@intentius/chant-lexicon-gitlab 0.105.1 → 0.106.3

package/dist/components/generate-pipeline.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generate-pipeline.d.ts","sourceRoot":"","sources":["../../src/components/generate-pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAGH,OAAO,EAAyB,KAAK,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAKjG,OAAO,KAAK,EACV,oBAAoB,IAAI,YAAY,EACpC,wBAAwB,IAAI,qBAAqB,EACjD,uBAAuB,IAAI,oBAAoB,EAEhD,MAAM,0BAA0B,CAAC;AAElC,YAAY,EAAE,YAAY,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,CAAC;AAS1E;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,eAAe,EAAE,EAC7B,OAAO,GAAE,qBAA0B,GAClC,oBAAoB,CAsJtB"}
+{"version":3,"file":"generate-pipeline.d.ts","sourceRoot":"","sources":["../../src/components/generate-pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAGH,OAAO,EAAyB,KAAK,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAKjG,OAAO,KAAK,EACV,oBAAoB,IAAI,YAAY,EACpC,wBAAwB,IAAI,qBAAqB,EACjD,uBAAuB,IAAI,oBAAoB,EAEhD,MAAM,0BAA0B,CAAC;AAElC,YAAY,EAAE,YAAY,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,CAAC;AAS1E;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,eAAe,EAAE,EAC7B,OAAO,GAAE,qBAA0B,GAClC,oBAAoB,CAqJtB"}

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "66544136a83cad1b87a2b66db21e685581d2f4d06018cfee23695b39399c8f07",
+    "manifest.json": "fb4d145f385ac1702b9084aa87ef84069138eff4010d2a8d0b61d50ce64e235f",
     "meta.json": "931fc3246a55645b1493080bbeb160e5d205e42349e8bdca96ca243adb5f0da3",
     "types/index.d.ts": "5cd2e99f135a929b72bdd822d00d780d39b1cd407ba0cfb3d511c7ac9d667b58",
     "rules/artifact-no-expiry.ts": "3f3cabf9792cbf8207e53a25f506715466b19ec25e9c3b4d0d77fed6b2eb4542",
@@ -55,5 +55,5 @@
     "skills/chant-gitlab-migrate.md": "4853d04980560b379e5b0f7267dcb0a1e5d5879cb9e9931681ce76b2a5fe69d8",
     "skills/chant-gitlab-patterns.md": "6d9a44e9e8de4c3820be9d65381b0d2ede4cb3626aaaf0011e21838a9fbf556e"
   },
-  "composite": "32497eb358c009df40dff92485e679c8c8ea4a5ea633a8274e762a9053652ba7"
+  "composite": "b4573669289f773787b3da6c76e8d20c8adf55482914d721749f627b308b7d11"
 }

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "gitlab",
-  "version": "0.105.1",
+  "version": "0.106.3",
   "chantVersion": ">=0.1.0",
   "namespace": "GitLab",
   "intrinsics": [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-gitlab",
-  "version": "0.105.1",
+  "version": "0.106.3",
   "description": "GitLab CI lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -67,8 +67,8 @@
     "typescript": "^5.9.3"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.105.1",
-    "@intentius/chant-lexicon-github": "^0.105.1",
+    "@intentius/chant": "^0.106.3",
+    "@intentius/chant-lexicon-github": "^0.106.3",
     "typescript": "^5.9.3"
   },
   "peerDependenciesMeta": {

package/src/components/__fixtures__/pr-loop.gitlab.golden.yml

@@ -14,13 +14,14 @@ variables:
 
 plan:
   stage: plan
-  image: node:22-slim
+  image: node:22
   rules:
     - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
   variables:
     BASE_SHA: '$CI_MERGE_REQUEST_DIFF_BASE_SHA'
     PR_NUMBER: '$CI_MERGE_REQUEST_IID'
   script:
+    - command -v tofu >/dev/null 2>&1 || (curl -fsSL https://get.opentofu.org/install-opentofu.sh -o /tmp/install-opentofu.sh && sh /tmp/install-opentofu.sh --install-method standalone)
     - chant components pr-plan --base "$BASE_SHA" --pr "$PR_NUMBER" --env prod --gate pr-apply --output .chant/pr --forge gitlab
   artifacts:
     when: always
@@ -29,14 +30,21 @@ plan:
 
 apply:
   stage: apply
-  image: node:22-slim
+  image: node:22
   resource_group: chant-apply-prod
   rules:
     - if: '$CI_PIPELINE_SOURCE == "push" && $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'
   variables:
     BASE_SHA: '$CI_COMMIT_BEFORE_SHA'
   script:
-    - chant components pr-apply --base "$BASE_SHA" --env prod --gate pr-apply --output .chant/pr --forge gitlab --require-review
+    - command -v tofu >/dev/null 2>&1 || (curl -fsSL https://get.opentofu.org/install-opentofu.sh -o /tmp/install-opentofu.sh && sh /tmp/install-opentofu.sh --install-method standalone)
+    - if [ -z "$BASE_SHA" ] || [ "$BASE_SHA" = "0000000000000000000000000000000000000000" ]; then BASE_SHA="${CI_MERGE_REQUEST_DIFF_BASE_SHA:-}"; if [ -z "$BASE_SHA" ]; then git fetch origin $CI_DEFAULT_BRANCH && BASE_SHA="$(git merge-base FETCH_HEAD "$CI_COMMIT_SHA")"; if [ "$BASE_SHA" = "$CI_COMMIT_SHA" ]; then BASE_SHA="$(git rev-parse "$CI_COMMIT_SHA^")"; fi; fi; fi; export BASE_SHA
+    - chant components pr-apply --base "$BASE_SHA" --env prod --gate pr-apply --output .chant/pr --forge gitlab --require-review --resume .chant/pr-resume/pr-apply.json
+  cache:
+    key: chant-apply-prod-$CI_COMMIT_SHA
+    paths:
+      - .chant/pr-resume/pr-apply.json
+    when: always
   artifacts:
     when: always
     paths:

package/src/components/generate-pipeline.member.test.ts

@@ -31,7 +31,7 @@ describe("generateGitlabPipeline for a workspace member", () => {
   test("jobs take the member's name, run in its directory and only on its changes", () => {
     const result = generateGitlabPipeline(components, { env: "staging", member: api });
     const doc = parseYAML(result.yaml) as Record<string, unknown>;
-    expect(doc.workflow).toEqual({ name: "chant-components-api-staging" });
+    expect(doc.workflow).toEqual({ name: "chant-components.api.staging" });
     expect(doc["shared-alb"]).toBeUndefined();
 
     const job = doc["api-api"] as Job;

package/src/components/generate-pipeline.test.ts

@@ -343,7 +343,9 @@ describe("generateGitlabPipeline: gated waves (#3049)", () => {
     expect(result.stages).toEqual(["wave-1", "wave-2", "wave-3"]);
     expect(parsed["wave-2"].needs).toEqual(["wave-1"]);
     expect(parsed["wave-1"].needs).toBeUndefined();
+    expect(parsed["wave-3"].image).toBe("node:22");
     expect(parsed["wave-3"].script).toEqual([
+      expect.stringMatching(/^command -v tofu /),
       "chant components fan-out --base HEAD~1 --env prod --wave-gate release --wave 3 --resume .chant/fan-out.json",
     ]);
     // The record goes to the next job even when this one stops at a gate.
@@ -357,6 +359,6 @@ describe("generateGitlabPipeline: gated waves (#3049)", () => {
     const result = generateGitlabPipeline(roots, { env: "prod", gatedWaves: { gate: "release", canary: ["b"], base: "$CI_COMMIT_BEFORE_SHA" } });
     expect(result.stages).toEqual(["wave-1", "wave-2", "wave-3", "wave-4"]);
     const parsed = parseYAML(result.yaml) as Record<string, Record<string, unknown>>;
-    expect((parsed["wave-1"].script as string[])[0]).toContain("--base $CI_COMMIT_BEFORE_SHA --env prod --wave-gate release --canary b --wave 1");
+    expect((parsed["wave-1"].script as string[])[1]).toContain("--base $CI_COMMIT_BEFORE_SHA --env prod --wave-gate release --canary b --wave 1");
   });
 });

package/src/components/generate-pipeline.ts

@@ -36,7 +36,7 @@ import { emitYAMLEntry } from "@intentius/chant/yaml";
 import { resolveComponentGraph, type DriverComponent } from "@intentius/chant/components/driver";
 import { hasPublishStep, promoteArchivePaths } from "@intentius/chant/components/promote";
 import { GATED_WAVE_RECORD, gatedWaveJobs } from "@intentius/chant/components/gated-wave-pipeline";
-import { PR_LOOP_REPORT_DIR, prApplyGroup, prLoopJobs } from "@intentius/chant/components/pr-pipeline";
+import { PR_APPLY_RECORD, PR_LOOP_IMAGE, PR_LOOP_REPORT_DIR, prApplyGroup, prApplyRecordKey, prLoopJobs, prLoopSetup } from "@intentius/chant/components/pr-pipeline";
 import { memberGitlabChanges, memberRepoPath, memberShellDir } from "@intentius/chant/lexicon";
 import type {
   ComponentPipelineJob as GeneratedJob,
@@ -67,7 +67,7 @@ export function generateGitlabPipeline(
   options: GenerateGitlabOptions = {},
 ): GenerateGitlabResult {
   const env = options.env ?? "production";
-  const image = options.image ?? DEFAULT_IMAGE;
+  const image = options.image ?? (options.prLoop || options.gatedWaves ? PR_LOOP_IMAGE : DEFAULT_IMAGE);
   const runCommand = options.runCommand ?? ["chant", "run", "--components", "{name}", "--env", env];
   const beforeScript = options.beforeScript ?? [];
   const extraScript = options.extraScript ?? [];
@@ -79,7 +79,6 @@ export function generateGitlabPipeline(
     if (options.gatedWaves || options.promoteTo !== undefined) {
       throw new Error("a pull-request pipeline has no wave or promote jobs; drop --wave-gate and --promote-to, or --pr-loop");
     }
-    if (options.member) throw new Error("a pull-request pipeline is not generated for a workspace member yet; generate it from the project outside the workspace");
     return prLoopGitlabPipeline(env, image, beforeScript, extraScript, options);
   }
 
@@ -246,7 +245,7 @@ function gatedWaveGitlabPipeline(
       stage: job.jobName,
       image,
       variables: { GIT_DEPTH: "0" },
-      script: [...beforeScript, job.command.join(" "), ...extraScript],
+      script: [...prLoopSetup(image), ...beforeScript, job.command.join(" "), ...extraScript],
       ...(job.needs.length > 0 ? { needs: job.needs } : {}),
       artifacts: { when: "always", paths: [GATED_WAVE_RECORD] },
     };
@@ -268,6 +267,21 @@ function gatedWaveGitlabPipeline(
  * they measure the change with. The jobs talk to GitLab with
  * `CHANT_FORGE_TOKEN`, a project or group access token with the `api` scope
  * set as a masked CI/CD variable, since a job token cannot write notes.
+ *
+ * For a workspace member (#3465) the file is one the root `.gitlab-ci.yml`
+ * includes, so the jobs are `<member>-plan` and `<member>-apply`, each
+ * script starts with a `cd` into the member's directory and the report
+ * artifact is kept from there. The jobs take no `changes:` rule, since a
+ * change outside the member can reach it; the plan selects from the whole
+ * change and passes `--member`, which keeps the member's gate, note and
+ * statuses apart from the other members'. The apply's resource group is the
+ * member's own.
+ *
+ * The apply job keeps its attempt record in the job cache under the pushed
+ * commit, uploaded whether the job passed or failed, so a retry of a failed
+ * apply passes it to `pr-apply --resume` (#3543). GitLab keeps protected
+ * branches' caches apart from other branches' by default, so a merge request
+ * pipeline cannot write the record the target branch's apply reads.
  */
 function prLoopGitlabPipeline(
   env: string,
@@ -277,39 +291,55 @@ function prLoopGitlabPipeline(
   options: GenerateGitlabOptions,
 ): GenerateGitlabResult {
   const loop = options.prLoop!;
-  const [plan, apply] = prLoopJobs("gitlab", env, loop);
+  const member = options.member;
+  const rooted = !member || member.dir === "." || member.dir === "";
+  const [plan, apply] = prLoopJobs("gitlab", env, loop, member?.name);
+  const reportPath = member ? memberRepoPath(member, PR_LOOP_REPORT_DIR) : PR_LOOP_REPORT_DIR;
+  const planJob = member ? `${member.name}-plan` : "plan";
+  const applyJob = member ? `${member.name}-apply` : "apply";
   const onMergeRequest = '$CI_PIPELINE_SOURCE == "merge_request_event"';
   const target = loop.branch ? JSON.stringify(loop.branch) : "$CI_DEFAULT_BRANCH";
   const onMerge = `$CI_PIPELINE_SOURCE == "push" && $CI_COMMIT_BRANCH == ${target}`;
-  const script = (job: typeof plan): string[] => [...beforeScript, job.command, ...extraScript];
+  // A member's jobs start in its directory, after the image's install lines.
+  const enter = rooted ? [] : [`cd ${memberShellDir(member!)}`];
+  const script = (job: typeof plan): string[] => [...prLoopSetup(image), ...enter, ...beforeScript, ...(job.setup ?? []), job.command, ...extraScript];
   const stages = ["plan", "apply"];
   const doc: Record<string, unknown> = {
-    workflow: { name: `chant-pr-${env}`, rules: [{ if: onMergeRequest }, { if: onMerge }] },
+    // Included files merge their top-level keys, so a member's file carries
+    // the rules every member shares and no name: two names would collide.
+    workflow: { ...(member ? {} : { name: `chant-pr-${env}` }), rules: [{ if: onMergeRequest }, { if: onMerge }] },
     stages,
     variables: { ...options.variables, CHANT_ENV: env, GIT_DEPTH: "0" },
-    plan: {
+    [planJob]: {
       stage: "plan",
       image,
       rules: [{ if: onMergeRequest }],
       variables: plan.env,
       script: script(plan),
-      artifacts: { when: "always", paths: [PR_LOOP_REPORT_DIR] },
+      artifacts: { when: "always", paths: [reportPath] },
     },
-    apply: {
+    [applyJob]: {
       stage: "apply",
       image,
-      resource_group: prApplyGroup(env),
+      resource_group: prApplyGroup(env, member?.name),
       rules: [{ if: onMerge }],
       variables: apply.env,
       script: script(apply),
-      artifacts: { when: "always", paths: [PR_LOOP_REPORT_DIR] },
+      // The attempt record (#3543), kept under the pushed commit even when
+      // the job fails, so a retry finishes the apply under the same approval.
+      cache: {
+        key: prApplyRecordKey(env, "$CI_COMMIT_SHA", member?.name),
+        paths: [member ? memberRepoPath(member, PR_APPLY_RECORD) : PR_APPLY_RECORD],
+        when: "always",
+      },
+      artifacts: { when: "always", paths: [reportPath] },
     },
   };
   const jobs: GeneratedJob[] = [
-    { jobName: "plan", component: "merge request plan", stage: "plan", needs: [] },
-    { jobName: "apply", component: "merge request apply", stage: "apply", needs: [] },
+    { jobName: planJob, component: "merge request plan", stage: "plan", needs: [] },
+    { jobName: applyJob, component: "merge request apply", stage: "apply", needs: [] },
   ];
-  const sections = ["workflow", "stages", "variables", "plan", "apply"].map((key) => emitYAMLEntry(key, doc[key]));
+  const sections = ["workflow", "stages", "variables", planJob, applyJob].map((key) => emitYAMLEntry(key, doc[key]));
   return { yaml: sections.join("\n\n") + "\n", stages, jobs, env };
 }
 
@@ -354,6 +384,6 @@ function scopeToMember(
     job.jobName = renamed.get(job.jobName)!;
     job.needs = job.needs.map((n) => renamed.get(n) ?? n);
   }
-  doc.workflow = { name: `chant-components-${member.name}-${env}` };
+  doc.workflow = { name: `chant-components.${member.name}.${env}` };
   return promoteJob ? renamed.get(promoteJob) : undefined;
 }

package/src/components/generate-pr-pipeline.test.ts

@@ -12,6 +12,7 @@ import { describe, expect, test } from "vitest";
 import { parseYAML } from "@intentius/chant/yaml";
 import type { DriverComponent } from "@intentius/chant/components/driver";
 import { generateGitlabPipeline } from "./generate-pipeline";
+import { PR_LOOP_SETUP } from "@intentius/chant/components/pr-pipeline";
 
 const ESTATE: DriverComponent[] = [
   { name: "net", dependsOn: [], deploy: [{ phase: "Apply", steps: [{ kind: "terraform-apply", root: "net" }] }] },
@@ -26,7 +27,9 @@ interface Job {
   variables: Record<string, string>;
   script: string[];
   resource_group?: string;
+  image?: string;
   artifacts: Record<string, unknown>;
+  cache?: Record<string, unknown>;
 }
 
 describe("the GitLab merge-request pipeline", () => {
@@ -50,21 +53,69 @@ describe("the GitLab merge-request pipeline", () => {
   test("plans in a merge request pipeline from its diff base, applies on a push to the default branch, one at a time", () => {
     expect(doc.plan.rules).toEqual([{ if: '$CI_PIPELINE_SOURCE == "merge_request_event"' }]);
     expect(doc.plan.variables).toEqual({ BASE_SHA: "$CI_MERGE_REQUEST_DIFF_BASE_SHA", PR_NUMBER: "$CI_MERGE_REQUEST_IID" });
-    expect(doc.plan.script).toEqual(['chant components pr-plan --base "$BASE_SHA" --pr "$PR_NUMBER" --env prod --gate pr-apply --output .chant/pr --forge gitlab']);
+    expect(doc.plan.script).toEqual([
+      ...PR_LOOP_SETUP,'chant components pr-plan --base "$BASE_SHA" --pr "$PR_NUMBER" --env prod --gate pr-apply --output .chant/pr --forge gitlab']);
     expect(doc.apply.rules).toEqual([{ if: '$CI_PIPELINE_SOURCE == "push" && $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH' }]);
     expect(doc.apply.variables).toEqual({ BASE_SHA: "$CI_COMMIT_BEFORE_SHA" });
-    expect(doc.apply.script[0]).toContain("--require-review");
+    expect(doc.apply.script.at(-1)).toContain("--require-review");
     expect(doc.apply.resource_group).toBe("chant-apply-prod");
     expect(doc.variables.GIT_DEPTH).toBe("0");
     expect(doc.apply.artifacts).toEqual({ when: "always", paths: [".chant/pr"] });
   });
 
+  test("runs in an image with git and installs OpenTofu, unless the caller names an image", () => {
+    expect(doc.plan.image).toBe("node:22");
+    expect(doc.apply.script[0]).toBe(PR_LOOP_SETUP[0]);
+    const own = generateGitlabPipeline(ESTATE, { env: "prod", image: "example/ci:1", prLoop: {} }).yaml;
+    expect(own).toContain("image: example/ci:1");
+    expect(own).not.toContain("install-opentofu");
+  });
+
+  test("an all-zero CI_COMMIT_BEFORE_SHA falls back to the merge request diff base, then the target branch", () => {
+    const line = doc.apply.script.find((l) => l.includes("CI_MERGE_REQUEST_DIFF_BASE_SHA"))!;
+    expect(line).toContain("0000000000000000000000000000000000000000");
+    expect(line).toContain("git fetch origin $CI_DEFAULT_BRANCH");
+    expect(doc.apply.script.indexOf(line)).toBeLessThan(doc.apply.script.length - 1);
+    expect(doc.plan.script.some((l) => l.includes("CI_MERGE_REQUEST_DIFF_BASE_SHA"))).toBe(false);
+  });
+
   test("a named branch replaces the default branch in the apply rule", () => {
     const yaml = generateGitlabPipeline(ESTATE, { env: "prod", prLoop: { branch: "trunk" } }).yaml;
     expect(yaml).toContain('$CI_COMMIT_BRANCH == "trunk"');
   });
 
+  test("the apply resumes from a record the job cache keeps for the pushed commit, failed or not (#3543)", () => {
+    expect(doc.apply.script.at(-1)).toContain("--resume .chant/pr-resume/pr-apply.json");
+    expect(doc.apply.cache).toEqual({ key: "chant-apply-prod-$CI_COMMIT_SHA", paths: [".chant/pr-resume/pr-apply.json"], when: "always" });
+    // The plan runs the merge request's code: no cache, no record.
+    expect(doc.plan.cache).toBeUndefined();
+    expect(doc.plan.script.at(-1)).not.toContain("--resume");
+  });
+
   test("refuses a wave or promote job beside it", () => {
     expect(() => generateGitlabPipeline(ESTATE, { prLoop: {}, gatedWaves: { gate: "g" } })).toThrow(/pull-request pipeline has no wave or promote jobs/);
   });
+
+  test("inside a workspace member: member-named jobs that cd into the member, with no changes rule (#3465)", () => {
+    const member = { name: "network", dir: "infra/network", file: ".gitlab/ci/chant-pr.network.prod.gitlab-ci.yml" };
+    const scoped = generateGitlabPipeline(ESTATE, { env: "prod", prLoop: {}, member });
+    const mdoc = parseYAML(scoped.yaml) as Record<string, unknown> & { workflow: { name?: string; rules: unknown[] } };
+    expect(scoped.jobs.map((j) => j.jobName)).toEqual(["network-plan", "network-apply"]);
+    expect(mdoc.plan).toBeUndefined();
+    // Included files merge top-level keys: no name, so members do not collide on it.
+    expect(mdoc.workflow.name).toBeUndefined();
+    expect(mdoc.workflow.rules).toHaveLength(2);
+    const plan = mdoc["network-plan"] as Job;
+    const apply = mdoc["network-apply"] as Job;
+    expect(plan.script).toContain("cd infra/network");
+    expect(plan.script.indexOf("cd infra/network")).toBeLessThan(plan.script.findIndex((l) => l.includes("pr-plan")));
+    expect(plan.script.find((l) => l.includes("pr-plan"))).toContain("--member network");
+    expect(apply.script.find((l) => l.includes("pr-apply"))).toContain("--member network");
+    // A change outside the member can reach it, so the jobs keep only their pipeline-source rules.
+    expect(plan.rules).toEqual([{ if: '$CI_PIPELINE_SOURCE == "merge_request_event"' }]);
+    expect(apply.resource_group).toBe("chant-apply.network.prod");
+    expect(plan.artifacts).toEqual({ when: "always", paths: ["infra/network/.chant/pr"] });
+    expect(apply.artifacts).toEqual({ when: "always", paths: ["infra/network/.chant/pr"] });
+    expect(apply.cache).toEqual({ key: "chant-apply.network.prod-$CI_COMMIT_SHA", paths: ["infra/network/.chant/pr-resume/pr-apply.json"], when: "always" });
+  });
 });