@intentius/chant-lexicon-gitlab 0.124.31 → 0.124.32

package/dist/lint/post-synth/wgl018.js

@@ -0,0 +1,34 @@
+/**
+ * WGL018: Missing Timeout
+ *
+ * Warns about jobs without an explicit `timeout:` setting.
+ * The default (1 hour) may be too long for most jobs.
+ */
+import { isPropertyDeclarable } from "@intentius/chant/declarable";
+export const wgl018 = {
+    id: "WGL018",
+    description: "Missing timeout — jobs without explicit timeout may run too long",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [entityName, entity] of ctx.entities) {
+            if (isPropertyDeclarable(entity))
+                continue;
+            const entityType = entity.entityType;
+            if (entityType !== "GitLab::CI::Job")
+                continue;
+            const props = entity.props;
+            if (!props)
+                continue;
+            if (!props.timeout) {
+                diagnostics.push({
+                    checkId: "WGL018",
+                    severity: "warning",
+                    message: `Job "${entityName}" has no explicit timeout — default is 1 hour which may be too long`,
+                    entity: entityName,
+                    lexicon: "gitlab",
+                });
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/wgl019.js

@@ -0,0 +1,43 @@
+/**
+ * WGL019: Missing Retry on Deploy Jobs
+ *
+ * Deploy-stage jobs should have a `retry:` strategy to handle transient
+ * infrastructure failures. This is informational, not a hard requirement.
+ */
+import { isPropertyDeclarable } from "@intentius/chant/declarable";
+const DEPLOY_STAGES = new Set(["deploy", "deployment", "release", "production", "staging"]);
+export const wgl019 = {
+    id: "WGL019",
+    description: "Missing retry — deploy jobs without retry strategy",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [entityName, entity] of ctx.entities) {
+            if (isPropertyDeclarable(entity))
+                continue;
+            const entityType = entity.entityType;
+            if (entityType !== "GitLab::CI::Job")
+                continue;
+            const props = entity.props;
+            if (!props)
+                continue;
+            const stage = props.stage;
+            if (!stage || !DEPLOY_STAGES.has(stage.toLowerCase()))
+                continue;
+            // chant #1544 — `!props.retry` treated an explicit `retry: 0` the same
+            // as no `retry` at all, warning on a job that stated its policy
+            // ("retrying a deploy without a human is deliberate") as if it hadn't.
+            // `retry: 0` is falsy but present — only an actually-absent key means
+            // "no retry strategy".
+            if (props.retry === undefined) {
+                diagnostics.push({
+                    checkId: "WGL019",
+                    severity: "info",
+                    message: `Deploy job "${entityName}" (stage: ${stage}) has no retry strategy — consider adding retry for transient failures`,
+                    entity: entityName,
+                    lexicon: "gitlab",
+                });
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/wgl020.js

@@ -0,0 +1,47 @@
+/**
+ * WGL020: Duplicate Job Names
+ *
+ * Detects multiple jobs that resolve to the same kebab-case name in
+ * the serialized YAML. GitLab silently merges duplicate keys, which
+ * causes unexpected behavior.
+ */
+import { getPrimaryOutput, topLevelKey, RESERVED_TOP_LEVEL_KEYS } from "./yaml-helpers.js";
+export function checkDuplicateJobNames(yaml) {
+    const diagnostics = [];
+    // Count occurrences of each top-level key (raw line parsing, not extractJobs,
+    // to detect actual YAML key duplication)
+    const keyCounts = new Map();
+    const lines = yaml.split("\n");
+    for (const line of lines) {
+        const name = topLevelKey(line);
+        if (name !== undefined) {
+            if (RESERVED_TOP_LEVEL_KEYS.has(name))
+                continue;
+            keyCounts.set(name, (keyCounts.get(name) ?? 0) + 1);
+        }
+    }
+    for (const [name, count] of keyCounts) {
+        if (count > 1) {
+            diagnostics.push({
+                checkId: "WGL020",
+                severity: "error",
+                message: `Duplicate job name "${name}" appears ${count} times — GitLab will silently merge these`,
+                entity: name,
+                lexicon: "gitlab",
+            });
+        }
+    }
+    return diagnostics;
+}
+export const wgl020 = {
+    id: "WGL020",
+    description: "Duplicate job names — multiple jobs resolving to same name",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [, output] of ctx.outputs) {
+            const yaml = getPrimaryOutput(output);
+            diagnostics.push(...checkDuplicateJobNames(yaml));
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/wgl021.js

@@ -0,0 +1,52 @@
+/**
+ * WGL021: Unused Variables
+ *
+ * Detects global `variables:` that are not referenced by any job script.
+ * Unused variables add noise and may indicate stale configuration.
+ */
+import { getPrimaryOutput, extractGlobalVariables, topLevelSections } from "./yaml-helpers.js";
+export function checkUnusedVariables(yaml) {
+    const diagnostics = [];
+    const globalVars = extractGlobalVariables(yaml);
+    if (globalVars.size === 0)
+        return diagnostics;
+    // Get the rest of the YAML (everything after the global variables block)
+    // to search for references
+    for (const [varName] of globalVars) {
+        // Check if $VARNAME or ${VARNAME} appears anywhere in the YAML (outside the variables block)
+        const refPattern = new RegExp(`\\$\\{?${varName}\\}?`);
+        // Also check for uses in extends, needs, etc. — search all sections
+        let found = false;
+        for (const { key, text } of topLevelSections(yaml)) {
+            // Skip the global variables section itself
+            if (key === "variables")
+                continue;
+            if (refPattern.test(text)) {
+                found = true;
+                break;
+            }
+        }
+        if (!found) {
+            diagnostics.push({
+                checkId: "WGL021",
+                severity: "warning",
+                message: `Global variable "${varName}" is not referenced in any job script`,
+                entity: varName,
+                lexicon: "gitlab",
+            });
+        }
+    }
+    return diagnostics;
+}
+export const wgl021 = {
+    id: "WGL021",
+    description: "Unused variables — global variables not referenced by any job",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [, output] of ctx.outputs) {
+            const yaml = getPrimaryOutput(output);
+            diagnostics.push(...checkUnusedVariables(yaml));
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/wgl022.js

@@ -0,0 +1,38 @@
+/**
+ * WGL022: Missing Artifacts Expiry
+ *
+ * Warns about `artifacts:` without `expire_in:`, which causes disk bloat
+ * on the GitLab instance. Default retention is "never expire" in some
+ * GitLab configurations.
+ */
+import { isPropertyDeclarable } from "@intentius/chant/declarable";
+export const wgl022 = {
+    id: "WGL022",
+    description: "Missing artifacts expiry — artifacts without expire_in cause disk bloat",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [entityName, entity] of ctx.entities) {
+            if (isPropertyDeclarable(entity))
+                continue;
+            const entityType = entity.entityType;
+            if (entityType !== "GitLab::CI::Job")
+                continue;
+            const props = entity.props;
+            if (!props?.artifacts)
+                continue;
+            const artifacts = props.artifacts;
+            // artifacts might be a Declarable with its own props
+            const artProps = artifacts.props ?? artifacts;
+            if (!artProps.expire_in && !artProps.expireIn) {
+                diagnostics.push({
+                    checkId: "WGL022",
+                    severity: "warning",
+                    message: `Job "${entityName}" has artifacts without expire_in — set an expiry to avoid disk bloat`,
+                    entity: entityName,
+                    lexicon: "gitlab",
+                });
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/wgl023.js

@@ -0,0 +1,44 @@
+/**
+ * WGL023: Overly Broad Rules
+ *
+ * Flags jobs with a single rule that has only `when: always` and no
+ * conditions (no `if:`, `changes:`, etc.). This effectively disables
+ * all pipeline filtering for the job, which is usually unintended.
+ */
+import { isPropertyDeclarable } from "@intentius/chant/declarable";
+export const wgl023 = {
+    id: "WGL023",
+    description: "Overly broad rules — job with only when: always rule (no conditions)",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [entityName, entity] of ctx.entities) {
+            if (isPropertyDeclarable(entity))
+                continue;
+            const entityType = entity.entityType;
+            if (entityType !== "GitLab::CI::Job")
+                continue;
+            const props = entity.props;
+            if (!props?.rules || !Array.isArray(props.rules))
+                continue;
+            const rules = props.rules;
+            if (rules.length !== 1)
+                continue;
+            const rule = rules[0];
+            const ruleProps = rule.props ?? rule;
+            const when = ruleProps.when;
+            const hasIf = !!ruleProps.if;
+            const hasChanges = !!ruleProps.changes;
+            const hasExists = !!ruleProps.exists;
+            if (when === "always" && !hasIf && !hasChanges && !hasExists) {
+                diagnostics.push({
+                    checkId: "WGL023",
+                    severity: "info",
+                    message: `Job "${entityName}" has a single rule with only "when: always" — this disables all pipeline filtering. Consider adding conditions or removing rules entirely.`,
+                    entity: entityName,
+                    lexicon: "gitlab",
+                });
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/wgl024.js

@@ -0,0 +1,41 @@
+/**
+ * WGL024: Manual Without allow_failure
+ *
+ * Warns about jobs with `when: manual` that don't set `allow_failure: true`.
+ * Without it, the manual job blocks the pipeline from progressing past
+ * its stage until someone manually triggers it.
+ */
+import { isPropertyDeclarable } from "@intentius/chant/declarable";
+export const wgl024 = {
+    id: "WGL024",
+    description: "Manual without allow_failure — manual jobs block pipeline without allow_failure: true",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [entityName, entity] of ctx.entities) {
+            if (isPropertyDeclarable(entity))
+                continue;
+            const entityType = entity.entityType;
+            if (entityType !== "GitLab::CI::Job")
+                continue;
+            const props = entity.props;
+            if (!props)
+                continue;
+            // Check top-level when: manual
+            const isManual = props.when === "manual";
+            if (!isManual)
+                continue;
+            // Check allow_failure
+            const allowFailure = props.allow_failure ?? props.allowFailure;
+            if (allowFailure !== true) {
+                diagnostics.push({
+                    checkId: "WGL024",
+                    severity: "warning",
+                    message: `Job "${entityName}" has when: manual but no allow_failure: true — this will block the pipeline`,
+                    entity: entityName,
+                    lexicon: "gitlab",
+                });
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/wgl025.js

@@ -0,0 +1,42 @@
+/**
+ * WGL025: Missing Cache Key
+ *
+ * Warns about `cache:` without `key:`. Without an explicit key, GitLab
+ * uses `default` as the key, which causes cache collisions between
+ * unrelated jobs sharing the same runner.
+ */
+import { isPropertyDeclarable } from "@intentius/chant/declarable";
+export const wgl025 = {
+    id: "WGL025",
+    description: "Missing cache key — cache without key causes collisions",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [entityName, entity] of ctx.entities) {
+            if (isPropertyDeclarable(entity))
+                continue;
+            const entityType = entity.entityType;
+            if (entityType !== "GitLab::CI::Job")
+                continue;
+            const props = entity.props;
+            if (!props?.cache)
+                continue;
+            // Cache can be a single object or an array
+            const caches = Array.isArray(props.cache) ? props.cache : [props.cache];
+            for (const cache of caches) {
+                const cacheObj = cache;
+                const cacheProps = cacheObj.props ?? cacheObj;
+                if (!cacheProps.key) {
+                    diagnostics.push({
+                        checkId: "WGL025",
+                        severity: "warning",
+                        message: `Job "${entityName}" has cache without a key — this causes cache collisions between jobs`,
+                        entity: entityName,
+                        lexicon: "gitlab",
+                    });
+                    break; // One diagnostic per job is enough
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/wgl026.js

@@ -0,0 +1,58 @@
+/**
+ * WGL026: Privileged Services Without TLS
+ *
+ * Warns about Docker-in-Docker (DinD) services that don't set
+ * DOCKER_TLS_CERTDIR. Running DinD without TLS exposes the Docker
+ * daemon on an unencrypted socket.
+ */
+import { isPropertyDeclarable } from "@intentius/chant/declarable";
+const DIND_IMAGES = ["docker:dind", "docker:stable-dind"];
+function isDindImage(image) {
+    return DIND_IMAGES.some((dind) => image.includes(dind));
+}
+export const wgl026 = {
+    id: "WGL026",
+    description: "Privileged services without TLS — DinD services without DOCKER_TLS_CERTDIR",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [entityName, entity] of ctx.entities) {
+            if (isPropertyDeclarable(entity))
+                continue;
+            const entityType = entity.entityType;
+            if (entityType !== "GitLab::CI::Job")
+                continue;
+            const props = entity.props;
+            if (!props?.services || !Array.isArray(props.services))
+                continue;
+            for (const service of props.services) {
+                let imageName;
+                let serviceVars;
+                if (typeof service === "string") {
+                    imageName = service;
+                }
+                else if (typeof service === "object" && service !== null) {
+                    const svc = service;
+                    const svcProps = svc.props ?? svc;
+                    imageName = svcProps.name;
+                    serviceVars = svcProps.variables;
+                }
+                if (!imageName || !isDindImage(imageName))
+                    continue;
+                // Check if DOCKER_TLS_CERTDIR is set in service variables or job variables
+                const jobVars = props.variables;
+                const hasTLS = serviceVars?.DOCKER_TLS_CERTDIR !== undefined ||
+                    jobVars?.DOCKER_TLS_CERTDIR !== undefined;
+                if (!hasTLS) {
+                    diagnostics.push({
+                        checkId: "WGL026",
+                        severity: "warning",
+                        message: `Job "${entityName}" uses DinD service without DOCKER_TLS_CERTDIR — the Docker daemon will be unencrypted`,
+                        entity: entityName,
+                        lexicon: "gitlab",
+                    });
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/wgl027.js

@@ -0,0 +1,49 @@
+/**
+ * WGL027: Empty Script
+ *
+ * Detects jobs with `script: []` or scripts containing only empty strings.
+ * GitLab rejects jobs with empty scripts at pipeline validation time.
+ */
+import { isPropertyDeclarable } from "@intentius/chant/declarable";
+export const wgl027 = {
+    id: "WGL027",
+    description: "Empty script — jobs with empty or blank script entries",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [entityName, entity] of ctx.entities) {
+            if (isPropertyDeclarable(entity))
+                continue;
+            const entityType = entity.entityType;
+            if (entityType !== "GitLab::CI::Job")
+                continue;
+            const props = entity.props;
+            if (!props)
+                continue;
+            const script = props.script;
+            if (script === undefined || script === null)
+                continue;
+            let isEmpty = false;
+            if (Array.isArray(script)) {
+                if (script.length === 0) {
+                    isEmpty = true;
+                }
+                else if (script.every((s) => typeof s === "string" && s.trim() === "")) {
+                    isEmpty = true;
+                }
+            }
+            else if (typeof script === "string" && script.trim() === "") {
+                isEmpty = true;
+            }
+            if (isEmpty) {
+                diagnostics.push({
+                    checkId: "WGL027",
+                    severity: "error",
+                    message: `Job "${entityName}" has an empty script — GitLab will reject this pipeline`,
+                    entity: entityName,
+                    lexicon: "gitlab",
+                });
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/wgl028.js

@@ -0,0 +1,58 @@
+/**
+ * WGL028: Redundant Needs
+ *
+ * Detects `needs:` entries that list jobs already implied by stage ordering.
+ * While not incorrect, redundant needs add noise and make the pipeline
+ * harder to maintain. This is informational only.
+ */
+import { getPrimaryOutput, extractStages, extractJobs } from "./yaml-helpers.js";
+export function checkRedundantNeeds(yaml) {
+    const diagnostics = [];
+    const stages = extractStages(yaml);
+    if (stages.length === 0)
+        return diagnostics;
+    const stageIndex = new Map();
+    for (let i = 0; i < stages.length; i++) {
+        stageIndex.set(stages[i], i);
+    }
+    const jobs = extractJobs(yaml);
+    for (const [jobName, job] of jobs) {
+        if (!job.needs || !job.stage)
+            continue;
+        const jobStageIdx = stageIndex.get(job.stage);
+        if (jobStageIdx === undefined)
+            continue;
+        for (const need of job.needs) {
+            const neededJob = jobs.get(need);
+            if (!neededJob?.stage)
+                continue;
+            const needStageIdx = stageIndex.get(neededJob.stage);
+            if (needStageIdx === undefined)
+                continue;
+            // If the needed job is in an earlier stage, it's already implied
+            // by GitLab's default stage-based ordering
+            if (needStageIdx < jobStageIdx) {
+                diagnostics.push({
+                    checkId: "WGL028",
+                    severity: "info",
+                    message: `Job "${jobName}" lists "${need}" in needs: but it's already in an earlier stage (${neededJob.stage} → ${job.stage})`,
+                    entity: jobName,
+                    lexicon: "gitlab",
+                });
+            }
+        }
+    }
+    return diagnostics;
+}
+export const wgl028 = {
+    id: "WGL028",
+    description: "Redundant needs — needs listing jobs already implied by stage ordering",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [, output] of ctx.outputs) {
+            const yaml = getPrimaryOutput(output);
+            diagnostics.push(...checkRedundantNeeds(yaml));
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/wgl029.js

@@ -0,0 +1,55 @@
+/**
+ * WGL029: Unpinned include:project / component Reference
+ *
+ * Flags an `include:project` or CI/CD `component:` resolved by a moving ref — a
+ * branch, no `ref:` at all (defaults to the project's default branch), or a
+ * floating component version — instead of a pinned tag or commit SHA. A
+ * repointed ref turns the included configuration into a supply-chain entry point.
+ */
+import { getPrimaryOutput, extractIncludes, isPinnedRef } from "./yaml-helpers.js";
+export const wgl029 = {
+    id: "WGL029",
+    description: "include:project / component resolved by a moving ref instead of a pinned tag or SHA",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [, output] of ctx.outputs) {
+            const yaml = getPrimaryOutput(output);
+            for (const entry of extractIncludes(yaml)) {
+                if (entry.kind === "project") {
+                    if (!entry.ref) {
+                        diagnostics.push({
+                            checkId: "WGL029",
+                            severity: "warning",
+                            message: `include:project "${entry.value}" has no ref: and resolves to the project's default branch (a moving target). Pin it to a tag or commit SHA.`,
+                            entity: entry.value,
+                            lexicon: "gitlab",
+                        });
+                    }
+                    else if (!isPinnedRef(entry.ref)) {
+                        diagnostics.push({
+                            checkId: "WGL029",
+                            severity: "warning",
+                            message: `include:project "${entry.value}" is pinned to the moving ref "${entry.ref}". Pin it to a tag or commit SHA.`,
+                            entity: entry.value,
+                            lexicon: "gitlab",
+                        });
+                    }
+                }
+                else if (entry.kind === "component") {
+                    const at = entry.value.lastIndexOf("@");
+                    const version = at === -1 ? "" : entry.value.slice(at + 1);
+                    if (!version || !isPinnedRef(version)) {
+                        diagnostics.push({
+                            checkId: "WGL029",
+                            severity: "warning",
+                            message: `component "${entry.value}" uses ${version ? `the moving version "${version}"` : "no pinned version"}. Pin it to a released version tag or commit SHA.`,
+                            entity: entry.value,
+                            lexicon: "gitlab",
+                        });
+                    }
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/wgl030.js

@@ -0,0 +1,43 @@
+/**
+ * WGL030: Mutable or Insecure include:remote
+ *
+ * Flags `include:remote` URLs that are fetched over HTTP (no transport
+ * integrity) or over HTTPS but inherently mutable (a raw URL can be repointed
+ * at any time). Prefer `include:project` pinned to a tag/SHA, or a pinned
+ * component, over a remote URL. Generalizes WGL017 (non-HTTPS) to includes.
+ */
+import { getPrimaryOutput, extractIncludes } from "./yaml-helpers.js";
+export const wgl030 = {
+    id: "WGL030",
+    description: "include:remote is insecure (HTTP) or mutable",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [, output] of ctx.outputs) {
+            const yaml = getPrimaryOutput(output);
+            for (const entry of extractIncludes(yaml)) {
+                const isRemote = entry.kind === "remote" || (entry.kind === "string" && /^https?:\/\//.test(entry.value));
+                if (!isRemote)
+                    continue;
+                if (/^http:\/\//.test(entry.value)) {
+                    diagnostics.push({
+                        checkId: "WGL030",
+                        severity: "error",
+                        message: `include:remote "${entry.value}" is fetched over HTTP — an attacker on the network can swap the included config. Use HTTPS, and prefer a pinned include:project or component.`,
+                        entity: entry.value,
+                        lexicon: "gitlab",
+                    });
+                }
+                else {
+                    diagnostics.push({
+                        checkId: "WGL030",
+                        severity: "warning",
+                        message: `include:remote "${entry.value}" is a mutable URL — its contents can change after review. Prefer include:project pinned to a tag/SHA, or a pinned component.`,
+                        entity: entry.value,
+                        lexicon: "gitlab",
+                    });
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/wgl031.js

@@ -0,0 +1,33 @@
+/**
+ * WGL031: Container Image Without an Immutable Digest
+ *
+ * Flags `image:` and `services:` references that are not pinned to an immutable
+ * `@sha256:` digest. A mutable tag can be repointed to a different image after
+ * review. Images built from a variable (e.g. `$CI_REGISTRY_IMAGE:tag`) are
+ * skipped — their concrete reference is not knowable from the static config.
+ */
+import { getPrimaryOutput, extractImageRefs } from "./yaml-helpers.js";
+export const wgl031 = {
+    id: "WGL031",
+    description: "Container image not pinned to an immutable digest",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [, output] of ctx.outputs) {
+            const yaml = getPrimaryOutput(output);
+            for (const { job, image, source } of extractImageRefs(yaml)) {
+                if (image.includes("@sha256:"))
+                    continue;
+                if (image.includes("$"))
+                    continue; // variable-based reference — not statically knowable
+                diagnostics.push({
+                    checkId: "WGL031",
+                    severity: "warning",
+                    message: `Job "${job}" ${source === "service" ? "service image" : "image"} "${image}" is not pinned to a digest — reference it by @sha256:... so the image cannot change after review.`,
+                    entity: job,
+                    lexicon: "gitlab",
+                });
+            }
+        }
+        return diagnostics;
+    },
+};