@intentius/chant 0.124.27 → 0.124.29

package/src/cli/handlers/release-verify.e2e.test.ts

@@ -0,0 +1,117 @@
+/**
+ * `chant release verify` and the publish's signature check, end to end
+ * (#4049), in a temp repo with a temp bare remote and throwaway ssh keys. A
+ * release cut signed with a key `.chant/allowed_signers` lists verifies, and a
+ * publish takes it; an unsigned one and one signed by a key the file does not
+ * list fail `release verify`, and a publish refuses them unless
+ * `--allow-unsigned`. Nothing is published: the member declares no target.
+ */
+
+import { describe, expect, test } from "vitest";
+import { execFileSync, spawnSync } from "node:child_process";
+import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { pathToFileURL } from "node:url";
+import { REPO } from "../../workspace/__fixtures__/contract-repo";
+import { hasSshKeygen } from "../../workspace/trust/test-repo";
+
+const CHANT = [process.execPath, "--import", pathToFileURL(join(REPO, "node_modules", "tsx", "dist", "loader.mjs")).href, join(REPO, "packages", "core", "src", "cli", "main.ts")];
+const CI_VARS = ["CI", "GITHUB_ACTIONS", "GITHUB_RUN_ID", "GITHUB_SHA", "GITHUB_ACTOR", "ACTIONS_ID_TOKEN_REQUEST_URL", "ACTIONS_ID_TOKEN_REQUEST_TOKEN", "GITLAB_CI", "CI_PIPELINE_ID", "GITLAB_USER_LOGIN", "CHANT_ENV"];
+
+function chant(cwd: string, args: string[]): { code: number; stdout: string; stderr: string } {
+  const env: NodeJS.ProcessEnv = { ...process.env, USER: "tester" };
+  for (const k of CI_VARS) delete env[k];
+  const r = spawnSync(CHANT[0]!, [...CHANT.slice(1), ...args], { cwd, encoding: "utf-8", env, timeout: 120_000 });
+  return { code: r.status ?? 1, stdout: r.stdout ?? "", stderr: r.stderr ?? "" };
+}
+
+function git(cwd: string, ...args: string[]): string {
+  const r = spawnSync("git", args, { cwd, encoding: "utf-8" });
+  if (r.status !== 0) throw new Error(r.stderr);
+  return r.stdout.trim();
+}
+
+function key(root: string, name: string): { file: string; pub: string } {
+  const file = join(root, `key-${name}`);
+  execFileSync("ssh-keygen", ["-q", "-t", "ed25519", "-N", "", "-C", name, "-f", file]);
+  return { file, pub: readFileSync(`${file}.pub`, "utf-8").trim().split(" ").slice(0, 2).join(" ") };
+}
+
+const BUILD = `mkdir -p dist && printf '{"env":"%s"}' "$CHANT_ENV" > dist/api.template.json`;
+
+describe("chant release verify", () => {
+  test.skipIf(!hasSshKeygen)(
+    "passes for a signed release, fails for an unsigned one and for one signed by an unlisted key; a publish refuses both unless --allow-unsigned",
+    () => {
+      const root = mkdtempSync(join(tmpdir(), "chant-release-verify-"));
+      try {
+        const alice = key(root, "alice");
+        const mallory = key(root, "mallory");
+        const dir = join(root, "work");
+        const remote = join(root, "origin.git");
+        git(root, "init", "-q", "--bare", "-b", "main", remote);
+        git(root, "init", "-q", "-b", "main", dir);
+        git(dir, "config", "user.email", "t@chant.dev");
+        git(dir, "config", "user.name", "T");
+        writeFileSync(join(dir, "chant.config.ts"), `export default { environments: ["dev"] };\n`);
+        writeFileSync(join(dir, "api.component.ts"), `export const api = { name: "api", dependsOn: [], deploy: [{ phase: "Apply", steps: [{ kind: "cfn-deploy", template: "dist/api.template.json" }] }] };\n`);
+        writeFileSync(join(dir, ".gitignore"), "dist/\n");
+        mkdirSync(join(dir, ".chant"));
+        writeFileSync(join(dir, ".chant", "allowed_signers"), `alice ${alice.pub}\n`);
+        git(dir, "add", ".");
+        git(dir, "commit", "-q", "-m", "init");
+        git(dir, "remote", "add", "origin", remote);
+        // A green commit pushed to trunk, ready to cut.
+        const next = (message?: string) => {
+          if (message) git(dir, "commit", "-q", "--allow-empty", "-m", message);
+          git(dir, "push", "-q", "origin", "main");
+          git(dir, "fetch", "-q", "origin");
+          git(dir, "tag", `ci/green/${git(dir, "rev-parse", "HEAD")}`);
+        };
+        next();
+
+        // v1: signed with alice's key, which the signers file lists.
+        const signed = chant(dir, ["release", "cut", "v1", "--build", BUILD, "--sign", alice.file, "--yes"]);
+        expect(signed.code, signed.stderr).toBe(0);
+        const ok = chant(dir, ["release", "verify", "v1"]);
+        expect(ok.code, ok.stderr).toBe(0);
+        expect(ok.stderr).toMatch(/Verified .*v1.*: signed by alice, checked against \.chant\/allowed_signers at [0-9a-f]{12}/);
+        expect(JSON.parse(chant(dir, ["release", "verify", "v1", "--json"]).stdout)).toMatchObject({ label: "v1", status: "verified", digestMatches: true, verifiedBy: { actor: "alice" } });
+        const pubSigned = chant(dir, ["release", "publish", "v1"]);
+        expect(pubSigned.code, pubSigned.stderr).toBe(0);
+        expect(pubSigned.stderr).toContain("signed by alice");
+
+        // v2: not signed.
+        next("v2");
+        expect(chant(dir, ["release", "cut", "v2", "--build", BUILD, "--yes"]).code).toBe(0);
+        const unsigned = chant(dir, ["release", "verify", "v2"]);
+        expect(unsigned.code).toBe(1);
+        expect(unsigned.stderr).toMatch(/v2.* does not verify: no cut of the release carries a signature \[release-unsigned\]/);
+        expect(JSON.parse(chant(dir, ["release", "verify", "v2", "--json"]).stdout)).toMatchObject({ status: "unsigned", error: { code: "release-unsigned" } });
+        const pubUnsigned = chant(dir, ["release", "publish", "v2"]);
+        expect(pubUnsigned.code).toBe(1);
+        expect(pubUnsigned.stderr).toMatch(/\[release-unsigned\]/);
+        expect(chant(dir, ["release", "publish", "v2", "--allow-unsigned"]).code).toBe(0);
+
+        // v3: signed by mallory, whom the signers file does not list.
+        next("v3");
+        const cut3 = chant(dir, ["release", "cut", "v3", "--build", BUILD, "--sign", mallory.file, "--actor", "mallory", "--yes"]);
+        expect(cut3.code, cut3.stderr).toBe(0);
+        const unlisted = chant(dir, ["release", "verify", "v3"]);
+        expect(unlisted.code).toBe(1);
+        expect(unlisted.stderr).toMatch(/mallory has no key in \.chant\/allowed_signers at [0-9a-f]{12}.*\[release-signature-unverified\]/);
+        const pubUnlisted = chant(dir, ["release", "publish", "v3"]);
+        expect(pubUnlisted.code).toBe(1);
+        expect(pubUnlisted.stderr).toMatch(/\[release-signature-unverified\]/);
+
+        const missing = chant(dir, ["release", "verify", "v9"]);
+        expect(missing.code).toBe(1);
+        expect(missing.stderr).toMatch(/\[release-not-found\]/);
+      } finally {
+        rmSync(root, { recursive: true, force: true });
+      }
+    },
+    240_000,
+  );
+});

package/src/cli/handlers/release-workstation-ci.e2e.test.ts

@@ -0,0 +1,135 @@
+/**
+ * #4027 requirement 3: the same command cuts the same release on a
+ * workstation and in CI. Two clones of one commit, each with its own temp
+ * bare remote, run `chant release cut v1 --yes`, one with a workstation's
+ * environment and one with GitHub Actions'. The records are equivalent:
+ * the release files are byte-identical, and the cut lines differ only in
+ * the run id and its origin, the actor and the timestamp.
+ */
+
+import { describe, test, expect } from "vitest";
+import { spawnSync } from "node:child_process";
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { pathToFileURL } from "node:url";
+import { REPO } from "../../workspace/__fixtures__/contract-repo";
+
+const CHANT = [process.execPath, "--import", pathToFileURL(join(REPO, "node_modules", "tsx", "dist", "loader.mjs")).href, join(REPO, "packages", "core", "src", "cli", "main.ts")];
+
+const CI_VARS = ["CI", "GITHUB_ACTIONS", "GITHUB_RUN_ID", "GITHUB_SHA", "GITHUB_ACTOR", "GITHUB_REPOSITORY", "GITHUB_SERVER_URL", "GITLAB_CI", "CI_PIPELINE_ID", "GITLAB_USER_LOGIN", "CHANT_ENV"];
+
+function chant(cwd: string, args: string[], extra: Record<string, string>): { code: number; stdout: string; stderr: string } {
+  const env: NodeJS.ProcessEnv = { ...process.env };
+  for (const k of CI_VARS) delete env[k];
+  Object.assign(env, extra);
+  const r = spawnSync(CHANT[0], [...CHANT.slice(1), ...args], { cwd, encoding: "utf-8", env, timeout: 120_000 });
+  return { code: r.status ?? 1, stdout: r.stdout ?? "", stderr: r.stderr ?? "" };
+}
+
+function git(cwd: string, ...args: string[]): string {
+  const r = spawnSync("git", args, { cwd, encoding: "utf-8" });
+  if (r.status !== 0) throw new Error(`git ${args.join(" ")}: ${r.stderr}`);
+  return r.stdout.trim();
+}
+
+const BUILD = `mkdir -p dist && printf '{"env":"%s"}' "$CHANT_ENV" > dist/api.template.json`;
+
+/** Every file under `_releases/` on the clone's chant/lifecycle, by path, as bytes. */
+function releaseFiles(dir: string): Map<string, string> {
+  const out = new Map<string, string>();
+  for (const path of git(dir, "ls-tree", "-r", "--name-only", "chant/lifecycle", "_releases").split("\n").filter(Boolean)) {
+    if (path.endsWith("cuts.jsonl")) continue;
+    out.set(path, git(dir, "show", `chant/lifecycle:${path}`));
+  }
+  return out;
+}
+
+describe("a release cut on a workstation and one cut in CI (#4027)", () => {
+  test(
+    "from the same commit produce the same release files, and cut lines that differ only in run id, run origin, actor and timestamp",
+    () => {
+      const root = mkdtempSync(join(tmpdir(), "chant-release-equiv-"));
+      try {
+        const seed = join(root, "seed");
+        git(root, "init", "-q", "-b", "main", seed);
+        git(seed, "config", "user.email", "seed@chant.dev");
+        git(seed, "config", "user.name", "Seed");
+        writeFileSync(join(seed, "chant.config.ts"), `export default { environments: ["dev", "prod"] };\n`);
+        writeFileSync(
+          join(seed, "api.component.ts"),
+          `export const api = { name: "api", dependsOn: [], deploy: [{ phase: "Apply", steps: [{ kind: "cfn-deploy", template: "dist/api.template.json" }] }] };\n`,
+        );
+        writeFileSync(join(seed, ".gitignore"), "dist/\n");
+        git(seed, "add", ".");
+        git(seed, "commit", "-q", "-m", "init");
+        const sha = git(seed, "rev-parse", "HEAD");
+
+        // Each clone pushes to a bare remote of its own, which holds main; the green tag is made locally in each.
+        const clone = (name: string, email: string | null): string => {
+          const dir = join(root, name);
+          git(root, "init", "-q", "--bare", "-b", "main", `${name}.git`);
+          git(root, "clone", "-q", seed, dir);
+          git(dir, "remote", "set-url", "origin", join(root, `${name}.git`));
+          git(dir, "push", "-q", "origin", "main");
+          git(dir, "fetch", "-q", "origin");
+          if (email) git(dir, "config", "user.email", email);
+          git(dir, "tag", `ci/green/${sha}`);
+          return dir;
+        };
+        const laptop = clone("laptop", "alice@example.com");
+        const runner = clone("runner", null);
+
+        const workstation = { USER: "alice" };
+        const ci = {
+          CI: "true",
+          GITHUB_ACTIONS: "true",
+          GITHUB_RUN_ID: "4242",
+          GITHUB_ACTOR: "release-bot",
+          GITHUB_REPOSITORY: "acme/app",
+          GITHUB_SERVER_URL: "https://github.com",
+          GITHUB_SHA: sha,
+          USER: "runner",
+        };
+        const cut = (dir: string, env: Record<string, string>) => {
+          const r = chant(dir, ["release", "cut", "v1", "--build", BUILD, "--yes", "--json"], env);
+          expect(r.code, r.stderr).toBe(0);
+          return JSON.parse(r.stdout);
+        };
+        const a = cut(laptop, workstation);
+        const b = cut(runner, ci);
+
+        // The release is the same object, stored as the same bytes.
+        expect(b.release).toEqual(a.release);
+        const [filesA, filesB] = [releaseFiles(laptop), releaseFiles(runner)];
+        expect([...filesA.keys()].sort()).toEqual([...filesB.keys()].sort());
+        expect(filesA.size).toBeGreaterThan(0);
+        for (const [path, bytes] of filesA) expect(filesB.get(path), path).toBe(bytes);
+
+        // The cut lines, as stored, are equal apart from the run, the actor and the time.
+        const line = (dir: string) => JSON.parse(git(dir, "show", "chant/lifecycle:_releases/cuts.jsonl"));
+        const [la, lb] = [line(laptop), line(runner)];
+        const rest = ({ runId: _r, runOrigin: _o, actor: _a, timestamp: _t, ...others }: Record<string, unknown>) => others;
+        expect(rest(lb)).toEqual(rest(la));
+        expect(Object.keys(la).sort()).toEqual(Object.keys(lb).sort());
+
+        expect(la).toMatchObject({ actor: "alice@example.com", runId: expect.stringMatching(/^local-\d+$/), runOrigin: { forge: "local" }, signature: null });
+        expect(lb).toMatchObject({
+          actor: "release-bot",
+          runId: "4242",
+          runOrigin: { forge: "github", repo: "acme/app", url: "https://github.com/acme/app/actions/runs/4242" },
+          signature: null,
+        });
+
+        // Both tag the commit the same way; the next command differs by where it ran.
+        expect(a.tag).toEqual({ name: "release/v1", created: true });
+        expect(b.tag).toEqual({ name: "release/v1", created: true });
+        expect(a.next[0]).toBe("git push origin release/v1");
+        expect(b.next[0]).toBe("chant release publish v1");
+      } finally {
+        rmSync(root, { recursive: true, force: true });
+      }
+    },
+    240_000,
+  );
+});

package/src/cli/handlers/release.e2e.test.ts

@@ -0,0 +1,199 @@
+/**
+ * `chant release cut`, `publish` and `list` end to end (#4026, #4027): the cut
+ * compiles each environment in a child chant with CHANT_ENV set, in a temp
+ * repo with a temp bare remote, and the list prints the read contract's
+ * `releases` document. No cloud is touched: the fixture's deploy is never
+ * run, no tag is pushed, and nothing is published: this member declares no
+ * publish target (release-publish-targets.e2e.test.ts publishes to stand-ins).
+ */
+
+import { describe, test, expect } from "vitest";
+import { spawnSync } from "node:child_process";
+import { mkdtempSync, rmSync, unlinkSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { pathToFileURL } from "node:url";
+import { contract, REPO } from "../../workspace/__fixtures__/contract-repo";
+import releasesSchema from "../../workspace/releases.schema.json";
+import { contentDigest } from "../../content-digest";
+import { sameWithYes } from "./release";
+
+const CHANT = [process.execPath, "--import", pathToFileURL(join(REPO, "node_modules", "tsx", "dist", "loader.mjs")).href, join(REPO, "packages", "core", "src", "cli", "main.ts")];
+
+/** The CI variables a run in this suite may inherit, removed so the cut reads as a workstation's unless a test sets them. */
+const CI_VARS = [
+  "CI",
+  "GITHUB_ACTIONS",
+  "GITHUB_RUN_ID",
+  "GITHUB_SHA",
+  "GITHUB_ACTOR",
+  "GITHUB_REPOSITORY",
+  "GITHUB_SERVER_URL",
+  "ACTIONS_ID_TOKEN_REQUEST_URL",
+  "ACTIONS_ID_TOKEN_REQUEST_TOKEN",
+  "GITLAB_CI",
+  "CI_PIPELINE_ID",
+  "GITLAB_USER_LOGIN",
+  "CHANT_ENV",
+];
+
+function chant(cwd: string, args: string[], extra: Record<string, string> = {}): { code: number; stdout: string; stderr: string } {
+  const env: NodeJS.ProcessEnv = { ...process.env, USER: "tester" };
+  for (const k of CI_VARS) delete env[k];
+  Object.assign(env, extra);
+  const r = spawnSync(CHANT[0], [...CHANT.slice(1), ...args], { cwd, encoding: "utf-8", env, timeout: 120_000 });
+  return { code: r.status ?? 1, stdout: r.stdout ?? "", stderr: r.stderr ?? "" };
+}
+
+function git(cwd: string, ...args: string[]): string {
+  const r = spawnSync("git", args, { cwd, encoding: "utf-8" });
+  if (r.status !== 0) throw new Error(r.stderr);
+  return r.stdout.trim();
+}
+
+const BUILD = `mkdir -p dist && printf '{"env":"%s"}' "$CHANT_ENV" > dist/api.template.json`;
+
+/** A member at `<root>/work` with one commit on main pushed to `<root>/origin.git`. */
+function project(root: string): { dir: string; sha: string; remote: string } {
+  const dir = join(root, "work");
+  const remote = join(root, "origin.git");
+  git(root, "init", "-q", "--bare", "-b", "main", remote);
+  git(root, "init", "-q", "-b", "main", dir);
+  git(dir, "config", "user.email", "t@chant.dev");
+  git(dir, "config", "user.name", "T");
+  writeFileSync(join(dir, "chant.config.ts"), `export default { environments: ["dev", "prod", "pr-*"] };\n`);
+  writeFileSync(
+    join(dir, "api.component.ts"),
+    `export const api = { name: "api", dependsOn: [], deploy: [{ phase: "Apply", steps: [{ kind: "cfn-deploy", template: "dist/api.template.json" }] }] };\n`,
+  );
+  writeFileSync(join(dir, ".gitignore"), "dist/\n");
+  git(dir, "add", ".");
+  git(dir, "commit", "-q", "-m", "init");
+  git(dir, "remote", "add", "origin", remote);
+  git(dir, "push", "-q", "origin", "main");
+  git(dir, "fetch", "-q", "origin");
+  return { dir, sha: git(dir, "rev-parse", "HEAD"), remote };
+}
+
+const hasRef = (dir: string, ref: string) => spawnSync("git", ["rev-parse", "--verify", "--quiet", ref], { cwd: dir }).status === 0;
+
+describe("chant release cut, publish and list", () => {
+  test(
+    "refuses a dirty tree, a commit not on trunk or not pushed, and one that isn't green; a dry run writes nothing; --yes cuts, tags and names the next command",
+    () => {
+      const root = mkdtempSync(join(tmpdir(), "chant-release-cut-"));
+      try {
+        const { dir, sha, remote } = project(root);
+        const cut = (...extra: string[]) => chant(dir, ["release", "cut", "v1", "--build", BUILD, ...extra]);
+
+        writeFileSync(join(dir, "extra.component.ts"), "export const extra = {};\n");
+        expect(cut().stderr).toMatch(/1 untracked file\(s\) such as extra\.component\.ts.*\[release-worktree-dirty\]/);
+        unlinkSync(join(dir, "extra.component.ts"));
+        writeFileSync(join(dir, "chant.config.ts"), `export default { environments: ["dev"] };\n`);
+        expect(cut().stderr).toMatch(/1 tracked file\(s\) with uncommitted changes.*\[release-worktree-dirty\]/);
+        git(dir, "checkout", "--", "chant.config.ts");
+
+        git(dir, "checkout", "-q", "-b", "feature");
+        git(dir, "commit", "-q", "--allow-empty", "-m", "feature");
+        expect(cut().stderr).toMatch(/is not on origin\/main.*\[release-commit-not-on-trunk\]/);
+        git(dir, "checkout", "-q", "main");
+        git(dir, "commit", "-q", "--allow-empty", "-m", "unpushed");
+        expect(cut().stderr).toMatch(/is on main( \(the branch origin\/HEAD names\))? but not on origin\/main, so it has not been pushed \[release-commit-not-pushed\]/);
+        git(dir, "reset", "-q", "--hard", sha);
+
+        const refused = cut();
+        expect(refused.code).toBe(1);
+        expect(refused.stderr).toMatch(/has no ci\/green tag.*\[release-commit-not-green\]/);
+        git(dir, "tag", `ci/green/${sha}`);
+
+        // A dry run by default: it compiles and prints the plan, and writes no ledger and no tag.
+        const dry = cut();
+        expect(dry.code, dry.stderr).toBe(0);
+        expect(dry.stdout).toMatch(/^Dry run: cut .*v1.* from commit [0-9a-f]{12} \(on origin\/main, green\)/m);
+        expect(dry.stdout).toContain("  actor t@chant.dev (from git user.email)");
+        expect(dry.stdout).toContain("  tag release/v1, made here and not pushed");
+        expect(dry.stdout).toContain("  dev: 1 template(s)");
+        expect(dry.stdout).toContain("chant release publish v1: nothing, since this member declares no publish target (release.publish in chant.config.ts)");
+        expect(dry.stderr).toContain(`Dry run: nothing was cut, signed or tagged. Run again with --yes to cut: ${sameWithYes(["release", "cut", "v1", "--build", BUILD])}`);
+        const dryJson = JSON.parse(cut("--json").stdout);
+        expect(dryJson).toMatchObject({ dryRun: true, label: "v1", commit: sha, actor: "t@chant.dev", actorSource: "git", tag: { name: "release/v1", exists: false }, build: [] });
+        expect(dryJson.releaseDigest).toMatch(/^jcs1-sha256:/);
+        expect(hasRef(dir, "refs/heads/chant/lifecycle")).toBe(false);
+        expect(hasRef(dir, "refs/tags/release/v1")).toBe(false);
+
+        const done = cut("--yes", "--json");
+        expect(done.code, done.stderr).toBe(0);
+        const result = JSON.parse(done.stdout);
+        expect(result).toMatchObject({ dryRun: false, label: "v1", actor: "t@chant.dev", actorSource: "git", tag: { name: "release/v1", created: true } });
+        expect(result.release.releaseDigest).toBe(dryJson.releaseDigest);
+        expect(result.release.commit).toBe(sha);
+        expect(result.release.targets).toEqual([
+          { env: "dev", params: [], templates: [{ component: "api", path: "dist/api.template.json", digest: contentDigest(`{"env":"dev"}`) }] },
+          { env: "prod", params: [], templates: [{ component: "api", path: "dist/api.template.json", digest: contentDigest(`{"env":"prod"}`) }] },
+        ]);
+        expect(result.cut).toMatchObject({ actor: "t@chant.dev", runId: expect.stringMatching(/^local-\d+$/), runOrigin: { forge: "local" }, signature: null });
+        expect(result.next).toEqual(["git push origin release/v1", "chant release publish v1", "chant components promote --release v1 --to dev"]);
+        expect(git(dir, "rev-parse", "release/v1^{commit}")).toBe(sha);
+        // chant pushes its ledger branch to the remote, and never a tag.
+        expect(git(root, "ls-remote", "--tags", remote)).toBe("");
+
+        const again = chant(dir, ["release", "cut", "--build", BUILD, "--yes"]);
+        expect(again.code, again.stderr).toBe(0);
+        expect(again.stderr).toContain("Already cut as");
+        expect(again.stderr).toContain("tag release/v1 (already there), not pushed");
+        expect(again.stderr).toContain("Next: git push origin release/v1");
+
+        const list = chant(dir, ["release", "list", "--json"]);
+        expect(list.code, list.stderr).toBe(0);
+        const doc = JSON.parse(list.stdout);
+        contract(releasesSchema).expectValid(doc);
+        expect(doc.releases).toHaveLength(1);
+        expect(doc.releases[0]).toMatchObject({ releaseDigest: result.release.releaseDigest, label: "v1", environments: [] });
+        expect(doc.releases[0].cuts[0]).toMatchObject({ runId: result.cut.runId, runOrigin: { forge: "local" } });
+
+        // #4049: the cut is not signed, so a publish refuses it unless --allow-unsigned.
+        const unsignedPub = chant(dir, ["release", "publish", "v1"]);
+        expect(unsignedPub.code).toBe(1);
+        expect(unsignedPub.stderr).toMatch(/v1 has no signed cut.*\[release-unsigned\]/);
+        expect(unsignedPub.stderr).toContain("pass --allow-unsigned");
+
+        // A publish is a dry run without --yes, as a cut is.
+        const dryPub = chant(dir, ["release", "publish", "v1", "--allow-unsigned"]);
+        expect(dryPub.code, dryPub.stderr).toBe(0);
+        expect(dryPub.stderr).toContain("v1 has no signed cut; publishing it anyway under --allow-unsigned");
+        expect(dryPub.stdout).toContain("What would be published where:\n  nothing: this member declares no publish target (release.publish in chant.config.ts)");
+        expect(dryPub.stderr).toContain("Dry run: nothing was published. Run again with --yes to publish: chant release publish v1 --allow-unsigned --yes");
+
+        // Publish from the workstation: the warning comes before anything else is said about publishing.
+        const pub = chant(dir, ["release", "publish", "v1", "--allow-unsigned", "--yes"]);
+        expect(pub.code, pub.stderr).toBe(0);
+        const warning = pub.stderr.indexOf("this publish runs without OIDC, so what it publishes carries no provenance");
+        const nothing = pub.stderr.indexOf("Nothing was published: this member declares no publish target (release.publish in chant.config.ts).");
+        expect(warning).toBeGreaterThan(-1);
+        expect(nothing).toBeGreaterThan(warning);
+        expect(pub.stderr).toContain("chant components promote --release v1 --to dev");
+
+        // In GitHub Actions with id-token: write there is no warning.
+        const oidc = { GITHUB_ACTIONS: "true", ACTIONS_ID_TOKEN_REQUEST_URL: "https://token.example", ACTIONS_ID_TOKEN_REQUEST_TOKEN: "t" };
+        const fromCi = chant(dir, ["release", "publish", "v1", "--allow-unsigned", "--json"], oidc);
+        expect(fromCi.code, fromCi.stderr).toBe(0);
+        expect(fromCi.stderr).not.toContain("without OIDC");
+        expect(JSON.parse(fromCi.stdout)).toMatchObject({
+          dryRun: true,
+          label: "v1",
+          provenance: { oidc: true, ci: "github" },
+          warnings: ["v1 has no signed cut; publishing it anyway under --allow-unsigned, so chant release verify v1 will fail for it"],
+          targets: [],
+          published: [],
+        });
+
+        const unknown = chant(dir, ["release", "publish", "v9"]);
+        expect(unknown.code).toBe(1);
+        expect(unknown.stderr).toMatch(/\[release-not-found\]/);
+      } finally {
+        rmSync(root, { recursive: true, force: true });
+      }
+    },
+    240_000,
+  );
+});