@intentius/chant-lexicon-gitlab 0.1.23 → 0.3.0

package/dist/rules/wgl041.ts

@@ -0,0 +1,57 @@
+/**
+ * WGL041: Logically Unsound rules:if Condition
+ *
+ * Flags a `rules:if` that reads like a gate but is a constant — both sides of an
+ * `==`/`!=` are identical, so the condition is always true or always false.
+ * Generalizes WGL011 (rules that always evaluate to never) to tautological
+ * conditions presented as gates.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { getPrimaryOutput, extractJobs, extractJobSection, extractJobRules } from "./yaml-helpers";
+
+function strip(s: string): string {
+  return s.trim().replace(/^['"]|['"]$/g, "").trim();
+}
+
+/** Classify an `if:` expression as a tautology, returning a reason or undefined. */
+export function tautologyReason(expr: string): string | undefined {
+  const e = strip(expr).replace(/^\$\{?/, "$").trim();
+  const eq = e.match(/^(\S.*?)\s*==\s*(\S.*?)$/);
+  if (eq && strip(eq[1]) === strip(eq[2])) return "always true (both sides of == are identical)";
+  const ne = e.match(/^(\S.*?)\s*!=\s*(\S.*?)$/);
+  if (ne && strip(ne[1]) === strip(ne[2])) return "always false (both sides of != are identical)";
+  return undefined;
+}
+
+export const wgl041: PostSynthCheck = {
+  id: "WGL041",
+  description: "Logically unsound (tautological) rules:if condition",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const [, output] of ctx.outputs) {
+      const yaml = getPrimaryOutput(output);
+      for (const [job] of extractJobs(yaml)) {
+        const section = extractJobSection(yaml, job);
+        if (!section) continue;
+        for (const rule of extractJobRules(section)) {
+          if (!rule.if) continue;
+          const reason = tautologyReason(rule.if);
+          if (reason) {
+            diagnostics.push({
+              checkId: "WGL041",
+              severity: "warning",
+              message: `Job "${job}" has a rules:if that is ${reason}: "${rule.if}". A gate that does not constrain anything is misleading — write the real condition or remove it.`,
+              entity: job,
+              lexicon: "gitlab",
+            });
+          }
+        }
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/dist/rules/wgl042.ts

@@ -0,0 +1,46 @@
+/**
+ * WGL042: Unreachable rules After an Unconditional Match
+ *
+ * GitLab evaluates `rules:` top-down and the first match wins. A rule with no
+ * `if:` (and not `when: never`) matches every pipeline, so any rule listed after
+ * it is dead — it can never be reached. Such dead rules usually mean the gate
+ * the author intended is not actually applied. Reorder so specific rules precede
+ * the catch-all.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { getPrimaryOutput, extractJobs, extractJobSection, extractJobRules } from "./yaml-helpers";
+
+export const wgl042: PostSynthCheck = {
+  id: "WGL042",
+  description: "Unreachable rules after an unconditional match",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const [, output] of ctx.outputs) {
+      const yaml = getPrimaryOutput(output);
+      for (const [job] of extractJobs(yaml)) {
+        const section = extractJobSection(yaml, job);
+        if (!section) continue;
+        const rules = extractJobRules(section);
+        for (let i = 0; i < rules.length - 1; i++) {
+          const r = rules[i];
+          const unconditional = !r.if && r.when !== "never";
+          if (unconditional) {
+            diagnostics.push({
+              checkId: "WGL042",
+              severity: "warning",
+              message: `Job "${job}" has an unconditional rule at position ${i + 1} that matches every pipeline, making the ${rules.length - i - 1} rule(s) after it unreachable. Put specific rules before the catch-all.`,
+              entity: job,
+              lexicon: "gitlab",
+            });
+            break;
+          }
+        }
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/dist/rules/wgl043.ts

@@ -0,0 +1,45 @@
+/**
+ * WGL043: Match-Anything Regex Gate
+ *
+ * Flags a `rules:if` whose regex match (`=~`) uses a pattern that matches every
+ * value — an empty regex, dot-star, or an anchored dot-star. The condition reads
+ * like a filter on a ref or variable but admits everything, so it gates nothing.
+ * This is how an unsound condition is obscured behind a regex. Tighten the
+ * pattern or remove the gate.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { getPrimaryOutput, extractJobs, extractJobSection, extractJobRules } from "./yaml-helpers";
+
+// `=~` followed by a regex literal that matches anything.
+const MATCH_ANYTHING = /=~\s*\/(?:|\.\*|\^\.\*\$|\^\.\*|\.\*\$)\//;
+
+export const wgl043: PostSynthCheck = {
+  id: "WGL043",
+  description: "Match-anything regex gate in rules:if",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const [, output] of ctx.outputs) {
+      const yaml = getPrimaryOutput(output);
+      for (const [job] of extractJobs(yaml)) {
+        const section = extractJobSection(yaml, job);
+        if (!section) continue;
+        for (const rule of extractJobRules(section)) {
+          if (rule.if && MATCH_ANYTHING.test(rule.if)) {
+            diagnostics.push({
+              checkId: "WGL043",
+              severity: "warning",
+              message: `Job "${job}" gates on a regex that matches everything ("${rule.if}") — the rule reads like a filter but admits every value. Tighten the pattern or remove the gate.`,
+              entity: job,
+              lexicon: "gitlab",
+            });
+          }
+        }
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/dist/rules/wgl044.ts

@@ -0,0 +1,41 @@
+/**
+ * WGL044: Public Artifacts
+ *
+ * Flags `artifacts:public: true`. Public artifacts are downloadable by anyone,
+ * including unauthenticated users for public projects, exposing build output and
+ * anything swept into it. Keep artifacts private unless they are deliberately
+ * meant to be world-readable.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { getPrimaryOutput, extractJobs, extractJobSection } from "./yaml-helpers";
+
+const PUBLIC_ARTIFACTS = /^\s+public:\s*true\s*$/m;
+
+export const wgl044: PostSynthCheck = {
+  id: "WGL044",
+  description: "Public artifacts expose build output",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const [, output] of ctx.outputs) {
+      const yaml = getPrimaryOutput(output);
+      for (const [job] of extractJobs(yaml)) {
+        const section = extractJobSection(yaml, job);
+        if (!section || !/^\s+artifacts:/m.test(section)) continue;
+        if (PUBLIC_ARTIFACTS.test(section)) {
+          diagnostics.push({
+            checkId: "WGL044",
+            severity: "warning",
+            message: `Job "${job}" publishes public artifacts (artifacts:public: true), downloadable by anyone. Keep them private unless they are meant to be world-readable.`,
+            entity: job,
+            lexicon: "gitlab",
+          });
+        }
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/dist/rules/wgl045.ts

@@ -0,0 +1,57 @@
+/**
+ * WGL045: Credential-Bearing Artifact Path
+ *
+ * Flags an `artifacts:paths:` entry that looks like it would sweep a credential
+ * or sensitive file into the artifact (`.env`, `*.pem`, `id_rsa`, `*.key`,
+ * `.npmrc`, `.netrc`, `credentials`). Artifacts flow to later stages and are
+ * downloadable, so a captured credential leaks across the boundary. Exclude the
+ * sensitive file from the artifact path.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { getPrimaryOutput, extractJobs, extractJobSection } from "./yaml-helpers";
+
+const CREDENTIAL_PATH = /(^|\/)(\.env(\.|$)|\.npmrc|\.netrc|id_rsa|.*\.pem|.*\.key|.*\.p12|credentials?(\.|$))/i;
+
+export const wgl045: PostSynthCheck = {
+  id: "WGL045",
+  description: "Artifact path that may capture a credential file",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const [, output] of ctx.outputs) {
+      const yaml = getPrimaryOutput(output);
+      for (const [job] of extractJobs(yaml)) {
+        const section = extractJobSection(yaml, job);
+        if (!section) continue;
+        // Collect the lines under the artifacts: block (deeper indent than the key).
+        const lines = section.split("\n");
+        const artifactsIdx = lines.findIndex((l) => /^\s+artifacts:\s*$/.test(l));
+        if (artifactsIdx === -1) continue;
+        const artifactsIndent = lines[artifactsIdx].search(/\S/);
+        const blockLines: string[] = [];
+        for (let i = artifactsIdx + 1; i < lines.length; i++) {
+          if (lines[i].trim() === "") continue;
+          if (lines[i].search(/\S/) <= artifactsIndent) break;
+          blockLines.push(lines[i]);
+        }
+        const hit = blockLines
+          .filter((l) => /^\s+-\s+/.test(l))
+          .map((l) => l.replace(/^\s+-\s+/, "").trim().replace(/^['"]|['"]$/g, ""))
+          .find((p) => CREDENTIAL_PATH.test(p));
+        if (hit) {
+          diagnostics.push({
+            checkId: "WGL045",
+            severity: "error",
+            message: `Job "${job}" includes a credential-like file ("${hit}") in its artifacts. Exclude it — artifacts are passed downstream and are downloadable.`,
+            entity: job,
+            lexicon: "gitlab",
+          });
+        }
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/dist/rules/wgl046.ts

@@ -0,0 +1,43 @@
+/**
+ * WGL046: Cache Populated in a Merge-Request Pipeline (Poisoning Risk)
+ *
+ * Flags a job that writes a cache (`cache:` with a push policy) and is reachable
+ * from merge-request pipelines. An outside contributor's MR can populate the
+ * cache; a later protected run that restores the same key then executes
+ * attacker-influenced contents. Restrict cache writes to protected refs, or
+ * scope cache keys so MR pipelines cannot write entries a protected run reads.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { getPrimaryOutput, extractJobs, extractJobSection, isMergeRequestReachable } from "./yaml-helpers";
+
+export const wgl046: PostSynthCheck = {
+  id: "WGL046",
+  description: "Cache populated in a merge-request pipeline (poisoning risk)",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const [, output] of ctx.outputs) {
+      const yaml = getPrimaryOutput(output);
+      for (const [job] of extractJobs(yaml)) {
+        const section = extractJobSection(yaml, job);
+        if (!section || !/^\s+cache:/m.test(section)) continue;
+        if (!isMergeRequestReachable(section)) continue;
+        // pull-only caches cannot poison; flag push/pull-push (the default when policy is absent)
+        const policyMatch = section.match(/^\s+policy:\s*(\S+)/m);
+        const policy = policyMatch ? policyMatch[1].replace(/^['"]|['"]$/g, "") : "pull-push";
+        if (policy === "pull") continue;
+        diagnostics.push({
+          checkId: "WGL046",
+          severity: "warning",
+          message: `Job "${job}" writes a cache and is reachable from merge-request pipelines. An MR can poison the cache for a later protected run that restores the same key — restrict cache writes to protected refs or scope the key.`,
+          entity: job,
+          lexicon: "gitlab",
+        });
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/dist/rules/wgl047.ts

@@ -0,0 +1,41 @@
+/**
+ * WGL047: Software Fetched and Executed at Runtime Without Verification
+ *
+ * Flags a `script:` command that pipes a network download straight into a shell
+ * (`curl ... | bash`, `wget ... | sh`). The fetched script is unpinned and
+ * unverified, so whoever controls the URL controls what runs in the job.
+ * Download to a file, verify a checksum/signature, then execute it.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { getPrimaryOutput, extractScriptCommands } from "./yaml-helpers";
+
+const PIPE_TO_SHELL = /\b(curl|wget)\b[^\n|]*\|\s*(sudo\s+)?(ba)?sh\b/i;
+
+export const wgl047: PostSynthCheck = {
+  id: "WGL047",
+  description: "Software fetched and piped to a shell without verification",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const [, output] of ctx.outputs) {
+      const yaml = getPrimaryOutput(output);
+      const seen = new Set<string>();
+      for (const { job, command } of extractScriptCommands(yaml)) {
+        if (PIPE_TO_SHELL.test(command) && !seen.has(job)) {
+          seen.add(job);
+          diagnostics.push({
+            checkId: "WGL047",
+            severity: "warning",
+            message: `Job "${job}" pipes a network download directly into a shell — the fetched code is unpinned and unverified. Download to a file, verify a checksum or signature, then execute it.`,
+            entity: job,
+            lexicon: "gitlab",
+          });
+        }
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/dist/rules/wgl048.ts

@@ -0,0 +1,37 @@
+/**
+ * WGL048: Pipeline Without a Name
+ *
+ * Flags a pipeline that defines a `workflow:` block but no `workflow:name:`.
+ * A pipeline name shows up in the GitLab UI and audit output; naming pipelines
+ * makes runs easier to identify and review. Only flags pipelines that already
+ * customize `workflow:` (where a name is cheap to add and most useful).
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { getPrimaryOutput } from "./yaml-helpers";
+
+export const wgl048: PostSynthCheck = {
+  id: "WGL048",
+  description: "Pipeline defines workflow: but no workflow:name",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const [, output] of ctx.outputs) {
+      const yaml = getPrimaryOutput(output);
+      const workflowSection = yaml.split("\n\n").find((s) => /^workflow:/.test(s));
+      if (!workflowSection) continue;
+      if (!/^\s+name:/m.test(workflowSection)) {
+        diagnostics.push({
+          checkId: "WGL048",
+          severity: "info",
+          message: `The pipeline defines a workflow: block but no workflow:name. Add a name so runs are identifiable in the GitLab UI and audit output.`,
+          entity: "workflow",
+          lexicon: "gitlab",
+        });
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/dist/rules/yaml-helpers.ts

@@ -223,3 +223,217 @@ export function extractJobRules(section: string): ParsedRule[] {
 
   return rules;
 }
+
+/** A container image reference (job/default `image:` or a `services:` entry). */
+export interface ImageRef {
+  /** Owning job name, or "default" for the global image. */
+  job: string;
+  /** The image reference (e.g. `node:20`). */
+  image: string;
+  /** Where the image was declared. */
+  source: "image" | "service";
+}
+
+/**
+ * Extract container image references from `image:` and `services:` across the
+ * pipeline. Handles both the object form (`image:\n  name: ...`) and the inline
+ * string form (`image: ...`).
+ */
+export function extractImageRefs(yaml: string): ImageRef[] {
+  const refs: ImageRef[] = [];
+  for (const section of yaml.split("\n\n")) {
+    const lines = section.split("\n");
+    const top = lines[0]?.match(/^(\.?[a-z][a-z0-9_.-]*):/i);
+    const job = top ? top[1] : "default";
+
+    for (let i = 0; i < lines.length; i++) {
+      // image: as object (next indented `name:`) or inline string
+      const imgInline = lines[i].match(/^\s+image:\s+(\S.*)$/);
+      if (imgInline) {
+        refs.push({ job, image: imgInline[1].trim().replace(/^['"]|['"]$/g, ""), source: "image" });
+        continue;
+      }
+      if (/^\s+image:\s*$/.test(lines[i])) {
+        const nameLine = lines.slice(i + 1, i + 4).find((l) => /^\s+name:\s+/.test(l));
+        if (nameLine) {
+          const v = nameLine.replace(/^\s+name:\s+/, "").trim().replace(/^['"]|['"]$/g, "");
+          refs.push({ job, image: v, source: "image" });
+        }
+        continue;
+      }
+      // services: list entries — `- name:` or `- 'image'`
+      const svcName = lines[i].match(/^\s+-\s+name:\s+(\S.*)$/);
+      if (svcName) {
+        refs.push({ job, image: svcName[1].trim().replace(/^['"]|['"]$/g, ""), source: "service" });
+      }
+    }
+  }
+  return refs;
+}
+
+/** An `include:` entry from the top-level include block. */
+export interface IncludeEntry {
+  kind: "project" | "remote" | "component" | "local" | "template" | "string";
+  /** The primary value (project path, URL, component address, …). */
+  value: string;
+  /** `ref:` for project includes, if present. */
+  ref?: string;
+}
+
+/**
+ * Parse the top-level `include:` block into structured entries.
+ */
+export function extractIncludes(yaml: string): IncludeEntry[] {
+  const entries: IncludeEntry[] = [];
+  const section = yaml.split("\n\n").find((s) => /^include:/.test(s));
+  if (!section) return entries;
+
+  // Inline string form: `include: <value>` (value on the same line, not a list)
+  const inline = section.match(/^include:[ \t]+(\S.*)$/m);
+  if (inline) {
+    entries.push({ kind: "string", value: inline[1].trim().replace(/^['"]|['"]$/g, "") });
+    return entries;
+  }
+
+  const lines = section.split("\n");
+  let current: IncludeEntry | undefined;
+  const push = () => { if (current) entries.push(current); current = undefined; };
+  for (const line of lines) {
+    const start = line.match(/^\s+-\s+(project|remote|component|local|template):\s*(.*)$/);
+    if (start) {
+      push();
+      current = { kind: start[1] as IncludeEntry["kind"], value: start[2].trim().replace(/^['"]|['"]$/g, "") };
+      continue;
+    }
+    const refLine = line.match(/^\s+ref:\s+(.+)$/);
+    if (refLine && current) {
+      current.ref = refLine[1].trim().replace(/^['"]|['"]$/g, "");
+    }
+    // A bare `- 'https://...'` short remote form
+    const bare = line.match(/^\s+-\s+(['"]?https?:\/\/\S+['"]?)\s*$/);
+    if (bare) {
+      push();
+      entries.push({ kind: "remote", value: bare[1].replace(/^['"]|['"]$/g, "") });
+    }
+  }
+  push();
+  return entries;
+}
+
+/** True if a git ref is an immutable pin (40-hex SHA or a vN.N.N-style tag). */
+export function isPinnedRef(ref: string): boolean {
+  if (/^[0-9a-f]{40}$/.test(ref)) return true;
+  // Semver-ish tag with all components fixed (v1.2.3 / 1.2.3)
+  if (/^v?\d+\.\d+\.\d+$/.test(ref)) return true;
+  return false;
+}
+
+/** An `id_tokens:` OIDC token declaration within a job. */
+export interface IdTokenDecl {
+  job: string;
+  /** Token variable name (e.g. `GCP_ID_TOKEN`). */
+  name: string;
+  /** Declared audiences (`aud:`), empty if none. */
+  aud: string[];
+}
+
+/**
+ * Extract `id_tokens:` declarations (OIDC) per job, with their audiences.
+ */
+export function extractIdTokens(yaml: string): IdTokenDecl[] {
+  const out: IdTokenDecl[] = [];
+  for (const section of yaml.split("\n\n")) {
+    const lines = section.split("\n");
+    const top = lines[0]?.match(/^(\.?[a-z][a-z0-9_.-]*):/i);
+    if (!top) continue;
+    const job = top[1];
+
+    let inIdTokens = false;
+    let idTokensIndent = -1;
+    let current: IdTokenDecl | undefined;
+    const flush = () => { if (current) out.push(current); current = undefined; };
+
+    for (const line of lines) {
+      if (/^\s+id_tokens:\s*$/.test(line)) {
+        inIdTokens = true;
+        idTokensIndent = line.search(/\S/);
+        continue;
+      }
+      if (!inIdTokens) continue;
+      const indent = line.search(/\S/);
+      if (line.trim() !== "" && indent <= idTokensIndent) { flush(); inIdTokens = false; continue; }
+
+      const tokenName = line.match(/^\s+([A-Z_][A-Z0-9_]*):\s*$/);
+      if (tokenName && indent === idTokensIndent + 2) {
+        flush();
+        current = { job, name: tokenName[1], aud: [] };
+        continue;
+      }
+      const audInline = line.match(/^\s+aud:\s+(\S.*)$/);
+      if (audInline && current) {
+        const v = audInline[1].trim();
+        if (v.startsWith("[")) {
+          for (const p of v.replace(/^\[|\]$/g, "").split(",")) {
+            const t = p.trim().replace(/^['"]|['"]$/g, "");
+            if (t) current.aud.push(t);
+          }
+        } else {
+          current.aud.push(v.replace(/^['"]|['"]$/g, ""));
+        }
+        continue;
+      }
+      const audItem = line.match(/^\s+-\s+(\S.*)$/);
+      if (audItem && current) {
+        current.aud.push(audItem[1].trim().replace(/^['"]|['"]$/g, ""));
+      }
+    }
+    flush();
+  }
+  return out;
+}
+
+/** True if a job section's rules make it reachable from merge-request pipelines. */
+export function isMergeRequestReachable(section: string): boolean {
+  return /merge_request_event|CI_MERGE_REQUEST|CI_PIPELINE_SOURCE\s*==\s*['"]?merge_request/.test(section);
+}
+
+/** A shell command line from a `script:` / `before_script:` / `after_script:`. */
+export interface ScriptCommand {
+  job: string;
+  command: string;
+}
+
+/**
+ * Extract shell command lines from all `script:` family blocks, per job.
+ */
+export function extractScriptCommands(yaml: string): ScriptCommand[] {
+  const out: ScriptCommand[] = [];
+  for (const section of yaml.split("\n\n")) {
+    const lines = section.split("\n");
+    const top = lines[0]?.match(/^(\.?[a-z][a-z0-9_.-]*):/i);
+    if (!top) continue;
+    const job = top[1];
+
+    let inScript = false;
+    let scriptIndent = -1;
+    for (const line of lines) {
+      if (/^\s+(before_script|after_script|script):\s*$/.test(line)) {
+        inScript = true;
+        scriptIndent = line.search(/\S/);
+        continue;
+      }
+      // inline form `script: cmd`
+      const inlineScript = line.match(/^\s+(?:before_script|after_script|script):\s+(\S.*)$/);
+      if (inlineScript) {
+        out.push({ job, command: inlineScript[1].trim().replace(/^['"]|['"]$/g, "") });
+        continue;
+      }
+      if (!inScript) continue;
+      const indent = line.search(/\S/);
+      if (line.trim() !== "" && indent <= scriptIndent) { inScript = false; continue; }
+      const item = line.match(/^\s+-\s+(.*)$/);
+      if (item) out.push({ job, command: item[1].trim().replace(/^['"]|['"]$/g, "") });
+    }
+  }
+  return out;
+}

package/dist/skills/chant-gitlab-migrate.md

@@ -79,6 +79,16 @@ npx chant migrate path/to/workflow.yml --output .gitlab-ci.yml --validate
 
 The CLI picks `glci` (offline, no auth) first; `glab ci lint` second. If neither is on PATH, `--validate` warns and skips. Pair with `--strict` to make validation failures hard.
 
+`--validate` also runs the **security backend** (#306): it classifies the fate of each security property across the migration edge and runs the GitLab security post-synth checks (WGL029+) against the emitted YAML — *migrate, then prove the output clears the GitLab security bar*. The report gains a **Security posture** section plus `MIG-*` security diagnostics:
+
+- `MIG-PIN-LOST` — a GitHub SHA pin can't follow the action to its GitLab include/image; re-pin on GitLab (→ #297 / WGL029, WGL031).
+- `MIG-SECRET-UNSCOPED` — a migrated `$VAR` assumes a masked + protected GitLab variable, set outside the YAML (→ #300 / WGL038).
+- `MIG-INJECTION-CARRIED` — an untrusted-input injection site translated verbatim; the weakness carries across (→ #299 / WGL035).
+- `MIG-TRUST-BOUNDARY` — `pull_request_target` → merge-request pipelines that fork contributors can trigger; re-establish protected-ref/approval gating (→ #299 / WGL034, WGL036).
+- `MIG-PERMISSIONS-001` (least-privilege) — no per-job GitLab YAML equivalent; lives in project token settings + `id_tokens` scoping (→ #298 / WGL033).
+
+Fates mirror the functional provenance model: **translated** (weakness carried as-is), **approximated**, **needs-review** (re-establish on GitLab), **lost** (no GitLab equivalent for the property). Use these to tell the user not just *did it migrate* but *did the security posture survive*.
+
 ## Step 5: Decide the emit mode
 
 Two modes serve different intents:

package/dist/skills/chant-gitlab-patterns.md

@@ -197,6 +197,21 @@ export const app = NodePipeline({
 });
 ```
 
+### Publish the plan to the merge request
+
+`MrPlanReport` turns `chant lifecycle plan` into the MR plan widget (the `terraform` artifact type above). It runs the plan with `--report gitlab-mr`, writes the `{create,update,delete}` counts to `tfplan.json`, and declares it as `artifacts:reports:terraform`:
+
+```typescript
+import { MrPlanReport } from "@intentius/chant-lexicon-gitlab";
+
+export const plan = MrPlanReport({
+  environment: "prod",
+  before: ["aws sts get-caller-identity"], // credential setup — the plan reads live state
+});
+```
+
+The widget label always reads "Terraform" (GitLab's fixed string). Counts only — `adopt`/`noop` are excluded; run the plan in the job log for the per-resource breakdown.
+
 ## Rules and Conditional Execution
 
 ### Branch-Based Rules

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-gitlab",
-  "version": "0.1.23",
+  "version": "0.3.0",
   "description": "GitLab CI lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",