@intentius/chant-lexicon-github 0.101.0 → 0.102.0

package/src/lint/post-synth/yaml-helpers.ts

@@ -37,66 +37,45 @@ export interface ParsedJob {
 
 /**
  * Extract jobs from a serialized GitHub Actions workflow YAML.
+ *
+ * Built on the structural parser ({@link jobEntries}), so every step of every
+ * job is read whatever key the step starts with, and `needs:` is read in all
+ * three forms (a scalar, a flow list, a block list). The line-based version
+ * this replaced stopped after the first line of a job's first step, so a step
+ * that starts with `name:` (the shape chant's serializer emits) had no `uses:`
+ * or `run:` and later steps were never seen (#3201).
+ *
+ * `run` is the whole script, block scalars included. `permissions` is not
+ * filled here; use {@link extractJobPermissions}.
  */
 export function extractJobs(yaml: string): Map<string, ParsedJob> {
   const jobs = new Map<string, ParsedJob>();
-
-  // Find the jobs: section — take everything after `jobs:\n`
-  const jobsIdx = yaml.search(/^jobs:\s*$/m);
-  if (jobsIdx === -1) return jobs;
-
-  // Content after the `jobs:` line. Stop at the next top-level key (non-indented) or EOF.
-  const afterJobs = yaml.slice(jobsIdx + yaml.slice(jobsIdx).indexOf("\n") + 1);
-  const endMatch = afterJobs.search(/^[a-z]/m);
-  const jobsContent = endMatch === -1 ? afterJobs : afterJobs.slice(0, endMatch);
-
-  // Split into individual jobs by finding lines with exactly 2 spaces of indent followed by a key
-  const jobSections = jobsContent.split(/\n(?=  [a-z][a-z0-9-]*:)/);
-
-  for (const section of jobSections) {
-    const nameMatch = section.match(/^\s{2}([a-z][a-z0-9-]*):/);
-    if (!nameMatch) continue;
-
-    const name = nameMatch[1];
+  for (const [name, jobObj] of jobEntries(yaml)) {
     const job: ParsedJob = { name };
 
-    // Extract needs
-    const needsInline = section.match(/^\s{4}needs:\s+\[(.+)\]$/m);
-    if (needsInline) {
-      job.needs = needsInline[1].split(",").map((s) => s.trim().replace(/^'|'$/g, "").replace(/^"|"$/g, ""));
-    } else {
-      const needsList = section.match(/^\s{4}needs:\n((?:\s{6}- .+\n?)+)/m);
-      if (needsList) {
-        job.needs = [];
-        for (const line of needsList[1].split("\n")) {
-          const item = line.match(/^\s{6}- (.+)$/);
-          if (item) job.needs.push(item[1].trim().replace(/^'|'$/g, "").replace(/^"|"$/g, ""));
-        }
-      }
+    const needs = jobObj.needs;
+    if (typeof needs === "string") {
+      job.needs = [needs];
+    } else if (Array.isArray(needs)) {
+      job.needs = needs.filter((n) => typeof n === "string" || typeof n === "number").map(String);
     }
 
-    // Extract steps with uses:
-    const stepsMatch = section.match(/^\s{4}steps:\n([\s\S]*?)(?=\n\s{4}[a-z]|\n\s{2}[a-z]|$)/m);
-    if (stepsMatch) {
+    const steps = jobObj.steps;
+    if (Array.isArray(steps)) {
       job.steps = [];
-      const stepEntries = stepsMatch[1].split(/\n(?=\s{6}- )/);
-      for (const stepEntry of stepEntries) {
-        const usesMatch = stepEntry.match(/uses:\s+(.+)$/m);
-        const runMatch = stepEntry.match(/run:\s+(.+)$/m);
-        const stepNameMatch = stepEntry.match(/name:\s+(.+)$/m);
-        if (usesMatch || runMatch) {
-          job.steps.push({
-            uses: usesMatch?.[1] ? stripUsesComment(usesMatch[1].trim().replace(/^'|'$/g, "")) : undefined,
-            run: runMatch?.[1]?.trim(),
-            name: stepNameMatch?.[1]?.trim().replace(/^'|'$/g, ""),
-          });
-        }
+      for (const raw of steps) {
+        if (!raw || typeof raw !== "object" || Array.isArray(raw)) continue;
+        const step = raw as Record<string, unknown>;
+        job.steps.push({
+          uses: typeof step.uses === "string" ? stripUsesComment(step.uses) : undefined,
+          run: typeof step.run === "string" ? step.run : undefined,
+          name: typeof step.name === "string" ? step.name : undefined,
+        });
       }
     }
 
     jobs.set(name, job);
   }
-
   return jobs;
 }
 
@@ -497,6 +476,21 @@ export function extractUsesComment(rawUses: string): string | undefined {
   return comment ? comment : undefined;
 }
 
+/**
+ * Every `uses:` line in the workflow text, in document order, with its
+ * trailing comment. The parsed document has no comments (core's parseYAML
+ * drops them, #3006), so a check that reads the pin label (GHA059) takes it
+ * from here.
+ */
+export function usesLineComments(yaml: string): Array<{ ref: string; comment: string | undefined }> {
+  const out: Array<{ ref: string; comment: string | undefined }> = [];
+  for (const line of yaml.split(/\r?\n/)) {
+    const m = line.match(/^\s*(?:-\s+)?uses:\s*(["']?)([^\s"'#]+)\1(\s+#.*)?\s*$/);
+    if (m) out.push({ ref: m[2], comment: m[3] ? extractUsesComment(m[3]) : undefined });
+  }
+  return out;
+}
+
 export function parseActionUses(rawUses: string): { owner: string; repo: string; slug: string; gitRef: string } | undefined {
   const uses = stripUsesComment(rawUses);
   if (uses.startsWith("./") || uses.startsWith("../") || uses.startsWith("docker://")) return undefined;

package/src/lint/rules/data/deprecated-versions.ts

@@ -2,9 +2,12 @@
  * Deprecated action versions and recommended replacements.
  */
 
+import { ACTION_PINS } from "../../../action-pins";
+
 export const deprecatedVersions: Record<string, { deprecated: string[]; recommended: string }> = {
-  "actions/checkout": { deprecated: ["v1", "v2", "v3"], recommended: "v4" },
-  "actions/setup-node": { deprecated: ["v1", "v2", "v3"], recommended: "v4" },
+  // v4 runs on Node 20, which GitHub has deprecated for actions.
+  "actions/checkout": { deprecated: ["v1", "v2", "v3", "v4"], recommended: ACTION_PINS["actions/checkout"].major },
+  "actions/setup-node": { deprecated: ["v1", "v2", "v3", "v4"], recommended: ACTION_PINS["actions/setup-node"].major },
   "actions/setup-go": { deprecated: ["v1", "v2", "v3", "v4"], recommended: "v5" },
   "actions/setup-python": { deprecated: ["v1", "v2", "v3", "v4"], recommended: "v5" },
   "actions/cache": { deprecated: ["v1", "v2", "v3"], recommended: "v4" },

package/src/lint/rules/deprecated-action-version.test.ts

@@ -19,7 +19,7 @@ describe("GHA012: deprecated-action-version", () => {
   });
 
   test("does not flag current version", () => {
-    const ctx = createContext(`const s = "actions/checkout@v4";`);
+    const ctx = createContext(`const s = "actions/checkout@v7";`);
     const diags = deprecatedActionVersionRule.check(ctx);
     expect(diags).toHaveLength(0);
   });

package/src/lint/rules/rules.test.ts

@@ -244,7 +244,7 @@ describe("GHA012: deprecated-action-version", () => {
   });
 
   test("does not flag current version", () => {
-    const ctx = createContext(`const s = "actions/checkout@v4";`);
+    const ctx = createContext(`const s = "actions/checkout@v7";`);
     const diags = deprecatedActionVersionRule.check(ctx);
     expect(diags).toHaveLength(0);
   });

package/src/mcp/context-tools.test.ts

@@ -33,6 +33,23 @@ describe("downstreamJobs / actionPinned (#327)", () => {
     expect(downstreamJobs(yaml, "deploy")).toEqual([]);
   });
 
+  test("downstreamJobs follows a scalar needs: (#3201)", () => {
+    const yaml = `jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Build
+        run: echo build
+  test:
+    runs-on: ubuntu-latest
+    needs: build
+    steps:
+      - name: Test
+        run: echo test
+`;
+    expect(downstreamJobs(yaml, "build")).toEqual(["test"]);
+  });
+
   test("actionPinned only accepts a full commit SHA", () => {
     expect(actionPinned("actions/checkout@" + "a".repeat(40))).toBe(true);
     expect(actionPinned("actions/checkout@v4")).toBe(false);

package/src/plugin.test.ts

@@ -24,7 +24,7 @@ describe("githubPlugin", () => {
 
   test("provides post-synth checks", () => {
     const checks = githubPlugin.postSynthChecks!();
-    expect(checks.length).toBe(55);
+    expect(checks.length).toBe(56);
 
     const checkIds = checks.map((c) => c.id);
     expect(checkIds).toContain("GHA006");

package/src/serializer.ts

@@ -12,7 +12,7 @@ import type { Serializer, SerializerResult } from "@intentius/chant/serializer";
 import type { LexiconOutput } from "@intentius/chant/lexicon-output";
 import { walkValue, type SerializerVisitor } from "@intentius/chant/serializer-walker";
 import { INTRINSIC_MARKER } from "@intentius/chant/intrinsic";
-import { emitYAML } from "@intentius/chant/yaml";
+import { emitYAMLEntry } from "@intentius/chant/yaml";
 
 // ── Key conversion ────────────────────────────────────────────────
 
@@ -459,7 +459,7 @@ function emitYAMLDocument(doc: Record<string, unknown>): string {
       } else if (typeof value === "string" || typeof value === "number" || typeof value === "boolean") {
         sections.push(`${key}: ${yamlScalar(value)}`);
       } else {
-        sections.push(`${key}:` + emitYAML(value, 1));
+        sections.push(emitYAMLEntry(key, value));
       }
     }
   }
@@ -470,11 +470,22 @@ function emitYAMLDocument(doc: Record<string, unknown>): string {
     if (typeof value === "string" || typeof value === "number" || typeof value === "boolean") {
       sections.push(`${key}: ${yamlScalar(value)}`);
     } else {
-      sections.push(`${key}:` + emitYAML(value, 1));
+      sections.push(emitYAMLEntry(key, value));
     }
   }
 
-  return sections.join("\n\n") + "\n";
+  return unquotePinComments(sections.join("\n\n") + "\n");
+}
+
+/**
+ * A SHA-pinned `uses:` carries its version as a trailing comment
+ * (`actions/checkout@<sha> # v7.0.1`). The YAML emitter quotes any string with
+ * a `#`, which would make the comment part of the ref GitHub resolves. A ref
+ * holds no whitespace, so `<ref> # <label>` inside quotes is always this
+ * pattern, and writing it unquoted turns the label back into a comment.
+ */
+function unquotePinComments(yaml: string): string {
+  return yaml.replace(/^(\s*(?:- )?uses: )'([^\s']+) # ([^'\n]*)'$/gm, "$1$2 # $3");
 }
 
 function yamlScalar(value: string | number | boolean): string {