@intentius/chant 0.124.30 → 0.124.31

package/src/workspace/ci-run.ts

@@ -22,7 +22,10 @@
  * own variables. The forge values a generated job reads from `${{ ... }}`
  * expressions or GitLab's predefined variables come from flags here:
  * `BASE_SHA` from `--base`, `PR_NUMBER` from `--pr`, and the commit from
- * `--commit`.
+ * `--commit`. The values a forge job gets from repository secrets come from
+ * the host's secrets file (`--secrets`, ./ci-secrets.ts, #4096), and every
+ * secret value is redacted from the run's events, record, copied report and
+ * output by the executor's `redact` option.
  *
  * The steps run in a fresh checkout of the commit: a detached `git worktree`
  * in a temporary directory outside the repository, removed when the run
@@ -37,14 +40,19 @@
  * key is given, so `chant ci tick --source runs` (#4044) judges the commit
  * from it. Its events are `kind: "pipeline"` and `runtime: "ci"`, and the
  * record and the events carry `runOrigin: { forge: "chant" }`.
+ *
+ * With a forge client (#4097) the job also sets a commit status at its
+ * commit: `pending` when it starts, `success` or `failure` when it settles.
+ * A status the forge refuses is a warning and never fails the job.
  */
 
 import { execFileSync } from "node:child_process";
-import { copyFileSync, cpSync, existsSync, mkdirSync, mkdtempSync, readFileSync, realpathSync, rmSync } from "node:fs";
+import { copyFileSync, cpSync, existsSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, realpathSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { dirname, join, relative, resolve, sep } from "node:path";
 import { PR_APPLY_RECORD, PR_LOOP_REPORT_DIR, prLoopJobs, prLoopSetup, PR_LOOP_IMAGE, type PrLoopJob, type PrLoopPipelineOptions } from "../components/pr-pipeline";
-import { detectForge, FORGE_KINDS, type ForgeKind } from "../pr-forge";
+import { detectForge, ForgeEnvironmentError, forgeFromEnv, FORGE_KINDS, type CommitStatus, type ForgeKind } from "../pr-forge";
+import { PR_APPLY_GATE } from "../pr-loop";
 import type { CommandContext } from "../cli/registry";
 import { formatError, formatWarning } from "../cli/format";
 import type { RunOrigin } from "../lifecycle/release-ledger";
@@ -55,11 +63,16 @@ import { shellCmd } from "../op/activities/shell";
 import { OpRunFailure, runOpLocally, type OpRunResult, type StepRecord } from "../op/local-executor";
 import type { OpRunFailureReason, OpRunRecord } from "../op/runtime";
 import type { ActivityStep, OpConfig, PhaseDefinition } from "../op/types";
+import { redactText, type Redact } from "../op/redact";
 import { findWorkspaceRoot } from "../project-root";
+import { parseReportUrl, reportKey } from "../pr-report-url";
 import { ciTagSigner, RUNNER_KEY_ENV } from "./ci-green";
+import { ciRedactor, ciSecretsFor, CI_SECRETS_ENV, readCiSecrets, type CiSecrets } from "./ci-secrets";
+import { updateCiRunIndex, type CiRunIndexEntry } from "./ci-run-index";
 import { resolveMemberContext } from "./member-pipeline";
 import { signOpRunRecord } from "./trust/op-run-statement";
 import { gitTop } from "./tree";
+import { hostRunnerKey } from "./ci-runner-key";
 
 /** The two jobs a pull-request pipeline has. */
 export type CiJobName = PrLoopJob["jobName"];
@@ -115,21 +128,34 @@ export class CiRunError extends Error {
 
 /**
  * The job's environment: the runner's base variables, the forge variables
- * and `passEnv` names it has, `CHANT_ENV` as a generated workflow sets it,
- * the commit as the forge spells it, and the job's own variables. A job
- * variable the forge fills from an expression comes from a flag, or from
- * the runner's environment for a token such as `GITHUB_TOKEN`; a literal
- * one, such as `CHANT_RUN_EVENTS_DIR`, is kept as it is.
+ * and `passEnv` names it has, the job's secrets from the host's secrets file
+ * (#4096), `CHANT_ENV` as a generated workflow sets it, the commit as the
+ * forge spells it, and the job's own variables. A job variable the forge
+ * fills from an expression comes from a flag, or from a secret or the
+ * runner's environment for a token such as `GITHUB_TOKEN`; a literal one,
+ * such as `CHANT_RUN_EVENTS_DIR`, is kept as it is. A secret replaces the
+ * runner's variable of the same name, and none replaces a variable the
+ * runner sets for the job. `CHANT_RUNNER_KEY` is never in it.
  */
 export function ciJobEnv(
   job: PrLoopJob,
-  input: { forge: ForgeKind; env: string; values: CiRunValues; hostEnv: Record<string, string | undefined>; passEnv?: readonly string[] },
+  input: {
+    forge: ForgeKind;
+    env: string;
+    values: CiRunValues;
+    hostEnv: Record<string, string | undefined>;
+    passEnv?: readonly string[];
+    /** The secrets this job gets, from {@link ciSecretsFor}. */
+    secrets?: Record<string, string>;
+  },
 ): Record<string, string> {
+  if (input.passEnv?.includes(RUNNER_KEY_ENV)) throw new CiRunError(`--pass-env names ${RUNNER_KEY_ENV}, and the runner key is never passed to a job`);
   const out: Record<string, string> = {};
   for (const name of [...CI_RUN_BASE_ENV, ...CI_RUN_FORGE_ENV, ...(input.passEnv ?? [])]) {
     const value = input.hostEnv[name];
     if (value !== undefined) out[name] = value;
   }
+  for (const [name, value] of Object.entries(input.secrets ?? {})) if (name !== RUNNER_KEY_ENV) out[name] = value;
   out.CHANT_ENV = input.env;
   out[input.forge === "gitlab" ? "CI_COMMIT_SHA" : "GITHUB_SHA"] = input.values.commit;
   const flags: Record<string, { value: string | undefined; flag: string }> = {
@@ -143,10 +169,13 @@ export function ciJobEnv(
       out[name] = given.value;
     } else if (!value.includes("$")) {
       out[name] = value;
+    } else if (input.secrets?.[name] !== undefined) {
+      out[name] = input.secrets[name]!;
     } else if (input.hostEnv[name] !== undefined) {
       out[name] = input.hostEnv[name]!;
     }
   }
+  delete out[RUNNER_KEY_ENV];
   return out;
 }
 
@@ -266,6 +295,77 @@ export function ciJobFailure(input: { job: CiJobName; op: OpConfig; records: rea
   return { code: "command-failed", reason: firstLine(failed.error ?? "the command failed"), phase: failed.phase, ...exit };
 }
 
+/** What posts a job's commit status (#4097): the `setCommitStatus` of a GitHub or Forgejo client. */
+export interface CiStatusClient {
+  setCommitStatus(sha: string, status: CommitStatus): Promise<void>;
+}
+
+/** Where a job's status goes (#4097). */
+export interface CiStatusConfig {
+  client: CiStatusClient;
+  /** `--status-url`: the link the status carries, `{key}` standing for `<pr>/<commit>[/<member>]`. Otherwise an https `--report-url` is used. */
+  urlTemplate?: string;
+}
+
+/** A status description is cut to what GitHub and Forgejo keep. */
+const STATUS_DESCRIPTION = 140;
+
+const cut = (text: string, max = STATUS_DESCRIPTION): string => (text.length > max ? `${text.slice(0, max - 3)}...` : text);
+
+/**
+ * A job's status context: `chant/pr-plan` for the plan, and for the apply
+ * `chant/<gate>`, which is `chant/pr-apply` unless `--gate` renamed the gate.
+ * pr-plan's own status is `chant/plan` (../pr-loop.ts), a different context.
+ */
+export function ciStatusContext(job: CiJobName, gate?: string): string {
+  return job === "apply" ? `chant/${gate ?? PR_APPLY_GATE}` : `chant/${CI_JOB_OPS.plan}`;
+}
+
+/**
+ * The link a job's status carries: the `--status-url` template with `{key}`
+ * filled, else the https `--report-url` followed by the key and a slash, else
+ * none (an `s3://` or `file://` URL is not one a browser opens).
+ */
+export function ciStatusUrl(input: { urlTemplate?: string; reportUrl?: string; pr?: number; commit: string; member?: string }): string | undefined {
+  const key = reportKey(input.pr ?? null, input.commit, input.member);
+  if (input.urlTemplate) return input.urlTemplate.split("{key}").join(key);
+  const url = input.reportUrl?.trim();
+  if (url && /^https:\/\//.test(url)) return `${url.replace(/\/+$/, "")}/${key}/`;
+  return undefined;
+}
+
+/** What the settled status says: a short summary, or on failure the record's code and reason. */
+export function ciStatusSettled(op: string, result: Pick<CiRunResult, "status" | "record" | "failure">, seconds: number): Pick<CommitStatus, "state" | "description"> {
+  if (result.status === "ok") return { state: "success", description: cut(`${op} passed in ${seconds}s`) };
+  const why = result.record.failure;
+  const text = why ? `${why.code}: ${why.reason}` : result.failure ? `${result.failure.phase}: ${firstLine(result.failure.error)}` : `${op} failed`;
+  return { state: "failure", description: cut(text) };
+}
+
+/**
+ * The status client for `chant ci run` and `chant ci serve` (#4097), or none:
+ * off with `--no-status`, on GitLab (its client has no commit status call
+ * here), and without a forge token. A token with the rest of the forge's
+ * variables missing gives a warning instead.
+ */
+export function ciStatusFromEnv(input: { forge: ForgeKind; hostEnv: Record<string, string | undefined>; noStatus?: boolean; statusUrl?: string }): { status?: CiStatusConfig; warning?: string } {
+  if (input.noStatus || input.forge === "gitlab") return {};
+  if (input.statusUrl !== undefined && !/^https?:\/\/\S+$/.test(input.statusUrl)) {
+    throw new CiRunError(`--status-url takes an http or https URL template such as https://host/reports/{key}, not ${JSON.stringify(input.statusUrl)}`);
+  }
+  const env = input.hostEnv;
+  const hasToken = Boolean(env.CHANT_FORGE_TOKEN ?? env.GITHUB_TOKEN ?? env.GH_TOKEN);
+  if (!hasToken) return {};
+  try {
+    const client = forgeFromEnv(input.forge, env);
+    if (!client.setCommitStatus) return {};
+    return { status: { client: { setCommitStatus: client.setCommitStatus.bind(client) }, ...(input.statusUrl ? { urlTemplate: input.statusUrl } : {}) } };
+  } catch (err) {
+    if (err instanceof ForgeEnvironmentError) return { warning: `no commit status will be set: ${err.message}` };
+    throw err;
+  }
+}
+
 /** What `chant ci run` runs. */
 export interface CiRunRequest {
   /** Where the command was run: the project, or a workspace member's directory. */
@@ -290,8 +390,16 @@ export interface CiRunRequest {
   passEnv?: readonly string[];
   /** The runner's environment. Default `process.env`. */
   hostEnv?: Record<string, string | undefined>;
+  /**
+   * The host's secrets file, read (#4096, `--secrets`): the job gets the
+   * secrets its allowlist names, and every value in it is redacted from the
+   * run's events, record, copied report and output.
+   */
+  secrets?: CiSecrets;
   /** `--output`: where the job's report is copied, from `cwd`. Default `.chant/pr`. */
   output?: string;
+  /** `--run-index-limit`: how many runs the index at `loop.reportUrl` keeps (#4098). Default 200. */
+  runIndexLimit?: number;
   /** A runner key, PEM, that signs the run's record. */
   runnerKey?: string;
   /**
@@ -315,6 +423,8 @@ export interface CiRunRequest {
    * failed. `chant ci serve` names one per `prApplyRecordKey`.
    */
   resumeRecord?: string;
+  /** Set a commit status at the job's commit (#4097). Absent: none is set. `chant ci run` builds it from the environment. */
+  status?: CiStatusConfig;
   signal?: AbortSignal;
 }
 
@@ -393,6 +503,55 @@ function freshCheckout(top: string, commit: string): { dir: string; remove(): vo
   };
 }
 
+/**
+ * Add the settled job to the run index at its report URL (#4098). The pull
+ * request is the one the job's own report names, since a pr-apply finds it
+ * itself, else `--pr`. A warning, never a failure, when the index can't be
+ * updated.
+ */
+async function recordInIndex(input: {
+  url: string;
+  job: CiJobName;
+  commit: string;
+  member?: string;
+  pr?: number;
+  record: OpRunRecord;
+  reportDir: string;
+  limit?: number;
+  /** The run's redactor (#4096): every string written to the index goes through it, as the copied report does. */
+  redact?: Redact;
+  warn: (message: string) => void;
+}): Promise<void> {
+  const target = parseReportUrl(input.url);
+  if ("error" in target) return input.warn(`the run index is not updated: ${target.error}`);
+  let pr: number | null = input.pr ?? null;
+  try {
+    const file = join(input.reportDir, `${CI_JOB_OPS[input.job]}.json`);
+    if (existsSync(file)) {
+      const said = (JSON.parse(readFileSync(file, "utf-8")) as { pr?: unknown }).pr;
+      if (Number.isInteger(said) && (said as number) > 0) pr = said as number;
+    }
+  } catch {
+    // The report is not readable; the flag stands.
+  }
+  const failure = input.record.failure;
+  const clean = (text: string): string => (input.redact ? input.redact(text) : text);
+  const entry: CiRunIndexEntry = {
+    job: input.job,
+    pr,
+    commit: input.commit,
+    status: input.record.status === "ok" ? "ok" : "fail",
+    ...(input.record.status !== "ok" ? { failure: { code: clean(failure?.code ?? "command-failed") } } : {}),
+    ...(input.member ? { member: clean(input.member) } : {}),
+    started: input.record.started,
+    ended: input.record.ended,
+    runId: clean(input.record.id),
+    key: clean(reportKey(pr, input.commit, input.member)),
+    runOrigin: CHANT_RUNNER_ORIGIN,
+  };
+  await updateCiRunIndex({ target, entry, ...(input.limit ? { limit: input.limit } : {}), warn: input.warn });
+}
+
 const ACTIVITIES = new Map<string, ActivityFn>([["shellCmd", shellCmd as unknown as ActivityFn]]);
 
 /**
@@ -410,7 +569,31 @@ export async function ciRun(req: CiRunRequest): Promise<CiRunResult> {
   const jobs = prLoopJobs(req.forge, req.env, req.loop ?? {}, place.member);
   const job = jobs.find((j) => j.jobName === req.job);
   if (!job) throw new CiRunError(`the pull-request pipeline has no ${req.job} job; it has ${jobs.map((j) => j.jobName).join(" and ")}`);
-  const jobEnv = ciJobEnv(job, { forge: req.forge, env: req.env, values: { base: req.base, pr: req.pr, commit }, hostEnv, passEnv: req.passEnv });
+  const jobEnv = ciJobEnv(job, {
+    forge: req.forge,
+    env: req.env,
+    values: { base: req.base, pr: req.pr, commit },
+    hostEnv,
+    passEnv: req.passEnv,
+    secrets: ciSecretsFor(req.secrets, req.job),
+  });
+  // #4096: the secrets and the job's secret-looking variables, redacted from everything the run writes and returns.
+  const redact = ciRedactor(jobEnv, req.secrets);
+  try {
+    const result = await runCiJob(req, { cwd, top, commit, place, job, jobEnv, ...(redact ? { redact } : {}) });
+    return redact ? { ...result, warnings: result.warnings.map(redact), ...(result.pushWarning ? { pushWarning: redact(result.pushWarning) } : {}) } : result;
+  } catch (err) {
+    if (redact && err instanceof Error) err.message = redact(err.message);
+    throw err;
+  }
+}
+
+/** {@link ciRun} once the job and its environment are known. */
+async function runCiJob(
+  req: CiRunRequest,
+  at: { cwd: string; top: string; commit: string; place: { member?: string; dir: string }; job: PrLoopJob; jobEnv: Record<string, string>; redact?: Redact },
+): Promise<CiRunResult> {
+  const { cwd, top, commit, place, job, jobEnv, redact } = at;
 
   // The record is signed against .chant/trust.json at the commit the job runs, so a key that commit does not list is refused before anything runs.
   let signer: ReturnType<typeof ciTagSigner> | undefined;
@@ -443,6 +626,20 @@ export async function ciRun(req: CiRunRequest): Promise<CiRunResult> {
       mkdirSync(dirname(resume.job), { recursive: true });
       copyFileSync(resume.host, resume.job);
     }
+    const statusContext = ciStatusContext(req.job, req.loop?.gate);
+    const statusUrl = req.status
+      ? ciStatusUrl({ ...(req.status.urlTemplate ? { urlTemplate: req.status.urlTemplate } : {}), ...(req.loop?.reportUrl ? { reportUrl: req.loop.reportUrl } : {}), ...(req.pr !== undefined ? { pr: req.pr } : {}), commit, ...(place.member ? { member: place.member } : {}) })
+      : undefined;
+    const postStatus = async (state: CommitStatus["state"], description: string): Promise<void> => {
+      if (!req.status) return;
+      try {
+        await req.status.client.setCommitStatus(commit, { context: statusContext, state, description: cut(redact ? redact(description) : description), ...(statusUrl ? { targetUrl: statusUrl } : {}) });
+      } catch (err) {
+        warnings.push(`could not set the ${statusContext} status: ${message(err)}`);
+      }
+    };
+    const startedAt = Date.now();
+    await postStatus("pending", `${op.name} running`);
     let ledgerError: string | undefined;
     let result: OpRunResult;
     try {
@@ -458,14 +655,25 @@ export async function ciRun(req: CiRunRequest): Promise<CiRunResult> {
         ...(req.stepOutput ? { stepOutput: req.stepOutput } : {}),
         ...(signer ? { signRecord: (record: OpRunRecord) => signOpRunRecord(record, signer!) } : {}),
         onSignError: (err) => warnings.push(`the run was not signed: ${message(err)}`),
+        ...(redact ? { redact } : {}),
         onLedgerError: (err) => {
           ledgerError = `the job ran, and its record could not be written to chant/lifecycle: ${message(err)}`;
         },
       });
     } catch (err) {
-      if (!(err instanceof OpRunFailure)) throw err;
+      if (!(err instanceof OpRunFailure)) {
+        await postStatus("error", `${op.name} stopped: ${firstLine(message(err))}`);
+        throw err;
+      }
       result = err.result;
     }
+    const failedStep = result.records.find((r) => r.status === "fail");
+    const settled = ciStatusSettled(
+      op.name,
+      { status: result.status, record: result.record, ...(failedStep ? { failure: { phase: failedStep.phase, error: failedStep.error ?? "the step failed" } } : {}) },
+      Math.round((Date.now() - startedAt) / 1000),
+    );
+    await postStatus(settled.state, settled.description);
 
     if (resume && existsSync(resume.job)) {
       try {
@@ -480,6 +688,10 @@ export async function ciRun(req: CiRunRequest): Promise<CiRunResult> {
     if (existsSync(written)) {
       report = resolve(cwd, req.output ?? PR_LOOP_REPORT_DIR);
       cpSync(written, report, { recursive: true });
+      if (redact) redactTree(report, redact);
+    }
+    if (req.loop?.reportUrl) {
+      await recordInIndex({ url: req.loop.reportUrl, job: req.job, commit, member: place.member, pr: req.pr, record: result.record, reportDir: written, limit: req.runIndexLimit, ...(redact ? { redact } : {}), warn: (w) => warnings.push(w) });
     }
     if (ledgerError) throw new CiRunError(ledgerError);
     const pushed: { pushed: boolean; pushWarning?: string } = req.push === false ? { pushed: false, pushWarning: "chant/lifecycle was not pushed" } : await pushLifecycleReport({ cwd: top });
@@ -501,6 +713,27 @@ export async function ciRun(req: CiRunRequest): Promise<CiRunResult> {
   }
 }
 
+/**
+ * Redact every text file under `dir` in place (#4096): the job's report, its
+ * change set and its component events, as `ci run` copied them out. A
+ * JSON file stays JSON. A file with a NUL byte is taken as binary and left.
+ */
+export function redactTree(dir: string, redact: Redact): void {
+  for (const entry of readdirSync(dir, { withFileTypes: true })) {
+    const path = join(dir, entry.name);
+    if (entry.isDirectory()) {
+      redactTree(path, redact);
+      continue;
+    }
+    if (!entry.isFile()) continue;
+    const bytes = readFileSync(path);
+    if (bytes.includes(0)) continue;
+    const text = bytes.toString("utf-8");
+    const clean = redactText(text, redact);
+    if (clean !== text) writeFileSync(path, clean);
+  }
+}
+
 /** The text `chant ci run` prints when the run settles. */
 export function formatCiRun(r: CiRunResult): string {
   const lines = [`${r.op} ${r.status === "ok" ? "passed" : r.status === "fail" ? "failed" : r.status} at ${r.record.gitSha?.slice(0, 12) ?? "an unknown commit"}, run ${r.record.id} in ${r.record.env}`];
@@ -517,16 +750,36 @@ export function formatCiRun(r: CiRunResult): string {
 
 const USAGE =
   "chant ci run plan|apply --env <env> --base <sha> [--pr <n>] [--commit <sha>] [--forge github|gitlab|forgejo] " +
-  "[--gate <name>] [--branch <name>] [--events-json] [--report-url <url>] [--image <image>] [--before-script <line>]... " +
-  "[--pr-build] [--pr-build-command <line>] " +
-  "[--chant <command>] [--pass-env <NAME>]... [--key <runner key.pem>] [-o <dir>]";
+  "[--gate <name>] [--branch <name>] [--events-json] [--report-url <url>] [--run-index-limit <n>] [--image <image>] [--before-script <line>]... " +
+  "[--pr-build] [--pr-build-command <line>] [--no-status] [--status-url <url template>] " +
+  "[--chant <command>] [--pass-env <NAME>]... [--secrets <file>] [--key <runner key.pem>] [-o <dir>] | chant ci run --setup-key [--trust [--principal <name>]] [--state <dir>] [--branch <name>]";
 
 const ENV_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
 
+/** The host's runner key in `--state`, or in ci serve's default state directory, when `--setup-key` made one there (#4099). */
+function hostRunnerKeyAt(cwd: string, statePath: string | undefined): { pem: string } | undefined {
+  const common = statePath ? null : (() => {
+    try {
+      return execFileSync("git", ["rev-parse", "--path-format=absolute", "--git-common-dir"], { cwd, encoding: "utf-8", stdio: ["ignore", "pipe", "pipe"] }).trim();
+    } catch {
+      return null;
+    }
+  })();
+  const dir = statePath ? resolve(statePath) : common ? join(common, "chant", "ci-serve") : null;
+  return dir ? hostRunnerKey(dir) : undefined;
+}
+
+/** The secrets file `--secrets` names, else the one `CHANT_CI_SECRETS` names, read; undefined when neither names one (#4096). */
+export function ciSecretsOf(flag: string | undefined, env: Record<string, string | undefined> = process.env): CiSecrets | undefined {
+  const file = flag ?? (env[CI_SECRETS_ENV] || undefined);
+  return file === undefined ? undefined : readCiSecrets(resolve(file));
+}
+
 /** `chant ci run plan|apply` (#4094). */
 export async function runCiRun(ctx: CommandContext): Promise<number> {
   const { args } = ctx;
   try {
+    if (args.setupKey) return (await import("./ci-serve")).runnerKeySetupCommand(ctx);
     const job = args.extraPositional;
     if (job !== "plan" && job !== "apply") throw new CiRunError(`ci run takes the job to run, plan or apply${job ? `, not ${JSON.stringify(job)}` : ""}`);
     if (!args.env) throw new CiRunError("--env names the environment the pipeline is for, as chant build --components --generate <lexicon> --pr-loop took it: --env <env>");
@@ -535,9 +788,16 @@ export async function runCiRun(ctx: CommandContext): Promise<number> {
     if (!(FORGE_KINDS as readonly string[]).includes(forge)) throw new CiRunError(`--forge takes github, gitlab or forgejo, not ${JSON.stringify(forge)}`);
     for (const name of args.passEnv ?? []) if (!ENV_NAME.test(name)) throw new CiRunError(`--pass-env takes a variable's name, not ${JSON.stringify(name)}`);
     const fromFlag = args.key !== undefined;
-    const runnerKey = fromFlag ? readFileSync(resolve(args.key!), "utf-8") : process.env[RUNNER_KEY_ENV] || undefined;
+    // #4099: without --key or CHANT_RUNNER_KEY, the host's key that --setup-key made, if there is one. Like the variable, an unlisted one only warns.
+    const hostKey = fromFlag || process.env[RUNNER_KEY_ENV] ? undefined : hostRunnerKeyAt(process.cwd(), args.statePath);
+    const runnerKey = fromFlag ? readFileSync(resolve(args.key!), "utf-8") : process.env[RUNNER_KEY_ENV] || hostKey?.pem;
+    const hostEnv = process.env;
+    const { status, warning } = ciStatusFromEnv({ forge: forge as ForgeKind, hostEnv, noStatus: args.noStatus, statusUrl: args.statusUrl });
+    if (warning) console.error(formatWarning({ message: warning }));
+    const secrets = ciSecretsOf(args.ciSecrets);
     const result = await ciRun({
       cwd: process.cwd(),
+      ...(status ? { status } : {}),
       job,
       env: args.env,
       forge: forge as ForgeKind,
@@ -552,10 +812,12 @@ export async function runCiRun(ctx: CommandContext): Promise<number> {
         ...(args.prBuild ? { build: true } : {}),
         ...(args.prBuildCommand ? { buildCommand: args.prBuildCommand } : {}),
       },
+      ...(args.runIndexLimit ? { runIndexLimit: args.runIndexLimit } : {}),
       ...(args.image ? { image: args.image } : {}),
       ...(args.beforeScript?.length ? { beforeScript: args.beforeScript } : {}),
       ...(args.ciChant ? { chant: args.ciChant } : {}),
       ...(args.passEnv?.length ? { passEnv: args.passEnv } : {}),
+      ...(secrets ? { secrets } : {}),
       ...(args.output ? { output: args.output } : {}),
       ...(runnerKey !== undefined ? { runnerKey, runnerKeyFromEnv: !fromFlag } : {}),
       ...(args.eventsJson ? { runEvents: (line: string) => void process.stdout.write(line) } : {}),

package/src/workspace/ci-runner-key.test.ts

@@ -0,0 +1,166 @@
+/**
+ * #4099: the runner key on a `chant ci serve` or `chant ci run` host. The
+ * key is made in the state directory with mode 0600, `--setup-key --trust`
+ * proposes its runner entry on a branch through `trust runner add` (#3510)
+ * and never writes the target branch, and `ci serve` refuses to start when
+ * `.chant/trust.json` at the target's head does not list its key, unless
+ * `--unsigned`.
+ *
+ * Every test works in its own temp repository with a bare origin and its own
+ * state directory. The jobs' `chant` is a stub script, and no job runs: the
+ * refusals come before the first poll.
+ */
+
+import { chmodSync, mkdirSync, readFileSync, statSync, writeFileSync } from "node:fs";
+import { generateKeyPairSync } from "node:crypto";
+import { join } from "node:path";
+import { afterEach, describe, expect, test, vi } from "vitest";
+import { cleanScratch, declaration, git, repoFixture, scratchDir, writeFiles } from "./__fixtures__/contract-repo";
+import { parseArgs } from "../cli/parse-args";
+import type { CommandContext } from "../cli/registry";
+import { ciServeRunnerKey, ensureHostRunnerKey, hostRunnerKey, RUNNER_KEY_FILE } from "./ci-runner-key";
+import { runCiServe } from "./ci-serve";
+import { runCiRun } from "./ci-run";
+import { ciTagSigner } from "./ci-green";
+import { trustWrite } from "./trust/trust-write";
+
+const home = process.cwd();
+afterEach(() => {
+  process.chdir(home);
+  vi.restoreAllMocks();
+  cleanScratch();
+});
+
+/** The repository every test starts from, built once: a checkout on main with a bare origin, with commits made by a fixed identity and never signed. */
+const workspaceTemplate = repoFixture(() => {
+  const top = scratchDir("chant-runner-key-template-");
+  const origin = join(top, "origin");
+  const root = join(top, "root");
+  mkdirSync(origin);
+  mkdirSync(root);
+  git(origin, "init", "-q", "--bare");
+  git(root, "init", "-q");
+  git(root, "symbolic-ref", "HEAD", "refs/heads/main");
+  for (const [k, v] of [["user.name", "t"], ["user.email", "t@example.com"], ["commit.gpgsign", "false"]]) git(root, "config", k!, v!);
+  writeFiles(root, { "chant.workspace.json": declaration([{ name: "app", dir: "app", kind: "other", because: "the app" }]), "app/a.txt": "a\n" });
+  git(root, "remote", "add", "origin", origin);
+  git(root, "add", "-A");
+  git(root, "commit", "-q", "-m", "init");
+  git(root, "push", "-q", "origin", "main");
+  return top;
+}, "chant-runner-key-");
+
+/** A copy of the template, its origin pointed at the copy of the bare one. */
+function workspace(): { root: string; origin: string; main: string } {
+  const top = workspaceTemplate();
+  const root = join(top, "root");
+  const origin = join(top, "origin");
+  git(root, "remote", "set-url", "origin", origin);
+  return { root, origin, main: git(root, "rev-parse", "HEAD") };
+}
+
+/** Run a ci command line in `cwd`, with what it printed. */
+async function cli(cwd: string, argv: string[], run: (ctx: CommandContext) => Promise<number> = runCiServe) {
+  process.chdir(cwd);
+  const out: string[] = [];
+  const err: string[] = [];
+  vi.spyOn(console, "log").mockImplementation((s: string) => void out.push(String(s)));
+  vi.spyOn(console, "error").mockImplementation((s: string) => void err.push(String(s)));
+  const code = await run({ args: parseArgs(argv) } as unknown as CommandContext);
+  return { code, out: out.join("\n"), err: err.join("\n") };
+}
+
+/** A stand-in for `chant` the jobs would run; no test here reaches a job. */
+function stubChant(): string {
+  const file = join(scratchDir("chant-runner-key-bin-"), "chant");
+  writeFileSync(file, "#!/bin/sh\nexit 0\n");
+  chmodSync(file, 0o755);
+  return file;
+}
+
+const SERVE = (state: string) => ["ci", "serve", "--forge", "forgejo", "--repo", "demo/estate", "--env", "local", "--once", "--state", state, "--chant", stubChant(), "--image", "node:22-bookworm"];
+
+describe("the host's runner key (#4099)", () => {
+  test("--setup-key makes an Ed25519 key with mode 0600, prints its public half, and reuses it", async () => {
+    const { root } = workspace();
+    const state = join(scratchDir("chant-runner-key-state-"), "ci-serve");
+    const first = await cli(root, ["ci", "serve", "--setup-key", "--state", state]);
+    expect(first.code).toBe(0);
+    const path = join(state, RUNNER_KEY_FILE);
+    expect(statSync(path).mode & 0o777).toBe(0o600);
+    expect(statSync(state).mode & 0o777).toBe(0o700);
+    expect(readFileSync(path, "utf-8")).toContain("BEGIN PRIVATE KEY");
+    expect(first.out).toMatch(/^ssh-ed25519 [A-Za-z0-9+/]+=*$/);
+    expect(first.err).toContain("made now, mode 0600");
+    // It is not listed yet, so the exact command is printed.
+    expect(first.err).toContain(`chant workspace trust runner add chant-runner:`);
+    expect(first.err).toContain(`--key "${first.out}"`);
+
+    // ci run --setup-key finds the same key and makes no other.
+    const again = await cli(root, ["ci", "run", "--setup-key", "--state", state], runCiRun);
+    expect(again.code).toBe(0);
+    expect(again.out).toBe(first.out);
+    expect(again.err).toContain("already here");
+
+    // A key other users can read is refused.
+    chmodSync(path, 0o644);
+    expect(() => hostRunnerKey(state)).toThrow(/can be read by other users/);
+    chmodSync(path, 0o600);
+    expect(ensureHostRunnerKey(state).created).toBe(false);
+  });
+
+  test("--setup-key --trust pushes the runner entry on a branch of its own and leaves main as it was", async () => {
+    const { root, origin, main } = workspace();
+    const state = scratchDir("chant-runner-key-state-");
+    const r = await cli(root, ["ci", "serve", "--setup-key", "--trust", "--principal", "chant-runner:demo", "--by", "github:alex", "--state", state]);
+    expect(r.code, r.err).toBe(0);
+    expect(r.err).toContain("committed the runner entry for chant-runner:demo on chant/trust-runner/chant-runner-demo");
+    const branch = "chant/trust-runner/chant-runner-demo";
+
+    // main is untouched, here and on the remote; the branch holds the entry and the role.
+    expect(git(origin, "rev-parse", "refs/heads/main")).toBe(main);
+    expect(git(root, "rev-parse", "HEAD")).toBe(main);
+    expect(git(root, "status", "--short")).toBe("");
+    const trust = JSON.parse(git(origin, "show", `${branch}:.chant/trust.json`)) as { runners: { principal: string; key: string }[]; roles: { runner: string[] } };
+    expect(trust.runners).toEqual([{ principal: "chant-runner:demo", class: "runner", key: r.out }]);
+    expect(trust.roles.runner).toEqual(["chant-runner:demo"]);
+    expect(git(origin, "rev-parse", `${branch}^`)).toBe(main);
+
+    // Until it merges, ci serve refuses the key; once it has, the key signs as the principal.
+    const key = hostRunnerKey(state)!;
+    expect(() => ciServeRunnerKey({ top: root, stateDir: state, branch: "main" })).toThrow(/not trusted at main/);
+    git(root, "push", "-q", "origin", `refs/remotes/origin/${branch}:refs/heads/main`);
+    expect(ciServeRunnerKey({ top: root, stateDir: state, branch: "main" })).toMatchObject({ pem: key.pem, source: join(state, RUNNER_KEY_FILE) });
+    expect(ciTagSigner(root, git(root, "rev-parse", "refs/remotes/origin/main"), key.pem).principal).toBe("chant-runner:demo");
+
+    // Run again, it says the key is listed and proposes nothing.
+    const listed = await cli(root, ["ci", "serve", "--setup-key", "--trust", "--state", state]);
+    expect(listed.err).toContain("lists it for chant-runner:demo, with the runner role");
+  });
+
+  test("ci serve refuses to start with a key trust.json does not list at the target's head, and --unsigned starts without one", async () => {
+    const { root } = workspace();
+    const state = scratchDir("chant-runner-key-state-");
+
+    const none = await cli(root, SERVE(state));
+    expect(none.code).toBe(1);
+    expect(none.err).toContain("there is no runner key");
+
+    ensureHostRunnerKey(state);
+    const unlisted = await cli(root, SERVE(state));
+    expect(unlisted.code).toBe(1);
+    expect(unlisted.err).toMatch(/not trusted at main [0-9a-f]{12}/);
+    expect(unlisted.err).toContain("chant ci serve --setup-key --trust");
+    expect(unlisted.err).toContain("chant workspace trust runner add");
+
+    // A key listed only in the working tree, not at the head, is still refused.
+    const other = generateKeyPairSync("ed25519").privateKey.export({ type: "pkcs8", format: "pem" }).toString();
+    writeFileSync(join(state, "other.pem"), other, { mode: 0o600 });
+    expect(trustWrite({ cwd: root, action: "runner add", name: "ci-bot", key: join(state, "other.pem") })).toMatchObject({ changed: true });
+    const flagged = await cli(root, [...SERVE(state), "--key", join(state, "other.pem")]);
+    expect(flagged.code).toBe(1);
+    expect(flagged.err).toContain("lists no runner with this key");
+
+    expect(ciServeRunnerKey({ top: root, stateDir: state, branch: "main", unsigned: true })).toEqual({ fromFlag: false, source: "none (--unsigned)" });
+  });
+});