@intentius/chant-lexicon-gitlab 0.0.16 → 0.0.22

package/dist/rules/wgl027.ts

@@ -0,0 +1,54 @@
+/**
+ * WGL027: Empty Script
+ *
+ * Detects jobs with `script: []` or scripts containing only empty strings.
+ * GitLab rejects jobs with empty scripts at pipeline validation time.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { isPropertyDeclarable } from "@intentius/chant/declarable";
+
+export const wgl027: PostSynthCheck = {
+  id: "WGL027",
+  description: "Empty script — jobs with empty or blank script entries",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const [entityName, entity] of ctx.entities) {
+      if (isPropertyDeclarable(entity)) continue;
+      const entityType = (entity as Record<string, unknown>).entityType as string;
+      if (entityType !== "GitLab::CI::Job") continue;
+
+      const props = (entity as Record<string, unknown>).props as Record<string, unknown> | undefined;
+      if (!props) continue;
+
+      const script = props.script;
+      if (script === undefined || script === null) continue;
+
+      let isEmpty = false;
+
+      if (Array.isArray(script)) {
+        if (script.length === 0) {
+          isEmpty = true;
+        } else if (script.every((s) => typeof s === "string" && s.trim() === "")) {
+          isEmpty = true;
+        }
+      } else if (typeof script === "string" && script.trim() === "") {
+        isEmpty = true;
+      }
+
+      if (isEmpty) {
+        diagnostics.push({
+          checkId: "WGL027",
+          severity: "error",
+          message: `Job "${entityName}" has an empty script — GitLab will reject this pipeline`,
+          entity: entityName,
+          lexicon: "gitlab",
+        });
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/dist/rules/wgl028.ts

@@ -0,0 +1,67 @@
+/**
+ * WGL028: Redundant Needs
+ *
+ * Detects `needs:` entries that list jobs already implied by stage ordering.
+ * While not incorrect, redundant needs add noise and make the pipeline
+ * harder to maintain. This is informational only.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { getPrimaryOutput, extractStages, extractJobs } from "./yaml-helpers";
+
+export function checkRedundantNeeds(yaml: string): PostSynthDiagnostic[] {
+  const diagnostics: PostSynthDiagnostic[] = [];
+
+  const stages = extractStages(yaml);
+  if (stages.length === 0) return diagnostics;
+
+  const stageIndex = new Map<string, number>();
+  for (let i = 0; i < stages.length; i++) {
+    stageIndex.set(stages[i], i);
+  }
+
+  const jobs = extractJobs(yaml);
+
+  for (const [jobName, job] of jobs) {
+    if (!job.needs || !job.stage) continue;
+
+    const jobStageIdx = stageIndex.get(job.stage);
+    if (jobStageIdx === undefined) continue;
+
+    for (const need of job.needs) {
+      const neededJob = jobs.get(need);
+      if (!neededJob?.stage) continue;
+
+      const needStageIdx = stageIndex.get(neededJob.stage);
+      if (needStageIdx === undefined) continue;
+
+      // If the needed job is in an earlier stage, it's already implied
+      // by GitLab's default stage-based ordering
+      if (needStageIdx < jobStageIdx) {
+        diagnostics.push({
+          checkId: "WGL028",
+          severity: "info",
+          message: `Job "${jobName}" lists "${need}" in needs: but it's already in an earlier stage (${neededJob.stage} → ${job.stage})`,
+          entity: jobName,
+          lexicon: "gitlab",
+        });
+      }
+    }
+  }
+
+  return diagnostics;
+}
+
+export const wgl028: PostSynthCheck = {
+  id: "WGL028",
+  description: "Redundant needs — needs listing jobs already implied by stage ordering",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+    for (const [, output] of ctx.outputs) {
+      const yaml = getPrimaryOutput(output);
+      diagnostics.push(...checkRedundantNeeds(yaml));
+    }
+    return diagnostics;
+  },
+};

package/dist/rules/yaml-helpers.ts

@@ -141,3 +141,85 @@ export function extractJobs(yaml: string): Map<string, ParsedJob> {
 export function hasInclude(yaml: string): boolean {
   return /^include:/m.test(yaml);
 }
+
+/**
+ * Extract global variables from serialized YAML.
+ */
+export function extractGlobalVariables(yaml: string): Map<string, string> {
+  const vars = new Map<string, string>();
+  const match = yaml.match(/^variables:\n((?:\s+.+\n?)+)/m);
+  if (!match) return vars;
+
+  for (const line of match[1].split("\n")) {
+    const kv = line.match(/^\s+(\w+):\s+(.+)$/);
+    if (kv) {
+      vars.set(kv[1], kv[2].trim().replace(/^['"]|['"]$/g, ""));
+    }
+  }
+  return vars;
+}
+
+/**
+ * Extract the full section text for a given job name.
+ */
+export function extractJobSection(yaml: string, jobName: string): string | null {
+  const sections = yaml.split("\n\n");
+  for (const section of sections) {
+    const lines = section.split("\n");
+    if (lines.length > 0 && lines[0].startsWith(`${jobName}:`)) {
+      return section;
+    }
+  }
+  return null;
+}
+
+/**
+ * Extract rules from a job section.
+ */
+export function extractJobRules(section: string): ParsedRule[] {
+  const rules: ParsedRule[] = [];
+  const lines = section.split("\n");
+
+  let inRules = false;
+  let currentRule: ParsedRule = {};
+
+  for (const line of lines) {
+    if (line.match(/^\s+rules:$/)) {
+      inRules = true;
+      continue;
+    }
+
+    if (inRules) {
+      const ruleStart = line.match(/^\s+- (if|when|changes):\s*(.*)$/);
+      if (ruleStart) {
+        if (Object.keys(currentRule).length > 0) {
+          rules.push(currentRule);
+        }
+        currentRule = {};
+        if (ruleStart[1] === "if") currentRule.if = ruleStart[2].trim();
+        if (ruleStart[1] === "when") currentRule.when = ruleStart[2].trim();
+        continue;
+      }
+
+      const whenMatch = line.match(/^\s+when:\s+(.+)$/);
+      if (whenMatch) {
+        currentRule.when = whenMatch[1].trim();
+        continue;
+      }
+
+      // End of rules block
+      if (!line.match(/^\s+\s/) || line.match(/^\s+[a-z_]+:/) && !line.match(/^\s+when:/)) {
+        if (Object.keys(currentRule).length > 0) {
+          rules.push(currentRule);
+        }
+        inRules = false;
+      }
+    }
+  }
+
+  if (inRules && Object.keys(currentRule).length > 0) {
+    rules.push(currentRule);
+  }
+
+  return rules;
+}

package/dist/skills/chant-gitlab.md

@@ -8,7 +8,7 @@ user-invocable: true
 
 ## How chant and GitLab CI relate
 
-chant is a **synthesis-only** tool — it compiles TypeScript source files into `.gitlab-ci.yml` (YAML). chant does NOT call GitLab APIs. Your job as an agent is to bridge the two:
+chant is a **synthesis compiler** — it compiles TypeScript source files into `.gitlab-ci.yml` (YAML). `chant build` does not call GitLab APIs; synthesis is pure and deterministic. Your job as an agent is to bridge synthesis and deployment:
 
 - Use **chant** for: build, lint, diff (local YAML comparison)
 - Use **git + GitLab API** for: push, merge requests, pipeline monitoring, job logs, rollback, and all deployment operations
@@ -147,7 +147,7 @@ Add `"dry_run": true, "include_merged_yaml": true` for full expansion with inclu
 | Step | Catches | When to run |
 |------|---------|-------------|
 | `chant lint` | Deprecated only/except (WGL001), missing script (WGL002), missing stage (WGL003), artifacts without expiry (WGL004) | Every edit |
-| `chant build` | Post-synth checks: undefined stages (WGL010), unreachable jobs (WGL011), deprecated properties (WGL012), invalid needs targets (WGL013), invalid extends targets (WGL014), circular needs chains (WGL015) | Before push |
+| `chant build` | Post-synth checks: undefined stages (WGL010), unreachable jobs (WGL011), deprecated properties (WGL012), invalid needs/extends targets (WGL013-014), circular needs (WGL015), secrets in variables (WGL016), insecure registry (WGL017), missing timeout/retry (WGL018-019), duplicate jobs (WGL020), unused variables (WGL021), missing artifacts expiry (WGL022), overly broad rules (WGL023), manual without allow_failure (WGL024), missing cache key (WGL025), DinD without TLS (WGL026), empty script (WGL027), redundant needs (WGL028) | Before push |
 | CI Lint API | GitLab-specific validation: include resolution, variable expansion, YAML schema errors | Before merge to default branch |
 
 Always run all three before deploying. Lint catches things the API cannot (and vice versa).

package/package.json

@@ -1,7 +1,25 @@
 {
   "name": "@intentius/chant-lexicon-gitlab",
-  "version": "0.0.16",
+  "version": "0.0.22",
+  "description": "GitLab CI lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",
+  "homepage": "https://intentius.io/chant",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/intentius/chant.git",
+    "directory": "lexicons/gitlab"
+  },
+  "bugs": {
+    "url": "https://github.com/intentius/chant/issues"
+  },
+  "keywords": [
+    "infrastructure-as-code",
+    "iac",
+    "typescript",
+    "gitlab",
+    "gitlab-ci",
+    "chant"
+  ],
   "type": "module",
   "files": [
     "src/",
@@ -25,7 +43,7 @@
     "prepack": "bun run generate && bun run bundle && bun run validate"
   },
   "dependencies": {
-    "@intentius/chant": "0.0.15"
+    "@intentius/chant": "0.0.22"
   },
   "devDependencies": {
     "typescript": "^5.9.3"

package/src/codegen/fetch.test.ts

@@ -0,0 +1,30 @@
+import { describe, test, expect } from "bun:test";
+import { fetchCISchema, fetchSchemas, getCachePath, GITLAB_SCHEMA_VERSION } from "./fetch";
+
+describe("fetch", () => {
+  test("fetchCISchema function exists", () => {
+    expect(typeof fetchCISchema).toBe("function");
+  });
+
+  test("fetchSchemas function exists", () => {
+    expect(typeof fetchSchemas).toBe("function");
+  });
+
+  test("GITLAB_SCHEMA_VERSION is defined", () => {
+    expect(typeof GITLAB_SCHEMA_VERSION).toBe("string");
+    expect(GITLAB_SCHEMA_VERSION).toMatch(/^v\d+\.\d+\.\d+-ee$/);
+  });
+
+  test("getCachePath returns a path", () => {
+    const cachePath = getCachePath();
+    expect(typeof cachePath).toBe("string");
+    expect(cachePath).toContain("gitlab-ci-schema.json");
+  });
+
+  test.skip("integration: fetchCISchema returns Buffer (requires network)", async () => {
+    const data = await fetchCISchema();
+    expect(data).toBeInstanceOf(Buffer);
+    const parsed = JSON.parse(data.toString("utf-8"));
+    expect(parsed.properties).toBeDefined();
+  });
+});

package/src/codegen/generate.test.ts

@@ -0,0 +1,65 @@
+import { describe, test, expect } from "bun:test";
+import { generate, writeGeneratedFiles } from "./generate";
+import { loadSchemaFixtureMap } from "../testdata/load-fixtures";
+
+describe("generate pipeline components", () => {
+  test("exports generate function", () => {
+    expect(typeof generate).toBe("function");
+  });
+
+  test("exports writeGeneratedFiles function", () => {
+    expect(typeof writeGeneratedFiles).toBe("function");
+  });
+
+  // Integration test — requires network, skip by default
+  test.skip("generates full pipeline (integration)", async () => {
+    const result = await generate({ verbose: false });
+
+    expect(result.resources).toBeGreaterThan(0);
+    expect(result.properties).toBeGreaterThan(0);
+    expect(result.lexiconJSON).toBeTruthy();
+    expect(result.typesDTS).toBeTruthy();
+    expect(result.indexTS).toBeTruthy();
+  });
+});
+
+describe("offline fixture pipeline", () => {
+  test("generates from fixtures", async () => {
+    const fixtures = loadSchemaFixtureMap();
+    const result = await generate({ schemaSource: fixtures });
+
+    expect(result.resources).toBeGreaterThanOrEqual(1);
+    expect(result.properties).toBeGreaterThanOrEqual(0);
+    expect(result.lexiconJSON).toBeTruthy();
+    expect(result.typesDTS).toBeTruthy();
+    expect(result.indexTS).toBeTruthy();
+  });
+
+  test("output contains expected entities", async () => {
+    const fixtures = loadSchemaFixtureMap();
+    const result = await generate({ schemaSource: fixtures });
+
+    const lexicon = JSON.parse(result.lexiconJSON);
+    // Core CI entities should be present
+    expect(lexicon["Job"]).toBeDefined();
+    expect(lexicon["Default"]).toBeDefined();
+    expect(lexicon["Workflow"]).toBeDefined();
+  });
+
+  test("resource and property counts are non-zero", async () => {
+    const fixtures = loadSchemaFixtureMap();
+    const result = await generate({ schemaSource: fixtures });
+
+    expect(result.resources).toBeGreaterThan(0);
+    // Properties are optional in a minimal fixture but count should be defined
+    expect(typeof result.properties).toBe("number");
+    expect(typeof result.enums).toBe("number");
+  });
+
+  test("produces no warnings from fixtures", async () => {
+    const fixtures = loadSchemaFixtureMap();
+    const result = await generate({ schemaSource: fixtures });
+
+    expect(result.warnings).toHaveLength(0);
+  });
+});

package/src/codegen/idempotency.test.ts

@@ -0,0 +1,28 @@
+import { describe, test, expect } from "bun:test";
+import { generate } from "./generate";
+import { loadSchemaFixtureMap } from "../testdata/load-fixtures";
+
+describe("generation idempotency", () => {
+  test("two generations from same fixtures produce identical content", async () => {
+    const fixtures = loadSchemaFixtureMap();
+
+    const result1 = await generate({ schemaSource: fixtures });
+    const result2 = await generate({ schemaSource: fixtures });
+
+    // Content should be byte-identical
+    expect(result1.lexiconJSON).toBe(result2.lexiconJSON);
+    expect(result1.typesDTS).toBe(result2.typesDTS);
+    expect(result1.indexTS).toBe(result2.indexTS);
+  });
+
+  test("resource counts match between runs", async () => {
+    const fixtures = loadSchemaFixtureMap();
+
+    const result1 = await generate({ schemaSource: fixtures });
+    const result2 = await generate({ schemaSource: fixtures });
+
+    expect(result1.resources).toBe(result2.resources);
+    expect(result1.properties).toBe(result2.properties);
+    expect(result1.enums).toBe(result2.enums);
+  });
+});

package/src/codegen/naming.test.ts

@@ -0,0 +1,93 @@
+import { describe, test, expect } from "bun:test";
+import { gitlabShortName, type GitLabParseResult } from "./parse";
+import { NamingStrategy } from "./naming";
+
+/**
+ * Chant's naming philosophy for GitLab: simple, flat names.
+ * Every priorityName should be the short name from the GitLab::CI:: namespace.
+ * No "CI" prefix should leak into class names.
+ */
+
+/** Build a minimal GitLabParseResult for a given typeName. */
+function stubResult(typeName: string, isProperty?: boolean): GitLabParseResult {
+  return {
+    resource: {
+      typeName,
+      properties: [],
+      attributes: [],
+      deprecatedProperties: [],
+    },
+    propertyTypes: [],
+    enums: [],
+    isProperty,
+  };
+}
+
+describe("naming spec fidelity", () => {
+  const typeNames = [
+    "GitLab::CI::Job",
+    "GitLab::CI::Default",
+    "GitLab::CI::Workflow",
+    "GitLab::CI::Artifacts",
+    "GitLab::CI::Cache",
+    "GitLab::CI::Image",
+    "GitLab::CI::Rule",
+    "GitLab::CI::Retry",
+    "GitLab::CI::AllowFailure",
+    "GitLab::CI::Parallel",
+    "GitLab::CI::Include",
+    "GitLab::CI::Release",
+    "GitLab::CI::Environment",
+    "GitLab::CI::Trigger",
+    "GitLab::CI::AutoCancel",
+    "GitLab::CI::WorkflowRule",
+    "GitLab::CI::Need",
+    "GitLab::CI::Inherit",
+  ];
+
+  const results = typeNames.map((t) => stubResult(t));
+  const strategy = new NamingStrategy(results);
+
+  test("all priority names resolve to short name", () => {
+    for (const typeName of typeNames) {
+      const resolved = strategy.resolve(typeName);
+      const shortName = gitlabShortName(typeName);
+      expect(resolved).toBe(shortName);
+    }
+  });
+
+  test("no priority name has CI prefix", () => {
+    for (const typeName of typeNames) {
+      const resolved = strategy.resolve(typeName)!;
+      // "CI" as a prefix (e.g. "CIJob") would be wrong; "Cache" starting with "C" is fine
+      expect(resolved.startsWith("CI")).toBe(false);
+    }
+  });
+
+  test("no priority name has GitLab prefix", () => {
+    for (const typeName of typeNames) {
+      const resolved = strategy.resolve(typeName)!;
+      expect(resolved.startsWith("GitLab")).toBe(false);
+    }
+  });
+
+  test("all 18 priority names are mapped", () => {
+    expect(typeNames).toHaveLength(18);
+    for (const typeName of typeNames) {
+      expect(strategy.resolve(typeName)).toBeDefined();
+    }
+  });
+});
+
+describe("property type naming", () => {
+  test("resolves property entities correctly", () => {
+    const results = [
+      stubResult("GitLab::CI::Artifacts", true),
+      stubResult("GitLab::CI::Cache", true),
+    ];
+    const strategy = new NamingStrategy(results);
+
+    expect(strategy.resolve("GitLab::CI::Artifacts")).toBe("Artifacts");
+    expect(strategy.resolve("GitLab::CI::Cache")).toBe("Cache");
+  });
+});

package/src/codegen/snapshot.test.ts

@@ -1,19 +1,21 @@
 import { describe, test, expect } from "bun:test";
-import { readFileSync } from "fs";
+import { existsSync, readFileSync } from "fs";
 import { join, dirname } from "path";
 import { fileURLToPath } from "url";
 
 const generatedDir = join(dirname(dirname(fileURLToPath(import.meta.url))), "generated");
+const hasGenerated = existsSync(join(generatedDir, "lexicon-gitlab.json"));
 
 describe("generated lexicon-gitlab.json", () => {
-  const content = readFileSync(join(generatedDir, "lexicon-gitlab.json"), "utf-8");
-  const registry = JSON.parse(content);
-
-  test("is valid JSON with expected entries", () => {
+  test.skipIf(!hasGenerated)("is valid JSON with expected entries", () => {
+    const content = readFileSync(join(generatedDir, "lexicon-gitlab.json"), "utf-8");
+    const registry = JSON.parse(content);
     expect(Object.keys(registry)).toHaveLength(19);
   });
 
-  test("contains all resource entities", () => {
+  test.skipIf(!hasGenerated)("contains all resource entities", () => {
+    const content = readFileSync(join(generatedDir, "lexicon-gitlab.json"), "utf-8");
+    const registry = JSON.parse(content);
     expect(registry.Job).toBeDefined();
     expect(registry.Job.kind).toBe("resource");
     expect(registry.Job.resourceType).toBe("GitLab::CI::Job");
@@ -26,7 +28,9 @@ describe("generated lexicon-gitlab.json", () => {
     expect(registry.Workflow.kind).toBe("resource");
   });
 
-  test("contains all property entities", () => {
+  test.skipIf(!hasGenerated)("contains all property entities", () => {
+    const content = readFileSync(join(generatedDir, "lexicon-gitlab.json"), "utf-8");
+    const registry = JSON.parse(content);
     const propertyNames = [
       "AllowFailure", "Artifacts", "AutoCancel", "Cache",
       "Environment", "Image", "Include", "Inherit", "Parallel",
@@ -40,7 +44,9 @@ describe("generated lexicon-gitlab.json", () => {
     }
   });
 
-  test("entries match snapshot", () => {
+  test.skipIf(!hasGenerated)("entries match snapshot", () => {
+    const content = readFileSync(join(generatedDir, "lexicon-gitlab.json"), "utf-8");
+    const registry = JSON.parse(content);
     expect(registry.Job).toMatchSnapshot();
     expect(registry.Artifacts).toMatchSnapshot();
     expect(registry.Cache).toMatchSnapshot();
@@ -49,9 +55,8 @@ describe("generated lexicon-gitlab.json", () => {
 });
 
 describe("generated index.d.ts", () => {
-  const content = readFileSync(join(generatedDir, "index.d.ts"), "utf-8");
-
-  test("contains all class declarations", () => {
+  test.skipIf(!hasGenerated)("contains all class declarations", () => {
+    const content = readFileSync(join(generatedDir, "index.d.ts"), "utf-8");
     const expectedClasses = [
       "Job", "Default", "Workflow",
       "AllowFailure", "Artifacts", "AutoCancel", "Cache",
@@ -64,14 +69,16 @@ describe("generated index.d.ts", () => {
     }
   });
 
-  test("contains CI variables declaration", () => {
+  test.skipIf(!hasGenerated)("contains CI variables declaration", () => {
+    const content = readFileSync(join(generatedDir, "index.d.ts"), "utf-8");
     expect(content).toContain("export declare const CI");
     expect(content).toContain("readonly CommitBranch: string");
     expect(content).toContain("readonly CommitSha: string");
     expect(content).toContain("readonly PipelineId: string");
   });
 
-  test("Job class has key properties in constructor", () => {
+  test.skipIf(!hasGenerated)("Job class has key properties in constructor", () => {
+    const content = readFileSync(join(generatedDir, "index.d.ts"), "utf-8");
     // Extract the Job class declaration
     const jobMatch = content.match(/export declare class Job \{[\s\S]*?\n\}/);
     expect(jobMatch).toBeDefined();
@@ -85,27 +92,29 @@ describe("generated index.d.ts", () => {
 });
 
 describe("generated index.ts", () => {
-  const content = readFileSync(join(generatedDir, "index.ts"), "utf-8");
-
-  test("has correct resource createResource calls", () => {
+  test.skipIf(!hasGenerated)("has correct resource createResource calls", () => {
+    const content = readFileSync(join(generatedDir, "index.ts"), "utf-8");
     expect(content).toContain('createResource("GitLab::CI::Default"');
     expect(content).toContain('createResource("GitLab::CI::Job"');
     expect(content).toContain('createResource("GitLab::CI::Workflow"');
   });
 
-  test("has correct property createProperty calls", () => {
+  test.skipIf(!hasGenerated)("has correct property createProperty calls", () => {
+    const content = readFileSync(join(generatedDir, "index.ts"), "utf-8");
     expect(content).toContain('createProperty("GitLab::CI::Artifacts"');
     expect(content).toContain('createProperty("GitLab::CI::Cache"');
     expect(content).toContain('createProperty("GitLab::CI::Image"');
     expect(content).toContain('createProperty("GitLab::CI::Rule"');
   });
 
-  test("re-exports reference and CI", () => {
+  test.skipIf(!hasGenerated)("re-exports reference and CI", () => {
+    const content = readFileSync(join(generatedDir, "index.ts"), "utf-8");
     expect(content).toContain('export { reference } from "../intrinsics"');
     expect(content).toContain('export { CI } from "../variables"');
   });
 
-  test("imports from runtime", () => {
+  test.skipIf(!hasGenerated)("imports from runtime", () => {
+    const content = readFileSync(join(generatedDir, "index.ts"), "utf-8");
     expect(content).toContain('from "./runtime"');
   });
 });