@intentius/chant 0.124.27 → 0.124.29

package/src/cli/handlers/release-implicit.e2e.test.ts

@@ -0,0 +1,161 @@
+/**
+ * An implicit release of a project with no components, end to end (#4046):
+ * the getting-started example, given two environments and a build parameter
+ * set per environment, is cut from the same commit in two clones. Each
+ * environment's build output must come out byte for byte the same, and the
+ * two cuts must give one release digest. No cluster is touched: the release
+ * is exported to files and never deployed.
+ */
+
+import { describe, test, expect } from "vitest";
+import { spawnSync } from "node:child_process";
+import { cpSync, existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, symlinkSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join, relative } from "node:path";
+import { pathToFileURL } from "node:url";
+import { contract, REPO } from "../../workspace/__fixtures__/contract-repo";
+import releasesSchema from "../../workspace/releases.schema.json";
+import { contentDigest } from "../../content-digest";
+
+const CHANT = [process.execPath, "--import", pathToFileURL(join(REPO, "node_modules", "tsx", "dist", "loader.mjs")).href, join(REPO, "packages", "core", "src", "cli", "main.ts")];
+const EXAMPLE = join(REPO, "examples", "getting-started");
+
+function chant(cwd: string, ...args: string[]): { code: number; stdout: string; stderr: string } {
+  const env: NodeJS.ProcessEnv = { ...process.env, USER: "tester" };
+  for (const k of ["GITHUB_RUN_ID", "CI_PIPELINE_ID", "GITHUB_ACTOR", "GITLAB_USER_LOGIN", "CHANT_ENV", "GITHUB_SHA", "CI"]) delete env[k];
+  const r = spawnSync(CHANT[0], [...CHANT.slice(1), ...args], { cwd, encoding: "utf-8", env, timeout: 180_000 });
+  return { code: r.status ?? 1, stdout: r.stdout ?? "", stderr: r.stderr ?? "" };
+}
+
+function git(cwd: string, ...args: string[]): string {
+  const r = spawnSync("git", args, { cwd, encoding: "utf-8" });
+  if (r.status !== 0) throw new Error(r.stderr);
+  return r.stdout.trim();
+}
+
+/** Every file under `dir`, by its path relative to `dir`, as bytes. */
+function filesUnder(dir: string): Map<string, Buffer> {
+  const out = new Map<string, Buffer>();
+  const walk = (d: string): void => {
+    for (const e of readdirSync(d, { withFileTypes: true })) {
+      const p = join(d, e.name);
+      if (e.isDirectory()) walk(p);
+      else out.set(relative(dir, p), readFileSync(p));
+    }
+  };
+  walk(dir);
+  return out;
+}
+
+/** The example as a project of its own with two environments and a parameter that differs between them. */
+function writeProject(dir: string): void {
+  cpSync(join(EXAMPLE, "src"), join(dir, "src"), { recursive: true });
+  // The deploy Op goes under the build root, so the build writes src/dist/ops/deploy/op.json too: an Op's output goes under its build root.
+  cpSync(join(EXAMPLE, "deploy.op.ts"), join(dir, "src", "deploy.op.ts"));
+  const web = readFileSync(join(dir, "src", "web.ts"), "utf-8");
+  writeFileSync(
+    join(dir, "src", "web.ts"),
+    `import { params } from "@intentius/chant/params";\n${web.replace("replicas: 2,", "replicas: params.replicas as number,")}`,
+  );
+  writeFileSync(
+    join(dir, "chant.config.ts"),
+    `export default {\n  lexicons: ["k8s"],\n  sourceDir: "src",\n  environments: ["dev", "prod"],\n  buildParams: { replicas: { type: "number", default: 2 } },\n};\n`,
+  );
+  writeFileSync(join(dir, "params.dev.json"), `{ "replicas": 1 }\n`);
+  writeFileSync(join(dir, "params.prod.json"), `{ "replicas": 3 }\n`);
+  writeFileSync(join(dir, ".gitignore"), "node_modules\ndist/\nout/\n");
+}
+
+describe("an implicit release of a project with no components", () => {
+  test(
+    "two cuts of one commit, in two clones, give byte-identical build output per environment and one release digest",
+    () => {
+      const root = mkdtempSync(join(tmpdir(), "chant-release-implicit-"));
+      try {
+        const a = join(root, "a");
+        const b = join(root, "b");
+        mkdirSync(a);
+        writeProject(a);
+        git(a, "init", "-q", "-b", "main");
+        git(a, "config", "user.email", "t@chant.dev");
+        git(a, "config", "user.name", "T");
+        git(a, "add", ".");
+        git(a, "commit", "-q", "-m", "init");
+        const sha = git(a, "rev-parse", "HEAD");
+        // Each clone has a bare remote of its own holding main, so the commit is on trunk and pushed (#4027).
+        git(root, "init", "-q", "--bare", "-b", "main", "a.git");
+        git(a, "remote", "add", "origin", join(root, "a.git"));
+        git(a, "push", "-q", "origin", "main");
+        git(a, "fetch", "-q", "origin");
+        git(root, "clone", "-q", join(root, "a.git"), b);
+        git(root, "init", "-q", "--bare", "-b", "main", "b.git");
+        git(b, "remote", "set-url", "origin", join(root, "b.git"));
+        git(b, "push", "-q", "origin", "main");
+        git(b, "fetch", "-q", "origin");
+        for (const d of [a, b]) git(d, "tag", `ci/green/${sha}`);
+        for (const d of [a, b]) symlinkSync(join(REPO, "node_modules"), join(d, "node_modules"), "dir");
+
+        const cuts = [a, b].map((d, i) => {
+          const r = chant(d, "release", "cut", ...(i === 0 ? ["v1"] : []), "--params-file", "params.{env}.json", "--yes", "--json");
+          expect(r.code, r.stderr).toBe(0);
+          return JSON.parse(r.stdout);
+        });
+        const [first, second] = cuts;
+        expect(second.release.releaseDigest).toBe(first.release.releaseDigest);
+        expect(second.release).toEqual(first.release);
+        expect(first.stored && second.stored).toBe(true);
+
+        const release = first.release;
+        expect(release.commit).toBe(sha);
+        expect(release.artifactDigests).toEqual([]);
+        expect(release.targets.map((t: { env: string }) => t.env)).toEqual(["dev", "prod"]);
+        for (const t of release.targets) {
+          expect(t.templates.map((x: { component: unknown; path: string }) => [x.component, x.path])).toEqual([
+            [null, "dist/build.yaml"],
+            [null, "src/dist/ops/deploy/op.json"],
+          ]);
+          expect(t.params).toEqual([{ name: "replicas", value: t.env === "prod" ? 3 : 1, source: "params-file" }]);
+        }
+        // The parameter reaches the output, so the two environments' manifests differ.
+        expect(release.targets[0].templates[0].digest).not.toBe(release.targets[1].templates[0].digest);
+        // Nothing was written into the member's directory by the cut.
+        expect(existsSync(join(a, "dist")) || existsSync(join(a, "src", "dist"))).toBe(false);
+
+        // Each clone's stored bytes, written out per environment, are the same bytes.
+        for (const env of ["dev", "prod"]) {
+          const [fromA, fromB] = [a, b].map((d) => {
+            const ref = d === a ? "v1" : release.releaseDigest;
+            const r = chant(d, "release", "export", ref, "--env", env, "-o", `out/${env}`);
+            expect(r.code, r.stderr).toBe(0);
+            return filesUnder(join(d, "out", env));
+          });
+          expect([...fromA.keys()].sort()).toEqual(["dist/build.yaml", "src/dist/ops/deploy/op.json"]);
+          expect([...fromB.keys()].sort()).toEqual([...fromA.keys()].sort());
+          for (const [path, bytes] of fromA) {
+            expect(fromB.get(path)!.equals(bytes), `${env} ${path}`).toBe(true);
+            const recorded = release.targets.find((t: { env: string }) => t.env === env).templates.find((x: { path: string }) => x.path === path);
+            expect(contentDigest(bytes.toString("utf-8"))).toBe(recorded.digest);
+          }
+          expect(fromA.get("dist/build.yaml")!.toString("utf-8")).toContain(`replicas: ${env === "prod" ? 3 : 1}`);
+        }
+
+        // `release list --json` shows it as it shows any release.
+        const list = chant(a, "release", "list", "--json");
+        expect(list.code, list.stderr).toBe(0);
+        const doc = JSON.parse(list.stdout);
+        contract(releasesSchema).expectValid(doc);
+        expect(doc.releases).toHaveLength(1);
+        expect(doc.releases[0]).toMatchObject({ releaseDigest: release.releaseDigest, label: "v1", artifactDigests: [], environments: [] });
+
+        // Promote has no component to deploy, and says what to run instead.
+        const promote = chant(a, "components", "promote", "--from", "dev", "--to", "prod", "--release", "v1");
+        expect(promote.code).toBe(1);
+        expect(promote.stderr).toMatch(/release v1 is of a project with no components/);
+        expect(promote.stderr).toMatch(/chant release export v1 --env prod/);
+      } finally {
+        rmSync(root, { recursive: true, force: true });
+      }
+    },
+    480_000,
+  );
+});

package/src/cli/handlers/release-join.e2e.test.ts

@@ -0,0 +1,185 @@
+/**
+ * A commit, a release, a release gate and a deploy record join through the
+ * release digest (#4043). Everything runs in a temp repo with no remote, so
+ * nothing is pushed: a green tag, a real cut, a real `components promote
+ * --release` that stops at its gate, a real `chant approve`, and the promote
+ * that follows. Only the capability registry is replaced, so no deploy step
+ * reaches a cloud.
+ */
+
+import { afterEach, describe, expect, test, vi } from "vitest";
+import { withTestDir } from "@intentius/chant-test-utils";
+import { spawnSync } from "node:child_process";
+import { writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { CapabilityRegistry, type DeployContext } from "../../components/capability";
+import type { DriverComponent } from "../../components/driver";
+import type { ParsedArgs } from "../registry";
+import { appendReleaseRecord, readReleaseLedger } from "../../lifecycle/release-ledger";
+import { readGateLedger } from "../../lifecycle/gate-ledger";
+import { cutRelease } from "../../lifecycle/release-cut";
+import { joinRelease, type ReleaseJoinStart } from "../../lifecycle/release-join";
+import { resetGateOrigin } from "../../lifecycle/gate-origin";
+import type { ReleaseArtifact } from "../../lifecycle/release-store";
+import type { CompiledTarget, TargetCompiler } from "../../components/release-compile";
+
+const DIGEST = `sha256:${"a".repeat(64)}`;
+
+const api: DriverComponent = {
+  name: "api",
+  deploy: [
+    { phase: "Publish", steps: [{ kind: "publish-image", from: "archive:api.tar" }] },
+    { phase: "Apply", steps: [{ kind: "gate", gate: "prod-release" }, { kind: "apply", template: "dist/api.template.json", imageRef: "@Publish.digest" }] },
+  ],
+};
+
+vi.mock("../../config", async () => {
+  const actual = await vi.importActual<typeof import("../../config")>("../../config");
+  return { ...actual, loadChantConfig: async () => ({ config: {} }) };
+});
+vi.mock("../../components/cli-support", () => ({
+  isComponentList: () => false,
+  resolveComponentTargets: async () => ({ success: true, targets: [api] }),
+}));
+vi.mock("../../components/fan-out-support", () => ({
+  fanOutRegistry: async () => {
+    const registry = new CapabilityRegistry();
+    registry.register({ kind: "publish-image", async run(_ctx: DeployContext) { return { digest: DIGEST, uri: `reg/api@${DIGEST}` }; } } as never);
+    registry.register({ kind: "apply", async run() { return {}; } } as never);
+    return registry;
+  },
+}));
+vi.mock("../../op/discover", () => ({ discoverOps: async () => ({ errors: [], ops: new Map() }) }));
+vi.mock("./run", () => ({ GATED_EXIT_CODE: 3 }));
+
+const { runComponentsPromote, runComponentsRedeploy } = await import("./promote");
+const { recordGateApproval } = await import("./approve");
+
+function git(dir: string, ...args: string[]): string {
+  const r = spawnSync("git", args, { cwd: dir, encoding: "utf-8" });
+  if (r.status !== 0) throw new Error(`git ${args.join(" ")}: ${r.stderr}`);
+  return r.stdout.trim();
+}
+
+/** A compiler that compiles each environment to its own template and builds one image. */
+const compiler: TargetCompiler = {
+  async compile(env): Promise<CompiledTarget> {
+    return {
+      env,
+      params: [],
+      components: ["api"],
+      buildSteps: { api: [{ kind: "docker-build", context: "api", into: "api.tar" }] },
+      buildInputs: { api: ["api"] },
+      componentFiles: { api: "api.component.ts" },
+      templates: [{ component: "api", path: "dist/api.template.json", content: `{"env":"${env}"}\n` }],
+    };
+  },
+  async buildArtifacts(_env, components): Promise<ReleaseArtifact[]> {
+    return components.map((c) => ({ component: c, kind: "image" as const, path: `${c}.tar`, digest: DIGEST }));
+  },
+};
+
+function args(overrides: Partial<ParsedArgs>): ParsedArgs {
+  return {
+    command: "components", path: "promote", format: "", fix: false, watch: false, verbose: false, help: false, live: false,
+    migrateFrom: "staging", migrateTo: "prod", actor: "bob", runId: "run-9", ...overrides,
+  } as ParsedArgs;
+}
+const ctx = (a: Partial<ParsedArgs>) => ({ args: args(a), plugins: [] }) as never;
+
+describe("commit, release, gate and deploy record join through the release digest (#4043)", () => {
+  const cwd = process.cwd();
+  afterEach(() => {
+    process.chdir(cwd);
+    resetGateOrigin();
+    vi.restoreAllMocks();
+  });
+
+  test(
+    "a cut, a gated promote, an approval and a redeploy join from the commit, the release, the gate and the deploy",
+    async () => {
+      vi.spyOn(console, "error").mockImplementation(() => {});
+      vi.spyOn(console, "log").mockImplementation(() => {});
+      vi.spyOn(process.stderr, "write").mockImplementation(() => true);
+      await withTestDir(async (dir) => {
+        git(dir, "init", "-q", "-b", "main");
+        git(dir, "config", "user.email", "t@chant.dev");
+        git(dir, "config", "user.name", "T");
+        writeFileSync(join(dir, "chant.config.ts"), `export default { environments: ["dev", "staging", "prod"] };\n`);
+        writeFileSync(join(dir, "api.component.ts"), "export const api = {};\n");
+        git(dir, "add", ".");
+        git(dir, "commit", "-q", "-m", "init");
+        const sha = git(dir, "rev-parse", "HEAD");
+        git(dir, "tag", `ci/green/${sha}`, sha);
+        process.chdir(dir);
+
+        // The release is cut from the green commit.
+        const cut = await cutRelease({ cwd: dir, compiler, label: "v1.0.0", actor: "alice", env: {}, now: () => new Date("2026-10-16T10:00:00.000Z") });
+        const releaseDigest = cut.release.releaseDigest;
+
+        // Staging is what prod promotes from. It is a plain deploy of the same commit.
+        await appendReleaseRecord(
+          { component: "api", env: "staging", digest: DIGEST, gitSha: sha, runId: "run-1", timestamp: "2026-10-16T10:30:00.000Z", actor: "ci" },
+          { cwd: dir },
+        );
+
+        // The promote stops at the release gate and leaves a pending fact for the release.
+        expect(await runComponentsPromote(ctx({ release: "v1.0.0" }))).toBe(3);
+        const afterStop = await readGateLedger("release", { cwd: dir });
+        expect(afterStop.pending).toEqual([expect.objectContaining({ gate: "prod-release", environment: "prod", releaseDigest })]);
+        expect((await readReleaseLedger("prod", { cwd: dir })).records).toEqual([]);
+
+        // A person approves it, and the promote then deploys.
+        const approved = await recordGateApproval("release", "prod-release", { origin: "cli", actor: "alice", cwd: dir, environment: "prod" });
+        expect(approved.ok).toBe(true);
+        expect(await runComponentsPromote(ctx({ release: "v1.0.0" }))).toBe(0);
+        const [deploy] = (await readReleaseLedger("prod", { cwd: dir })).records;
+        expect(deploy).toMatchObject({ env: "prod", component: "api", releaseDigest, approver: "alice", admission: { op: "release", gate: "prod-release" } });
+
+        // A redeploy puts the same deploy back; it stops at the component's own gate first.
+        const redeployArgs = { path: "redeploy", component: "api", migrateTo: undefined, migrateFrom: undefined, extraPositional: "prod", runId: "run-10" };
+        const stopped = await runComponentsRedeploy(ctx(redeployArgs));
+        expect(stopped).toBe(3);
+        const gateOp = (await readGateLedger("api", { cwd: dir })).pending.at(-1)!;
+        expect((await recordGateApproval(gateOp.op, gateOp.gate, { origin: "cli", actor: "alice", cwd: dir, environment: "prod" })).ok).toBe(true);
+        expect(await runComponentsRedeploy(ctx(redeployArgs))).toBe(0);
+        const prodRecords = (await readReleaseLedger("prod", { cwd: dir })).records;
+        expect(prodRecords).toHaveLength(2);
+        expect(prodRecords[1]).toMatchObject({ releaseDigest, redeploys: { env: "prod", runId: deploy.runId } });
+
+        // From each starting point the same release, gate and deploys come back.
+        const resolution = (await readGateLedger("release", { cwd: dir })).resolutions[0];
+        const pending = (await readGateLedger("release", { cwd: dir })).pending[0];
+        const starts: Array<[string, ReleaseJoinStart]> = [
+          ["commit", { commit: sha }],
+          ["commit prefix", { commit: sha.slice(0, 10) }],
+          ["release label", { release: "v1.0.0" }],
+          ["release digest", { release: releaseDigest }],
+          ["deploy record", { deploy: deploy }],
+          ["gate resolution", { gate: resolution }],
+          ["pending fact", { gate: pending }],
+          ["deploy record without releaseDigest, by its admission", { deploy: { admission: deploy.admission } }],
+        ];
+        for (const [name, from] of starts) {
+          const joined = await joinRelease(from, { cwd: dir });
+          expect(joined.releases, name).toHaveLength(1);
+          const [one] = joined.releases;
+          expect(one.releaseDigest, name).toBe(releaseDigest);
+          expect(one.commit, name).toBe(sha);
+          expect(one.label, name).toBe("v1.0.0");
+          expect(one.gates.resolutions.map((r) => [r.gate, r.resolvedBy, r.environment]), name).toEqual([["prod-release", "alice", "prod"]]);
+          expect(one.gates.pending.map((p) => p.planDigest), name).toEqual([resolution.planDigest]);
+          expect(one.deploys.map((d) => [d.env, d.runId]), name).toEqual([["prod", deploy.runId], ["prod", "run-10"]]);
+          // The deploy names the gate's resolution by address, and the join finds that very resolution.
+          expect(one.deploys[0].admission).toMatchObject({ op: "release", gate: one.gates.resolutions[0].gate, resolvedAt: one.gates.resolutions[0].timestamp });
+        }
+
+        // An unknown commit and a deploy that came from no release join to nothing, with a reason.
+        expect(await joinRelease({ commit: "f".repeat(40) }, { cwd: dir })).toMatchObject({ releases: [], reason: expect.stringMatching(/no release was cut/) });
+        expect(await joinRelease({ deploy: { releaseDigest: undefined } }, { cwd: dir })).toMatchObject({ releases: [], reason: expect.stringMatching(/not made from one/) });
+        expect(await joinRelease({ commit: "abc" }, { cwd: dir })).toMatchObject({ releases: [], reason: expect.stringMatching(/at least 7/) });
+      });
+    },
+    240_000,
+  );
+});

package/src/cli/handlers/release-publish-targets.e2e.test.ts

@@ -0,0 +1,295 @@
+/**
+ * `chant release publish` with targets, end to end (#4047): a member that
+ * declares an npm target of two packages and an OCI target is cut, then
+ * published to stand-ins only, a fake `npm` first on PATH and a registry fake
+ * on 127.0.0.1 that this test starts and closes. The publish is a dry run
+ * without --yes; with --yes and a CI OIDC token it stages each package under
+ * next with --provenance and the image by digest, then moves latest and the
+ * tag (#4048); no credential appears in its output or on `chant/lifecycle`;
+ * and a checkout that moved past the release's commit is refused. A publish
+ * that fails part way is resumed from a fresh clone, as a CI job would, from
+ * the record it pushed, and publishes nothing again.
+ *
+ * #4049: the first release is cut signed with a throwaway key the signers
+ * file lists, and published as CI publishes it: each package carries its
+ * SBOM, the image gets its SBOM and the release's provenance statement as
+ * referrers, and the fake npm records `npm audit signatures` run over what
+ * was published. The second is published unsigned under --allow-unsigned.
+ */
+
+import { afterAll, beforeAll, describe, expect, test } from "vitest";
+import { execFileSync, spawn, spawnSync } from "node:child_process";
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, realpathSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { pathToFileURL } from "node:url";
+import { REPO } from "../../workspace/__fixtures__/contract-repo";
+import { readFakeNpmRegistry, startFakeRegistry, writeFakeNpm, writeLockfile, writeOciLayout, writePackage, type FakeRegistry } from "../../lifecycle/__fixtures__/publish-fakes";
+import { hasSshKeygen } from "../../workspace/trust/test-repo";
+
+const CHANT = [process.execPath, "--import", pathToFileURL(join(REPO, "node_modules", "tsx", "dist", "loader.mjs")).href, join(REPO, "packages", "core", "src", "cli", "main.ts")];
+const CI_VARS = [
+  "CI",
+  "GITHUB_ACTIONS",
+  "GITHUB_RUN_ID",
+  "GITHUB_SHA",
+  "GITHUB_ACTOR",
+  "GITHUB_REPOSITORY",
+  "GITHUB_SERVER_URL",
+  "GITHUB_API_URL",
+  "GITHUB_TOKEN",
+  "ACTIONS_ID_TOKEN_REQUEST_URL",
+  "ACTIONS_ID_TOKEN_REQUEST_TOKEN",
+  "GITLAB_CI",
+  "CI_PIPELINE_ID",
+  "GITLAB_USER_LOGIN",
+  "CHANT_ENV",
+  "NODE_AUTH_TOKEN",
+  "OCI_USERNAME",
+  "OCI_PASSWORD",
+];
+
+/** Run chant without blocking this process, so the registry fake in it can answer. */
+function chant(cwd: string, args: string[], extra: Record<string, string> = {}): Promise<{ code: number; stdout: string; stderr: string }> {
+  const env: NodeJS.ProcessEnv = { ...process.env, USER: "tester" };
+  for (const k of CI_VARS) delete env[k];
+  Object.assign(env, extra);
+  return new Promise((resolve) => {
+    const child = spawn(CHANT[0]!, [...CHANT.slice(1), ...args], { cwd, env });
+    let stdout = "";
+    let stderr = "";
+    child.stdout.on("data", (c: Buffer) => (stdout += c.toString()));
+    child.stderr.on("data", (c: Buffer) => (stderr += c.toString()));
+    child.on("close", (code) => resolve({ code: code ?? 1, stdout, stderr }));
+  });
+}
+
+function git(cwd: string, ...args: string[]): string {
+  const r = spawnSync("git", args, { cwd, encoding: "utf-8" });
+  if (r.status !== 0) throw new Error(r.stderr);
+  return r.stdout.trim();
+}
+
+const BUILD = `mkdir -p dist && printf '{"env":"%s"}' "$CHANT_ENV" > dist/api.template.json`;
+const NPM_TOKEN = "npm_e2eSecretToken0042";
+const OCI_PASSWORD = "oci-e2e-password-0042";
+const REGISTRY_TOKEN = "registry-e2e-token-0042";
+
+let reg: FakeRegistry;
+let root: string;
+beforeAll(async () => {
+  reg = await startFakeRegistry({ username: "robot", password: OCI_PASSWORD, token: REGISTRY_TOKEN });
+  root = realpathSync(mkdtempSync(join(tmpdir(), "chant-release-publish-targets-")));
+});
+afterAll(async () => {
+  await reg.close();
+  rmSync(root, { recursive: true, force: true });
+});
+
+describe("chant release publish with targets", () => {
+  test.skipIf(!hasSshKeygen)(
+    "a dry run by default; with --yes publishes a signed release's two npm packages in order with --provenance, audits their signatures, and an image by digest with its SBOM and provenance; prints no credential, and refuses a moved checkout",
+    async () => {
+      const dir = join(root, "work");
+      const remote = join(root, "origin.git");
+      git(root, "init", "-q", "--bare", "-b", "main", remote);
+      git(root, "init", "-q", "-b", "main", dir);
+      git(dir, "config", "user.email", "t@chant.dev");
+      git(dir, "config", "user.name", "T");
+      const publish = [
+        { type: "npm", packages: ["packages/core", "packages/cli"], access: "public" },
+        { type: "oci", image: "image", repository: `${reg.host}/acme/api`, usernameEnv: "OCI_USERNAME", passwordEnv: "OCI_PASSWORD" },
+      ];
+      writeFileSync(join(dir, "chant.config.ts"), `export default { environments: ["dev"], release: { publish: ${JSON.stringify(publish)} } };\n`);
+      writeFileSync(
+        join(dir, "api.component.ts"),
+        `export const api = { name: "api", dependsOn: [], deploy: [{ phase: "Apply", steps: [{ kind: "cfn-deploy", template: "dist/api.template.json" }] }] };\n`,
+      );
+      writeFileSync(join(dir, ".gitignore"), "dist/\n");
+      writePackage(join(dir, "packages", "core"), "@acme/core", "1.0.0");
+      writePackage(join(dir, "packages", "cli"), "@acme/cli", "1.0.0");
+      writeLockfile(dir);
+      const { digest } = writeOciLayout(join(dir, "image"));
+      // #4049: alice's throwaway key, which the signers file lists.
+      const key = join(root, "alice-key");
+      execFileSync("ssh-keygen", ["-q", "-t", "ed25519", "-N", "", "-C", "alice", "-f", key]);
+      const alicePub = readFileSync(`${key}.pub`, "utf-8").trim().split(" ").slice(0, 2).join(" ");
+      mkdirSync(join(dir, ".chant"), { recursive: true });
+      writeFileSync(join(dir, ".chant", "allowed_signers"), `alice ${alicePub}\n`);
+      git(dir, "add", ".");
+      git(dir, "commit", "-q", "-m", "init");
+      git(dir, "remote", "add", "origin", remote);
+      git(dir, "push", "-q", "origin", "main");
+      git(dir, "fetch", "-q", "origin");
+      const sha = git(dir, "rev-parse", "HEAD");
+      git(dir, "tag", `ci/green/${sha}`);
+
+      const log = join(root, "npm.log");
+      const bin = join(root, "bin");
+      writeFakeNpm(bin, log);
+      const path = { PATH: `${bin}:${process.env.PATH}` };
+      const calls = () => (existsSync(log) ? readFileSync(log, "utf-8").trim().split("\n").filter(Boolean).map((l) => JSON.parse(l) as { args: string[]; tokenSet: boolean }) : []);
+
+      const dryCut = await chant(dir, ["release", "cut", "v1", "--build", BUILD], path);
+      expect(dryCut.code, dryCut.stderr).toBe(0);
+      expect(dryCut.stdout).toContain("chant release publish v1: npm (2 packages) to npm the registry npm's config names");
+      expect(dryCut.stdout).toContain(`chant release publish v1: oci ${reg.host}/acme/api to ${reg.host}/acme/api`);
+      const cut = await chant(dir, ["release", "cut", "v1", "--build", BUILD, "--sign", key, "--yes"], path);
+      expect(cut.code, cut.stderr).toBe(0);
+      expect(cut.stderr).toContain("signed by alice");
+
+      const secrets = { NODE_AUTH_TOKEN: NPM_TOKEN, OCI_USERNAME: "robot", OCI_PASSWORD };
+      const oidc = { GITHUB_ACTIONS: "true", ACTIONS_ID_TOKEN_REQUEST_URL: "https://token.example", ACTIONS_ID_TOKEN_REQUEST_TOKEN: "oidc-request-token-0042" };
+
+      const dry = await chant(dir, ["release", "publish", "v1"], { ...path, ...secrets, ...oidc });
+      expect(dry.code, dry.stderr).toBe(0);
+      expect(dry.stdout).toContain("What would be published where:");
+      expect(dry.stdout).toContain("  npm (2 packages), with --provenance:\n    @acme/core@1.0.0 to the registry npm's config names, dist-tag next, then latest, carrying sbom.spdx.json\n    @acme/cli@1.0.0 to");
+      expect(dry.stdout).toContain(`    image (tag v1) to ${reg.host}/acme/api@${digest}`);
+      expect(dry.stderr).toContain("Dry run: nothing was published. Run again with --yes to publish: chant release publish v1 --yes");
+      expect(calls()).toEqual([]);
+      expect(reg.requests).toEqual([]);
+
+      const pub = await chant(dir, ["release", "publish", "v1", "--yes"], { ...path, ...secrets, ...oidc });
+      expect(pub.code, pub.stderr).toBe(0);
+      expect(pub.stderr).toContain("signed by alice");
+      expect(calls().map((c) => c.args)).toEqual([
+        ["view", "@acme/core@1.0.0", "version"],
+        ["publish", join(dir, "packages/core"), "--tag", "next", "--access", "public", "--provenance"],
+        ["view", "@acme/cli@1.0.0", "version"],
+        ["publish", join(dir, "packages/cli"), "--tag", "next", "--access", "public", "--provenance"],
+        ["dist-tag", "add", "@acme/core@1.0.0", "latest"],
+        ["dist-tag", "add", "@acme/cli@1.0.0", "latest"],
+        // #4049: in CI, what was published is installed in an empty directory and its signatures and attestations audited.
+        ["install", "--ignore-scripts", "--no-audit", "--no-fund"],
+        ["audit", "signatures"],
+      ]);
+      expect(pub.stderr).toContain("2 packages have verified attestations");
+      expect(calls().every((c) => c.tokenSet)).toBe(true);
+      expect(reg.manifests.has(digest)).toBe(true);
+      expect(reg.manifests.has("v1")).toBe(true);
+      expect(pub.stderr).toContain(`published: image (tag v1) to ${reg.host}/acme/api@${digest}`);
+      expect(pub.stderr).toContain("published: @acme/core@1.0.0 to the registry npm's config names, dist-tag latest, carrying sbom.spdx.json");
+      expect(pub.stderr).toMatch(/published: sbom\.spdx\.json \(SBOM\) to .*@sha256:[0-9a-f]{64}, a referrer of the image/);
+      expect(pub.stderr).toMatch(/published: release\.intoto\.json \(provenance\) to .*@sha256:[0-9a-f]{64}, a referrer of the image/);
+      expect(pub.stderr).toContain("Published v1 to 2 target(s)");
+      // The image's referrers: each names the image as its subject, and the provenance statement carries the cut's signature.
+      const referrers = [...reg.manifests.entries()]
+        .filter(([k]) => k.startsWith("sha256:") && k !== digest)
+        .map(([, m]) => JSON.parse(m.bytes.toString("utf-8")) as { artifactType: string; subject: { digest: string }; layers: Array<{ digest: string }> });
+      expect(referrers.map((m) => m.artifactType).sort()).toEqual(["application/spdx+json", "application/vnd.in-toto+json"]);
+      expect(referrers.every((m) => m.subject.digest === digest)).toBe(true);
+      const statement = JSON.parse(reg.blobs.get(referrers.find((m) => m.artifactType === "application/vnd.in-toto+json")!.layers[0]!.digest)!.toString("utf-8"));
+      expect(statement).toMatchObject({
+        _type: "https://in-toto.io/Statement/v1",
+        subject: [{ digest: { sha256: digest.slice(7) } }],
+        predicateType: "https://intentius.io/chant/release/v1",
+        predicate: { label: "v1", cut: { actor: "alice", namespace: "chant-release", signature: expect.stringMatching(/^-----BEGIN SSH SIGNATURE-----/) }, provenance: { kind: "oidc", ci: "github" } },
+      });
+
+      // The release verifies offline against the signers file at its commit.
+      const verified = await chant(dir, ["release", "verify", "v1", "--json"]);
+      expect(verified.code, verified.stderr).toBe(0);
+      expect(JSON.parse(verified.stdout)).toMatchObject({ label: "v1", status: "verified", verifiedBy: { actor: "alice" } });
+
+      // No credential in the output, or anywhere on chant/lifecycle.
+      const lifecycle = git(dir, "log", "-p", "--all");
+      for (const secret of [NPM_TOKEN, OCI_PASSWORD, REGISTRY_TOKEN, "oidc-request-token-0042"]) {
+        for (const text of [dry.stdout, dry.stderr, pub.stdout, pub.stderr, lifecycle]) expect(text).not.toContain(secret);
+      }
+      expect(pub.stderr).toContain("npm notice token [redacted]");
+
+      // From a workstation the publish warns that it carries no provenance, and the plan offers none.
+      const asJson = await chant(dir, ["release", "publish", "v1", "--json"], { ...path, ...secrets });
+      expect(asJson.code, asJson.stderr).toBe(0);
+      expect(asJson.stderr).toContain("this publish runs without OIDC");
+      const doc = JSON.parse(asJson.stdout);
+      expect(doc).toMatchObject({ dryRun: true, label: "v1", provenance: { oidc: false } });
+      expect(doc.targets.map((t: { kind: string }) => t.kind)).toEqual(["npm", "oci"]);
+
+      // A checkout past the release's commit is refused before anything runs.
+      git(dir, "commit", "-q", "--allow-empty", "-m", "later");
+      const moved = await chant(dir, ["release", "publish", "v1", "--yes"], { ...path, ...secrets, ...oidc });
+      expect(moved.code).toBe(1);
+      expect(moved.stderr).toMatch(/\[release-head-mismatch\]/);
+      expect(calls()).toHaveLength(8);
+    },
+    240_000,
+  );
+  test(
+    "a publish that failed at the image is resumed from a fresh clone with the record it pushed, and stages no package again",
+    async () => {
+      const work = join(root, "resume");
+      const remote = join(root, "resume-origin.git");
+      git(root, "init", "-q", "--bare", "-b", "main", remote);
+      git(root, "init", "-q", "-b", "main", work);
+      git(work, "config", "user.email", "t@chant.dev");
+      git(work, "config", "user.name", "T");
+      const publish = [
+        { type: "npm", packages: ["packages/core", "packages/cli"] },
+        { type: "oci", image: "image", repository: `${reg.host}/acme/resume` },
+      ];
+      writeFileSync(join(work, "chant.config.ts"), `export default { environments: ["dev"], release: { publish: ${JSON.stringify(publish)} } };\n`);
+      writeFileSync(
+        join(work, "api.component.ts"),
+        `export const api = { name: "api", dependsOn: [], deploy: [{ phase: "Apply", steps: [{ kind: "cfn-deploy", template: "dist/api.template.json" }] }] };\n`,
+      );
+      writeFileSync(join(work, ".gitignore"), "dist/\n");
+      writePackage(join(work, "packages", "core"), "@acme/rcore", "3.0.0");
+      writePackage(join(work, "packages", "cli"), "@acme/rcli", "3.0.0");
+      writeLockfile(work);
+      const { digest } = writeOciLayout(join(work, "image"), "resume layer");
+      git(work, "add", ".");
+      git(work, "commit", "-q", "-m", "init");
+      git(work, "remote", "add", "origin", remote);
+      git(work, "push", "-q", "origin", "main");
+      git(work, "fetch", "-q", "origin");
+      git(work, "tag", `ci/green/${git(work, "rev-parse", "HEAD")}`);
+
+      const log = join(root, "resume-npm.log");
+      const bin = join(root, "resume-bin");
+      writeFakeNpm(bin, log);
+      const path = { PATH: `${bin}:${process.env.PATH}` };
+      const calls = () => (existsSync(log) ? readFileSync(log, "utf-8").trim().split("\n").filter(Boolean).map((l) => (JSON.parse(l) as { args: string[] }).args) : []);
+      const cut = await chant(work, ["release", "cut", "r3", "--build", BUILD, "--yes"], path);
+      expect(cut.code, cut.stderr).toBe(0);
+
+      // The registry refuses the password: npm staged, the image did not, and no tag moved. These packages
+      // are new, and npm makes a new package's first version latest whatever tag it was published under.
+      const failed = await chant(work, ["release", "publish", "r3", "--allow-unsigned", "--yes"], { ...path, OCI_USERNAME: "robot", OCI_PASSWORD: "wrong-password-0042" });
+      expect(failed.code).toBe(1);
+      expect(failed.stderr).toMatch(/\[publish-oci-failed\]/);
+      expect(failed.stderr).toContain("nothing is visible yet; staged: npm (2 packages)");
+      expect(failed.stderr).toContain("Run the same command again to resume; what went out is not published again: chant release publish r3 --allow-unsigned --yes");
+      expect(failed.stderr).not.toContain("wrong-password-0042");
+      expect(readFakeNpmRegistry(log).packages["@acme/rcore"]!.distTags).toEqual({ next: "3.0.0", latest: "3.0.0" });
+      expect(calls().filter((a) => a[0] === "dist-tag")).toEqual([]);
+      expect([...reg.manifests.keys()].filter((k) => k === "r3")).toEqual([]);
+
+      // A CI job resumes on a fresh clone of the release's commit: the record came with chant/lifecycle.
+      const fresh = join(root, "resume-fresh");
+      git(root, "clone", "-q", remote, fresh);
+      git(fresh, "config", "user.email", "ci@chant.dev");
+      git(fresh, "config", "user.name", "CI");
+      const before = calls().length;
+      const dry = await chant(fresh, ["release", "publish", "r3", "--allow-unsigned"], path);
+      expect(dry.code, dry.stderr).toBe(0);
+      expect(dry.stdout).toContain("npm (2 packages) (staged by an earlier run; only revealed):");
+      const resumed = await chant(fresh, ["release", "publish", "r3", "--allow-unsigned", "--yes", "--json"], { ...path, OCI_USERNAME: "robot", OCI_PASSWORD });
+      expect(resumed.code, resumed.stderr).toBe(0);
+      expect(calls().slice(before)).toEqual([
+        ["dist-tag", "add", "@acme/rcore@3.0.0", "latest"],
+        ["dist-tag", "add", "@acme/rcli@3.0.0", "latest"],
+      ]);
+      expect(reg.manifests.has(digest)).toBe(true);
+      expect(reg.manifests.has("r3")).toBe(true);
+      const doc = JSON.parse(resumed.stdout);
+      expect(doc.resumed).toEqual([{ target: "npm (2 packages)", step: "staged" }]);
+      expect(doc.targets.map((t: { progress: string }) => t.progress)).toEqual(["staged", "none"]);
+      const record = git(fresh, "show", "chant/lifecycle:_releases/publishes.jsonl").split("\n").map((l) => JSON.parse(l) as { kind: string; step: string });
+      expect(record.map((l) => `${l.kind} ${l.step}`)).toEqual(["npm staged", "oci staged", "npm revealed", "oci revealed"]);
+      expect(git(fresh, "log", "-p", "--all")).not.toContain(OCI_PASSWORD);
+    },
+    240_000,
+  );
+});