@intentius/chant 0.124.38 → 0.124.40

package/src/workspace/ci-builds.test.ts

@@ -4,7 +4,7 @@
  */
 
 import { describe, expect, test } from "vitest";
-import { agedOut, BUILD_REQUEST_TTL_MS, planBuilds, recordOf, RETRY_TTL_MS, sameRecord, type BuildRequest, type CiRecord } from "./ci-builds";
+import { agedOut, BUILD_REQUEST_TTL_MS, MISSING_RUN_GRACE_MS, planBuilds, recordOf, RETRY_TTL_MS, sameRecord, type BuildRequest, type CiRecord } from "./ci-builds";
 import { evaluateCommit, type TickCommit } from "./ci-green";
 import type { CheckRun } from "./ci-green-forge";
 import type { CiGreen } from "./declaration";
@@ -172,3 +172,48 @@ describe("records (#4169)", () => {
     expect(agedOut(pending, NOW)).toMatchObject({ state: "unbuilt", phases: { suites: { verdict: "unbuilt", reason: "aged-out" } } });
   });
 });
+
+describe("a missing every phase (#4216)", () => {
+  // The forge ran suites on the commit but never ran check: its push run was skipped.
+  const skipped = (committed: string) => {
+    const { commits, runs } = judged([[run("suites", "success")]]);
+    commits[0].committed = committed;
+    return { commits, runs };
+  };
+
+  test("half an hour after the commit landed, the tick asks for the every phase once, at a ci/build tag", () => {
+    const { commits, runs } = skipped(ago(MISSING_RUN_GRACE_MS + 60_000));
+    const p = plan(commits, runs);
+    expect(p.requests).toEqual([expect.objectContaining({ commit: commits[0].sha, phases: ["check"], reason: "missing", tag: `ci/build/${commits[0].sha}` })]);
+    expect(commits[0].verdict!.phases[0]).toMatchObject({ phase: "check", verdict: "pending", reason: "requested" });
+    // The record keeps it, so the next tick doesn't ask again.
+    const req = new Map(p.requests.map((r) => [r.commit, r] as const));
+    const record = recordOf({ green: GREEN, commit: commits[0], retries: [], requests: req, now: NOW });
+    expect(record.missing).toEqual({ phases: ["check"], at: p.requests[0].at });
+    const again = skipped(ago(MISSING_RUN_GRACE_MS + 60_000));
+    expect(plan(again.commits, again.runs, { records: new Map([[commits[0].sha, record]]) }).requests).toEqual([]);
+    const { request: _request, ...afterTagDeleted } = record;
+    const later = recordOf({ green: GREEN, commit: again.commits[0], previous: afterTagDeleted as CiRecord, retries: [], requests: new Map(), now: NOW });
+    expect(later.missing).toEqual(record.missing);
+  });
+
+  test("nothing is asked for inside the grace, for a newest phase, for a tagged commit, or while a request waits", () => {
+    expect(plan(...Object.values(skipped(ago(MISSING_RUN_GRACE_MS - 60_000))) as [TickCommit[], Map<string, CheckRun[]>]).requests).toEqual([]);
+    // suites missing is the newest phase's business (superseded or bisected), not a missing request.
+    const { commits, runs } = judged([[run("check", "success")]]);
+    commits[0].committed = ago(MISSING_RUN_GRACE_MS + 60_000);
+    expect(plan(commits, runs).requests).toEqual([]);
+    const tagged = skipped(ago(MISSING_RUN_GRACE_MS + 60_000));
+    tagged.commits[0].before = "green";
+    expect(plan(tagged.commits, tagged.runs).requests).toEqual([]);
+    const waiting = skipped(ago(MISSING_RUN_GRACE_MS + 60_000));
+    const r: BuildRequest = { schema: 1, tag: `ci/build/${waiting.commits[0].sha}`, commit: waiting.commits[0].sha, branch: "main", phases: ["suites"], reason: "requested", at: ago(60_000) };
+    expect(plan(waiting.commits, waiting.runs, { requests: new Map([[r.commit, r]]) }).requests).toEqual([]);
+  });
+
+  test("a phase that sets no build is never asked for", () => {
+    const green: CiGreen = { ...GREEN, phases: GREEN.phases.map((ph) => (ph.name === "check" ? { ...ph, build: undefined } : ph)) };
+    const { commits, runs } = skipped(ago(MISSING_RUN_GRACE_MS + 60_000));
+    expect(planBuilds({ green, commits, runs, requests: new Map(), records: new Map(), now: NOW, retryVia: null }).requests).toEqual([]);
+  });
+});

package/src/workspace/ci-builds.ts

@@ -26,6 +26,10 @@
  *   waits on is `pending`. A request no runner served in six hours leaves
  *   the phase `unbuilt`, and once its phases are decided the tick deletes
  *   the tag.
+ * - Missing. A phase that declares `build: "every"` and has no run on a
+ *   commit half an hour after it landed (the forge skipped the push run, as
+ *   on acc9b9dbd) gets one build request, `missing`, for those phases
+ *   (#4216). The record keeps `missing`, so a commit is asked for once.
  * - Records. Every first-parent commit the tick judged gets
  *   `_ci/<sha>.json` on `chant/lifecycle`, rewritten only when what it says
  *   changes: `green`, `red`, `unbuilt` or `pending`, with each required
@@ -47,12 +51,14 @@ const LEDGER_REF = "refs/heads/chant/lifecycle";
 
 /** How long a build request may wait for a runner before its phases count as unbuilt. */
 export const BUILD_REQUEST_TTL_MS = 6 * 3_600_000;
+/** How long an `every` phase may have no run on a commit before the tick asks for one (#4216). */
+export const MISSING_RUN_GRACE_MS = 30 * 60_000;
 /** How long a retry may take to start before the failure it was counts. */
 export const RETRY_TTL_MS = 3_600_000;
 /** Above this many unbuilt commits a bisect halves the range; at or below it, it steps back one commit at a time. */
 export const BISECT_HALVE_ABOVE = 4;
 
-export type BuildRequestReason = "bisect" | "retry" | "requested";
+export type BuildRequestReason = "bisect" | "retry" | "requested" | "missing";
 
 /** A `ci/build/<sha>` tag's record: the phases to build at the commit, and why. */
 export interface BuildRequest {
@@ -84,6 +90,8 @@ export interface CiRecord {
   retried?: Record<string, { run: number; at: string }>;
   /** The build request waiting on this commit, when there is one. */
   request?: { tag: string; reason: BuildRequestReason; phases: string[]; at: string; dispatched?: true };
+  /** The `every` phases a `missing` request asked for, and when (#4216). A commit is asked for once. */
+  missing?: { phases: string[]; at: string };
 }
 
 export interface CiRecordRun {
@@ -166,6 +174,20 @@ export function planBuilds(input: BuildsInput): BuildsPlan {
     }
   }
 
+  // Missing (#4216): an `every` phase the forge never ran on a commit, asked for once per commit.
+  for (const c of commits) {
+    if (c.before !== "none" || !c.verdict || age(c.committed, now) < MISSING_RUN_GRACE_MS) continue;
+    if (input.records.get(c.sha)?.missing || input.requests.has(c.sha) || plan.requests.some((q) => q.commit === c.sha)) continue;
+    const phases = green.require.filter((name) => {
+      if (phaseOf(green, name).build !== "every") return false;
+      const p = phaseIn(c, name);
+      return p !== undefined && p.verdict === "pending" && p.runs.length === 0 && p.reason === undefined;
+    });
+    if (phases.length === 0) continue;
+    plan.requests.push(request(green, c.sha, phases, "missing", now));
+    for (const name of phases) setPhase(c, name, (q) => ({ ...q, verdict: "pending", reason: "requested" }));
+  }
+
   // Superseded: newest first, a newest phase with no run below a commit with one.
   for (const name of green.require) {
     if (buildOf(green, name) !== "newest") continue;
@@ -265,9 +287,11 @@ export function recordOf(input: { green: CiGreen; commit: TickCommit; previous?:
   const retried = { ...(previous?.retried ?? {}) };
   for (const r of input.retries) if (r.sha === c.sha) retried[r.run.name] = { run: r.run.id, at: iso(now) };
   const req = input.requests.get(c.sha);
+  const missing = req?.reason === "missing" ? { phases: req.phases, at: req.at } : previous?.missing;
   const extras = {
     ...(Object.keys(retried).length > 0 ? { retried } : {}),
     ...(req ? { request: { tag: req.tag, reason: req.reason, phases: req.phases, at: req.at } } : {}),
+    ...(missing ? { missing } : {}),
   };
   if (c.before === "revoked" || !c.verdict) {
     return { schema: 1, commit: c.sha, branch: green.branch, state: "red", at: iso(now), revoked: true, phases: previous?.phases ?? {}, ...(previous?.failure ? { failure: previous.failure } : {}), ...extras };

package/src/workspace/ci-green-builds.test.ts

@@ -158,6 +158,32 @@ describe("the tick for a newest phase (#4169)", () => {
   });
 });
 
+describe("the tick for a missing every phase (#4216)", () => {
+  const CHECK_WORKFLOW = "name: ci\non:\n  push:\n    branches: [main]\n  workflow_dispatch: {}\njobs:\n  check:\n    runs-on: ubuntu-latest\n    steps:\n      - run: true\n";
+
+  test("a commit the forge never ran check on gets one request, started at its ci/build tag, and the record keeps it", async () => {
+    const { root, origin } = workspace();
+    writeFiles(root, { ".github/workflows/ci.yml": CHECK_WORKFLOW });
+    const a = commitAt(root, 2, "app/a.txt");
+    git(root, "push", "-q", "origin", "main");
+    // GitHub skipped a's push run of ci.yml; release-suites ran.
+    const runs = new Map([[a, [run("suites", "success")]]]);
+    const forge = fakeForge(runs);
+    const tick = await ciTick({ cwd: root, forge, now: NOW });
+    expect(tick.requested.map((r) => [r.commit, r.phases, r.reason])).toEqual([[a, ["check"], "missing"]]);
+    expect(forge.dispatched).toEqual([`ci.yml@ci/build/${a}`]);
+    expect(remoteTags(origin)).toEqual([`ci/build/${a}`]);
+    expect(remoteRecord(origin, a)).toMatchObject({ state: "pending", missing: { phases: ["check"] }, request: { reason: "missing", dispatched: true }, phases: { check: { reason: "requested" } } });
+
+    // The started run passes: the commit goes green and the request is done.
+    runs.set(a, [run("suites", "success"), run("check", "success")]);
+    const second = await ciTick({ cwd: root, forge, now: NOW });
+    expect(second.made).toEqual([`ci/green/${a}`]);
+    expect(second.requested).toEqual([]);
+    expect(forge.dispatched).toHaveLength(1);
+  });
+});
+
 describe("chant ci run --at (#4169)", () => {
   test("pushes a request for every required phase and starts the workflows holding them", async () => {
     const { root, origin } = workspace();

package/src/workspace/ci-green-cli.ts

@@ -192,7 +192,7 @@ export async function runCiWorkflow(ctx: CommandContext): Promise<number> {
       console.log(
         e.build === "newest"
           ? `Wrote ${path}'s triggers and concurrency: ${e.phases.join(", ")} build${e.phases.length === 1 ? "s" : ""} the newest commit on ${green.branch} when a run ends, and a ci/build/<sha> tag by hand.`
-          : `Wrote ${path}'s concurrency: ${e.phases.join(", ")} build${e.phases.length === 1 ? "s" : ""} every commit on ${green.branch}, none cancelled.`,
+          : `Wrote ${path}'s triggers and concurrency: ${e.phases.join(", ")} build${e.phases.length === 1 ? "s" : ""} every commit on ${green.branch}, none cancelled, and a ci/build/<sha> tag by hand when the forge ran nothing.`,
       );
     }
     return 0;

package/src/workspace/ci-green-forge.test.ts

@@ -64,3 +64,34 @@ describe("the GitHub check-run client (#3573)", () => {
     expect(() => ciForgeFromEnv("forgejo", {})).toThrow(/GitHub only/);
   });
 });
+
+describe("re-running a failed check run (#4219)", () => {
+  const run = (id: number) => ({ id, name: "suites", status: "completed", conclusion: "failure", completedAt: null, url: null });
+  const forgeWith = (jobs: Record<number, unknown>) => {
+    const calls: string[] = [];
+    const fetch: ForgeFetch = async (url, init) => {
+      calls.push(`${init.method} ${new URL(url).pathname}`);
+      const m = /\/actions\/jobs\/(\d+)$/.exec(new URL(url).pathname);
+      if (init.method === "GET" && m) return { ok: true, status: 200, text: async () => JSON.stringify(jobs[Number(m[1])] ?? {}) };
+      return { ok: true, status: 201, text: async () => "" };
+    };
+    return { forge: githubCiForge({ apiBase: "https://api.github.com", repo: "acme/app", token: "t", fetch }), calls };
+  };
+
+  test("re-runs the failed jobs of the job's workflow run, so an aggregate's shards go again with it, once per run", async () => {
+    const { forge, calls } = forgeWith({ 7: { id: 7, run_id: 500 }, 8: { id: 8, run_id: 500 } });
+    await forge.rerun!(run(7));
+    await forge.rerun!(run(8));
+    expect(calls).toEqual([
+      "GET /repos/acme/app/actions/jobs/7",
+      "POST /repos/acme/app/actions/runs/500/rerun-failed-jobs",
+      "GET /repos/acme/app/actions/jobs/8",
+    ]);
+  });
+
+  test("falls back to the job's own re-run when the job names no workflow run", async () => {
+    const { forge, calls } = forgeWith({ 9: { id: 9 } });
+    await forge.rerun!(run(9));
+    expect(calls).toEqual(["GET /repos/acme/app/actions/jobs/9", "POST /repos/acme/app/actions/jobs/9/rerun"]);
+  });
+});

package/src/workspace/ci-green-forge.ts

@@ -57,7 +57,9 @@ export interface CiForge {
   checkRuns(sha: string): Promise<CheckRun[]>;
   /**
    * Run a failed check run's job again (#4169), so a flake costs one more
-   * run before the commit counts red. Absent on a forge chant can't ask.
+   * run before the commit counts red: on GitHub, every failed job of its
+   * workflow run, so the jobs an aggregate needs go again with it (#4219).
+   * Absent on a forge chant can't ask.
    */
   rerun?(run: CheckRun): Promise<void>;
   /**
@@ -86,6 +88,7 @@ export function githubCiForge(opts: GithubCiForgeOptions): CiForge {
   const root = opts.apiBase.replace(/\/+$/, "");
   const fetchImpl = opts.fetch ?? (globalThis.fetch as unknown as ForgeFetch);
   const headers = { Authorization: `Bearer ${opts.token}`, Accept: "application/vnd.github+json" };
+  const rerunRuns = new Set<number>();
   return {
     kind: "github",
     async checkRuns(sha) {
@@ -115,9 +118,24 @@ export function githubCiForge(opts: GithubCiForgeOptions): CiForge {
       }
       return out;
     },
-    // An Actions job's check run has the job's id, so the job is re-run by it. Both need `actions: write`.
+    // An Actions job's check run has the job's id. Re-running only that job
+    // would re-run an aggregate such as `suites` against the shards' old
+    // results, so the failed jobs of its workflow run go again together,
+    // each run once per tick (#4219). Both calls need `actions: write`.
     async rerun(run) {
-      await post(`${root}/repos/${opts.repo}/actions/jobs/${run.id}/rerun`, {});
+      const jobUrl = `${root}/repos/${opts.repo}/actions/jobs/${run.id}`;
+      const res = await fetchImpl(jobUrl, { method: "GET", headers });
+      const text = await res.text();
+      if (!res.ok) throw new ForgeApiError("GET", jobUrl, res.status, text);
+      const job: unknown = text ? JSON.parse(text) : null;
+      const runId = isObject(job) && typeof job.run_id === "number" ? job.run_id : null;
+      if (runId === null) {
+        await post(`${jobUrl}/rerun`, {});
+        return;
+      }
+      if (rerunRuns.has(runId)) return;
+      rerunRuns.add(runId);
+      await post(`${root}/repos/${opts.repo}/actions/runs/${runId}/rerun-failed-jobs`, {});
     },
     async dispatch(workflow, ref) {
       await post(`${root}/repos/${opts.repo}/actions/workflows/${encodeURIComponent(workflow)}/dispatches`, { ref });

package/src/workspace/ci-green-workflow.test.ts

@@ -346,8 +346,8 @@ describe("the triggers of a phase that sets build (#4169)", () => {
       [".github/workflows/suites.yml", "newest", ["suites"], true],
     ]);
     const ci = parseYAMLDocument(edits[0].text) as Yaml;
-    // The triggers of an every phase stay, pull requests included.
-    expect(ci.on).toEqual({ push: { branches: ["main"] }, pull_request: null });
+    // The triggers of an every phase stay, pull requests included, and it can be started by hand (#4216).
+    expect(ci.on).toEqual({ push: { branches: ["main"] }, pull_request: null, workflow_dispatch: {} });
     expect(ci.concurrency).toEqual({ group: "chant-build-lint-${{ github.ref == 'refs/heads/main' && github.sha || github.ref }}", "cancel-in-progress": "${{ github.ref != 'refs/heads/main' }}" });
     expect(edits[0].text).toContain(`# Comments above a block stay.\n${BUILD_BLOCK_MARKER}\nconcurrency:`);
     const suites = parseYAMLDocument(edits[1].text) as Yaml;
@@ -388,7 +388,7 @@ describe("the triggers of a phase that sets build (#4169)", () => {
     ];
     const edits = buildTriggerEdits(green(), sources, { compose: true });
     const ci = parseYAMLDocument(edits[0].text) as Yaml;
-    expect(ci.on).toEqual({ push: { branches: ["main", "chant/compose/**"] }, pull_request: null });
+    expect(ci.on).toEqual({ push: { branches: ["main", "chant/compose/**"] }, pull_request: null, workflow_dispatch: {} });
     expect(ci.concurrency).toEqual({
       group: "chant-build-lint-${{ (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/heads/chant/compose/')) && github.sha || github.ref }}",
       "cancel-in-progress": "${{ !(github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/heads/chant/compose/')) }}",
@@ -399,7 +399,7 @@ describe("the triggers of a phase that sets build (#4169)", () => {
     expect(buildTriggerEdits(green(), edits.map((e) => ({ path: e.path, text: e.text })), { compose: true }).map((e) => e.changed)).toEqual([false, false]);
     // A push with no branch list already runs on every branch, so its triggers stay.
     const anyBranch = LINT_WF.replace("  push:\n    branches: [main]\n", "  push:\n");
-    expect((parseYAMLDocument(buildTriggerEdits(green(), [{ path: ".github/workflows/ci.yml", text: anyBranch }], { compose: true })[0].text) as Yaml).on).toEqual({ push: null, pull_request: null });
+    expect((parseYAMLDocument(buildTriggerEdits(green(), [{ path: ".github/workflows/ci.yml", text: anyBranch }], { compose: true })[0].text) as Yaml).on).toEqual({ push: null, pull_request: null, workflow_dispatch: {} });
     // Without compose the bytes are what #4169 wrote.
     expect(buildTriggerEdits(green(), sources).map((e) => e.text)).toEqual(buildTriggerEdits(green(), sources, { compose: false }).map((e) => e.text));
     const tick = parseYAMLDocument(renderCiGreenWorkflow({ green: green(), workflows: ["ci"], chantVersion: "0.124.33", workspaceRoot: ".", compose: true })) as Yaml;

package/src/workspace/ci-green-workflow.ts

@@ -327,9 +327,11 @@ export interface BuildTriggerEdit {
  *   ref that never cancels a run in progress, so GitHub keeps the newest
  *   push waiting and drops the ones between, and each tag's build runs in a
  *   group of its own.
- * - `every`: the triggers stay, and the group is the commit itself on the
- *   branch, so no push cancels or replaces another's run; elsewhere, such as
- *   a pull request, a new push cancels the run it supersedes.
+ * - `every`: the triggers stay, with `workflow_dispatch` added so the tick
+ *   can start a run the forge never started on a commit (#4216), and the
+ *   group is the commit itself on the branch, so no push cancels or replaces
+ *   another's run; elsewhere, such as a pull request or a `ci/build/<sha>`
+ *   tag, a new push cancels the run it supersedes.
  *
  * With `compose` (#4220, a workspace declaring `ci.workflow`), both builds
  * also run on pushes to `chant/compose/**`: `newest` adds the filter to the
@@ -337,7 +339,7 @@ export interface BuildTriggerEdit {
  * and `every`'s group keys a compose branch's runs by commit, as the trunk
  * branch's.
  *
- * Only the top-level `on:` (for `newest`, or `every` with `compose`) and `concurrency:` blocks change,
+ * Only the top-level `on:` and `concurrency:` blocks change,
  * each under {@link BUILD_BLOCK_MARKER}; the rest of the file is kept as it
  * is. Throws when one workflow holds a phase of each build, which no one
  * concurrency group can serve.
@@ -375,12 +377,16 @@ export function buildTriggerEdits(green: CiGreen, sources: readonly WorkflowSour
       text = writeTopLevel(text, "concurrency", { group: `chant-build-${tag}-\${{ github.ref }}`, "cancel-in-progress": false });
     } else {
       const main = `refs/heads/${green.branch}`;
+      const on = triggersOf(isObject(doc) ? doc.on : undefined);
+      let next = on;
       // A push filter that lists branches gains the compose branches; one with no list already runs on every branch.
-      const on = isObject(doc) && isObject(doc.on) ? doc.on : undefined;
-      const pushOn = on && isObject(on.push) ? on.push : undefined;
-      if (compose && on && pushOn && Array.isArray(pushOn.branches) && !pushOn.branches.includes(COMPOSE_BRANCHES)) {
-        text = writeTopLevel(text, "on", { ...on, push: { ...pushOn, branches: [...pushOn.branches, COMPOSE_BRANCHES] } });
+      const pushOn = isObject(on.push) ? on.push : undefined;
+      if (compose && pushOn && Array.isArray(pushOn.branches) && !pushOn.branches.includes(COMPOSE_BRANCHES)) {
+        next = { ...next, push: { ...pushOn, branches: [...pushOn.branches, COMPOSE_BRANCHES] } };
       }
+      // #4216: the tick starts the workflow by hand at a ci/build/<sha> tag when the forge ran nothing on a commit.
+      if (!("workflow_dispatch" in next)) next = { ...next, workflow_dispatch: {} };
+      if (next !== on) text = writeTopLevel(text, "on", next);
       // #4220: a compose branch's commits each get a verdict, so its runs are keyed by commit, as the trunk branch's are.
       const keyed = compose ? `(github.ref == '${main}' || startsWith(github.ref, 'refs/heads/${COMPOSE_BRANCH_PREFIX}'))` : `github.ref == '${main}'`;
       const unkeyed = compose ? `!${keyed}` : `github.ref != '${main}'`;
@@ -396,6 +402,14 @@ export function buildTriggerEdits(green: CiGreen, sources: readonly WorkflowSour
   return out;
 }
 
+/** A workflow's `on:` as a map: `on: push` and `on: [push, pull_request]` name triggers with no settings. */
+function triggersOf(on: unknown): Record<string, unknown> {
+  if (isObject(on)) return on;
+  if (typeof on === "string") return { [on]: null };
+  if (Array.isArray(on)) return Object.fromEntries(on.filter((t): t is string => typeof t === "string").map((t) => [t, null]));
+  return {};
+}
+
 /**
  * Replace the top-level `key:` block of a YAML file with `value` (or with
  * `value`'s lines, the key's own line first), under

package/src/workspace/ci-run.test.ts

@@ -24,6 +24,7 @@ import type { StepRecord } from "../op/local-executor";
 import { sshFromEd25519 } from "./trust/dsse";
 import { verifyOpRunStatement } from "./trust/op-run-statement";
 import { readRunLedger } from "../lifecycle/run-ledger";
+import { resolveRunId } from "../lifecycle/release-ledger";
 import { prLoopJobs, PR_LOOP_SETUP } from "../components/pr-pipeline";
 import { parseArgs } from "../cli/parse-args";
 import { ciSecretsFor, readCiSecrets } from "./ci-secrets";
@@ -837,6 +838,31 @@ describe("a generated forge job runs ci run --in-place (#4156)", () => {
     expect(index.runs[0]).toMatchObject({ job: "plan", runId: "forge-plan-1", signer: null, runOrigin: { forge: "github", jobId: "plan", attempt: 2 } });
   });
 
+  test("a release record written in a runner job names the run the run index lists, and a forge job's never does (#4275)", async () => {
+    const { app, base } = workspace();
+    const reports = scratchDir("chant-ci-run-index-");
+    const output = join(scratchDir("chant-ci-run-out-"), "pr");
+    // The host's forge run id, even passed on by name, does not reach a runner job's steps.
+    const r = await ciRun({ image: JOB_IMAGE, cwd: app, job: "plan", env: "prod", forge: "forgejo", base, pr: 7, chant: fakeChant(), hostEnv: { ...HOST, ...FORGE }, passEnv: ["GITHUB_RUN_ID", "GITHUB_JOB"], push: false, output, loop: { reportUrl: `file://${reports}` } });
+    expect(r.status).toBe("ok");
+    const step = envFile(output, "pr-plan");
+    expect(step).not.toHaveProperty("GITHUB_RUN_ID");
+    const index = JSON.parse(readFileSync(join(reports, "runs", "index.json"), "utf-8")) as { runs: { runId: string; runOrigin: unknown }[] };
+    expect(index.runs[0]!.runId).toMatch(/^chant-\d+$/);
+    expect(resolveRunId(undefined, step)).toEqual({ runId: index.runs[0]!.runId, runOrigin: index.runs[0]!.runOrigin });
+    expect(index.runs[0]!.runOrigin).toEqual({ forge: "chant" });
+
+    // In place in a forge job, the runner's variables from the host are dropped, and the record names the forge's run.
+    const forge = await ciRun({ cwd: app, job: "plan", env: "prod", forge: "forgejo", base, pr: 7, chant: fakeChant(), hostEnv: { ...HOST, ...FORGE, CHANT_CI_RUN_ID: "chant-1", CHANT_CI_RUN_FORGE: "chant" }, inPlace: true, push: false, runId: "forge-plan-2" });
+    expect(forge.status).toBe("ok");
+    const inPlace = envFile(join(app, ".chant/pr"), "pr-plan");
+    expect(inPlace).not.toHaveProperty("CHANT_CI_RUN_ID");
+    expect(resolveRunId(undefined, inPlace).runOrigin).toMatchObject({ forge: "github", repo: "acme/estate" });
+    // And a forge's run id wins over the runner's variables wherever both appear.
+    expect(resolveRunId(undefined, { GITHUB_RUN_ID: "4242", CHANT_CI_RUN_ID: "chant-1", CHANT_CI_RUN_FORGE: "chant" }).runId).toBe("4242");
+    expect(resolveRunId(undefined, { CHANT_CI_RUN_ID: "chant-1" }).runOrigin).toEqual({ forge: "local" });
+  });
+
   test("a failed command's exit code is the job's, and --wave reaches pr-apply", async () => {
     const { app, base } = workspace();
     const r = await ciRun({ cwd: app, job: "apply", env: "prod", forge: "github", base, chant: fakeChant(), hostEnv: { ...HOST, ...FORGE, FAKE_EXIT: "3" }, inPlace: true, push: false, loop: { waveGate: "release" }, wave: 2 });

package/src/workspace/ci-run.ts

@@ -79,7 +79,7 @@ import { detectForge, ForgeEnvironmentError, forgeFromEnv, FORGE_KINDS, type Com
 import { PR_APPLY_GATE } from "../pr-loop";
 import type { CommandContext } from "../cli/registry";
 import { formatError, formatWarning } from "../cli/format";
-import { resolveCiJob, type RunOrigin } from "../lifecycle/release-ledger";
+import { CHANT_CI_RUN_FORGE_ENV, CHANT_CI_RUN_ID_ENV, FORGE_RUN_ENV, resolveCiJob, type RunOrigin } from "../lifecycle/release-ledger";
 import { fetchLifecycleStatus, pushLifecycleReport } from "../lifecycle/git";
 import { ACTIVITY_PROFILES } from "../op/activity-profiles";
 import type { ActivityFn, ActivityProfile } from "../op/activity-registry";
@@ -761,6 +761,23 @@ function ciRunSigner(req: CiRunRequest, at: { cwd: string; top: string; commit:
   }
 }
 
+/**
+ * The steps' environment (#4275). A job the chant runner ran gets its run's id
+ * and origin, so a release record written inside it names the run the run
+ * index lists, and none of the forge's run variables. Any other job, in place
+ * in a forge job or on this machine, never carries the runner's.
+ */
+export function ciRunStepEnv(jobEnv: Record<string, string>, origin: RunOrigin, runId: string): Record<string, string> {
+  const out = { ...jobEnv };
+  delete out[CHANT_CI_RUN_ID_ENV];
+  delete out[CHANT_CI_RUN_FORGE_ENV];
+  if (origin.forge !== "chant") return out;
+  for (const name of FORGE_RUN_ENV) delete out[name];
+  out[CHANT_CI_RUN_ID_ENV] = runId;
+  out[CHANT_CI_RUN_FORGE_ENV] = "chant";
+  return out;
+}
+
 /** Where the job runs: a fresh worktree of the commit, or with `inPlace` the checkout itself, which is left as it is. */
 function jobCheckout(top: string, commit: string, inPlace?: boolean): { dir: string; remove(): void } {
   return inPlace ? { dir: top, remove() {} } : freshCheckout(top, commit);
@@ -788,16 +805,16 @@ async function runCiJob(
   const checkout = jobCheckout(top, commit, req.inPlace);
   try {
     const jobDir = place.dir === "." ? checkout.dir : join(checkout.dir, place.dir);
+    const runId = req.runId ?? `chant-${Date.now()}`;
     const op = ciJobOp({
       job,
       env: req.env,
       cwd: jobDir,
-      jobEnv,
+      jobEnv: ciRunStepEnv(jobEnv, origin, runId),
       setup: req.inPlace ? [] : prLoopSetup(req.image ?? PR_LOOP_IMAGE),
       build: [...(req.beforeScript ?? []), ...(job.build ?? [])],
       ...(req.chant ? { chant: req.chant } : {}),
     });
-    const runId = req.runId ?? `chant-${Date.now()}`;
     const warnings: string[] = [...early];
     const resume = req.job === "apply" && req.resumeRecord ? { host: resolve(req.resumeRecord), job: join(jobDir, PR_APPLY_RECORD) } : undefined;
     if (resume && existsSync(resume.host)) {

package/src/workspace/status.schema.json

@@ -1149,6 +1149,7 @@
         "releaseDigest": { "type": ["string", "null"], "pattern": "^(?:jcs1-)?sha256:[0-9a-f]{64}$", "description": "Added in contract 1 by #4043, written by chant 0.124.29 and newer. The release this deploy was made from: the releaseDigest of _releases/<releaseDigest>.json. A promote with --release writes it, a run --components with --release writes it, and a rollback or redeploy copies it from the record it restores. Null for a deploy that named no release. With the item's environment it names the release target." },
         "releaseLabel": { "type": ["string", "null"], "description": "Added in contract 1 by #4043, written by chant 0.124.29 and newer. The label that release was cut with, from _releases/cuts.jsonl. Null when releaseDigest is null, when the release has no label, and when the cuts can't be read." },
         "flags": { "type": "array", "items": { "enum": ["legacy-digest"] } },
+        "digestKind": { "enum": ["plan", "deploy-input", "templates"], "description": "Added in contract 1 by #4274, written by chant 0.124.35 and newer. What digest names when it is not an artifact digest: plan, the plan digest a pr-apply of a component that published nothing applied under its approval; deploy-input, that component's deploy-input digest when nothing planned; templates, the digest of the templates a release records for the component (#4222). Absent for an artifact digest. Compare joins a plan or deploy-input record on gitSha." },
         "plan": {
           "type": ["object", "null"],
           "description": "The release plan digest names, read from _plans/<digest>.json on chant/lifecycle (ws-055, #2733): the work items and evidence this release shipped. Null when this checkout has no plan stored under that digest — most releases carry no plan, and a plan not yet fetched also reads null."

package/src/workspace/status.ts

@@ -38,7 +38,7 @@ import { formatError } from "../cli/format";
 import type { CommandContext } from "../cli/registry";
 import { GATES_DIR } from "../lifecycle/gate-ledger";
 import { readPathSha } from "../lifecycle/git";
-import { latestPerComponent, readReleaseLedger, type ReleaseRecord } from "../lifecycle/release-ledger";
+import { latestPerComponent, readReleaseLedger, type ReleaseDigestKind, type ReleaseRecord } from "../lifecycle/release-ledger";
 import { describeRevocation, revokedCommitsAt, revokedReleaseLookup, type ReleaseRevocation, type RevokedRelease } from "../lifecycle/release-revocation";
 import { readReleasePlan, type ReleasePlan } from "../lifecycle/plan-ledger";
 import { readDeployOutcomes, type DeployOutcome } from "../lifecycle/deploy-outcome";
@@ -138,6 +138,8 @@ export interface StatusRelease {
   releaseLabel: string | null;
   /** Read flags, such as `legacy-digest` (#2514). */
   flags: string[];
+  /** What `digest` names when it is not an artifact digest (#4274): `plan`, `deploy-input` or `templates`. Absent for an artifact digest. */
+  digestKind?: ReleaseDigestKind;
   /**
    * The release plan `digest` names, read from `_plans/<digest>.json` on
    * chant/lifecycle (ws-055, #2733) — the work items and evidence this
@@ -611,6 +613,7 @@ async function readEnvironment(
       releaseDigest: r.releaseDigest ?? null,
       releaseLabel: (r.releaseDigest !== undefined ? labels.get(r.releaseDigest) : undefined) ?? null,
       flags: [...(r.flags ?? [])],
+      ...(r.digestKind ? { digestKind: r.digestKind } : {}),
       plan: await readReleasePlan(r.digest, { cwd, prefix: planPrefix }),
       ...(await revokedItem(r, env, revokedOf, back)),
     })),
@@ -665,8 +668,9 @@ async function supersedeRevokedGates(gates: StatusGate[], revokedOf: RevokedOf):
   );
 }
 
-/** The digest two environments are compared on: the input side when there is one. */
-const compareKey = (r: StatusRelease): string => r.inputDigest ?? r.digest;
+/** The digest two environments are compared on: the input side when there is one, the commit for an apply (#4274). */
+const compareKey = (r: StatusRelease): string =>
+  r.digestKind === "plan" || r.digestKind === "deploy-input" ? `git:${r.gitSha}` : r.inputDigest ?? r.digest;
 
 export function compareEnvironments(a: StatusEnvironment, b: StatusEnvironment): StatusCompare {
   const left = new Map(a.releases.map((r) => [r.component, r]));