@intentius/chant-lexicon-github 0.45.0 → 0.49.0

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "e30d7f473b8a2e2f5043a3cb45b1904b7a3863a8a114d534e0fe87147352f632",
+    "manifest.json": "f13c6d5badc99a05feb6c2f1172e984576192151b1a62a157d770efa5b1c541c",
     "meta.json": "798c5f5f37b0174756d2451299acfdc95c014f11d06d32b9153bbdfa9f3a580c",
     "types/index.d.ts": "39c0791f0e58025bcef82e0f7a92240508f899fc2771d5dd51b2369b4d330f13",
     "rules/deprecated-action-version.ts": "d41e6e532ab7f623af1bee4ac5279fcb2baada7defa1c5d022a5bc71983e8797",
@@ -20,7 +20,7 @@
     "rules/gha006.ts": "7e2977d34851ce2ed9f91c4dd78ecda8d4de099ceaac1cd9ab74960a193133a3",
     "rules/gha009.ts": "0f9a261e886309679494da32b72a0d9ea20017e5da75a9d59a04846a0e4d78db",
     "rules/gha011.ts": "53b7ca79b5bf56e5793a9b7a44ae0ac766eb5acf0669005e7810cb7762bab79c",
-    "rules/gha013.ts": "47c1b28565aced3370b85d00a03b6110a32e451661e34badd731ffbb24b45d9a",
+    "rules/gha013.ts": "cd9119154d7b9de94ae3f4d41ad5f09c5757e25a5effddd3d580ef5d1466a8fc",
     "rules/gha017.ts": "ec62dac7f9d69f36978cb461c4ba391a7e445d410bbfa497cddcb1b12cfd5904",
     "rules/gha018.ts": "2c71c5accb96bccfa01075e7f8f4ad66e6d9a68a81b86f89a68cabb9c144e140",
     "rules/gha019.ts": "d0b33d63812c9cba2ebf9f2d85d8cf22068ea96460cd2143bdfb4d2a4d58fe2e",
@@ -67,5 +67,5 @@
     "skills/chant-github-patterns.md": "bb3abef289a8fdfcf07d6bb2d7289dcb2f38bc0cb0321ea320b78b45a6f548c0",
     "skills/chant-github-security.md": "aab111cb0871cad30281ce48d7da23663689619351029219e2be019a1a61e394"
   },
-  "composite": "77a265cdec5d2163e1ce49b12ef260aaa7e23b3d8989fcb6de23a90ce9612227"
+  "composite": "b77a589c318cd23862c320a4e9ba5459696b8192700a8f9a23ff49519149d90b"
 }

package/dist/lint/post-synth/gha013.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gha013.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/gha013.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAG9G,eAAO,MAAM,MAAM,EAAE,cA6BpB,CAAC"}
+{"version":3,"file":"gha013.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/gha013.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAG9G,eAAO,MAAM,MAAM,EAAE,cAoCpB,CAAC"}

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "github",
-  "version": "0.45.0",
+  "version": "0.49.0",
   "chantVersion": ">=0.1.0",
   "namespace": "GitHub",
   "intrinsics": [

package/dist/rules/gha013.ts

@@ -6,7 +6,7 @@
  */
 
 import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
-import { getPrimaryOutput, extractJobs, extractTriggers } from "./yaml-helpers";
+import { getPrimaryOutput, extractJobs, extractTriggers, extractJobPermissions } from "./yaml-helpers";
 
 export const gha013: PostSynthCheck = {
   id: "GHA013",
@@ -21,9 +21,16 @@ export const gha013: PostSynthCheck = {
 
       if (!triggers["pull_request_target"] && !triggers["workflow_dispatch"]) continue;
 
+      // chant #1544 — `extractJobs`' `ParsedJob.permissions` field is never
+      // populated (its regex-based per-job scan only fills `needs`/`steps`),
+      // so this rule read `job.permissions` as always undefined and warned
+      // on every job regardless of whether it declared one. `extractJobPermissions`
+      // (below) is the structural, `parseYAML`-backed extractor that other
+      // permissions-aware checks already use — it actually sees the block.
       const jobs = extractJobs(yaml);
-      for (const [jobName, job] of jobs) {
-        if (!job.permissions) {
+      const jobPermissions = extractJobPermissions(yaml);
+      for (const [jobName] of jobs) {
+        if (!jobPermissions.has(jobName)) {
           diagnostics.push({
             checkId: "GHA013",
             severity: "warning",

package/dist/serializer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"serializer.d.ts","sourceRoot":"","sources":["../src/serializer.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,OAAO,KAAK,EAAE,UAAU,EAAoB,MAAM,6BAA6B,CAAC;AA6MhF;;GAEG;AACH,eAAO,MAAM,gBAAgB,EAAE,UAwD9B,CAAC"}
+{"version":3,"file":"serializer.d.ts","sourceRoot":"","sources":["../src/serializer.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,OAAO,KAAK,EAAE,UAAU,EAAoB,MAAM,6BAA6B,CAAC;AAuNhF;;GAEG;AACH,eAAO,MAAM,gBAAgB,EAAE,UAwD9B,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-github",
-  "version": "0.45.0",
+  "version": "0.49.0",
   "description": "GitHub Actions lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -61,7 +61,7 @@
     "typescript": "^5.9.3"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.45.0",
+    "@intentius/chant": "^0.49.0",
     "typescript": "^5.9.3"
   }
 }

package/src/lint/post-synth/gha013.test.ts

@@ -50,6 +50,23 @@ jobs:
     expect(diags[0].message).toContain("deploy");
   });
 
+  test("does not flag a job that declares job-level permissions (#1544)", () => {
+    const yaml = `name: Deploy
+on:
+  workflow_dispatch:
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - run: echo deploy
+`;
+    const diags = gha013.check(makeCtx(yaml));
+    expect(diags).toHaveLength(0);
+  });
+
   test("does not flag when trigger is not sensitive", () => {
     const yaml = `name: CI
 on:

package/src/lint/post-synth/gha013.ts

@@ -6,7 +6,7 @@
  */
 
 import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
-import { getPrimaryOutput, extractJobs, extractTriggers } from "./yaml-helpers";
+import { getPrimaryOutput, extractJobs, extractTriggers, extractJobPermissions } from "./yaml-helpers";
 
 export const gha013: PostSynthCheck = {
   id: "GHA013",
@@ -21,9 +21,16 @@ export const gha013: PostSynthCheck = {
 
       if (!triggers["pull_request_target"] && !triggers["workflow_dispatch"]) continue;
 
+      // chant #1544 — `extractJobs`' `ParsedJob.permissions` field is never
+      // populated (its regex-based per-job scan only fills `needs`/`steps`),
+      // so this rule read `job.permissions` as always undefined and warned
+      // on every job regardless of whether it declared one. `extractJobPermissions`
+      // (below) is the structural, `parseYAML`-backed extractor that other
+      // permissions-aware checks already use — it actually sees the block.
       const jobs = extractJobs(yaml);
-      for (const [jobName, job] of jobs) {
-        if (!job.permissions) {
+      const jobPermissions = extractJobPermissions(yaml);
+      for (const [jobName] of jobs) {
+        if (!jobPermissions.has(jobName)) {
           diagnostics.push({
             checkId: "GHA013",
             severity: "warning",

package/src/serializer.test.ts

@@ -180,6 +180,36 @@ describe("githubSerializer.serialize", () => {
     expect(output).toContain("continue-on-error: true");
   });
 
+  test("env / with map keys pass through verbatim (chant #1223)", () => {
+    const entities = new Map<string, Declarable>();
+    entities.set("workflow", new MockWorkflow({
+      name: "CI",
+      on: { push: null },
+    }));
+    entities.set("job", new MockJob({
+      "runs-on": "ubuntu-latest",
+      env: { CHANT_ENV: "pr-1", kubeConfigPath: "/tmp/kc" },
+      steps: [
+        new MockStep({
+          uses: "actions/setup-node@abc",
+          with: { "node-version": "22", checkLatest: "true" },
+          env: { GH_TOKEN: "${{ secrets.GITHUB_TOKEN }}" },
+        }),
+      ],
+    }));
+
+    const output = githubSerializer.serialize(entities) as string;
+    // Env var names are user identifiers — kebab-casing renames what the
+    // script reads. They must survive exactly as written.
+    expect(output).toContain("CHANT_ENV: pr-1");
+    expect(output).toContain("kubeConfigPath: /tmp/kc");
+    expect(output).toContain("GH_TOKEN:");
+    // Action inputs are the action's declared names, also not chant's to touch.
+    expect(output).toContain("checkLatest: 'true'");
+    expect(output).not.toContain("gh-token");
+    expect(output).not.toContain("chant-env");
+  });
+
   test("serializes trigger entities", () => {
     const entities = new Map<string, Declarable>();
     entities.set("workflow", new MockWorkflow({

package/src/serializer.ts

@@ -183,6 +183,15 @@ function buildStandaloneJobsSection(
 
 // ── Key conversion for YAML output ────────────────────────────────
 
+/**
+ * Map keys whose entries are user-named, not schema properties. `env` names
+ * environment variables (`KUBECONFIG_DATA` must stay `KUBECONFIG_DATA`, not
+ * become `kubeconfig_data`), `with` names an action's declared inputs,
+ * `outputs`/`secrets`/`variables` name user identifiers referenced elsewhere
+ * by exact spelling. Kebab-casing inside these silently renames them.
+ */
+const VERBATIM_KEY_MAPS = new Set(["env", "with", "outputs", "secrets", "variables"]);
+
 /**
  * Convert a props object keys from camelCase to kebab-case for job/step properties.
  */
@@ -192,21 +201,22 @@ function convertKeys(obj: Record<string, unknown>): Record<string, unknown> {
     if (value === undefined || value === null) continue;
     // Zero and false are valid values, but undefined/null should be omitted
     const yamlKey = toKebabCase(key);
-    result[yamlKey] = convertValueKeys(value);
+    result[yamlKey] = convertValueKeys(value, VERBATIM_KEY_MAPS.has(yamlKey));
   }
   return result;
 }
 
-function convertValueKeys(value: unknown): unknown {
+function convertValueKeys(value: unknown, verbatim = false): unknown {
   if (value === null || value === undefined) return value;
   if (typeof value !== "object") return value;
-  if (Array.isArray(value)) return value.map(convertValueKeys);
+  if (Array.isArray(value)) return value.map((v) => convertValueKeys(v, verbatim));
 
   const obj = value as Record<string, unknown>;
   const result: Record<string, unknown> = {};
   for (const [key, v] of Object.entries(obj)) {
     if (v === undefined || v === null) continue;
-    result[toKebabCase(key)] = convertValueKeys(v);
+    const yamlKey = verbatim ? key : toKebabCase(key);
+    result[yamlKey] = convertValueKeys(v, verbatim || VERBATIM_KEY_MAPS.has(yamlKey));
   }
   return result;
 }