@intentius/chant-lexicon-gitlab 0.1.12 → 0.1.14

package/src/migrate/from-github/actions/tier-2.ts

@@ -0,0 +1,296 @@
+/**
+ * Tier 2 marketplace action mappings — 14 common actions from the
+ * upstream skill's `references/marketplace-actions.md`.
+ */
+
+import type { ActionMapping, ActionMappedResult, ActionMapCtx } from "./registry";
+import { getDefaultRegistry } from "./registry";
+
+const prov = (
+  ctx: ActionMapCtx,
+  actionName: string,
+  note: string,
+  category: "literal" | "needs-review" | "skipped" | "action-map" = "action-map",
+) => ({
+  gitlabPath: `jobs.${ctx.logicalId}.script`,
+  gitlabLogicalId: ctx.logicalId,
+  sourceKey: `jobs.${ctx.jobName}.steps[${ctx.stepIndex}].uses`,
+  sourceFile: ctx.sourceFile,
+  category,
+  rule: `ACT-${actionName.replace(/[\/-]/g, "-")}`,
+  note,
+  actionRef: actionName,
+  mappingTier: 2 as const,
+});
+
+const getWith = (s: Record<string, unknown>): Record<string, unknown> =>
+  (s.with as Record<string, unknown>) ?? {};
+
+const actionsSetupDotnet: ActionMapping = {
+  actionName: "actions/setup-dotnet",
+  tier: 2,
+  translate(step, ctx): ActionMappedResult {
+    const w = getWith(step);
+    const version = (w["dotnet-version"] as string) ?? "8.0";
+    return {
+      scriptLines: [],
+      image: `mcr.microsoft.com/dotnet/sdk:${version}`,
+      cache: { paths: [".nuget/packages/"] },
+      provenance: [prov(ctx, "actions/setup-dotnet", `setup-dotnet → image: mcr.microsoft.com/dotnet/sdk:${version}`)],
+    };
+  },
+};
+
+const shivammathurSetupPhp: ActionMapping = {
+  actionName: "shivammathur/setup-php",
+  tier: 2,
+  translate(step, ctx): ActionMappedResult {
+    const w = getWith(step);
+    const version = (w["php-version"] as string) ?? "8.3";
+    const extensions = (w.extensions as string) ?? "";
+    const lines = ["apt-get update"];
+    if (extensions) lines.push(`docker-php-ext-install ${extensions.split(",").map((s) => s.trim()).join(" ")}`);
+    return {
+      scriptLines: [],
+      image: `php:${version}`,
+      beforeScript: lines,
+      provenance: [prov(ctx, "shivammathur/setup-php", `setup-php → image: php:${version} + before_script extensions`)],
+    };
+  },
+};
+
+const awsConfigureCredentials: ActionMapping = {
+  actionName: "aws-actions/configure-aws-credentials",
+  tier: 2,
+  translate(step, ctx): ActionMappedResult {
+    const w = getWith(step);
+    const region = (w["aws-region"] as string) ?? "us-east-1";
+    return {
+      scriptLines: [],
+      variables: {
+        AWS_DEFAULT_REGION: region,
+      },
+      provenance: [prov(
+        ctx,
+        "aws-actions/configure-aws-credentials",
+        "Configure AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY as masked CI/CD variables, or use GitLab OIDC to AWS",
+        "needs-review",
+      )],
+    };
+  },
+};
+
+const googleAuthAction: ActionMapping = {
+  actionName: "google-github-actions/auth",
+  tier: 2,
+  translate(_step, ctx): ActionMappedResult {
+    return {
+      scriptLines: [
+        "echo $GCP_SA_KEY | base64 -d > /tmp/gcp-key.json",
+        "gcloud auth activate-service-account --key-file=/tmp/gcp-key.json",
+      ],
+      variables: { GOOGLE_APPLICATION_CREDENTIALS: "/tmp/gcp-key.json" },
+      provenance: [prov(
+        ctx,
+        "google-github-actions/auth",
+        "Set GCP_SA_KEY as masked CI/CD variable (base64-encoded), or use GitLab OIDC to GCP",
+        "needs-review",
+      )],
+    };
+  },
+};
+
+const azureLogin: ActionMapping = {
+  actionName: "azure/login",
+  tier: 2,
+  translate(_step, ctx): ActionMappedResult {
+    return {
+      scriptLines: ["az login --service-principal -u $AZURE_CLIENT_ID -p $AZURE_CLIENT_SECRET --tenant $AZURE_TENANT_ID"],
+      provenance: [prov(
+        ctx,
+        "azure/login",
+        "Set AZURE_CLIENT_ID/SECRET/TENANT_ID as masked CI/CD variables, or use GitLab OIDC to Azure",
+        "needs-review",
+      )],
+    };
+  },
+};
+
+const hashicorpSetupTerraform: ActionMapping = {
+  actionName: "hashicorp/setup-terraform",
+  tier: 2,
+  translate(step, ctx): ActionMappedResult {
+    const w = getWith(step);
+    const version = (w.terraform_version as string) ?? "1.6";
+    return {
+      scriptLines: [],
+      image: `hashicorp/terraform:${version}`,
+      provenance: [prov(ctx, "hashicorp/setup-terraform", `setup-terraform → image: hashicorp/terraform:${version} (or use GitLab Terraform template)`)],
+    };
+  },
+};
+
+const codecovAction: ActionMapping = {
+  actionName: "codecov/codecov-action",
+  tier: 2,
+  translate(step, ctx): ActionMappedResult {
+    const w = getWith(step);
+    const file = (w.files as string) ?? (w.file as string) ?? "coverage.xml";
+    return {
+      scriptLines: [
+        "pip install codecov-cli",
+        `codecovcli upload-process --file ${file} --token $CODECOV_TOKEN`,
+      ],
+      provenance: [prov(ctx, "codecov/codecov-action", "codecov-action → codecov-cli; set CODECOV_TOKEN as masked variable")],
+    };
+  },
+};
+
+const softpropsGhRelease: ActionMapping = {
+  actionName: "softprops/action-gh-release",
+  tier: 2,
+  translate(_step, ctx): ActionMappedResult {
+    return {
+      scriptLines: ["glab release create $CI_COMMIT_TAG"],
+      provenance: [prov(
+        ctx,
+        "softprops/action-gh-release",
+        "softprops/action-gh-release → glab release create (for GitLab) or curl GitHub API",
+        "needs-review",
+      )],
+    };
+  },
+};
+
+const peterEvansCreatePr: ActionMapping = {
+  actionName: "peter-evans/create-pull-request",
+  tier: 2,
+  translate(step, ctx): ActionMappedResult {
+    const w = getWith(step);
+    const title = (w.title as string) ?? "Automated update";
+    return {
+      scriptLines: [
+        "git config user.email \"ci@example.com\"",
+        "git config user.name \"CI Bot\"",
+        "git add .",
+        `git commit -m "${title}"`,
+        `glab mr create --title "${title}"`,
+      ],
+      provenance: [prov(
+        ctx,
+        "peter-evans/create-pull-request",
+        "create-pull-request → glab mr create",
+        "needs-review",
+      )],
+    };
+  },
+};
+
+const jamesIvesPagesDeploy: ActionMapping = {
+  actionName: "JamesIves/github-pages-deploy-action",
+  tier: 2,
+  translate(step, ctx): ActionMappedResult {
+    const w = getWith(step);
+    const folder = (w.folder as string) ?? "build";
+    return {
+      scriptLines: [
+        "mkdir -p public",
+        `cp -r ${folder}/* public/`,
+      ],
+      artifacts: { paths: ["public"] },
+      provenance: [prov(
+        ctx,
+        "JamesIves/github-pages-deploy-action",
+        "pages-deploy → GitLab Pages requires job name 'pages' and artifacts in public/. May need a separate `pages:` job.",
+        "needs-review",
+      )],
+    };
+  },
+};
+
+const pnpmActionSetup: ActionMapping = {
+  actionName: "pnpm/action-setup",
+  tier: 2,
+  translate(step, ctx): ActionMappedResult {
+    const w = getWith(step);
+    const version = (w.version as string) ?? "9";
+    return {
+      scriptLines: [`npm install -g pnpm@${version}`],
+      cache: { paths: [".pnpm-store/"] },
+      provenance: [prov(ctx, "pnpm/action-setup", `pnpm/action-setup → npm install -g pnpm@${version}`)],
+    };
+  },
+};
+
+const ovenSetupBun: ActionMapping = {
+  actionName: "oven-sh/setup-bun",
+  tier: 2,
+  translate(step, ctx): ActionMappedResult {
+    const w = getWith(step);
+    const version = (w["bun-version"] as string) ?? "latest";
+    return {
+      scriptLines: [],
+      image: `oven/bun:${version}`,
+      cache: { paths: [".bun/install/cache/"] },
+      provenance: [prov(ctx, "oven-sh/setup-bun", `setup-bun → image: oven/bun:${version}`)],
+    };
+  },
+};
+
+const gradleBuildAction: ActionMapping = {
+  actionName: "gradle/gradle-build-action",
+  tier: 2,
+  translate(step, ctx): ActionMappedResult {
+    const w = getWith(step);
+    const version = (w["gradle-version"] as string) ?? "8";
+    return {
+      scriptLines: [],
+      image: `gradle:${version}`,
+      cache: { paths: [".gradle/"] },
+      provenance: [prov(ctx, "gradle/gradle-build-action", `gradle-build-action → image: gradle:${version}`)],
+    };
+  },
+};
+
+const cypressAction: ActionMapping = {
+  actionName: "cypress-io/github-action",
+  tier: 2,
+  translate(step, ctx): ActionMappedResult {
+    const w = getWith(step);
+    const browser = (w.browser as string) ?? "chrome";
+    const start = w.start as string | undefined;
+    const lines: string[] = ["npm install"];
+    if (start) lines.push(`${start} &`);
+    lines.push(`npx cypress run --browser ${browser}`);
+    return {
+      scriptLines: lines,
+      image: "cypress/browsers:latest",
+      provenance: [prov(ctx, "cypress-io/github-action", `cypress-io → cypress/browsers image + npx cypress run`)],
+    };
+  },
+};
+
+const TIER_2_MAPPINGS: ActionMapping[] = [
+  actionsSetupDotnet,
+  shivammathurSetupPhp,
+  awsConfigureCredentials,
+  googleAuthAction,
+  azureLogin,
+  hashicorpSetupTerraform,
+  codecovAction,
+  softpropsGhRelease,
+  peterEvansCreatePr,
+  jamesIvesPagesDeploy,
+  pnpmActionSetup,
+  ovenSetupBun,
+  gradleBuildAction,
+  cypressAction,
+];
+
+export function registerTier2(registry = getDefaultRegistry()): void {
+  for (const m of TIER_2_MAPPINGS) {
+    registry.register(m);
+  }
+}
+
+export { TIER_2_MAPPINGS };

package/src/migrate/from-github/actions/tier-3.ts

@@ -0,0 +1,124 @@
+/**
+ * Tier 3 marketplace action mappings — 5 niche actions. Several map to
+ * native GitLab keywords (rules:changes, retry:) rather than scripts.
+ */
+
+import type { ActionMapping, ActionMappedResult, ActionMapCtx } from "./registry";
+import { getDefaultRegistry } from "./registry";
+
+const prov = (
+  ctx: ActionMapCtx,
+  actionName: string,
+  note: string,
+  category: "literal" | "needs-review" | "skipped" | "action-map" = "action-map",
+) => ({
+  gitlabPath: `jobs.${ctx.logicalId}.script`,
+  gitlabLogicalId: ctx.logicalId,
+  sourceKey: `jobs.${ctx.jobName}.steps[${ctx.stepIndex}].uses`,
+  sourceFile: ctx.sourceFile,
+  category,
+  rule: `ACT-${actionName.replace(/[\/-]/g, "-")}`,
+  note,
+  actionRef: actionName,
+  mappingTier: 3 as const,
+});
+
+const getWith = (s: Record<string, unknown>): Record<string, unknown> =>
+  (s.with as Record<string, unknown>) ?? {};
+
+const tjActionsChangedFiles: ActionMapping = {
+  actionName: "tj-actions/changed-files",
+  tier: 3,
+  translate(step, ctx): ActionMappedResult {
+    const w = getWith(step);
+    const files = (w.files as string) ?? "";
+    return {
+      scriptLines: [
+        `git diff --name-only $CI_COMMIT_BEFORE_SHA $CI_COMMIT_SHA${files ? ` | grep -E '${files.replace(/\n/g, "|")}' || true` : ""}`,
+      ],
+      provenance: [prov(ctx, "tj-actions/changed-files", "tj-actions/changed-files → git diff inline; for path-based job gating prefer rules:changes:")],
+    };
+  },
+};
+
+// dorny/paths-filter: native rules:changes:
+const dornyPathsFilter: ActionMapping = {
+  actionName: "dorny/paths-filter",
+  tier: 3,
+  translate(_step, ctx): ActionMappedResult {
+    return {
+      scriptLines: [
+        "# dorny/paths-filter has no script equivalent in GitLab.",
+        "# Use rules:changes: on each job to gate on file path changes.",
+        "# Example: rules: [{ changes: ['src/backend/**'] }]",
+      ],
+      provenance: [prov(
+        ctx,
+        "dorny/paths-filter",
+        "dorny/paths-filter → native rules:changes:; emit rule on each gated job",
+        "needs-review",
+      )],
+    };
+  },
+};
+
+// nick-invision/retry / nick-fields/retry: native retry:
+const nickFieldsRetry: ActionMapping = {
+  actionName: "nick-fields/retry",
+  tier: 3,
+  translate(step, ctx): ActionMappedResult {
+    const w = getWith(step);
+    const command = (w.command as string) ?? "";
+    return {
+      scriptLines: command ? [command] : [],
+      provenance: [prov(
+        ctx,
+        "nick-fields/retry",
+        "nick-fields/retry → native retry: { max, when } at job level; configure manually",
+        "needs-review",
+      )],
+    };
+  },
+};
+
+const preCommitAction: ActionMapping = {
+  actionName: "pre-commit/action",
+  tier: 3,
+  translate(_step, ctx): ActionMappedResult {
+    return {
+      scriptLines: ["pip install pre-commit", "pre-commit run --all-files"],
+      provenance: [prov(ctx, "pre-commit/action", "pre-commit/action → pip install pre-commit + pre-commit run")],
+    };
+  },
+};
+
+const slackapiGithubAction: ActionMapping = {
+  actionName: "slackapi/slack-github-action",
+  tier: 3,
+  translate(step, ctx): ActionMappedResult {
+    const w = getWith(step);
+    const payload = (w.payload as string) ?? '{"text":"Build completed"}';
+    return {
+      scriptLines: [
+        `curl -X POST -H 'Content-type: application/json' --data '${payload.replace(/'/g, "'\\''")}' $SLACK_WEBHOOK_URL`,
+      ],
+      provenance: [prov(ctx, "slackapi/slack-github-action", "slack-github-action → curl to $SLACK_WEBHOOK_URL")],
+    };
+  },
+};
+
+const TIER_3_MAPPINGS: ActionMapping[] = [
+  tjActionsChangedFiles,
+  dornyPathsFilter,
+  nickFieldsRetry,
+  preCommitAction,
+  slackapiGithubAction,
+];
+
+export function registerTier3(registry = getDefaultRegistry()): void {
+  for (const m of TIER_3_MAPPINGS) {
+    registry.register(m);
+  }
+}
+
+export { TIER_3_MAPPINGS };

package/src/migrate/from-github/composites/patterns.ts

@@ -0,0 +1,167 @@
+/**
+ * Pattern recognisers for `chant migrate --use-composites`.
+ *
+ * Each pattern walks the GitLab IR looking for a recognisable shape
+ * (e.g. NodePipeline-shaped 2-job setup) and rewrites the matched
+ * resources into a sentinel IR type (`GitLab::Composite::NodePipeline`)
+ * that the GitLab generator (`lexicons/gitlab/src/import/generator.ts`)
+ * will emit as `NodePipeline({...})` instead of raw `new Job(...)`.
+ */
+
+import type { TemplateIR, ResourceIR } from "@intentius/chant/import/parser";
+import type { ProvenanceRecord } from "../provenance";
+
+export interface CompositePattern {
+  name: string;
+  match(ir: TemplateIR): MatchResult | null;
+  rewrite(ir: TemplateIR, match: MatchResult): { ir: TemplateIR; provenance: ProvenanceRecord[] };
+}
+
+export interface MatchResult {
+  /** Resource logicalIds to remove */
+  removed: string[];
+  /** New composite resource to add */
+  added: ResourceIR;
+}
+
+function getProp<T>(r: ResourceIR, k: string): T | undefined {
+  return r.properties[k] as T | undefined;
+}
+
+function looksLikeNodeImage(image: unknown): boolean {
+  return typeof image === "string" && /^node:/i.test(image);
+}
+
+function detectPackageManager(script: string[]): "npm" | "yarn" | "pnpm" | "bun" {
+  const text = script.join("\n");
+  if (/\b(bun|bunx)\s+(install|test|run)/.test(text)) return "bun";
+  if (/\bpnpm\s+(install|run|test)/.test(text)) return "pnpm";
+  if (/\byarn\s+(install|run|test)/.test(text)) return "yarn";
+  return "npm";
+}
+
+function hasInstallStep(script: string[], pm: "npm" | "yarn" | "pnpm" | "bun"): boolean {
+  const installers: Record<string, RegExp> = {
+    npm: /\bnpm\s+(ci|install)\b/,
+    yarn: /\byarn\s+install\b/,
+    pnpm: /\bpnpm\s+install\b/,
+    bun: /\bbun\s+install\b/,
+  };
+  return script.some((line) => installers[pm].test(line));
+}
+
+function hasBuildStep(script: string[], pm: "npm" | "yarn" | "pnpm" | "bun"): boolean {
+  const re = pm === "npm" ? /\bnpm\s+run\s+build\b/ : new RegExp(`\\b${pm}\\s+(run\\s+)?build\\b`);
+  return script.some((line) => re.test(line));
+}
+
+function hasTestStep(script: string[], pm: "npm" | "yarn" | "pnpm" | "bun"): boolean {
+  const re = pm === "npm"
+    ? /\bnpm\s+(test|run\s+test)\b/
+    : new RegExp(`\\b${pm}\\s+(run\\s+)?test\\b`);
+  return script.some((line) => re.test(line));
+}
+
+const nodePipelinePattern: CompositePattern = {
+  name: "NodePipeline",
+  match(ir: TemplateIR): MatchResult | null {
+    const jobs = ir.resources.filter((r) => r.type === "GitLab::CI::Job");
+    if (jobs.length !== 2) return null;
+    // Find build job + test job
+    let buildJob: ResourceIR | undefined;
+    let testJob: ResourceIR | undefined;
+    for (const j of jobs) {
+      const script = (getProp<string[]>(j, "script") ?? []);
+      if (!looksLikeNodeImage(getProp(j, "image"))) return null;
+      const pm = detectPackageManager(script);
+      if (hasBuildStep(script, pm) && hasInstallStep(script, pm)) {
+        buildJob = j;
+      } else if (hasTestStep(script, pm) && hasInstallStep(script, pm)) {
+        testJob = j;
+      }
+    }
+    if (!buildJob || !testJob) return null;
+    if (buildJob.logicalId === testJob.logicalId) return null;
+
+    const buildScript = (getProp<string[]>(buildJob, "script") ?? []);
+    const pm = detectPackageManager(buildScript);
+    const image = getProp<string>(buildJob, "image") ?? "node:22";
+    const nodeVersion = image.replace(/^node:/, "") || "22";
+
+    return {
+      removed: [buildJob.logicalId, testJob.logicalId],
+      added: {
+        logicalId: "app",
+        type: "GitLab::Composite::NodePipeline",
+        properties: {
+          nodeVersion,
+          packageManager: pm,
+        },
+      },
+    };
+  },
+  rewrite(ir, match): { ir: TemplateIR; provenance: ProvenanceRecord[] } {
+    const keep = ir.resources.filter((r) => !match.removed.includes(r.logicalId));
+    return {
+      ir: { ...ir, resources: [...keep, match.added] },
+      provenance: [
+        {
+          gitlabPath: `jobs.${match.added.logicalId}`,
+          gitlabLogicalId: match.added.logicalId,
+          category: "synthesis",
+          rule: "MIG-COMPOSITE-NODEPIPELINE",
+          note: `Recognised NodePipeline shape (${match.removed.join(", ")}) → NodePipeline composite`,
+        },
+      ],
+    };
+  },
+};
+
+const nodeCiPattern: CompositePattern = {
+  name: "NodeCI",
+  match(ir: TemplateIR): MatchResult | null {
+    const jobs = ir.resources.filter((r) => r.type === "GitLab::CI::Job");
+    if (jobs.length !== 1) return null;
+    const j = jobs[0];
+    const script = (getProp<string[]>(j, "script") ?? []);
+    if (!looksLikeNodeImage(getProp(j, "image"))) return null;
+    const pm = detectPackageManager(script);
+    if (!hasInstallStep(script, pm)) return null;
+    if (!hasBuildStep(script, pm) && !hasTestStep(script, pm)) return null;
+    const image = getProp<string>(j, "image") ?? "node:22";
+    const nodeVersion = image.replace(/^node:/, "") || "22";
+
+    return {
+      removed: [j.logicalId],
+      added: {
+        logicalId: "app",
+        type: "GitLab::Composite::NodeCI",
+        properties: {
+          nodeVersion,
+          packageManager: pm,
+        },
+      },
+    };
+  },
+  rewrite(ir, match): { ir: TemplateIR; provenance: ProvenanceRecord[] } {
+    const keep = ir.resources.filter((r) => !match.removed.includes(r.logicalId));
+    return {
+      ir: { ...ir, resources: [...keep, match.added] },
+      provenance: [
+        {
+          gitlabPath: `jobs.${match.added.logicalId}`,
+          gitlabLogicalId: match.added.logicalId,
+          category: "synthesis",
+          rule: "MIG-COMPOSITE-NODECI",
+          note: `Recognised NodeCI shape (${match.removed.join(", ")}) → NodeCI composite`,
+        },
+      ],
+    };
+  },
+};
+
+export const PATTERNS: CompositePattern[] = [
+  // Match NodePipeline first (2 jobs); NodeCI second (single job)
+  nodePipelinePattern,
+  nodeCiPattern,
+];

package/src/migrate/from-github/composites/rewriter.test.ts

@@ -0,0 +1,98 @@
+import { describe, test, expect } from "vitest";
+import { applyComposites } from "./rewriter";
+import type { TemplateIR } from "@intentius/chant/import/parser";
+
+function nodeJob(id: string, opts: { image: string; script: string[]; stage?: string }): TemplateIR["resources"][0] {
+  return {
+    logicalId: id,
+    type: "GitLab::CI::Job",
+    properties: {
+      image: opts.image,
+      script: opts.script,
+      ...(opts.stage ? { stage: opts.stage } : {}),
+    },
+  };
+}
+
+describe("applyComposites — NodePipeline", () => {
+  test("matches 2-job build+test shape", () => {
+    const ir: TemplateIR = {
+      resources: [
+        nodeJob("build", { image: "node:22", script: ["npm ci", "npm run build"], stage: "build" }),
+        nodeJob("test", { image: "node:22", script: ["npm ci", "npm test"], stage: "test" }),
+      ],
+      parameters: [],
+    };
+    const r = applyComposites(ir);
+    const composites = r.ir.resources.filter((res) => res.type === "GitLab::Composite::NodePipeline");
+    expect(composites).toHaveLength(1);
+    expect(r.ir.resources.filter((res) => res.type === "GitLab::CI::Job")).toHaveLength(0);
+    expect(r.provenance[0].rule).toBe("MIG-COMPOSITE-NODEPIPELINE");
+  });
+
+  test("rejects non-node images", () => {
+    const ir: TemplateIR = {
+      resources: [
+        nodeJob("build", { image: "alpine:3", script: ["npm ci", "npm run build"] }),
+        nodeJob("test", { image: "node:22", script: ["npm ci", "npm test"] }),
+      ],
+      parameters: [],
+    };
+    const r = applyComposites(ir);
+    expect(r.ir.resources.filter((res) => res.type === "GitLab::CI::Job")).toHaveLength(2);
+  });
+
+  test("rejects jobs without install step", () => {
+    const ir: TemplateIR = {
+      resources: [
+        nodeJob("build", { image: "node:22", script: ["npm run build"] }),
+        nodeJob("test", { image: "node:22", script: ["npm test"] }),
+      ],
+      parameters: [],
+    };
+    const r = applyComposites(ir);
+    expect(r.ir.resources.filter((res) => res.type === "GitLab::CI::Job")).toHaveLength(2);
+  });
+
+  test("detects pnpm package manager", () => {
+    const ir: TemplateIR = {
+      resources: [
+        nodeJob("build", { image: "node:20", script: ["pnpm install", "pnpm build"] }),
+        nodeJob("test", { image: "node:20", script: ["pnpm install", "pnpm test"] }),
+      ],
+      parameters: [],
+    };
+    const r = applyComposites(ir);
+    const composite = r.ir.resources.find((res) => res.type === "GitLab::Composite::NodePipeline");
+    expect(composite?.properties.packageManager).toBe("pnpm");
+  });
+});
+
+describe("applyComposites — NodeCI", () => {
+  test("matches single-job node setup", () => {
+    const ir: TemplateIR = {
+      resources: [
+        nodeJob("ci", { image: "node:20", script: ["npm ci", "npm test"] }),
+      ],
+      parameters: [],
+    };
+    const r = applyComposites(ir);
+    const composites = r.ir.resources.filter((res) => res.type === "GitLab::Composite::NodeCI");
+    expect(composites).toHaveLength(1);
+    expect(r.provenance[0].rule).toBe("MIG-COMPOSITE-NODECI");
+  });
+
+  test("falls back to raw jobs when nothing matches", () => {
+    const ir: TemplateIR = {
+      resources: [
+        nodeJob("a", { image: "ubuntu:24.04", script: ["make"] }),
+        nodeJob("b", { image: "ubuntu:24.04", script: ["./deploy.sh"] }),
+        nodeJob("c", { image: "ubuntu:24.04", script: ["./teardown.sh"] }),
+      ],
+      parameters: [],
+    };
+    const r = applyComposites(ir);
+    expect(r.ir.resources).toHaveLength(3);
+    expect(r.provenance).toHaveLength(0);
+  });
+});