@intentius/chant 0.124.31 → 0.124.33

package/src/components/pr-pipeline.test.ts

@@ -0,0 +1,100 @@
+/**
+ * The apply job's base fallback (#4004), run in sh against a real
+ * repository. GitHub and Forgejo set `github.event.before`, and GitLab
+ * `CI_COMMIT_BEFORE_SHA`, to forty zeros on a branch's first push.
+ */
+
+import { execFileSync } from "node:child_process";
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { afterAll, describe, expect, test } from "vitest";
+import { EMPTY_TREE_SHA } from "./changed-files";
+import { githubBaseFallback, gitlabBaseFallback, prLoopJobs } from "./pr-pipeline";
+
+const ZEROS = "0".repeat(40);
+const dir = mkdtempSync(join(tmpdir(), "chant-pr-base-"));
+afterAll(() => rmSync(dir, { recursive: true, force: true }));
+const ENV = { ...process.env, GIT_AUTHOR_NAME: "t", GIT_AUTHOR_EMAIL: "t@example.com", GIT_COMMITTER_NAME: "t", GIT_COMMITTER_EMAIL: "t@example.com" };
+
+const git = (cwd: string, ...args: string[]): string => execFileSync("git", args, { cwd, encoding: "utf8", env: ENV }).trim();
+
+/** A bare origin and a clone of it, `main` holding `commits` commits. */
+function repo(name: string, commits: number): string {
+  const origin = join(dir, `${name}.git`);
+  const work = join(dir, name);
+  execFileSync("git", ["init", "-q", "--bare", "-b", "main", origin]);
+  execFileSync("git", ["init", "-q", "-b", "main", work]);
+  git(work, "remote", "add", "origin", origin);
+  for (let i = 0; i < commits; i++) {
+    writeFileSync(join(work, "f.txt"), `${i}\n`);
+    git(work, "add", "-A");
+    git(work, "commit", "-q", "-m", `c${i}`);
+  }
+  git(work, "push", "-q", "origin", "main");
+  return work;
+}
+
+/** BASE_SHA after `line` runs in `cwd` with `env`. */
+function settle(cwd: string, line: string, env: Record<string, string>): string {
+  return execFileSync("sh", ["-ec", `${line}\nprintf %s "$BASE_SHA"`], { cwd, encoding: "utf8", env: { ...ENV, ...env } });
+}
+
+describe("githubBaseFallback (#4004)", () => {
+  test("a set base is kept", () => {
+    const work = repo("kept", 2);
+    const parent = git(work, "rev-parse", "HEAD^");
+    expect(settle(work, githubBaseFallback(), { BASE_SHA: parent, GITHUB_SHA: git(work, "rev-parse", "HEAD") })).toBe(parent);
+  });
+
+  test("forty zeros or empty on the target branch's first push: the pushed commit's parent", () => {
+    const work = repo("first", 2);
+    const head = git(work, "rev-parse", "HEAD");
+    const parent = git(work, "rev-parse", "HEAD^");
+    expect(settle(work, githubBaseFallback(), { BASE_SHA: ZEROS, GITHUB_SHA: head })).toBe(parent);
+    expect(settle(work, githubBaseFallback(), { BASE_SHA: "", GITHUB_SHA: head })).toBe(parent);
+  });
+
+  test("a branch's first push: the merge base with the target branch", () => {
+    const work = repo("branch", 1);
+    const fork = git(work, "rev-parse", "HEAD");
+    git(work, "checkout", "-q", "-b", "feature");
+    writeFileSync(join(work, "g.txt"), "g\n");
+    git(work, "add", "-A");
+    git(work, "commit", "-q", "-m", "feature");
+    expect(settle(work, githubBaseFallback(), { BASE_SHA: ZEROS, GITHUB_SHA: git(work, "rev-parse", "HEAD") })).toBe(fork);
+  });
+
+  test("a root commit: the empty tree", () => {
+    const work = repo("root", 1);
+    expect(settle(work, githubBaseFallback(), { BASE_SHA: ZEROS, GITHUB_SHA: git(work, "rev-parse", "HEAD") })).toBe(EMPTY_TREE_SHA);
+  });
+
+  test("a named branch is the one fetched", () => {
+    expect(githubBaseFallback()).toContain('git fetch origin "main"');
+    expect(githubBaseFallback("trunk")).toContain('git fetch origin "trunk"');
+  });
+});
+
+describe("gitlabBaseFallback", () => {
+  test("a root commit's first push: the empty tree, as on GitHub (#4004)", () => {
+    const work = repo("gitlab-root", 1);
+    expect(settle(work, gitlabBaseFallback("main"), { BASE_SHA: ZEROS, CI_COMMIT_SHA: git(work, "rev-parse", "HEAD") })).toBe(EMPTY_TREE_SHA);
+  });
+
+  test("the merge request's diff base comes first", () => {
+    const work = repo("gitlab-mr", 2);
+    const parent = git(work, "rev-parse", "HEAD^");
+    expect(settle(work, gitlabBaseFallback("main"), { BASE_SHA: ZEROS, CI_MERGE_REQUEST_DIFF_BASE_SHA: parent, CI_COMMIT_SHA: git(work, "rev-parse", "HEAD") })).toBe(parent);
+  });
+});
+
+describe("prLoopJobs", () => {
+  test("every forge's apply settles its base first; no plan does", () => {
+    for (const forge of ["github", "forgejo", "gitlab"] as const) {
+      const [plan, apply] = prLoopJobs(forge, "prod", { branch: "trunk" });
+      expect(plan!.setup).toBeUndefined();
+      expect(apply!.setup).toEqual([forge === "gitlab" ? gitlabBaseFallback("trunk") : githubBaseFallback("trunk")]);
+    }
+  });
+});

package/src/components/pr-pipeline.ts

@@ -1,6 +1,7 @@
 /**
  * The jobs of a generated pull-request pipeline (#3183): a plan job on every
- * pull request and an apply job on every push to the target branch.
+ * pull request and, on every push to the target branch, a record job, or an
+ * apply job when the pipeline opts into apply on merge (#4168).
  *
  * Each forge's generator (the github, gitlab and forgejo lexicons) adds its
  * own triggers, permissions and artifact handling; the commands and the
@@ -9,11 +10,19 @@
  * - The plan job runs `chant components pr-plan` against the pull request's
  *   target commit. It posts the note and the `chant/plan` status and writes
  *   nothing to `chant/lifecycle`, since it runs the pull request's code.
- * - The apply job runs `chant components pr-apply` against the commit the
+ * - The record job (#4168 step 1, the default) runs `chant components
+ *   pr-record` against the commit the push replaced. It plans the same
+ *   members on the merged commit, stores the change set and writes the merge
+ *   record, `_merges/<commit>.json` on `chant/lifecycle`. It applies nothing:
+ *   a release that carries the commit deploys it. It needs write access to
+ *   `chant/lifecycle`. One record runs at a time per environment.
+ * - With `applyOnMerge` the apply job takes the record job's place. It runs
+ *   `chant components pr-apply` against the commit the
  *   push replaced, finds the pull request that merged the pushed commit
  *   through the forge, and applies only when an approval stands for the
- *   digest it plans. With `requireReview` (the default) the approver must
- *   also have approved the pull request on the forge. It needs write access
+ *   digest it plans. With `requireReview` (off by default since #4168, on
+ *   under the `review-rules` security group) the approver must also have
+ *   approved the pull request on the forge. It needs write access
  *   to `chant/lifecycle`, to record the pending fact when the gate stops it.
  *   One apply runs at a time per environment.
  *
@@ -35,6 +44,7 @@
  * it too. With `reportUrl` both pass `--report-url`, which copies the report,
  * the change set and the events where a reader outside CI can fetch them;
  * the job's own environment brings the credentials an `s3://` URL needs.
+ * The record job passes the same flags as the apply.
  *
  * With `build` (#4088) both jobs run the project's build and `chant lint`
  * before their command, and fail on an error. A `cfn-deploy` member's plan
@@ -42,6 +52,25 @@
  * build is `chant build --env <env>`, or `buildCommand` when the templates
  * come from several builds (`npm run build`).
  *
+ * With `waveGate` (#4003) the apply runs a wave at a time: `pr-apply
+ * --wave-gate <gate>`, each wave planned after the one before it applied. A
+ * generator writes one apply job per wave of the component graph
+ * (`prLoopWaveJobs`), job `apply-wave-<k>` passing `--wave <k>` and needing
+ * the job before it, and the attempt record carries the approved set from
+ * one job to the next. A wave whose plan the approved change set covers
+ * applies under the pull request's approval; one whose plan moved stops at
+ * `<gate>-wave-<k>` (exit 3), and re-running its job after the approval
+ * carries on. `chant ci serve` runs the one apply job, which runs the waves
+ * in order until one stops.
+ *
+ * Each generated job runs its command through `chant ci run plan|apply
+ * --in-place` (#4156, `PrLoopJob.run`), so a forge job writes the same run
+ * record the chant runner does: Op `pr-plan` or `pr-apply`, signed with
+ * the runner key a forge secret puts in `CHANT_RUNNER_KEY`, and naming the
+ * forge's run as its `runOrigin`. `ci run` runs `command` in the job's own
+ * checkout with the job's environment, less the key. The plan passes
+ * `--no-push`, so it still writes nothing to the remote `chant/lifecycle`.
+ *
  * In a workspace member (#3465) both commands run in the member's directory
  * and pass `--member <name>`, so the member's gate (`pr-<number>-<member>`),
  * note and statuses stay apart from every other member's on the same pull
@@ -52,6 +81,13 @@
 import type { ForgeKind } from "../pr-forge";
 import { PR_APPLY_GATE } from "../pr-loop";
 import { CI_IMAGE, GITHUB_JOB_TOKEN } from "../ci-jobs";
+import { EMPTY_TREE_SHA } from "./changed-files";
+import { layerWaves } from "../gated-waves";
+import type { DriverComponent } from "./driver";
+import type { GatedWavePipelineOptions } from "./gated-wave-pipeline";
+
+/** The variable `chant ci run` reads its runner key from (`RUNNER_KEY_ENV` in ../workspace/ci-green.ts). */
+const RUNNER_KEY_ENV = "CHANT_RUNNER_KEY";
 
 /** Where both jobs write their reports, kept as a CI artifact. */
 export const PR_LOOP_REPORT_DIR = ".chant/pr";
@@ -97,8 +133,16 @@ export interface PrLoopPipelineOptions {
    * GitHub and Forgejo; on GitLab, the project's default branch.
    */
   branch?: string;
-  /** Count an approval only from someone who approved the pull request on the forge. Default true. */
+  /** Count an approval only from someone who approved the pull request on the forge. Default false (#4168): review rules are opt-in. */
   requireReview?: boolean;
+  /** The job on merge (apply, or record since #4168) has `chant ci run` refuse to start without a runner-start statement for it (`--require-runner-start`, #4147), as under the `isolated-runners` security group (#4168). Default false. */
+  requireRunnerStart?: boolean;
+  /**
+   * Apply the approved plan on merge (#4168), as every pull-request pipeline
+   * did before #4168: the apply job in place of the record job. Default
+   * false, so a merge deploys nothing. `waveGate` needs it.
+   */
+  applyOnMerge?: boolean;
   /**
    * Stream each job's run events (#4007): `--events-json` on both commands,
    * and `CHANT_RUN_EVENTS_DIR` set to {@link PR_LOOP_EVENTS_DIR}. Default false.
@@ -125,6 +169,12 @@ export interface PrLoopPipelineOptions {
    * `npm run build`. Setting it turns `build` on.
    */
   buildCommand?: string;
+  /**
+   * A gate per wave on merge (#4003): the apply runs `pr-apply --wave-gate
+   * <waveGate>`, a wave at a time, and a generator writes one apply job per
+   * wave. Set from `--wave-gate` beside `--pr-loop` ({@link prLoopWithWaves}).
+   */
+  waveGate?: string;
   /**
    * Which GitHub-shaped forge the workflow is for. Set by the forgejo
    * generator, which reuses the github one; a caller never needs to.
@@ -134,8 +184,8 @@ export interface PrLoopPipelineOptions {
 
 /** One job's command and the forge values it reads, as environment variables for its step. */
 export interface PrLoopJob {
-  /** `plan` or `apply`. */
-  jobName: "plan" | "apply";
+  /** `plan`, `apply` or `record` (#4168). */
+  jobName: "plan" | "apply" | "record";
   /** The command line. Reads `$BASE_SHA` and, for the plan, `$PR_NUMBER`. */
   command: string;
   /**
@@ -148,6 +198,17 @@ export interface PrLoopJob {
   setup?: string[];
   /** With `build` (#4088): the build line and the lint line, run in this order before the command. */
   build?: string[];
+  /** With `waveGate` (#4003): the wave a generated apply job runs, 1-based. */
+  wave?: number;
+  /**
+   * What the generated job runs in place of `command` (#4156): `chant ci run
+   * <job> --in-place` with the same environment, gate, forge, events and
+   * report URL, which runs `command` and records the run. `env` is the
+   * job's `env` and, on GitHub and Forgejo, `CHANT_RUNNER_KEY` from the
+   * repository secret of that name. GitLab hands its CI/CD variables to a
+   * job itself.
+   */
+  run: { command: string; env: Record<string, string> };
 }
 
 /** The lines `build` (#4088) runs before a job's command: the build, then the lint. Empty without the option. */
@@ -157,9 +218,10 @@ export function prLoopBuildLines(env: string, options: PrLoopPipelineOptions = {
 }
 
 /**
- * The two jobs for `forge`. `member` is the workspace member the pipeline is
- * generated for; the commands then run in its directory, so `--output` is
- * relative to it.
+ * The jobs for `forge`: plan, apply and record, in that order. A generator
+ * writes the plan and, on merge, {@link prLoopMergeJob}'s choice of the
+ * other two. `member` is the workspace member the pipeline is generated for;
+ * the commands then run in its directory, so `--output` is relative to it.
  */
 export function prLoopJobs(forge: ForgeKind, env: string, options: PrLoopPipelineOptions = {}, member?: string): PrLoopJob[] {
   const gate = options.gate ?? PR_APPLY_GATE;
@@ -176,29 +238,99 @@ export function prLoopJobs(forge: ForgeKind, env: string, options: PrLoopPipelin
     ...(github ? { GITHUB_TOKEN: GITHUB_JOB_TOKEN } : {}),
     ...(options.events ? { CHANT_RUN_EVENTS_DIR: PR_LOOP_EVENTS_DIR } : {}),
   };
+  // #4156: the flags `chant ci run` rebuilds `command` from. It finds the member from the directory it runs in.
+  const ciRun = (job: PrLoopJob["jobName"]): string[] => [
+    "chant", "ci", "run", job, "--in-place", ...(job === "plan" ? ["--no-push"] : []),
+    "--base", '"$BASE_SHA"', ...(job === "plan" ? ["--pr", '"$PR_NUMBER"'] : []),
+    "--env", env, "--gate", gate, "--forge", forge,
+    ...(job !== "record" && options.waveGate ? ["--wave-gate", options.waveGate] : []),
+    ...(job !== "plan" && options.branch ? ["--branch", JSON.stringify(options.branch)] : []),
+    ...(job === "apply" && options.requireReview === true ? ["--require-review"] : []),
+    ...(job !== "plan" && options.requireRunnerStart === true ? ["--require-runner-start"] : []),
+    ...(options.events ? ["--events-json"] : []),
+    ...(options.reportUrl ? ["--report-url", JSON.stringify(options.reportUrl)] : []),
+  ];
+  const runEnv = (env: Record<string, string>): Record<string, string> => (github ? { ...env, [RUNNER_KEY_ENV]: `\${{ secrets.${RUNNER_KEY_ENV} }}` } : env);
+  const planEnv = github
+    ? { BASE_SHA: "${{ github.event.pull_request.base.sha }}", PR_NUMBER: "${{ github.event.pull_request.number }}", ...jobEnv }
+    : { BASE_SHA: "$CI_MERGE_REQUEST_DIFF_BASE_SHA", PR_NUMBER: "$CI_MERGE_REQUEST_IID", ...jobEnv };
+  const applyEnv = github ? { BASE_SHA: "${{ github.event.before }}", ...jobEnv } : { BASE_SHA: "$CI_COMMIT_BEFORE_SHA", ...jobEnv };
   return [
     {
       jobName: "plan",
-      command: ["chant", "components", "pr-plan", "--base", '"$BASE_SHA"', "--pr", '"$PR_NUMBER"', ...common].join(" "),
-      env: github
-        ? { BASE_SHA: "${{ github.event.pull_request.base.sha }}", PR_NUMBER: "${{ github.event.pull_request.number }}", ...jobEnv }
-        : { BASE_SHA: "$CI_MERGE_REQUEST_DIFF_BASE_SHA", PR_NUMBER: "$CI_MERGE_REQUEST_IID", ...jobEnv },
+      // With `waveGate` the plan's note says the later waves may stop at their own gates (#4003).
+      command: ["chant", "components", "pr-plan", "--base", '"$BASE_SHA"', "--pr", '"$PR_NUMBER"', ...common, ...(options.waveGate ? ["--wave-gate", options.waveGate] : [])].join(" "),
+      env: planEnv,
       ...build,
+      run: { command: ciRun("plan").join(" "), env: runEnv(planEnv) },
     },
     {
       jobName: "apply",
       command: [
         "chant", "components", "pr-apply", "--base", '"$BASE_SHA"', ...common,
-        ...(options.requireReview === false ? [] : ["--require-review"]),
+        ...(options.requireReview === true ? ["--require-review"] : []),
+        ...(options.waveGate ? ["--wave-gate", options.waveGate] : []),
         "--resume", PR_APPLY_RECORD,
       ].join(" "),
-      env: github ? { BASE_SHA: "${{ github.event.before }}", ...jobEnv } : { BASE_SHA: "$CI_COMMIT_BEFORE_SHA", ...jobEnv },
-      ...(github ? {} : { setup: [gitlabBaseFallback(options.branch)] }),
+      env: applyEnv,
+      setup: [github ? githubBaseFallback(options.branch) : gitlabBaseFallback(options.branch)],
+      ...build,
+      run: { command: ciRun("apply").join(" "), env: runEnv(applyEnv) },
+    },
+    {
+      jobName: "record",
+      command: ["chant", "components", "pr-record", "--base", '"$BASE_SHA"', ...common].join(" "),
+      env: applyEnv,
+      setup: [github ? githubBaseFallback(options.branch) : gitlabBaseFallback(options.branch)],
       ...build,
+      run: { command: ciRun("record").join(" "), env: runEnv(applyEnv) },
     },
   ];
 }
 
+/** The job a push to the target branch runs (#4168): `record`, or `apply` when the pipeline opts into apply on merge. */
+export function prLoopMergeJob(jobs: readonly PrLoopJob[], options: PrLoopPipelineOptions = {}): PrLoopJob {
+  return jobs.find((j) => j.jobName === (options.applyOnMerge ? "apply" : "record"))!;
+}
+
+/**
+ * The pull-request options with `--wave-gate` beside `--pr-loop` (#4003):
+ * the apply gets a gate per wave. A canary or a fixed base is refused, since
+ * the pull request's waves are its derivation's and each push is measured
+ * from the commit before it.
+ */
+export function prLoopWithWaves(prLoop: PrLoopPipelineOptions, gatedWaves?: GatedWavePipelineOptions): PrLoopPipelineOptions {
+  if (!gatedWaves) return prLoop;
+  if (!prLoop.applyOnMerge) {
+    throw new Error("--wave-gate beside --pr-loop gates the apply on merge, so it needs --apply-on-merge (#4168); without it a merge records the plan and a release deploys it");
+  }
+  if (gatedWaves.canary?.length) throw new Error("a pull-request pipeline's waves are the change's derivation, so it takes no --canary; drop --canary");
+  if (gatedWaves.base !== undefined) throw new Error("a pull-request pipeline measures each push from the commit before it, so it takes no --base; drop --base");
+  return { ...prLoop, waveGate: gatedWaves.gate };
+}
+
+/** The name of the apply job for wave `wave` (#4003). */
+export function prApplyWaveJobName(wave: number): string {
+  return `apply-wave-${wave}`;
+}
+
+/**
+ * One apply job per wave of the component graph (#4003), each `apply`'s
+ * command with `--wave <k>`. A change selects a subset, which never layers
+ * deeper than the graph, so a job past the change's last wave finds nothing
+ * left and exits 0.
+ */
+export function prLoopWaveJobs(components: DriverComponent[], apply: PrLoopJob): PrLoopJob[] {
+  const count = Math.max(1, layerWaves(components.map((c) => ({ name: c.name, dependsOn: c.dependsOn ?? [] }))).length);
+  return Array.from({ length: count }, (_, i) => ({
+    ...apply,
+    command: `${apply.command} --wave ${i + 1}`,
+    wave: i + 1,
+    // #4156: the job runs it through chant ci run, which appends the same --wave to pr-apply.
+    run: { ...apply.run, command: `${apply.run.command} --wave ${i + 1}` },
+  }));
+}
+
 /**
  * The concurrency group (GitHub, Forgejo) or resource group (GitLab) that
  * keeps one apply at a time per environment, and per member in a workspace.
@@ -214,6 +346,11 @@ export function prApplyGroup(env: string, member?: string): string {
   return member ? `chant-apply.${member}.${env}` : `chant-apply-${env}`;
 }
 
+/** The group that keeps one record job at a time per environment and member (#4168), named as {@link prApplyGroup} names the apply's. */
+export function prRecordGroup(env: string, member?: string): string {
+  return member ? `chant-record.${member}.${env}` : `chant-record-${env}`;
+}
+
 /**
  * The cache key the apply job keeps its attempt record under (#3543), with
  * `commit` the forge's expression for the pushed commit. A push of another
@@ -227,19 +364,38 @@ export function prApplyRecordKey(env: string, commit: string, member?: string):
 }
 
 /**
- * GitLab sets `CI_COMMIT_BEFORE_SHA` to forty zeros on a branch's first push.
- * The line replaces it with the merge request's diff base when the pipeline
- * has one, and otherwise with the merge base of the target branch and the
- * pushed commit, or the pushed commit's parent when that is the commit itself.
+ * The shell that settles an unusable push base. `before` is empty or forty
+ * zeros on a branch's first push; then the base is `diffBase` when the forge
+ * gives one, else the merge base of `target` and `commit`, else `commit`'s
+ * parent when the merge base is `commit` itself, else, for a root commit, the
+ * empty tree.
  */
-export function gitlabBaseFallback(branch?: string): string {
-  const target = branch ? JSON.stringify(branch) : "$CI_DEFAULT_BRANCH";
+function pushBaseFallback(target: string, commit: string, diffBase?: string): string {
+  const fromBranch =
+    `git fetch origin ${target} && BASE_SHA="$(git merge-base FETCH_HEAD "${commit}")"; ` +
+    `if [ "$BASE_SHA" = "${commit}" ]; then BASE_SHA="$(git rev-parse --verify --quiet "${commit}^" || echo ${EMPTY_TREE_SHA})"; fi; `;
   return (
     'if [ -z "$BASE_SHA" ] || [ "$BASE_SHA" = "0000000000000000000000000000000000000000" ]; then ' +
-    'BASE_SHA="${CI_MERGE_REQUEST_DIFF_BASE_SHA:-}"; ' +
-    'if [ -z "$BASE_SHA" ]; then ' +
-    `git fetch origin ${target} && BASE_SHA="$(git merge-base FETCH_HEAD "$CI_COMMIT_SHA")"; ` +
-    'if [ "$BASE_SHA" = "$CI_COMMIT_SHA" ]; then BASE_SHA="$(git rev-parse "$CI_COMMIT_SHA^")"; fi; ' +
-    "fi; fi; export BASE_SHA"
+    (diffBase ? `BASE_SHA="\${${diffBase}:-}"; if [ -z "$BASE_SHA" ]; then ${fromBranch}fi; ` : fromBranch) +
+    "fi; export BASE_SHA"
   );
 }
+
+/**
+ * GitLab sets `CI_COMMIT_BEFORE_SHA` to forty zeros on a branch's first push.
+ * The line replaces it with the merge request's diff base when the pipeline
+ * has one, and otherwise as {@link pushBaseFallback} does.
+ */
+export function gitlabBaseFallback(branch?: string): string {
+  return pushBaseFallback(branch ? JSON.stringify(branch) : "$CI_DEFAULT_BRANCH", "$CI_COMMIT_SHA", "CI_MERGE_REQUEST_DIFF_BASE_SHA");
+}
+
+/**
+ * GitHub and Forgejo set `github.event.before` to forty zeros on a branch's
+ * first push (#4004). The line replaces it as {@link pushBaseFallback} does,
+ * with the target branch `main` unless the pipeline names another, the
+ * generators' default.
+ */
+export function githubBaseFallback(branch?: string): string {
+  return pushBaseFallback(JSON.stringify(branch ?? "main"), "$GITHUB_SHA");
+}