@intentius/chant-lexicon-gitlab 0.101.0 → 0.104.0

package/src/components/generate-pipeline.ts

@@ -32,9 +32,11 @@
  * touching the component declarations.
  */
 
-import { emitYAML } from "@intentius/chant/yaml";
+import { emitYAMLEntry } from "@intentius/chant/yaml";
 import { resolveComponentGraph, type DriverComponent } from "@intentius/chant/components/driver";
 import { hasPublishStep, promoteArchivePaths } from "@intentius/chant/components/promote";
+import { GATED_WAVE_RECORD, gatedWaveJobs } from "@intentius/chant/components/gated-wave-pipeline";
+import { PR_LOOP_REPORT_DIR, prApplyGroup, prLoopJobs } from "@intentius/chant/components/pr-pipeline";
 import { memberGitlabChanges, memberRepoPath, memberShellDir } from "@intentius/chant/lexicon";
 import type {
   ComponentPipelineJob as GeneratedJob,
@@ -73,6 +75,19 @@ export function generateGitlabPipeline(
   const { waves } = resolveComponentGraph(components);
   const byName = new Map(components.map((c) => [c.name, c]));
 
+  if (options.prLoop) {
+    if (options.gatedWaves || options.promoteTo !== undefined) {
+      throw new Error("a pull-request pipeline has no wave or promote jobs; drop --wave-gate and --promote-to, or --pr-loop");
+    }
+    if (options.member) throw new Error("a pull-request pipeline is not generated for a workspace member yet; generate it from the project outside the workspace");
+    return prLoopGitlabPipeline(env, image, beforeScript, extraScript, options);
+  }
+
+  if (options.gatedWaves) {
+    if (options.promoteTo !== undefined) throw new Error("a gated-wave pipeline has no promote job; drop --promote-to or --wave-gate");
+    return gatedWaveGitlabPipeline(components, env, image, beforeScript, extraScript, options);
+  }
+
   // Components that something else depends on must hand their resolved outputs
   // (stack outputs, published artifact refs) to their dependents, which run as
   // separate jobs/processes. Each such producer dumps its outputs to a file and
@@ -187,23 +202,114 @@ export function generateGitlabPipeline(
   }
 
   const sections: string[] = [];
-  // `emitYAML` returns a `\n`-led block for a non-empty sequence and an inline
-  // `[]` for an empty one, so the header needs a space in the second case.
-  // `stages:[]` is the plain scalar "stages:[]" — a colon opens a mapping only
-  // when whitespace or the line's end follows it — which is how GitLab's own
-  // reader takes it, and now how `parseYAML` does too (chant #2013).
-  sections.push("workflow:" + emitYAML(doc.workflow, 1));
+  sections.push(emitYAMLEntry("workflow", doc.workflow));
   // The promote stage is YAML only: `stages` in the result stays one entry
   // per graph wave.
   const yamlStages = promoteJob ? [...stages, "promote"] : stages;
-  sections.push(yamlStages.length > 0 ? "stages:" + emitYAML(yamlStages, 1) : "stages: []");
-  if (doc.variables) sections.push("variables:" + emitYAML(doc.variables, 1));
+  sections.push(emitYAMLEntry("stages", yamlStages));
+  if (doc.variables) sections.push(emitYAMLEntry("variables", doc.variables));
   for (const job of jobs) {
     const props = doc[job.jobName] as Record<string, unknown>;
-    sections.push(`${job.jobName}:` + emitYAML(props, 1));
+    sections.push(emitYAMLEntry(job.jobName, props));
+  }
+  if (promoteJob) sections.push(emitYAMLEntry(promoteJob, doc[promoteJob]));
+
+  return { yaml: sections.join("\n\n") + "\n", stages, jobs, env };
+}
+
+/**
+ * The gated-wave pipeline (#3049): one job per wave, each running one wave of
+ * `chant components fan-out --wave-gate`, in order through `needs:`. The
+ * attempt record is the artifact GitLab hands from job to job, kept even when
+ * a job stops at a gate (exit 3) so the re-run after `chant approve` reads it.
+ * `GIT_DEPTH: "0"` gives the job the history `--base` diffs against.
+ */
+function gatedWaveGitlabPipeline(
+  components: DriverComponent[],
+  env: string,
+  image: string,
+  beforeScript: string[],
+  extraScript: string[],
+  options: GenerateGitlabOptions,
+): GenerateGitlabResult {
+  const waveJobs = gatedWaveJobs(components, env, options.gatedWaves!);
+  const stages = waveJobs.map((j) => j.jobName);
+  const doc: Record<string, unknown> = {
+    workflow: { name: `chant-components-${env}` },
+    stages,
+    variables: { ...options.variables, CHANT_ENV: env },
+  };
+  const jobs: GeneratedJob[] = [];
+  for (const job of waveJobs) {
+    jobs.push({ jobName: job.jobName, component: `wave ${job.wave}`, stage: job.jobName, needs: job.needs });
+    doc[job.jobName] = {
+      stage: job.jobName,
+      image,
+      variables: { GIT_DEPTH: "0" },
+      script: [...beforeScript, job.command.join(" "), ...extraScript],
+      ...(job.needs.length > 0 ? { needs: job.needs } : {}),
+      artifacts: { when: "always", paths: [GATED_WAVE_RECORD] },
+    };
   }
-  if (promoteJob) sections.push(`${promoteJob}:` + emitYAML(doc[promoteJob], 1));
+  if (options.member) scopeToMember(doc, jobs, undefined, options.member, env);
+  const sections = [
+    emitYAMLEntry("workflow", doc.workflow),
+    emitYAMLEntry("stages", stages),
+    emitYAMLEntry("variables", doc.variables),
+    ...jobs.map((job) => emitYAMLEntry(job.jobName, doc[job.jobName])),
+  ];
+  return { yaml: sections.join("\n\n") + "\n", stages, jobs, env };
+}
 
+/**
+ * The merge-request pipeline (#3183): `plan` in each merge request pipeline,
+ * `apply` on each push to the target branch, one apply at a time per
+ * environment (`resource_group`). `GIT_DEPTH: "0"` gives both the history
+ * they measure the change with. The jobs talk to GitLab with
+ * `CHANT_FORGE_TOKEN`, a project or group access token with the `api` scope
+ * set as a masked CI/CD variable, since a job token cannot write notes.
+ */
+function prLoopGitlabPipeline(
+  env: string,
+  image: string,
+  beforeScript: string[],
+  extraScript: string[],
+  options: GenerateGitlabOptions,
+): GenerateGitlabResult {
+  const loop = options.prLoop!;
+  const [plan, apply] = prLoopJobs("gitlab", env, loop);
+  const onMergeRequest = '$CI_PIPELINE_SOURCE == "merge_request_event"';
+  const target = loop.branch ? JSON.stringify(loop.branch) : "$CI_DEFAULT_BRANCH";
+  const onMerge = `$CI_PIPELINE_SOURCE == "push" && $CI_COMMIT_BRANCH == ${target}`;
+  const script = (job: typeof plan): string[] => [...beforeScript, job.command, ...extraScript];
+  const stages = ["plan", "apply"];
+  const doc: Record<string, unknown> = {
+    workflow: { name: `chant-pr-${env}`, rules: [{ if: onMergeRequest }, { if: onMerge }] },
+    stages,
+    variables: { ...options.variables, CHANT_ENV: env, GIT_DEPTH: "0" },
+    plan: {
+      stage: "plan",
+      image,
+      rules: [{ if: onMergeRequest }],
+      variables: plan.env,
+      script: script(plan),
+      artifacts: { when: "always", paths: [PR_LOOP_REPORT_DIR] },
+    },
+    apply: {
+      stage: "apply",
+      image,
+      resource_group: prApplyGroup(env),
+      rules: [{ if: onMerge }],
+      variables: apply.env,
+      script: script(apply),
+      artifacts: { when: "always", paths: [PR_LOOP_REPORT_DIR] },
+    },
+  };
+  const jobs: GeneratedJob[] = [
+    { jobName: "plan", component: "merge request plan", stage: "plan", needs: [] },
+    { jobName: "apply", component: "merge request apply", stage: "apply", needs: [] },
+  ];
+  const sections = ["workflow", "stages", "variables", "plan", "apply"].map((key) => emitYAMLEntry(key, doc[key]));
   return { yaml: sections.join("\n\n") + "\n", stages, jobs, env };
 }
 

package/src/components/generate-pr-pipeline.test.ts

@@ -0,0 +1,70 @@
+/**
+ * The generated merge-request pipeline for GitLab CI (#3183): a plan job in
+ * each merge request pipeline, an apply job on each push to the default
+ * branch. The whole file has a golden, and it validates against the GitLab
+ * CI schema this lexicon vendors.
+ */
+
+import { readFileSync, writeFileSync } from "node:fs";
+import { createRequire } from "node:module";
+import { join } from "node:path";
+import { describe, expect, test } from "vitest";
+import { parseYAML } from "@intentius/chant/yaml";
+import type { DriverComponent } from "@intentius/chant/components/driver";
+import { generateGitlabPipeline } from "./generate-pipeline";
+
+const ESTATE: DriverComponent[] = [
+  { name: "net", dependsOn: [], deploy: [{ phase: "Apply", steps: [{ kind: "terraform-apply", root: "net" }] }] },
+  { name: "app", dependsOn: ["net"], deploy: [{ phase: "Apply", steps: [{ kind: "terraform-apply", root: "app" }] }] },
+];
+
+const GOLDEN = join(import.meta.dirname, "__fixtures__", "pr-loop.gitlab.golden.yml");
+const SCHEMA = join(import.meta.dirname, "..", "codegen", "vendored", "gitlab-ci-schema.json");
+
+interface Job {
+  rules: Array<{ if: string }>;
+  variables: Record<string, string>;
+  script: string[];
+  resource_group?: string;
+  artifacts: Record<string, unknown>;
+}
+
+describe("the GitLab merge-request pipeline", () => {
+  const result = generateGitlabPipeline(ESTATE, { env: "prod", prLoop: {} });
+  const doc = parseYAML(result.yaml) as { workflow: { rules: unknown[] }; variables: Record<string, string>; plan: Job; apply: Job };
+
+  test("matches its golden", () => {
+    if (process.env.UPDATE_GOLDEN) writeFileSync(GOLDEN, result.yaml);
+    expect(result.yaml).toBe(readFileSync(GOLDEN, "utf-8"));
+  });
+
+  test("validates against the vendored GitLab CI schema", () => {
+    const req = createRequire(import.meta.url);
+    const mod = req("ajv") as { default?: unknown };
+    const Ajv = (mod.default ?? mod) as new (opts: object) => { compile(s: object): ((d: unknown) => boolean) & { errors?: unknown } };
+    const validate = new Ajv({ strict: false, allErrors: true }).compile(JSON.parse(readFileSync(SCHEMA, "utf-8")));
+    const ok = validate(doc);
+    expect(ok, JSON.stringify(validate.errors, null, 2)).toBe(true);
+  });
+
+  test("plans in a merge request pipeline from its diff base, applies on a push to the default branch, one at a time", () => {
+    expect(doc.plan.rules).toEqual([{ if: '$CI_PIPELINE_SOURCE == "merge_request_event"' }]);
+    expect(doc.plan.variables).toEqual({ BASE_SHA: "$CI_MERGE_REQUEST_DIFF_BASE_SHA", PR_NUMBER: "$CI_MERGE_REQUEST_IID" });
+    expect(doc.plan.script).toEqual(['chant components pr-plan --base "$BASE_SHA" --pr "$PR_NUMBER" --env prod --gate pr-apply --output .chant/pr --forge gitlab']);
+    expect(doc.apply.rules).toEqual([{ if: '$CI_PIPELINE_SOURCE == "push" && $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH' }]);
+    expect(doc.apply.variables).toEqual({ BASE_SHA: "$CI_COMMIT_BEFORE_SHA" });
+    expect(doc.apply.script[0]).toContain("--require-review");
+    expect(doc.apply.resource_group).toBe("chant-apply-prod");
+    expect(doc.variables.GIT_DEPTH).toBe("0");
+    expect(doc.apply.artifacts).toEqual({ when: "always", paths: [".chant/pr"] });
+  });
+
+  test("a named branch replaces the default branch in the apply rule", () => {
+    const yaml = generateGitlabPipeline(ESTATE, { env: "prod", prLoop: { branch: "trunk" } }).yaml;
+    expect(yaml).toContain('$CI_COMMIT_BRANCH == "trunk"');
+  });
+
+  test("refuses a wave or promote job beside it", () => {
+    expect(() => generateGitlabPipeline(ESTATE, { prLoop: {}, gatedWaves: { gate: "g" } })).toThrow(/pull-request pipeline has no wave or promote jobs/);
+  });
+});

package/src/lint/post-synth/post-synth.test.ts

@@ -153,3 +153,32 @@ describe("WGL011: unreachable job", () => {
     expect(diags).toHaveLength(0);
   });
 });
+
+describe("WGL010: job ids the old line parser skipped (#3256)", () => {
+  test("flags a job whose id starts with a capital", () => {
+    const yaml = `stages:
+  - build
+
+Build_Docs:
+  stage: docs
+  script:
+    - make docs
+`;
+    const diags = wgl010.check(makeCtx(yaml));
+    expect(diags).toHaveLength(1);
+    expect(diags[0].entity).toBe("Build_Docs");
+  });
+
+  test("reads a flow-list stages: and jobs with no blank line between them", () => {
+    const yaml = `stages: [build, test]
+build:
+  stage: build
+  script: make
+lint:
+  stage: lint
+  script: make lint
+`;
+    const diags = wgl010.check(makeCtx(yaml));
+    expect(diags.map((d) => d.entity)).toEqual(["lint"]);
+  });
+});

package/src/lint/post-synth/wgl013.test.ts

@@ -162,3 +162,56 @@ build:
     expect(diags[1].message).toContain("ghost2");
   });
 });
+
+describe("WGL013: needs: forms the old line parser misread (#3256)", () => {
+  test("a dangling need after an artifacts: line is reported", () => {
+    const yaml = `build:
+  script: make
+
+deploy:
+  needs:
+    - job: build
+      artifacts: true
+    - job: missing
+  script: ./deploy.sh
+`;
+    const diags = checkInvalidNeeds(makeCtx(yaml));
+    expect(diags).toHaveLength(1);
+    expect(diags[0].message).toContain('"missing"');
+  });
+
+  test("a need on a job whose id starts with a capital is not dangling", () => {
+    const yaml = `Build_Docs:
+  script: make docs
+
+deploy:
+  needs: [Build_Docs]
+  script: ./deploy.sh
+`;
+    expect(checkInvalidNeeds(makeCtx(yaml))).toHaveLength(0);
+  });
+
+  test("an optional need on an absent job is not reported", () => {
+    const yaml = `deploy:
+  needs:
+    - job: maybe-build
+      optional: true
+  script: ./deploy.sh
+`;
+    expect(checkInvalidNeeds(makeCtx(yaml))).toHaveLength(0);
+  });
+
+  test("cross-pipeline needs are not checked against this pipeline", () => {
+    const yaml = `deploy:
+  needs:
+    - pipeline: $PARENT_PIPELINE_ID
+      job: generate
+    - project: group/other
+      job: build
+      ref: main
+      artifacts: true
+  script: ./deploy.sh
+`;
+    expect(checkInvalidNeeds(makeCtx(yaml))).toHaveLength(0);
+  });
+});

package/src/lint/post-synth/wgl013.ts

@@ -8,7 +8,9 @@
  * Both cause GitLab pipeline validation failures.
  *
  * Caveat: when `include:` is present, referenced jobs may come from
- * included files, so the check is skipped.
+ * included files, so the check is skipped. A `- job: x` entry with
+ * `optional: true` may name a job that is not in the pipeline (GitLab
+ * ignores it), so it is not reported as dangling.
  */
 
 import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
@@ -36,7 +38,7 @@ export function checkInvalidNeeds(ctx: PostSynthContext): PostSynthDiagnostic[]
             entity: jobName,
             lexicon: "gitlab",
           });
-        } else if (!jobNames.has(need)) {
+        } else if (!jobNames.has(need) && !job.optionalNeeds?.includes(need)) {
           diagnostics.push({
             checkId: "WGL013",
             severity: "error",

package/src/lint/post-synth/wgl014.test.ts

@@ -95,3 +95,26 @@ deploy:
     expect(diags[0].message).toContain(".missing");
   });
 });
+
+describe("WGL014: templates the old line parser skipped (#3256)", () => {
+  test("extends of a hidden template whose name has a capital is resolved", () => {
+    const yaml = `.Base:
+  image: node:20
+
+lint:
+  extends: .Base
+  script: npm run lint
+`;
+    expect(checkInvalidExtends(makeCtx(yaml))).toHaveLength(0);
+  });
+
+  test("a job whose id starts with a capital is checked", () => {
+    const yaml = `Lint:
+  extends: .missing
+  script: npm run lint
+`;
+    const diags = checkInvalidExtends(makeCtx(yaml));
+    expect(diags).toHaveLength(1);
+    expect(diags[0].entity).toBe("Lint");
+  });
+});

package/src/lint/post-synth/wgl015.test.ts

@@ -137,3 +137,38 @@ job-a:
     expect(diags).toHaveLength(0);
   });
 });
+
+describe("WGL015: needs the old line parser dropped (#3256)", () => {
+  test("finds a cycle through a need listed after an artifacts: line", () => {
+    const yaml = `build:
+  needs: [deploy]
+  script: make
+
+deploy:
+  needs:
+    - job: lint
+      artifacts: true
+    - job: build
+  script: ./deploy.sh
+
+lint:
+  script: make lint
+`;
+    const diags = checkCircularNeeds(makeCtx(yaml));
+    expect(diags).toHaveLength(1);
+    expect(diags[0].message).toContain("build");
+    expect(diags[0].message).toContain("deploy");
+  });
+
+  test("finds a cycle through a job whose id starts with a capital", () => {
+    const yaml = `Build:
+  needs: [deploy]
+  script: make
+
+deploy:
+  needs: [Build]
+  script: ./deploy.sh
+`;
+    expect(checkCircularNeeds(makeCtx(yaml))).toHaveLength(1);
+  });
+});

package/src/lint/post-synth/wgl017.test.ts

@@ -51,3 +51,17 @@ describe("WGL017: Insecure Registry", () => {
     expect(diags).toHaveLength(0);
   });
 });
+
+describe("WGL017: job ids the old line parser skipped (#3256)", () => {
+  test("flags a job whose id starts with a capital, with no blank line before it", () => {
+    const yaml = `build:
+  script: make
+Push_Image:
+  script:
+    - docker push http://registry.local/app:latest
+`;
+    const diags = checkInsecureRegistry(yaml);
+    expect(diags).toHaveLength(1);
+    expect(diags[0].entity).toBe("Push_Image");
+  });
+});

package/src/lint/post-synth/wgl017.ts

@@ -6,23 +6,15 @@
  */
 
 import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
-import { getPrimaryOutput, extractJobs } from "./yaml-helpers";
+import { getPrimaryOutput, topLevelSections } from "./yaml-helpers";
 
 const INSECURE_REGISTRY_PATTERN = /docker\s+(push|pull|tag|login)\s+.*http:\/\/[^\s]+/;
 
 export function checkInsecureRegistry(yaml: string): PostSynthDiagnostic[] {
   const diagnostics: PostSynthDiagnostic[] = [];
 
-  const sections = yaml.split("\n\n");
-  for (const section of sections) {
-    const lines = section.split("\n");
-    if (lines.length === 0) continue;
-
-    const topMatch = lines[0].match(/^(\.?[a-z][a-z0-9_.-]*):/);
-    if (!topMatch) continue;
-    const jobName = topMatch[1];
-
-    for (const line of lines) {
+  for (const { key: jobName, text } of topLevelSections(yaml)) {
+    for (const line of text.split("\n")) {
       if (INSECURE_REGISTRY_PATTERN.test(line)) {
         diagnostics.push({
           checkId: "WGL017",

package/src/lint/post-synth/wgl020.test.ts

@@ -52,3 +52,29 @@ variables:
     expect(diags).toHaveLength(0);
   });
 });
+
+describe("WGL020: keys the old line parser skipped (#3256)", () => {
+  test("flags a duplicated job id that starts with a capital", () => {
+    const yaml = `Build_Docs:
+  script: a
+
+Build_Docs:
+  script: b
+`;
+    const diags = checkDuplicateJobNames(yaml);
+    expect(diags).toHaveLength(1);
+    expect(diags[0].entity).toBe("Build_Docs");
+  });
+
+  test("treats a quoted and a plain key as the same job, and skips global keywords", () => {
+    const yaml = `image: node:20
+build:
+  script: a
+"build":
+  script: b
+image: node:22
+`;
+    const diags = checkDuplicateJobNames(yaml);
+    expect(diags.map((d) => d.entity)).toEqual(["build"]);
+  });
+});

package/src/lint/post-synth/wgl020.ts

@@ -7,7 +7,7 @@
  */
 
 import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
-import { getPrimaryOutput, extractJobs } from "./yaml-helpers";
+import { getPrimaryOutput, topLevelKey, RESERVED_TOP_LEVEL_KEYS } from "./yaml-helpers";
 
 export function checkDuplicateJobNames(yaml: string): PostSynthDiagnostic[] {
   const diagnostics: PostSynthDiagnostic[] = [];
@@ -18,10 +18,9 @@ export function checkDuplicateJobNames(yaml: string): PostSynthDiagnostic[] {
   const lines = yaml.split("\n");
 
   for (const line of lines) {
-    const topMatch = line.match(/^(\.?[a-z][a-z0-9_.-]*):/);
-    if (topMatch) {
-      const name = topMatch[1];
-      if (["stages", "default", "workflow", "variables", "include"].includes(name)) continue;
+    const name = topLevelKey(line);
+    if (name !== undefined) {
+      if (RESERVED_TOP_LEVEL_KEYS.has(name)) continue;
       keyCounts.set(name, (keyCounts.get(name) ?? 0) + 1);
     }
   }

package/src/lint/post-synth/wgl021.test.ts

@@ -60,3 +60,32 @@ deploy-job:
     expect(diags).toHaveLength(0);
   });
 });
+
+describe("WGL021: expanded variables (#3256)", () => {
+  test("reads the value:/description: form by variable name", () => {
+    const yaml = `variables:
+  DEPLOY_ENV:
+    value: staging
+    description: Target environment
+
+deploy:
+  script:
+    - ./deploy.sh $DEPLOY_ENV
+`;
+    expect(checkUnusedVariables(yaml)).toHaveLength(0);
+  });
+
+  test("reports an unused expanded variable by its name", () => {
+    const yaml = `variables:
+  UNUSED_ENV:
+    value: staging
+    description: Never read
+
+deploy:
+  script:
+    - ./deploy.sh
+`;
+    const diags = checkUnusedVariables(yaml);
+    expect(diags.map((d) => d.entity)).toEqual(["UNUSED_ENV"]);
+  });
+});

package/src/lint/post-synth/wgl021.ts

@@ -6,7 +6,7 @@
  */
 
 import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
-import { getPrimaryOutput, extractGlobalVariables } from "./yaml-helpers";
+import { getPrimaryOutput, extractGlobalVariables, topLevelSections } from "./yaml-helpers";
 
 export function checkUnusedVariables(yaml: string): PostSynthDiagnostic[] {
   const diagnostics: PostSynthDiagnostic[] = [];
@@ -20,14 +20,13 @@ export function checkUnusedVariables(yaml: string): PostSynthDiagnostic[] {
     // Check if $VARNAME or ${VARNAME} appears anywhere in the YAML (outside the variables block)
     const refPattern = new RegExp(`\\$\\{?${varName}\\}?`);
     // Also check for uses in extends, needs, etc. — search all sections
-    const sections = yaml.split("\n\n");
     let found = false;
 
-    for (const section of sections) {
+    for (const { key, text } of topLevelSections(yaml)) {
       // Skip the global variables section itself
-      if (section.trimStart().startsWith("variables:")) continue;
+      if (key === "variables") continue;
 
-      if (refPattern.test(section)) {
+      if (refPattern.test(text)) {
         found = true;
         break;
       }

package/src/lint/post-synth/wgl028.test.ts

@@ -93,3 +93,30 @@ test-app:
     expect(diags).toHaveLength(0);
   });
 });
+
+describe("WGL028: needs the old line parser dropped (#3256)", () => {
+  test("reads a need listed after an artifacts: line", () => {
+    const yaml = `stages:
+  - build
+  - deploy
+
+lint:
+  stage: build
+  script: make lint
+
+build:
+  stage: build
+  script: make
+
+deploy:
+  stage: deploy
+  needs:
+    - job: lint
+      artifacts: false
+    - job: build
+  script: ./deploy.sh
+`;
+    const diags = checkRedundantNeeds(yaml);
+    expect(diags.map((d) => d.message.match(/lists "([^"]+)"/)?.[1])).toEqual(["lint", "build"]);
+  });
+});

package/src/lint/post-synth/wgl042.test.ts

@@ -43,3 +43,17 @@ describe("WGL042: unreachable rules after unconditional match", () => {
     expect(diags).toHaveLength(0);
   });
 });
+
+describe("WGL042: job ids the old line parser skipped (#3256)", () => {
+  test("checks a job whose id starts with a capital", () => {
+    const yaml = `Build_Docs:
+  rules:
+    - when: always
+    - if: $CI_COMMIT_BRANCH == "main"
+  script: make docs
+`;
+    const diags = wgl042.check(makeCtx(yaml));
+    expect(diags).toHaveLength(1);
+    expect(diags[0].entity).toBe("Build_Docs");
+  });
+});

package/src/lint/post-synth/wgl048.test.ts

@@ -54,3 +54,17 @@ build:
     expect(diags).toHaveLength(0);
   });
 });
+
+describe("WGL048: section boundaries (#3256)", () => {
+  test("a name: in the next job is not read as workflow:name", () => {
+    const yaml = `workflow:
+  rules:
+    - when: always
+build:
+  image:
+    name: node:20
+  script: make
+`;
+    expect(wgl048.check(makeCtx(yaml))).toHaveLength(1);
+  });
+});

package/src/lint/post-synth/wgl048.ts

@@ -8,7 +8,7 @@
  */
 
 import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
-import { getPrimaryOutput } from "./yaml-helpers";
+import { getPrimaryOutput, topLevelSections } from "./yaml-helpers";
 
 export const wgl048: PostSynthCheck = {
   id: "WGL048",
@@ -19,7 +19,7 @@ export const wgl048: PostSynthCheck = {
 
     for (const [, output] of ctx.outputs) {
       const yaml = getPrimaryOutput(output);
-      const workflowSection = yaml.split("\n\n").find((s) => /^workflow:/.test(s));
+      const workflowSection = topLevelSections(yaml).find((s) => s.key === "workflow")?.text;
       if (!workflowSection) continue;
       if (!/^\s+name:/m.test(workflowSection)) {
         diagnostics.push({