chant for a platform team

For a team that sets the rules other teams build within: policy as project code, shared defaults as plain functions, and rollouts one environment at a time behind a gate.

Works

• Policy checks written in the project that read the environment, such as no public buckets in prod
• Presets and composite resources that carry a team's defaults as plain functions
• Op waves that apply to each environment, or each target in a set, one wave at a time behind one gate
• Components run by one generic orchestrator, so a new component adds no new pipeline

Differs

By forge

GitHub

• --generate github writes the pull-request workflow under .github/workflows/, run on pull_request and on push to the target branch.
• Both jobs use the job's own github.token. On a pull request from a fork that token is read-only, so the plan note and the status are not posted.

GitLab

• --generate gitlab writes .gitlab-ci.yml, and apply runs one at a time per environment through resource_group.
• A CI job token cannot write merge request notes, so set a project access token with the api scope as the masked variable CHANT_FORGE_TOKEN.

Forgejo

• --generate forgejo writes the GitHub workflow in the Forgejo dialect under .forgejo/workflows/: the runner label, action references by URL, and no permissions block.
• Forgejo workflows are GitHub-dialect, so chant audit applies its GitHub rules to them.

First step

Policy runs during chant build; pass the environment with --env.

npx chant build src --env prod

Organizational Policy

Or hand this step to your coding agentIt stops at a pull request or a report.

Read https://intentius.io/chant/for/platform/.
Following https://intentius.io/chant/guide/organizational-policy/, write the policy checks I describe as project code in this chant project.
Run `npx chant build src --env <env>` for each environment I name, and show me what each check reports.
Open a pull request with the checks.
Never deploy to a real cloud account or shared environment (with `chant run`, `chant components` or a platform's own CLI), approve (a pull request review, `chant approve` or `chant run approve`), override a policy denial (`chant approve policy-override`), or merge; never cut or publish a release (`chant release cut --yes` or `chant release publish`), push or delete a `ci/*` tag (`chant ci tick` pushes them), or change the value of an existing flag; never touch `.chant/allowed_signers` or `chant/lifecycle`.

Show the whole prompt

Read https://intentius.io/chant/for/platform/.
Following https://intentius.io/chant/guide/organizational-policy/, write the policy checks I describe as project code in this chant project.
Run `npx chant build src --env <env>` for each environment I name, and show me what each check reports.
Open a pull request with the checks.
Never deploy to a real cloud account or shared environment (with `chant run`, `chant components` or a platform's own CLI), approve (a pull request review, `chant approve` or `chant run approve`), override a policy denial (`chant approve policy-override`), or merge; never cut or publish a release (`chant release cut --yes` or `chant release publish`), push or delete a `ci/*` tag (`chant ci tick` pushes them), or change the value of an existing flag; never touch `.chant/allowed_signers` or `chant/lifecycle`.

Copy promptCopy link

Proof

Example projects in the chant repository for this room, each with a README that has the commands to run it.

Example	Where
fan-out-estate	examples/fan-out-estate
components-aws-e2e	examples/components-aws-e2e

Then read

Tasks

Organizational PolicyPresetsComposite ResourcesMulti-Stack ProjectsLayered ConfigurationOp Waves

Background

State and GovernanceComponents

Reference

Config FileLint rules