@intentius/chant 0.124.39 → 0.124.41

package/src/ci-handover.ts

@@ -0,0 +1,237 @@
+/**
+ * The forge token handover (#4295): no step that runs a pull request's code
+ * holds a forge token.
+ *
+ * A pull request's plan runs its code: the synth of its components, the
+ * plans their capabilities run, its build and lint, and its hooks. A token
+ * that can post a note or set a status can also push, so the generated plan
+ * job uses the job's token for the checkout's fetches alone and drops it
+ * before anything else runs. The ordering is terragucci's `handover.ts`
+ * (INTENTIUS/terragucci e6cb431, packages/terragucci/src/handover.ts):
+ *
+ * 1. The checkout is a script ({@link checkoutScript}), not actions/checkout,
+ *    whose post step runs at the job's end with the token as its input. The
+ *    token reaches its fetches through the environment, never the git config.
+ * 2. Every later step starts again without the token variables
+ *    ({@link dropForgeTokens}).
+ * 3. The plan step is the job's last. A step after it would start beside
+ *    whatever the change's code left running, with what it wrote to
+ *    GITHUB_ENV and GITHUB_PATH. So the plan step hands its report directory
+ *    on as the job's outputs ({@link handoverTrap}) in place of an artifact
+ *    upload.
+ * 4. A fresh job, `plan-note`, checks out the target branch's commit, takes
+ *    the report back ({@link takeOverScript}), keeps it as the artifact, and
+ *    posts the note and the status with the token (`chant components
+ *    pr-post`, ./pr-post.ts). It reads the report as data.
+ *
+ * `chant ci run plan` keeps the same rule: no step of the plan job gets a
+ * forge token, and the runner posts from the report once the steps settle
+ * (../workspace/ci-run.ts).
+ */
+
+import type { ForgeKind } from "./pr-forge";
+
+/**
+ * The variables a runner, a job or a secret may hold a forge token in.
+ * A step that runs the change's code starts without them. The list is
+ * terragucci's `STEP_TOKEN_VARS` (render.ts:1787) with chant's own names
+ * (`FORGE_TOKEN_ENV` in ./pr-forge.ts) and GitLab's added.
+ */
+export const FORGE_TOKEN_VARS = [
+  "CHANT_FORGE_TOKEN",
+  "CHANT_GITHUB_TOKEN",
+  "CHANT_FORGEJO_TOKEN",
+  "CHANT_GITLAB_TOKEN",
+  "CHANT_CHECKOUT_TOKEN",
+  "GITHUB_TOKEN",
+  "GH_TOKEN",
+  "FORGEJO_TOKEN",
+  "GITEA_TOKEN",
+  "GITLAB_TOKEN",
+  "CI_JOB_TOKEN",
+  "ACTIONS_RUNTIME_TOKEN",
+] as const;
+
+/** `env` without {@link FORGE_TOKEN_VARS}. */
+export function withoutForgeTokens<T extends Record<string, string | undefined>>(env: T): T {
+  const out = { ...env };
+  for (const name of FORGE_TOKEN_VARS) delete out[name];
+  return out;
+}
+
+/** Whether `env` holds a forge token under one of {@link FORGE_TOKEN_VARS}. */
+export function holdsForgeToken(env: Record<string, string | undefined>): boolean {
+  return FORGE_TOKEN_VARS.some((name) => (env[name] ?? "") !== "");
+}
+
+/** The marker a step {@link dropForgeTokens} restarted carries. */
+export const NO_FORGE_TOKEN_MARKER = "CHANT_NO_FORGE_TOKEN";
+
+/**
+ * The first line of a step that runs the change's code: restart the step's
+ * shell once without the token variables in its process environment, or,
+ * when it cannot restart, unset them. Unsetting alone leaves the values in
+ * the shell's own initial environment, which a child reads on Linux from
+ * `/proc/<pid>/environ`; the restart replaces it. A forge runs a step's
+ * script as a file (`sh -e {0}` in a GitHub or Forgejo container job), so
+ * `$0` is that file. terragucci's `restartWithout` (render.ts:1826).
+ */
+export function dropForgeTokens(shell: "sh" | "bash" = "sh", extra: readonly string[] = []): string {
+  const again = shell === "bash" ? 'bash --noprofile --norc -e -o pipefail "$0"' : 'sh -e "$0"';
+  const marker = NO_FORGE_TOKEN_MARKER;
+  // #4296: a plan job that traded its OIDC token drops the variables a token is requested with too.
+  const vars = [...FORGE_TOKEN_VARS, ...extra];
+  const can = `[ -z "\${${marker}:-}" ] && [ "\${0#*/}" != "$0" ] && [ -f "$0" ] && ! { [ "\${0##*/}" = sh ] || [ "\${0##*/}" = bash ] || [ "\${0##*/}" = dash ]; } && command -v env >/dev/null 2>&1 && command -v ${shell} >/dev/null 2>&1`;
+  return `if ${can}; then exec env ${vars.map((v) => `-u ${v}`).join(" ")} ${marker}=1 ${again}; fi; unset ${vars.join(" ")}`;
+}
+
+/** The line a GitLab plan job starts its script with: GitLab runs the script in one shell, so the unset holds for every line after it. */
+export const GITLAB_DROP_FORGE_TOKENS = `unset ${FORGE_TOKEN_VARS.join(" ")}`;
+
+/** The forges whose plan job hands its report on through job outputs. GitLab passes the artifact to the next job itself. */
+export type HandoverForge = Exclude<ForgeKind, "gitlab">;
+
+/**
+ * How many outputs the plan job hands its report on in, and the most
+ * characters each holds. Forgejo keeps each output's value to 1 MiB. GitHub
+ * keeps a job's outputs to 1 MB together, sized as UTF-16. terragucci's
+ * `HANDOVER_LIMITS` (handover.ts).
+ */
+export const HANDOVER_LIMITS: Record<HandoverForge, { chunk: number; parts: number }> = {
+  forgejo: { chunk: 1_000_000, parts: 4 },
+  github: { chunk: 450_000, parts: 1 },
+};
+
+/** The outputs' names on a forge: report_0, report_1, ... */
+export function handoverKeys(forge: HandoverForge): string[] {
+  return Array.from({ length: HANDOVER_LIMITS[forge].parts }, (_, i) => `report_${i}`);
+}
+
+/** The files the note job reads, which a report too large to hand on whole is cut to. */
+export const HANDOVER_NOTE_FILES = ["pr-plan.json", "pr-note.md"] as const;
+
+/**
+ * Packs the report directory (argv 1) into the step's output file (argv 2):
+ * every regular file, found without following a link, as gzipped JSON in
+ * base64, cut into the forge's chunks. A report too large is cut to
+ * {@link HANDOVER_NOTE_FILES}, and to none when even those are too large.
+ */
+export function packJs(forge: HandoverForge): string {
+  const { chunk, parts } = HANDOVER_LIMITS[forge];
+  return [
+    'const fs=require("fs"),p=require("path"),z=require("zlib");',
+    "const [dir,out]=process.argv.slice(1);",
+    `const CHUNK=${chunk},PARTS=${parts},NOTE=${JSON.stringify(HANDOVER_NOTE_FILES)};`,
+    "const all={};",
+    'const walk=(d,r)=>{let n=[];try{n=fs.readdirSync(d).sort()}catch{return}for(const x of n){const f=p.join(d,x),k=r?r+"/"+x:x;let s;try{s=fs.lstatSync(f)}catch{continue}if(s.isDirectory())walk(f,k);else if(s.isFile())all[k]=fs.readFileSync(f).toString("base64")}};',
+    'walk(dir,"");',
+    'const pack=(o)=>z.gzipSync(JSON.stringify(o)).toString("base64");',
+    "let b=pack(all);",
+    "if(b.length>CHUNK*PARTS){b=pack(Object.fromEntries(Object.entries(all).filter(([k])=>NOTE.includes(k))));",
+    'if(b.length>CHUNK*PARTS){b=pack({});console.error("chant: the plan report is too large to hand to the note job, even cut to the report and the note; it hands on none of it")}',
+    'else console.error("chant: the plan report is too large to hand to the note job whole; it hands on pr-plan.json and pr-note.md")}',
+    'let o="";for(let i=0;i*CHUNK<b.length;i++)o+="report_"+i+"="+b.slice(i*CHUNK,(i+1)*CHUNK)+"\\n";',
+    "fs.appendFileSync(out,o);",
+  ].join("");
+}
+
+/**
+ * Writes back, under the directory argv 1 names, the files the plan job
+ * handed on: stdin holds its outputs, one JSON string a line. A path is kept
+ * only when it is plain segments (no empty one, no `.` or `..`, no backslash
+ * or control character), so nothing lands outside the directory.
+ */
+export const UNPACK_JS = [
+  'const fs=require("fs"),p=require("path"),z=require("zlib");',
+  "const dir=process.argv[1];",
+  'let b="";',
+  'for(const l of fs.readFileSync(0,"utf8").split("\\n")){if(!l.trim())continue;let s="";try{s=JSON.parse(l)}catch{}if(typeof s==="string")b+=s}',
+  'if(!b){console.log("chant: the plan job handed on no report");process.exit(0)}',
+  'let files;try{files=JSON.parse(z.gunzipSync(Buffer.from(b,"base64"),{maxOutputLength:268435456}).toString("utf8"))}catch(e){console.log("chant: the report the plan job handed on does not read: "+e.message);process.exit(0)}',
+  'if(!files||typeof files!=="object"||Array.isArray(files)){console.log("chant: the report the plan job handed on is not a set of files");process.exit(0)}',
+  "let n=0;",
+  'for(const [k,v] of Object.entries(files)){const parts=k.split("/");',
+  'if(typeof v!=="string"||k.length>1024||parts.some((x)=>!x||x==="."||x===".."||/[\\\\\\x00-\\x1f]/.test(x))){console.log("chant: left out "+JSON.stringify(k));continue}',
+  'try{const f=p.join(dir,...parts);fs.mkdirSync(p.dirname(f),{recursive:true});fs.writeFileSync(f,Buffer.from(v,"base64"));n++}catch(e){console.log("chant: could not write "+JSON.stringify(k)+": "+e.message)}}',
+  'console.log("chant: took "+n+" report files from the plan job")',
+].join("");
+
+/**
+ * The lines of the plan step, after {@link dropForgeTokens}: when the step
+ * ends, however it ends, its report directory (`dir`, from the directory the
+ * step starts in) goes into the step's outputs.
+ */
+export function handoverTrap(dir: string, forge: HandoverForge): string[] {
+  return [
+    `chant_report="$PWD/${dir}"`,
+    `chant_handover() { node -e '${packJs(forge)}' "$chant_report" "\${GITHUB_OUTPUT:-/dev/null}" || echo "chant: the plan report could not be handed to the note job" >&2; }`,
+    "trap chant_handover EXIT",
+  ];
+}
+
+/** A job's outputs that carry the report its step `step` handed on. */
+export function handoverOutputs(step: string, forge: HandoverForge): Record<string, string> {
+  return Object.fromEntries(handoverKeys(forge).map((k) => [k, `\${{ steps.${step}.outputs.${k} }}`]));
+}
+
+/**
+ * The script of the step that takes the report job `job` handed on into
+ * `dir`. Each output comes in as toJSON's string, one line of a quoted
+ * heredoc whose end no JSON string can be, so the change's outputs stay data.
+ */
+export function takeOverScript(job: string, dir: string, forge: HandoverForge): string {
+  return [
+    "set -u",
+    `node -e '${UNPACK_JS}' ${dir} <<'END_OF_REPORT'`,
+    ...handoverKeys(forge).map((k) => `\${{ toJSON(needs.${job}.outputs.${k}) }}`),
+    "END_OF_REPORT",
+  ].join("\n");
+}
+
+/** The variable the checkout script reads the job's token from. */
+export const CHECKOUT_TOKEN_ENV = "CHANT_CHECKOUT_TOKEN";
+
+/**
+ * Checks the run's commit out with git, as actions/checkout does without
+ * credentials kept: `GITHUB_SHA` under `GITHUB_REF`. With `history`, every
+ * branch and tag too, since the plan measures the change with git. The job's
+ * token ({@link CHECKOUT_TOKEN_ENV}) reaches the fetches alone, through the
+ * environment, never the git config. A workspace already checked out is
+ * cleaned first, as actions/checkout does. terragucci's `checkoutScript`
+ * (handover.ts). With `ledger`, the `chant/lifecycle` branch is fetched
+ * into a local branch too, while the token is there: the plan reads the
+ * gate ledger from it, and a later fetch without the token cannot reach a
+ * private repository (`requireLifecycleLedger` in ./lifecycle/git.ts reads
+ * the local branch when the fetch fails).
+ */
+export function checkoutScript(history: boolean, ledger = false): string {
+  const fetchLine = history
+    ? `git -c protocol.version=2 fetch -q --prune --no-recurse-submodules origin '+refs/heads/*:refs/remotes/origin/*' '+refs/tags/*:refs/tags/*' "+$want:$target"`
+    : 'git -c protocol.version=2 fetch -q --no-tags --prune --no-recurse-submodules --depth=1 origin "+$want:$target"';
+  return [
+    "set -eu",
+    'git config --global --add safe.directory "$PWD" 2>/dev/null || true',
+    "[ -d .git ] || git init -q .",
+    'git remote get-url origin >/dev/null 2>&1 || git remote add origin "$GITHUB_SERVER_URL/$GITHUB_REPOSITORY"',
+    `if [ -n "\${${CHECKOUT_TOKEN_ENV}:-}" ]; then`,
+    `  chant_auth="$(printf 'x-access-token:%s' "$${CHECKOUT_TOKEN_ENV}" | base64 | tr -d '\\n')"`,
+    '  export GIT_CONFIG_COUNT=1 GIT_CONFIG_KEY_0=http.extraheader GIT_CONFIG_VALUE_0="AUTHORIZATION: basic $chant_auth"',
+    "  unset chant_auth",
+    "fi",
+    'ref="$GITHUB_REF"',
+    'want="$GITHUB_SHA"',
+    'case "$ref" in',
+    '  refs/heads/*) target="refs/remotes/origin/${ref#refs/heads/}" ;;',
+    '  refs/tags/*) target="$ref" ;;',
+    '  refs/*) target="refs/remotes/${ref#refs/}" ;;',
+    '  *) target="refs/remotes/origin/chant-head" ;;',
+    "esac",
+    "if git rev-parse -q --verify HEAD >/dev/null; then git clean -ffdxq; fi",
+    fetchLine,
+    ...(ledger ? ["git -c protocol.version=2 fetch -q --no-tags origin '+refs/heads/chant/lifecycle:refs/heads/chant/lifecycle' 2>/dev/null || true"] : []),
+    'case "$ref" in',
+    '  refs/heads/*) git checkout -q --force -B "${ref#refs/heads/}" "$target" ;;',
+    '  *) git checkout -q --force --detach "$target" ;;',
+    "esac",
+  ].join("\n");
+}

package/src/ci-identity.test.ts

@@ -0,0 +1,201 @@
+/**
+ * #4296: the plan and apply cloud identities, and the OIDC trade. The trade
+ * tests run the generated `node -e` line with `sh`, as a forge step runs
+ * it, against a local emulator of the forge's token URL, AWS STS, Google's
+ * STS and IAM credentials, and Entra (./__fixtures__/oidc-emulator.ts).
+ * Test values only; no cloud is reached.
+ */
+
+import { execFile } from "node:child_process";
+import { existsSync, mkdtempSync, readFileSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { promisify } from "node:util";
+import { afterAll, beforeAll, describe, expect, test } from "vitest";
+import {
+  cloudIdentityProblems,
+  gitlabTradeIdTokens,
+  gitlabTradeLines,
+  idTokenVar,
+  OIDC_REQUEST_VARS,
+  resolveCloudIdentity,
+  TRADE_JS,
+  TRADE_SPEC_ENV,
+  tradeLine,
+  type CloudIdentityDeclaration,
+  type CloudTradeSpec,
+} from "./ci-identity";
+import { emulatedCredentials, EMULATED_JWT_PREFIX, startOidcEmulator, type OidcEmulator } from "./__fixtures__/oidc-emulator";
+import { dropForgeTokens } from "./ci-handover";
+
+const run = promisify(execFile);
+
+const DECL: CloudIdentityDeclaration = {
+  aws: {
+    region: "eu-west-1",
+    rules: [
+      { environments: ["prod"], members: ["net"], plan: "arn:aws:iam::111111111111:role/net-prod-plan", apply: "arn:aws:iam::111111111111:role/net-prod-apply" },
+      { environments: ["prod"], plan: "arn:aws:iam::111111111111:role/prod-plan", apply: "arn:aws:iam::111111111111:role/prod-apply" },
+      { environments: ["staging-*"], plan: "arn:aws:iam::222222222222:role/staging-plan", apply: "arn:aws:iam::222222222222:role/staging-apply" },
+    ],
+  },
+  gcp: {
+    provider: "projects/123/locations/global/workloadIdentityPools/ci/providers/forge",
+    rules: [{ plan: "plan@test-project.iam.gserviceaccount.com", apply: "apply@test-project.iam.gserviceaccount.com" }],
+  },
+  azure: { tenantId: "00000000-0000-0000-0000-00000000tena", rules: [{ members: ["app"], plan: "plan-client-id", apply: "apply-client-id" }] },
+};
+
+describe("which identities a pipeline takes (#4296)", () => {
+  test("the first rule whose environments and members match wins, per cloud", () => {
+    const net = resolveCloudIdentity(DECL, "prod", "net")!;
+    expect(net.plan.aws!.role).toBe("arn:aws:iam::111111111111:role/net-prod-plan");
+    expect(net.apply.aws!.role).toBe("arn:aws:iam::111111111111:role/net-prod-apply");
+    expect(resolveCloudIdentity(DECL, "prod", "web")!.plan.aws!.role).toBe("arn:aws:iam::111111111111:role/prod-plan");
+    expect(resolveCloudIdentity(DECL, "staging-eu", "net")!.apply.aws!.role).toBe("arn:aws:iam::222222222222:role/staging-apply");
+    expect(net.plan.aws).toMatchObject({ region: "eu-west-1", audience: "sts.amazonaws.com" });
+  });
+
+  test("a cloud no rule covers is left out, and so is a pipeline no rule covers", () => {
+    expect(resolveCloudIdentity(DECL, "prod", "net")!.plan.azure).toBeUndefined();
+    expect(resolveCloudIdentity(DECL, "prod", "app")!.plan.azure).toMatchObject({ clientId: "plan-client-id", audience: "api://AzureADTokenExchange" });
+    expect(resolveCloudIdentity({ aws: DECL.aws }, "dev", "net")).toBeUndefined();
+    expect(resolveCloudIdentity(undefined, "prod")).toBeUndefined();
+  });
+
+  test("a rule with members never matches a pipeline outside a member", () => {
+    expect(resolveCloudIdentity(DECL, "prod")!.plan.aws!.role).toBe("arn:aws:iam::111111111111:role/prod-plan");
+  });
+
+  test("GCP's default audience names the provider", () => {
+    expect(resolveCloudIdentity(DECL, "prod")!.plan.gcp!.audience).toBe("https://iam.googleapis.com/projects/123/locations/global/workloadIdentityPools/ci/providers/forge");
+  });
+
+  test("a rule may not plan as an identity it or another rule applies as", () => {
+    expect(cloudIdentityProblems(DECL)).toEqual([]);
+    const same = cloudIdentityProblems({ aws: { rules: [{ plan: "r", apply: "r" }] } });
+    expect(same).toEqual([{ pointer: "/ci/identity/cloud/aws/rules/0", message: expect.stringContaining("plans and applies as r") }]);
+    const crossed = cloudIdentityProblems({ gcp: { provider: "p", rules: [{ plan: "a", apply: "b" }, { plan: "b", apply: "c" }] } });
+    expect(crossed).toEqual([{ pointer: "/ci/identity/cloud/gcp/rules/1", message: expect.stringContaining("plans as b, which another rule applies as") }]);
+  });
+});
+
+describe("the trade script stays inside one shell word", () => {
+  test("it holds no single quote, so tradeLine can quote it", () => {
+    expect(TRADE_JS).not.toContain("'");
+  });
+  test("GitLab's lines trade, unset the token variables and the extra ones, then source the credentials", () => {
+    const [trade, unset, source] = gitlabTradeLines(["CHANT_FORGE_TOKEN"]);
+    expect(trade).toContain("node -e");
+    expect(unset).toBe(`unset CHANT_FORGE_TOKEN ${OIDC_REQUEST_VARS.join(" ")}`);
+    expect(source).toMatch(/^\. "\$\{TMPDIR:-\/tmp\}\/chant-cloud-\$CI_JOB_ID\.sh" && rm -f /);
+    expect(gitlabTradeIdTokens(resolveCloudIdentity(DECL, "prod", "app")!.plan)).toEqual({
+      CHANT_ID_TOKEN_AWS: { aud: "sts.amazonaws.com" },
+      CHANT_ID_TOKEN_GCP: { aud: "https://iam.googleapis.com/projects/123/locations/global/workloadIdentityPools/ci/providers/forge" },
+      CHANT_ID_TOKEN_AZURE: { aud: "api://AzureADTokenExchange" },
+    });
+  });
+});
+
+const dirs: string[] = [];
+let emu: OidcEmulator;
+beforeAll(async () => {
+  emu = await startOidcEmulator();
+});
+afterAll(async () => {
+  await emu.close();
+  for (const d of dirs) rmSync(d, { recursive: true, force: true });
+});
+
+const BASE = { PATH: process.env.PATH ?? "/usr/bin:/bin", HOME: process.env.HOME ?? "/tmp" };
+
+/** Run the trade line as a step does, with `spec` pointed at the emulator. */
+async function trade(spec: CloudTradeSpec, format: "github-env" | "sh", env: Record<string, string> = emu.requestEnv): Promise<{ out: string; stdout: string; stderr: string; code: number; file: string }> {
+  const dir = mkdtempSync(join(tmpdir(), "chant-trade-"));
+  dirs.push(dir);
+  const file = join(dir, format === "sh" ? "cloud.sh" : "github-env");
+  if (format === "github-env") writeFileSync(file, "EARLIER=1\n");
+  try {
+    const r = await run("sh", ["-c", tradeLine(file, format)], { env: { ...BASE, ...env, [TRADE_SPEC_ENV]: JSON.stringify(emu.pointAt(spec)) } });
+    return { out: existsSync(file) ? readFileSync(file, "utf-8") : "", stdout: r.stdout, stderr: r.stderr, code: 0, file };
+  } catch (e) {
+    const err = e as { stdout: string; stderr: string; code: number };
+    return { out: existsSync(file) ? readFileSync(file, "utf-8") : "", stdout: err.stdout, stderr: err.stderr, code: err.code, file };
+  }
+}
+
+describe("the trade, run against the emulator (#4296)", () => {
+  const prodApp = () => resolveCloudIdentity(DECL, "prod", "app")!;
+
+  test("it trades one minted token per cloud for the plan identity alone, and writes the credentials to GITHUB_ENV", async () => {
+    const before = { minted: emu.log.minted.length, assumed: emu.log.assumed.length };
+    const r = await trade(prodApp().plan, "github-env");
+    expect(r.stderr).not.toContain("failed");
+    expect(r.code).toBe(0);
+    const aws = emulatedCredentials("arn:aws:iam::111111111111:role/prod-plan");
+    expect(r.out).toContain("EARLIER=1\n");
+    expect(r.out).toContain(`AWS_ACCESS_KEY_ID=${aws.accessKeyId}\n`);
+    expect(r.out).toContain(`AWS_SESSION_TOKEN=${aws.token}\n`);
+    expect(r.out).toContain("AWS_REGION=eu-west-1\n");
+    expect(r.out).toMatch(/^GOOGLE_OAUTH_ACCESS_TOKEN=ya29\.session-/m);
+    expect(r.out).toMatch(/^AZURE_ACCESS_TOKEN=azure\.session-/m);
+    expect(r.out).toContain("AZURE_CLIENT_ID=plan-client-id\n");
+    // The minted token itself is in no line the later steps get, and no apply identity was asked for.
+    expect(r.out).not.toContain(EMULATED_JWT_PREFIX);
+    expect(r.stdout + r.stderr).not.toContain(EMULATED_JWT_PREFIX);
+    expect(emu.log.minted.slice(before.minted)).toEqual(["sts.amazonaws.com", "https://iam.googleapis.com/projects/123/locations/global/workloadIdentityPools/ci/providers/forge", "api://AzureADTokenExchange"]);
+    expect(emu.log.assumed.slice(before.assumed).map((a) => a.role)).toEqual(["arn:aws:iam::111111111111:role/prod-plan"]);
+    expect(emu.log.impersonated.at(-1)).toBe("plan@test-project.iam.gserviceaccount.com");
+    expect(emu.log.clients.at(-1)!.clientId).toBe("plan-client-id");
+    // GitHub masks each secret in every later step's log.
+    expect(r.stdout).toContain(`::add-mask::${aws.secret}`);
+    expect(r.stdout).toContain(`::add-mask::${aws.token}`);
+  });
+
+  test("the sh format writes export lines a GitLab script sources, mode 0600", async () => {
+    const r = await trade({ aws: prodApp().apply.aws }, "sh");
+    expect(r.code).toBe(0);
+    expect(statSync(r.file).mode & 0o777).toBe(0o600);
+    const probe = await run("sh", ["-c", `. "${r.file}"; echo "$AWS_ACCESS_KEY_ID"`], { env: BASE });
+    expect(probe.stdout.trim()).toBe(emulatedCredentials("arn:aws:iam::111111111111:role/prod-apply").accessKeyId);
+  });
+
+  test("on GitLab the token comes from the job's id_tokens variable, and no request URL is needed", async () => {
+    const before = emu.log.minted.length;
+    const jwt = `${EMULATED_JWT_PREFIX}.gitlab.1`;
+    const r = await trade({ aws: prodApp().plan.aws }, "sh", { [idTokenVar("aws")]: jwt });
+    expect(r.code).toBe(0);
+    expect(emu.log.minted.length).toBe(before);
+    expect(emu.log.assumed.at(-1)).toEqual({ role: "arn:aws:iam::111111111111:role/prod-plan", token: jwt });
+    expect(r.out).not.toContain(jwt);
+  });
+
+  test("a job that can request no token fails the step and writes nothing", async () => {
+    const r = await trade({ aws: prodApp().plan.aws }, "sh", {});
+    expect(r.code).not.toBe(0);
+    expect(r.stderr).toContain("the job can request no OIDC token for aws");
+    expect(r.out).toBe("");
+  });
+
+  test("an answer that would add a line of its own to GITHUB_ENV is refused", async () => {
+    const r = await trade({ aws: { ...prodApp().plan.aws!, region: "eu-west-1\nNODE_OPTIONS=--require=/tmp/x" } }, "github-env");
+    expect(r.code).not.toBe(0);
+    expect(r.out).toBe("EARLIER=1\n");
+  });
+});
+
+describe("after the trade, a step that runs the change's code cannot request a token (#4296)", () => {
+  test("the drop line with the OIDC request variables leaves none of them, and a request from the step fails", async () => {
+    const dir = mkdtempSync(join(tmpdir(), "chant-trade-drop-"));
+    dirs.push(dir);
+    const file = join(dir, "step.sh");
+    const ask = `node -e 'const u=process.env.ACTIONS_ID_TOKEN_REQUEST_URL,k=process.env.ACTIONS_ID_TOKEN_REQUEST_TOKEN;if(!u||!k){console.log("no-request-vars");process.exit(0)}fetch(u+"&audience=sts.amazonaws.com",{headers:{authorization:"bearer "+k}}).then(r=>r.text()).then(t=>console.log("minted:"+t))'`;
+    writeFileSync(file, `${dropForgeTokens("sh", OIDC_REQUEST_VARS)}\nenv\n${ask}\n`);
+    const before = emu.log.minted.length;
+    const r = await run("sh", ["-e", file], { cwd: dir, env: { ...BASE, ...emu.requestEnv, [idTokenVar("aws")]: `${EMULATED_JWT_PREFIX}.x.y`, [TRADE_SPEC_ENV]: "{}" } });
+    expect(r.stdout).toContain("no-request-vars");
+    expect(r.stdout).not.toContain(EMULATED_JWT_PREFIX);
+    for (const v of OIDC_REQUEST_VARS) expect(r.stdout).not.toMatch(new RegExp(`^${v}=`, "m"));
+    expect(emu.log.minted.length).toBe(before);
+  });
+});