@intentius/chant 0.105.1 → 0.106.3

package/src/workspace/lineage-upgrade.test.ts

@@ -21,6 +21,14 @@ import { LOCK_FILE, fileHash, readLock, writeLock } from "./lineage-lock";
 import { stageUpgrade, isGovernancePath, UPGRADE_DIR, type ChantRunner } from "./lineage-upgrade";
 import { upgradeCommand } from "./lineage-upgrade-cli";
 
+// #3521: whether the workspace seals a gate is read from identity.gates in the
+// working directory; a test says which gates are sealed instead.
+const sealedGates = new Set<string>();
+vi.mock("../op/gate", async () => {
+  const actual = await vi.importActual<typeof import("../op/gate")>("../op/gate");
+  return { ...actual, gateIsSealed: async (gate: string) => sealedGates.has(gate) };
+});
+
 const ENV = { ...process.env, GIT_AUTHOR_NAME: "t", GIT_AUTHOR_EMAIL: "t@t", GIT_COMMITTER_NAME: "t", GIT_COMMITTER_EMAIL: "t@t" };
 
 let root: string;
@@ -290,6 +298,38 @@ describe("chant workspace upgrade", () => {
     expect(again.outcome).toBe("up-to-date");
   });
 
+  describe("the gated hint's approve command (#3521)", () => {
+    /** Runs the upgrade into its gate, and again against an approval of another patch; returns what both printed. */
+    async function gatedOutput(): Promise<string> {
+      release("v2.0.0", { "README.md": "starter v2\n" });
+      const port = ledger();
+      const lines: string[] = [];
+      vi.spyOn(console, "error").mockImplementation((s: unknown) => { lines.push(String(s)); });
+      await upgradeCommand({ root: proj, to: "v2.0.0", runChant: passing, ledger: port, now: "2026-09-23T10:00:00.000Z" });
+      port.approve(`sha256:${"0".repeat(64)}`, "2026-09-23T10:01:00.000Z");
+      await upgradeCommand({ root: proj, to: "v2.0.0", runChant: passing, ledger: port, now: "2026-09-23T10:02:00.000Z" });
+      return lines.join("\n");
+    }
+
+    test("unsealed gate: the gated line and the mismatch line carry no --sign", async () => {
+      const out = await gatedOutput();
+      expect(out).toContain("then run `chant approve workspace-upgrade .`");
+      expect(out).toContain("needs a fresh one: chant approve workspace-upgrade .");
+      expect(out).not.toContain("--sign");
+    });
+
+    test("sealed gate: the gated line and the mismatch line end in --sign", async () => {
+      sealedGates.add(".");
+      try {
+        const out = await gatedOutput();
+        expect(out).toContain("then run `chant approve workspace-upgrade . --sign`");
+        expect(out).toContain("needs a fresh one: chant approve workspace-upgrade . --sign");
+      } finally {
+        sealedGates.clear();
+      }
+    });
+  });
+
   test("a lock that a .gitignore covers is applied beside the patch, and the digest covers it", async () => {
     put(proj, ".gitignore", ".chant/\n");
     git(proj, ["rm", "-q", "--cached", LOCK_FILE]);

package/src/workspace/member-pipeline.test.ts

@@ -79,6 +79,34 @@ describe("the component pipeline's file and command", () => {
     expect(plan.command).toBe("chant build --components --generate github --env staging --promote-to prod");
   });
 
+  test("a pull-request pipeline gets its own file and a command that regenerates it (#3465)", () => {
+    expect(memberPipelineFile("github", "api", "staging", "pr")).toBe(".github/workflows/chant-pr.api.staging.yml");
+    expect(memberPipelineFile("gitlab", "api", "staging", "pr")).toBe(".gitlab/ci/chant-pr.api.staging.gitlab-ci.yml");
+    const dir = join(repo, "services/api");
+    const plan = planMemberComponentPipeline({
+      projectDir: dir,
+      found: findWorkspaceRoot(dir)!,
+      lexicon: "github",
+      env: "staging",
+      prLoop: { gate: "infra-apply", branch: "trunk" },
+    })!;
+    expect(plan.file).toBe(".github/workflows/chant-pr.api.staging.yml");
+    expect(plan.member).toEqual({ name: "api", dir: "services/api", file: ".github/workflows/chant-pr.api.staging.yml" });
+    expect(plan.command).toBe("chant build --components --generate github --env staging --pr-loop --gate infra-apply --branch trunk");
+  });
+
+  test("the recorded command keeps --wave-gate, --canary and --base (#3049)", () => {
+    const dir = join(repo, "services/api");
+    const plan = planMemberComponentPipeline({
+      projectDir: dir,
+      found: findWorkspaceRoot(dir)!,
+      lexicon: "github",
+      env: "staging",
+      waveGate: { gate: "release", canary: ["a", "b"], base: "origin/main" },
+    })!;
+    expect(plan.command).toBe("chant build --components --generate github --env staging --wave-gate release --canary a,b --base origin/main");
+  });
+
   test("--output keeps the path, relative to the member in the command", () => {
     const dir = join(repo, "services/api");
     const plan = planMemberComponentPipeline({

package/src/workspace/member-pipeline.ts

@@ -134,11 +134,15 @@ export function memberPipelineDir(provider: string): string | undefined {
  * The default path of a member's component pipeline for one environment,
  * relative to the repository root: `chant-<member>-<env>.yml` in the forge's
  * workflow directory, or `.gitlab/ci/chant-<member>-<env>.gitlab-ci.yml`.
+ * A pull-request pipeline (`kind` `"pr"`, #3465) is `chant-pr.<member>.<env>`, with the dots the apply group uses so no
+ * two member and environment pairs share one name, and it sits beside the
+ * member's deploy pipeline for the same environment.
  */
-export function memberPipelineFile(provider: string, member: string, env: string): string | undefined {
+export function memberPipelineFile(provider: string, member: string, env: string, kind: "components" | "pr" = "components"): string | undefined {
   const dir = PIPELINE_DIRS[provider];
   if (dir === undefined) return undefined;
-  return `${dir}/chant-${member}-${env}${provider === "gitlab" ? ".gitlab-ci.yml" : ".yml"}`;
+  const stem = kind === "pr" ? `chant-pr.${member}.${env}` : `chant-${member}-${env}`;
+  return `${dir}/${stem}${provider === "gitlab" ? ".gitlab-ci.yml" : ".yml"}`;
 }
 
 /** A repository-relative path for an absolute one. */
@@ -205,6 +209,10 @@ export interface ComponentPlanInput {
   output?: string;
   params?: string[];
   paramsFile?: string;
+  /** `--pr-loop`, with its `--gate` and `--branch` (#3465). */
+  prLoop?: { gate?: string; branch?: string };
+  /** `--wave-gate` with its `--canary` and `--base` (#3049). */
+  waveGate?: { gate: string; canary?: string[]; base?: string };
 }
 
 /** The generators' own default environment when `--env` is not given. */
@@ -224,7 +232,7 @@ export function planMemberComponentPipeline(input: ComponentPlanInput): MemberCo
   if (input.output) {
     target = resolve(input.output);
   } else {
-    const file = memberPipelineFile(input.lexicon, ctx.member.name, env);
+    const file = memberPipelineFile(input.lexicon, ctx.member.name, env, input.prLoop ? "pr" : "components");
     if (file === undefined) {
       throw new Error(`there is no default pipeline path for ${input.lexicon} in a workspace member; pass --output <file>`);
     }
@@ -234,6 +242,16 @@ export function planMemberComponentPipeline(input: ComponentPlanInput): MemberCo
 
   const parts = ["chant", "build", "--components", "--generate", input.lexicon, "--env", env];
   if (input.promoteTo) parts.push("--promote-to", input.promoteTo);
+  if (input.waveGate) {
+    parts.push("--wave-gate", input.waveGate.gate);
+    if (input.waveGate.canary?.length) parts.push("--canary", input.waveGate.canary.join(","));
+    if (input.waveGate.base) parts.push("--base", input.waveGate.base);
+  }
+  if (input.prLoop) {
+    parts.push("--pr-loop");
+    if (input.prLoop.gate) parts.push("--gate", input.prLoop.gate);
+    if (input.prLoop.branch) parts.push("--branch", input.prLoop.branch);
+  }
   for (const p of input.params ?? []) parts.push("--param", p);
   if (input.paramsFile) parts.push("--params-file", relPath(ctx.memberRoot, resolve(input.paramsFile)));
   if (input.output) parts.push("--output", relPath(ctx.memberRoot, target));

package/src/workspace/pr-report.schema.json

@@ -15,11 +15,16 @@
       "description": "The pull or merge request number. null when an apply found no pull request that merged its commit."
     },
     "env": { "type": "string" },
+    "member": {
+      "type": "string",
+      "pattern": "^[a-z0-9][a-z0-9-]{0,39}$",
+      "description": "The workspace member whose pipeline ran the stage. Absent outside a workspace member."
+    },
     "base": { "type": "string", "pattern": "^[0-9a-f]{40,64}$", "description": "The commit the change is measured from: the merge base of the given base and head." },
     "head": { "type": "string", "pattern": "^[0-9a-f]{40,64}$" },
     "op": {
       "type": "string",
-      "description": "The gate's op, pr-<number>. Its ledger is _gates/<op>.jsonl on chant/lifecycle. pr-unknown when no pull request was found."
+      "description": "The gate's op, pr-<number>, or pr-<number>-<member> for a workspace member's pipeline. Its ledger is _gates/<op>.jsonl on chant/lifecycle. pr-unknown when no pull request was found."
     },
     "gate": { "type": "string", "description": "The gate the apply waits on, pr-apply unless the pipeline names another." },
     "digest": {
@@ -36,6 +41,14 @@
       "description": "Why an apply refused. plan-changed: an approval stands for another digest, so the plan changed after review."
     },
     "message": { "type": "string", "description": "The refusal or failure as printed." },
+    "resumed": {
+      "type": "object",
+      "required": ["applied"],
+      "description": "Apply stage with --resume (#3464): an earlier attempt at the approved set failed partway. This run applied the rest under the same approval.",
+      "properties": {
+        "applied": { "type": "array", "items": { "type": "string" }, "description": "Components the earlier attempt applied, which this run did not run again." }
+      }
+    },
     "approval": {
       "type": "object",
       "required": ["status"],