@intentius/chant 0.124.33 → 0.124.35

package/dist/workspace/__fixtures__/contract-repo.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"contract-repo.d.ts","sourceRoot":"","sources":["../../../src/workspace/__fixtures__/contract-repo.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAMH,OAAO,OAAO,MAAM,eAAe,CAAC;AAGpC,6CAA6C;AAC7C,eAAO,MAAM,IAAI,QAAwE,CAAC;AAI1F,gGAAgG;AAChG,wBAAgB,YAAY,IAAI,IAAI,CAEnC;AAED,wBAAgB,UAAU,CAAC,MAAM,SAAoB,GAAG,MAAM,CAI7D;AAED,wBAAgB,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,CAM1D;AAED,iFAAiF;AACjF,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,GAAG,IAAI,CAO7G;AAED,uFAAuF;AACvF,wBAAgB,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,EAAE,MAAM,UAAQ,GAAG,MAAM,CAS3G;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,MAAM,EAAE,MAAM,SAAyB,GAAG,MAAM,MAAM,CAQ9F;AAED,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,SAAS,GAAG,MAAM,CAIhE;AAED,QAAA,MAAM,GAAG,SAAiD,CAAC;AAE3D,4EAA4E;AAC5E,wBAAgB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG;IAAE,QAAQ,EAAE,UAAU,CAAC,OAAO,GAAG,CAAC,OAAO,CAAC,CAAC;IAAC,WAAW,CAAC,GAAG,EAAE,OAAO,GAAG,IAAI,CAAA;CAAE,CAStH;AAED,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAEnD;AAED,eAAO,MAAM,WAAW,YAAa,OAAO,EAAE,UAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,WACL,CAAC;AAE1E;;;GAGG;AACH,eAAO,MAAM,gBAAgB,6XAU5B,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,sZASjC,CAAC"}
+{"version":3,"file":"contract-repo.d.ts","sourceRoot":"","sources":["../../../src/workspace/__fixtures__/contract-repo.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAMH,OAAO,OAAO,MAAM,eAAe,CAAC;AAGpC,6CAA6C;AAC7C,eAAO,MAAM,IAAI,QAAwE,CAAC;AAI1F,gGAAgG;AAChG,wBAAgB,YAAY,IAAI,IAAI,CAEnC;AAED,wBAAgB,UAAU,CAAC,MAAM,SAAoB,GAAG,MAAM,CAI7D;AAED,wBAAgB,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,CAM1D;AAED,iFAAiF;AACjF,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,GAAG,IAAI,CAO7G;AAED,uFAAuF;AACvF,wBAAgB,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,EAAE,MAAM,UAAQ,GAAG,MAAM,CAS3G;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,MAAM,EAAE,MAAM,SAAyB,GAAG,MAAM,MAAM,CAiB9F;AAED,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,SAAS,GAAG,MAAM,CAIhE;AAED,QAAA,MAAM,GAAG,SAAiD,CAAC;AAE3D,4EAA4E;AAC5E,wBAAgB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG;IAAE,QAAQ,EAAE,UAAU,CAAC,OAAO,GAAG,CAAC,OAAO,CAAC,CAAC;IAAC,WAAW,CAAC,GAAG,EAAE,OAAO,GAAG,IAAI,CAAA;CAAE,CAStH;AAED,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAEnD;AAED,eAAO,MAAM,WAAW,YAAa,OAAO,EAAE,UAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,WACL,CAAC;AAE1E;;;GAGG;AACH,eAAO,MAAM,gBAAgB,6XAU5B,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,sZASjC,CAAC"}

package/dist/workspace/__fixtures__/contract-repo.js

@@ -22,7 +22,7 @@ export function scratchDir(prefix = "chant-contract-") {
     return d;
 }
 export function git(cwd, ...args) {
-    return execFileSync("git", ["-c", "user.name=t", "-c", "user.email=t@example.com", "-c", "commit.gpgsign=false", ...args], {
+    return execFileSync("git", ["-c", "user.name=t", "-c", "user.email=t@example.com", "-c", "commit.gpgsign=false", "-c", "gc.auto=0", "-c", "maintenance.auto=false", ...args], {
         cwd,
         encoding: "utf-8",
         stdio: ["ignore", "pipe", "pipe"],
@@ -61,7 +61,18 @@ export function repoFixture(build, prefix = "chant-contract-copy-") {
         if (template === undefined || !existsSync(template))
             template = build();
         const root = scratchDir(prefix);
-        cpSync(template, root, { recursive: true });
+        // A commit can leave a detached `git gc --auto` or maintenance run moving
+        // the template's objects, and a copy that meets it fails with ENOENT on
+        // .git/objects. Copy once more after it settles.
+        try {
+            cpSync(template, root, { recursive: true });
+        }
+        catch (err) {
+            if (err.code !== "ENOENT")
+                throw err;
+            rmSync(root, { recursive: true, force: true });
+            cpSync(template, root, { recursive: true });
+        }
         return root;
     };
 }

package/dist/workspace/check.schema.json

@@ -332,7 +332,16 @@
 
             "security-runner-start-no-role",
 
-            "security-trust-unreadable"
+            "security-trust-unreadable",
+            "ci-workflow-green-undeclared",
+            "ci-workflow-no-pre-merge",
+            "ci-workflow-apply-in-green",
+            "ci-workflow-no-components",
+            "ci-workflow-no-environments",
+            "ci-workflow-ungated-env",
+            "ci-workflow-pipeline-missing",
+            "ci-workflow-pipeline-differs",
+            "ci-workflow-publish-missing"
           ],
           "description": "For WSP001: why the declaration can't be read. For WSP121 to WSP127, the box finding (#2726, #2727, #2780, #2850). For WSP117, work-acceptance-unmet (#2772). For WSP118, flag-stale (#4024). For WSP131 to WSP133, the diagram finding (#2764)."
         }
@@ -445,7 +454,16 @@
 
             "security-runner-start-no-role",
 
-            "security-trust-unreadable"
+            "security-trust-unreadable",
+            "ci-workflow-green-undeclared",
+            "ci-workflow-no-pre-merge",
+            "ci-workflow-apply-in-green",
+            "ci-workflow-no-components",
+            "ci-workflow-no-environments",
+            "ci-workflow-ungated-env",
+            "ci-workflow-pipeline-missing",
+            "ci-workflow-pipeline-differs",
+            "ci-workflow-publish-missing"
           ],
           "description": "For WSP001: why the declaration can't be read. For WSP121 to WSP127, the box finding (#2726, #2727, #2780, #2850). For WSP117, work-acceptance-unmet (#2772). For WSP118, flag-stale (#4024). For WSP131 to WSP133, the diagram finding (#2764)."
         },

package/dist/workspace/checks/ci-workflow.d.ts

@@ -0,0 +1,17 @@
+/**
+ * WSP151 (#4168 step 6): what a member under `ci.workflow` still lacks.
+ *
+ * A declaration that names no workflow gets no finding from this file. The
+ * requirements and their codes are {@link CI_WORKFLOW_REQUIREMENTS}
+ * (../ci-workflow.ts). Like the security checklists (./security.ts), the
+ * check reads files and never runs them: `chant.config.ts` for the
+ * environments (its literal `environments`, as `workspace status` reads it),
+ * `*.component.ts` for components and gates, and the forge pipeline files for
+ * the jobs. A generated file that differs from what its generator writes is
+ * WSP101 to WSP106's to report; this check asks only whether the jobs the
+ * workflow needs are there.
+ */
+import type { WorkspaceCheck } from "../checks.js";
+export declare const WSP_CI_WORKFLOW = "WSP151";
+export declare const CI_WORKFLOW_CHECKS: readonly WorkspaceCheck[];
+//# sourceMappingURL=ci-workflow.d.ts.map

package/dist/workspace/checks/ci-workflow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ci-workflow.d.ts","sourceRoot":"","sources":["../../../src/workspace/checks/ci-workflow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAuB,MAAM,WAAW,CAAC;AAQrE,eAAO,MAAM,eAAe,WAAW,CAAC;AAaxC,eAAO,MAAM,kBAAkB,EAAE,SAAS,cAAc,EAmGvD,CAAC"}

package/dist/workspace/checks/ci-workflow.js

@@ -0,0 +1,130 @@
+/**
+ * WSP151 (#4168 step 6): what a member under `ci.workflow` still lacks.
+ *
+ * A declaration that names no workflow gets no finding from this file. The
+ * requirements and their codes are {@link CI_WORKFLOW_REQUIREMENTS}
+ * (../ci-workflow.ts). Like the security checklists (./security.ts), the
+ * check reads files and never runs them: `chant.config.ts` for the
+ * environments (its literal `environments`, as `workspace status` reads it),
+ * `*.component.ts` for components and gates, and the forge pipeline files for
+ * the jobs. A generated file that differs from what its generator writes is
+ * WSP101 to WSP106's to report; this check asks only whether the jobs the
+ * workflow needs are there.
+ */
+import { appliesOnMerge, STUB_MARKER, workflowOf } from "../ci-workflow.js";
+import { matchesCheckRun } from "../ci-green.js";
+import { staticPromotionOrder } from "../promotion-order.js";
+import { joinPath } from "../tree.js";
+import { allPipelineFiles, commandLines, componentFiles, read } from "./security.js";
+export const WSP_CI_WORKFLOW = "WSP151";
+const memberDir = (dir) => (dir === "." ? "" : dir);
+const PLAN = /\bci\s+run\s+plan\b|\bcomponents\s+pr-plan\b/;
+const RECORD = /\bci\s+run\s+record\b|\bcomponents\s+pr-record\b/;
+const APPLY = /\bci\s+run\s+apply\b|\bcomponents\s+pr-apply\b/;
+const TICK = /\bci\s+tick\b/;
+const PUBLISH = /\brelease\s+publish\b/;
+/** The apply job names a required phase could match. */
+const APPLY_JOB_NAMES = ["apply", "pr-apply"];
+export const CI_WORKFLOW_CHECKS = [
+    {
+        id: WSP_CI_WORKFLOW,
+        name: "ci-workflow",
+        description: "Under ci.workflow: ci.green with pre-merge phases and no apply job required, each member with a component, environments and a gate on each component, and pipeline files that plan, record (or apply under apply on merge), tick and publish.",
+        severity: "warning",
+        configurable: true,
+        check(ctx) {
+            const d = ctx.declaration;
+            const under = d.members
+                .map((m) => ({ member: m, workflow: workflowOf(d, m) }))
+                .filter((u) => u.workflow !== null)
+                // The top level's workflow covers the members that build with chant; a member that names one itself is held to it.
+                .filter((u) => u.member.ciWorkflow !== null || ctx.tree.stat(joinPath(memberDir(u.member.dir), "chant.config.ts")) === "file");
+            if (under.length === 0 && !d.ci?.workflow)
+                return [];
+            const pointer = d.ci?.workflow ? "/ci/workflow" : `${under[0].member.pointer}/ci/workflow`;
+            const out = [];
+            const finding = (code, message, at = {}) => {
+                out.push({
+                    checkId: this.id,
+                    severity: this.severity,
+                    code,
+                    message: `${code}: ${message}`,
+                    pointer: at.pointer ?? pointer,
+                    ...(at.entity !== undefined ? { entity: at.entity } : {}),
+                    ...(at.treeFile !== undefined ? { treeFile: at.treeFile, line: at.line ?? 1, column: 1 } : {}),
+                });
+            };
+            const green = d.ci?.green ?? null;
+            if (!green) {
+                finding("ci-workflow-green-undeclared", "the workspace follows a ci.workflow and declares no ci.green, so no commit gets a verdict and no release can be cut; run chant ci init or add a ci.green block");
+            }
+            else {
+                if ((green.preMerge ?? []).length === 0) {
+                    finding("ci-workflow-no-pre-merge", "ci.green.preMerge names no phase, so nothing says which checks run before the branch moves; name the quick ones", { pointer: green.pointer });
+                }
+                for (const name of green.require) {
+                    const phase = green.phases.find((p) => p.name === name);
+                    const hit = phase?.runs.find((pattern) => APPLY_JOB_NAMES.some((job) => matchesCheckRun(pattern, job)));
+                    if (phase && hit) {
+                        finding("ci-workflow-apply-in-green", `the required phase ${name} matches the apply job with ${JSON.stringify(hit)}, so an apply that waits for a green commit would wait on itself; drop the pattern`, { pointer: phase.pointer });
+                    }
+                }
+            }
+            for (const { member } of under) {
+                const dir = memberDir(member.dir);
+                const components = componentFiles(ctx.tree, dir);
+                if (components.length === 0) {
+                    finding("ci-workflow-no-components", `member ${member.name} declares no component, so nothing of it can be cut or promoted; chant ci init writes a stub`, { pointer: member.pointer, entity: member.name });
+                }
+                else if (components.every((f) => (read(ctx.tree, f) ?? "").includes(STUB_MARKER))) {
+                    finding("ci-workflow-no-components", `member ${member.name}'s only component is the stub chant ci init wrote (${components[0]}); say how it is built and deployed, then delete its ${STUB_MARKER} line`, { pointer: member.pointer, entity: member.name, treeFile: components[0] });
+                }
+                const configPath = joinPath(dir, "chant.config.ts");
+                const config = read(ctx.tree, configPath);
+                // A config whose environments aren't literals can't be read without running it; say nothing rather than guess.
+                const order = config === null ? [] : staticPromotionOrder(config);
+                if (order !== undefined && order.length === 0) {
+                    finding("ci-workflow-no-environments", `member ${member.name}'s chant.config.ts declares no environments, so a release has nowhere to be promoted to`, { pointer: member.pointer, entity: member.name, ...(config !== null ? { treeFile: configPath } : {}) });
+                }
+                for (const file of components) {
+                    const text = read(ctx.tree, file) ?? "";
+                    if (/\bgate\s*\(|kind\s*:\s*["']gate["']/.test(text))
+                        continue;
+                    const last = order && order.length > 0 ? order[order.length - 1].name : "the last environment";
+                    finding("ci-workflow-ungated-env", `${file} has no gate, so a promote to ${last} waits on no approval; add a gate() step`, { pointer: member.pointer, entity: member.name, treeFile: file });
+                }
+            }
+            const files = allPipelineFiles(ctx);
+            const has = (re) => files.some((f) => f.lines.some((l) => re.test(l)));
+            const applyOnMerge = under.some((u) => appliesOnMerge(u.workflow)) || (d.ci?.workflow ? appliesOnMerge(d.ci.workflow) : false);
+            const missing = [
+                ...(has(PLAN) ? [] : ["a plan job (ci run plan)"]),
+                // #4168 step 9: every merge is recorded, apply on merge or not, since the apply reads the merge records.
+                ...(has(RECORD) ? [] : ["a record job (ci run record)"]),
+                ...(has(TICK) ? [] : ["chant ci tick"]),
+            ];
+            if (missing.length > 0) {
+                finding("ci-workflow-pipeline-missing", `no pipeline file runs ${missing.join(", ")}; generate them with chant build --components --generate <forge> --pr-loop and chant ci workflow`);
+            }
+            if (!applyOnMerge) {
+                for (const l of commandLines(ctx, APPLY)) {
+                    finding("ci-workflow-pipeline-differs", `${l.path} applies on merge, and the workflow is trunk-curated, where a merge records the plan and deploys nothing; regenerate without --apply-on-merge, or set ci.workflow to trunk-curated+apply-on-merge`, { treeFile: l.path, line: l.line });
+                }
+            }
+            else if (!has(APPLY) && has(RECORD)) {
+                const l = commandLines(ctx, RECORD)[0];
+                finding("ci-workflow-pipeline-differs", `${l.path} records on merge, and the workflow is trunk-curated+apply-on-merge; regenerate with --apply-on-merge`, { treeFile: l.path, line: l.line });
+            }
+            else {
+                // #4168 step 9: an apply measured from a push's base applies each merge; the workflow applies green commits.
+                for (const l of commandLines(ctx, APPLY).filter((c) => /--base\b/.test(c.text) || (/\bcomponents\s+pr-apply\b/.test(c.text) && !/--green\b/.test(c.text)))) {
+                    finding("ci-workflow-pipeline-differs", `${l.path} applies each merge, and under trunk-curated+apply-on-merge the apply applies the newest green commit; regenerate with --apply-on-merge`, { treeFile: l.path, line: l.line });
+                }
+            }
+            if (!has(PUBLISH)) {
+                finding("ci-workflow-publish-missing", "no pipeline file runs chant release publish, so a cut release is never published; generate one with chant release workflow");
+            }
+            return out;
+        },
+    },
+];

package/dist/workspace/checks/security.d.ts

@@ -23,7 +23,8 @@
  * pipeline file that runs `chant release publish`, `chant ci tick` or
  * `chant components pr-apply`.
  */
-import type { WorkspaceCheck } from "../checks.js";
+import type { WorkspaceCheck, WorkspaceCheckContext } from "../checks.js";
+import { type WorkspaceTree } from "../tree.js";
 /** The read contract's codes for the security findings, carried as `code` on each. */
 export declare const SECURITY_FINDING_CODES: readonly ["security-signers-missing", "security-release-gate-missing", "security-publish-allows-unsigned", "security-sbom-disabled", "security-sbom-unsourced", "security-publish-no-provenance", "security-component-no-sbom", "security-component-no-verify", "security-signed-since-unset", "security-runner-untrusted", "security-tick-no-key", "security-review-not-required", "security-attribution-any", "security-gate-unsigned", "security-runner-start-no-key", "security-runner-start-no-role", "security-trust-unreadable"];
 export declare const WSP_SECURITY_VERIFIED_RELEASES = "WSP161";
@@ -31,5 +32,19 @@ export declare const WSP_SECURITY_SUPPLY_CHAIN = "WSP162";
 export declare const WSP_SECURITY_WHO_RAN_IT = "WSP163";
 export declare const WSP_SECURITY_REVIEW_RULES = "WSP164";
 export declare const WSP_SECURITY_ISOLATED_RUNNERS = "WSP165";
+export declare function read(tree: WorkspaceTree, path: string): string | null;
+/** Every pipeline file of the workspace: its root's, and each member's. */
+export declare function allPipelineFiles(ctx: WorkspaceCheckContext): {
+    path: string;
+    lines: string[];
+}[];
+/** The lines of the pipeline files that run a chant command, `command` naming it, such as `release publish`. */
+export declare function commandLines(ctx: WorkspaceCheckContext, command: RegExp): {
+    path: string;
+    line: number;
+    text: string;
+}[];
+/** The member's `*.component.ts` files, walked a few levels down, past node_modules and build output. */
+export declare function componentFiles(tree: WorkspaceTree, dir: string, depth?: number): string[];
 export declare const SECURITY_CHECKS: readonly WorkspaceCheck[];
 //# sourceMappingURL=security.d.ts.map

package/dist/workspace/checks/security.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"security.d.ts","sourceRoot":"","sources":["../../../src/workspace/checks/security.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,KAAK,EAAE,cAAc,EAA8C,MAAM,WAAW,CAAC;AAU5F,sFAAsF;AACtF,eAAO,MAAM,sBAAsB,ygBAkBO,CAAC;AAI3C,eAAO,MAAM,8BAA8B,WAAW,CAAC;AACvD,eAAO,MAAM,yBAAyB,WAAW,CAAC;AAClD,eAAO,MAAM,uBAAuB,WAAW,CAAC;AAChD,eAAO,MAAM,yBAAyB,WAAW,CAAC;AAClD,eAAO,MAAM,6BAA6B,WAAW,CAAC;AA0GtD,eAAO,MAAM,eAAe,EAAE,SAAS,cAAc,EAuIpD,CAAC"}
+{"version":3,"file":"security.d.ts","sourceRoot":"","sources":["../../../src/workspace/checks/security.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,qBAAqB,EAAuB,MAAM,WAAW,CAAC;AAI5F,OAAO,EAAY,KAAK,aAAa,EAAE,MAAM,SAAS,CAAC;AAMvD,sFAAsF;AACtF,eAAO,MAAM,sBAAsB,ygBAkBO,CAAC;AAI3C,eAAO,MAAM,8BAA8B,WAAW,CAAC;AACvD,eAAO,MAAM,yBAAyB,WAAW,CAAC;AAClD,eAAO,MAAM,uBAAuB,WAAW,CAAC;AAChD,eAAO,MAAM,yBAAyB,WAAW,CAAC;AAClD,eAAO,MAAM,6BAA6B,WAAW,CAAC;AAsBtD,wBAAgB,IAAI,CAAC,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAOrE;AAkBD,2EAA2E;AAC3E,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,qBAAqB,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,EAAE,CAGhG;AAED,gHAAgH;AAChH,wBAAgB,YAAY,CAAC,GAAG,EAAE,qBAAqB,EAAE,OAAO,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EAAE,CAExH;AAED,yGAAyG;AACzG,wBAAgB,cAAc,CAAC,IAAI,EAAE,aAAa,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,SAAI,GAAG,MAAM,EAAE,CAQpF;AAuCD,eAAO,MAAM,eAAe,EAAE,SAAS,cAAc,EAuIpD,CAAC"}

package/dist/workspace/checks/security.js

@@ -70,7 +70,7 @@ function groupPointer(declaration, group) {
     const m = declaration.members.find((e) => e.security.includes(group));
     return m ? `${m.pointer}/security/${m.security.indexOf(group)}` : "/security";
 }
-function read(tree, path) {
+export function read(tree, path) {
     if (tree.stat(path) !== "file")
         return null;
     try {
@@ -99,16 +99,16 @@ function pipelineFiles(tree, dir) {
     return out;
 }
 /** Every pipeline file of the workspace: its root's, and each member's. */
-function allPipelineFiles(ctx) {
+export function allPipelineFiles(ctx) {
     const dirs = new Set(["", ...ctx.declaration.members.map((m) => memberDir(m.dir))]);
     return [...dirs].flatMap((d) => pipelineFiles(ctx.tree, d));
 }
 /** The lines of the pipeline files that run a chant command, `command` naming it, such as `release publish`. */
-function commandLines(ctx, command) {
+export function commandLines(ctx, command) {
     return allPipelineFiles(ctx).flatMap((f) => f.lines.flatMap((text, i) => (command.test(text) ? [{ path: f.path, line: i + 1, text }] : [])));
 }
 /** The member's `*.component.ts` files, walked a few levels down, past node_modules and build output. */
-function componentFiles(tree, dir, depth = 4) {
+export function componentFiles(tree, dir, depth = 4) {
     const out = [];
     for (const e of tree.list(dir) ?? []) {
         if (e.type === "dir") {

package/dist/workspace/checks.d.ts

@@ -37,7 +37,7 @@
  * | WSP126, WSP127 | box intent: the decision record a box names exists, and constrains a member or path of this workspace (#2850, #2857) |
  * | WSP141, WSP142 | member links resolved against a live read, with `--live` (#2549) |
  * | WSP131 to WSP133 | diagram artifacts: source and render exist, a recorded source hash still matches (#2764) |
- * | WSP151 | reserved for the `ci.workflow` preset (#4168 step 6) |
+ * | WSP151 | what a member under `ci.workflow` still lacks (#4168 step 6) |
  * | WSP161 to WSP165 | the security groups the declaration opts into: what each still lacks (#4168 step 7) |
  */
 import type { LintDiagnostic, LintRule, Severity } from "../lint/rule.js";

package/dist/workspace/checks.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"checks.d.ts","sourceRoot":"","sources":["../../src/workspace/checks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAIH,OAAO,KAAK,EAAE,cAAc,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACvE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAsD,KAAK,WAAW,EAAkC,KAAK,aAAa,EAAE,MAAM,eAAe,CAAC;AACzJ,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAEjD,OAAO,EAAiE,KAAK,eAAe,EAAE,KAAK,YAAY,EAAE,MAAM,SAAS,CAAC;AACjI,OAAO,EAA6D,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpH,OAAO,EAAuB,KAAK,aAAa,EAAE,MAAM,QAAQ,CAAC;AAEjE,OAAO,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACrD,OAAO,EAA0C,KAAK,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACrG,OAAO,EAAoC,KAAK,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAC5F,OAAO,EAAwC,KAAK,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACpG,OAAO,EAAoC,KAAK,aAAa,EAAE,MAAM,eAAe,CAAC;AACrF,OAAO,EAAiB,KAAK,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAInE,OAAO,EAAqB,KAAK,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACxE,OAAO,EAAqB,KAAK,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACzE,OAAO,EAAwB,KAAK,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAEpF;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,6EAA6E;IAC7E,OAAO,CAAC,EAAE,SAAS,iBAAiB,EAAE,CAAC;IACvC,+EAA+E;IAC/E,SAAS,CAAC,EAAE,SAAS,mBAAmB,EAAE,CAAC;IAC3C,kFAAkF;IAClF,SAAS,CAAC,EAAE,SAAS,kBAAkB,EAAE,CAAC;IAC1C,oFAAoF;IACpF,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,oGAAoG;IACpG,aAAa,CAAC,EAAE,SAAS,YAAY,EAAE,CAAC;IACxC,8EAA8E;IAC9E,IAAI,CAAC,EAAE,aAAa,CAAC;IACrB,uFAAuF;IACvF,UAAU,CAAC,EAAE,SAAS,iBAAiB,EAAE,CAAC;IAC1C,kHAAkH;IAClH,cAAc,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;CAC5D;AAED,0CAA0C;AAC1C,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,WAAW,CAAC;IACzB,IAAI,EAAE,aAAa,CAAC;IACpB,MAAM,EAAE,aAAa,EAAE,CAAC;IACxB,KAAK,EAAE,YAAY,CAAC;IACpB,+CAA+C;IAC/C,YAAY,EAAE,eAAe,EAAE,CAAC;IAChC,yGAAyG;IACzG,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,mEAAmE;IACnE,aAAa,CAAC,EAAE,eAAe,EAAE,CAAC;IAClC,gDAAgD;IAChD,KAAK,CAAC,EAAE,cAAc,CAAC;CACxB;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAoB,SAAQ,mBAAmB;IAC9D,2CAA2C;IAC3C,OAAO,EAAE,MAAM,CAAC;IAChB,2IAA2I;IAC3I,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,mJAAmJ;IACnJ,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,yEAAyE;IACzE,IAAI,CAAC,EAAE,UAAU,CAAC;CACnB;AAED,MAAM,WAAW,cAAc;IAC7B,mDAAmD;IACnD,EAAE,EAAE,MAAM,CAAC;IACX,kCAAkC;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,QAAQ,CAAC;IACnB,kFAAkF;IAClF,YAAY,EAAE,OAAO,CAAC;IACtB,KAAK,CAAC,GAAG,EAAE,qBAAqB,GAAG,mBAAmB,EAAE,CAAC;CAC1D;AAED,2EAA2E;AAC3E,MAAM,WAAW,gBAAiB,SAAQ,cAAc;IACtD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,mJAAmJ;IACnJ,IAAI,CAAC,EAAE,UAAU,CAAC;CACnB;AAED,MAAM,WAAW,iBAAkB,SAAQ,gBAAgB;IACzD,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,sBAAsB;IACrC,+EAA+E;IAC/E,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,gBAAgB,EAAE,CAAC;IAChC,UAAU,EAAE,iBAAiB,EAAE,CAAC;IAChC,8EAA8E;IAC9E,KAAK,EAAE,YAAY,EAAE,CAAC;IACtB,0FAA0F;IAC1F,IAAI,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,OAAO,EAAE,CAAA;KAAE,CAAC;IACzC,mDAAmD;IACnD,EAAE,EAAE,OAAO,CAAC;CACb;AAqBD,iHAAiH;AACjH,eAAO,MAAM,mBAAmB,WAAW,CAAC;AAE5C,eAAO,MAAM,gBAAgB,EAAE,SAAS,cAAc,EAmMrD,CAAC;AAWF;;;GAGG;AACH,wBAAgB,mBAAmB,IAAI,QAAQ,EAAE,CAShD;AAED,qFAAqF;AACrF,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,qBAAqB,GAAG,mBAAmB,EAAE,CAEpF;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,WAAW,EAAE,WAAW,EACxB,QAAQ,EAAE,mBAAmB,EAAE,GAC9B;IAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IAAC,UAAU,EAAE,CAAC,mBAAmB,GAAG;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,EAAE,CAAA;CAAE,CAkB7F;AAED,MAAM,WAAW,uBAAuB;IACtC;;;;OAIG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,sHAAsH;IACtH,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB;;;;;OAKG;IACH,IAAI,CAAC,EAAE,aAAa,CAAC;IACrB,8FAA8F;IAC9F,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB;;;;;OAKG;IACH,IAAI,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;KAAE,CAAC;CAC3D;AAED;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,OAAO,GAAE;IAAE,aAAa,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,OAAO,CAAC,cAAc,CAAC,CASrJ;AAUD;;;;;;;;GAQG;AACH,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAiB,EAC5C,OAAO,GAAE,uBAA4B,GACpC,OAAO,CAAC,sBAAsB,CAAC,CAqEjC"}
+{"version":3,"file":"checks.d.ts","sourceRoot":"","sources":["../../src/workspace/checks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAIH,OAAO,KAAK,EAAE,cAAc,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACvE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAsD,KAAK,WAAW,EAAkC,KAAK,aAAa,EAAE,MAAM,eAAe,CAAC;AACzJ,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAEjD,OAAO,EAAiE,KAAK,eAAe,EAAE,KAAK,YAAY,EAAE,MAAM,SAAS,CAAC;AACjI,OAAO,EAA6D,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpH,OAAO,EAAuB,KAAK,aAAa,EAAE,MAAM,QAAQ,CAAC;AAEjE,OAAO,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACrD,OAAO,EAA0C,KAAK,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACrG,OAAO,EAAoC,KAAK,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAC5F,OAAO,EAAwC,KAAK,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACpG,OAAO,EAAoC,KAAK,aAAa,EAAE,MAAM,eAAe,CAAC;AACrF,OAAO,EAAiB,KAAK,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAKnE,OAAO,EAAqB,KAAK,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACxE,OAAO,EAAqB,KAAK,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACzE,OAAO,EAAwB,KAAK,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAEpF;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,6EAA6E;IAC7E,OAAO,CAAC,EAAE,SAAS,iBAAiB,EAAE,CAAC;IACvC,+EAA+E;IAC/E,SAAS,CAAC,EAAE,SAAS,mBAAmB,EAAE,CAAC;IAC3C,kFAAkF;IAClF,SAAS,CAAC,EAAE,SAAS,kBAAkB,EAAE,CAAC;IAC1C,oFAAoF;IACpF,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,oGAAoG;IACpG,aAAa,CAAC,EAAE,SAAS,YAAY,EAAE,CAAC;IACxC,8EAA8E;IAC9E,IAAI,CAAC,EAAE,aAAa,CAAC;IACrB,uFAAuF;IACvF,UAAU,CAAC,EAAE,SAAS,iBAAiB,EAAE,CAAC;IAC1C,kHAAkH;IAClH,cAAc,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;CAC5D;AAED,0CAA0C;AAC1C,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,WAAW,CAAC;IACzB,IAAI,EAAE,aAAa,CAAC;IACpB,MAAM,EAAE,aAAa,EAAE,CAAC;IACxB,KAAK,EAAE,YAAY,CAAC;IACpB,+CAA+C;IAC/C,YAAY,EAAE,eAAe,EAAE,CAAC;IAChC,yGAAyG;IACzG,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,mEAAmE;IACnE,aAAa,CAAC,EAAE,eAAe,EAAE,CAAC;IAClC,gDAAgD;IAChD,KAAK,CAAC,EAAE,cAAc,CAAC;CACxB;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAoB,SAAQ,mBAAmB;IAC9D,2CAA2C;IAC3C,OAAO,EAAE,MAAM,CAAC;IAChB,2IAA2I;IAC3I,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,mJAAmJ;IACnJ,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,yEAAyE;IACzE,IAAI,CAAC,EAAE,UAAU,CAAC;CACnB;AAED,MAAM,WAAW,cAAc;IAC7B,mDAAmD;IACnD,EAAE,EAAE,MAAM,CAAC;IACX,kCAAkC;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,QAAQ,CAAC;IACnB,kFAAkF;IAClF,YAAY,EAAE,OAAO,CAAC;IACtB,KAAK,CAAC,GAAG,EAAE,qBAAqB,GAAG,mBAAmB,EAAE,CAAC;CAC1D;AAED,2EAA2E;AAC3E,MAAM,WAAW,gBAAiB,SAAQ,cAAc;IACtD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,mJAAmJ;IACnJ,IAAI,CAAC,EAAE,UAAU,CAAC;CACnB;AAED,MAAM,WAAW,iBAAkB,SAAQ,gBAAgB;IACzD,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,sBAAsB;IACrC,+EAA+E;IAC/E,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,gBAAgB,EAAE,CAAC;IAChC,UAAU,EAAE,iBAAiB,EAAE,CAAC;IAChC,8EAA8E;IAC9E,KAAK,EAAE,YAAY,EAAE,CAAC;IACtB,0FAA0F;IAC1F,IAAI,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,OAAO,EAAE,CAAA;KAAE,CAAC;IACzC,mDAAmD;IACnD,EAAE,EAAE,OAAO,CAAC;CACb;AAqBD,iHAAiH;AACjH,eAAO,MAAM,mBAAmB,WAAW,CAAC;AAE5C,eAAO,MAAM,gBAAgB,EAAE,SAAS,cAAc,EAqMrD,CAAC;AAWF;;;GAGG;AACH,wBAAgB,mBAAmB,IAAI,QAAQ,EAAE,CAShD;AAED,qFAAqF;AACrF,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,qBAAqB,GAAG,mBAAmB,EAAE,CAEpF;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,WAAW,EAAE,WAAW,EACxB,QAAQ,EAAE,mBAAmB,EAAE,GAC9B;IAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IAAC,UAAU,EAAE,CAAC,mBAAmB,GAAG;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,EAAE,CAAA;CAAE,CAkB7F;AAED,MAAM,WAAW,uBAAuB;IACtC;;;;OAIG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,sHAAsH;IACtH,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB;;;;;OAKG;IACH,IAAI,CAAC,EAAE,aAAa,CAAC;IACrB,8FAA8F;IAC9F,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB;;;;;OAKG;IACH,IAAI,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;KAAE,CAAC;CAC3D;AAED;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,OAAO,GAAE;IAAE,aAAa,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,OAAO,CAAC,cAAc,CAAC,CASrJ;AAUD;;;;;;;;GAQG;AACH,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAiB,EAC5C,OAAO,GAAE,uBAA4B,GACpC,OAAO,CAAC,sBAAsB,CAAC,CAqEjC"}

package/dist/workspace/checks.js

@@ -37,7 +37,7 @@
  * | WSP126, WSP127 | box intent: the decision record a box names exists, and constrains a member or path of this workspace (#2850, #2857) |
  * | WSP141, WSP142 | member links resolved against a live read, with `--live` (#2549) |
  * | WSP131 to WSP133 | diagram artifacts: source and render exist, a recorded source hash still matches (#2764) |
- * | WSP151 | reserved for the `ci.workflow` preset (#4168 step 6) |
+ * | WSP151 | what a member under `ci.workflow` still lacks (#4168 step 6) |
  * | WSP161 to WSP165 | the security groups the declaration opts into: what each still lacks (#4168 step 7) |
  */
 import { realpathSync } from "node:fs";
@@ -56,6 +56,7 @@ import { RECORD_CHECKS } from "./checks/records.js";
 import { BOX_CHECKS } from "./checks/boxes.js";
 import { DIAGRAM_CHECKS } from "./checks/diagrams.js";
 import { SECURITY_CHECKS } from "./checks/security.js";
+import { CI_WORKFLOW_CHECKS } from "./checks/ci-workflow.js";
 import { loadDeclaredKinds } from "./declared-kinds.js";
 import { resolveBoxIntents } from "./box-intent.js";
 import { gatherLexiconOutputs } from "./lexicon-outputs.js";
@@ -273,6 +274,8 @@ export const WORKSPACE_CHECKS = [
     ...DIAGRAM_CHECKS,
     // Links resolved against a live read, with --live (#2549), WSP141 and WSP142.
     ...LIVE_CHECKS,
+    // What a member under ci.workflow still lacks (#4168 step 6), WSP151.
+    ...CI_WORKFLOW_CHECKS,
     // The security groups the declaration opts into (#4168 step 7), WSP161 to WSP165.
     ...SECURITY_CHECKS,
 ];

package/dist/workspace/ci-green-cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ci-green-cli.d.ts","sourceRoot":"","sources":["../../src/workspace/ci-green-cli.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAKH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEtD,OAAO,EAAmE,cAAc,EAAE,MAAM,YAAY,CAAC;AAW7G,OAAO,EAAE,cAAc,EAAE,CAAC;AAe1B,wBAAsB,cAAc,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAiBzE;AAED,wBAAsB,SAAS,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAsBpE;AAID,wBAAsB,SAAS,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAoBpE;AAeD,wBAAsB,aAAa,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CA+DxE"}
+{"version":3,"file":"ci-green-cli.d.ts","sourceRoot":"","sources":["../../src/workspace/ci-green-cli.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAKH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEtD,OAAO,EAAmE,cAAc,EAAE,MAAM,YAAY,CAAC;AAW7G,OAAO,EAAE,cAAc,EAAE,CAAC;AAe1B,wBAAsB,cAAc,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAiBzE;AAED,wBAAsB,SAAS,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAsBpE;AAID,wBAAsB,SAAS,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAoBpE;AAeD,wBAAsB,aAAa,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAiExE"}

package/dist/workspace/ci-green-cli.js

@@ -153,7 +153,9 @@ export async function runCiWorkflow(ctx) {
         const sources = readWorkflowSources(repoRoot, fromRepo);
         const scan = workflowsHolding(green, sources);
         // #4169: the triggers and concurrency of the workflows holding a phase that sets build. Refused before anything is written.
-        const edits = buildTriggerEdits(green, sources);
+        // #4220: under a ci.workflow, composed releases' branches run the phases and tick too.
+        const compose = declaration.ci?.workflow !== undefined || declaration.members.some((m) => m.ciWorkflow !== null);
+        const edits = buildTriggerEdits(green, sources, { compose });
         const extra = ctx.args.ciWorkflows ?? [];
         const workflows = [...new Set([...scan.workflows, ...extra])].sort();
         for (const f of scan.unreadable)
@@ -186,11 +188,11 @@ export async function runCiWorkflow(ctx) {
         const workspaceRoot = relative(repoRoot, root).split(sep).join("/") || ".";
         // The install runs in the workspace root, so its lockfile there keys setup-node's npm cache.
         const npmLock = ctx.args.ciInstall && existsSync(join(root, "package-lock.json")) ? (workspaceRoot === "." ? "package-lock.json" : `${workspaceRoot}/package-lock.json`) : undefined;
-        const yaml = renderCiGreenWorkflow({ green, workflows, chantVersion: readerVersion(), workspaceRoot, chant: ctx.args.ciChant, install: ctx.args.ciInstall, npmLock, push, ...(runnerKeySecret ? { runnerKeySecret } : {}) });
+        const yaml = renderCiGreenWorkflow({ green, workflows, chantVersion: readerVersion(), workspaceRoot, chant: ctx.args.ciChant, install: ctx.args.ciInstall, npmLock, push, ...(runnerKeySecret ? { runnerKeySecret } : {}), ...(compose ? { compose } : {}) });
         const written = writeWorkflowFile(target, ciGreenHeader(command, member ? "member" : "root") + yaml);
         if (member)
             recordGeneratedFiles(member.memberRoot, [{ path: fromRepo, command }]);
-        console.log(`Wrote ${written}: ticks when ${workflows.join(", ")} complete${workflows.length === 1 ? "s" : ""} on ${green.branch}, and every 15 minutes.`);
+        console.log(`Wrote ${written}: ticks when ${workflows.join(", ")} complete${workflows.length === 1 ? "s" : ""} on ${green.branch}${compose ? " or a chant/compose/ branch" : ""}, and every 15 minutes.`);
         for (const e of edits) {
             if (!e.changed)
                 continue;

package/dist/workspace/ci-green-workflow.d.ts

@@ -106,7 +106,15 @@ export interface WorkflowInput {
      * The key's principal needs the `runner` role in `.chant/trust.json`.
      */
     runnerKeySecret?: string;
+    /**
+     * The workspace declares a `ci.workflow` (#4220), so composed releases
+     * live on `chant/compose/<name>` branches (#4168 4.3): the tick also runs
+     * when a phase workflow completes on one of them.
+     */
+    compose?: boolean;
 }
+/** The branch filter for composed releases' branches (#4220). */
+export declare const COMPOSE_BRANCHES = "chant/compose/**";
 /**
  * A token the checkout persists for the tick's `git push`: a repository
  * secret, or a GitHub App's installation token minted from its id (an
@@ -153,12 +161,20 @@ export interface BuildTriggerEdit {
  *   branch, so no push cancels or replaces another's run; elsewhere, such as
  *   a pull request, a new push cancels the run it supersedes.
  *
- * Only the top-level `on:` (for `newest`) and `concurrency:` blocks change,
+ * With `compose` (#4220, a workspace declaring `ci.workflow`), both builds
+ * also run on pushes to `chant/compose/**`: `newest` adds the filter to the
+ * branches it writes, `every` adds it to an existing `push.branches` list,
+ * and `every`'s group keys a compose branch's runs by commit, as the trunk
+ * branch's.
+ *
+ * Only the top-level `on:` (for `newest`, or `every` with `compose`) and `concurrency:` blocks change,
  * each under {@link BUILD_BLOCK_MARKER}; the rest of the file is kept as it
  * is. Throws when one workflow holds a phase of each build, which no one
  * concurrency group can serve.
  */
-export declare function buildTriggerEdits(green: CiGreen, sources: readonly WorkflowSource[]): BuildTriggerEdit[];
+export declare function buildTriggerEdits(green: CiGreen, sources: readonly WorkflowSource[], options?: {
+    compose?: boolean;
+}): BuildTriggerEdit[];
 /**
  * Replace the top-level `key:` block of a YAML file with `value` (or with
  * `value`'s lines, the key's own line first), under

package/dist/workspace/ci-green-workflow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ci-green-workflow.d.ts","sourceRoot":"","sources":["../../src/workspace/ci-green-workflow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AAMH,OAAO,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAItD,gEAAgE;AAChE,eAAO,MAAM,sBAAsB,yCAAyC,CAAC;AAC7E,eAAO,MAAM,sBAAsB,mBAAmB,CAAC;AAEvD,8CAA8C;AAC9C,MAAM,WAAW,cAAc;IAC7B,2EAA2E;IAC3E,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAKD,yHAAyH;AACzH,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,EAAE,CAYnD;AAYD,MAAM,WAAW,YAAY;IAC3B,0DAA0D;IAC1D,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,sDAAsD;IACtD,SAAS,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAChD,+CAA+C;IAC/C,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,oEAAoE;AACpE,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,cAAc,EAAE,GAAG,YAAY,CAyBjG;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,MAAM,EAAE,EAAE,OAAO,EAAE,SAAS,cAAc,EAAE,GAAG;IAAE,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,CAkBlK;AAED,iEAAiE;AACjE,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,cAAc,EAAE,CASpF;AAID,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,OAAO,CAAC;IACf,sDAAsD;IACtD,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7B,mEAAmE;IACnE,YAAY,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,wFAAwF;IACxF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,8GAA8G;IAC9G,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,mFAAmF;IACnF,aAAa,EAAE,MAAM,CAAC;IACtB,uEAAuE;IACvE,IAAI,CAAC,EAAE,SAAS,CAAC;IACjB;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;;GAIG;AACH,MAAM,MAAM,SAAS,GAAG;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAAC;AAExF,4GAA4G;AAC5G,eAAO,MAAM,YAAY,QAA6B,CAAC;AAEvD,mHAAmH;AACnH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,aAAa,GAAG,MAAM,CA0ElE;AAED,iGAAiG;AACjG,eAAO,MAAM,aAAa,UAAW,OAAO,YAAoD,CAAC;AACjG,sEAAsE;AACtE,eAAO,MAAM,YAAY,UAAW,OAAO,YAAqF,CAAC;AAIjI,gGAAgG;AAChG,eAAO,MAAM,kBAAkB,kGAAkG,CAAC;AAElI,qFAAqF;AACrF,MAAM,WAAW,gBAAgB;IAC/B,uCAAuC;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,0DAA0D;IAC1D,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,OAAO,CAAC;CAClB;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,cAAc,EAAE,GAAG,gBAAgB,EAAE,CAyCxG;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,EAAE,GAAG,MAAM,CAe1G;AAED,yFAAyF;AACzF,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,GAAG,MAAM,GAAG,MAAM,CAE/E;AAED,kGAAkG;AAClG,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAItE"}
+{"version":3,"file":"ci-green-workflow.d.ts","sourceRoot":"","sources":["../../src/workspace/ci-green-workflow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AAMH,OAAO,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAKtD,gEAAgE;AAChE,eAAO,MAAM,sBAAsB,yCAAyC,CAAC;AAC7E,eAAO,MAAM,sBAAsB,mBAAmB,CAAC;AAEvD,8CAA8C;AAC9C,MAAM,WAAW,cAAc;IAC7B,2EAA2E;IAC3E,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAKD,yHAAyH;AACzH,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,EAAE,CAYnD;AAYD,MAAM,WAAW,YAAY;IAC3B,0DAA0D;IAC1D,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,sDAAsD;IACtD,SAAS,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAChD,+CAA+C;IAC/C,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,oEAAoE;AACpE,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,cAAc,EAAE,GAAG,YAAY,CAyBjG;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,MAAM,EAAE,EAAE,OAAO,EAAE,SAAS,cAAc,EAAE,GAAG;IAAE,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,CAkBlK;AAED,iEAAiE;AACjE,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,cAAc,EAAE,CASpF;AAID,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,OAAO,CAAC;IACf,sDAAsD;IACtD,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7B,mEAAmE;IACnE,YAAY,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,wFAAwF;IACxF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,8GAA8G;IAC9G,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,mFAAmF;IACnF,aAAa,EAAE,MAAM,CAAC;IACtB,uEAAuE;IACvE,IAAI,CAAC,EAAE,SAAS,CAAC;IACjB;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;OAIG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,iEAAiE;AACjE,eAAO,MAAM,gBAAgB,qBAA+B,CAAC;AAE7D;;;;GAIG;AACH,MAAM,MAAM,SAAS,GAAG;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAAC;AAExF,4GAA4G;AAC5G,eAAO,MAAM,YAAY,QAA6B,CAAC;AAEvD,mHAAmH;AACnH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,aAAa,GAAG,MAAM,CA4ElE;AAED,iGAAiG;AACjG,eAAO,MAAM,aAAa,UAAW,OAAO,YAAoD,CAAC;AACjG,sEAAsE;AACtE,eAAO,MAAM,YAAY,UAAW,OAAO,YAAqF,CAAC;AAIjI,gGAAgG;AAChG,eAAO,MAAM,kBAAkB,kGAAkG,CAAC;AAElI,qFAAqF;AACrF,MAAM,WAAW,gBAAgB;IAC/B,uCAAuC;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,0DAA0D;IAC1D,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,OAAO,CAAC;CAClB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,cAAc,EAAE,EAAE,OAAO,GAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,gBAAgB,EAAE,CAoD7I;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,EAAE,GAAG,MAAM,CAe1G;AAED,yFAAyF;AACzF,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,GAAG,MAAM,GAAG,MAAM,CAE/E;AAED,kGAAkG;AAClG,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAItE"}

package/dist/workspace/ci-green-workflow.js

@@ -50,6 +50,7 @@ import { GENERATED_MARKER } from "../discovery/files.js";
 import { emitYAMLEntry, parseYAMLDocument } from "../yaml.js";
 import { matchesCheckRun } from "./ci-green.js";
 import { githubSecretOrJobToken } from "../ci-jobs.js";
+import { COMPOSE_BRANCH_PREFIX } from "../lifecycle/compose-refs.js";
 /** Where the workflow goes, relative to the repository root. */
 export const CI_GREEN_WORKFLOW_FILE = ".github/workflows/chant-ci-green.yml";
 export const CI_GREEN_WORKFLOW_NAME = "chant-ci-green";
@@ -149,6 +150,8 @@ export function readWorkflowSources(repoRoot, skip) {
         .map((path) => ({ path, text: readFileSync(join(repoRoot, path), "utf-8") }));
 }
 const q = (s) => JSON.stringify(s);
+/** The branch filter for composed releases' branches (#4220). */
+export const COMPOSE_BRANCHES = `${COMPOSE_BRANCH_PREFIX}**`;
 /** A secret or variable name GitHub accepts: letters, digits and underscores, not starting with a digit. */
 export const ACTIONS_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
 /** The workflow's YAML, without the generated-file header. Deterministic: the same input writes the same bytes. */
@@ -184,6 +187,8 @@ export function renderCiGreenWorkflow(input) {
         `      - ${q(green.branch)}`,
         // #4169: a build the tick asked for runs at a ci/build/<sha> tag, and its completion ticks too.
         ...(newestPhases(green) ? [`      - ${q("ci/build/**")}`] : []),
+        // #4220: a composed commit's phases run on its chant/compose/<name> branch, and their completion ticks too.
+        ...(input.compose ? [`      - ${q(COMPOSE_BRANCHES)}`] : []),
         "  schedule:",
         "    - cron: \"*/15 * * * *\"",
         "  workflow_dispatch: {}",
@@ -248,12 +253,19 @@ export const BUILD_BLOCK_MARKER = "# Written by chant ci workflow from ci.green'
  *   branch, so no push cancels or replaces another's run; elsewhere, such as
  *   a pull request, a new push cancels the run it supersedes.
  *
- * Only the top-level `on:` (for `newest`) and `concurrency:` blocks change,
+ * With `compose` (#4220, a workspace declaring `ci.workflow`), both builds
+ * also run on pushes to `chant/compose/**`: `newest` adds the filter to the
+ * branches it writes, `every` adds it to an existing `push.branches` list,
+ * and `every`'s group keys a compose branch's runs by commit, as the trunk
+ * branch's.
+ *
+ * Only the top-level `on:` (for `newest`, or `every` with `compose`) and `concurrency:` blocks change,
  * each under {@link BUILD_BLOCK_MARKER}; the rest of the file is kept as it
  * is. Throws when one workflow holds a phase of each build, which no one
  * concurrency group can serve.
  */
-export function buildTriggerEdits(green, sources) {
+export function buildTriggerEdits(green, sources, options = {}) {
+    const compose = options.compose === true;
     const out = [];
     for (const s of sources) {
         let doc;
@@ -280,18 +292,28 @@ export function buildTriggerEdits(green, sources) {
             delete on.schedule;
             const push = isObject(on.push) ? { ...on.push } : {};
             const branches = Array.isArray(push.branches) ? push.branches.filter((b) => typeof b === "string") : [];
-            push.branches = branches.includes(green.branch) ? branches : [...branches, green.branch];
+            const withBranch = branches.includes(green.branch) ? branches : [...branches, green.branch];
+            push.branches = compose && !withBranch.includes(COMPOSE_BRANCHES) ? [...withBranch, COMPOSE_BRANCHES] : withBranch;
             const { push: _push, workflow_dispatch: dispatch, ...rest } = on;
             text = writeTopLevel(text, "on", { push, workflow_dispatch: dispatch ?? {}, ...rest });
             text = writeTopLevel(text, "concurrency", { group: `chant-build-${tag}-\${{ github.ref }}`, "cancel-in-progress": false });
         }
         else {
             const main = `refs/heads/${green.branch}`;
+            // A push filter that lists branches gains the compose branches; one with no list already runs on every branch.
+            const on = isObject(doc) && isObject(doc.on) ? doc.on : undefined;
+            const pushOn = on && isObject(on.push) ? on.push : undefined;
+            if (compose && on && pushOn && Array.isArray(pushOn.branches) && !pushOn.branches.includes(COMPOSE_BRANCHES)) {
+                text = writeTopLevel(text, "on", { ...on, push: { ...pushOn, branches: [...pushOn.branches, COMPOSE_BRANCHES] } });
+            }
+            // #4220: a compose branch's commits each get a verdict, so its runs are keyed by commit, as the trunk branch's are.
+            const keyed = compose ? `(github.ref == '${main}' || startsWith(github.ref, 'refs/heads/${COMPOSE_BRANCH_PREFIX}'))` : `github.ref == '${main}'`;
+            const unkeyed = compose ? `!${keyed}` : `github.ref != '${main}'`;
             // Written as lines: the emitter would quote the expression, and GitHub reads it the same either way.
             text = writeTopLevel(text, "concurrency", [
                 "concurrency:",
-                `  group: chant-build-${tag}-\${{ github.ref == '${main}' && github.sha || github.ref }}`,
-                `  cancel-in-progress: \${{ github.ref != '${main}' }}`,
+                `  group: chant-build-${tag}-\${{ ${keyed} && github.sha || github.ref }}`,
+                `  cancel-in-progress: \${{ ${unkeyed} }}`,
             ]);
         }
         out.push({ path: s.path, build, phases, text, changed: text !== s.text });

package/dist/workspace/ci-green.d.ts

@@ -248,6 +248,16 @@ export declare function readCiTags(top: string, green?: CiGreen | null, base?: s
  * and `ci run` and `chant run` warn about a run they leave unsigned.
  */
 export declare function signedRunsRequired(cwd: string): string | null;
+/** The declaration's `ci.green`, read where `cwd` is, and the git top. */
+export declare function readGreen(cwd: string): {
+    green: CiGreen;
+    top: string;
+    workspace: {
+        name: string;
+        root: string;
+        file: string;
+    };
+};
 export interface TickRequest {
     cwd: string;
     /**
@@ -271,12 +281,20 @@ export interface TickRequest {
      */
     runnerKey?: string;
 }
+/** One compose branch a tick walked (#4168 4.3): its composed commits within the window. */
+export interface ComposedBranchTick {
+    branch: string;
+    ref: string;
+    commits: TickCommit[];
+}
 export interface TickResult {
     branch: string;
     window: string;
     /** The ref the commits were read from. */
     ref: string;
     commits: TickCommit[];
+    /** The compose branches walked (#4168 4.3), each with its composed commits judged. Their tags are in `made`. */
+    composed: ComposedBranchTick[];
     /** The tags made and pushed, or that would be under `dryRun`. */
     made: string[];
     /** The builds asked for (#4169), as `ci/build/<sha>` tags made and pushed, or that would be under `dryRun`. */
@@ -355,6 +373,19 @@ export declare function opRunCheckRun(record: OpRunRecord, signer: string | null
  * elsewhere. Reads local refs only.
  */
 export declare function readOpRunSource(cwd: string, top: string, base: string, signedSince?: string | null): Promise<OpRunSource>;
+/**
+ * Judge `ci.green.preMerge` on `commit` from the Op run records on the ledger
+ * (#4168 4.4), as `ci serve --land` does before it moves the target. The
+ * trust policy is read at `base`, the target's head. An unsigned run counts
+ * as the tick counts one: always, unless `ci.green.signedSince` asks for a
+ * signature. Throws {@link CiGreenError} when the declaration has no
+ * `ci.green` or names no pre-merge phase.
+ */
+export declare function judgePreMerge(req: {
+    cwd: string;
+    commit: string;
+    base: string;
+}): Promise<CommitVerdict>;
 /**
  * What `chant run <op> --key` signs a run's record with (#4044): the runner
  * key `.chant/trust.json` at the checkout's `HEAD` lists for a principal