@intentius/chant 0.124.29 → 0.124.31

package/src/cli/parse-args.ts

@@ -42,6 +42,7 @@ const BOOLEAN_FLAGS = new Set([
   "--composites",
   "--stacks",
   "--components",
+  "--pr-build",
   "--up",
   "--down",
   "--include-dependents",
@@ -64,6 +65,10 @@ const BOOLEAN_FLAGS = new Set([
   "--yes",
   "--confirm-prod",
   "--once",
+  "--rerun-failed",
+  "--setup-key",
+  "--trust",
+  "--unsigned",
   "--expire",
   "--check-live",
   "--check-snapshot",
@@ -386,6 +391,13 @@ export function parseArgs(args: string[]): ParsedArgs {
       const url = args[++i];
       if (!url || url.startsWith("-")) throw new Error("--report-url needs a URL: --report-url s3://<bucket>/<prefix> or file://<directory>");
       result.reportUrl = url;
+    } else if (arg === "--no-status") {
+      // `chant ci run|serve --no-status` (#4097): post no commit status for the job.
+      result.noStatus = true;
+    } else if (arg === "--status-url") {
+      // `chant ci run|serve --status-url <template>` (#4097): the link a job's status carries, in place of an https --report-url.
+      result.statusUrl = args[++i];
+      if (!result.statusUrl || result.statusUrl.startsWith("-")) throw new Error("--status-url needs a URL template: --status-url https://host/reports/{key}");
     } else if (arg === "--allow-unsigned") {
       // `chant release publish --allow-unsigned` (#4049).
       result.allowUnsigned = true;
@@ -394,6 +406,13 @@ export function parseArgs(args: string[]): ParsedArgs {
       result.requireProvenance = true;
     } else if (arg === "--pr-loop") {
       result.prLoop = true;
+    } else if (arg === "--pr-build") {
+      // `chant build --pr-loop --pr-build` (#4088), and `chant ci run --pr-build` (#4094).
+      result.prBuild = true;
+    } else if (arg === "--pr-build-command") {
+      const line = args[++i];
+      if (line === undefined || line === "") throw new Error("--pr-build-command needs a shell line: --pr-build-command '<line>'");
+      result.prBuildCommand = line;
     } else if (arg === "--before-script") {
       const line = args[++i];
       if (line === undefined || line === "") throw new Error("--before-script needs a shell line: --before-script '<line>'");
@@ -518,6 +537,41 @@ export function parseArgs(args: string[]): ParsedArgs {
       // `chant ci workflow --chant <command>` (#3573): what the tick step runs chant with.
       result.ciChant = args[++i];
       if (!result.ciChant || result.ciChant.startsWith("-")) throw new Error("--chant needs the command that runs chant, such as \"npx tsx packages/core/src/cli/main.ts\": --chant <command>");
+    } else if (arg === "--commit") {
+      // `chant ci run plan|apply --commit <sha>` (#4094): the commit the job runs at.
+      result.commit = args[++i];
+      if (!result.commit || result.commit.startsWith("-")) throw new Error("--commit needs the commit the job runs at: --commit <sha>");
+    } else if (arg === "--pass-env") {
+      // `chant ci run --pass-env <NAME>`, repeatable (#4094): a variable of the runner's environment the job gets.
+      const name = args[++i];
+      if (!name || name.startsWith("-")) throw new Error("--pass-env needs a variable's name, such as AWS_PROFILE: --pass-env <NAME>");
+      (result.passEnv ??= []).push(name);
+    } else if (arg === "--secrets") {
+      // `chant ci run|serve --secrets <file>` (#4096): the host's secrets file, readable only by its owner.
+      result.ciSecrets = args[++i];
+      if (!result.ciSecrets || result.ciSecrets.startsWith("-")) throw new Error("--secrets needs the host's secrets file, a dotenv or JSON file only its owner can read: --secrets <file>");
+    } else if (arg === "--repo") {
+      // `chant ci serve --repo <owner/repo>` (#4095): the repository whose pull requests and target branch it polls.
+      result.ciRepo = args[++i];
+      if (!result.ciRepo || !/^[^/\s-][^/\s]*\/[^/\s]+$/.test(result.ciRepo)) throw new Error("--repo needs the repository as owner/name: --repo <owner/repo>");
+    } else if (arg === "--run-index-limit") {
+      // `chant ci run --run-index-limit <n>` (#4098): how many runs the index at the report URL keeps.
+      const n = Number(args[++i]);
+      if (!Number.isInteger(n) || n < 1) throw new Error("--run-index-limit needs a whole number of runs, 1 or more: --run-index-limit <n>");
+      result.runIndexLimit = n;
+    } else if (arg === "--max-jobs") {
+      // `chant ci serve --max-jobs <n>` (#4095): how many jobs run at once.
+      const n = Number(args[++i]);
+      if (!Number.isInteger(n) || n < 1) throw new Error("--max-jobs needs a whole number of jobs, 1 or more: --max-jobs <n>");
+      result.maxJobs = n;
+    } else if (arg === "--author") {
+      // `chant ci serve --author <login>`, repeatable (#4095): plan only pull requests these people opened.
+      const login = args[++i];
+      if (!login || login.startsWith("-")) throw new Error("--author needs a forge login: --author <login>");
+      (result.ciAuthors ??= []).push(login);
+    } else if (arg === "--rerun-failed") {
+      // `chant ci serve --rerun-failed` (#4095): run again the failed apply at the target branch's head, and failed plans of open heads.
+      result.rerunFailed = true;
     } else if (arg === "--install") {
       // `chant ci workflow --install <command>` (#3573): a step before the tick that installs what --chant runs.
       result.ciInstall = args[++i];
@@ -541,6 +595,10 @@ export function parseArgs(args: string[]): ParsedArgs {
       // `chant workspace records review <id> --verdict agree|dissent|abstain` (#2670)
       result.verdict = args[++i];
       if (!result.verdict || result.verdict.startsWith("-")) throw new Error("--verdict needs agree, dissent or abstain");
+    } else if (arg === "--class") {
+      // `chant workspace trust runner add <principal> --class runner|service` (#3510).
+      result.runnerClass = args[++i];
+      if (!result.runnerClass || result.runnerClass.startsWith("-")) throw new Error("--class needs runner or service: --class <class>");
     } else if (arg === "--by") {
       // `chant workspace records review <id> --by <principal>` (#2670): whoever the caller says.
       result.by = args[++i];
@@ -713,6 +771,19 @@ export function parseArgs(args: string[]): ParsedArgs {
       }
     } else if (arg === "--once") {
       result.once = true;
+    } else if (arg === "--setup-key") {
+      // `chant ci serve|run --setup-key` (#4099): make the host's runner key and print its public half.
+      result.setupKey = true;
+    } else if (arg === "--trust") {
+      // `chant ci serve|run --setup-key --trust` (#4099): list the key in .chant/trust.json on a branch.
+      result.trustKey = true;
+    } else if (arg === "--unsigned") {
+      // `chant ci serve --unsigned` (#4099): serve without a runner key listed at the target's head.
+      result.unsigned = true;
+    } else if (arg === "--principal") {
+      // `chant ci serve|run --setup-key --trust --principal <name>` (#4099): the runner's principal.
+      result.ciPrincipal = args[++i];
+      if (!result.ciPrincipal || result.ciPrincipal.startsWith("-")) throw new Error("--principal needs the runner's principal: --principal <name>");
     } else if (arg === "--work") {
       // `chant run <op> --work <id>` (#2748)
       const value = args[++i];

package/src/cli/registry.ts

@@ -326,6 +326,10 @@ export interface ParsedArgs {
    * merge bound to the approved digest.
    */
   prLoop?: boolean;
+  /** `chant build --pr-loop --pr-build` (#4088) — build and lint before pr-plan and pr-apply. */
+  prBuild?: boolean;
+  /** `chant build --pr-loop --pr-build-command <line>` (#4088) — the build line to run in place of `chant build --env <env>`. */
+  prBuildCommand?: string;
   /**
    * `chant components fan-out --resume <file>` (#2420) — the attempt record
    * this fan-out reads before it starts and writes when it finishes. Repeating
@@ -454,8 +458,28 @@ export interface ParsedArgs {
   branch?: string;
   /** `chant ci workflow --workflow <name>`, repeatable (#3573): a workflow whose completion triggers a tick, beside those the scan finds. */
   ciWorkflows?: string[];
-  /** `chant ci workflow --chant <command>` (#3573): the command the tick step runs chant with, in place of the npx pin. */
+  /** `chant ci run plan|apply --commit <sha>` (#4094): the commit the job runs at. Default `HEAD`. */
+  commit?: string;
+  /** `chant ci run --pass-env <NAME>`, repeatable (#4094): a variable of the runner's environment the job gets, beside the few it always gets. */
+  passEnv?: string[];
+  /** `chant ci run|serve --secrets <file>` (#4096): the host's secrets file. Default the file `CHANT_CI_SECRETS` names. */
+  ciSecrets?: string;
+  /** `chant ci workflow --chant <command>` (#3573): the command the tick step runs chant with, in place of the npx pin. Also `chant ci run --chant` (#4094): what runs chant in the job. */
   ciChant?: string;
+  /** `chant ci run|serve --no-status` (#4097): post no commit status for the job. */
+  noStatus?: boolean;
+  /** `chant ci run|serve --status-url <template>` (#4097): the link a job's status carries. `{key}` is `<pr>/<commit>[/<member>]`, as `--report-url` keys it. */
+  statusUrl?: string;
+  /** `chant ci run --run-index-limit <n>` (#4098): how many runs the index at the report URL keeps. Default 200. */
+  runIndexLimit?: number;
+  /** `chant ci serve --repo <owner/repo>` (#4095): the repository it polls. */
+  ciRepo?: string;
+  /** `chant ci serve --max-jobs <n>` (#4095): how many jobs run at once. Default 1. */
+  maxJobs?: number;
+  /** `chant ci serve --author <login>`, repeatable (#4095): plan only pull requests these logins opened. */
+  ciAuthors?: string[];
+  /** `chant ci serve --rerun-failed` (#4095): run again the failed apply at the target's head and failed plans of open heads. */
+  rerunFailed?: boolean;
   /** `chant ci workflow --install <command>` (#3573): a step before the tick that installs what `--chant` runs. */
   ciInstall?: string;
   /** `chant ci workflow --token-secret <NAME>` (#3573): the repository secret the tick's tag push authenticates with. */
@@ -474,6 +498,16 @@ export interface ParsedArgs {
    * `records-write.ts`.
    */
   by?: string;
+  /** `chant ci serve|run --setup-key` (#4099): make the host's runner key in the state directory and print its public half. */
+  setupKey?: boolean;
+  /** `chant ci serve|run --setup-key --trust` (#4099): list the runner key in .chant/trust.json on a branch pushed for review. */
+  trustKey?: boolean;
+  /** `chant ci serve --unsigned` (#4099): start without a runner key listed in .chant/trust.json at the target's head. */
+  unsigned?: boolean;
+  /** `chant ci serve|run --setup-key --trust --principal <name>` (#4099): the principal the runner key is listed for. */
+  ciPrincipal?: string;
+  /** `chant workspace trust runner add <principal> --class runner|service` (#3510): the runner entry's class. */
+  runnerClass?: string;
   /**
    * `chant workspace records review <id> --sign [<key file>]` (#2687): the key that seals the verdict, or true for git's user.signingkey.
    * On `records new` and `records amend`, the key that seals the record's author (#2688).

package/src/components/pr-pipeline.ts

@@ -36,6 +36,12 @@
  * the change set and the events where a reader outside CI can fetch them;
  * the job's own environment brings the credentials an `s3://` URL needs.
  *
+ * With `build` (#4088) both jobs run the project's build and `chant lint`
+ * before their command, and fail on an error. A `cfn-deploy` member's plan
+ * and apply read the built template, so a project with one needs it. The
+ * build is `chant build --env <env>`, or `buildCommand` when the templates
+ * come from several builds (`npm run build`).
+ *
  * In a workspace member (#3465) both commands run in the member's directory
  * and pass `--member <name>`, so the member's gate (`pr-<number>-<member>`),
  * note and statuses stay apart from every other member's on the same pull
@@ -105,6 +111,20 @@ export interface PrLoopPipelineOptions {
    * such as `$CHANT_REPORT_URL`.
    */
   reportUrl?: string;
+  /**
+   * Build and lint before `pr-plan` and before `pr-apply` (#4088): the build
+   * line, then `chant lint`, each failing the job on an error. A `cfn-deploy`
+   * member reads the built template, so a project with one sets this. The
+   * build line is `chant build --env <env>` unless `buildCommand` names
+   * another. Default false.
+   */
+  build?: boolean;
+  /**
+   * The shell line that builds the project in place of `chant build --env
+   * <env>`, for a project whose templates come from several builds, such as
+   * `npm run build`. Setting it turns `build` on.
+   */
+  buildCommand?: string;
   /**
    * Which GitHub-shaped forge the workflow is for. Set by the forgejo
    * generator, which reuses the github one; a caller never needs to.
@@ -126,6 +146,14 @@ export interface PrLoopJob {
   env: Record<string, string>;
   /** Shell lines to run before the command, to settle values the forge may leave unusable. */
   setup?: string[];
+  /** With `build` (#4088): the build line and the lint line, run in this order before the command. */
+  build?: string[];
+}
+
+/** The lines `build` (#4088) runs before a job's command: the build, then the lint. Empty without the option. */
+export function prLoopBuildLines(env: string, options: PrLoopPipelineOptions = {}): string[] {
+  if (!options.build && !options.buildCommand) return [];
+  return [options.buildCommand ?? `chant build --env ${env}`, "chant lint"];
 }
 
 /**
@@ -142,6 +170,8 @@ export function prLoopJobs(forge: ForgeKind, env: string, options: PrLoopPipelin
     ...(options.reportUrl ? ["--report-url", JSON.stringify(options.reportUrl)] : []),
   ];
   const github = forge !== "gitlab";
+  const buildLines = prLoopBuildLines(env, options);
+  const build = buildLines.length > 0 ? { build: buildLines } : {};
   const jobEnv: Record<string, string> = {
     ...(github ? { GITHUB_TOKEN: GITHUB_JOB_TOKEN } : {}),
     ...(options.events ? { CHANT_RUN_EVENTS_DIR: PR_LOOP_EVENTS_DIR } : {}),
@@ -153,6 +183,7 @@ export function prLoopJobs(forge: ForgeKind, env: string, options: PrLoopPipelin
       env: github
         ? { BASE_SHA: "${{ github.event.pull_request.base.sha }}", PR_NUMBER: "${{ github.event.pull_request.number }}", ...jobEnv }
         : { BASE_SHA: "$CI_MERGE_REQUEST_DIFF_BASE_SHA", PR_NUMBER: "$CI_MERGE_REQUEST_IID", ...jobEnv },
+      ...build,
     },
     {
       jobName: "apply",
@@ -163,6 +194,7 @@ export function prLoopJobs(forge: ForgeKind, env: string, options: PrLoopPipelin
       ].join(" "),
       env: github ? { BASE_SHA: "${{ github.event.before }}", ...jobEnv } : { BASE_SHA: "$CI_COMMIT_BEFORE_SHA", ...jobEnv },
       ...(github ? {} : { setup: [gitlabBaseFallback(options.branch)] }),
+      ...build,
     },
   ];
 }

package/src/components/pr-run.test.ts

@@ -60,6 +60,8 @@ function world() {
     planned: [] as Array<{ root: string; vars?: Record<string, unknown> }>,
     outputsRead: [] as string[],
     applied: [] as string[],
+    /** The vars each root applied with, after wiring resolved. */
+    ranWith: {} as Record<string, Record<string, unknown> | undefined>,
     fromPlan: {} as Record<string, boolean>,
     failing: new Set<string>(),
     planFailing: new Set<string>(),
@@ -100,6 +102,7 @@ function world() {
     },
     async run(ctx: DeployContext, input: RootInput) {
       w.fromPlan[input.root] = ctx.plans?.[input.root] !== undefined;
+      w.ranWith[input.root] = input.vars;
       if (w.failing.has(input.root)) throw new Error(`${input.root} failed`);
       w.applied.push(input.root);
       if (input.root === "a") w.state.a = { id: `a-${w.versions.a ?? "v1"}` };
@@ -166,6 +169,130 @@ describe("planPrSet", () => {
   });
 });
 
+describe("a dependency outside the selection (#4104)", () => {
+  /** Two members: `up`, and `down` reading its `id`. The pull request changes `down` alone. */
+  const PAIR: DriverComponent[] = [root("up"), root("down", ["up"], { upstream: { stackOutput: { stack: "up", name: "id" } } })];
+
+  function pairWorld() {
+    const w = world();
+    w.state = { up: { id: "up-live", arn: "arn:up" } };
+    w.versions.down = "v2";
+    return w;
+  }
+
+  test("the dependent's plan resolves the upstream's outputs from its deployed outputs, and the report lists them", async () => {
+    const w = pairWorld();
+    const plan = planFanOut({ components: PAIR, changed: ["down"] });
+    expect(plan.order).toEqual(["down"]);
+    expect(plan.seeds).toEqual(["up"]);
+
+    const set = await planPrSet({ components: PAIR, plan, registry: w.registry, env: "prod" });
+    expect(w.outputsRead).toEqual(["up"]);
+    expect(w.planned).toEqual([{ root: "down", vars: { upstream: "up-live" } }]);
+    expect(set.outputs).toEqual({ up: { id: "up-live", arn: "arn:up" } });
+    expect(set.deployedOutputs).toEqual({ up: ["arn", "id"] });
+
+    const report = prReport({
+      stage: "plan",
+      pr: 12,
+      env: "prod",
+      base: "1".repeat(40),
+      head: "2".repeat(40),
+      op: "pr-12",
+      gate: "pr-apply",
+      plan,
+      signal: { changed: ["down"], indeterminate: [], unclaimed: [] },
+      set,
+      approval: { status: "pending" },
+      status: "planned",
+    });
+    expect(report.deployedOutputs).toEqual({ up: ["arn", "id"] });
+    expect(report.selection).toMatchObject({ changed: ["down"], dependents: [] });
+  });
+
+  test("the apply's plan reads the same outputs, gets the approved digest, and applies against them", async () => {
+    const w = pairWorld();
+    const plan = planFanOut({ components: PAIR, changed: ["down"] });
+    const approved = await planPrSet({ components: PAIR, plan, registry: w.registry, env: "prod" });
+
+    // pr-apply plans the members again before anything applies.
+    w.outputsRead.length = 0;
+    const set = await planPrSet({ components: PAIR, plan, registry: w.registry, env: "prod" });
+    expect(w.outputsRead).toEqual(["up"]);
+    expect(set.doc.digest).toBe(approved.doc.digest);
+    const check = await decidePrGate(memoryGateLedgerPort({ resolutions: [approval(approved.doc.digest)] }), {
+      op: "pr-12",
+      gate: "pr-apply",
+      digest: set.doc.digest,
+      now: NOW,
+    });
+    expect(check.satisfied).toBe(true);
+
+    const { members, status } = await applyPrSet({ components: PAIR, plan, registry: w.registry, env: "prod", set });
+    expect(status).toBe("applied");
+    expect(w.applied).toEqual(["down"]);
+    expect(w.ranWith.down).toEqual({ upstream: "up-live" });
+    expect(members.map((m) => [m.member, m.status, m.inputsMoved])).toEqual([["down", "applied", undefined]]);
+  });
+
+  test("an upstream whose deployed output moved after approval moves the apply's digest", async () => {
+    const w = pairWorld();
+    const plan = planFanOut({ components: PAIR, changed: ["down"] });
+    const approved = await planPrSet({ components: PAIR, plan, registry: w.registry, env: "prod" });
+    w.state.up = { id: "up-moved", arn: "arn:up" };
+    const set = await planPrSet({ components: PAIR, plan, registry: w.registry, env: "prod" });
+    expect(set.doc.digest).not.toBe(approved.doc.digest);
+  });
+
+  test("--seed-outputs wins: a seeded upstream is not read and not listed", async () => {
+    const w = pairWorld();
+    const plan = planFanOut({ components: PAIR, changed: ["down"] });
+    const set = await planPrSet({ components: PAIR, plan, registry: w.registry, env: "prod", seededOutputs: { up: { id: "up-seeded" } } });
+    expect(w.outputsRead).toEqual([]);
+    expect(w.planned).toEqual([{ root: "down", vars: { upstream: "up-seeded" } }]);
+    expect(set.deployedOutputs).toBeUndefined();
+  });
+
+  test("an upstream whose steps cannot say leaves the reference unresolved", async () => {
+    const w = pairWorld();
+    const silent: DriverComponent[] = [
+      { name: "up", dependsOn: [], deploy: [{ phase: "Apply", steps: [{ kind: "no-outputs" }] }] },
+      PAIR[1]!,
+    ];
+    w.registry.register({ kind: "no-outputs", async run() { return {}; } } as never);
+    const plan = planFanOut({ components: silent, changed: ["down"] });
+    const set = await planPrSet({ components: silent, plan, registry: w.registry, env: "prod" });
+    expect(w.outputsRead).toEqual([]);
+    expect(set.outputs).toEqual({});
+    expect(set.deployedOutputs).toBeUndefined();
+    expect(w.planned).toHaveLength(1);
+    expect(w.planned[0]!.vars?.upstream).not.toBe("up-live");
+  });
+
+  test("the selection in place of the whole graph is refused, naming the dependency", async () => {
+    const w = pairWorld();
+    const plan = planFanOut({ components: PAIR, changed: ["down"] });
+    await expect(planPrSet({ components: [PAIR[1]!], plan, registry: w.registry, env: "prod" })).rejects.toThrow(/up, a dependency of a planned member/);
+  });
+
+  test("a resume plans against the record's outputs and reads no dependency they cover", async () => {
+    const w = world();
+    w.versions.a = "v2";
+    const plan = planFanOut({ components: ESTATE, changed: ["a"] });
+    const { set, first, record } = await firstAttempt(w, plan, ["app"]);
+    expect(first.run.completed).toEqual(["a"]);
+    expect(set.deployedOutputs).toEqual({ a: ["id"], net: ["cidr"] });
+
+    w.outputsRead.length = 0;
+    w.state.net = { cidr: "10.9.0.0/16" };
+    const resumed = await resumePrSet({ components: ESTATE, plan, registry: w.registry, env: "prod", record, completed: ["a"] });
+    if (!resumed.ok) throw new Error(resumed.reasons.join("; "));
+    expect(w.outputsRead).toEqual([]);
+    expect(resumed.set.doc.digest).toBe(set.doc.digest);
+    expect(resumed.set.outputs).toBe(record.planOutputs);
+  });
+});
+
 describe("the gate", () => {
   test("pending with no approval, approved for the digest, changed for another one", async () => {
     const w = world();

package/src/components/pr-run.ts

@@ -19,6 +19,16 @@
  * its dependents in one rollout is what gated waves are for (#3049): each
  * wave is planned after the one before it applied.
  *
+ * A dependency the change did not select is read the same way (#4104), so
+ * a change to one cluster plans it against the network it sits on. That is
+ * why `components` is every component in the project and not the selection.
+ * `--seed-outputs` wins over a read, and a dependency whose steps cannot say
+ * leaves its dependents' references unresolved. The apply stage's plan reads
+ * the same dependencies, so on the same estate it gets the digest the plan
+ * stage showed, and it applies against the outputs its plans read
+ * (`set.outputs`). A resume plans against the outputs the approved plans
+ * read, from the record (`planOutputs`), and reads nothing those cover.
+ *
  * ## Finishing an apply that failed partway
  *
  * {@link resumePrSet} (#3464) is fan-out's resume (#2417, #3049) for a pull
@@ -53,10 +63,10 @@ import type { PrApplyRecord } from "./fan-out-record";
 import type { CapabilityRegistry } from "./capability";
 import type { RunProgressEvent } from "./run-progress";
 import type { RunEventSink } from "../run-event-stream";
-import { planWaveComponent, readComponentOutputs } from "./wave-plan";
+import { planWaveComponent, readDeployedOutputs } from "./wave-plan";
 
 export interface PrPlanSetOptions {
-  /** Every component in the project. */
+  /** Every component in the project, not the selection: a planned member's dependency outside it is read too (#4104). */
   components: DriverComponent[];
   /** The fan-out the change derives (`planFanOut`). Its `order` is what is planned. */
   plan: FanOutPlan;
@@ -85,6 +95,12 @@ export interface PrPlanSet {
   plans: Record<string, Record<string, unknown>>;
   /** The outputs the plans read: the seeds, and each dependency's outputs as they stood. */
   outputs: Record<string, Record<string, unknown>>;
+  /**
+   * Per dependency read from the deployed estate (#4104), the names of the
+   * outputs the read gave, sorted. The seeds are not here. Absent when
+   * nothing was read. The report's `deployedOutputs`.
+   */
+  deployedOutputs?: Record<string, string[]>;
   /** Whether any component failed to plan. */
   failed: boolean;
 }
@@ -101,12 +117,15 @@ function failedParts(component: DriverComponent, error: string): ChangeSetPart[]
 /**
  * Plan every component in `plan.order`, a wave at a time, each against the
  * outputs its dependencies have now. Never throws for a component that fails
- * to plan: it becomes a failed member, and `failed` is set.
+ * to plan: it becomes a failed member, and `failed` is set. Throws when a
+ * planned member's dependency is not among `components`, which means the
+ * caller passed the selection where the whole graph belongs.
  */
 export async function planPrSet(options: PrPlanSetOptions): Promise<PrPlanSet> {
   const byName = new Map(options.components.map((c) => [c.name, c]));
   const outputs: Record<string, Record<string, unknown>> = { ...(options.seededOutputs ?? {}) };
   const read = new Set(Object.keys(outputs));
+  const deployed: Record<string, string[]> = {};
   const parts: ChangeSetPart[] = [];
   const componentOf = new Map<string, string>();
   const plans: Record<string, Record<string, unknown>> = {};
@@ -117,15 +136,14 @@ export async function planPrSet(options: PrPlanSetOptions): Promise<PrPlanSet> {
   for (const wave of options.plan.waves) {
     // The dependencies' outputs first, each read once. A dependency that
     // cannot say leaves its references unresolved, which its dependent's
-    // plan reports if it needs them.
-    for (const name of wave) {
-      for (const dep of byName.get(name)?.dependsOn ?? []) {
-        if (read.has(dep) || !byName.has(dep)) continue;
-        read.add(dep);
-        const found = await readComponentOutputs(byName.get(dep)!, options.registry, deployContext(options, dep), outputs);
-        if (found) outputs[dep] = found;
-      }
+    // plan reports if it needs them. A dependency outside the selection is
+    // read the same way (#4104).
+    const deps = [...new Set(wave.flatMap((name) => byName.get(name)?.dependsOn ?? []))].filter((dep) => !read.has(dep));
+    for (const dep of deps) {
+      read.add(dep);
+      if (!byName.has(dep)) throw new Error(`planPrSet: ${dep}, a dependency of a planned member, is not among the components; pass every component in the project`);
     }
+    Object.assign(deployed, await readDeployedOutputs(deps, byName, options.registry, (dep) => deployContext(options, dep), outputs));
     const planned = await Promise.all(
       wave.map(async (name) => {
         const at = { component: name, phase: PR_PLAN_PHASE, step: "plan" };
@@ -170,7 +188,8 @@ export async function planPrSet(options: PrPlanSetOptions): Promise<PrPlanSet> {
     counts: memberCounts(doc, m.member),
     ...(m.error ? { error: m.error } : {}),
   }));
-  return { doc, members, plans, outputs, failed };
+  const deployedOutputs = Object.fromEntries(Object.entries(deployed).sort(([a], [b]) => a.localeCompare(b)));
+  return { doc, members, plans, outputs, failed, ...(Object.keys(deployedOutputs).length > 0 ? { deployedOutputs } : {}) };
 }
 
 /**
@@ -488,6 +507,7 @@ export function prReport(input: PrReportInput): PrReport {
     ...(input.refusal ? { refusal: input.refusal } : {}),
     ...(input.message ? { message: input.message } : {}),
     ...(input.resumed ? { resumed: { applied: [...input.resumed].sort() } } : {}),
+    ...(input.set.deployedOutputs ? { deployedOutputs: input.set.deployedOutputs } : {}),
     approval: input.approval,
     selection: {
       changed: input.plan.order.filter((c) => changed.has(c)),

package/src/components/wave-plan.ts

@@ -135,3 +135,33 @@ export async function readComponentOutputs(
   }
   return found;
 }
+
+/**
+ * Read the deployed outputs of each of `names` that `outputs` holds nothing
+ * for yet (#4104), through {@link readComponentOutputs}, and add them to
+ * `outputs`. A name that is not among `components`, or whose steps cannot
+ * say, is left out, so its dependents' references stay unresolved. Returns,
+ * per component read, the names of the outputs the read gave, sorted.
+ *
+ * `components` must be the whole graph, not the selection: the dependency a
+ * selected member reads is often one the change did not select.
+ */
+export async function readDeployedOutputs(
+  names: readonly string[],
+  components: ReadonlyMap<string, DriverComponent>,
+  registry: CapabilityRegistry,
+  ctxOf: (component: string) => DeployContext,
+  outputs: Record<string, Record<string, unknown>>,
+): Promise<Record<string, string[]>> {
+  const read: Record<string, string[]> = {};
+  for (const name of names) {
+    if (name in outputs || name in read) continue;
+    const component = components.get(name);
+    if (!component) continue;
+    const found = await readComponentOutputs(component, registry, ctxOf(name), outputs);
+    if (!found) continue;
+    outputs[name] = found;
+    read[name] = Object.keys(found).sort();
+  }
+  return read;
+}

package/src/lifecycle/release-ledger.ts

@@ -47,16 +47,22 @@ export interface RunOrigin {
    * Which id space minted `runId`: `github` (a GitHub Actions run id — also
    * the spelling Forgejo Actions uses, since it implements the same env
    * contract; `url` disambiguates the actual host), `gitlab` (a CI pipeline
-   * id), `op` (an orchestrator/Op run id), or `local` (minted on the machine
-   * that ran the deploy, resolvable nowhere).
+   * id), `op` (an orchestrator/Op run id), `local` (minted on the machine
+   * that ran the deploy, resolvable nowhere), or `chant` (a job the chant
+   * runner ran, `chant ci run`, #4094, named by its Op run id). `chant` was
+   * added within contract 1 by {@link RUN_ORIGIN_CHANT_FLOOR}, so a reader
+   * that switches on `forge` keeps a case for a value it does not know.
    */
-  forge: "github" | "gitlab" | "op" | "local";
+  forge: "github" | "gitlab" | "op" | "local" | "chant";
   /** Repo/project slug on the forge (`GITHUB_REPOSITORY` / `CI_PROJECT_PATH`), when the environment named one. */
   repo?: string;
   /** Resolved link to the run, when the environment provided enough to build one. */
   url?: string;
 }
 
+/** The first chant that writes `runOrigin.forge: "chant"`, for a job `chant ci run` ran (#4094). */
+export const RUN_ORIGIN_CHANT_FLOOR = "0.124.30";
+
 /**
  * The gate resolution that admitted a deploy (#4020): the gate's address in the
  * gate ledger (`_gates/<op>.jsonl`, `op` and `gate`) and when the resolution

package/src/lifecycle/run-ledger.ts

@@ -38,7 +38,7 @@ import { randomUUID } from "node:crypto";
 import { sortedJsonReplacer } from "../utils";
 import type { OpConfig } from "../op/types";
 import type { StepRecord } from "../op/local-executor";
-import type { OpRunRecord, OpRunRecordInput, OpRunPhaseRecord, OpRunStepRecord } from "../op/runtime";
+import { opRunFailureOf, type OpRunRecord, type OpRunRecordInput, type OpRunPhaseRecord, type OpRunStepRecord } from "../op/runtime";
 import { readBlobFromPath, readPathSha, readBlobBySha, writeBlobToPath, RefCASConflictError } from "./git";
 
 /** Prefix folding the per-op run ledgers into one flat name under `<env>/`. See the module doc. */
@@ -215,6 +215,12 @@ export async function readRunLedger(
         malformed++;
         continue;
       }
+      // A `failure` (#4094) that is not one is dropped and the line kept, as a gate line's wrong-typed `gitSha` is.
+      if ("failure" in parsed) {
+        const failure = opRunFailureOf(parsed.failure);
+        if (failure) parsed.failure = failure;
+        else delete parsed.failure;
+      }
       records.push(parsed as OpRunRecord);
     } catch {
       malformed++;

package/src/op/activities/activity-contracts.ts

@@ -54,6 +54,7 @@ export const shellCmdContract = activityContract(
     cmd: z.string(),
     env: z.record(z.string(), z.string()).optional(),
     cwd: z.string().optional(),
+    inheritEnv: z.boolean().optional(),
     okExit: z.array(z.number()).optional(),
     gatedExit: z.number().optional(),
     gate: z.strictObject({ op: z.string(), gate: z.string() }).optional(),

package/src/op/activities/shell.ts

@@ -13,6 +13,12 @@ export interface ShellCmdArgs {
   env?: Record<string, string>;
   /** Working directory. Default: process.cwd(). */
   cwd?: string;
+  /**
+   * Whether the command sees this process's environment. Default true. With
+   * false it sees `env` alone, plus the in-flight record's variable, so a job
+   * the chant runner runs (`chant ci run`, #4094) gets a clean environment.
+   */
+  inheritEnv?: boolean;
   /**
    * Exit codes that count as success. Default `[0]`.
    *
@@ -129,7 +135,7 @@ export async function shellCmd(args: ShellCmdArgs, signal?: AbortSignal): Promis
       cwd: args.cwd,
       // In a run that keeps an in-flight record, CHANT_RUN_ACTIVITY names the
       // file the command appends activity lines to (../run-live.ts).
-      env: { ...process.env, ...liveRunEnv(), ...args.env },
+      env: { ...(args.inheritEnv === false ? {} : process.env), ...liveRunEnv(), ...args.env },
       maxBuffer: MAX_STDOUT_BYTES,
       signal,
     });