@intentius/chant 0.124.26 → 0.124.28

package/dist/workspace/changes.schema.json

@@ -210,6 +210,17 @@
             }
           ]
         },
+        "links": {
+          "description": "Whether each trunk commit of the range names the work item it belongs to (#4029): the first-parent commits of base..head, merges left out. A commit names one with a `Chant-Record: <kind>:<id>` trailer of a work kind the declaration names, or a `Chant-Lease` trailer a lease history on chant/lifecycle resolves to a work item. A window match does not count. Null when no work kind was read. The field is added within contract version 1, and is written by chant 0.124.28 and newer; a reader that finds none is reading an older chant. Its findings follow `severity`, like `findings`.",
+          "oneOf": [
+            {
+              "type": "null"
+            },
+            {
+              "$ref": "#/$defs/links"
+            }
+          ]
+        },
         "ok": {
           "type": "boolean",
           "description": "False when severity is fail and there is a finding, or when scope has a finding."
@@ -637,6 +648,130 @@
           "type": "string"
         }
       }
+    },
+    "links": {
+      "type": "object",
+      "required": [
+        "kinds",
+        "commits",
+        "findings"
+      ],
+      "properties": {
+        "kinds": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "description": "The work kinds read, by name. A Chant-Record links a commit only when its kind is one of these."
+        },
+        "commits": {
+          "type": "array",
+          "description": "Oldest first.",
+          "items": {
+            "$ref": "#/$defs/linkCommit"
+          }
+        },
+        "findings": {
+          "type": "array",
+          "items": {
+            "$ref": "#/$defs/linkFinding"
+          }
+        }
+      }
+    },
+    "linkCommit": {
+      "type": "object",
+      "required": [
+        "commit",
+        "subject",
+        "state",
+        "ids",
+        "problems"
+      ],
+      "properties": {
+        "commit": {
+          "type": "string",
+          "pattern": "^[0-9a-f]{40,64}$"
+        },
+        "subject": {
+          "type": "string"
+        },
+        "state": {
+          "enum": [
+            "linked",
+            "unlinked",
+            "wrong"
+          ],
+          "description": "linked: a trailer names a work record that exists, or a lease that resolves to one (a lease is taken as linked when this checkout has no chant/lifecycle branch to read). unlinked: no Chant-Record or Chant-Lease trailer names anything. wrong: trailers name a work item but none of them is one that exists."
+        },
+        "ids": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "description": "The work records the trailers name, as <kind>:<id>. Empty unless state is linked."
+        },
+        "problems": {
+          "type": "array",
+          "description": "The trailers that do not link the commit. Empty unless state is wrong.",
+          "items": {
+            "type": "object",
+            "required": [
+              "trailer",
+              "message"
+            ],
+            "properties": {
+              "trailer": {
+                "type": "string",
+                "description": "The trailer as written, such as Chant-Record: decision:ws-075."
+              },
+              "message": {
+                "type": "string"
+              }
+            }
+          }
+        }
+      }
+    },
+    "linkFinding": {
+      "type": "object",
+      "required": [
+        "id",
+        "code",
+        "commit",
+        "message",
+        "fix",
+        "severity"
+      ],
+      "properties": {
+        "id": {
+          "type": "string",
+          "description": "finding:<code>:<commit>."
+        },
+        "code": {
+          "enum": [
+            "commit-unlinked",
+            "commit-wrongly-linked"
+          ]
+        },
+        "commit": {
+          "type": "string",
+          "pattern": "^[0-9a-f]{40,64}$"
+        },
+        "message": {
+          "type": "string"
+        },
+        "fix": {
+          "type": "string",
+          "description": "What to change so the commit names its work item."
+        },
+        "severity": {
+          "enum": [
+            "warn",
+            "fail"
+          ]
+        }
+      }
     }
   }
 }

package/dist/workspace/ci-green-cli.d.ts

@@ -1,17 +1,32 @@
 /**
  * `chant ci` (#3573, ws-103): which commits passed CI.
  *
- *   ci last-green [--json]               the newest commit on the branch with a green tag and no revoked tag
- *   ci tick [--dry-run] [--forge github] tag the commits that turned green, revoke the ones that turned red
+ *   ci last-green [--json] [--from <rev>] the newest commit on the branch with a green tag and no revoked tag
+ *   ci list [--json] [--limit <n>] [--since <rev>] [--forge github] [--source checks|runs]
+ *                                        the branch's commits within the window, each with its state and phase results
+ *   ci tick [--dry-run] [--forge github] [--source checks|runs] [--key <runner key.pem>]
+ *                                        tag the commits that turned green, revoke the ones that turned red
  *   ci workflow [--workflow <name>]... [--output <file>] [--chant <command>] [--install <command>]
- *               [--token-secret <NAME> | --app-id-var <VAR> --app-key-secret <NAME>]
+ *               [--token-secret <NAME> | --app-id-var <VAR> --app-key-secret <NAME>] [--runner-key-secret <NAME>]
  *                                        write the root CI file that runs the tick
  *
- * `last-green --json` prints `ci-last-green.schema.json`. The tick and the
+ * The tick signs its tags with a runner key (#4031) from `--key <file>` or
+ * the PEM in `CHANT_RUNNER_KEY`, which the generated workflow sets from the
+ * secret `--runner-key-secret` names.
+ *
+ * `--source runs` (or `ci.green.source: "runs"`) reads phase results from
+ * chant's own signed Op runs on `chant/lifecycle` in place of the forge's
+ * check runs (#4044); a tick from runs needs no forge token.
+ *
+ * `last-green --json` prints `ci-last-green.schema.json` and `list --json` prints
+ * `ci-list.schema.json`. The tick and the
  * workflow print text.
  */
 import type { CommandContext } from "../cli/registry.js";
+import { RUNNER_KEY_ENV } from "./ci-green.js";
+export { RUNNER_KEY_ENV };
 export declare function runCiLastGreen(ctx: CommandContext): Promise<number>;
+export declare function runCiList(ctx: CommandContext): Promise<number>;
 export declare function runCiTick(ctx: CommandContext): Promise<number>;
 export declare function runCiWorkflow(ctx: CommandContext): Promise<number>;
 //# sourceMappingURL=ci-green-cli.d.ts.map

package/dist/workspace/ci-green-cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ci-green-cli.d.ts","sourceRoot":"","sources":["../../src/workspace/ci-green-cli.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAKH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAWtD,wBAAsB,cAAc,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAgBzE;AAID,wBAAsB,SAAS,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAUpE;AAeD,wBAAsB,aAAa,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CA6CxE"}
+{"version":3,"file":"ci-green-cli.d.ts","sourceRoot":"","sources":["../../src/workspace/ci-green-cli.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAKH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEtD,OAAO,EAAmE,cAAc,EAAE,MAAM,YAAY,CAAC;AAW7G,OAAO,EAAE,cAAc,EAAE,CAAC;AAe1B,wBAAsB,cAAc,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAiBzE;AAED,wBAAsB,SAAS,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAsBpE;AAID,wBAAsB,SAAS,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAapE;AAeD,wBAAsB,aAAa,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAkDxE"}

package/dist/workspace/ci-green-cli.js

@@ -1,28 +1,56 @@
 /**
  * `chant ci` (#3573, ws-103): which commits passed CI.
  *
- *   ci last-green [--json]               the newest commit on the branch with a green tag and no revoked tag
- *   ci tick [--dry-run] [--forge github] tag the commits that turned green, revoke the ones that turned red
+ *   ci last-green [--json] [--from <rev>] the newest commit on the branch with a green tag and no revoked tag
+ *   ci list [--json] [--limit <n>] [--since <rev>] [--forge github] [--source checks|runs]
+ *                                        the branch's commits within the window, each with its state and phase results
+ *   ci tick [--dry-run] [--forge github] [--source checks|runs] [--key <runner key.pem>]
+ *                                        tag the commits that turned green, revoke the ones that turned red
  *   ci workflow [--workflow <name>]... [--output <file>] [--chant <command>] [--install <command>]
- *               [--token-secret <NAME> | --app-id-var <VAR> --app-key-secret <NAME>]
+ *               [--token-secret <NAME> | --app-id-var <VAR> --app-key-secret <NAME>] [--runner-key-secret <NAME>]
  *                                        write the root CI file that runs the tick
  *
- * `last-green --json` prints `ci-last-green.schema.json`. The tick and the
+ * The tick signs its tags with a runner key (#4031) from `--key <file>` or
+ * the PEM in `CHANT_RUNNER_KEY`, which the generated workflow sets from the
+ * secret `--runner-key-secret` names.
+ *
+ * `--source runs` (or `ci.green.source: "runs"`) reads phase results from
+ * chant's own signed Op runs on `chant/lifecycle` in place of the forge's
+ * check runs (#4044); a tick from runs needs no forge token.
+ *
+ * `last-green --json` prints `ci-last-green.schema.json` and `list --json` prints
+ * `ci-list.schema.json`. The tick and the
  * workflow print text.
  */
-import { existsSync, realpathSync } from "node:fs";
+import { existsSync, readFileSync, realpathSync } from "node:fs";
 import { join, relative, resolve, sep } from "node:path";
 import { formatError } from "../cli/format.js";
 import { findWorkspaceRoot } from "../project-root.js";
-import { ciTick, CiGreenError, formatTick, lastGreen } from "./ci-green.js";
+import { ciList, ciTick, CiGreenError, formatList, formatTick, lastGreen, RUNNER_KEY_ENV } from "./ci-green.js";
 import { ciForgeFromEnv } from "./ci-green-forge.js";
 import { ACTIONS_NAME, CI_GREEN_WORKFLOW_FILE, ciGreenHeader, readWorkflowSources, renderCiGreenWorkflow, workflowsHolding, writeWorkflowFile } from "./ci-green-workflow.js";
 import { readDeclaration, readerVersion, WorkspaceReadError } from "./declaration.js";
 import { recordGeneratedFiles, resolveMemberContext, shellArg } from "./member-pipeline.js";
 import { gitTop, workingTree } from "./tree.js";
-const USAGE = "chant ci last-green [--json] | ci tick [--dry-run] [--forge github] | ci workflow [--workflow <name>]... [--output <file>] [--chant <command>] [--install <command>] [--token-secret <NAME> | --app-id-var <VAR> --app-key-secret <NAME>]";
+const USAGE = "chant ci last-green [--json] [--from <rev>] | ci list [--json] [--limit <n>] [--since <rev>] [--forge github] [--source checks|runs] | ci tick [--dry-run] [--forge github] [--source checks|runs] [--key <runner key.pem>] | " +
+    "ci workflow [--workflow <name>]... [--output <file>] [--chant <command>] [--install <command>] [--token-secret <NAME> | --app-id-var <VAR> --app-key-secret <NAME>] [--runner-key-secret <NAME>]";
+export { RUNNER_KEY_ENV };
+/** `--source`, checked (#4044): `checks` or `runs`, or undefined to follow `ci.green.source`. */
+function sourceOf(args) {
+    const v = args.source;
+    if (v === undefined)
+        return undefined;
+    if (v !== "checks" && v !== "runs")
+        throw new Error(`--source takes checks (the forge's check runs) or runs (chant's own Op runs), not ${JSON.stringify(v)}`);
+    return v;
+}
+/** Each ignored tag as a warning line for stderr (#4031). */
+function warnIgnored(ignored) {
+    for (const t of ignored)
+        console.error(`warning: ignored ${t.tag} (${t.status}): ${t.reason}`);
+}
 export async function runCiLastGreen(ctx) {
-    const doc = lastGreen({ cwd: process.cwd() });
+    const doc = lastGreen({ cwd: process.cwd(), ...(ctx.args.migrateFrom !== undefined ? { from: ctx.args.migrateFrom } : {}) });
     if (ctx.args.json) {
         console.log(JSON.stringify(doc, null, 2));
         return "error" in doc ? 1 : 0;
@@ -31,6 +59,7 @@ export async function runCiLastGreen(ctx) {
         console.error(formatError({ message: doc.error.message, hint: USAGE }));
         return 1;
     }
+    warnIgnored(doc.ignored);
     if (!doc.commit) {
         console.error(`No first-parent commit of ${doc.ref} has a ci/green tag without a ci/revoked one. Fetch the tags first: git fetch origin --tags`);
         return 1;
@@ -38,11 +67,39 @@ export async function runCiLastGreen(ctx) {
     console.log(doc.commit.sha);
     return 0;
 }
+export async function runCiList(ctx) {
+    try {
+        const limit = ctx.args.limit;
+        if (limit !== undefined && (!Number.isInteger(limit) || limit < 1))
+            throw new Error("--limit takes a whole number of commits, 1 or more");
+        // Only an explicit --forge reaches the network; without it the list reads local refs and tags.
+        const forge = ctx.args.forge !== undefined ? ciForgeFromEnv(ctx.args.forge) : undefined;
+        const source = sourceOf(ctx.args);
+        const doc = await ciList({ cwd: process.cwd(), limit, since: ctx.args.since, forge, ...(source ? { source } : {}) });
+        if (ctx.args.json) {
+            console.log(JSON.stringify(doc, null, 2));
+            return "error" in doc ? 1 : 0;
+        }
+        if ("error" in doc) {
+            console.error(formatError({ message: doc.error.message, hint: USAGE }));
+            return 1;
+        }
+        console.log(formatList(doc));
+        return 0;
+    }
+    catch (err) {
+        console.error(formatError({ message: `chant ci list: ${describe(err)}`, hint: USAGE }));
+        return 1;
+    }
+}
 const describe = (err) => (err instanceof WorkspaceReadError ? err.describe() : err instanceof Error ? err.message : String(err));
 export async function runCiTick(ctx) {
     try {
-        const forge = ciForgeFromEnv(ctx.args.forge ?? "github");
-        const result = await ciTick({ cwd: process.cwd(), forge, dryRun: ctx.args.dryRun === true });
+        const source = sourceOf(ctx.args);
+        // The forge is made only when the source is check runs, so a tick from chant runs needs no forge token.
+        const forge = () => ciForgeFromEnv(ctx.args.forge ?? "github");
+        const runnerKey = ctx.args.key !== undefined ? readFileSync(resolve(ctx.args.key), "utf-8") : process.env[RUNNER_KEY_ENV] || undefined;
+        const result = await ciTick({ cwd: process.cwd(), forge, dryRun: ctx.args.dryRun === true, ...(source ? { source } : {}), ...(runnerKey !== undefined ? { runnerKey } : {}) });
         console.log(formatTick(result, ctx.args.dryRun === true));
         return 0;
     }
@@ -54,7 +111,7 @@ export async function runCiTick(ctx) {
 /** The push token the flags ask for, or none for the Actions token. Throws on a half-given or clashing pair. */
 function pushToken(args) {
     const { ciTokenSecret: secret, ciAppIdVar: appIdVar, ciAppKeySecret: appKeySecret } = args;
-    for (const [flag, name] of [["--token-secret", secret], ["--app-id-var", appIdVar], ["--app-key-secret", appKeySecret]]) {
+    for (const [flag, name] of [["--token-secret", secret], ["--app-id-var", appIdVar], ["--app-key-secret", appKeySecret], ["--runner-key-secret", args.ciRunnerKeySecret]]) {
         if (name !== undefined && !ACTIONS_NAME.test(name))
             throw new Error(`${flag} takes a secret or variable name, letters, digits and underscores, not ${JSON.stringify(name)}`);
     }
@@ -107,11 +164,17 @@ export async function runCiWorkflow(ctx) {
             parts.push("--token-secret", push.secret);
         if (push && "appIdVar" in push)
             parts.push("--app-id-var", push.appIdVar, "--app-key-secret", push.appKeySecret);
+        const runnerKeySecret = ctx.args.ciRunnerKeySecret;
+        if (runnerKeySecret)
+            parts.push("--runner-key-secret", runnerKeySecret);
+        if (green.signedSince && !runnerKeySecret) {
+            console.error(`warning: ci.green.signedSince is set, so the tick needs a runner key; pass --runner-key-secret <NAME> naming the repository secret that holds it, or every tick will fail`);
+        }
         const command = parts.map(shellArg).join(" ");
         const workspaceRoot = relative(repoRoot, root).split(sep).join("/") || ".";
         // The install runs in the workspace root, so its lockfile there keys setup-node's npm cache.
         const npmLock = ctx.args.ciInstall && existsSync(join(root, "package-lock.json")) ? (workspaceRoot === "." ? "package-lock.json" : `${workspaceRoot}/package-lock.json`) : undefined;
-        const yaml = renderCiGreenWorkflow({ green, workflows, chantVersion: readerVersion(), workspaceRoot, chant: ctx.args.ciChant, install: ctx.args.ciInstall, npmLock, push });
+        const yaml = renderCiGreenWorkflow({ green, workflows, chantVersion: readerVersion(), workspaceRoot, chant: ctx.args.ciChant, install: ctx.args.ciInstall, npmLock, push, ...(runnerKeySecret ? { runnerKeySecret } : {}) });
         const written = writeWorkflowFile(target, ciGreenHeader(command, member ? "member" : "root") + yaml);
         if (member)
             recordGeneratedFiles(member.memberRoot, [{ path: fromRepo, command }]);

package/dist/workspace/ci-green-forge.d.ts

@@ -6,14 +6,17 @@
  * The tags themselves are git's, pushed to the remote like any other ref, so
  * the forge is asked for check runs and nothing else. GitHub is the one
  * forge implemented. Forgejo reports commit statuses rather than check runs,
- * and GitLab reports pipeline jobs; each can implement {@link CiForge} by
- * mapping those to {@link CheckRun}s, and until one does `--forge` refuses
- * them by name.
+ * and GitLab reports pipeline jobs, and neither gets a reader here (#4021): a
+ * project on either runs its pipelines as chant Ops and sets
+ * `ci.green.source` to `runs`, so the tick reads signed Op runs from the run
+ * ledger instead (#4044, `./ci-green.ts`). `--forge` refuses them by name and
+ * says so.
  *
  * The client takes a `fetch` like the pull-request loop's (`../pr-forge.ts`),
  * so the tests drive it with a recording fake and no network.
  */
 import { type ForgeFetch, type ForgeKind } from "../pr-forge.js";
+import type { OpRunRecord } from "../op/runtime.js";
 /** One attempt of one check run on a commit. */
 export interface CheckRun {
     /** The forge's id. A later attempt of the same check has a larger one. */
@@ -25,6 +28,20 @@ export interface CheckRun {
     conclusion: string | null;
     completedAt: string | null;
     url: string | null;
+    /**
+     * Set when the "check run" is a chant Op run (#4044, `ci.green.source:
+     * "runs"`): the run's id and env, the runner whose statement it carries,
+     * and that statement. `name` is then the Op's name and `id` the run's end
+     * time in milliseconds, which orders a re-run after the run it replaced.
+     */
+    opRun?: OpRunRef;
+}
+/** The Op run a {@link CheckRun} stands for (#4044). */
+export interface OpRunRef {
+    id: string;
+    env: string;
+    signer: string;
+    statement: NonNullable<OpRunRecord["statement"]>;
 }
 export interface CiForge {
     kind: ForgeKind;

package/dist/workspace/ci-green-forge.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ci-green-forge.d.ts","sourceRoot":"","sources":["../../src/workspace/ci-green-forge.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAwC,KAAK,UAAU,EAAE,KAAK,SAAS,EAAE,MAAM,aAAa,CAAC;AAEpG,gDAAgD;AAChD,MAAM,WAAW,QAAQ;IACvB,0EAA0E;IAC1E,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,6GAA6G;IAC7G,MAAM,EAAE,MAAM,CAAC;IACf,8HAA8H;IAC9H,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;CACpB;AAED,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,SAAS,CAAC;IAChB,+CAA+C;IAC/C,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;CAC7C;AAED,MAAM,WAAW,oBAAoB;IACnC,sEAAsE;IACtE,OAAO,EAAE,MAAM,CAAC;IAChB,oBAAoB;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,UAAU,CAAC;CACpB;AAKD,+GAA+G;AAC/G,wBAAgB,aAAa,CAAC,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAkCjE;AAED,0EAA0E;AAC1E,qBAAa,uBAAwB,SAAQ,KAAK;IAChD,YAAY,IAAI,EAAE,MAAM,EAGvB;CACF;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,IAAI,GAAE,MAAiB,EAAE,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,EAAE,SAAS,CAAC,EAAE,UAAU,GAAG,OAAO,CAW9I"}
+{"version":3,"file":"ci-green-forge.d.ts","sourceRoot":"","sources":["../../src/workspace/ci-green-forge.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAwC,KAAK,UAAU,EAAE,KAAK,SAAS,EAAE,MAAM,aAAa,CAAC;AACpG,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAEjD,gDAAgD;AAChD,MAAM,WAAW,QAAQ;IACvB,0EAA0E;IAC1E,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,6GAA6G;IAC7G,MAAM,EAAE,MAAM,CAAC;IACf,8HAA8H;IAC9H,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB;;;;;OAKG;IACH,KAAK,CAAC,EAAE,QAAQ,CAAC;CAClB;AAED,wDAAwD;AACxD,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,WAAW,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC;CAClD;AAED,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,SAAS,CAAC;IAChB,+CAA+C;IAC/C,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;CAC7C;AAED,MAAM,WAAW,oBAAoB;IACnC,sEAAsE;IACtE,OAAO,EAAE,MAAM,CAAC;IAChB,oBAAoB;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,UAAU,CAAC;CACpB;AAKD,+GAA+G;AAC/G,wBAAgB,aAAa,CAAC,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAkCjE;AAED,0EAA0E;AAC1E,qBAAa,uBAAwB,SAAQ,KAAK;IAChD,YAAY,IAAI,EAAE,MAAM,EAKvB;CACF;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,IAAI,GAAE,MAAiB,EAAE,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,EAAE,SAAS,CAAC,EAAE,UAAU,GAAG,OAAO,CAW9I"}

package/dist/workspace/ci-green-forge.js

@@ -6,9 +6,11 @@
  * The tags themselves are git's, pushed to the remote like any other ref, so
  * the forge is asked for check runs and nothing else. GitHub is the one
  * forge implemented. Forgejo reports commit statuses rather than check runs,
- * and GitLab reports pipeline jobs; each can implement {@link CiForge} by
- * mapping those to {@link CheckRun}s, and until one does `--forge` refuses
- * them by name.
+ * and GitLab reports pipeline jobs, and neither gets a reader here (#4021): a
+ * project on either runs its pipelines as chant Ops and sets
+ * `ci.green.source` to `runs`, so the tick reads signed Op runs from the run
+ * ledger instead (#4044, `./ci-green.ts`). `--forge` refuses them by name and
+ * says so.
  *
  * The client takes a `fetch` like the pull-request loop's (`../pr-forge.ts`),
  * so the tests drive it with a recording fake and no network.
@@ -58,7 +60,7 @@ export function githubCiForge(opts) {
 /** Thrown for a forge `chant ci tick` has no check-run client for yet. */
 export class CiForgeUnsupportedError extends Error {
     constructor(kind) {
-        super(`check runs are read from GitHub only so far, and --forge asked for ${kind}; see #3573`);
+        super(`check runs are read from GitHub only, and --forge asked for ${kind}. A ${kind} project runs its pipelines as chant Ops and sets ci.green.source to "runs" (or passes --source runs), so the tick reads signed Op runs from chant/lifecycle instead`);
         this.name = "CiForgeUnsupportedError";
     }
 }

package/dist/workspace/ci-green-workflow.d.ts

@@ -34,6 +34,11 @@
  * tick's own `GITHUB_TOKEN`, which reads check runs, stays the Actions token:
  * a fine-grained personal access token can't call the Checks API.
  *
+ * `--runner-key-secret <NAME>` (#4031) hands the tick the runner key it
+ * signs its tags with, from `secrets.<NAME>` as `CHANT_RUNNER_KEY`. A
+ * declaration that sets `ci.green.signedSince` needs it: a tag outside that
+ * commit's strict first-parent ancestry without a statement is ignored.
+ *
  * Like a member's pipelines (./member-pipeline.ts), the file starts with the
  * generated-file header naming the command, and the member whose directory
  * the command runs in records it in its generated-file record, so `WSP081`
@@ -86,6 +91,12 @@ export interface WorkflowInput {
     workspaceRoot: string;
     /** How the tag push authenticates, when not with the Actions token. */
     push?: PushToken;
+    /**
+     * The repository secret holding the runner key the tick signs its tags
+     * with, as PEM (#4031). The tick step reads it from `CHANT_RUNNER_KEY`.
+     * The key's principal needs the `runner` role in `.chant/trust.json`.
+     */
+    runnerKeySecret?: string;
 }
 /**
  * A token the checkout persists for the tick's `git push`: a repository

package/dist/workspace/ci-green-workflow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ci-green-workflow.d.ts","sourceRoot":"","sources":["../../src/workspace/ci-green-workflow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAMH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAI7C,gEAAgE;AAChE,eAAO,MAAM,sBAAsB,yCAAyC,CAAC;AAC7E,eAAO,MAAM,sBAAsB,mBAAmB,CAAC;AAEvD,8CAA8C;AAC9C,MAAM,WAAW,cAAc;IAC7B,2EAA2E;IAC3E,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAKD,yHAAyH;AACzH,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,EAAE,CAYnD;AAYD,MAAM,WAAW,YAAY;IAC3B,0DAA0D;IAC1D,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,sDAAsD;IACtD,SAAS,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAChD,+CAA+C;IAC/C,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,oEAAoE;AACpE,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,cAAc,EAAE,GAAG,YAAY,CAyBjG;AAED,iEAAiE;AACjE,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,cAAc,EAAE,CASpF;AAID,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,OAAO,CAAC;IACf,sDAAsD;IACtD,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7B,mEAAmE;IACnE,YAAY,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,wFAAwF;IACxF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,8GAA8G;IAC9G,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,mFAAmF;IACnF,aAAa,EAAE,MAAM,CAAC;IACtB,uEAAuE;IACvE,IAAI,CAAC,EAAE,SAAS,CAAC;CAClB;AAED;;;;GAIG;AACH,MAAM,MAAM,SAAS,GAAG;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAAC;AAExF,4GAA4G;AAC5G,eAAO,MAAM,YAAY,QAA6B,CAAC;AAEvD,mHAAmH;AACnH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,aAAa,GAAG,MAAM,CAqElE;AAED,yFAAyF;AACzF,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,GAAG,MAAM,GAAG,MAAM,CAE/E;AAED,kGAAkG;AAClG,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAItE"}
+{"version":3,"file":"ci-green-workflow.d.ts","sourceRoot":"","sources":["../../src/workspace/ci-green-workflow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AAMH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAI7C,gEAAgE;AAChE,eAAO,MAAM,sBAAsB,yCAAyC,CAAC;AAC7E,eAAO,MAAM,sBAAsB,mBAAmB,CAAC;AAEvD,8CAA8C;AAC9C,MAAM,WAAW,cAAc;IAC7B,2EAA2E;IAC3E,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAKD,yHAAyH;AACzH,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,EAAE,CAYnD;AAYD,MAAM,WAAW,YAAY;IAC3B,0DAA0D;IAC1D,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,sDAAsD;IACtD,SAAS,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAChD,+CAA+C;IAC/C,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,oEAAoE;AACpE,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,cAAc,EAAE,GAAG,YAAY,CAyBjG;AAED,iEAAiE;AACjE,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,cAAc,EAAE,CASpF;AAID,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,OAAO,CAAC;IACf,sDAAsD;IACtD,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7B,mEAAmE;IACnE,YAAY,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,wFAAwF;IACxF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,8GAA8G;IAC9G,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,mFAAmF;IACnF,aAAa,EAAE,MAAM,CAAC;IACtB,uEAAuE;IACvE,IAAI,CAAC,EAAE,SAAS,CAAC;IACjB;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;;GAIG;AACH,MAAM,MAAM,SAAS,GAAG;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAAC;AAExF,4GAA4G;AAC5G,eAAO,MAAM,YAAY,QAA6B,CAAC;AAEvD,mHAAmH;AACnH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,aAAa,GAAG,MAAM,CAsElE;AAED,yFAAyF;AACzF,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,GAAG,MAAM,GAAG,MAAM,CAE/E;AAED,kGAAkG;AAClG,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAItE"}

package/dist/workspace/ci-green-workflow.js

@@ -34,6 +34,11 @@
  * tick's own `GITHUB_TOKEN`, which reads check runs, stays the Actions token:
  * a fine-grained personal access token can't call the Checks API.
  *
+ * `--runner-key-secret <NAME>` (#4031) hands the tick the runner key it
+ * signs its tags with, from `secrets.<NAME>` as `CHANT_RUNNER_KEY`. A
+ * declaration that sets `ci.green.signedSince` needs it: a tag outside that
+ * commit's strict first-parent ancestry without a statement is ignored.
+ *
  * Like a member's pipelines (./member-pipeline.ts), the file starts with the
  * generated-file header naming the command, and the member whose directory
  * the command runs in records it in its generated-file record, so `WSP081`
@@ -186,6 +191,7 @@ export function renderCiGreenWorkflow(input) {
         "          GITHUB_TOKEN: ${{ github.token }}",
         "          GIT_COMMITTER_NAME: github-actions[bot]",
         "          GIT_COMMITTER_EMAIL: 41898282+github-actions[bot]@users.noreply.github.com",
+        ...(input.runnerKeySecret ? [`          CHANT_RUNNER_KEY: \${{ secrets.${input.runnerKeySecret} }}`] : []),
         `        run: ${tick}`,
     ];
     return lines.join("\n") + "\n";