@intentius/chant 0.124.40 → 0.124.42

package/src/cli/handlers/pr-waves-blocked.test.ts

@@ -0,0 +1,247 @@
+/**
+ * `chant components pr-apply --wave-gate` (#4291): a failed member blocks
+ * only the members that depend on it. `db` fails in wave 1; `app` reads
+ * `net` and still applies in wave 2, and `web` reads `db` and is blocked.
+ * The note lists the blocked set. Git, the change signal, the derivation and
+ * the gate ledger are fakes, as in `pr-waves.test.ts`; the planning, the
+ * coverage check and the apply are the real ones.
+ */
+
+import { mkdtemp, readFile, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { existsSync } from "node:fs";
+import { join } from "node:path";
+import { afterEach, beforeEach, describe, expect, test, vi } from "vitest";
+import type { DriverComponent } from "../../components/driver";
+import type { DeployContext } from "../../components/capability";
+import type { ParsedArgs } from "../registry";
+import type { PrReport } from "../../pr-loop";
+
+const HEAD = "a".repeat(40);
+const BASE = "b".repeat(40);
+
+vi.mock("../../components/changed-files", () => ({
+  resolveCommit: async () => HEAD,
+  resolveMergeBase: async () => BASE,
+}));
+
+vi.mock("../../config", async () => {
+  const actual = await vi.importActual<typeof import("../../config")>("../../config");
+  return { ...actual, loadChantConfig: async () => ({ config: {} }) };
+});
+
+vi.mock("./fan-out", () => ({
+  resolveChangedUnits: async () => ({ units: { changed: ["net", "db"], indeterminate: [] } }),
+}));
+
+// pr-apply stores the change set a gate binds on chant/lifecycle (#4022); never in the real repository.
+vi.mock("../../lifecycle/gate-change-set", () => ({
+  storeGateChangeSet: async () => ({ written: false }),
+  readGraphIds: async () => ({ ids: [] }),
+  setGraphIdReader: () => {},
+  gateGraphReader: () => async () => ({ ids: [] }),
+}));
+vi.mock("../../lifecycle/git", async () => {
+  const actual = await vi.importActual<typeof import("../../lifecycle/git")>("../../lifecycle/git");
+  return { ...actual, pushLifecycleReport: async () => { throw new Error("pr-waves.test must not push chant/lifecycle"); } };
+});
+
+vi.mock("./run", () => ({
+  GATED_EXIT_CODE: 3,
+  autoReleaseRun: (id: string) => ({ runId: id, runOrigin: { forge: "local" } }),
+  recordAutoReleasesForRun: async () => [],
+}));
+
+let gateLedger: ReturnType<typeof import("../../op/gate").memoryGateLedgerPort>;
+vi.mock("../../op/gate", async () => {
+  const actual = await vi.importActual<typeof import("../../op/gate")>("../../op/gate");
+  return { ...actual, gitGateLedgerPort: () => gateLedger, gateIsSealed: async () => false };
+});
+
+/** The outputs each root exposes on the estate: what `outputs` reads and `run` writes. */
+const deployed: Record<string, Record<string, unknown>> = {};
+/** The roots that applied, in order. */
+let ran: string[] = [];
+/**
+ * Whether a root's plan says the `cidr` it will expose (#3999), as
+ * terraform's `planned_values` does. Off, every output of a root the change
+ * plans is known only after apply.
+ */
+let predicts = true;
+/** Roots whose apply fails. */
+const failing = new Set<string>();
+vi.mock("../../components/fan-out-support", async () => {
+  const { CapabilityRegistry } = await import("../../components/capability");
+  const { planFanOut } = await import("../../components/fan-out");
+  const { computePlanDigest } = await import("../../lifecycle/plan-digest");
+  const registry = new CapabilityRegistry();
+  /** A root whose one resource writes its `cidr` input: the plan says so, so a moved input moves the entry. */
+  registry.register({
+    kind: "fake-root",
+    async plan(_ctx: DeployContext, input: { root: string; cidr?: string }) {
+      const cidr = input.cidr ?? null;
+      const planDigest = computePlanDigest("fake-root", { root: input.root, cidr });
+      return {
+        member: input.root,
+        planDigest,
+        artifact: { planDigest, cidr },
+        ...(predicts ? { outputs: { known: { cidr }, unknown: [] } } : {}),
+        changeSet: {
+          member: { member: input.root, lexicon: "terraform", planner: "tofu", status: "planned", planDigest, holes: [] },
+          entries: [
+            {
+              member: input.root,
+              lexicon: "terraform",
+              planner: "tofu",
+              address: `${input.root}.main`,
+              type: "fake_resource",
+              action: "update",
+              attributes: [{ path: "cidr", before: deployed[input.root]?.cidr ?? null, after: cidr }],
+            },
+          ],
+        },
+      };
+    },
+    async outputs(_ctx: DeployContext, input: { root: string }) {
+      return deployed[input.root] ?? {};
+    },
+    // Applies the plan it is handed, as a planned root does, else what its input says now.
+    async run(ctx: DeployContext, input: { root: string; cidr?: string }) {
+      if (failing.has(input.root)) throw new Error(`${input.root} failed`);
+      ran.push(input.root);
+      const planned = (ctx as { plans?: Record<string, { cidr: string | null }> }).plans?.[input.root];
+      deployed[input.root] = { cidr: planned ? planned.cidr : (input.cidr ?? null) };
+      return { outputs: deployed[input.root] };
+    },
+  } as never);
+  return {
+    fanOutRegistry: async () => registry,
+    deriveFanOut: async () => ({
+      success: true,
+      components: ESTATE,
+      plan: planFanOut({ components: ESTATE, changed: ["net", "db"] }),
+      signal: { changed: ["net", "db"], indeterminate: [], unclaimed: [] },
+    }),
+  };
+});
+
+/** Wave 1: `net` and `db`. Wave 2: `app` reads `net`, `web` reads `db`. */
+const fixed = (name: string, dependsOn: string[] = []): DriverComponent => ({
+  name,
+  dependsOn,
+  deploy: [{ phase: "Apply", steps: [{ kind: "fake-root", root: name, cidr: "10.0.0.0/16" }] }],
+});
+const ESTATE: DriverComponent[] = [
+  fixed("net"),
+  fixed("db"),
+  { name: "app", dependsOn: ["net"], deploy: [{ phase: "Apply", steps: [{ kind: "fake-root", root: "app", cidr: { stackOutput: { stack: "net", name: "cidr" } } }] }] },
+  fixed("web", ["db"]),
+];
+const netStep = ESTATE[0]!.deploy[0]!.steps[0] as Record<string, unknown>;
+
+const { memoryGateLedgerPort } = await import("../../op/gate");
+const { runComponentsPrApply, runComponentsPrPlan } = await import("./pr");
+const { checkRunEventLines } = await import("../../workspace/__fixtures__/run-event-check");
+
+let dir: string;
+let record: string;
+let errors: string[];
+let out: string[];
+
+const ctx = (a: Partial<ParsedArgs>) =>
+  ({ args: { command: "components", path: "pr-apply", format: "", fix: false, watch: false, verbose: false, help: false, live: false, base: "main", env: "prod", output: dir, ...a } as ParsedArgs, plugins: [] }) as never;
+/** One wave's job, as the generated pipeline runs it. */
+const wave = (k?: number, a: Partial<ParsedArgs> = {}) => ctx({ pr: 12, waveGate: "release", resume: record, ...(k !== undefined ? { wave: k } : {}), ...a });
+
+const resolution = (gate: string, planDigest: string, by = "github:alice") => ({
+  version: 1 as const,
+  kind: "resolution" as const,
+  op: "pr-12",
+  gate,
+  resolvedBy: by,
+  timestamp: new Date().toISOString(),
+  planDigest,
+});
+
+const report = async (): Promise<PrReport> => JSON.parse(await readFile(join(dir, "pr-apply.json"), "utf8")) as PrReport;
+const note = async (): Promise<string> => readFile(join(dir, "pr-note.md"), "utf8");
+
+/** Plan pull request 12, as its plan job does, and approve its digest as alice. */
+async function planAndApprove(): Promise<string> {
+  expect(await runComponentsPrPlan(ctx({ pr: 12 }))).toBe(0);
+  const digest = (JSON.parse(await readFile(join(dir, "pr-plan.json"), "utf8")) as PrReport).digest;
+  gateLedger = memoryGateLedgerPort({ resolutions: [resolution("pr-apply", digest)] });
+  errors = [];
+  return digest;
+}
+
+beforeEach(async () => {
+  dir = await mkdtemp(join(tmpdir(), "pr-waves-"));
+  record = join(dir, "resume", "pr-apply.json");
+  errors = [];
+  ran = [];
+  predicts = true;
+  for (const k of Object.keys(deployed)) delete deployed[k];
+  deployed.net = { cidr: "10.0.0.0/16" };
+  deployed.app = { cidr: "10.0.0.0/16" };
+  failing.clear();
+  netStep.cidr = "10.0.0.0/16";
+  gateLedger = memoryGateLedgerPort();
+  out = [];
+  vi.spyOn(process.stdout, "write").mockImplementation((chunk: string | Uint8Array) => { out.push(String(chunk)); return true; });
+  vi.spyOn(console, "error").mockImplementation((...m: unknown[]) => { errors.push(m.map(String).join(" ")); });
+  vi.spyOn(console, "log").mockImplementation(() => {});
+});
+
+afterEach(async () => {
+  vi.restoreAllMocks();
+  await rm(dir, { recursive: true, force: true });
+});
+
+describe("pr-apply --wave-gate: a failed member blocks only its dependents (#4291)", () => {
+  test("wave 1 fails db and applies net; wave 2's job still runs, applies app and blocks web by db", async () => {
+    await planAndApprove();
+    failing.add("db");
+
+    expect(await runComponentsPrApply(wave(1))).toBe(1);
+    expect(ran).toEqual(["net"]);
+
+    expect(await runComponentsPrApply(wave(2))).toBe(1);
+    expect(ran).toEqual(["net", "app"]);
+    const r = await report();
+    expect(r.status).toBe("failed");
+    expect(Object.fromEntries(r.members.map((m) => [m.member, [m.status, m.blockedBy]]))).toEqual({
+      net: ["applied", undefined],
+      db: ["failed", undefined],
+      app: ["applied", undefined],
+      web: ["blocked", "db"],
+    });
+    const text = await note();
+    expect(text).toContain("| `web` | web | blocked by `db` |");
+    expect(text).toContain("Blocked, so not applied: `web` (blocked by `db`).");
+    expect(errors.some((e) => /wave 2: web \(blocked by db\), so not planned or applied/.test(e))).toBe(true);
+  });
+
+  test("re-run once db is fixed: wave 1 applies db, and wave 2 applies web", async () => {
+    await planAndApprove();
+    failing.add("db");
+    expect(await runComponentsPrApply(wave(1))).toBe(1);
+    expect(await runComponentsPrApply(wave(2))).toBe(1);
+
+    failing.clear();
+    expect(await runComponentsPrApply(wave(1))).toBe(0);
+    expect(await runComponentsPrApply(wave(2))).toBe(0);
+    expect(ran).toEqual(["net", "app", "db", "web"]);
+    expect((await report()).status).toBe("applied");
+  });
+
+  test("without --wave the waves run in one job: app applies after db failed, web is blocked, exit 1", async () => {
+    await planAndApprove();
+    failing.add("db");
+    expect(await runComponentsPrApply(wave())).toBe(1);
+    expect(ran).toEqual(["net", "app"]);
+    const r = await report();
+    expect(r.members.find((m) => m.member === "web")).toMatchObject({ status: "blocked", blockedBy: "db" });
+    expect(r.message).toContain("Blocked: web (blocked by db).");
+  });
+});

package/src/cli/handlers/pr.test.ts

@@ -26,6 +26,33 @@ vi.mock("../../workspace/security", async (original) => ({
   securityGroupsAt: () => new Set(groups),
 }));
 
+/** The ci.hooks pr-plan and pr-apply read at base (#4288); none unless a test sets them. */
+let hooksAtBase: Record<string, unknown> = {};
+vi.mock("../../components/pr-hooks", async (original) => ({
+  ...(await original<typeof import("../../components/pr-hooks")>()),
+  prLoopHooksAt: (_cwd: string, base: string) => ({ hooks: hooksAtBase, base }),
+}));
+/** `ci.locks` pr-apply reads at base (#4293), and the locks other pull requests hold; none unless a test sets them. */
+let locksMode: "apply" | "plan" | null = null;
+let heldLocks: (gate: string, targets: readonly string[], pr: number | null) => Promise<unknown[]> = async () => [];
+vi.mock("../../workspace/ci-locks", () => ({ ciLocksAt: () => locksMode }));
+vi.mock("../../lifecycle/target-lock", async (original) => ({
+  ...(await original<typeof import("../../lifecycle/target-lock")>()),
+  heldTargetLocks: (gate: string, targets: readonly string[], pr: number | null) => heldLocks(gate, targets, pr),
+}));
+
+/** What ci.policy at base says (#4294): no policy unless a test sets a verdict. The engine itself is gate-policy.test.ts's. */
+let policyVerdict: import("../../gate-policy").GatePolicyVerdict | undefined;
+vi.mock("../../components/pr-policy", async (original) => ({
+  ...(await original<typeof import("../../components/pr-policy")>()),
+  prLoopPolicyAt: (_cwd: string, base: string) => ({ base }),
+  runPrPolicy: () => policyVerdict,
+}));
+vi.mock("../../override-gate", async (original) => ({
+  ...(await original<typeof import("../../override-gate")>()),
+  overridersAt: (_repo: string, base: string) => ({ base, path: ".chant/overriders", active: true, principals: ["github:carol"] }),
+}));
+
 vi.mock("../../components/changed-files", () => ({
   resolveCommit: async () => HEAD,
   resolveMergeBase: async () => BASE,
@@ -134,6 +161,10 @@ beforeEach(async () => {
   refusal.clear();
   onRun = () => {};
   groups = [];
+  hooksAtBase = {};
+  locksMode = null;
+  heldLocks = async () => [];
+  policyVerdict = undefined;
   gateLedger = memoryGateLedgerPort();
   vi.spyOn(process.stdout, "write").mockImplementation((chunk: string | Uint8Array) => { out.push(String(chunk)); return true; });
   vi.spyOn(console, "error").mockImplementation((...m: unknown[]) => { errors.push(m.map(String).join(" ")); });
@@ -353,6 +384,39 @@ describe("--events-json beside --json", () => {
   });
 });
 
+describe("pr-apply under ci.locks (#4293)", () => {
+  test("a target another open pull request holds refuses the apply as locked, before anything plans or applies", async () => {
+    locksMode = "plan";
+    const asked: unknown[] = [];
+    heldLocks = async (gate, targets, pr) => {
+      asked.push({ gate, targets, pr });
+      return [{ target: "net", pr: 9, by: "bob", at: "2026-10-22T10:00:00.000Z", stage: "plan" }];
+    };
+    let ran = false;
+    onRun = () => void (ran = true);
+    expect(await runComponentsPrApply(ctx({ pr: 12, eventsJson: false }))).toBe(3);
+    expect(asked).toEqual([{ gate: "pr-apply", targets: ["net", "app"], pr: 12 }]);
+    expect(ran).toBe(false);
+    const { readFile } = await import("node:fs/promises");
+    const report = JSON.parse(await readFile(join(dir, "pr-apply.json"), "utf8"));
+    expect(report).toMatchObject({ status: "refused", refusal: "locked" });
+    expect(report.message).toContain("net is locked by pull request 9 (planned by bob), so nothing was applied");
+    expect(report.message).toContain("chant unlock --pr 9");
+  });
+
+  test("no lock held by another pull request lets the apply go on to its gate; without ci.locks nothing is read", async () => {
+    locksMode = "apply";
+    expect(await runComponentsPrApply(ctx({ pr: 12, eventsJson: false }))).toBe(3);
+    const { readFile } = await import("node:fs/promises");
+    expect(JSON.parse(await readFile(join(dir, "pr-apply.json"), "utf8"))).toMatchObject({ status: "refused", refusal: "not-approved" });
+    locksMode = null;
+    heldLocks = async () => {
+      throw new Error("read without ci.locks");
+    };
+    expect(await runComponentsPrApply(ctx({ pr: 12, eventsJson: false }))).toBe(3);
+  });
+});
+
 test("under the review-rules security group pr-apply needs --forge, since it reads the pull request's reviews (#4168)", async () => {
   groups = ["review-rules"];
   expect(await runComponentsPrApply(ctx({ pr: 12, eventsJson: false }))).toBe(1);
@@ -495,3 +559,123 @@ describe("pr-apply: a step that refuses its plan because the plan moved (#3997)"
     expect(logLines()).toEqual(["wave 1/2: net", "  net: applied", "wave 2/2: app", "  app: failed"]);
   });
 });
+
+describe("ci.hooks on the pull-request path (#4288)", () => {
+  const logged = (): string[] => {
+    try {
+      return readFileSync(join(dir, "hooks.log"), "utf8").trim().split("\n");
+    } catch {
+      return [];
+    }
+  };
+  const hook = (name: string, extra: Record<string, unknown> = {}) => ({ name, command: ["sh", "-c", `echo ${name} $CHANT_HOOK \${CHANT_TARGET:-wave} >> ${join(dir, "hooks.log")}`], ...extra });
+
+  test("pr-plan runs before-observe, before-plan and after-plan around the plan, each for the components its targets match", async () => {
+    hooksAtBase = {
+      "before-observe": [hook("init", { perRun: true })],
+      "before-plan": [hook("lint", { targets: ["app"] })],
+      "after-plan": [hook("check", { perRun: true, targets: ["net"] })],
+    };
+    expect(await runComponentsPrPlan(ctx({ pr: 12, eventsJson: false }))).toBe(0);
+    expect(logged()).toEqual(["init before-observe net", "init before-observe app", "lint before-plan wave", "check after-plan net"]);
+    const report = JSON.parse(readFileSync(join(dir, "pr-plan.json"), "utf8"));
+    expect(report.hooks.map((h: { moment: string; name: string; outcome: string }) => `${h.moment} ${h.name} ${h.outcome}`)).toEqual([
+      "before-observe init passed",
+      "before-observe init passed",
+      "before-plan lint passed",
+      "after-plan check passed",
+    ]);
+    expect(readFileSync(join(dir, "pr-note.md"), "utf8")).toContain("Hooks: 4 passed.");
+  });
+
+  test("a failed before-plan hook fails pr-plan before anything plans, and the note says which", async () => {
+    hooksAtBase = { "before-plan": [{ name: "lint", command: ["sh", "-c", "exit 4"] }] };
+    expect(await runComponentsPrPlan(ctx({ pr: 12, eventsJson: false }))).toBe(1);
+    const report = JSON.parse(readFileSync(join(dir, "pr-plan.json"), "utf8"));
+    expect(report).toMatchObject({ status: "plan-failed", members: [], message: "The before-plan hook lint exited 4, so nothing was planned or applied." });
+    expect(readFileSync(join(dir, "pr-note.md"), "utf8")).toContain("A hook failed, so nothing can apply.");
+  });
+
+  test("pr-apply runs before-apply and after-apply around an approved apply; a failed before-apply applies nothing", async () => {
+    await runComponentsPrPlan(ctx({ pr: 12, eventsJson: false }));
+    const digest = await plannedDigest();
+    gateLedger = memoryGateLedgerPort({
+      resolutions: [{ version: 1, kind: "resolution", op: "pr-12", gate: "pr-apply", resolvedBy: "github:alice", timestamp: new Date().toISOString(), planDigest: digest }],
+    });
+    hooksAtBase = { "before-apply": [hook("backup")], "after-apply": [hook("smoke", { perRun: true })] };
+    expect(await runComponentsPrApply(ctx({ pr: 12, eventsJson: false }))).toBe(0);
+    expect(logged()).toEqual(["backup before-apply wave", "smoke after-apply net", "smoke after-apply app"]);
+
+    const ran: string[] = [];
+    onRun = (r) => ran.push(r);
+    hooksAtBase = { "before-apply": [{ name: "backup", command: ["sh", "-c", "exit 1"] }] };
+    expect(await runComponentsPrApply(ctx({ pr: 12, eventsJson: false }))).toBe(1);
+    expect(ran).toEqual([]);
+    expect(JSON.parse(readFileSync(join(dir, "pr-apply.json"), "utf8"))).toMatchObject({ status: "failed", message: "The before-apply hook backup exited 1, so nothing was applied." });
+  });
+});
+
+describe("ci.policy on the pull-request path (#4294)", () => {
+  const denied = (): import("../../gate-policy").GatePolicyVerdict => ({
+    result: "denied",
+    engine: "opa",
+    denials: [{ rule: "main.deny_public", message: "bucket logs is public" }],
+    rules: ["main.deny_public"],
+    holds: [],
+    warnings: [],
+  });
+  const approve = (digest: string) => ({ version: 1 as const, kind: "resolution" as const, op: "pr-12", gate: "pr-apply", resolvedBy: "github:alice", timestamp: new Date(Date.now() - 1000).toISOString(), planDigest: digest });
+
+  test("pr-plan reports the denial, fails its status and exits 1, and records nothing", async () => {
+    policyVerdict = denied();
+    expect(await runComponentsPrPlan(ctx({ pr: 12, eventsJson: false }))).toBe(1);
+    const report = JSON.parse(readFileSync(join(dir, "pr-plan.json"), "utf8"));
+    expect(report).toMatchObject({ status: "planned", policy: { result: "denied", rules: ["main.deny_public"], overrideCommand: expect.stringContaining("chant approve policy-override pr-12 --rule main.deny_public") } });
+    expect(gateLedger.appended).toEqual([]);
+    expect(readFileSync(join(dir, "pr-note.md"), "utf8")).toContain("denied this plan:");
+  });
+
+  test("pr-apply refuses a denied plan though the gate is approved, and records the denial for an override", async () => {
+    await runComponentsPrPlan(ctx({ pr: 12, eventsJson: false }));
+    const digest = await plannedDigest();
+    gateLedger = memoryGateLedgerPort({ resolutions: [approve(digest)] });
+    policyVerdict = denied();
+    const ran: string[] = [];
+    onRun = (r) => ran.push(r);
+    expect(await runComponentsPrApply(ctx({ pr: 12, eventsJson: false }))).toBe(3);
+    const report = JSON.parse(readFileSync(join(dir, "pr-apply.json"), "utf8"));
+    expect(report).toMatchObject({ status: "refused", refusal: "policy-denied", policy: { result: "denied" } });
+    expect(report.message).toContain("github:carol may override it");
+    expect(gateLedger.appended).toEqual([expect.objectContaining({ op: "policy-override", gate: "pr-12", plan: digest, rules: ["main.deny_public"] })]);
+    expect(ran).toEqual([]);
+  });
+
+  test("an override by a listed overrider lets pr-apply apply under the gate's approval, and is spent first", async () => {
+    await runComponentsPrPlan(ctx({ pr: 12, eventsJson: false }));
+    const digest = await plannedDigest();
+    const { overrideDigest } = await import("../../override-gate");
+    const od = overrideDigest("pr-12", digest, ["main.deny_public"]);
+    gateLedger = memoryGateLedgerPort({
+      resolutions: [approve(digest), { version: 1, kind: "resolution", op: "policy-override", gate: "pr-12", resolvedBy: "github:carol", timestamp: new Date(Date.now() - 500).toISOString(), planDigest: od, note: "the bucket is the docs site" }],
+    });
+    policyVerdict = denied();
+    expect(await runComponentsPrApply(ctx({ pr: 12, eventsJson: false }))).toBe(0);
+    const report = JSON.parse(readFileSync(join(dir, "pr-apply.json"), "utf8"));
+    expect(report).toMatchObject({ status: "applied", policy: { result: "denied", override: { by: "github:carol", digest: od } } });
+    expect(gateLedger.applied).toEqual([expect.objectContaining({ op: "policy-override", gate: "pr-12", planDigest: od })]);
+  });
+
+  test("a policy that could not run applies nothing and exits 1; a hold still needs the gate's approval", async () => {
+    await runComponentsPrPlan(ctx({ pr: 12, eventsJson: false }));
+    const digest = await plannedDigest();
+    gateLedger = memoryGateLedgerPort({ resolutions: [approve(digest)] });
+    policyVerdict = { result: "error", engine: "opa", denials: [], rules: [], holds: [], warnings: [], error: "opa did not run" };
+    expect(await runComponentsPrApply(ctx({ pr: 12, eventsJson: false }))).toBe(1);
+    expect(JSON.parse(readFileSync(join(dir, "pr-apply.json"), "utf8"))).toMatchObject({ status: "refused", refusal: "policy-error" });
+
+    gateLedger = memoryGateLedgerPort();
+    policyVerdict = { result: "held", engine: "opa", denials: [], rules: [], holds: [{ rule: "main.hold_iam", message: "iam" }], warnings: [] };
+    expect(await runComponentsPrApply(ctx({ pr: 12, eventsJson: false }))).toBe(3);
+    expect(JSON.parse(readFileSync(join(dir, "pr-apply.json"), "utf8"))).toMatchObject({ status: "refused", refusal: "not-approved", policy: { result: "held" } });
+  });
+});