@intentius/chant-lexicon-gitlab 0.124.30 → 0.124.32

package/dist/migrate/from-github/actions/tier-3.js

@@ -0,0 +1,96 @@
+/**
+ * Tier 3 marketplace action mappings — 5 niche actions. Several map to
+ * native GitLab keywords (rules:changes, retry:) rather than scripts.
+ */
+import { getDefaultRegistry } from "./registry.js";
+const prov = (ctx, actionName, note, category = "action-map") => ({
+    gitlabPath: `jobs.${ctx.logicalId}.script`,
+    gitlabLogicalId: ctx.logicalId,
+    sourceKey: `jobs.${ctx.jobName}.steps[${ctx.stepIndex}].uses`,
+    sourceFile: ctx.sourceFile,
+    category,
+    rule: `ACT-${actionName.replace(/[\/-]/g, "-")}`,
+    note,
+    actionRef: actionName,
+    mappingTier: 3,
+});
+const getWith = (s) => s.with ?? {};
+const tjActionsChangedFiles = {
+    actionName: "tj-actions/changed-files",
+    tier: 3,
+    translate(step, ctx) {
+        const w = getWith(step);
+        const files = w.files ?? "";
+        return {
+            scriptLines: [
+                `git diff --name-only $CI_COMMIT_BEFORE_SHA $CI_COMMIT_SHA${files ? ` | grep -E '${files.replace(/\n/g, "|")}' || true` : ""}`,
+            ],
+            provenance: [prov(ctx, "tj-actions/changed-files", "tj-actions/changed-files → git diff inline; for path-based job gating prefer rules:changes:")],
+        };
+    },
+};
+// dorny/paths-filter: native rules:changes:
+const dornyPathsFilter = {
+    actionName: "dorny/paths-filter",
+    tier: 3,
+    translate(_step, ctx) {
+        return {
+            scriptLines: [
+                "# dorny/paths-filter has no script equivalent in GitLab.",
+                "# Use rules:changes: on each job to gate on file path changes.",
+                "# Example: rules: [{ changes: ['src/backend/**'] }]",
+            ],
+            provenance: [prov(ctx, "dorny/paths-filter", "dorny/paths-filter → native rules:changes:; emit rule on each gated job", "needs-review")],
+        };
+    },
+};
+// nick-invision/retry / nick-fields/retry: native retry:
+const nickFieldsRetry = {
+    actionName: "nick-fields/retry",
+    tier: 3,
+    translate(step, ctx) {
+        const w = getWith(step);
+        const command = w.command ?? "";
+        return {
+            scriptLines: command ? [command] : [],
+            provenance: [prov(ctx, "nick-fields/retry", "nick-fields/retry → native retry: { max, when } at job level; configure manually", "needs-review")],
+        };
+    },
+};
+const preCommitAction = {
+    actionName: "pre-commit/action",
+    tier: 3,
+    translate(_step, ctx) {
+        return {
+            scriptLines: ["pip install pre-commit", "pre-commit run --all-files"],
+            provenance: [prov(ctx, "pre-commit/action", "pre-commit/action → pip install pre-commit + pre-commit run")],
+        };
+    },
+};
+const slackapiGithubAction = {
+    actionName: "slackapi/slack-github-action",
+    tier: 3,
+    translate(step, ctx) {
+        const w = getWith(step);
+        const payload = w.payload ?? '{"text":"Build completed"}';
+        return {
+            scriptLines: [
+                `curl -X POST -H 'Content-type: application/json' --data '${payload.replace(/'/g, "'\\''")}' $SLACK_WEBHOOK_URL`,
+            ],
+            provenance: [prov(ctx, "slackapi/slack-github-action", "slack-github-action → curl to $SLACK_WEBHOOK_URL")],
+        };
+    },
+};
+const TIER_3_MAPPINGS = [
+    tjActionsChangedFiles,
+    dornyPathsFilter,
+    nickFieldsRetry,
+    preCommitAction,
+    slackapiGithubAction,
+];
+export function registerTier3(registry = getDefaultRegistry()) {
+    for (const m of TIER_3_MAPPINGS) {
+        registry.register(m);
+    }
+}
+export { TIER_3_MAPPINGS };

package/dist/migrate/from-github/composites/patterns.js

@@ -0,0 +1,151 @@
+/**
+ * Pattern recognisers for `chant migrate --use-composites`.
+ *
+ * Each pattern walks the GitLab IR looking for a recognisable shape
+ * (e.g. NodePipeline-shaped 2-job setup) and rewrites the matched
+ * resources into a sentinel IR type (`GitLab::Composite::NodePipeline`)
+ * that the GitLab generator (`lexicons/gitlab/src/import/generator.ts`)
+ * will emit as `NodePipeline({...})` instead of raw `new Job(...)`.
+ */
+function getProp(r, k) {
+    return r.properties[k];
+}
+function looksLikeNodeImage(image) {
+    return typeof image === "string" && /^node:/i.test(image);
+}
+function detectPackageManager(script) {
+    const text = script.join("\n");
+    if (/\b(bun|bunx)\s+(install|test|run)/.test(text))
+        return "bun";
+    if (/\bpnpm\s+(install|run|test)/.test(text))
+        return "pnpm";
+    if (/\byarn\s+(install|run|test)/.test(text))
+        return "yarn";
+    return "npm";
+}
+function hasInstallStep(script, pm) {
+    const installers = {
+        npm: /\bnpm\s+(ci|install)\b/,
+        yarn: /\byarn\s+install\b/,
+        pnpm: /\bpnpm\s+install\b/,
+        bun: /\bbun\s+install\b/,
+    };
+    return script.some((line) => installers[pm].test(line));
+}
+function hasBuildStep(script, pm) {
+    const re = pm === "npm" ? /\bnpm\s+run\s+build\b/ : new RegExp(`\\b${pm}\\s+(run\\s+)?build\\b`);
+    return script.some((line) => re.test(line));
+}
+function hasTestStep(script, pm) {
+    const re = pm === "npm"
+        ? /\bnpm\s+(test|run\s+test)\b/
+        : new RegExp(`\\b${pm}\\s+(run\\s+)?test\\b`);
+    return script.some((line) => re.test(line));
+}
+const nodePipelinePattern = {
+    name: "NodePipeline",
+    match(ir) {
+        const jobs = ir.resources.filter((r) => r.type === "GitLab::CI::Job");
+        if (jobs.length !== 2)
+            return null;
+        // Find build job + test job
+        let buildJob;
+        let testJob;
+        for (const j of jobs) {
+            const script = (getProp(j, "script") ?? []);
+            if (!looksLikeNodeImage(getProp(j, "image")))
+                return null;
+            const pm = detectPackageManager(script);
+            if (hasBuildStep(script, pm) && hasInstallStep(script, pm)) {
+                buildJob = j;
+            }
+            else if (hasTestStep(script, pm) && hasInstallStep(script, pm)) {
+                testJob = j;
+            }
+        }
+        if (!buildJob || !testJob)
+            return null;
+        if (buildJob.logicalId === testJob.logicalId)
+            return null;
+        const buildScript = (getProp(buildJob, "script") ?? []);
+        const pm = detectPackageManager(buildScript);
+        const image = getProp(buildJob, "image") ?? "node:22";
+        const nodeVersion = image.replace(/^node:/, "") || "22";
+        return {
+            removed: [buildJob.logicalId, testJob.logicalId],
+            added: {
+                logicalId: "app",
+                type: "GitLab::Composite::NodePipeline",
+                properties: {
+                    nodeVersion,
+                    packageManager: pm,
+                },
+            },
+        };
+    },
+    rewrite(ir, match) {
+        const keep = ir.resources.filter((r) => !match.removed.includes(r.logicalId));
+        return {
+            ir: { ...ir, resources: [...keep, match.added] },
+            provenance: [
+                {
+                    gitlabPath: `jobs.${match.added.logicalId}`,
+                    gitlabLogicalId: match.added.logicalId,
+                    category: "synthesis",
+                    rule: "MIG-COMPOSITE-NODEPIPELINE",
+                    note: `Recognised NodePipeline shape (${match.removed.join(", ")}) → NodePipeline composite`,
+                },
+            ],
+        };
+    },
+};
+const nodeCiPattern = {
+    name: "NodeCI",
+    match(ir) {
+        const jobs = ir.resources.filter((r) => r.type === "GitLab::CI::Job");
+        if (jobs.length !== 1)
+            return null;
+        const j = jobs[0];
+        const script = (getProp(j, "script") ?? []);
+        if (!looksLikeNodeImage(getProp(j, "image")))
+            return null;
+        const pm = detectPackageManager(script);
+        if (!hasInstallStep(script, pm))
+            return null;
+        if (!hasBuildStep(script, pm) && !hasTestStep(script, pm))
+            return null;
+        const image = getProp(j, "image") ?? "node:22";
+        const nodeVersion = image.replace(/^node:/, "") || "22";
+        return {
+            removed: [j.logicalId],
+            added: {
+                logicalId: "app",
+                type: "GitLab::Composite::NodeCI",
+                properties: {
+                    nodeVersion,
+                    packageManager: pm,
+                },
+            },
+        };
+    },
+    rewrite(ir, match) {
+        const keep = ir.resources.filter((r) => !match.removed.includes(r.logicalId));
+        return {
+            ir: { ...ir, resources: [...keep, match.added] },
+            provenance: [
+                {
+                    gitlabPath: `jobs.${match.added.logicalId}`,
+                    gitlabLogicalId: match.added.logicalId,
+                    category: "synthesis",
+                    rule: "MIG-COMPOSITE-NODECI",
+                    note: `Recognised NodeCI shape (${match.removed.join(", ")}) → NodeCI composite`,
+                },
+            ],
+        };
+    },
+};
+export const PATTERNS = [
+    // Match NodePipeline first (2 jobs); NodeCI second (single job)
+    nodePipelinePattern,
+    nodeCiPattern,
+];

package/dist/migrate/from-github/composites/rewriter.js

@@ -0,0 +1,22 @@
+/**
+ * `--use-composites` orchestrator: walks the registered patterns and
+ * applies the first match. Patterns are tried in declaration order
+ * (NodePipeline before NodeCI so the 2-job shape wins over the 1-job
+ * shape when both could match).
+ */
+import { PATTERNS } from "./patterns.js";
+export function applyComposites(ir, registry = PATTERNS) {
+    const provenance = [];
+    let current = ir;
+    for (const pattern of registry) {
+        const match = pattern.match(current);
+        if (match) {
+            const result = pattern.rewrite(current, match);
+            current = result.ir;
+            provenance.push(...result.provenance);
+            // Only one composite rewrite per migrate run (keeps semantics simple)
+            break;
+        }
+    }
+    return { ir: current, provenance };
+}

package/dist/migrate/from-github/diagnostics.js

@@ -0,0 +1,53 @@
+/**
+ * Convert ProvenanceRecord[] into LintDiagnostic[] for SARIF output.
+ *
+ * Mapping:
+ *   - category "needs-review"   → severity "warning" (or "error" if --strict)
+ *   - category "skipped"        → severity "info"
+ *   - category "action-map" tier 3 → severity "warning"
+ *   - all others                → no diagnostic (clean translation)
+ */
+export function provenanceToDiagnostics(records, opts = {}) {
+    const out = [];
+    for (const r of records) {
+        // Security records always emit a diagnostic, at their own severity
+        // (escalated to error under --strict when the property was lost or needs
+        // review), independent of the functional category.
+        if (r.security) {
+            const sev = opts.strict && (r.security.fate === "lost" || r.security.fate === "needs-review")
+                ? "error"
+                : r.security.severity;
+            out.push({
+                file: r.sourceFile ?? "<input>",
+                line: r.sourceLine ?? 1,
+                column: r.sourceColumn ?? 1,
+                ruleId: r.rule,
+                severity: sev,
+                message: r.note ?? r.rule,
+            });
+            continue;
+        }
+        let severity;
+        if (r.category === "needs-review") {
+            severity = opts.strict ? "error" : "warning";
+        }
+        else if (r.category === "skipped") {
+            severity = "info";
+        }
+        else if (r.category === "action-map" && r.mappingTier === 3) {
+            severity = "warning";
+        }
+        else {
+            continue;
+        }
+        out.push({
+            file: r.sourceFile ?? "<input>",
+            line: r.sourceLine ?? 1,
+            column: r.sourceColumn ?? 1,
+            ruleId: r.rule,
+            severity,
+            message: r.note ?? r.rule,
+        });
+    }
+    return out;
+}

package/dist/migrate/from-github/emit-yaml.js

@@ -0,0 +1,121 @@
+/**
+ * Direct GitLab TemplateIR → `.gitlab-ci.yml` text emission.
+ *
+ * We deliberately bypass the existing `gitlabSerializer.serialize()` because
+ * that path consumes `Map<string, Declarable>` (entity instances built by
+ * user TS code), not a raw IR. Going through entity instances would require
+ * runtime construction of typed objects we don't have. Direct emission is
+ * ~60 LOC.
+ */
+import { emitYAML } from "@intentius/chant/yaml";
+const RESERVED_TOP_LEVEL_ORDER = [
+    "spec",
+    "include",
+    "default",
+    "stages",
+    "variables",
+    "workflow",
+    "image",
+    "services",
+    "before_script",
+    "after_script",
+    "cache",
+    "pages",
+];
+function isReservedTopLevelKey(key) {
+    return RESERVED_TOP_LEVEL_ORDER.includes(key);
+}
+function emitKeyValue(key, value, indent) {
+    const prefix = "  ".repeat(indent);
+    if (value === null || value === undefined)
+        return `${prefix}${key}: null`;
+    if (typeof value === "boolean" || typeof value === "number")
+        return `${prefix}${key}: ${value}`;
+    if (typeof value === "string")
+        return `${prefix}${key}: ${emitYAML(value, indent + 1)}`;
+    if (Array.isArray(value)) {
+        if (value.length === 0)
+            return `${prefix}${key}: []`;
+        return `${prefix}${key}:${emitYAML(value, indent + 1)}`;
+    }
+    if (typeof value === "object") {
+        if (Object.keys(value).length === 0)
+            return `${prefix}${key}: {}`;
+        return `${prefix}${key}:${emitYAML(value, indent + 1)}`;
+    }
+    return `${prefix}${key}: ${String(value)}`;
+}
+function emitBlock(obj, indent) {
+    return Object.entries(obj)
+        .filter(([, v]) => v !== undefined)
+        .map(([k, v]) => emitKeyValue(k, v, indent))
+        .join("\n");
+}
+/**
+ * Convert a GitLab `TemplateIR` (produced by the GH→GL transformer) into
+ * `.gitlab-ci.yml` text.
+ */
+export function emitGitlabYaml(ir) {
+    const top = {};
+    // Stages from metadata
+    const meta = (ir.metadata ?? {});
+    if (Array.isArray(meta.stages) && meta.stages.length > 0) {
+        top.stages = meta.stages;
+    }
+    // Top-level variables from metadata.variables
+    if (meta.variables && typeof meta.variables === "object" && Object.keys(meta.variables).length > 0) {
+        top.variables = meta.variables;
+    }
+    // Workflow / Default / Include resources go into reserved top-level keys
+    for (const r of ir.resources) {
+        if (r.type === "GitLab::CI::Workflow") {
+            top.workflow = r.properties;
+        }
+        else if (r.type === "GitLab::CI::Default") {
+            top.default = r.properties;
+        }
+        else if (r.type === "GitLab::CI::Include") {
+            top.include = r.properties;
+        }
+    }
+    // Job resources go at the top level keyed by logicalId (kebab-cased)
+    const jobs = {};
+    for (const r of ir.resources) {
+        if (r.type === "GitLab::CI::Job") {
+            const key = r.metadata?.originalName ?? r.logicalId;
+            if (isReservedTopLevelKey(key)) {
+                // Avoid colliding with reserved keywords; prefix
+                jobs[`job-${key}`] = r.properties;
+            }
+            else {
+                jobs[key] = r.properties;
+            }
+        }
+    }
+    // Emit ordered top-level keys (reserved first, then jobs)
+    const lines = [];
+    for (const key of RESERVED_TOP_LEVEL_ORDER) {
+        if (top[key] !== undefined) {
+            lines.push(emitKeyValue(key, top[key], 0));
+        }
+    }
+    // Migration banner comment
+    if (meta.migration && typeof meta.migration === "object") {
+        const m = meta.migration;
+        if (lines.length === 0) {
+            lines.push(`# Generated by chant migrate from ${m.sourceFile ?? "(unknown)"}`);
+            lines.push("");
+        }
+        else {
+            lines.unshift("");
+            lines.unshift(`# Generated by chant migrate from ${m.sourceFile ?? "(unknown)"}`);
+        }
+    }
+    // Jobs (sorted by logicalId for determinism)
+    const jobKeys = Object.keys(jobs).sort();
+    for (const key of jobKeys) {
+        lines.push("");
+        lines.push(emitKeyValue(key, jobs[key], 0));
+    }
+    return lines.join("\n") + "\n";
+}