@oisincoveney/pipeline 1.19.0 → 1.20.0

package/README.md

@@ -124,8 +124,11 @@ storage, Kueue discovery, and UI rendering. This package owns the in-container
 translation, authenticated event posting, signal cancellation, and final event
 flushing.
 
-The console starts the image with `OISIN_PIPELINE_RUNNER_PAYLOAD_JSON` and the
-runner-side event token. The payload contract is documented in
+The console starts the image with the payload as a mounted ConfigMap file and
+the event auth token as a mounted Secret file. The runner reads the payload
+from `--payload-file` and reads the event auth token from the file path
+specified in `events.authTokenFile`. No environment variables are used for
+payload or auth token delivery. The payload contract is documented in
 [`docs/pipeline-console-runner-contract.md`](docs/pipeline-console-runner-contract.md).
 The executable contract is exported from
 `@oisincoveney/pipeline/runner-job-contract` for payload construction,
@@ -410,3 +413,6 @@ bun run check
 bun run test
 bun run build:cli
 ```
+
+
+Runner Kubernetes Jobs can be generated with `buildRunnerJobK8sManifest` from `@oisincoveney/pipeline/runner-job-k8s`.

package/dist/commands/runner-job-command.js

@@ -1,8 +1,12 @@
 import { runRunnerJob } from "../runner-job/run.js";
 //#region src/commands/runner-job-command.ts
 function registerRunnerJobCommand(program) {
-	program.command("runner-job").description("Run an in-pod pipeline runner job from the console payload").action(async () => {
-		const exitCode = await runRunnerJob();
+	program.command("runner-job").description("Run an in-pod pipeline runner job from the console payload").option("--payload-file <path>", "Path to the runner job payload JSON file").option("--orchestrator <name>", "Orchestrator runner (codex|opencode)").argument("[orchestrator]", "Orchestrator runner (codex|opencode)").action(async (orchestratorArg, options) => {
+		const orchestrator = orchestratorArg ?? options.orchestrator;
+		const exitCode = await runRunnerJob({
+			payloadFile: options.payloadFile,
+			orchestrator
+		});
 		process.exitCode = exitCode;
 	});
 }

package/dist/config.d.ts

@@ -10,6 +10,10 @@ declare const HOOK_EVENTS: readonly ["workflow.start", "workflow.success", "work
 declare const GATE_KINDS: readonly ["acceptance", "artifact", "builtin", "changed_files", "command", "json_schema", "verdict"];
 declare const SCHEDULE_BASELINES: readonly ["epic", "pipe"];
 declare const SCHEDULING_ROLES: readonly ["coverage", "implementation"];
+declare const DEFAULT_RUNNER_JOB_GIT_COMMITTER: {
+  readonly email: "git@oisin.ee";
+  readonly name: "oisin-bot";
+};
 type PipelineConfigErrorCode = "PIPELINE_CONFIG_LEGACY_UNSUPPORTED" | "PIPELINE_CONFIG_MISSING" | "PIPELINE_CONFIG_PARSE_ERROR" | "PIPELINE_CONFIG_VALIDATION_ERROR";
 interface PipelineConfigIssue {
   message: string;
@@ -223,8 +227,8 @@ declare const configSchema: z.ZodObject<{
     policy: z.ZodOptional<z.ZodObject<{
       commands: z.ZodOptional<z.ZodEnum<{
         allow: "allow";
-        deny: "deny";
         "trusted-only": "trusted-only";
+        deny: "deny";
       }>>;
       modules: z.ZodOptional<z.ZodEnum<{
         allow: "allow";
@@ -279,10 +283,10 @@ declare const configSchema: z.ZodObject<{
     }, z.core.$strict>>;
     output: z.ZodOptional<z.ZodObject<{
       format: z.ZodEnum<{
-        json_schema: "json_schema";
         text: "text";
         json: "json";
         jsonl: "jsonl";
+        json_schema: "json_schema";
       }>;
       repair: z.ZodOptional<z.ZodObject<{
         enabled: z.ZodOptional<z.ZodBoolean>;
@@ -298,6 +302,7 @@ declare const configSchema: z.ZodObject<{
       implementation: "implementation";
     }>>>;
     skills: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    timeout_ms: z.ZodOptional<z.ZodNumber>;
     tools: z.ZodOptional<z.ZodArray<z.ZodEnum<{
       read: "read";
       list: "list";
@@ -322,6 +327,12 @@ declare const configSchema: z.ZodObject<{
         required: z.ZodDefault<z.ZodBoolean>;
       }, z.core.$strict>>>;
     }, z.core.$strict>>;
+    git: z.ZodDefault<z.ZodObject<{
+      committer: z.ZodDefault<z.ZodObject<{
+        email: z.ZodDefault<z.ZodString>;
+        name: z.ZodDefault<z.ZodString>;
+      }, z.core.$strict>>;
+    }, z.core.$strict>>;
   }, z.core.$strict>>;
   rules: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
     path: z.ZodString;
@@ -340,10 +351,10 @@ declare const configSchema: z.ZodObject<{
         disabled: "disabled";
       }>>>;
       output_formats: z.ZodOptional<z.ZodArray<z.ZodEnum<{
-        json_schema: "json_schema";
         text: "text";
         json: "json";
         jsonl: "jsonl";
+        json_schema: "json_schema";
       }>>>;
       rules: z.ZodOptional<z.ZodBoolean>;
       skills: z.ZodOptional<z.ZodBoolean>;
@@ -409,9 +420,10 @@ interface PipelineConfigValidationOptions {
   allowMissingLintFileReferences?: boolean;
 }
 declare function loadPipelineConfig(projectRoot: string, options?: PipelineConfigValidationOptions): PipelineConfig;
+declare function loadPackagePipelineConfig(projectRoot: string, options?: PipelineConfigValidationOptions): PipelineConfig;
 declare function tryLoadPipelineConfig(projectRoot: string, options?: PipelineConfigValidationOptions): PipelineConfig | null;
 declare function parsePipelineConfigYaml(source: string, sourcePath?: string, projectRoot?: string): PipelineConfig;
 declare function parsePipelineConfigParts(sources: PipelineConfigParts, projectRoot?: string, sourcePaths?: PipelineConfigParts, options?: PipelineConfigValidationOptions): PipelineConfig;
 declare function validatePipelineConfig(rawConfig: PipelineConfig, projectRoot?: string, options?: PipelineConfigValidationOptions): PipelineConfig;
 //#endregion
-export { GateKind, HookEvent, PIPELINE_CONFIG_PATH, PROFILES_CONFIG_PATH, PipelineConfig, PipelineConfigError, PipelineConfigErrorCode, PipelineConfigIssue, PipelineConfigParts, PipelineConfigValidationOptions, RUNNERS_CONFIG_PATH, RunnerType, ScheduleBaseline, SchedulingRole, WorkflowNodeKind, loadPipelineConfig, parsePipelineConfigParts, parsePipelineConfigYaml, tryLoadPipelineConfig, validatePipelineConfig, workflowSchema };
+export { DEFAULT_RUNNER_JOB_GIT_COMMITTER, GateKind, HookEvent, PIPELINE_CONFIG_PATH, PROFILES_CONFIG_PATH, PipelineConfig, PipelineConfigError, PipelineConfigErrorCode, PipelineConfigIssue, PipelineConfigParts, PipelineConfigValidationOptions, RUNNERS_CONFIG_PATH, RunnerType, ScheduleBaseline, SchedulingRole, WorkflowNodeKind, loadPackagePipelineConfig, loadPipelineConfig, parsePipelineConfigParts, parsePipelineConfigYaml, tryLoadPipelineConfig, validatePipelineConfig, workflowSchema };

package/dist/config.js

@@ -1,13 +1,11 @@
 import { resolveFileReference } from "./path-refs.js";
-import { existsSync, readFileSync } from "node:fs";
-import { join } from "node:path";
+import { existsSync } from "node:fs";
 import { parseDocument } from "yaml";
 import { z } from "zod";
 //#region src/config.ts
 const PIPELINE_CONFIG_PATH = ".pipeline/pipeline.yaml";
 const RUNNERS_CONFIG_PATH = ".pipeline/runners.yaml";
 const PROFILES_CONFIG_PATH = ".pipeline/profiles.yaml";
-const LEGACY_CONFIG_PATH = ".pipeline/config.toml";
 const ID_RE = /^[a-z][a-z0-9-]*$/;
 const RUNNER_TYPES = [
 	"codex",
@@ -57,6 +55,10 @@ const RETRY_REASONS = [
 const SCHEDULE_BASELINES = ["epic", "pipe"];
 const SCHEDULING_ROLES = ["coverage", "implementation"];
 const PIPELINE_GATEWAY_SERVER_ID = "pipeline-gateway";
+const DEFAULT_RUNNER_JOB_GIT_COMMITTER = {
+	email: "git@oisin.ee",
+	name: "oisin-bot"
+};
 const PACKAGE_DEFAULT_RUNNERS_YAML = `version: 1
 runners:
   codex:
@@ -73,7 +75,7 @@ runners:
       output_formats: [text, json, jsonl, json_schema]
   opencode:
     type: opencode
-    model: default
+    model: openai/gpt-5.5
     capabilities:
       native_subagents: true
       rules: true
@@ -113,7 +115,8 @@ profiles:
   pipeline-researcher:
     runner: codex
     description: Research the requested task and produce structured findings.
-    instructions: { inline: "Inspect first-party source, tests, docs, and task context before proposing changes." }
+    instructions: { inline: "Inspect first-party source, tests, docs, and task context for the current task only. Produce concise findings with file references and stop; do not perform open-ended repository exploration." }
+    timeout_ms: 900000
     mcp_servers: [pipeline-gateway]
     tools: [read, list, grep, glob, bash]
     filesystem: { mode: read-only, allow: ["**/*"], deny: ["node_modules/**", "dist/**", ".git/**"] }
@@ -163,7 +166,7 @@ profiles:
     runner: codex
     scheduling_roles: [coverage]
     description: Audit the finished change against every acceptance criterion.
-    instructions: { inline: "Audit the completed change against each canonical acceptance criterion independently." }
+    instructions: { inline: 'Audit the completed change against each canonical acceptance criterion independently. Return only valid JSON with top-level "verdict", "evidence", "acceptance", and optional "violations". Each "acceptance" entry must include "id", "verdict", and non-empty "evidence". Do not use Markdown fences or prose outside the JSON object.' }
     mcp_servers: [pipeline-gateway]
     tools: [read, list, grep, glob, bash]
     filesystem: { mode: read-only, allow: ["**/*"], deny: ["node_modules/**", "dist/**", ".git/**"] }
@@ -181,7 +184,7 @@ profiles:
     runner: codex
     scheduling_roles: [coverage]
     description: Verify checks, implementation fit, and final evidence.
-    instructions: { inline: "Verify checks, implementation fit, and final evidence." }
+    instructions: { inline: 'Verify checks, implementation fit, and final evidence. Return only valid JSON with top-level "verdict", "evidence", and optional "violations". Do not use Markdown fences or prose outside the JSON object.' }
     mcp_servers: [pipeline-gateway]
     tools: [read, list, grep, glob, bash]
     filesystem: { mode: read-only, allow: ["**/*"], deny: ["node_modules/**", "dist/**", ".git/**"] }
@@ -213,7 +216,7 @@ hooks:
   functions:
     generated-defaults-audit:
       kind: command
-      command: [node, -e, "process.exit(0)"]
+      command: [node, -e, "const fs=require('node:fs'); fs.writeFileSync(process.env.PIPELINE_HOOK_RESULT, JSON.stringify({status:'pass',summary:'Generated defaults audit passed'}));"]
       trusted: true
       timeout_ms: 5000
       output_limit_bytes: 4096
@@ -340,6 +343,10 @@ workflows:
         kind: agent
         profile: pipeline-thermo-nuclear-reviewer
         needs: [merge]
+        gates:
+          - id: review-verdict
+            kind: verdict
+            target: stdout
 `;
 var PipelineConfigError = class extends Error {
 	code;
@@ -515,6 +522,7 @@ const profileSchema = z.object({
 	runner: z.string(),
 	scheduling_roles: z.array(z.enum(SCHEDULING_ROLES)).optional(),
 	skills: z.array(z.string()).optional(),
+	timeout_ms: z.number().int().positive().optional(),
 	tools: z.array(z.enum(TOOL_NAMES)).optional()
 }).strict();
 const orchestratorSchema = z.object({ profile: z.string() }).strict();
@@ -654,10 +662,18 @@ const runnerJobEnvironmentSchema = z.object({
 	setup: z.array(runnerJobCommandSchema).default([]),
 	smoke: z.array(runnerJobCommandSchema).default([])
 }).strict();
-const runnerJobConfigSchema = z.object({ environment: runnerJobEnvironmentSchema.default({
-	setup: [],
-	smoke: []
-}) }).strict();
+const runnerJobGitCommitterSchema = z.object({
+	email: z.string().email().default(DEFAULT_RUNNER_JOB_GIT_COMMITTER.email),
+	name: z.string().min(1).default(DEFAULT_RUNNER_JOB_GIT_COMMITTER.name)
+}).strict();
+const runnerJobGitSchema = z.object({ committer: runnerJobGitCommitterSchema.default(DEFAULT_RUNNER_JOB_GIT_COMMITTER) }).strict();
+const runnerJobConfigSchema = z.object({
+	environment: runnerJobEnvironmentSchema.default({
+		setup: [],
+		smoke: []
+	}),
+	git: runnerJobGitSchema.default({ committer: DEFAULT_RUNNER_JOB_GIT_COMMITTER })
+}).strict();
 const runnersFileSchema = z.object({
 	runners: strictRecord(runnerSchema).default({}),
 	version: z.literal(1)
@@ -678,10 +694,13 @@ const pipelineFileSchema = z.object({
 		on: {}
 	}),
 	orchestrator: orchestratorSchema,
-	runner_job: runnerJobConfigSchema.default({ environment: {
-		setup: [],
-		smoke: []
-	} }),
+	runner_job: runnerJobConfigSchema.default({
+		environment: {
+			setup: [],
+			smoke: []
+		},
+		git: { committer: DEFAULT_RUNNER_JOB_GIT_COMMITTER }
+	}),
 	schedules: strictRecord(schedulePolicySchema).default({}),
 	task_context: taskContextResolverSchema.optional(),
 	workflows: strictRecord(workflowSchema).default({}),
@@ -698,10 +717,13 @@ const configSchema = z.object({
 	mcp_servers: strictRecord(mcpServerSchema).default({}),
 	orchestrator: orchestratorSchema,
 	profiles: strictRecord(profileSchema).default({}),
-	runner_job: runnerJobConfigSchema.default({ environment: {
-		setup: [],
-		smoke: []
-	} }),
+	runner_job: runnerJobConfigSchema.default({
+		environment: {
+			setup: [],
+			smoke: []
+		},
+		git: { committer: DEFAULT_RUNNER_JOB_GIT_COMMITTER }
+	}),
 	rules: strictRecord(pathRefSchema).default({}),
 	runners: strictRecord(runnerSchema).default({}),
 	schedules: strictRecord(schedulePolicySchema).default({}),
@@ -769,36 +791,18 @@ function addConfigSchemaIssue(ctx, path, message) {
 	});
 }
 function loadPipelineConfig(projectRoot, options = {}) {
-	const paths = [
-		PIPELINE_CONFIG_PATH,
-		PROFILES_CONFIG_PATH,
-		RUNNERS_CONFIG_PATH
-	];
-	const missing = paths.filter((path) => !existsSync(join(projectRoot, path)));
-	if (missing.length > 0) {
-		if (existsSync(join(projectRoot, LEGACY_CONFIG_PATH))) throw new PipelineConfigError("PIPELINE_CONFIG_LEGACY_UNSUPPORTED", `${LEGACY_CONFIG_PATH} is not supported by the v1 pipeline config. Create ${PIPELINE_CONFIG_PATH}.`, [{
-			path: LEGACY_CONFIG_PATH,
-			message: "legacy TOML config found"
-		}]);
-		if (missing.length === paths.length) return parsePipelineConfigParts({
-			pipeline: PACKAGE_DEFAULT_PIPELINE_YAML,
-			profiles: PACKAGE_DEFAULT_PROFILES_YAML,
-			runners: PACKAGE_DEFAULT_RUNNERS_YAML
-		}, projectRoot, {
-			pipeline: "@oisincoveney/pipeline/defaults/pipeline.yaml",
-			profiles: "@oisincoveney/pipeline/defaults/profiles.yaml",
-			runners: "@oisincoveney/pipeline/defaults/runners.yaml"
-		}, options);
-		throw new PipelineConfigError("PIPELINE_CONFIG_MISSING", `Missing required pipeline config files: ${missing.join(", ")}`, missing.map((path) => ({
-			path,
-			message: "file does not exist"
-		})));
-	}
+	return loadPackagePipelineConfig(projectRoot, options);
+}
+function loadPackagePipelineConfig(projectRoot, options = {}) {
 	return parsePipelineConfigParts({
-		pipeline: readFileSync(join(projectRoot, PIPELINE_CONFIG_PATH), "utf8"),
-		profiles: readFileSync(join(projectRoot, PROFILES_CONFIG_PATH), "utf8"),
-		runners: readFileSync(join(projectRoot, RUNNERS_CONFIG_PATH), "utf8")
-	}, projectRoot, void 0, options);
+		pipeline: PACKAGE_DEFAULT_PIPELINE_YAML,
+		profiles: PACKAGE_DEFAULT_PROFILES_YAML,
+		runners: PACKAGE_DEFAULT_RUNNERS_YAML
+	}, projectRoot, {
+		pipeline: "@oisincoveney/pipeline/defaults/pipeline.yaml",
+		profiles: "@oisincoveney/pipeline/defaults/profiles.yaml",
+		runners: "@oisincoveney/pipeline/defaults/runners.yaml"
+	}, options);
 }
 function tryLoadPipelineConfig(projectRoot, options = {}) {
 	return loadPipelineConfig(projectRoot, options);
@@ -1066,4 +1070,4 @@ function validationError(issues) {
 	return new PipelineConfigError("PIPELINE_CONFIG_VALIDATION_ERROR", ["Invalid pipeline config:", ...issues.map((issue) => issue.path ? `- ${issue.path}: ${issue.message}` : `- ${issue.message}`)].join("\n"), issues);
 }
 //#endregion
-export { PIPELINE_CONFIG_PATH, PROFILES_CONFIG_PATH, PipelineConfigError, RUNNERS_CONFIG_PATH, loadPipelineConfig, parsePipelineConfigParts, parsePipelineConfigYaml, tryLoadPipelineConfig, validatePipelineConfig, workflowSchema };
+export { DEFAULT_RUNNER_JOB_GIT_COMMITTER, PIPELINE_CONFIG_PATH, PROFILES_CONFIG_PATH, PipelineConfigError, RUNNERS_CONFIG_PATH, loadPackagePipelineConfig, loadPipelineConfig, parsePipelineConfigParts, parsePipelineConfigYaml, tryLoadPipelineConfig, validatePipelineConfig, workflowSchema };

package/dist/index.d.ts

@@ -9,8 +9,8 @@ interface PipeOptions {
   workflow?: string;
 }
 /**
- * Config-driven `pipe` entrypoint. The workflow source of truth is
- * `.pipeline/pipeline.yaml`; missing YAML is a hard error.
+ * Config-driven `pipe` entrypoint. Package-owned defaults are the source of
+ * truth; repo-local pipeline files are only scaffolding fixtures.
  */
 declare function pipe(description: string, options?: PipeOptions): Promise<void>;
 interface DoctorCheck {

package/dist/index.js

@@ -18,8 +18,8 @@ import { execa } from "execa";
 const PATH_SEPARATOR_RE = /[\\/]/;
 const LINE_RE = /\r?\n/;
 /**
-* Config-driven `pipe` entrypoint. The workflow source of truth is
-* `.pipeline/pipeline.yaml`; missing YAML is a hard error.
+* Config-driven `pipe` entrypoint. Package-owned defaults are the source of
+* truth; repo-local pipeline files are only scaffolding fixtures.
 */
 function pipe(description, options = {}) {
 	try {

package/dist/mcp/gateway.js

@@ -1,6 +1,6 @@
 import { copyFileSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
-import { dirname, join } from "node:path";
 import { homedir } from "node:os";
+import { dirname, join } from "node:path";
 import { execa } from "execa";
 //#region src/mcp/gateway.ts
 const PIPELINE_GATEWAY_SERVER_ID = "pipeline-gateway";

package/dist/path-refs.js

@@ -1,5 +1,5 @@
-import { isAbsolute, join } from "node:path";
 import { homedir } from "node:os";
+import { isAbsolute, join } from "node:path";
 //#region src/path-refs.ts
 function resolveFileReference(basePath, pathRef) {
 	if (pathRef === "~") return homedir();

package/dist/pipeline-runtime.js

@@ -19,7 +19,7 @@ import { dispatchHooks } from "./runtime/hooks/hooks.js";
 import "./runtime/hooks/index.js";
 import { executeParallelNode } from "./runtime/parallel-node/parallel-node.js";
 import "./runtime/parallel-node/index.js";
-import { prepareWorkflowNodeWorktree, removeWorkflowNodeWorktree, workflowBaseSha } from "./runtime/worktrees/worktrees.js";
+import { commitWorkflowNodeWorktree, prepareWorkflowNodeWorktree, removeWorkflowNodeWorktree, workflowBaseSha } from "./runtime/worktrees/worktrees.js";
 import "./runtime/worktrees/index.js";
 import { nodeExecutionMachine } from "./runtime-machines/node-machine.js";
 import { workflowSchedulerMachine } from "./runtime-machines/workflow-machine.js";
@@ -572,10 +572,36 @@ async function executeWorkflowNode(node, context) {
 	childContext.inheritedOutputNodeIds = new Set(childContext.lastOutputByNode.keys());
 	const result = await runPipelineWithContext(childContext);
 	context.agentInvocations.push(...result.agentInvocations);
+	if (result.outcome === "PASS" && worktree.worktreePath) try {
+		worktree.commitSha = await commitWorkflowNodeWorktree(worktree.worktreePath, node.id, context.config.runner_job.git.committer);
+	} catch (error) {
+		const message = error instanceof Error ? error.message : String(error);
+		return {
+			evidence: [
+				`workflow '${result.plan.workflowId}' passed`,
+				`workflow worktree commit failed: ${message}`,
+				`inspect workflow worktree: cd ${worktree.worktreePath}`
+			],
+			exitCode: 1,
+			output: JSON.stringify({
+				baseSha: worktree.baseSha,
+				branch: worktree.branch,
+				commitSha: worktree.commitSha ?? null,
+				nodeResults: result.nodes.map((child) => ({
+					nodeId: child.nodeId,
+					status: child.status
+				})),
+				status: "FAIL",
+				worktreePath: worktree.worktreePath,
+				workflowId: result.plan.workflowId
+			})
+		};
+	}
 	if (result.outcome === "PASS" && worktree.worktreePath && !shouldPreserveWorkflowNodeWorktree(node, context)) await removeWorkflowNodeWorktree(worktree.worktreePath);
 	const output = JSON.stringify({
 		baseSha: worktree.baseSha,
 		branch: worktree.branch,
+		...worktree.worktreePath ? { commitSha: worktree.commitSha ?? null } : {},
 		nodeResults: result.nodes.map((child) => ({
 			nodeId: child.nodeId,
 			status: child.status

package/dist/runner-job/delivery.js

@@ -1,30 +1,36 @@
+import { DEFAULT_RUNNER_JOB_GIT_COMMITTER } from "../config.js";
 import { execa } from "execa";
+import simpleGit$1 from "simple-git";
 //#region src/runner-job/delivery.ts
 const GITHUB_HTTPS_REPOSITORY_RE = /^https:\/\/github\.com\/([^/]+\/[^/.]+)(?:\.git)?$/;
 const GITHUB_SSH_REPOSITORY_RE = /^git@github\.com:([^/]+\/[^/.]+)(?:\.git)?$/;
+const deliverGitBranch = async (options) => {
+	const git = createDeliveryGitClient(options);
+	const branch = options.branch ?? await currentBranch(git);
+	const status = await git.status();
+	let commitSha = null;
+	if (status.files.length > 0) {
+		await git.add(["--all"]);
+		await configureCommitter(git, options.committer ?? DEFAULT_RUNNER_JOB_GIT_COMMITTER);
+		await git.commit(deliveryCommitMessage(options.payload));
+		if ((await git.status()).files.length > 0) throw new Error("Runner job delivery requires all worktree changes to be committed");
+		commitSha = (await git.revparse(["HEAD"])).trim();
+	}
+	for (const branchToPush of await deliveryBranches(git, branch, options.payload.run.id)) await git.push("origin", branchToPush, ["--set-upstream"]);
+	return {
+		branch,
+		commitSha,
+		pushed: true
+	};
+};
 const createPullRequest = async (options) => {
 	if (!options.payload.delivery.pullRequest) return null;
 	const repository = options.payload.repository;
 	const env = compactEnv(options.env);
 	const runCommand = options.runCommand ?? runDeliveryCommand;
-	const branch = (await runCommand("git", ["branch", "--show-current"], {
-		cwd: options.worktreePath,
-		env,
-		stdin: "ignore"
-	})).stdout.trim();
-	if (!branch) throw new Error("Pull request delivery requires a checked-out branch");
+	const branch = options.branch ?? await currentBranch(createDeliveryGitClient(options));
 	const headOwner = options.env.PIPELINE_PR_HEAD_OWNER?.trim() || "oisin-bot";
 	const repositoryName = githubRepositoryName(repository.url);
-	await runCommand("git", [
-		"push",
-		"--set-upstream",
-		"origin",
-		branch
-	], {
-		cwd: options.worktreePath,
-		env,
-		stdin: "ignore"
-	});
 	const url = (await runCommand("gh", [
 		"pr",
 		"create",
@@ -43,6 +49,28 @@ const createPullRequest = async (options) => {
 	return url ? { url } : null;
 };
 const runDeliveryCommand = (command, args, options) => execa(command, args, options);
+function createDeliveryGitClient(options) {
+	return options.createGitClient?.(options.worktreePath) ?? simpleGit$1({ baseDir: options.worktreePath });
+}
+async function currentBranch(git) {
+	const branch = (await git.branch()).current.trim();
+	if (!branch) throw new Error("Runner job delivery requires a checked-out branch");
+	return branch;
+}
+async function deliveryBranches(git, current, runId) {
+	const branches = await git.branchLocal();
+	return [...new Set([current, ...Object.keys(branches.branches).map((branch) => branch.trim()).filter((branch) => isRunScopedBranch(branch, runId))])];
+}
+function isRunScopedBranch(branch, runId) {
+	return branch.startsWith(`${runId}/`) || branch === `runs/integration/${runId}`;
+}
+function deliveryCommitMessage(payload) {
+	return `pipeline: ${(payload.task.kind === "ticket" ? payload.task.id.trim() : void 0) || payload.run.id}`;
+}
+async function configureCommitter(git, committer) {
+	await git.addConfig("user.name", committer.name, false, "local");
+	await git.addConfig("user.email", committer.email, false, "local");
+}
 function compactEnv(env) {
 	return Object.fromEntries(Object.entries(env).filter((entry) => Boolean(entry[1])));
 }
@@ -54,4 +82,4 @@ function githubRepositoryName(repositoryUrl) {
 	throw new Error("Pull request delivery requires a GitHub repository URL");
 }
 //#endregion
-export { createPullRequest };
+export { createPullRequest, deliverGitBranch };