@intentius/chant-lexicon-github 0.101.0 → 0.102.0

package/src/components/generate-op-pipeline.test.ts

@@ -72,7 +72,7 @@ describe("generateGithubOpPipeline: one file per scheduled Op", () => {
     const job = doc.jobs!["actions-audit"];
 
     expect(job["runs-on"]).toBe("ubuntu-latest");
-    expect(job.steps[0].uses).toBe("actions/checkout@v4");
+    expect(job.steps[0].uses).toBe("actions/checkout@v7");
     const runStep = job.steps.find((s) => typeof s.run === "string")!;
     expect(runStep.run).toBe("chant run actions-audit");
   });
@@ -327,7 +327,7 @@ describe("generateGithubOpPipeline: setup steps and additive permissions (#2242)
     const steps = doc.jobs!["app-apply"].steps;
 
     expect(steps.slice(0, 3).map((s) => s.uses ?? s.run)).toEqual([
-      "actions/checkout@v4",
+      "actions/checkout@v7",
       "aws-actions/configure-aws-credentials@v6",
       "install terraform",
     ]);
@@ -385,7 +385,7 @@ describe("generateGithubOpPipeline: setup steps and additive permissions (#2242)
     ];
     const steps = parseFile(generateGithubOpPipeline(specs).files[0].yaml).jobs!["app-apply"].steps;
     expect(steps.map((s) => s.uses).filter(Boolean)).toEqual([
-      "actions/checkout@v4",
+      "actions/checkout@v7",
       "github/codeql-action/upload-sarif@v4",
       "aws-actions/configure-aws-credentials@0e613a0980cbf65ed5b322eb7a1e075d28913a83",
     ]);
@@ -622,7 +622,7 @@ describe("generateGithubOpPipeline: a deployment environment on the Op's job (#2
       "    runs-on: ubuntu-latest",
       "    container: node:22-slim",
       "    steps:",
-      "      - uses: actions/checkout@v4",
+      "      - uses: actions/checkout@v7",
       "      - run: chant run actions-audit",
       "        env:",
       "          GITHUB_TOKEN: '${{ github.token }}'",

package/src/components/generate-op-pipeline.ts

@@ -70,7 +70,7 @@
  * that job either, same as `environment:` above does not).
  */
 
-import { emitYAML } from "@intentius/chant/yaml";
+import { emitYAML, emitYAMLEntry } from "@intentius/chant/yaml";
 import { memberPathFilter, resolveOpTrigger } from "@intentius/chant/lexicon";
 import type {
   ComponentPipelineOptions as GenerateGithubOpOptions,
@@ -83,6 +83,7 @@ import type {
   PipelineMember,
   ScheduledOpSpec,
 } from "@intentius/chant/lexicon";
+import { actionRef } from "../action-pins";
 
 export type { GenerateGithubOpOptions, GenerateGithubOpResult };
 
@@ -709,7 +710,7 @@ export function buildGithubOpPipelineDocs(
       ? [...runParts, ...GATED_EXIT_FLAG, "--json"].join(" ")
       : runParts.join(" ");
 
-    const steps: Array<Record<string, unknown>> = [{ uses: "actions/checkout@v4" }];
+    const steps: Array<Record<string, unknown>> = [{ uses: actionRef("actions/checkout") }];
     for (const step of setup) steps.push(setupStepDoc(step));
     for (const line of beforeScript) steps.push({ run: line });
     steps.push(
@@ -822,14 +823,14 @@ export function emitOpPipelineYAML(doc: GithubOpPipelineDoc): string {
   // it was before the field existed.
   if (doc.header && doc.header.length > 0) sections.push(doc.header.join("\n"));
   if (doc.name) sections.push("name: " + emitYAML(doc.name, 0));
-  sections.push("on:" + emitYAML(doc.on, 1));
-  if (doc.env && Object.keys(doc.env).length > 0) sections.push("env:" + emitYAML(doc.env, 1));
-  sections.push("concurrency:" + emitYAML(doc.concurrency, 1));
-  if (Object.keys(doc.permissions).length > 0) sections.push("permissions:" + emitYAML(doc.permissions, 1));
+  sections.push(emitYAMLEntry("on", doc.on));
+  if (doc.env && Object.keys(doc.env).length > 0) sections.push(emitYAMLEntry("env", doc.env));
+  sections.push(emitYAMLEntry("concurrency", doc.concurrency));
+  if (Object.keys(doc.permissions).length > 0) sections.push(emitYAMLEntry("permissions", doc.permissions));
   // The gated-apply notice job rides in `jobs:` beside the Op's own job, but
   // is carried separately on the doc so a dialect that cannot run it (forgejo,
   // whose runner has no `gh` pointed at its own instance) drops it by omission.
-  sections.push("jobs:" + emitYAML({ ...doc.jobsDoc, ...(doc.gatedNoticeDoc ?? {}) }, 1));
+  sections.push(emitYAMLEntry("jobs", { ...doc.jobsDoc, ...(doc.gatedNoticeDoc ?? {}) }));
   return sections.join("\n\n") + "\n";
 }
 

package/src/components/generate-pipeline.test.ts

@@ -104,7 +104,7 @@ describe("generateGithubPipeline: structurally valid YAML", () => {
       expect(job.steps.length).toBeGreaterThan(0);
       // Every job starts with a checkout step — a job runs on a fresh runner
       // with no repo present, unlike GitLab's auto-cloned workspace.
-      expect(job.steps[0].uses).toBe("actions/checkout@v4");
+      expect(job.steps[0].uses).toBe("actions/checkout@v7");
     }
   });
 

package/src/components/generate-pipeline.ts

@@ -56,7 +56,7 @@
  * touching the component declarations.
  */
 
-import { emitYAML } from "@intentius/chant/yaml";
+import { emitYAML, emitYAMLEntry } from "@intentius/chant/yaml";
 import { resolveComponentGraph, type DriverComponent } from "@intentius/chant/components/driver";
 import { hasPublishStep, promoteArchivePaths } from "@intentius/chant/components/promote";
 import { memberRepoPath } from "@intentius/chant/lexicon";
@@ -66,6 +66,7 @@ import type {
   ComponentPipelineResult as GenerateGithubResult,
   PipelineMember,
 } from "@intentius/chant/lexicon";
+import { actionRef } from "../action-pins";
 
 export type { GeneratedJob, GenerateGithubOptions, GenerateGithubResult };
 
@@ -232,7 +233,7 @@ export function buildGithubPipelineDoc(
       // One step per script line — mirrors gitlab's `script:` array of
       // discrete shell lines, rather than a single multi-line `run:` block, so
       // each line is independently inspectable (and machine-parseable).
-      const steps: Array<Record<string, unknown>> = [{ uses: "actions/checkout@v4" }];
+      const steps: Array<Record<string, unknown>> = [{ uses: actionRef("actions/checkout") }];
 
       for (const dep of component.dependsOn ?? []) {
         steps.push({
@@ -297,7 +298,7 @@ export function buildGithubPipelineDoc(
     for (const name of [...pinned].sort()) {
       command.push("--digest", `"${name}=\${{ needs.${jobNameByComponent.get(name)!}.outputs.digest }}"`);
     }
-    const steps: Array<Record<string, unknown>> = [{ uses: "actions/checkout@v4" }];
+    const steps: Array<Record<string, unknown>> = [{ uses: actionRef("actions/checkout") }];
     for (const [name, paths] of archives) {
       steps.push({
         name: `Download ${name} build archive`,
@@ -375,21 +376,14 @@ function memberArtifactStep(step: Record<string, unknown>, member: PipelineMembe
  * Shared with the forgejo dialect (#969), which transforms the doc first.
  */
 export function emitPipelineYAML(doc: GithubPipelineDoc): string {
-  // A block value starts with a newline; an inline one (`{}` for an empty
-  // component set) needs the space after the colon, or `jobs:{}` is a plain
-  // scalar rather than a key (#2991).
-  const section = (key: string, value: unknown): string => {
-    const emitted = emitYAML(value, 1);
-    return `${key}:${emitted.startsWith("\n") ? "" : " "}${emitted}`;
-  };
   const sections: string[] = [];
   sections.push("name: " + emitYAML(doc.name, 0));
-  sections.push(section("on", doc.on));
+  sections.push(emitYAMLEntry("on", doc.on));
   if (doc.env && Object.keys(doc.env).length > 0) {
-    sections.push(section("env", doc.env));
+    sections.push(emitYAMLEntry("env", doc.env));
   }
-  if (doc.defaults) sections.push(section("defaults", doc.defaults));
-  sections.push(section("jobs", doc.jobsDoc));
+  if (doc.defaults) sections.push(emitYAMLEntry("defaults", doc.defaults));
+  sections.push(emitYAMLEntry("jobs", doc.jobsDoc));
   return sections.join("\n\n") + "\n";
 }
 

package/src/composites/checkout.ts

@@ -1,5 +1,6 @@
 import { Composite, mergeDefaults } from "@intentius/chant";
 import { Step } from "../generated/index";
+import { actionRef, type ActionPinMode } from "../action-pins";
 
 export interface CheckoutProps {
   ref?: string;
@@ -8,6 +9,12 @@ export interface CheckoutProps {
   token?: string;
   submodules?: boolean | string;
   sshKey?: string;
+  /**
+   * `"tag"` (default) emits the action's major tag. `"sha"` emits the commit
+   * SHA from the lexicon's pin table with the version as a YAML comment, which
+   * passes GHA021, GHA029 and GHA059.
+   */
+  pin?: ActionPinMode;
   defaults?: {
     step?: Partial<ConstructorParameters<typeof Step>[0]>;
   };
@@ -25,7 +32,7 @@ export const Checkout = Composite((props: CheckoutProps) => {
 
   const step = new Step(mergeDefaults({
     name: "Checkout",
-    uses: "actions/checkout@v4",
+    uses: actionRef("actions/checkout", props.pin),
     ...(Object.keys(withObj).length > 0 ? { with: withObj } : {}),
   }, defaults?.step));
 

package/src/composites/composites.test.ts

@@ -19,7 +19,7 @@ describe("Checkout", () => {
   test("returns step with checkout action", () => {
     const result = Checkout({});
     expect(result.step).toBeDefined();
-    expect(result.step.props.uses).toBe("actions/checkout@v4");
+    expect(result.step.props.uses).toBe("actions/checkout@v7");
     expect(result.step.props.name).toBe("Checkout");
   });
 
@@ -45,7 +45,7 @@ describe("Checkout", () => {
 describe("SetupNode", () => {
   test("returns step with setup-node action", () => {
     const result = SetupNode({});
-    expect(result.step.props.uses).toBe("actions/setup-node@v4");
+    expect(result.step.props.uses).toBe("actions/setup-node@v7");
     expect(result.step.props.name).toBe("Setup Node.js");
   });
 
@@ -540,7 +540,7 @@ describe("DeployEnvironment", () => {
     const result = DeployEnvironment({ name: "staging", deployScript: "npm run deploy" });
     const steps = result.deployJob.props.steps as Array<{ props: Record<string, unknown> }>;
     expect(steps.length).toBe(2);
-    expect(steps[0].props.uses).toBe("actions/checkout@v4");
+    expect(steps[0].props.uses).toBe("actions/checkout@v7");
     expect(steps[1].props.run).toBe("npm run deploy");
   });
 
@@ -683,7 +683,7 @@ describe("defaults overrides", () => {
       defaults: { step: { id: "my-checkout" } },
     });
     expect(result.step.props.id).toBe("my-checkout");
-    expect(result.step.props.uses).toBe("actions/checkout@v4");
+    expect(result.step.props.uses).toBe("actions/checkout@v7");
   });
 
   test("SetupNode defaults override step props", () => {

package/src/composites/deploy-environment.ts

@@ -1,5 +1,6 @@
 import { Composite, mergeDefaults } from "@intentius/chant";
 import { Job, Step } from "../generated/index";
+import { actionRef } from "../action-pins";
 
 export interface DeployEnvironmentProps {
   /** Environment name. Required. */
@@ -40,7 +41,7 @@ export const DeployEnvironment = Composite((props: DeployEnvironmentProps) => {
 
   // ── Deploy job ─────────────────────────────────────────────────────
   const deploySteps = [
-    new Step({ name: "Checkout", uses: "actions/checkout@v4" }),
+    new Step({ name: "Checkout", uses: actionRef("actions/checkout") }),
     ...deployScriptArr.map(
       (cmd: string) => new Step({ name: "Deploy", run: cmd }),
     ),
@@ -63,7 +64,7 @@ export const DeployEnvironment = Composite((props: DeployEnvironmentProps) => {
 
   // ── Cleanup job ────────────────────────────────────────────────────
   const cleanupSteps = [
-    new Step({ name: "Checkout", uses: "actions/checkout@v4" }),
+    new Step({ name: "Checkout", uses: actionRef("actions/checkout") }),
     ...cleanupScriptArr.map(
       (cmd: string) => new Step({ name: "Cleanup", run: cmd }),
     ),

package/src/composites/docker-build.ts

@@ -1,5 +1,6 @@
 import { Composite, mergeDefaults } from "@intentius/chant";
 import { Job, Step, Workflow } from "../generated/index";
+import { actionRef } from "../action-pins";
 
 export interface DockerBuildProps {
   /** Image tag. Default: "${{ github.sha }}" */
@@ -44,7 +45,7 @@ export const DockerBuild = Composite((props: DockerBuildProps) => {
   } = props;
 
   // ── Steps ──────────────────────────────────────────────────────────
-  const checkout = new Step({ name: "Checkout", uses: "actions/checkout@v4" });
+  const checkout = new Step({ name: "Checkout", uses: actionRef("actions/checkout") });
 
   const login = new Step({
     name: "Log in to container registry",

package/src/composites/go-ci.ts

@@ -1,5 +1,6 @@
 import { Composite, mergeDefaults } from "@intentius/chant";
 import { Job, Step, Workflow } from "../generated/index";
+import { actionRef } from "../action-pins";
 
 export interface GoCIProps {
   /** Go version. Default: "1.22" */
@@ -34,7 +35,7 @@ export const GoCI = Composite((props: GoCIProps) => {
   const buildJob = new Job(mergeDefaults({
     "runs-on": runsOn,
     steps: [
-      new Step({ name: "Checkout", uses: "actions/checkout@v4" }),
+      new Step({ name: "Checkout", uses: actionRef("actions/checkout") }),
       new Step({
         name: "Setup Go",
         uses: "actions/setup-go@v5",
@@ -48,7 +49,7 @@ export const GoCI = Composite((props: GoCIProps) => {
   const testJob = new Job(mergeDefaults({
     "runs-on": runsOn,
     steps: [
-      new Step({ name: "Checkout", uses: "actions/checkout@v4" }),
+      new Step({ name: "Checkout", uses: actionRef("actions/checkout") }),
       new Step({
         name: "Setup Go",
         uses: "actions/setup-go@v5",
@@ -64,7 +65,7 @@ export const GoCI = Composite((props: GoCIProps) => {
       ? new Job(mergeDefaults({
           "runs-on": runsOn,
           steps: [
-            new Step({ name: "Checkout", uses: "actions/checkout@v4" }),
+            new Step({ name: "Checkout", uses: actionRef("actions/checkout") }),
             new Step({
               name: "Setup Go",
               uses: "actions/setup-go@v5",

package/src/composites/node-ci.ts

@@ -1,5 +1,6 @@
 import { Composite, mergeDefaults } from "@intentius/chant";
 import { Job, Step, Workflow } from "../generated/index";
+import { actionRef } from "../action-pins";
 
 export interface NodeCIProps {
   nodeVersion?: string;
@@ -28,12 +29,12 @@ export const NodeCI = Composite((props: NodeCIProps) => {
 
   const checkoutStep = new Step({
     name: "Checkout",
-    uses: "actions/checkout@v4",
+    uses: actionRef("actions/checkout"),
   });
 
   const setupNodeStep = new Step({
     name: "Setup Node.js",
-    uses: "actions/setup-node@v4",
+    uses: actionRef("actions/setup-node"),
     with: {
       "node-version": nodeVersion,
       cache: packageManager === "bun" ? undefined : packageManager,

package/src/composites/node-pipeline.ts

@@ -1,5 +1,6 @@
 import { Composite, withDefaults, mergeDefaults } from "@intentius/chant";
 import { Job, Step, Workflow } from "../generated/index";
+import { actionRef } from "../action-pins";
 
 export interface NodePipelineProps {
   /** Node.js version. Default: "22" */
@@ -32,19 +33,19 @@ const cacheConfig = {
     cache: "npm",
     installCmd: "npm ci",
     runPrefix: "npm run",
-    setupAction: "actions/setup-node@v4",
+    setupAction: actionRef("actions/setup-node"),
   },
   pnpm: {
     cache: "pnpm",
     installCmd: "pnpm install --frozen-lockfile",
     runPrefix: "pnpm run",
-    setupAction: "actions/setup-node@v4",
+    setupAction: actionRef("actions/setup-node"),
   },
   yarn: {
     cache: "yarn",
     installCmd: "yarn install --frozen-lockfile",
     runPrefix: "yarn",
-    setupAction: "actions/setup-node@v4",
+    setupAction: actionRef("actions/setup-node"),
   },
   bun: {
     cache: undefined,
@@ -75,13 +76,13 @@ export const NodePipeline = Composite((props: NodePipelineProps) => {
   const isBun = packageManager === "bun";
 
   // ── Build job steps ────────────────────────────────────────────────
-  const buildCheckout = new Step({ name: "Checkout", uses: "actions/checkout@v4" });
+  const buildCheckout = new Step({ name: "Checkout", uses: actionRef("actions/checkout") });
 
   const buildSetup = isBun
     ? new Step({ name: "Setup Bun", uses: "oven-sh/setup-bun@v2" })
     : new Step({
         name: "Setup Node.js",
-        uses: "actions/setup-node@v4",
+        uses: actionRef("actions/setup-node"),
         with: { "node-version": nodeVersion, cache: pm.cache },
       });
 
@@ -105,13 +106,13 @@ export const NodePipeline = Composite((props: NodePipelineProps) => {
   }, defaults?.buildJob));
 
   // ── Test job steps ─────────────────────────────────────────────────
-  const testCheckout = new Step({ name: "Checkout", uses: "actions/checkout@v4" });
+  const testCheckout = new Step({ name: "Checkout", uses: actionRef("actions/checkout") });
 
   const testSetup = isBun
     ? new Step({ name: "Setup Bun", uses: "oven-sh/setup-bun@v2" })
     : new Step({
         name: "Setup Node.js",
-        uses: "actions/setup-node@v4",
+        uses: actionRef("actions/setup-node"),
         with: { "node-version": nodeVersion, cache: pm.cache },
       });
 

package/src/composites/python-ci.ts

@@ -1,5 +1,6 @@
 import { Composite, mergeDefaults } from "@intentius/chant";
 import { Job, Step, Workflow } from "../generated/index";
+import { actionRef } from "../action-pins";
 
 export interface PythonCIProps {
   /** Python version. Default: "3.12" */
@@ -46,7 +47,7 @@ export const PythonCI = Composite((props: PythonCIProps) => {
   const testJob = new Job(mergeDefaults({
     "runs-on": runsOn,
     steps: [
-      new Step({ name: "Checkout", uses: "actions/checkout@v4" }),
+      new Step({ name: "Checkout", uses: actionRef("actions/checkout") }),
       new Step({
         name: "Setup Python",
         uses: "actions/setup-python@v5",
@@ -63,7 +64,7 @@ export const PythonCI = Composite((props: PythonCIProps) => {
       ? new Job(mergeDefaults({
           "runs-on": runsOn,
           steps: [
-            new Step({ name: "Checkout", uses: "actions/checkout@v4" }),
+            new Step({ name: "Checkout", uses: actionRef("actions/checkout") }),
             new Step({
               name: "Setup Python",
               uses: "actions/setup-python@v5",

package/src/composites/setup-node.ts

@@ -1,11 +1,18 @@
 import { Composite, mergeDefaults } from "@intentius/chant";
 import { Step } from "../generated/index";
+import { actionRef, type ActionPinMode } from "../action-pins";
 
 export interface SetupNodeProps {
   nodeVersion?: string;
   registryUrl?: string;
   cache?: string;
   cacheFilePath?: string;
+  /**
+   * `"tag"` (default) emits the action's major tag. `"sha"` emits the commit
+   * SHA from the lexicon's pin table with the version as a YAML comment, which
+   * passes GHA021, GHA029 and GHA059.
+   */
+  pin?: ActionPinMode;
   defaults?: {
     step?: Partial<ConstructorParameters<typeof Step>[0]>;
   };
@@ -21,7 +28,7 @@ export const SetupNode = Composite((props: SetupNodeProps) => {
 
   const step = new Step(mergeDefaults({
     name: "Setup Node.js",
-    uses: "actions/setup-node@v4",
+    uses: actionRef("actions/setup-node", props.pin),
     ...(Object.keys(withObj).length > 0 ? { with: withObj } : {}),
   }, defaults?.step));
 

package/src/index.ts

@@ -20,6 +20,10 @@ export { GitHub, Runner } from "./variables";
 // After running `chant generate`, this re-exports all entity classes
 export * from "./generated/index";
 
+// Action versions the composites emit, and their pinned commits
+export { ACTION_PINS, actionRef, actionPin } from "./action-pins";
+export type { ActionPin, ActionPinMode, PinnedAction } from "./action-pins";
+
 // Composites
 export {
   Checkout, SetupNode, SetupGo, SetupPython,

package/src/lint/audit-catalog.ts

@@ -66,6 +66,7 @@ export const githubAuditCatalog: Record<string, RuleMeta> = {
   GHA066: auditRule("GHA066", "report-only", "guidance", "Unbounded artifact retention", "Set a retention-days sized to how long the artifact is actually needed.", { category: "efficiency" }),
   GHA067: auditRule("GHA067", "report-only", "guidance", "Unconditional heavy step with no path filter", "Scope the trigger's paths, or add an if: guard to the step.", { category: "efficiency" }),
   GHA068: auditRule("GHA068", "report-only", "guidance", "Pull-request workflow missing a concurrency group", "Add a concurrency group with cancel-in-progress: true.", { category: "efficiency" }),
+  GHA069: auditRule("GHA069", "merge-worthy", "guidance", "Job permissions block drops the workflow's id-token: write", "Add `id-token: write` to the job's `permissions:` block; keep the job block rather than removing it.", { category: "correctness" }),
 };
 
 // Prior art credits live beside the rules in ./audit-lineage.ts (see core audit/prior-art.ts).

package/src/lint/audit-lineage.ts

@@ -4,6 +4,19 @@
  * the registry, the relation vocabulary, and why this is credit rather than
  * authority. Kept by hand; the prior-art sweep (scripts/prior-art-sweep.ts) reports
  * when a credited tool's index no longer lists a rule cited here.
+ *
+ * GHA069 (a job-level permissions block drops the workflow's `id-token:
+ * write`, #2273) has no entry here. Checked 2026-10-02: zizmor's 41 audits
+ * (docs.zizmor.sh/audits) cover over-broad scopes (`excessive-permissions`)
+ * and undocumented ones (`undocumented-permissions`), not a scope a job
+ * block silently loses. actionlint's `permissions` check
+ * (github.com/rhysd/actionlint/blob/main/docs/checks.md#permissions)
+ * validates scope names and levels only. poutine's rules (opa/rego/rules)
+ * have `default_permissions_on_risky_events`, the GHA013 condition, and
+ * nothing about a dropped grant. octoscan's `debug-oidc-action` flags OIDC
+ * action use as a debug finding and does not read the permission blocks.
+ * Scorecard's Token-Permissions rewards narrower blocks, the opposite
+ * concern. Ship with no lineage rather than invent a credit.
  */
 import type { Lineage } from "@intentius/chant/audit/catalog";
 

package/src/lint/post-synth/fixtures/GHA069/negative-no-job-block.yml

@@ -0,0 +1,16 @@
+name: Deploy
+on:
+  push:
+    branches: [main]
+permissions:
+  id-token: write
+  contents: read
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: arn:aws:iam::123456789012:role/deploy
+          aws-region: us-east-1

package/src/lint/post-synth/fixtures/GHA069/negative-no-oidc-step.yml

@@ -0,0 +1,22 @@
+name: Deploy
+on:
+  push:
+    branches: [main]
+permissions:
+  id-token: write
+  contents: read
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@v4
+      - run: npm test
+  deploy:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: arn:aws:iam::123456789012:role/deploy
+          aws-region: us-east-1

package/src/lint/post-synth/fixtures/GHA069/negative.yml

@@ -0,0 +1,21 @@
+name: Deploy
+on:
+  push:
+    branches: [main]
+permissions:
+  id-token: write
+  contents: read
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
+      id-token: write
+    steps:
+      - uses: actions/checkout@v4
+      - uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: arn:aws:iam::123456789012:role/deploy
+          aws-region: us-east-1
+      - run: aws s3 sync ./dist s3://example-bucket

package/src/lint/post-synth/fixtures/GHA069/positive.yml

@@ -0,0 +1,20 @@
+name: Deploy
+on:
+  push:
+    branches: [main]
+permissions:
+  id-token: write
+  contents: read
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
+    steps:
+      - uses: actions/checkout@v4
+      - uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: arn:aws:iam::123456789012:role/deploy
+          aws-region: us-east-1
+      - run: aws s3 sync ./dist s3://example-bucket

package/src/lint/post-synth/gha011.test.ts

@@ -58,4 +58,20 @@ jobs:
     const diags = gha011.check(makeCtx(yaml));
     expect(diags).toHaveLength(0);
   });
+
+  test("flags a scalar needs: naming a missing job (#3201)", () => {
+    const yaml = `name: CI
+on: push
+jobs:
+  test:
+    needs: biuld
+    runs-on: ubuntu-latest
+    steps:
+      - name: Test
+        run: npm test
+`;
+    const diags = gha011.check(makeCtx(yaml));
+    expect(diags).toHaveLength(1);
+    expect(diags[0].message).toContain('"biuld"');
+  });
 });

package/src/lint/post-synth/gha018.test.ts

@@ -63,4 +63,22 @@ jobs:
     const diags = gha018.check(makeCtx(yaml));
     expect(diags).toHaveLength(0);
   });
+
+  test("flags a checkout step that starts with name: (#3201)", () => {
+    const yaml = `name: CI
+on:
+  pull_request_target:
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Label
+        run: echo label
+      - name: Checkout
+        uses: actions/checkout@v7
+`;
+    const diags = gha018.check(makeCtx(yaml));
+    expect(diags).toHaveLength(1);
+    expect(diags[0].entity).toBe("build");
+  });
 });

package/src/lint/post-synth/gha019.test.ts

@@ -59,6 +59,48 @@ jobs:
     needs: [test]
     steps:
       - run: echo deploy
+`;
+    const diags = gha019.check(makeCtx(yaml));
+    expect(diags).toHaveLength(0);
+  });
+
+  test("detects a cycle through scalar needs: (#3201)", () => {
+    const yaml = `name: CI
+on: push
+jobs:
+  a:
+    needs: b
+    runs-on: ubuntu-latest
+    steps:
+      - run: echo a
+  b:
+    needs: a
+    runs-on: ubuntu-latest
+    steps:
+      - run: echo b
+`;
+    const diags = gha019.check(makeCtx(yaml));
+    expect(diags).toHaveLength(1);
+  });
+
+  test("no false cycle when a later job id has an underscore (#3201)", () => {
+    // The line-based extractJobs did not split on "extra_thing", so its
+    // needs: landed on shared-alb and read as shared-alb -> shared-alb.
+    // generateGithubPipeline emits this shape for a component named Extra_Thing.
+    const yaml = `name: chant-components
+on:
+  workflow_dispatch: {}
+jobs:
+  shared-alb:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+  extra_thing:
+    runs-on: ubuntu-latest
+    needs:
+      - shared-alb
+    steps:
+      - uses: actions/checkout@v7
 `;
     const diags = gha019.check(makeCtx(yaml));
     expect(diags).toHaveLength(0);