@intentius/chant-lexicon-forgejo 0.54.3 → 0.56.0

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "880444cb755d36c21132e6de0c4cbf7165c508131c5644076752bf6b711b99cb",
+    "manifest.json": "41422a1279c60fe920c3cdcc8752b261195129987cc90aaad7533025cc518ce9",
     "meta.json": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
     "types/index.d.ts": "66204549b2a864ab5489e3f02c1878e73ab4b3c9d938cfb480b66f71543a43de",
     "rules/delegate-to-github.ts": "1060cda40f4b73d6cca3ba3fa13b80b4886147d4034c88584c2d80c5510dbe5e",
@@ -9,5 +9,5 @@
     "rules/wfj011.ts": "fcb8bf6685d744af20ad804ce929488257995c74b9a3353b2eacae3768d1c83e",
     "skills/chant-forgejo.md": "a1a560429db736c187e0b34cf8dd9efc6ad771afefcbf6f802d160d3d5274257"
   },
-  "composite": "305f801d240521872d4b877bf60eceb3e2d20794830c4ab6e1a12a3ba158c447"
+  "composite": "6d2553e4556e777c5615f3644dfa6b0efa68638650c814d6e2da620ef8e1e1e2"
 }

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "forgejo",
-  "version": "0.54.3",
+  "version": "0.56.0",
   "chantVersion": ">=0.1.0",
   "namespace": "Forgejo",
   "intrinsics": [],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-forgejo",
-  "version": "0.54.3",
+  "version": "0.56.0",
   "description": "Forgejo / Codeberg / Gitea Actions lexicon for chant — a thin GitHub Actions dialect",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -54,8 +54,8 @@
   },
   "peerDependencies": {
     "zod": "^4.3.6",
-    "@intentius/chant": "^0.54.3",
-    "@intentius/chant-lexicon-github": "^0.54.3"
+    "@intentius/chant": "^0.56.0",
+    "@intentius/chant-lexicon-github": "^0.56.0"
   },
   "scripts": {
     "generate": "tsx src/codegen/generate-cli.ts",

package/src/plugin.test.ts

@@ -82,6 +82,24 @@ describe("forgejo plugin", () => {
     expect(forgejoPlugin.migrationSource?.("gitlab")).toBeUndefined();
   });
 
+  // #2066 regression (the gitlab wrapper dropped both fields; lock the
+  // forgejo seam too): security passes through, securityPosture comes back.
+  it("migrationSource transform with security: true carries securityPosture", async () => {
+    const src = forgejoPlugin.migrationSource!("github")!;
+    const workflow = `on: push
+permissions:
+  contents: read
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - run: echo hello
+`;
+    const result = await src.transform(workflow, { emit: "yaml", security: true });
+    expect(result.securityPosture).toContain("## Security posture");
+    expect(result.securityPosture).toContain("Least-privilege permissions");
+  });
+
   it("mcpTools() includes the diff tool and context tools", () => {
     const tools = forgejoPlugin.mcpTools?.();
     expect(Array.isArray(tools)).toBe(true);