant: a Pulumi program as a workspace member, its preview in the change set and its refresh as drift records",

package/src/changed-units.test.ts

@@ -0,0 +1,87 @@
+/**
+ * The stacks a change touched (INTENTIUS/plywood#22): plywood's bench edits
+ * `Pulumi.dev.yaml` in a pull request, and `chant components pr-plan`
+ * selected nothing because no lexicon claimed the file. Fixture repositories
+ * on disk; nothing here runs Pulumi or git.
+ */
+import { mkdirSync, mkdtempSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { dirname, join } from "node:path";
+import { describe, expect, test } from "vitest";
+import { pulumiChangedUnits, pulumiStackUnit } from "./changed-units";
+import { pulumiPlugin } from "./plugin";
+
+function repo(files: Record<string, string>): string {
+  const root = mkdtempSync(join(tmpdir(), "pulumi-changed-units-"));
+  for (const [f, text] of Object.entries(files)) {
+    mkdirSync(dirname(join(root, f)), { recursive: true });
+    writeFileSync(join(root, f), text);
+  }
+  return root;
+}
+
+/** plywood's bench shop: one project at the root with four stacks, and a nested project. */
+const SHOP = {
+  "Pulumi.yaml": "name: shop\nruntime: nodejs\n",
+  "Pulumi.dev.yaml": "config: {}\n",
+  "Pulumi.staging.yaml": "config: {}\n",
+  "Pulumi.prod-us.yaml": "config: {}\n",
+  "Pulumi.prod-eu.yaml": "config: {}\n",
+  "index.ts": "export {};\n",
+  "package.json": "{}\n",
+  "plywood.yml": "stacks: {}\n",
+  ".forgejo/workflows/plywood.yml": "name: plywood\n",
+  "net/Pulumi.yaml": "name: net\nruntime: nodejs\n",
+  "net/Pulumi.qa.yaml": "config: {}\n",
+  "net/vpc.ts": "export {};\n",
+  "docs/notes.md": "x\n",
+};
+
+describe("pulumiChangedUnits", () => {
+  test("a changed stack config touches that stack alone: the PR-2 case from the bench", () => {
+    const root = repo(SHOP);
+    expect(pulumiChangedUnits(root, ["Pulumi.dev.yaml"])).toEqual(["dev"]);
+    expect(pulumiChangedUnits(root, ["Pulumi.prod-us.yaml", "Pulumi.prod-eu.yaml"])).toEqual(["prod-eu", "prod-us"]);
+    expect(pulumiChangedUnits(root, ["net/Pulumi.qa.yaml"])).toEqual(["net/qa"]);
+  });
+
+  test("a program file touches every stack of its project, and only that project", () => {
+    const root = repo(SHOP);
+    expect(pulumiChangedUnits(root, ["index.ts"])).toEqual(["dev", "prod-eu", "prod-us", "staging"]);
+    expect(pulumiChangedUnits(root, ["Pulumi.yaml"])).toEqual(["dev", "prod-eu", "prod-us", "staging"]);
+    // The nested project owns its files; the root project does not reach into it.
+    expect(pulumiChangedUnits(root, ["net/vpc.ts"])).toEqual(["net/qa"]);
+    // A file under the root project's tree but in no nested project is the root project's program.
+    expect(pulumiChangedUnits(root, ["docs/notes.md"])).toEqual(["dev", "prod-eu", "prod-us", "staging"]);
+  });
+
+  test("dot directories, node_modules and files outside the project root are not the program", () => {
+    const root = repo(SHOP);
+    expect(pulumiChangedUnits(root, [".forgejo/workflows/plywood.yml", ".chant/op-waves/pulumi-up.spec.json", "node_modules/x/index.js", "../shared/lib.ts"])).toEqual([]);
+  });
+
+  test("a deleted stack config still names its stack, and a program change reaches it", () => {
+    const root = repo(SHOP);
+    expect(pulumiChangedUnits(root, ["Pulumi.old.yaml"])).toEqual(["old"]);
+    expect(pulumiChangedUnits(root, ["index.ts", "Pulumi.old.yaml"])).toEqual(["dev", "old", "prod-eu", "prod-us", "staging"]);
+  });
+
+  test("a deleted Pulumi.yaml still names its project", () => {
+    const root = repo({ "app/Pulumi.dev.yaml": "config: {}\n", "app/index.ts": "export {};\n" });
+    expect(pulumiChangedUnits(root, ["app/Pulumi.yaml", "app/index.ts"])).toEqual(["app/dev"]);
+  });
+
+  test("a file in no Pulumi project touches nothing", () => {
+    const root = repo({ "README.md": "x\n", "tf/main.tf": "\n" });
+    expect(pulumiChangedUnits(root, ["README.md", "tf/main.tf"])).toEqual([]);
+  });
+
+  test("units are named as core names a pulumi-up step's deploy unit", () => {
+    expect([pulumiStackUnit(".", "dev"), pulumiStackUnit("./infra/", "dev"), pulumiStackUnit("apps\\web", "qa")]).toEqual(["dev", "infra/dev", "apps/web/qa"]);
+  });
+
+  test("the plugin answers changedUnits from the changed files", async () => {
+    const root = repo(SHOP);
+    expect(await pulumiPlugin.changedUnits!({ projectRoot: root, config: {}, changedFiles: ["Pulumi.dev.yaml"] })).toEqual(["dev"]);
+  });
+});

package/src/changed-units.ts

@@ -0,0 +1,96 @@
+/**
+ * The Pulumi stacks a change touched, judged from the changed files alone
+ * (`LexiconPlugin.changedUnits`, #3183; INTENTIUS/plywood#22). A Pulumi
+ * program and its stack configs are not chant source, so `chant lifecycle
+ * affected`'s artifact diff never shows them, and without this a pull request
+ * that edits `Pulumi.dev.yaml` selects no component at all.
+ *
+ * A file belongs to the nearest directory at or above it holding a
+ * `Pulumi.yaml` (or `Pulumi.yml`), the project, never above the project root:
+ *
+ *   - `Pulumi.<stack>.yaml` in that directory is the stack's config, so it
+ *     touches that stack alone;
+ *   - any other file there or below (the program, `Pulumi.yaml`, the
+ *     package files) touches every stack of the project, which is each
+ *     `Pulumi.<stack>.yaml` beside `Pulumi.yaml` at head and any the change
+ *     deleted. A stack with no config file has no file to find it by, so a
+ *     program change does not reach it.
+ *
+ * Files under a directory whose name starts with a dot (`.forgejo`, `.chant`,
+ * `.git`) or under `node_modules` are not the program. A file outside every
+ * project, such as a module the program imports from `../shared`, is not
+ * claimed.
+ *
+ * Each unit is named as core's `DEPLOY_UNIT_RULES` names a `pulumi-up` step:
+ * `<dir>/<stack>`, or `<stack>` for a project at the project root.
+ */
+import { existsSync, readdirSync } from "node:fs";
+import { join, posix } from "node:path";
+
+const PROJECT_FILES = ["Pulumi.yaml", "Pulumi.yml"];
+const STACK_CONFIG = /^Pulumi\.(.+)\.ya?ml$/;
+
+/** The unit core names for a `pulumi-up` step on `stack` in `dir` (deploy-units.ts `pulumiStackUnit`). */
+export function pulumiStackUnit(dir: string, stack: string): string {
+  const d = dir.replace(/\\/g, "/").replace(/^(\.\/)+/, "").replace(/\/+$/, "");
+  return d === "" || d === "." ? stack : `${d}/${stack}`;
+}
+
+/** The project directory (relative, `""` for the root) holding `file`, or undefined when none does. */
+function projectOf(projectRoot: string, file: string, changed: ReadonlySet<string>): string | undefined {
+  let dir = posix.dirname(file);
+  for (;;) {
+    const rel = dir === "." ? "" : dir;
+    for (const name of PROJECT_FILES) {
+      const p = rel === "" ? name : `${rel}/${name}`;
+      // A deleted Pulumi.yaml still names its project for the change that deleted it.
+      if (existsSync(join(projectRoot, p)) || changed.has(p)) return rel;
+    }
+    if (rel === "") return undefined;
+    dir = posix.dirname(dir);
+  }
+}
+
+/** The stacks of the project in `dir`: the stack configs at head, and the ones the change names. */
+function stacksOf(projectRoot: string, dir: string, changed: readonly string[]): string[] {
+  const out = new Set<string>();
+  let names: string[] = [];
+  try {
+    names = readdirSync(join(projectRoot, dir));
+  } catch {
+    // The project directory is gone at head; the change's own files still name stacks.
+  }
+  for (const n of names) {
+    const m = STACK_CONFIG.exec(n);
+    if (m) out.add(m[1]!);
+  }
+  for (const f of changed) {
+    if (posix.dirname(f) !== (dir === "" ? "." : dir)) continue;
+    const m = STACK_CONFIG.exec(posix.basename(f));
+    if (m) out.add(m[1]!);
+  }
+  return [...out];
+}
+
+function ignored(file: string): boolean {
+  const parts = file.split("/");
+  return parts.slice(0, -1).some((p) => p.startsWith(".") || p === "node_modules");
+}
+
+/** The stack units `changedFiles` (relative to `projectRoot`, `/` separators) touch, sorted. */
+export function pulumiChangedUnits(projectRoot: string, changedFiles: readonly string[]): string[] {
+  const files = changedFiles.map((f) => f.replace(/\\/g, "/").replace(/^\.\//, "")).filter((f) => f !== "" && !f.startsWith("../") && !ignored(f));
+  const changed = new Set(files);
+  const units = new Set<string>();
+  const whole = new Set<string>();
+  for (const f of files) {
+    const dir = projectOf(projectRoot, f, changed);
+    if (dir === undefined) continue;
+    const here = posix.dirname(f) === (dir === "" ? "." : dir);
+    const m = STACK_CONFIG.exec(posix.basename(f));
+    if (here && m && !PROJECT_FILES.includes(posix.basename(f))) units.add(pulumiStackUnit(dir, m[1]!));
+    else whole.add(dir);
+  }
+  for (const dir of whole) for (const stack of stacksOf(projectRoot, dir, files)) units.add(pulumiStackUnit(dir, stack));
+  return [...units].sort();
+}

package/src/check-step.test.ts

@@ -0,0 +1,191 @@
+/**
+ * The pulumi check steps (#4633): install, stack config against the
+ * project's schema, and about, with a fake runner, so no binary runs and no
+ * backend is read or written.
+ */
+import { mkdtempSync, mkdirSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { describe, expect, test } from "vitest";
+import { runCheckStage } from "@intentius/chant/components/check-steps";
+import { listedStacks, pulumiAboutDetail, pulumiCheckSteps, pulumiMemberCheck, pulumiProjectSchema, pulumiStackConfigProblems } from "./check-step";
+import { pulumiPlugin } from "./plugin";
+import { allowedCheck, runCheckPulumi, type PulumiRunner } from "./run";
+
+const PROJECT = `name: shop
+runtime: nodejs
+config:
+  aws:region: us-east-1
+  replicas:
+    type: integer
+  size:
+    type: string
+    default: small
+  dbPassword:
+    type: string
+    secret: true
+  zones:
+    type: array
+    items:
+      type: string
+`;
+
+const ABOUT = JSON.stringify({
+  cli: { version: "3.140.0" },
+  plugins: [{ name: "aws", version: "6.60.0" }, { name: "nodejs", version: "unknown" }],
+  backend: { name: "laptop", url: "file:///tmp/state", user: "ci" },
+});
+
+function member(files: Record<string, string>, fields: Record<string, unknown> | null = null) {
+  const dir = mkdtempSync(join(tmpdir(), "chant-pulumi-check-"));
+  for (const [name, text] of Object.entries(files)) {
+    mkdirSync(join(dir, name, ".."), { recursive: true });
+    writeFileSync(join(dir, name), text);
+  }
+  return { name: "shop", dir, kind: "pulumi", fields };
+}
+
+function fake(answers: Record<string, { stdout?: string; fail?: { code?: number | string; stderr?: string; stdout?: string } }>) {
+  const calls: Array<{ engine: string; args: string[]; env?: Record<string, string> }> = [];
+  const runner = (engine: string, env: Record<string, string>): PulumiRunner => async (args) => {
+    calls.push({ engine, args, env });
+    const a = answers[args.join(" ")] ?? { stdout: "" };
+    if (a.fail) throw Object.assign(new Error(`${engine} ${args.join(" ")} failed`), a.fail);
+    return { stdout: a.stdout ?? "" };
+  };
+  return { calls, runner };
+}
+
+const ctx = { env: { PATH: "/bin" }, log: () => {} };
+
+describe("the check argv (#4633)", () => {
+  test("install and about --json, optionally with a stack, and nothing else", () => {
+    expect(allowedCheck(["install"])).toBe(true);
+    expect(allowedCheck(["about", "--json"])).toBe(true);
+    expect(allowedCheck(["about", "--json", "--stack", "dev"])).toBe(true);
+    expect(allowedCheck(["install", "--reinstall"])).toBe(false);
+    expect(allowedCheck(["about"])).toBe(false);
+    expect(allowedCheck(["about", "--json", "--stack", "--yes"])).toBe(false);
+    expect(allowedCheck(["up", "--yes"])).toBe(false);
+  });
+
+  test("runCheckPulumi refuses an argv off the list before the runner sees it", async () => {
+    let ran = false;
+    const run: PulumiRunner = async () => {
+      ran = true;
+      return { stdout: "" };
+    };
+    await expect(runCheckPulumi(run, ["up", "--yes"], "/tmp")).rejects.toThrow(/check stage runs only/);
+    expect(ran).toBe(false);
+  });
+});
+
+describe("stack config against the project's schema", () => {
+  const schema = pulumiProjectSchema({ name: "shop", config: { "aws:region": "us-east-1", replicas: { type: "integer" }, size: { type: "string", default: "small" }, dbPassword: { type: "string", secret: true }, zones: { type: "array", items: { type: "string" } } } });
+
+  test("reads the keys in full form", () => {
+    expect(schema.keys.map((k) => k.key)).toEqual(["aws:region", "shop:replicas", "shop:size", "shop:dbPassword", "shop:zones"]);
+    expect(schema.stackConfigDir).toBe(".");
+  });
+
+  test("a stack that sets every required key with the right types passes", () => {
+    expect(pulumiStackConfigProblems(schema, "dev", { config: { "shop:replicas": "3", "shop:dbPassword": { secure: "AAAB" }, "shop:zones": ["a", "b"] } })).toEqual([]);
+  });
+
+  test("a missing key with no default, a wrong type and a plain-text secret are each named", () => {
+    const problems = pulumiStackConfigProblems(schema, "prod", { config: { "shop:size": 3, "shop:dbPassword": "hunter2", "shop:zones": ["a", ["b"]] } });
+    expect(problems).toEqual([
+      "stack prod is missing the configuration value shop:replicas (type integer, no default)",
+      "stack prod sets shop:dbPassword in plain text, and the project declares it secret; set it with pulumi config set --secret",
+      'stack prod sets shop:zones[1] to ["b"], which is not of type string',
+    ]);
+    expect(pulumiStackConfigProblems(schema, "qa", { config: { replicas: "three" } })[0]).toBe('stack qa sets shop:replicas to "three", which is not of type integer');
+  });
+
+  test("the listed stacks are the stack files", () => {
+    const m = member({ "Pulumi.yaml": PROJECT, "Pulumi.dev.yaml": "config: {}\n", "Pulumi.prod.yml": "config: {}\n" });
+    expect(listedStacks(m.dir)).toEqual(["dev", "prod"]);
+  });
+});
+
+describe("pulumi about --json", () => {
+  test("reads the engine, plugins and backend", () => {
+    expect(pulumiAboutDetail("pulumi", ABOUT)).toEqual({
+      engine: "pulumi",
+      version: "3.140.0",
+      plugins: [{ name: "aws", version: "6.60.0" }, { name: "nodejs", version: "unknown" }],
+      backend: { name: "laptop", url: "file:///tmp/state", user: "ci" },
+    });
+    expect(pulumiAboutDetail("pulumi", "not json")).toBeUndefined();
+  });
+});
+
+describe("a member's steps", () => {
+  test("install, each stack's config and about pass in order, with the check job's environment", async () => {
+    const m = member({ "Pulumi.yaml": PROJECT, "Pulumi.dev.yaml": "config:\n  shop:replicas: \"2\"\n  shop:dbPassword:\n    secure: AAAB\n  shop:zones: [a, b]\n" });
+    const { calls, runner } = fake({ "about --json": { stdout: ABOUT } });
+    const out = await pulumiMemberCheck(m, ctx, { runner });
+    expect(out.map((o) => [o.step, o.stack ?? "", o.outcome])).toEqual([
+      ["pulumi-install", "", "passed"],
+      ["stack-config", "dev", "passed"],
+      ["pulumi-about", "", "passed"],
+    ]);
+    expect(calls.map((c) => c.args.join(" "))).toEqual(["install", "about --json"]);
+    expect(calls.every((c) => c.engine === "pulumi" && c.env?.PATH === "/bin")).toBe(true);
+  });
+
+  test("a member on plunge runs plunge, and its declared stack goes to about", async () => {
+    const m = member({ "Pulumi.yaml": PROJECT }, { engine: "plunge", stack: "dev" });
+    const { calls, runner } = fake({ "about --json --stack dev": { stdout: ABOUT } });
+    const out = await pulumiMemberCheck(m, ctx, { runner });
+    expect(calls.map((c) => `${c.engine} ${c.args.join(" ")}`)).toEqual(["plunge install", "plunge about --json --stack dev"]);
+    // dev has no stack file, and replicas has no default.
+    expect(out.find((o) => o.step === "stack-config")).toMatchObject({ stack: "dev", outcome: "failed", reason: expect.stringContaining("member shop: stack dev is missing the configuration value shop:replicas") });
+  });
+
+  test("a failed install names the member, and about does not run", async () => {
+    const m = member({ "Pulumi.yaml": PROJECT, "Pulumi.dev.yaml": "config:\n  shop:replicas: 1\n  shop:dbPassword:\n    secure: x\n" });
+    const { calls, runner } = fake({ install: { fail: { code: 255, stderr: "error: npm install failed\n" } } });
+    const out = await pulumiMemberCheck(m, ctx, { runner });
+    expect(out[0]).toMatchObject({ step: "pulumi-install", outcome: "failed", exit: 255, reason: "pulumi install failed for member shop: error: npm install failed" });
+    expect(out.at(-1)).toMatchObject({ step: "pulumi-about", outcome: "skipped" });
+    expect(calls.map((c) => c.args.join(" "))).toEqual(["install"]);
+  });
+
+  test("about that exits non-zero but prints its JSON still reports", async () => {
+    const m = member({ "Pulumi.yaml": "name: shop\nruntime: nodejs\n" });
+    const { runner } = fake({ "about --json": { fail: { code: 1, stdout: ABOUT, stderr: "error: not logged in" } } });
+    const out = await pulumiMemberCheck(m, ctx, { runner });
+    expect(out.find((o) => o.step === "pulumi-about")).toMatchObject({ outcome: "passed", exit: 1, detail: { version: "3.140.0" } });
+    expect(out.find((o) => o.step === "stack-config")).toMatchObject({ outcome: "skipped" });
+  });
+
+  test("a member with no Pulumi.yaml fails, naming it", async () => {
+    const m = member({ "README.md": "x" });
+    const out = await pulumiMemberCheck(m, ctx, { runner: fake({}).runner });
+    expect(out).toEqual([expect.objectContaining({ step: "pulumi-install", outcome: "failed", reason: expect.stringContaining("has no Pulumi.yaml") })]);
+  });
+});
+
+describe("in the check stage", () => {
+  test("the plugin gives the steps for the pulumi kind", () => {
+    expect(pulumiPlugin.checkSteps?.()).toMatchObject({ lexicon: "pulumi", kinds: ["pulumi"] });
+  });
+
+  test("a failed step fails the stage after the hooks, naming member and stack", async () => {
+    const m = member({ "Pulumi.yaml": PROJECT, "Pulumi.prod.yaml": "config: {}\n" });
+    const cwd = mkdtempSync(join(tmpdir(), "chant-pulumi-stage-"));
+    const report = await runCheckStage({
+      base: "abc123",
+      cwd,
+      read: { base: "abc123", hooks: [] },
+      members: [m],
+      adapters: [pulumiCheckSteps({ runner: fake({ "about --json": { stdout: ABOUT } }).runner })],
+      env: {},
+      log: () => {},
+    });
+    expect(report.status).toBe("failed");
+    expect(report.failed).toContain("member shop: stack prod is missing the configuration value shop:replicas");
+    expect(report.steps?.map((s) => s.step)).toEqual(["pulumi-install", "stack-config", "pulumi-about"]);
+  });
+});