@intentius/chant-lexicon-gitlab 0.124.31 → 0.124.33

package/dist/serializer.js

@@ -0,0 +1,197 @@
+/**
+ * GitLab CI YAML serializer.
+ *
+ * Converts Chant declarables to .gitlab-ci.yml YAML output.
+ * Uses snake_case keys (GitLab CI convention) and produces
+ * valid YAML without a library dependency — the CI schema is
+ * simple enough for a direct emitter.
+ */
+import { isPropertyDeclarable, isResourceDeclarable } from "@intentius/chant/declarable";
+import { walkValue } from "@intentius/chant/serializer-walker";
+import { INTRINSIC_MARKER } from "@intentius/chant/intrinsic";
+import { emitYAMLEntry } from "@intentius/chant/yaml";
+/**
+ * `#` lines for a comment, one per line of the string (#3669). Only the file
+ * header and job comments exist, and both sit at column 0.
+ */
+function commentLines(comment) {
+    return comment.split("\n").map((l) => `#${l.trimEnd() ? ` ${l.trimEnd()}` : ""}`).join("\n");
+}
+/** An entity's props without `comment`, and the comment if it is a non-empty string. */
+function splitComment(entity) {
+    const props = isResourceDeclarable(entity) ? entity.props : undefined;
+    if (!props || !("comment" in props))
+        return { props };
+    const { comment, ...rest } = props;
+    return { props: rest, comment: typeof comment === "string" && comment !== "" ? comment : undefined };
+}
+/**
+ * GitLab CI visitor for the generic serializer walker.
+ */
+function gitlabVisitor(entityNames) {
+    return {
+        attrRef: (name, _attr) => name,
+        resourceRef: (name) => name.replace(/([a-z0-9])([A-Z])/g, "$1-$2").toLowerCase(),
+        propertyDeclarable: (entity, walk) => {
+            if (!isResourceDeclarable(entity) || typeof entity.props !== "object" || entity.props === null) {
+                return undefined;
+            }
+            const props = entity.props;
+            const result = {};
+            for (const [key, value] of Object.entries(props)) {
+                if (value !== undefined) {
+                    result[key] = walk(value);
+                }
+            }
+            return Object.keys(result).length > 0 ? result : undefined;
+        },
+    };
+}
+/**
+ * Pre-process values to convert intrinsics to their YAML representation
+ * before the walker (which would call toJSON instead of toYAML).
+ *
+ * IMPORTANT: Must not touch Declarable objects — their identity markers
+ * (DECLARABLE_MARKER, entityType, kind, props) are non-enumerable and
+ * would be stripped by Object.entries(), producing empty `{}` output.
+ */
+function preprocessIntrinsics(value) {
+    if (value === null || value === undefined)
+        return value;
+    if (typeof value === "object" && INTRINSIC_MARKER in value) {
+        if ("toYAML" in value && typeof value.toYAML === "function") {
+            return value.toYAML();
+        }
+    }
+    // Leave Declarables untouched — the walker handles them
+    if (typeof value === "object" && value !== null && "entityType" in value) {
+        return value;
+    }
+    if (Array.isArray(value)) {
+        return value.map(preprocessIntrinsics);
+    }
+    if (typeof value === "object") {
+        const result = {};
+        for (const [k, v] of Object.entries(value)) {
+            result[k] = preprocessIntrinsics(v);
+        }
+        return result;
+    }
+    return value;
+}
+/**
+ * Convert a value to YAML-compatible form using the walker.
+ */
+function toYAMLValue(value, entityNames) {
+    const preprocessed = preprocessIntrinsics(value);
+    return walkValue(preprocessed, entityNames, gitlabVisitor(entityNames));
+}
+/**
+ * GitLab CI YAML serializer implementation.
+ */
+export const gitlabSerializer = {
+    name: "gitlab",
+    rulePrefix: "WGL",
+    serialize(entities, _outputs) {
+        // Build reverse map: entity → name
+        const entityNames = new Map();
+        for (const [name, entity] of entities) {
+            entityNames.set(entity, name);
+        }
+        const sections = [];
+        // Separate entities by type
+        const jobs = [];
+        const pipelines = [];
+        const defaults = [];
+        const workflows = [];
+        const others = [];
+        for (const [name, entity] of entities) {
+            if (isPropertyDeclarable(entity))
+                continue; // Skip property-only entities
+            const entityType = entity.entityType;
+            if (entityType === "GitLab::CI::Job") {
+                jobs.push([name, entity]);
+            }
+            else if (entityType === "GitLab::CI::Default") {
+                defaults.push([name, entity]);
+            }
+            else if (entityType === "GitLab::CI::Workflow") {
+                workflows.push([name, entity]);
+            }
+            else if (entityType === "GitLab::CI::Pipeline") {
+                pipelines.push([name, entity]);
+            }
+            else {
+                others.push([name, entity]);
+            }
+        }
+        // The Pipeline entity's top-level keys (#3669). More than one is merged
+        // in declaration order: comments joined, includes concatenated, stages
+        // in first-listed order, later variables overriding earlier ones.
+        const headers = [];
+        const includes = [];
+        const declaredStages = [];
+        let variables;
+        for (const [, entity] of pipelines) {
+            const { props, comment } = splitComment(entity);
+            if (comment)
+                headers.push(comment);
+            const converted = toYAMLValue(props, entityNames);
+            if (!converted)
+                continue;
+            if (converted.include !== undefined) {
+                includes.push(...(Array.isArray(converted.include) ? converted.include : [converted.include]));
+            }
+            if (Array.isArray(converted.stages))
+                declaredStages.push(...converted.stages.map(String));
+            if (converted.variables && typeof converted.variables === "object") {
+                variables = { ...variables, ...converted.variables };
+            }
+        }
+        if (headers.length > 0)
+            sections.push(commentLines(headers.join("\n\n")));
+        if (includes.length > 0)
+            sections.push(emitYAMLEntry("include", includes));
+        // Stages: a Pipeline's explicit list first, in its order, then any stage
+        // a job names that the list leaves out, in first use. Without a list,
+        // that is the jobs' stages alone.
+        const stages = new Set(declaredStages);
+        for (const [, entity] of jobs) {
+            const props = isResourceDeclarable(entity) ? entity.props : undefined;
+            if (props?.stage && typeof props.stage === "string") {
+                stages.add(props.stage);
+            }
+        }
+        if (stages.size > 0) {
+            sections.push(emitYAMLEntry("stages", [...stages]));
+        }
+        if (variables && Object.keys(variables).length > 0)
+            sections.push(emitYAMLEntry("variables", variables));
+        // Emit defaults
+        for (const [, entity] of defaults) {
+            const converted = toYAMLValue((isResourceDeclarable(entity) ? entity.props : undefined), entityNames);
+            if (converted) {
+                sections.push(emitYAMLEntry("default", converted));
+            }
+        }
+        // Emit workflow
+        for (const [, entity] of workflows) {
+            const converted = toYAMLValue((isResourceDeclarable(entity) ? entity.props : undefined), entityNames);
+            if (converted) {
+                sections.push(emitYAMLEntry("workflow", converted));
+            }
+        }
+        // Emit jobs
+        for (const [name, entity] of jobs) {
+            const { props, comment } = splitComment(entity);
+            const converted = toYAMLValue(props, entityNames);
+            if (converted) {
+                // Convert job name from camelCase to kebab-case for YAML
+                const yamlName = name.replace(/([a-z0-9])([A-Z])/g, "$1-$2").toLowerCase();
+                const entry = emitYAMLEntry(yamlName, converted);
+                sections.push(comment ? `${commentLines(comment)}\n${entry}` : entry);
+            }
+        }
+        return sections.join("\n\n") + "\n";
+    },
+};

package/dist/testdata/create-fixture.js

@@ -0,0 +1,40 @@
+#!/usr/bin/env tsx
+/**
+ * Script to create a minimal CI schema fixture for tests.
+ * Run once: npx tsx src/testdata/create-fixture.ts
+ */
+import { readFileSync, writeFileSync } from "fs";
+import { homedir } from "os";
+import { join } from "path";
+const schema = JSON.parse(readFileSync(join(homedir(), ".chant", "gitlab-ci-schema.json"), "utf-8"));
+const neededDefs = [
+    "job_template", "image", "services", "artifacts", "cache_item",
+    "rules", "retry", "allow_failure", "parallel", "include_item",
+    "when", "retry_errors", "workflowAutoCancel",
+    "before_script", "after_script", "script", "optional_script",
+    "globalVariables", "jobVariables", "rulesVariables",
+    "id_tokens", "secrets", "timeout", "start_in",
+];
+const defs = {};
+for (const name of neededDefs) {
+    if (schema.definitions?.[name]) {
+        defs[name] = schema.definitions[name];
+    }
+}
+const keepProps = ["default", "workflow", "stages", "variables", "include"];
+const filteredProps = {};
+for (const key of keepProps) {
+    if (schema.properties?.[key])
+        filteredProps[key] = schema.properties[key];
+}
+const minimal = {
+    definitions: defs,
+    properties: filteredProps,
+    patternProperties: schema.patternProperties || {},
+    required: schema.required || [],
+};
+const outPath = join(import.meta.dirname, "ci-schema-fixture.json");
+writeFileSync(outPath, JSON.stringify(minimal, null, 2));
+console.log(`Fixture written to ${outPath}`);
+console.log(`Definitions: ${Object.keys(defs).length}`);
+console.log(`Missing: ${neededDefs.filter(n => !defs[n]).join(", ") || "none"}`);

package/dist/testdata/load-fixtures.js

@@ -0,0 +1,20 @@
+/**
+ * Test fixture loader for the GitLab CI lexicon.
+ */
+import { readFileSync } from "fs";
+import { join } from "path";
+/**
+ * Load the minimal CI schema fixture for offline testing.
+ */
+export function loadSchemaFixture() {
+    const fixturePath = join(import.meta.dirname, "ci-schema-fixture.json");
+    return Buffer.from(readFileSync(fixturePath));
+}
+/**
+ * Load the schema fixture as a Map compatible with generatePipeline.
+ */
+export function loadSchemaFixtureMap() {
+    const schemas = new Map();
+    schemas.set("GitLab::CI::Pipeline", loadSchemaFixture());
+    return schemas;
+}

package/dist/validate-cli.js

@@ -0,0 +1,16 @@
+#!/usr/bin/env tsx
+/**
+ * Thin entry point for `npm run validate` in lexicon-gitlab.
+ */
+import { validate } from "./validate.js";
+const result = await validate();
+for (const check of result.checks) {
+    const status = check.ok ? "OK" : "FAIL";
+    const msg = check.error ? ` — ${check.error}` : "";
+    console.error(`  [${status}] ${check.name}${msg}`);
+}
+if (!result.success) {
+    console.error("Validation failed");
+    process.exit(1);
+}
+console.error("All validation checks passed.");

package/dist/validate.js

@@ -0,0 +1,29 @@
+/**
+ * Validate generated lexicon-gitlab artifacts.
+ *
+ * Thin wrapper around the core validation framework
+ * with GitLab-specific configuration.
+ */
+import { dirname } from "path";
+import { fileURLToPath } from "url";
+import { validateLexiconArtifacts } from "@intentius/chant/codegen/validate";
+const REQUIRED_NAMES = [
+    "Job", "Default", "Workflow",
+    "Artifacts", "Cache", "Image", "Service", "Rule", "Retry",
+    "AllowFailure", "Parallel", "Include", "Release",
+    "Environment", "Trigger", "AutoCancel",
+    "WorkflowRule", "Need", "Inherit",
+];
+/**
+ * Validate the generated lexicon-gitlab artifacts.
+ *
+ * @param opts.basePath - Override the package directory (defaults to lexicon-gitlab package root)
+ */
+export async function validate(opts) {
+    const basePath = opts?.basePath ?? dirname(dirname(fileURLToPath(import.meta.url)));
+    return validateLexiconArtifacts({
+        lexiconJsonFilename: "lexicon-gitlab.json",
+        requiredNames: REQUIRED_NAMES,
+        basePath,
+    });
+}

package/dist/variables.js

@@ -0,0 +1,30 @@
+/**
+ * GitLab CI/CD predefined variable references.
+ *
+ * These expand to $CI_* variable strings in the serialized YAML.
+ * Provided for type-safe access and autocompletion.
+ */
+export const CI = {
+    CommitBranch: "$CI_COMMIT_BRANCH",
+    CommitRef: "$CI_COMMIT_REF_NAME",
+    CommitRefSlug: "$CI_COMMIT_REF_SLUG",
+    CommitSha: "$CI_COMMIT_SHA",
+    CommitTag: "$CI_COMMIT_TAG",
+    DefaultBranch: "$CI_DEFAULT_BRANCH",
+    Environment: "$CI_ENVIRONMENT_NAME",
+    EnvironmentSlug: "$CI_ENVIRONMENT_SLUG",
+    JobId: "$CI_JOB_ID",
+    JobName: "$CI_JOB_NAME",
+    JobStage: "$CI_JOB_STAGE",
+    MergeRequestIid: "$CI_MERGE_REQUEST_IID",
+    PipelineId: "$CI_PIPELINE_ID",
+    PipelineSource: "$CI_PIPELINE_SOURCE",
+    ProjectDir: "$CI_PROJECT_DIR",
+    ProjectId: "$CI_PROJECT_ID",
+    ProjectName: "$CI_PROJECT_NAME",
+    ProjectPath: "$CI_PROJECT_PATH",
+    Registry: "$CI_REGISTRY",
+    RegistryImage: "$CI_REGISTRY_IMAGE",
+    RegistryUser: "$CI_REGISTRY_USER",
+    RegistryPassword: "$CI_REGISTRY_PASSWORD",
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-gitlab",
-  "version": "0.124.31",
+  "version": "0.124.33",
   "description": "GitLab CI lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -32,22 +32,22 @@
     ".": {
       "development": "./src/index.ts",
       "types": "./dist/index.d.ts",
-      "default": "./src/index.ts"
+      "default": "./dist/index.js"
     },
     "./*": {
       "development": "./src/*.ts",
       "types": "./dist/*.d.ts",
-      "default": "./src/*.ts"
+      "default": "./dist/*.js"
     },
     "./lint/post-synth": {
       "development": "./src/lint/post-synth/index.ts",
       "types": "./dist/lint/post-synth/index.d.ts",
-      "default": "./src/lint/post-synth/index.ts"
+      "default": "./dist/lint/post-synth/index.js"
     },
     "./op/activities": {
       "development": "./src/op/activities/index.ts",
       "types": "./dist/op/activities/index.d.ts",
-      "default": "./src/op/activities/index.ts"
+      "default": "./dist/op/activities/index.js"
     },
     "./manifest": "./dist/manifest.json",
     "./meta": "./dist/meta.json",
@@ -59,7 +59,7 @@
     "validate": "tsx src/validate-cli.ts",
     "docs": "tsx src/codegen/docs-cli.ts",
     "prepack": "npm run generate && npm run bundle && npm run validate && npm run build",
-    "build": "../../scripts/tsc7.sh -p tsconfig.build.json && tsc-alias -p tsconfig.build.json && find dist -type f \\( -name \"*.js\" -o -name \"*.js.map\" \\) -delete"
+    "build": "../../scripts/tsc7.sh -p tsconfig.build.json --sourceMap false && tsc-alias -p tsconfig.build.json"
   },
   "devDependencies": {
     "@intentius/chant": "*",
@@ -67,8 +67,8 @@
     "typescript": "^5.9.3"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.124.31",
-    "@intentius/chant-lexicon-github": "^0.124.31"
+    "@intentius/chant": "^0.124.33",
+    "@intentius/chant-lexicon-github": "^0.124.33"
   },
   "peerDependenciesMeta": {
     "@intentius/chant-lexicon-github": {

package/src/codegen/fetch.ts

@@ -6,7 +6,7 @@
 import { join, dirname } from "path";
 import { homedir } from "os";
 import { readFileSync, writeFileSync } from "fs";
-import { fileURLToPath } from "url";
+import { moduleSourceDir } from "@intentius/chant/module-source";
 import { fetchWithCache, clearCacheFile } from "@intentius/chant/codegen/fetch";
 
 /**
@@ -41,7 +41,7 @@ export function getCachePath(): string {
  * committed copy is equivalent and network-free.
  */
 export function getVendoredSchemaPath(): string {
-  return join(dirname(fileURLToPath(import.meta.url)), "vendored", "gitlab-ci-schema.json");
+  return join(moduleSourceDir(import.meta.url), "vendored", "gitlab-ci-schema.json");
 }
 
 /**

package/src/codegen/package.ts

@@ -6,7 +6,7 @@
 import { readFileSync } from "fs";
 import { gitlabPlugin } from "../plugin";
 import { join, dirname } from "path";
-import { fileURLToPath } from "url";
+import { moduleSourceDir } from "@intentius/chant/module-source";
 import type { IntrinsicDef } from "@intentius/chant/lexicon";
 import {
   packagePipeline,
@@ -18,7 +18,7 @@ import { generate } from "./generate";
 
 export type { PackageOptions, PackageResult };
 
-const pkgDir = dirname(dirname(fileURLToPath(import.meta.url)));
+const pkgDir = dirname(moduleSourceDir(import.meta.url));
 
 /**
  * Package the GitLab lexicon into a distributable BundleSpec.

package/src/components/__fixtures__/pr-loop-build.gitlab.golden.yml

@@ -24,7 +24,7 @@ plan:
     - command -v tofu >/dev/null 2>&1 || (curl -fsSL https://get.opentofu.org/install-opentofu.sh -o /tmp/install-opentofu.sh && sh /tmp/install-opentofu.sh --install-method standalone)
     - chant build --env prod
     - chant lint
-    - chant components pr-plan --base "$BASE_SHA" --pr "$PR_NUMBER" --env prod --gate pr-apply --output .chant/pr --forge gitlab
+    - chant ci run plan --in-place --no-push --base "$BASE_SHA" --pr "$PR_NUMBER" --env prod --gate pr-apply --forge gitlab
   artifacts:
     when: always
     paths:
@@ -40,10 +40,10 @@ apply:
     BASE_SHA: '$CI_COMMIT_BEFORE_SHA'
   script:
     - command -v tofu >/dev/null 2>&1 || (curl -fsSL https://get.opentofu.org/install-opentofu.sh -o /tmp/install-opentofu.sh && sh /tmp/install-opentofu.sh --install-method standalone)
-    - if [ -z "$BASE_SHA" ] || [ "$BASE_SHA" = "0000000000000000000000000000000000000000" ]; then BASE_SHA="${CI_MERGE_REQUEST_DIFF_BASE_SHA:-}"; if [ -z "$BASE_SHA" ]; then git fetch origin $CI_DEFAULT_BRANCH && BASE_SHA="$(git merge-base FETCH_HEAD "$CI_COMMIT_SHA")"; if [ "$BASE_SHA" = "$CI_COMMIT_SHA" ]; then BASE_SHA="$(git rev-parse "$CI_COMMIT_SHA^")"; fi; fi; fi; export BASE_SHA
+    - if [ -z "$BASE_SHA" ] || [ "$BASE_SHA" = "0000000000000000000000000000000000000000" ]; then BASE_SHA="${CI_MERGE_REQUEST_DIFF_BASE_SHA:-}"; if [ -z "$BASE_SHA" ]; then git fetch origin $CI_DEFAULT_BRANCH && BASE_SHA="$(git merge-base FETCH_HEAD "$CI_COMMIT_SHA")"; if [ "$BASE_SHA" = "$CI_COMMIT_SHA" ]; then BASE_SHA="$(git rev-parse --verify --quiet "$CI_COMMIT_SHA^" || echo 4b825dc642cb6eb9a060e54bf8d69288fbee4904)"; fi; fi; fi; export BASE_SHA
     - chant build --env prod
     - chant lint
-    - chant components pr-apply --base "$BASE_SHA" --env prod --gate pr-apply --output .chant/pr --forge gitlab --require-review --resume .chant/pr-resume/pr-apply.json
+    - chant ci run apply --in-place --base "$BASE_SHA" --env prod --gate pr-apply --forge gitlab
   cache:
     key: chant-apply-prod-$CI_COMMIT_SHA
     paths:

package/src/components/__fixtures__/pr-loop-record.gitlab.golden.yml

@@ -0,0 +1,46 @@
+workflow:
+  name: chant-pr-prod
+  rules:
+    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
+    - if: '$CI_PIPELINE_SOURCE == "push" && $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'
+
+stages:
+  - plan
+  - record
+
+variables:
+  CHANT_ENV: prod
+  GIT_DEPTH: '0'
+
+plan:
+  stage: plan
+  image: node:22
+  rules:
+    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
+  variables:
+    BASE_SHA: '$CI_MERGE_REQUEST_DIFF_BASE_SHA'
+    PR_NUMBER: '$CI_MERGE_REQUEST_IID'
+  script:
+    - command -v tofu >/dev/null 2>&1 || (curl -fsSL https://get.opentofu.org/install-opentofu.sh -o /tmp/install-opentofu.sh && sh /tmp/install-opentofu.sh --install-method standalone)
+    - chant ci run plan --in-place --no-push --base "$BASE_SHA" --pr "$PR_NUMBER" --env prod --gate pr-apply --forge gitlab
+  artifacts:
+    when: always
+    paths:
+      - .chant/pr
+
+record:
+  stage: record
+  image: node:22
+  resource_group: chant-record-prod
+  rules:
+    - if: '$CI_PIPELINE_SOURCE == "push" && $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'
+  variables:
+    BASE_SHA: '$CI_COMMIT_BEFORE_SHA'
+  script:
+    - command -v tofu >/dev/null 2>&1 || (curl -fsSL https://get.opentofu.org/install-opentofu.sh -o /tmp/install-opentofu.sh && sh /tmp/install-opentofu.sh --install-method standalone)
+    - if [ -z "$BASE_SHA" ] || [ "$BASE_SHA" = "0000000000000000000000000000000000000000" ]; then BASE_SHA="${CI_MERGE_REQUEST_DIFF_BASE_SHA:-}"; if [ -z "$BASE_SHA" ]; then git fetch origin $CI_DEFAULT_BRANCH && BASE_SHA="$(git merge-base FETCH_HEAD "$CI_COMMIT_SHA")"; if [ "$BASE_SHA" = "$CI_COMMIT_SHA" ]; then BASE_SHA="$(git rev-parse --verify --quiet "$CI_COMMIT_SHA^" || echo 4b825dc642cb6eb9a060e54bf8d69288fbee4904)"; fi; fi; fi; export BASE_SHA
+    - chant ci run record --in-place --base "$BASE_SHA" --env prod --gate pr-apply --forge gitlab
+  artifacts:
+    when: always
+    paths:
+      - .chant/pr

package/src/components/__fixtures__/pr-loop-waves.gitlab.golden.yml

@@ -0,0 +1,101 @@
+workflow:
+  name: chant-pr-prod
+  rules:
+    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
+    - if: '$CI_PIPELINE_SOURCE == "push" && $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'
+
+stages:
+  - plan
+  - apply-wave-1
+  - apply-wave-2
+  - apply-wave-3
+
+variables:
+  CHANT_ENV: prod
+  GIT_DEPTH: '0'
+
+plan:
+  stage: plan
+  image: node:22
+  rules:
+    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
+  variables:
+    BASE_SHA: '$CI_MERGE_REQUEST_DIFF_BASE_SHA'
+    PR_NUMBER: '$CI_MERGE_REQUEST_IID'
+  script:
+    - command -v tofu >/dev/null 2>&1 || (curl -fsSL https://get.opentofu.org/install-opentofu.sh -o /tmp/install-opentofu.sh && sh /tmp/install-opentofu.sh --install-method standalone)
+    - chant ci run plan --in-place --no-push --base "$BASE_SHA" --pr "$PR_NUMBER" --env prod --gate pr-apply --forge gitlab --wave-gate release
+  artifacts:
+    when: always
+    paths:
+      - .chant/pr
+
+apply-wave-1:
+  stage: apply-wave-1
+  image: node:22
+  resource_group: chant-apply-prod
+  rules:
+    - if: '$CI_PIPELINE_SOURCE == "push" && $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'
+  variables:
+    BASE_SHA: '$CI_COMMIT_BEFORE_SHA'
+  script:
+    - command -v tofu >/dev/null 2>&1 || (curl -fsSL https://get.opentofu.org/install-opentofu.sh -o /tmp/install-opentofu.sh && sh /tmp/install-opentofu.sh --install-method standalone)
+    - if [ -z "$BASE_SHA" ] || [ "$BASE_SHA" = "0000000000000000000000000000000000000000" ]; then BASE_SHA="${CI_MERGE_REQUEST_DIFF_BASE_SHA:-}"; if [ -z "$BASE_SHA" ]; then git fetch origin $CI_DEFAULT_BRANCH && BASE_SHA="$(git merge-base FETCH_HEAD "$CI_COMMIT_SHA")"; if [ "$BASE_SHA" = "$CI_COMMIT_SHA" ]; then BASE_SHA="$(git rev-parse --verify --quiet "$CI_COMMIT_SHA^" || echo 4b825dc642cb6eb9a060e54bf8d69288fbee4904)"; fi; fi; fi; export BASE_SHA
+    - chant ci run apply --in-place --base "$BASE_SHA" --env prod --gate pr-apply --forge gitlab --wave-gate release --wave 1
+  cache:
+    key: chant-apply-prod-$CI_COMMIT_SHA
+    paths:
+      - .chant/pr-resume/pr-apply.json
+    when: always
+  artifacts:
+    when: always
+    paths:
+      - .chant/pr
+
+apply-wave-2:
+  stage: apply-wave-2
+  image: node:22
+  needs:
+    - apply-wave-1
+  resource_group: chant-apply-prod
+  rules:
+    - if: '$CI_PIPELINE_SOURCE == "push" && $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'
+  variables:
+    BASE_SHA: '$CI_COMMIT_BEFORE_SHA'
+  script:
+    - command -v tofu >/dev/null 2>&1 || (curl -fsSL https://get.opentofu.org/install-opentofu.sh -o /tmp/install-opentofu.sh && sh /tmp/install-opentofu.sh --install-method standalone)
+    - if [ -z "$BASE_SHA" ] || [ "$BASE_SHA" = "0000000000000000000000000000000000000000" ]; then BASE_SHA="${CI_MERGE_REQUEST_DIFF_BASE_SHA:-}"; if [ -z "$BASE_SHA" ]; then git fetch origin $CI_DEFAULT_BRANCH && BASE_SHA="$(git merge-base FETCH_HEAD "$CI_COMMIT_SHA")"; if [ "$BASE_SHA" = "$CI_COMMIT_SHA" ]; then BASE_SHA="$(git rev-parse --verify --quiet "$CI_COMMIT_SHA^" || echo 4b825dc642cb6eb9a060e54bf8d69288fbee4904)"; fi; fi; fi; export BASE_SHA
+    - chant ci run apply --in-place --base "$BASE_SHA" --env prod --gate pr-apply --forge gitlab --wave-gate release --wave 2
+  cache:
+    key: chant-apply-prod-$CI_COMMIT_SHA
+    paths:
+      - .chant/pr-resume/pr-apply.json
+    when: always
+  artifacts:
+    when: always
+    paths:
+      - .chant/pr
+
+apply-wave-3:
+  stage: apply-wave-3
+  image: node:22
+  needs:
+    - apply-wave-2
+  resource_group: chant-apply-prod
+  rules:
+    - if: '$CI_PIPELINE_SOURCE == "push" && $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'
+  variables:
+    BASE_SHA: '$CI_COMMIT_BEFORE_SHA'
+  script:
+    - command -v tofu >/dev/null 2>&1 || (curl -fsSL https://get.opentofu.org/install-opentofu.sh -o /tmp/install-opentofu.sh && sh /tmp/install-opentofu.sh --install-method standalone)
+    - if [ -z "$BASE_SHA" ] || [ "$BASE_SHA" = "0000000000000000000000000000000000000000" ]; then BASE_SHA="${CI_MERGE_REQUEST_DIFF_BASE_SHA:-}"; if [ -z "$BASE_SHA" ]; then git fetch origin $CI_DEFAULT_BRANCH && BASE_SHA="$(git merge-base FETCH_HEAD "$CI_COMMIT_SHA")"; if [ "$BASE_SHA" = "$CI_COMMIT_SHA" ]; then BASE_SHA="$(git rev-parse --verify --quiet "$CI_COMMIT_SHA^" || echo 4b825dc642cb6eb9a060e54bf8d69288fbee4904)"; fi; fi; fi; export BASE_SHA
+    - chant ci run apply --in-place --base "$BASE_SHA" --env prod --gate pr-apply --forge gitlab --wave-gate release --wave 3
+  cache:
+    key: chant-apply-prod-$CI_COMMIT_SHA
+    paths:
+      - .chant/pr-resume/pr-apply.json
+    when: always
+  artifacts:
+    when: always
+    paths:
+      - .chant/pr

package/src/components/__fixtures__/pr-loop.gitlab.golden.yml

@@ -22,7 +22,7 @@ plan:
     PR_NUMBER: '$CI_MERGE_REQUEST_IID'
   script:
     - command -v tofu >/dev/null 2>&1 || (curl -fsSL https://get.opentofu.org/install-opentofu.sh -o /tmp/install-opentofu.sh && sh /tmp/install-opentofu.sh --install-method standalone)
-    - chant components pr-plan --base "$BASE_SHA" --pr "$PR_NUMBER" --env prod --gate pr-apply --output .chant/pr --forge gitlab
+    - chant ci run plan --in-place --no-push --base "$BASE_SHA" --pr "$PR_NUMBER" --env prod --gate pr-apply --forge gitlab
   artifacts:
     when: always
     paths:
@@ -38,8 +38,8 @@ apply:
     BASE_SHA: '$CI_COMMIT_BEFORE_SHA'
   script:
     - command -v tofu >/dev/null 2>&1 || (curl -fsSL https://get.opentofu.org/install-opentofu.sh -o /tmp/install-opentofu.sh && sh /tmp/install-opentofu.sh --install-method standalone)
-    - if [ -z "$BASE_SHA" ] || [ "$BASE_SHA" = "0000000000000000000000000000000000000000" ]; then BASE_SHA="${CI_MERGE_REQUEST_DIFF_BASE_SHA:-}"; if [ -z "$BASE_SHA" ]; then git fetch origin $CI_DEFAULT_BRANCH && BASE_SHA="$(git merge-base FETCH_HEAD "$CI_COMMIT_SHA")"; if [ "$BASE_SHA" = "$CI_COMMIT_SHA" ]; then BASE_SHA="$(git rev-parse "$CI_COMMIT_SHA^")"; fi; fi; fi; export BASE_SHA
-    - chant components pr-apply --base "$BASE_SHA" --env prod --gate pr-apply --output .chant/pr --forge gitlab --require-review --resume .chant/pr-resume/pr-apply.json
+    - if [ -z "$BASE_SHA" ] || [ "$BASE_SHA" = "0000000000000000000000000000000000000000" ]; then BASE_SHA="${CI_MERGE_REQUEST_DIFF_BASE_SHA:-}"; if [ -z "$BASE_SHA" ]; then git fetch origin $CI_DEFAULT_BRANCH && BASE_SHA="$(git merge-base FETCH_HEAD "$CI_COMMIT_SHA")"; if [ "$BASE_SHA" = "$CI_COMMIT_SHA" ]; then BASE_SHA="$(git rev-parse --verify --quiet "$CI_COMMIT_SHA^" || echo 4b825dc642cb6eb9a060e54bf8d69288fbee4904)"; fi; fi; fi; export BASE_SHA
+    - chant ci run apply --in-place --base "$BASE_SHA" --env prod --gate pr-apply --forge gitlab
   cache:
     key: chant-apply-prod-$CI_COMMIT_SHA
     paths:

package/src/components/generate-op-pipeline.test.ts

@@ -185,6 +185,16 @@ describe("generateGitlabOpPipeline: the merge_request and push triggers (#2084,
     ]);
   });
 
+  test("a newest push build also runs at a build request's tag, and the header says how auto-cancel must be set (#4169)", () => {
+    const newest = generateGitlabOpPipeline([{ name: "suites", trigger: { kind: "push", build: "newest" } }]);
+    const job = parseYAML(newest.files[0].yaml)["suites"] as { rules: Array<{ if: string }> };
+    expect(job.rules.map((r) => r.if)).toEqual(['$CI_PIPELINE_SOURCE == "push" && $CI_COMMIT_BRANCH == "main"', "$CI_COMMIT_TAG =~ /^ci\\/build\\//"]);
+    expect(newest.files[0].yaml).toContain("Auto-cancel redundant pipelines on");
+    const every = generateGitlabOpPipeline([{ name: "suites", trigger: { kind: "push", build: "every" } }]);
+    expect((parseYAML(every.files[0].yaml)["suites"] as { rules: unknown[] }).rules).toHaveLength(1);
+    expect(every.files[0].yaml).toContain("Auto-cancel redundant pipelines off");
+  });
+
   test("an unfiltered push trigger defaults to main, the same branch github's generator assumes", () => {
     const result = generateGitlabOpPipeline([{ name: "tf-apply", trigger: { kind: "push" } }]);
     const job = parseYAML(result.files[0].yaml)["tf-apply"] as { rules: Array<{ if: string }> };

package/src/components/generate-op-pipeline.ts

@@ -239,9 +239,16 @@ function headerLineFor(
     }
     case "push": {
       const branches = pushBranches(trigger.branches);
+      // #4169: GitLab cancels a waiting pipeline when a newer commit's starts, under the project's auto-cancel setting.
+      const build =
+        trigger.build === "newest"
+          ? "; builds the newest commit and each ci/build/<sha> tag: keep Settings > CI/CD > Auto-cancel redundant pipelines on"
+          : trigger.build === "every"
+            ? "; builds every commit: turn Settings > CI/CD > Auto-cancel redundant pipelines off"
+            : "";
       return (
         `#   ${jobName}: push to ${branches.join(", ")}, finding-mode ${mode}${tokenNote}` +
-        ` — a gated apply stays green, its pending gate in the log and in ${gateSummaryPath(jobName)}`
+        ` — a gated apply stays green, its pending gate in the log and in ${gateSummaryPath(jobName)}${build}`
       );
     }
   }