@intentius/chant-lexicon-gitlab 0.101.0 → 0.102.0

package/src/lint/post-synth/wgl017.ts

@@ -6,23 +6,15 @@
  */
 
 import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
-import { getPrimaryOutput, extractJobs } from "./yaml-helpers";
+import { getPrimaryOutput, topLevelSections } from "./yaml-helpers";
 
 const INSECURE_REGISTRY_PATTERN = /docker\s+(push|pull|tag|login)\s+.*http:\/\/[^\s]+/;
 
 export function checkInsecureRegistry(yaml: string): PostSynthDiagnostic[] {
   const diagnostics: PostSynthDiagnostic[] = [];
 
-  const sections = yaml.split("\n\n");
-  for (const section of sections) {
-    const lines = section.split("\n");
-    if (lines.length === 0) continue;
-
-    const topMatch = lines[0].match(/^(\.?[a-z][a-z0-9_.-]*):/);
-    if (!topMatch) continue;
-    const jobName = topMatch[1];
-
-    for (const line of lines) {
+  for (const { key: jobName, text } of topLevelSections(yaml)) {
+    for (const line of text.split("\n")) {
       if (INSECURE_REGISTRY_PATTERN.test(line)) {
         diagnostics.push({
           checkId: "WGL017",

package/src/lint/post-synth/wgl020.test.ts

@@ -52,3 +52,29 @@ variables:
     expect(diags).toHaveLength(0);
   });
 });
+
+describe("WGL020: keys the old line parser skipped (#3256)", () => {
+  test("flags a duplicated job id that starts with a capital", () => {
+    const yaml = `Build_Docs:
+  script: a
+
+Build_Docs:
+  script: b
+`;
+    const diags = checkDuplicateJobNames(yaml);
+    expect(diags).toHaveLength(1);
+    expect(diags[0].entity).toBe("Build_Docs");
+  });
+
+  test("treats a quoted and a plain key as the same job, and skips global keywords", () => {
+    const yaml = `image: node:20
+build:
+  script: a
+"build":
+  script: b
+image: node:22
+`;
+    const diags = checkDuplicateJobNames(yaml);
+    expect(diags.map((d) => d.entity)).toEqual(["build"]);
+  });
+});

package/src/lint/post-synth/wgl020.ts

@@ -7,7 +7,7 @@
  */
 
 import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
-import { getPrimaryOutput, extractJobs } from "./yaml-helpers";
+import { getPrimaryOutput, topLevelKey, RESERVED_TOP_LEVEL_KEYS } from "./yaml-helpers";
 
 export function checkDuplicateJobNames(yaml: string): PostSynthDiagnostic[] {
   const diagnostics: PostSynthDiagnostic[] = [];
@@ -18,10 +18,9 @@ export function checkDuplicateJobNames(yaml: string): PostSynthDiagnostic[] {
   const lines = yaml.split("\n");
 
   for (const line of lines) {
-    const topMatch = line.match(/^(\.?[a-z][a-z0-9_.-]*):/);
-    if (topMatch) {
-      const name = topMatch[1];
-      if (["stages", "default", "workflow", "variables", "include"].includes(name)) continue;
+    const name = topLevelKey(line);
+    if (name !== undefined) {
+      if (RESERVED_TOP_LEVEL_KEYS.has(name)) continue;
       keyCounts.set(name, (keyCounts.get(name) ?? 0) + 1);
     }
   }

package/src/lint/post-synth/wgl021.test.ts

@@ -60,3 +60,32 @@ deploy-job:
     expect(diags).toHaveLength(0);
   });
 });
+
+describe("WGL021: expanded variables (#3256)", () => {
+  test("reads the value:/description: form by variable name", () => {
+    const yaml = `variables:
+  DEPLOY_ENV:
+    value: staging
+    description: Target environment
+
+deploy:
+  script:
+    - ./deploy.sh $DEPLOY_ENV
+`;
+    expect(checkUnusedVariables(yaml)).toHaveLength(0);
+  });
+
+  test("reports an unused expanded variable by its name", () => {
+    const yaml = `variables:
+  UNUSED_ENV:
+    value: staging
+    description: Never read
+
+deploy:
+  script:
+    - ./deploy.sh
+`;
+    const diags = checkUnusedVariables(yaml);
+    expect(diags.map((d) => d.entity)).toEqual(["UNUSED_ENV"]);
+  });
+});

package/src/lint/post-synth/wgl021.ts

@@ -6,7 +6,7 @@
  */
 
 import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
-import { getPrimaryOutput, extractGlobalVariables } from "./yaml-helpers";
+import { getPrimaryOutput, extractGlobalVariables, topLevelSections } from "./yaml-helpers";
 
 export function checkUnusedVariables(yaml: string): PostSynthDiagnostic[] {
   const diagnostics: PostSynthDiagnostic[] = [];
@@ -20,14 +20,13 @@ export function checkUnusedVariables(yaml: string): PostSynthDiagnostic[] {
     // Check if $VARNAME or ${VARNAME} appears anywhere in the YAML (outside the variables block)
     const refPattern = new RegExp(`\\$\\{?${varName}\\}?`);
     // Also check for uses in extends, needs, etc. — search all sections
-    const sections = yaml.split("\n\n");
     let found = false;
 
-    for (const section of sections) {
+    for (const { key, text } of topLevelSections(yaml)) {
       // Skip the global variables section itself
-      if (section.trimStart().startsWith("variables:")) continue;
+      if (key === "variables") continue;
 
-      if (refPattern.test(section)) {
+      if (refPattern.test(text)) {
         found = true;
         break;
       }

package/src/lint/post-synth/wgl028.test.ts

@@ -93,3 +93,30 @@ test-app:
     expect(diags).toHaveLength(0);
   });
 });
+
+describe("WGL028: needs the old line parser dropped (#3256)", () => {
+  test("reads a need listed after an artifacts: line", () => {
+    const yaml = `stages:
+  - build
+  - deploy
+
+lint:
+  stage: build
+  script: make lint
+
+build:
+  stage: build
+  script: make
+
+deploy:
+  stage: deploy
+  needs:
+    - job: lint
+      artifacts: false
+    - job: build
+  script: ./deploy.sh
+`;
+    const diags = checkRedundantNeeds(yaml);
+    expect(diags.map((d) => d.message.match(/lists "([^"]+)"/)?.[1])).toEqual(["lint", "build"]);
+  });
+});

package/src/lint/post-synth/wgl042.test.ts

@@ -43,3 +43,17 @@ describe("WGL042: unreachable rules after unconditional match", () => {
     expect(diags).toHaveLength(0);
   });
 });
+
+describe("WGL042: job ids the old line parser skipped (#3256)", () => {
+  test("checks a job whose id starts with a capital", () => {
+    const yaml = `Build_Docs:
+  rules:
+    - when: always
+    - if: $CI_COMMIT_BRANCH == "main"
+  script: make docs
+`;
+    const diags = wgl042.check(makeCtx(yaml));
+    expect(diags).toHaveLength(1);
+    expect(diags[0].entity).toBe("Build_Docs");
+  });
+});

package/src/lint/post-synth/wgl048.test.ts

@@ -54,3 +54,17 @@ build:
     expect(diags).toHaveLength(0);
   });
 });
+
+describe("WGL048: section boundaries (#3256)", () => {
+  test("a name: in the next job is not read as workflow:name", () => {
+    const yaml = `workflow:
+  rules:
+    - when: always
+build:
+  image:
+    name: node:20
+  script: make
+`;
+    expect(wgl048.check(makeCtx(yaml))).toHaveLength(1);
+  });
+});

package/src/lint/post-synth/wgl048.ts

@@ -8,7 +8,7 @@
  */
 
 import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
-import { getPrimaryOutput } from "./yaml-helpers";
+import { getPrimaryOutput, topLevelSections } from "./yaml-helpers";
 
 export const wgl048: PostSynthCheck = {
   id: "WGL048",
@@ -19,7 +19,7 @@ export const wgl048: PostSynthCheck = {
 
     for (const [, output] of ctx.outputs) {
       const yaml = getPrimaryOutput(output);
-      const workflowSection = yaml.split("\n\n").find((s) => /^workflow:/.test(s));
+      const workflowSection = topLevelSections(yaml).find((s) => s.key === "workflow")?.text;
       if (!workflowSection) continue;
       if (!/^\s+name:/m.test(workflowSection)) {
         diagnostics.push({

package/src/lint/post-synth/wgl049.test.ts

@@ -69,3 +69,28 @@ build:
     expect(wgl049.check(makeCtx(yaml))).toHaveLength(0);
   });
 });
+
+describe("WGL049: job ids and section boundaries (#3256)", () => {
+  test("flags a job whose id starts with a capital", () => {
+    const yaml = `Build_App:
+  script:
+    - npm ci
+`;
+    const diags = wgl049.check(makeCtx(yaml));
+    expect(diags).toHaveLength(1);
+    expect(diags[0].entity).toBe("Build_App");
+  });
+
+  test("a cache: in the next job is not read as this job's cache", () => {
+    const yaml = `build:
+  script:
+    - npm ci
+other:
+  cache:
+    paths: [node_modules/]
+  script: echo
+`;
+    const diags = wgl049.check(makeCtx(yaml));
+    expect(diags.map((d) => d.entity)).toEqual(["build"]);
+  });
+});

package/src/lint/post-synth/wgl049.ts

@@ -11,14 +11,14 @@
  */
 
 import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
-import { getPrimaryOutput, extractJobs, extractJobSection } from "./yaml-helpers";
+import { getPrimaryOutput, extractJobs, extractJobSection, topLevelSections } from "./yaml-helpers";
 
 const DEP_INSTALL_RE = /\b(npm (install|ci)|yarn install|pnpm install|pip install|pip3 install|bundle install|composer install|go mod download|mvn (install|dependency:resolve))\b/i;
 
 function hasPipelineWideCache(yaml: string): boolean {
-  const sections = yaml.split("\n\n");
-  if (sections.some((s) => /^cache:/.test(s))) return true;
-  const defaultSection = sections.find((s) => /^default:/.test(s));
+  const sections = topLevelSections(yaml);
+  if (sections.some((s) => s.key === "cache")) return true;
+  const defaultSection = sections.find((s) => s.key === "default")?.text;
   return !!defaultSection && /\n\s+cache:/.test(defaultSection);
 }
 

package/src/lint/post-synth/wgl050.test.ts

@@ -55,3 +55,19 @@ describe("WGL050: merge-request job missing interruptible", () => {
     expect(wgl050.check(makeCtx(yaml))).toHaveLength(0);
   });
 });
+
+describe("WGL050: job ids and section boundaries (#3256)", () => {
+  test("flags a job whose id has a colon, with no blank line before it", () => {
+    const yaml = `build:
+  interruptible: true
+  script: make
+test:unit:
+  rules:
+    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
+  script:
+    - npm test
+`;
+    const diags = wgl050.check(makeCtx(yaml));
+    expect(diags.map((d) => d.entity)).toEqual(["test:unit"]);
+  });
+});

package/src/lint/post-synth/wgl050.ts

@@ -10,9 +10,7 @@
  */
 
 import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
-import { getPrimaryOutput, isMergeRequestReachable } from "./yaml-helpers";
-
-const RESERVED_TOP_LEVEL_KEYS = new Set(["stages", "default", "workflow", "variables", "include", "cache"]);
+import { getPrimaryOutput, isMergeRequestReachable, extractJobs, extractJobSection } from "./yaml-helpers";
 
 export const wgl050: PostSynthCheck = {
   id: "WGL050",
@@ -24,11 +22,10 @@ export const wgl050: PostSynthCheck = {
     for (const [, output] of ctx.outputs) {
       const yaml = getPrimaryOutput(output);
 
-      for (const section of yaml.split("\n\n")) {
-        const top = section.split("\n")[0]?.match(/^(\.?[a-z][a-z0-9_.-]*):/i);
-        if (!top) continue;
-        const jobName = top[1];
-        if (jobName.startsWith(".") || RESERVED_TOP_LEVEL_KEYS.has(jobName)) continue;
+      for (const [jobName] of extractJobs(yaml)) {
+        if (jobName.startsWith(".")) continue;
+        const section = extractJobSection(yaml, jobName);
+        if (!section) continue;
         if (/deploy/i.test(jobName)) continue; // cancelling mid-deploy is a hazard, not a win
 
         if (!isMergeRequestReachable(section)) continue;

package/src/lint/post-synth/yaml-helpers.test.ts

@@ -0,0 +1,249 @@
+import { describe, test, expect } from "vitest";
+import {
+  extractJobs,
+  extractStages,
+  extractGlobalVariables,
+  extractJobSection,
+  extractScriptCommands,
+  topLevelSections,
+  topLevelKey,
+} from "./yaml-helpers";
+
+// The reproduction from #3256.
+const ISSUE_3256 = `stages:
+  - build
+  - deploy
+
+build:
+  stage: build
+  script:
+    - make
+
+Build_Docs:
+  stage: build
+  script:
+    - make docs
+
+deploy:
+  stage: deploy
+  needs:
+    - job: build
+      artifacts: true
+    - job: Build_Docs
+  script:
+    - ./deploy.sh
+`;
+
+describe("extractJobs", () => {
+  test("reads a job id that starts with a capital and needs after an artifacts: line (#3256)", () => {
+    const jobs = extractJobs(ISSUE_3256);
+    expect([...jobs.keys()]).toEqual(["build", "Build_Docs", "deploy"]);
+    expect(jobs.get("Build_Docs")?.stage).toBe("build");
+    expect(jobs.get("deploy")?.needs).toEqual(["build", "Build_Docs"]);
+  });
+
+  test("skips global keywords, including the deprecated global forms", () => {
+    const yaml = `stages: [build]
+variables:
+  FOO: bar
+default:
+  image: node:20
+include:
+  - local: ci/other.yml
+workflow:
+  name: main
+image: node:20
+services:
+  - docker:dind
+cache:
+  paths: [node_modules]
+before_script:
+  - echo hi
+after_script:
+  - echo bye
+build:
+  stage: build
+  script: make
+`;
+    expect([...extractJobs(yaml).keys()]).toEqual(["build"]);
+  });
+
+  test("keeps hidden jobs and reads extends: as a string or a list", () => {
+    const yaml = `.base:
+  image: node:20
+
+.lint-base:
+  stage: test
+
+lint:
+  extends: .base
+  script: npm run lint
+
+test:
+  extends:
+    - .base
+    - .lint-base
+  script: npm test
+`;
+    const jobs = extractJobs(yaml);
+    expect(jobs.has(".base")).toBe(true);
+    expect(jobs.get("lint")?.extends).toEqual([".base"]);
+    expect(jobs.get("test")?.extends).toEqual([".base", ".lint-base"]);
+  });
+
+  test("reads every needs: form", () => {
+    const yaml = `a:
+  script: x
+b:
+  script: x
+c:
+  script: x
+plain:
+  needs: [a, 'b']
+  script: x
+maps:
+  needs:
+    - job: a
+      artifacts: true
+    - job: b
+      optional: true
+    - job: c
+      parallel:
+        matrix:
+          - PROVIDER: aws
+  script: x
+cross:
+  needs:
+    - pipeline: $PARENT_PIPELINE_ID
+      job: generate
+    - project: group/other
+      job: build
+      ref: main
+      artifacts: true
+    - a
+  script: x
+none:
+  needs: []
+  script: x
+scalar:
+  needs: a
+  script: x
+`;
+    const jobs = extractJobs(yaml);
+    expect(jobs.get("plain")?.needs).toEqual(["a", "b"]);
+    expect(jobs.get("maps")?.needs).toEqual(["a", "b", "c"]);
+    expect(jobs.get("maps")?.optionalNeeds).toEqual(["b"]);
+    expect(jobs.get("cross")?.needs).toEqual(["a"]);
+    expect(jobs.get("none")?.needs).toEqual([]);
+    expect(jobs.get("scalar")?.needs).toEqual(["a"]);
+    expect(jobs.get("a")?.needs).toBeUndefined();
+  });
+
+  test("reads job ids with colons, spaces and quotes", () => {
+    const yaml = `build:linux:
+  stage: build
+  script: make
+"deploy prod":
+  needs: ["build:linux"]
+  script: ./deploy
+'it''s':
+  script: x
+`;
+    const jobs = extractJobs(yaml);
+    expect([...jobs.keys()]).toEqual(["build:linux", "deploy prod", "it's"]);
+    expect(jobs.get("deploy prod")?.needs).toEqual(["build:linux"]);
+  });
+
+  test("does not depend on blank lines between jobs", () => {
+    const yaml = `build:
+  stage: build
+  script: make
+test:
+  stage: test
+  needs: [build]
+  script: make test
+`;
+    const jobs = extractJobs(yaml);
+    expect(jobs.get("test")?.needs).toEqual(["build"]);
+    expect(jobs.get("test")?.stage).toBe("test");
+  });
+
+  test("unparseable YAML gives no jobs", () => {
+    expect(extractJobs("build:\n  script: [unclosed\n").size).toBe(0);
+  });
+});
+
+describe("extractStages", () => {
+  test("reads block and flow lists", () => {
+    expect(extractStages("stages:\n  - build\n  - 'test'\n")).toEqual(["build", "test"]);
+    expect(extractStages("stages: [build, deploy]\n")).toEqual(["build", "deploy"]);
+    expect(extractStages("build:\n  script: x\n")).toEqual([]);
+  });
+});
+
+describe("extractGlobalVariables", () => {
+  test("reads the expanded value:/description: form without treating its keys as variables", () => {
+    const vars = extractGlobalVariables(`variables:
+  PLAIN: one
+  DEPLOY_ENV:
+    value: staging
+    description: Target environment
+`);
+    expect([...vars.entries()]).toEqual([
+      ["PLAIN", "one"],
+      ["DEPLOY_ENV", "staging"],
+    ]);
+  });
+});
+
+describe("topLevelSections / extractJobSection", () => {
+  test("topLevelKey unquotes and keeps colons inside the key", () => {
+    expect(topLevelKey("build:linux:")).toBe("build:linux");
+    expect(topLevelKey('"deploy prod":')).toBe("deploy prod");
+    expect(topLevelKey("Build_Docs:")).toBe("Build_Docs");
+    expect(topLevelKey("  script:")).toBeUndefined();
+    expect(topLevelKey("# build:")).toBeUndefined();
+    expect(topLevelKey("---")).toBeUndefined();
+  });
+
+  test("cuts at top-level keys, not blank lines", () => {
+    const yaml = `build:
+  script:
+    - make
+
+    - make install
+test:
+  script: make test
+`;
+    expect(topLevelSections(yaml).map((s) => s.key)).toEqual(["build", "test"]);
+    expect(extractJobSection(yaml, "build")).toContain("make install");
+    expect(extractJobSection(yaml, "build")).not.toContain("make test");
+  });
+
+  test("matches the exact key", () => {
+    const yaml = `build:linux:
+  script: linux
+
+build:
+  script: plain
+`;
+    expect(extractJobSection(yaml, "build")).toBe("build:\n  script: plain");
+    expect(extractJobSection(yaml, "Build_Docs")).toBeNull();
+  });
+
+  test("a job preceded by a comment is still found", () => {
+    const yaml = `build:
+  script: make
+
+# the docs job
+Build_Docs:
+  script:
+    - make docs
+`;
+    expect(extractJobSection(yaml, "build")).toBe("build:\n  script: make");
+    expect(extractScriptCommands(yaml)).toEqual([
+      { job: "build", command: "make" },
+      { job: "Build_Docs", command: "make docs" },
+    ]);
+  });
+});