chant for CI pipelines

For a team that owns its pipelines: workflows for GitHub Actions, GitLab CI and Forgejo Actions from TypeScript, a generated pull-request pipeline, and an audit of the pipelines you already have.

Works

• Workflows for GitHub Actions, GitLab CI and Forgejo Actions from TypeScript
• A generated pull-request pipeline that plans what a change reaches, posts the plan, and on merge applies only the plan a reviewer approved
• chant audit reads a repository's existing pipelines and reports security findings, with a diff for each mechanical fix
• chant migrate translates a GitHub Actions workflow into GitLab CI

Differs

By forge

GitHub

• --generate github writes the pull-request workflow under .github/workflows/, run on pull_request and on push to the target branch.
• Both jobs use the job's own github.token. On a pull request from a fork that token is read-only, so the plan note and the status are not posted.

GitLab

• --generate gitlab writes .gitlab-ci.yml, and apply runs one at a time per environment through resource_group.
• A CI job token cannot write merge request notes, so set a project access token with the api scope as the masked variable CHANT_FORGE_TOKEN.

Forgejo

• --generate forgejo writes the GitHub workflow in the Forgejo dialect under .forgejo/workflows/: the runner label, action references by URL, and no permissions block.
• Forgejo workflows are GitHub-dialect, so chant audit applies its GitHub rules to them.

First step

GitHub

npm install --save-dev @intentius/chant-lexicon-github
npx chant init my-pipelines --lexicon github

GitLab

npm install --save-dev @intentius/chant-lexicon-gitlab
npx chant init my-pipelines --lexicon gitlab

Forgejo

npm install --save-dev @intentius/chant-lexicon-forgejo
npx chant init my-pipelines --lexicon forgejo

Generated CI for Pull Requests

Or hand this step to your coding agentIt stops at a pull request or a report.

Read https://intentius.io/chant/for/ci/.
Set up chant for this repository's pipelines with the lexicon of its forge: github, gitlab or forgejo. Use that name in place of `github` below.
Install it with `npm install --save-dev @intentius/chant-lexicon-github`, run `npx chant init . --lexicon github`, and read every `skills/*/SKILL.md` it writes before you author anything.
Run `npx chant audit .` over the pipelines the repository has now, and list its findings in the pull request description.
Run `npx chant build` and `npx chant lint` until both pass, and open a pull request with the result.
Never deploy to a real cloud account or shared environment (with `chant run`, `chant components` or a platform's own CLI), approve (a pull request review, `chant approve` or `chant run approve`), override a policy denial (`chant approve policy-override`), or merge; never cut or publish a release (`chant release cut --yes` or `chant release publish`), push or delete a `ci/*` tag (`chant ci tick` pushes them), or change the value of an existing flag; never touch `.chant/allowed_signers` or `chant/lifecycle`.

Show the whole prompt

Read https://intentius.io/chant/for/ci/.
Set up chant for this repository's pipelines with the lexicon of its forge: github, gitlab or forgejo. Use that name in place of `github` below.
Install it with `npm install --save-dev @intentius/chant-lexicon-github`, run `npx chant init . --lexicon github`, and read every `skills/*/SKILL.md` it writes before you author anything.
Run `npx chant audit .` over the pipelines the repository has now, and list its findings in the pull request description.
Run `npx chant build` and `npx chant lint` until both pass, and open a pull request with the result.
Never deploy to a real cloud account or shared environment (with `chant run`, `chant components` or a platform's own CLI), approve (a pull request review, `chant approve` or `chant run approve`), override a policy denial (`chant approve policy-override`), or merge; never cut or publish a release (`chant release cut --yes` or `chant release publish`), push or delete a `ci/*` tag (`chant ci tick` pushes them), or change the value of an existing flag; never touch `.chant/allowed_signers` or `chant/lifecycle`.

Copy promptCopy link

Proof

Example projects in the chant repository for this room, each with a README that has the commands to run it. The last rows count the examples each lexicon ships, read from the repository when this site was built.

Example	Where
github-pr-preview	examples/github-pr-preview
gitlab-aws-alb-services	examples/gitlab-aws-alb-services
8 examples	lexicons/github/examples
9 examples	lexicons/gitlab/examples
1 example	lexicons/forgejo/examples

Then read

Tasks

Generated CI for Pull RequestsPer-PR Preview EnvironmentsGitLab CI + AWS ALB

Background

Components

Reference

chant auditchant migrateAudit rules referenceGitHub Actions lexiconGitLab CI/CD lexiconForgejo Actions lexicon