@intentius/chant 0.124.46 → 0.124.49

package/src/workspace/ci-green-workflow.ts

@@ -48,8 +48,9 @@
 import { existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync } from "node:fs";
 import { dirname, join, relative, resolve, sep } from "node:path";
 import { GENERATED_MARKER } from "../discovery/files";
+import { ACTION_PINS, tagComments, usesRef } from "../action-pins";
 import { emitYAMLEntry, parseYAMLDocument } from "../yaml";
-import type { CiBuild, CiGreen } from "./declaration";
+import { greenBranches, type CiBuild, type CiGreen } from "./declaration";
 import { matchesCheckRun } from "./ci-green";
 import { githubSecretOrJobToken } from "../ci-jobs";
 import { COMPOSE_BRANCH_PREFIX } from "../lifecycle/compose-refs";
@@ -228,7 +229,7 @@ export function renderCiGreenWorkflow(input: WorkflowInput): string {
       ? [
           "      - name: Mint a GitHub App token that may push tags to commits that change workflows",
           "        id: app-token",
-          "        uses: actions/create-github-app-token@v2",
+          `        uses: ${usesRef(ACTION_PINS.createGithubAppToken2)}`,
           "        with:",
           `          app-id: \${{ vars.${push.appIdVar} }}`,
           `          private-key: \${{ secrets.${push.appKeySecret} }}`,
@@ -247,7 +248,7 @@ export function renderCiGreenWorkflow(input: WorkflowInput): string {
     "    types:",
     "      - completed",
     "    branches:",
-    `      - ${q(green.branch)}`,
+    ...greenBranches(green).map((b) => `      - ${q(b)}`),
     // #4169: a build the tick asked for runs at a ci/build/<sha> tag, and its completion ticks too.
     ...(newestPhases(green) ? [`      - ${q("ci/build/**")}`] : []),
     // #4220: a composed commit's phases run on its chant/compose/<name> branch, and their completion ticks too.
@@ -273,12 +274,12 @@ export function renderCiGreenWorkflow(input: WorkflowInput): string {
     "    timeout-minutes: 15",
     "    steps:",
     ...mint,
-    "      - uses: actions/checkout@v6",
+    `      - uses: ${usesRef(ACTION_PINS.checkout6)}`,
     "        with:",
     `          ref: ${q(green.branch)}`,
     "          fetch-depth: 0",
     ...token,
-    "      - uses: actions/setup-node@v6",
+    `      - uses: ${usesRef(ACTION_PINS.setupNode6)}`,
     "        with:",
     "          node-version: \"24\"",
     ...cache,
@@ -292,7 +293,7 @@ export function renderCiGreenWorkflow(input: WorkflowInput): string {
     ...(input.runnerKeySecret ? [`          CHANT_RUNNER_KEY: \${{ secrets.${input.runnerKeySecret} }}`] : []),
     `        run: ${tick}`,
   ];
-  return lines.join("\n") + "\n";
+  return tagComments(lines.join("\n") + "\n");
 }
 
 /** Whether any phase sets `build` (#4169): then the tick may re-run jobs and start workflows. */
@@ -370,7 +371,7 @@ export function buildTriggerEdits(green: CiGreen, sources: readonly WorkflowSour
       delete on.schedule;
       const push = isObject(on.push) ? { ...on.push } : {};
       const branches = Array.isArray(push.branches) ? push.branches.filter((b): b is string => typeof b === "string") : [];
-      const withBranch = branches.includes(green.branch) ? branches : [...branches, green.branch];
+      const withBranch = [...branches, ...greenBranches(green).filter((b) => !branches.includes(b))];
       push.branches = compose && !withBranch.includes(COMPOSE_BRANCHES) ? [...withBranch, COMPOSE_BRANCHES] : withBranch;
       const { push: _push, workflow_dispatch: dispatch, ...rest } = on;
       text = writeTopLevel(text, "on", { push, workflow_dispatch: dispatch ?? {}, ...rest });
@@ -388,8 +389,11 @@ export function buildTriggerEdits(green: CiGreen, sources: readonly WorkflowSour
       if (!("workflow_dispatch" in next)) next = { ...next, workflow_dispatch: {} };
       if (next !== on) text = writeTopLevel(text, "on", next);
       // #4220: a compose branch's commits each get a verdict, so its runs are keyed by commit, as the trunk branch's are.
-      const keyed = compose ? `(github.ref == '${main}' || startsWith(github.ref, 'refs/heads/${COMPOSE_BRANCH_PREFIX}'))` : `github.ref == '${main}'`;
-      const unkeyed = compose ? `!${keyed}` : `github.ref != '${main}'`;
+      // #4325: each branch ci.green judges is keyed by commit.
+      const heads = greenBranches(green).map((b) => `github.ref == 'refs/heads/${b}'`);
+      const several = heads.length > 1;
+      const keyed = compose ? `(${[...heads, `startsWith(github.ref, 'refs/heads/${COMPOSE_BRANCH_PREFIX}')`].join(" || ")})` : several ? `(${heads.join(" || ")})` : `github.ref == '${main}'`;
+      const unkeyed = compose || several ? `!${keyed}` : `github.ref != '${main}'`;
       // Written as lines: the emitter would quote the expression, and GitHub reads it the same either way.
       text = writeTopLevel(text, "concurrency", [
         "concurrency:",

package/src/workspace/ci-green.ts

@@ -55,7 +55,7 @@
 
 import { judgeCommits, mergeCommits, readWorkIndex, type CommitLink } from "./commit-links";
 import { execFileSync } from "node:child_process";
-import { readDeclaration, readerVersion, WORKSPACE_ERROR_CODES, WorkspaceReadError, type CiGreen, type CiPhase, type CiSource } from "./declaration";
+import { greenBranches, readDeclaration, readerVersion, WORKSPACE_ERROR_CODES, WorkspaceReadError, type CiGreen, type CiPhase, type CiSource } from "./declaration";
 import type { CheckRun, CiForge, OpRunRef } from "./ci-green-forge";
 import type { OpRunRecord } from "../op/runtime";
 import { readRunLedger } from "../lifecycle/run-ledger";
@@ -514,8 +514,25 @@ export function readGreen(cwd: string): { green: CiGreen; top: string; workspace
   return { green, top, workspace: { name: declaration.name, root: located.root, file: declaration.file } };
 }
 
+/**
+ * `green` judging `branch` (#4325): `ci.green` names several branches when
+ * `ci.branches` routes members to branches of their own, and each is judged
+ * as the single branch always was. Without `branch` the first is judged.
+ * Refuses a branch `ci.green` does not name.
+ */
+export function greenOn(green: CiGreen, branch: string | undefined): CiGreen {
+  const { branches: _all, ...rest } = green;
+  if (branch === undefined || branch === green.branch) return rest;
+  if (!greenBranches(green).includes(branch)) {
+    throw new CiGreenError("ci-branch-unknown", `ci.green judges ${greenBranches(green).join(", ")}, not ${branch}; add it to ci.green.branch to give it a green verdict`);
+  }
+  return { ...rest, branch };
+}
+
 export interface TickRequest {
   cwd: string;
+  /** Judge this one branch of `ci.green.branch` (#4325). Without it a tick judges every branch the declaration names. */
+  branch?: string;
   /**
    * Where check runs come from. A function is called only when the source
    * is `checks`, so a tick from runs needs no forge token. Required for
@@ -547,6 +564,8 @@ export interface ComposedBranchTick {
 
 export interface TickResult {
   branch: string;
+  /** The other branches `ci.green` names (#4325), each judged as this one is. Their tags are in `made`. Absent for a one-branch declaration. */
+  routed?: TickResult[];
   window: string;
   /** The ref the commits were read from. */
   ref: string;
@@ -601,7 +620,16 @@ export function ciTagSigner(top: string, base: string, pem: string, what = "the
 export async function ciTick(req: TickRequest): Promise<TickResult> {
   const read = readGreen(req.cwd);
   const top = read.top;
-  const green: CiGreen = { ...read.green, source: req.source ?? read.green.source };
+  const names = greenBranches(read.green);
+  if (req.branch === undefined && names.length > 1) {
+    const first = await ciTick({ ...req, branch: names[0]! });
+    const routed: TickResult[] = [];
+    for (const b of names.slice(1)) routed.push(await ciTick({ ...req, branch: b }));
+    return { ...first, routed, made: [...first.made, ...routed.flatMap((r) => r.made)] };
+  }
+  const green: CiGreen = { ...greenOn(read.green, req.branch), source: req.source ?? read.green.source };
+  // Compose branches are walked from trunk, so only the first branch's tick walks them.
+  const walksCompose = green.branch === read.green.branch;
   const forge = green.source === "checks" ? (typeof req.forge === "function" ? req.forge() : req.forge) : undefined;
   if (green.source === "checks" && !forge) throw new Error("ci.green.source is checks, so the tick reads check runs and needs a forge");
   const remote = req.remote ?? "origin";
@@ -671,7 +699,7 @@ export async function ciTick(req: TickRequest): Promise<TickResult> {
   if (links) for (const c of planned) c.work = links.get(c.sha);
   // Compose branches (#4168 4.3): each composed commit within the window is judged as trunk's are, and its tags name its branch.
   const composed: ComposedBranchTick[] = [];
-  for (const b of remoteComposeBranches(top, remote)) {
+  for (const b of walksCompose ? remoteComposeBranches(top, remote) : []) {
     const own = git(top, ["log", "--first-parent", `--max-age=${cutoff}`, "--format=%H %ct", b.ref, `^${tracking}`])
       .split("\n")
       .filter(Boolean)
@@ -904,18 +932,20 @@ export interface RequestBuildResult {
  */
 export async function requestBuild(req: { cwd: string; at: string; remote?: string; forge?: CiForge; now?: Date }): Promise<RequestBuildResult> {
   const read = readGreen(req.cwd);
-  const { green, top } = read;
+  const { top } = read;
+  const green = greenOn(read.green, undefined);
+  const names = greenBranches(read.green);
   const remote = req.remote ?? "origin";
-  const tracking = `refs/remotes/${remote}/${green.branch}`;
+  const trackingOf = (b: string): string => `refs/remotes/${remote}/${b}`;
   try {
-    git(top, ["fetch", "--quiet", "--no-tags", remote, `+refs/heads/${green.branch}:${tracking}`, `+refs/tags/${CI_BUILD_TAG_PREFIX}*:refs/tags/${CI_BUILD_TAG_PREFIX}*`]);
+    git(top, ["fetch", "--quiet", "--no-tags", remote, ...names.map((b) => `+refs/heads/${b}:${trackingOf(b)}`), `+refs/tags/${CI_BUILD_TAG_PREFIX}*:refs/tags/${CI_BUILD_TAG_PREFIX}*`]);
   } catch (err) {
-    throw new Error(`could not fetch ${green.branch} and the build requests from ${remote}: ${stderrOf(err)}`);
+    throw new Error(`could not fetch ${names.join(", ")} and the build requests from ${remote}: ${stderrOf(err)}`);
   }
   if (req.at.startsWith("-") || tryGit(top, ["rev-parse", "--verify", "--quiet", `${req.at}^{commit}`]) === null) throw new WorkspaceReadError("revision-unknown", `--at ${req.at} names no commit in this repository`);
   const sha = git(top, ["rev-parse", `${req.at}^{commit}`]);
-  const onBranch = git(top, ["rev-list", "--first-parent", tracking]).split("\n").includes(sha);
-  if (!onBranch) throw new Error(`${sha.slice(0, 12)} is not a first-parent commit of ${remote}/${green.branch}, and only those are judged green`);
+  const onBranch = names.some((b) => tryGit(top, ["rev-list", "--first-parent", trackingOf(b)])?.split("\n").includes(sha));
+  if (!onBranch) throw new Error(`${sha.slice(0, 12)} is not a first-parent commit of ${names.map((b) => `${remote}/${b}`).join(" or ")}, and only those are judged green`);
   const existing = readBuildRequests(top).get(sha);
   const request = existing ?? requestedBuild(green, sha, green.require, req.now ?? new Date());
   const warnings: string[] = [];
@@ -1101,6 +1131,7 @@ export function whyWorkUnknown(work: CommitLink | null | undefined): string | un
 
 /** The text `chant ci tick` prints. */
 export function formatTick(r: TickResult, dryRun = false): string {
+  if (r.routed) return [formatTick({ ...r, routed: undefined }, dryRun), ...r.routed.map((b) => formatTick(b, dryRun))].join("\n");
   const lines = [`${r.branch}, commits within ${r.window}${r.source === "runs" ? ", judged from chant runs" : ""}: ${r.commits.length}`];
   for (const c of r.commits) {
     const short = c.sha.slice(0, 12);
@@ -1187,10 +1218,12 @@ export const LAST_GREEN_NEWER = 50;
  * green tag and no revoked tag. It reads local refs and tags and never
  * fetches, so a reader fetches first (`git fetch origin --tags`).
  */
-export function lastGreen(req: { cwd: string; remote?: string; from?: string }): LastGreenDocument {
+export function lastGreen(req: { cwd: string; remote?: string; from?: string; branch?: string }): LastGreenDocument {
   const head = { $schema: CI_LAST_GREEN_SCHEMA_ID, contract: CI_LAST_GREEN_CONTRACT_VERSION, chant: readerVersion() };
   try {
-    const { green, top, workspace } = readGreen(req.cwd);
+    const read = readGreen(req.cwd);
+    const { top, workspace } = read;
+    const green = greenOn(read.green, req.branch);
     const branchRef = branchRefOf(top, green, req.remote);
     let ref = branchRef;
     if (req.from !== undefined) {
@@ -1355,6 +1388,8 @@ function recordedPhase(green: CountedCiTag | undefined, phase: string): CiListPh
 
 export interface ListRequest {
   cwd: string;
+  /** List this branch of `ci.green.branch` (#4325). The first when absent. */
+  branch?: string;
   remote?: string;
   /** Keep only the newest n commits. */
   limit?: number;
@@ -1380,7 +1415,9 @@ export interface ListRequest {
 export async function ciList(req: ListRequest): Promise<CiListDocument> {
   const head = { $schema: CI_LIST_SCHEMA_ID, contract: CI_LIST_CONTRACT_VERSION, chant: readerVersion() };
   try {
-    const { green, top, workspace } = readGreen(req.cwd);
+    const read = readGreen(req.cwd);
+    const { top, workspace } = read;
+    const green = greenOn(read.green, req.branch);
     const ref = branchRefOf(top, green, req.remote);
 
     const logArgs = ["log", "--first-parent", "--format=%H %ct"];

package/src/workspace/ci-run.test.ts

@@ -17,7 +17,7 @@ import { join } from "node:path";
 import { afterAll, beforeAll, describe, expect, test } from "vitest";
 import { cleanScratch, declaration, git, repoFixture, scratchDir, writeFiles } from "./__fixtures__/contract-repo";
 import { checkRunEventLines } from "./__fixtures__/run-event-check";
-import { ciJobCommand, ciJobEnv, ciJobFailure, ciJobOp, ciLoopOptions, ciRun, CiRunError, ciStatusContext, ciStatusFromEnv, ciStatusUrl, formatCiRun } from "./ci-run";
+import { chantNodeModules, ciJobCommand, ciJobEnv, ciJobFailure, ciJobOp, ciLoopOptions, ciRun, CiRunError, ciStatusContext, ciStatusFromEnv, ciStatusUrl, formatCiRun } from "./ci-run";
 import type { CommitStatus, ForgeStatus, PrForge } from "../pr-forge";
 import { FORGE_TOKEN_VARS } from "../ci-handover";
 import { ciList, ciTick, evaluateCommit, readOpRunSource, revokedAnnotation } from "./ci-green";
@@ -1040,6 +1040,77 @@ describe("the plan's steps hold no forge token (#4295)", () => {
   });
 });
 
+/** A scheduled watch Op's file, shaped as discovery reads one (entity.props = OpConfig), importing nothing. */
+const WATCH_OP = (name: string): string =>
+  `export default { props: { name: ${JSON.stringify(name)}, overview: "t", schedule: { cron: "0 * * * *" }, labels: { Watch: "true" }, phases: [{ name: "Run", steps: [] }] } };\n`;
+
+describe("chant ci run plan checks the scheduled Ops at --base for the note (#4328)", () => {
+  /**
+   * The base declares watch Op `drift`, with its generated workflow. The
+   * change deletes it and adds `sneaky`. The note names the Op the base has,
+   * since the check reads the Ops at --base, and never the change's own.
+   */
+  function stale(): { app: string; base: string; sha: string } {
+    const { root, app } = workspace();
+    writeFiles(root, {
+      "app/chant.config.json": "{}",
+      "app/ops/drift.op.ts": WATCH_OP("drift"),
+      ".forgejo/workflows/app-drift.yml": "on: schedule\n",
+    });
+    const base = commitAt(root, 1, "app/b.txt");
+    execFileSync("git", ["rm", "-q", "app/ops/drift.op.ts"], { cwd: root });
+    writeFiles(root, { "app/ops/sneaky.op.ts": WATCH_OP("sneaky"), ".forgejo/workflows/app-sneaky.yml": "on: schedule\n" });
+    const sha = commitAt(root, 0.5, "app/c.txt");
+    return { app, base, sha };
+  }
+
+  function overdueForge(): { forge: PrForge; notes: string[]; asked: string[] } {
+    const notes: string[] = [];
+    const asked: string[] = [];
+    const forge = {
+      kind: "forgejo",
+      host: "forgejo.localhost",
+      async setStatus() {},
+      async upsertNote(_pr: number, _marker: string, body: string) {
+        notes.push(body);
+        return "1";
+      },
+      // Every Op last ran a year ago: overdue whichever is asked about.
+      async scheduledRuns(q: { op: string }) {
+        asked.push(q.op);
+        return { last: "2025-10-01T00:00:00Z" };
+      },
+    } as unknown as PrForge;
+    return { forge, notes, asked };
+  }
+
+  test("on the runner, the note warns of the base's overdue Op and not of one the change added", async () => {
+    const { app, base, sha } = stale();
+    const forge = overdueForge();
+    const r = await ciRun({ image: JOB_IMAGE, cwd: app, job: "plan", env: "prod", forge: "forgejo", base, pr: 7, chant: fakeChant(), hostEnv: { ...HOST, FAKE_REPORT: planReport(sha) }, passEnv: ["FAKE_REPORT"], planForge: forge.forge, push: false, output: join(scratchDir("chant-ci-overdue-"), "pr") });
+    expect(r.status).toBe("ok");
+    expect(forge.asked).toEqual(["drift"]);
+    expect(forge.notes).toHaveLength(1);
+    expect(forge.notes[0]).toContain("Op `drift` is overdue");
+    expect(forge.notes[0]).not.toContain("sneaky");
+    expect(r.warnings).toEqual([expect.stringMatching(/Op `drift` is overdue/)]);
+  });
+
+  test("in place, the check still reads the base, not the checkout the change runs in", async () => {
+    const { app, base, sha } = stale();
+    const forge = overdueForge();
+    const r = await ciRun({ cwd: app, job: "plan", env: "prod", forge: "forgejo", base, pr: 7, chant: fakeChant(), hostEnv: { ...HOST, GITHUB_JOB: "plan", FAKE_REPORT: planReport(sha) }, inPlace: true, push: false, planForge: forge.forge });
+    expect(r.status).toBe("ok");
+    expect(forge.asked).toEqual(["drift"]);
+    expect(forge.notes[0]).toContain("Op `drift` is overdue");
+  });
+
+  test("the base checkout resolves packages from the node_modules the running chant is installed in", () => {
+    expect(chantNodeModules("/opt/ci/node_modules/@intentius/chant/dist/workspace/ci-run.js")).toBe("/opt/ci/node_modules");
+    expect(chantNodeModules("/src/chant/packages/core/src/workspace/ci-run.ts")).toBeUndefined();
+  });
+});
+
 /**
  * #4330: a pull request environment's jobs run through `ci run` too. The
  * stand-in chant keeps each action's arguments, environment, directory and

package/src/workspace/ci-run.ts

@@ -53,7 +53,9 @@
  * report with its own token (`postPlanReport`, ../pr-post.ts). In place, a
  * generated job holds no token and its `plan-note` job posts; a job that
  * still holds one was generated before #4295, and the runner posts for it
- * with a warning to regenerate.
+ * with a warning to regenerate. Either way the note's overdue check (#4289)
+ * reads the scheduled Ops from a fresh checkout of `--base`, as the
+ * plan-note job reads them at the target branch's commit (#4328).
  *
  * Signing is opt-in (#4156). With no runner key the record is unsigned, and
  * a reader counts it with no signer. A key `.chant/trust.json` does not list
@@ -81,14 +83,16 @@
  */
 
 import { execFileSync } from "node:child_process";
-import { copyFileSync, cpSync, existsSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, realpathSync, rmSync, writeFileSync } from "node:fs";
+import { copyFileSync, cpSync, existsSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, realpathSync, rmSync, symlinkSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
-import { dirname, join, relative, resolve, sep } from "node:path";
+import { basename, dirname, join, relative, resolve, sep } from "node:path";
+import { fileURLToPath } from "node:url";
 import { PR_APPLY_RECORD, PR_ENV_POST_JOB, PR_ENV_REPORT_DIR, PR_LOOP_REPORT_DIR, prEnvJobs, prLoopJobs, prLoopSetup, PR_LOOP_IMAGE, type PrEnvJob, type PrLoopJob, type PrLoopPipelineOptions } from "../components/pr-pipeline";
 import { detectForge, ForgeEnvironmentError, forgeFromEnv, FORGE_KINDS, type CommitStatus, type ForgeKind, type PrForge } from "../pr-forge";
 import { holdsForgeToken, withoutForgeTokens } from "../ci-handover";
 import { postPlanReport } from "../pr-post";
-import { PR_APPLY_GATE } from "../pr-loop";
+import { overdueOpsAt } from "../op/schedule-overdue";
+import { PR_APPLY_GATE, type PrOverdue } from "../pr-loop";
 import type { CommandContext } from "../cli/registry";
 import { formatError, formatWarning } from "../cli/format";
 import { CHANT_CI_RUN_FORGE_ENV, CHANT_CI_RUN_ID_ENV, FORGE_RUN_ENV, resolveCiJob, type RunOrigin } from "../lifecycle/release-ledger";
@@ -738,7 +742,9 @@ export async function ciRun(req: CiRunRequest): Promise<CiRunResult> {
   // A generated wave job's command, as prLoopWaveJobs writes it. #4161: a local job's command posts no status or note.
   const forgeCommand = req.noForge ? found.command.replace(` --forge ${req.forge}`, "") : found.command;
   const noStatus = req.local && !/ --no-status(?: |$)/.test(forgeCommand);
-  const command = `${forgeCommand}${req.wave !== undefined ? ` --wave ${req.wave}` : ""}${noStatus ? " --no-status" : ""}`;
+  // #4325: a record or apply on a routed branch is told the branch, as the forge's ref would tell it in a pipeline. `ci serve` has no such ref.
+  const branch = req.job !== "plan" && req.loop?.branch !== undefined && !/ --branch(?: |=)/.test(forgeCommand) ? ` --branch ${/^[A-Za-z0-9._\/=:@%+,-]+$/.test(req.loop.branch) ? req.loop.branch : `'${req.loop.branch.replace(/'/g, `'\\''`)}'`}` : "";
+  const command = `${forgeCommand}${branch}${req.wave !== undefined ? ` --wave ${req.wave}` : ""}${noStatus ? " --no-status" : ""}`;
   const job = { ...found, command, ...(req.wave !== undefined ? { wave: req.wave } : {}) };
   const own = ciJobEnv(job, {
     forge: req.forge,
@@ -759,7 +765,7 @@ export async function ciRun(req: CiRunRequest): Promise<CiRunResult> {
   const redact = ciRedactor(req.inPlace ? { ...longValues(jobEnv), ...own } : jobEnv, req.secrets);
   try {
     const ran = await runCiJob(req, { cwd, top, commit, place, job, jobEnv, ...(redact ? { redact } : {}) });
-    const posted = poster ? await postFromReport(req, poster, ran, { commit, ...(place.member ? { member: place.member } : {}) }) : [];
+    const posted = poster ? await postFromReport(req, poster, ran, { top, dir: place.dir, commit, ...(place.member ? { member: place.member } : {}) }) : [];
     const envPost = req.job === "env-up" ? await envPostAfterUp(req, { cwd, top, head: commit, place, jobs, hostEnv, ran }) : undefined;
     const withPost = envPost ? ("result" in envPost ? { ...ran, post: envPost.result } : { ...ran, warnings: [...ran.warnings, envPost.warning] }) : ran;
     const withPosts = posted.length > 0 ? { ...withPost, warnings: [...withPost.warnings, ...posted] } : withPost;
@@ -831,10 +837,11 @@ async function postFromReport(
   req: CiRunRequest,
   poster: NonNullable<ReturnType<typeof planPoster>>,
   ran: CiRunResult,
-  at: { commit: string; member?: string },
+  at: { top: string; dir: string; commit: string; member?: string },
 ): Promise<string[]> {
   if ("error" in poster) return [poster.error];
   const warnings = poster.warning ? [poster.warning] : [];
+  const checked: string[] = [];
   const dir = ran.report ?? resolve(req.cwd, req.output ?? PR_LOOP_REPORT_DIR);
   const posted = await postPlanReport({
     forge: poster.forge,
@@ -844,9 +851,62 @@ async function postFromReport(
     env: req.env,
     ...(at.member ? { member: at.member } : {}),
     result: ran.status === "ok" ? "success" : "failure",
+    // #4328: as pr-post does (#4289), with the Ops read at --base, never from the change's checkout.
+    overdue: () => overdueAtBase(req, { forge: poster.forge, top: at.top, dir: at.dir, ...(at.member ? { member: at.member } : {}), log: (line) => checked.push(line) }),
   });
   if (posted.refused) warnings.push(`the plan report was not posted: ${posted.refused}`);
-  return [...warnings, ...posted.warnings];
+  return [...warnings, ...checked, ...posted.warnings];
+}
+
+/**
+ * The overdue check for the plan's note (#4289, #4328), at `--base`, as the
+ * plan-note job's `pr-post` runs it at the target branch's commit. The Ops
+ * are read from a fresh checkout of the base outside the repository, never
+ * from the checkout the change's code ran in, in place or not. That checkout
+ * resolves packages from the `node_modules` the running chant is installed
+ * in ({@link chantNodeModules}), so an Op file's `@intentius/chant` is the
+ * chant running the job, not one the change installed. Without `--base`
+ * nothing is checked, and `log` says so.
+ */
+async function overdueAtBase(
+  req: CiRunRequest,
+  at: { forge: PrForge; top: string; dir: string; member?: string; log: (line: string) => void },
+): Promise<PrOverdue[]> {
+  if (!at.forge.scheduledRuns) return [];
+  if (!req.base) {
+    at.log("the scheduled Ops were not checked: the check reads them at the target branch's commit, so pass --base <sha>");
+    return [];
+  }
+  let checkout: { dir: string; remove(): void };
+  try {
+    checkout = freshCheckout(at.top, resolveJobCommit(at.top, req.base));
+  } catch (err) {
+    at.log(`the scheduled Ops were not checked: ${message(err)}`);
+    return [];
+  }
+  try {
+    const modules = chantNodeModules();
+    const link = join(checkout.dir, "node_modules");
+    if (modules && !existsSync(link)) symlinkSync(modules, link, "dir");
+    return await overdueOpsAt({ forge: at.forge, cwd: at.dir === "." ? checkout.dir : join(checkout.dir, at.dir), ...(at.member ? { member: at.member } : {}), log: at.log });
+  } finally {
+    checkout.remove();
+  }
+}
+
+/**
+ * The `node_modules` directory the running chant is installed in, or
+ * undefined when it runs from a source checkout, where chant's own packages
+ * resolve without one (../ts-loader.ts).
+ */
+export function chantNodeModules(from: string = fileURLToPath(import.meta.url)): string | undefined {
+  let dir = dirname(from);
+  for (;;) {
+    if (basename(dir) === "node_modules") return dir;
+    const parent = dirname(dir);
+    if (parent === dir) return undefined;
+    dir = parent;
+  }
 }
 
 /**

package/src/workspace/ci-serve.test.ts

@@ -602,3 +602,98 @@ describe("ci serve runs fast-forwards only, and honours [skip ci] (#4122)", () =
     expect(ofType(events, "not-run")).toHaveLength(1);
   });
 });
+
+describe("ci serve follows ci.branches (#4325)", () => {
+  /** A forge with a head per branch, and the branches it was asked about. */
+  function branchForge(heads: Record<string, string>): CiServeForge & { heads: Record<string, string>; polled: string[] } {
+    const f = {
+      heads,
+      polled: [] as string[],
+      async pullRequestFor() {
+        return null;
+      },
+      async openPullRequests(base: string) {
+        f.polled.push(base);
+        return [];
+      },
+      async branchHead(branch: string) {
+        return f.heads[branch];
+      },
+    };
+    return f;
+  }
+
+  /** The workspace with `ci.branches` routing `app` to `release`, and a `release` branch on the forge. */
+  function routed(globs: string[] = ["app"]): ReturnType<typeof workspace> & { release: string } {
+    const w = workspace();
+    writeFiles(w.root, { "chant.workspace.json": declaration([{ name: "app", dir: "app", kind: "other", because: "the app" }], { ci: { branches: { release: globs } } }) });
+    commit(w.root, "app/route.txt", "route app to release");
+    git(w.root, "push", "-q", "origin", "main");
+    git(w.root, "checkout", "-q", "-b", "release");
+    const release = commit(w.root, "app/rel.txt");
+    git(w.root, "push", "-q", "origin", "release");
+    git(w.root, "checkout", "-q", "main");
+    return { ...w, main: git(w.root, "rev-parse", "main"), release };
+  }
+
+  test("a routed member polls its route alone, and its record job gets --branch", async () => {
+    const { root, app, main, release } = routed();
+    const forge = branchForge({ main, release });
+    const { opts, events } = serve(app, forge);
+    await ciServePass(opts);
+    expect(forge.polled).toEqual(["release"]);
+    expect(ofType(events, "baseline")).toEqual([{ type: "baseline", commit: release }]);
+
+    git(root, "checkout", "-q", "release");
+    const next = commit(root, "app/rel2.txt");
+    git(root, "push", "-q", "origin", "release");
+    git(root, "checkout", "-q", "main");
+    forge.heads.release = next;
+    const pass = await ciServePass(opts);
+    expect(pass.jobs).toEqual([expect.objectContaining({ job: "record", commit: next, base: release, status: "ok" })]);
+    const argv = argsOf(pass.jobs[0]!.report!, "pr-record");
+    expect(argv[argv.indexOf("--branch") + 1]).toBe("release");
+    // A push to main is not this member's.
+    forge.heads.main = "0".repeat(40);
+    expect((await ciServePass(opts)).jobs).toEqual([]);
+  });
+
+  test("a member no glob matches polls main and passes no --branch", async () => {
+    const { root, app, main } = routed(["other-*"]);
+    const forge = branchForge({ main });
+    const { opts } = serve(app, forge);
+    await ciServePass(opts);
+    expect(forge.polled).toEqual(["main"]);
+    const merged = commit(root, "app/merged.txt");
+    git(root, "push", "-q", "origin", "main");
+    forge.heads.main = merged;
+    const pass = await ciServePass(opts);
+    expect(pass.jobs).toEqual([expect.objectContaining({ job: "record", commit: merged, base: main })]);
+    expect(argsOf(pass.jobs[0]!.report!, "pr-record")).not.toContain("--branch");
+  });
+
+  test("the workspace root polls main and each routed branch, each from its own head", async () => {
+    const { root, main, release } = routed();
+    const forge = branchForge({ main, release });
+    const { opts } = serve(root, forge);
+    await ciServePass(opts);
+    expect(forge.polled).toEqual(["main", "release"]);
+    git(root, "checkout", "-q", "release");
+    const next = commit(root, "app/rel2.txt");
+    git(root, "push", "-q", "origin", "release");
+    git(root, "checkout", "-q", "main");
+    forge.heads.release = next;
+    const pass = await ciServePass(opts);
+    expect(pass.jobs).toEqual([expect.objectContaining({ job: "record", commit: next, base: release })]);
+    const state = readCiServeState(join(opts.stateDir!, `${prApplyGroup("prod")}.json`), { forge: "forgejo", repo: "demo/estate", env: "prod", branch: "main" });
+    expect(state.target).toBe(main);
+    expect(state.targets).toEqual({ release: next });
+    expect((await ciServePass(opts)).jobs).toEqual([]);
+  });
+
+  test("a --branch that disagrees with the route is refused", async () => {
+    const { app, main, release } = routed();
+    const { opts } = serve(app, branchForge({ main, release }), { job: { loop: { branch: "main" } } });
+    await expect(ciServePass(opts)).rejects.toThrow(/routes member app to release/);
+  });
+});