@intentius/chant-lexicon-gitlab 0.124.31 → 0.124.33

package/dist/lint/audit-catalog.js

@@ -0,0 +1,53 @@
+/**
+ * The gitlab lexicon's chant audit catalog — metadata for its post-synth rules
+ * (WGL GitLab CI rules). Contributed via gitlabPlugin.auditCatalog() (#687).
+ */
+import { auditRule, GH_INJECTION, GH_OIDC, GH_PWN, GH_SECRETS, SCORECARD_PINNED, applyLineage } from "@intentius/chant/audit/catalog";
+import { gitlabAuditLineage } from "./audit-lineage.js";
+export const gitlabAuditCatalog = {
+    WGL010: auditRule("WGL010", "merge-worthy", "guidance", "Job references an undefined stage", "Add the stage to `stages:` or fix the job's `stage:`.", { category: "correctness" }),
+    WGL011: auditRule("WGL011", "merge-worthy", "guidance", "Job rules always evaluate to never", "Fix the `rules:` so the job can run; it is currently unreachable.", { category: "correctness" }),
+    WGL012: auditRule("WGL012", "report-only", "guidance", "Deprecated property", "Replace the deprecated GitLab CI property.", { category: "best-practice" }),
+    WGL013: auditRule("WGL013", "merge-worthy", "guidance", "Invalid needs target", "Fix the dangling/self `needs:` reference.", { category: "correctness" }),
+    WGL014: auditRule("WGL014", "merge-worthy", "guidance", "Invalid extends target", "Point `extends:` at a template that exists in the pipeline.", { category: "correctness" }),
+    WGL015: auditRule("WGL015", "merge-worthy", "guidance", "Circular needs chain", "Break the cycle in the job dependency graph.", { category: "correctness" }),
+    WGL016: auditRule("WGL016", "merge-worthy", "guidance", "Hardcoded secret in variables", "Move the secret out of `variables:` into a masked/protected CI variable and rotate it.", { authority: [GH_SECRETS] }),
+    WGL017: auditRule("WGL017", "merge-worthy", "guidance", "Insecure (non-HTTPS) registry", "Use an HTTPS registry endpoint.", { category: "security" }),
+    WGL018: auditRule("WGL018", "report-only", "guidance", "Missing job timeout", "Add a `timeout:` to bound long-running jobs.", { category: "best-practice" }),
+    WGL019: auditRule("WGL019", "report-only", "guidance", "Missing retry on deploy job", "Add a `retry:` strategy to deploy jobs.", { category: "best-practice" }),
+    WGL020: auditRule("WGL020", "merge-worthy", "guidance", "Duplicate job names", "Rename so each job resolves to a unique name.", { category: "correctness" }),
+    WGL021: auditRule("WGL021", "report-only", "guidance", "Unused global variable", "Remove the unused global `variables:` entry.", { category: "best-practice" }),
+    WGL022: auditRule("WGL022", "report-only", "guidance", "Missing artifacts expiry", "Add `expire_in:` to artifacts to avoid disk bloat.", { category: "best-practice" }),
+    WGL023: auditRule("WGL023", "report-only", "guidance", "Overly broad rules (when: always)", "Add real conditions to the job's `rules:`.", { category: "best-practice" }),
+    WGL024: auditRule("WGL024", "report-only", "guidance", "Manual job without allow_failure", "Add `allow_failure: true` so a manual job doesn't block the pipeline.", { category: "best-practice" }),
+    WGL025: auditRule("WGL025", "report-only", "guidance", "Cache without a key", "Add a `cache.key` to avoid cross-job cache collisions.", { category: "best-practice" }),
+    WGL026: auditRule("WGL026", "merge-worthy", "guidance", "Privileged DinD service without TLS", "Set `DOCKER_TLS_CERTDIR` for privileged Docker-in-Docker services.", { category: "security" }),
+    WGL027: auditRule("WGL027", "merge-worthy", "guidance", "Empty script", "Give the job a non-empty `script:`; it currently does nothing.", { category: "correctness" }),
+    WGL028: auditRule("WGL028", "report-only", "guidance", "Redundant needs", "Drop `needs:` already implied by stage ordering.", { category: "best-practice" }),
+    WGL029: auditRule("WGL029", "merge-worthy", "guidance", "include/component resolved by a moving ref", "Pin `include:project`/component to a tag or commit SHA, not a branch.", { authority: [SCORECARD_PINNED] }),
+    WGL030: auditRule("WGL030", "merge-worthy", "guidance", "Insecure or mutable include:remote", "Use HTTPS and pin the remote include to an immutable ref.", { authority: [SCORECARD_PINNED] }),
+    WGL031: auditRule("WGL031", "merge-worthy", "deterministic", "Container image not pinned to a digest", "Pin the image to an immutable `@sha256:` digest.", { authority: [SCORECARD_PINNED] }),
+    WGL032: auditRule("WGL032", "merge-worthy", "guidance", "Possible include/component impersonation", "Verify the include source; it resembles a well-known project.", { authority: [SCORECARD_PINNED] }),
+    WGL033: auditRule("WGL033", "merge-worthy", "guidance", "OIDC id_token without a scoped audience", "Set a specific `aud:` on the OIDC id_token.", { authority: [GH_OIDC] }),
+    WGL034: auditRule("WGL034", "merge-worthy", "guidance", "OIDC id_token mintable from a merge-request pipeline", "Restrict OIDC token minting to protected pipelines.", { authority: [GH_OIDC, GH_PWN] }),
+    WGL035: auditRule("WGL035", "merge-worthy", "guidance", "Untrusted CI variable interpolated into a script", "Pass untrusted variables via the environment and quote them; don't inline.", { authority: [GH_INJECTION] }),
+    WGL036: auditRule("WGL036", "merge-worthy", "guidance", "Privileged service reachable from merge-request pipelines", "Block privileged/DinD services on merge-request pipelines.", { authority: [GH_PWN] }),
+    WGL037: auditRule("WGL037", "merge-worthy", "guidance", "Security gate on an untrusted ref regex", "Don't gate security decisions on a regex over an untrusted ref variable.", { authority: [GH_PWN] }),
+    WGL038: auditRule("WGL038", "merge-worthy", "guidance", "Secret reachable from a merge-request pipeline", "Scope secret-like variables to protected branches/pipelines.", { authority: [GH_SECRETS, GH_PWN] }),
+    WGL039: auditRule("WGL039", "merge-worthy", "guidance", "Secret printed to job logs", "Stop echoing the secret-like variable; mask it.", { authority: [GH_SECRETS] }),
+    WGL040: auditRule("WGL040", "merge-worthy", "guidance", "Hardcoded credential in a registry login", "Move the credential to a masked CI variable and rotate it.", { authority: [GH_SECRETS] }),
+    WGL041: auditRule("WGL041", "merge-worthy", "guidance", "Tautological rules:if condition", "Fix the always-true `rules:if`; it may neutralize a gate.", { category: "correctness" }),
+    WGL042: auditRule("WGL042", "report-only", "guidance", "Unreachable rules after an unconditional match", "Remove the dead `rules:` entries after the catch-all.", { category: "best-practice" }),
+    WGL043: auditRule("WGL043", "merge-worthy", "guidance", "Match-anything regex gate in rules:if", "Tighten the regex; a match-anything gate is no gate.", { authority: [GH_PWN] }),
+    WGL044: auditRule("WGL044", "merge-worthy", "guidance", "Public artifacts expose build output", "Mark sensitive artifacts non-public (`public: false`).", { category: "security" }),
+    WGL045: auditRule("WGL045", "merge-worthy", "guidance", "Artifact path may capture a credential file", "Narrow the artifact path so it can't capture credential files.", { authority: [GH_SECRETS] }),
+    WGL046: auditRule("WGL046", "merge-worthy", "guidance", "Cache populated in a merge-request pipeline", "Don't populate caches from merge-request pipelines (poisoning risk).", { authority: [GH_PWN] }),
+    WGL047: auditRule("WGL047", "merge-worthy", "guidance", "Software piped to a shell without verification", "Verify a checksum/signature before executing fetched scripts.", { authority: [SCORECARD_PINNED] }),
+    WGL048: auditRule("WGL048", "report-only", "guidance", "Pipeline without workflow:name", "Add a `workflow:name` for clearer pipeline naming.", { category: "best-practice" }),
+    // Efficiency (#444) — waste, not a safety/correctness issue. Always
+    // report-only: none of these warrant a merge on their own.
+    WGL049: auditRule("WGL049", "report-only", "guidance", "Dependency install without a cache", "Add a `cache:` covering the dependency directory.", { category: "efficiency" }),
+    WGL050: auditRule("WGL050", "report-only", "guidance", "Merge-request job missing interruptible", "Add `interruptible: true` so a superseded pipeline can be cancelled.", { category: "efficiency" }),
+};
+// Prior art credits live beside the rules in ./audit-lineage.ts (see core audit/prior-art.ts).
+applyLineage(gitlabAuditCatalog, gitlabAuditLineage);

package/dist/lint/audit-lineage.js

@@ -0,0 +1,64 @@
+export const gitlabAuditLineage = {
+    WGL010: [
+        { tool: "gitlab-docs", rule: "stage: supported values are the default stages or stages listed in `stages`", url: "https://docs.gitlab.com/ci/yaml/#stage", relation: "equivalent" },
+    ],
+    WGL012: [
+        { tool: "gitlab-docs", rule: "Deprecated keywords (only/except, globally-defined image/services/cache/before_script/after_script)", url: "https://docs.gitlab.com/ci/yaml/deprecated_keywords/#only--except", relation: "equivalent" },
+    ],
+    WGL013: [
+        { tool: "gitlab-docs", rule: "Error: 'job' does not exist in the pipeline (needs)", url: "https://docs.gitlab.com/ci/yaml/needs/#error-job-does-not-exist-in-the-pipeline", relation: "equivalent" },
+    ],
+    WGL014: [
+        { tool: "gitlab-docs", rule: "extends: supported values are the name(s) of another job in the pipeline", url: "https://docs.gitlab.com/ci/yaml/#extends", relation: "equivalent" },
+    ],
+    WGL016: [
+        { tool: "gitlab-docs", rule: "CI/CD variable security (secrets belong in masked/protected variables, not in .gitlab-ci.yml)", url: "https://docs.gitlab.com/ci/variables/#cicd-variable-security", relation: "overlaps" },
+    ],
+    WGL023: [
+        { tool: "gitlab-docs", rule: "Pipeline warning: Job may allow multiple pipelines to run for a single action (final `when` rule without conditions)", url: "https://docs.gitlab.com/ci/debugging/#job-may-allow-multiple-pipelines-to-run-for-a-single-action-warning", relation: "overlaps" },
+    ],
+    WGL024: [
+        { tool: "gitlab-docs", rule: "allow_failure default: true for manual jobs, false for rules:when: manual", url: "https://docs.gitlab.com/ci/yaml/#allow_failure", relation: "overlaps" },
+    ],
+    WGL025: [
+        { tool: "gitlab-docs", rule: "cache:key: all jobs with `cache` but no `cache:key` share the `default` cache", url: "https://docs.gitlab.com/ci/yaml/#cachekey", relation: "overlaps" },
+    ],
+    WGL026: [
+        { tool: "gitlab-docs", rule: "Docker-in-Docker with TLS enabled (recommended); DOCKER_TLS_CERTDIR", url: "https://docs.gitlab.com/ci/docker/docker_in_docker/#docker-in-docker-with-tls-enabled-in-the-docker-executor-recommended", relation: "overlaps" },
+    ],
+    WGL029: [
+        { tool: "gitlab-docs", rule: "include:project ref guidance: use a specific SHA hash, protected branch/tag rules", url: "https://docs.gitlab.com/ci/yaml/#includeproject", relation: "overlaps" },
+        { tool: "gitlab-docs", rule: "CI/CD component security best practices: use pinned versions (commit SHA preferred), avoid `latest`", url: "https://docs.gitlab.com/ci/components/#for-component-users", relation: "overlaps" },
+    ],
+    WGL030: [
+        { tool: "gitlab-docs", rule: "include:remote: treat as a third-party dependency; verify integrity with include:integrity", url: "https://docs.gitlab.com/ci/yaml/#includeremote", relation: "overlaps" },
+    ],
+    WGL031: [
+        { tool: "gitlab-docs", rule: "Use checksum to keep your image secure (image@sha256:digest)", url: "https://docs.gitlab.com/ci/docker/using_docker_images/#use-checksum-to-keep-your-image-secure", relation: "overlaps" },
+    ],
+    WGL033: [
+        { tool: "gitlab-docs", rule: "id_tokens: the required `aud` sub-keyword configures the aud claim", url: "https://docs.gitlab.com/ci/yaml/#id_tokens", relation: "overlaps" },
+    ],
+    WGL035: [
+        { tool: "poutine", rule: "injection", url: "https://boostsecurityio.github.io/poutine/rules/injection/", relation: "overlaps" },
+    ],
+    WGL038: [
+        { tool: "gitlab-docs", rule: "Protect a CI/CD variable (available only to protected branches/tags)", url: "https://docs.gitlab.com/ci/variables/#protect-a-cicd-variable", relation: "overlaps" },
+        { tool: "gitlab-docs", rule: "Merge request pipelines from forked projects can steal secrets in the parent project", url: "https://docs.gitlab.com/ci/pipelines/merge_request_pipelines/#use-with-forked-projects", relation: "overlaps" },
+    ],
+    WGL039: [
+        { tool: "gitlab-docs", rule: "CI/CD variable security: accidental-leak-job example (echo of $PASSWORD); mask sensitive variables", url: "https://docs.gitlab.com/ci/variables/#mask-a-cicd-variable", relation: "overlaps" },
+    ],
+    WGL044: [
+        { tool: "gitlab-docs", rule: "artifacts:public (default true: downloadable by anonymous users in public pipelines)", url: "https://docs.gitlab.com/ci/yaml/#artifactspublic", relation: "overlaps" },
+    ],
+    WGL046: [
+        { tool: "gitlab-docs", rule: "Cache key names: protected and non-protected branches do not share the cache by default", url: "https://docs.gitlab.com/ci/caching/#cache-key-names", relation: "overlaps" },
+    ],
+    WGL047: [
+        { tool: "poutine", rule: "unverified_script_exec", url: "https://boostsecurityio.github.io/poutine/rules/unverified_script_exec/", relation: "equivalent" },
+    ],
+    WGL048: [
+        { tool: "gitlab-docs", rule: "Use pipeline names (workflow:name)", url: "https://docs.gitlab.com/ci/debugging/#use-pipeline-names", relation: "overlaps" },
+    ],
+};

package/dist/lint/post-synth/index.js

@@ -0,0 +1,84 @@
+import { wgl010 } from "./wgl010.js";
+import { wgl011 } from "./wgl011.js";
+import { wgl012 } from "./wgl012.js";
+import { wgl013 } from "./wgl013.js";
+import { wgl014 } from "./wgl014.js";
+import { wgl015 } from "./wgl015.js";
+import { wgl016 } from "./wgl016.js";
+import { wgl017 } from "./wgl017.js";
+import { wgl018 } from "./wgl018.js";
+import { wgl019 } from "./wgl019.js";
+import { wgl020 } from "./wgl020.js";
+import { wgl021 } from "./wgl021.js";
+import { wgl022 } from "./wgl022.js";
+import { wgl023 } from "./wgl023.js";
+import { wgl024 } from "./wgl024.js";
+import { wgl025 } from "./wgl025.js";
+import { wgl026 } from "./wgl026.js";
+import { wgl027 } from "./wgl027.js";
+import { wgl028 } from "./wgl028.js";
+import { wgl029 } from "./wgl029.js";
+import { wgl030 } from "./wgl030.js";
+import { wgl031 } from "./wgl031.js";
+import { wgl032 } from "./wgl032.js";
+import { wgl033 } from "./wgl033.js";
+import { wgl034 } from "./wgl034.js";
+import { wgl035 } from "./wgl035.js";
+import { wgl036 } from "./wgl036.js";
+import { wgl037 } from "./wgl037.js";
+import { wgl038 } from "./wgl038.js";
+import { wgl039 } from "./wgl039.js";
+import { wgl040 } from "./wgl040.js";
+import { wgl041 } from "./wgl041.js";
+import { wgl042 } from "./wgl042.js";
+import { wgl043 } from "./wgl043.js";
+import { wgl044 } from "./wgl044.js";
+import { wgl045 } from "./wgl045.js";
+import { wgl046 } from "./wgl046.js";
+import { wgl047 } from "./wgl047.js";
+import { wgl048 } from "./wgl048.js";
+import { wgl049 } from "./wgl049.js";
+import { wgl050 } from "./wgl050.js";
+export const postSynthChecks = [
+    wgl010,
+    wgl011,
+    wgl012,
+    wgl013,
+    wgl014,
+    wgl015,
+    wgl016,
+    wgl017,
+    wgl018,
+    wgl019,
+    wgl020,
+    wgl021,
+    wgl022,
+    wgl023,
+    wgl024,
+    wgl025,
+    wgl026,
+    wgl027,
+    wgl028,
+    wgl029,
+    wgl030,
+    wgl031,
+    wgl032,
+    wgl033,
+    wgl034,
+    wgl035,
+    wgl036,
+    wgl037,
+    wgl038,
+    wgl039,
+    wgl040,
+    wgl041,
+    wgl042,
+    wgl043,
+    wgl044,
+    wgl045,
+    wgl046,
+    wgl047,
+    wgl048,
+    wgl049,
+    wgl050,
+];

package/dist/lint/post-synth/wgl010.js

@@ -0,0 +1,34 @@
+/**
+ * WGL010: Undefined stage
+ *
+ * Detects jobs that reference a stage not declared in the `stages:` list.
+ * This will cause a pipeline validation error in GitLab.
+ */
+import { getPrimaryOutput, extractStages, extractJobs } from "./yaml-helpers.js";
+export const wgl010 = {
+    id: "WGL010",
+    description: "Job references a stage not in the stages list",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [, output] of ctx.outputs) {
+            const yaml = getPrimaryOutput(output);
+            const stages = extractStages(yaml);
+            if (stages.length === 0)
+                continue; // No explicit stages — GitLab uses defaults
+            const stageSet = new Set(stages);
+            const jobs = extractJobs(yaml);
+            for (const [jobName, job] of jobs) {
+                if (job.stage && !stageSet.has(job.stage)) {
+                    diagnostics.push({
+                        checkId: "WGL010",
+                        severity: "error",
+                        message: `Job "${jobName}" references undefined stage "${job.stage}". Add it to the stages list.`,
+                        entity: jobName,
+                        lexicon: "gitlab",
+                    });
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/wgl011.js

@@ -0,0 +1,48 @@
+/**
+ * WGL011: Unreachable job
+ *
+ * Detects jobs where all `rules:` entries evaluate to `when: never`,
+ * making the job unreachable. This usually indicates a configuration error.
+ *
+ * Note: This is a simple static check — it only catches the obvious case
+ * where every rule has `when: "never"` literally set. Complex conditions
+ * with `if:` expressions are not evaluated.
+ */
+import { isPropertyDeclarable } from "@intentius/chant/declarable";
+export const wgl011 = {
+    id: "WGL011",
+    description: "Job has rules that always evaluate to never (unreachable)",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [entityName, entity] of ctx.entities) {
+            if (isPropertyDeclarable(entity))
+                continue;
+            const entityType = entity.entityType;
+            if (entityType !== "GitLab::CI::Job")
+                continue;
+            const props = entity.props;
+            if (!props?.rules || !Array.isArray(props.rules))
+                continue;
+            const rules = props.rules;
+            if (rules.length === 0)
+                continue;
+            // Check if ALL rules have when: "never"
+            const allNever = rules.every((rule) => {
+                // If the rule is a declarable (e.g. new Rule({...})), check its props
+                const ruleProps = rule.props;
+                const when = ruleProps?.when ?? rule.when;
+                return when === "never";
+            });
+            if (allNever) {
+                diagnostics.push({
+                    checkId: "WGL011",
+                    severity: "warning",
+                    message: `Job "${entityName}" has rules that all evaluate to "never" — this job will never run.`,
+                    entity: entityName,
+                    lexicon: "gitlab",
+                });
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/wgl012.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"wgl012.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/wgl012.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAgC9G;;GAEG;AACH,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,gBAAgB,EACrB,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,GACnC,mBAAmB,EAAE,CA6BvB;AAED,eAAO,MAAM,MAAM,EAAE,cAOpB,CAAC"}
+{"version":3,"file":"wgl012.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/wgl012.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AA+B9G;;GAEG;AACH,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,gBAAgB,EACrB,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,GACnC,mBAAmB,EAAE,CA6BvB;AAED,eAAO,MAAM,MAAM,EAAE,cAOpB,CAAC"}

package/dist/lint/post-synth/wgl012.js

@@ -0,0 +1,68 @@
+/**
+ * WGL012: Deprecated Property Usage
+ *
+ * Flags properties marked as deprecated in the GitLab CI schema.
+ * Sources: description text mining (keywords like "Deprecated", "legacy").
+ */
+import { readFileSync } from "fs";
+import { join } from "path";
+import { moduleSourceDir } from "@intentius/chant/module-source";
+import { isPropertyDeclarable } from "@intentius/chant/declarable";
+/**
+ * Load deprecated properties per entity type from the lexicon JSON.
+ */
+function loadDeprecatedProperties() {
+    const map = new Map();
+    try {
+        const lexiconPath = join(moduleSourceDir(import.meta.url), "..", "..", "generated", "lexicon-gitlab.json");
+        const content = readFileSync(lexiconPath, "utf-8");
+        const data = JSON.parse(content);
+        for (const [_name, entry] of Object.entries(data)) {
+            if (entry.resourceType && entry.deprecatedProperties && entry.deprecatedProperties.length > 0) {
+                map.set(entry.resourceType, new Set(entry.deprecatedProperties));
+            }
+        }
+    }
+    catch {
+        // Lexicon not available — skip
+    }
+    return map;
+}
+/**
+ * Core detection logic — exported for direct testing with synthetic data.
+ */
+export function checkDeprecatedProperties(ctx, deprecated) {
+    if (deprecated.size === 0)
+        return [];
+    const diagnostics = [];
+    for (const [entityName, entity] of ctx.entities) {
+        if (isPropertyDeclarable(entity))
+            continue;
+        const entityType = entity.entityType;
+        const deprProps = deprecated.get(entityType);
+        if (!deprProps)
+            continue;
+        const props = entity.props;
+        if (!props)
+            continue;
+        for (const propName of Object.keys(props)) {
+            if (deprProps.has(propName)) {
+                diagnostics.push({
+                    checkId: "WGL012",
+                    severity: "warning",
+                    message: `Entity "${entityName}" (${entityType}) uses deprecated property "${propName}" — consider alternatives`,
+                    entity: entityName,
+                    lexicon: "gitlab",
+                });
+            }
+        }
+    }
+    return diagnostics;
+}
+export const wgl012 = {
+    id: "WGL012",
+    description: "Deprecated property usage — flags properties marked as deprecated in the GitLab CI schema",
+    check(ctx) {
+        return checkDeprecatedProperties(ctx, loadDeprecatedProperties());
+    },
+};

package/dist/lint/post-synth/wgl013.js

@@ -0,0 +1,57 @@
+/**
+ * WGL013: Invalid `needs:` Target
+ *
+ * Detects two cases in the serialized YAML:
+ * - Dangling reference: `needs:` names a job not defined in the pipeline
+ * - Self-reference: job lists itself in `needs:`
+ *
+ * Both cause GitLab pipeline validation failures.
+ *
+ * Caveat: when `include:` is present, referenced jobs may come from
+ * included files, so the check is skipped. A `- job: x` entry with
+ * `optional: true` may name a job that is not in the pipeline (GitLab
+ * ignores it), so it is not reported as dangling.
+ */
+import { getPrimaryOutput, extractJobs, hasInclude } from "./yaml-helpers.js";
+export function checkInvalidNeeds(ctx) {
+    const diagnostics = [];
+    for (const [, output] of ctx.outputs) {
+        const yaml = getPrimaryOutput(output);
+        if (hasInclude(yaml))
+            continue;
+        const jobs = extractJobs(yaml);
+        const jobNames = new Set(jobs.keys());
+        for (const [jobName, job] of jobs) {
+            if (!job.needs)
+                continue;
+            for (const need of job.needs) {
+                if (need === jobName) {
+                    diagnostics.push({
+                        checkId: "WGL013",
+                        severity: "error",
+                        message: `Job "${jobName}" lists itself in needs: — self-references are invalid`,
+                        entity: jobName,
+                        lexicon: "gitlab",
+                    });
+                }
+                else if (!jobNames.has(need) && !job.optionalNeeds?.includes(need)) {
+                    diagnostics.push({
+                        checkId: "WGL013",
+                        severity: "error",
+                        message: `Job "${jobName}" needs "${need}" which is not defined in the pipeline`,
+                        entity: jobName,
+                        lexicon: "gitlab",
+                    });
+                }
+            }
+        }
+    }
+    return diagnostics;
+}
+export const wgl013 = {
+    id: "WGL013",
+    description: "Invalid needs: target — dangling reference or self-reference",
+    check(ctx) {
+        return checkInvalidNeeds(ctx);
+    },
+};

package/dist/lint/post-synth/wgl014.js

@@ -0,0 +1,43 @@
+/**
+ * WGL014: Invalid `extends:` Target
+ *
+ * Detects jobs that `extends:` a template not defined in the pipeline YAML.
+ * GitLab rejects pipelines with unresolved extends references.
+ *
+ * Caveat: when `include:` is present, templates may come from
+ * included files, so the check is skipped.
+ */
+import { getPrimaryOutput, extractJobs, hasInclude } from "./yaml-helpers.js";
+export function checkInvalidExtends(ctx) {
+    const diagnostics = [];
+    for (const [, output] of ctx.outputs) {
+        const yaml = getPrimaryOutput(output);
+        if (hasInclude(yaml))
+            continue;
+        const jobs = extractJobs(yaml);
+        const jobNames = new Set(jobs.keys());
+        for (const [jobName, job] of jobs) {
+            if (!job.extends)
+                continue;
+            for (const target of job.extends) {
+                if (!jobNames.has(target)) {
+                    diagnostics.push({
+                        checkId: "WGL014",
+                        severity: "error",
+                        message: `Job "${jobName}" extends "${target}" which is not defined in the pipeline`,
+                        entity: jobName,
+                        lexicon: "gitlab",
+                    });
+                }
+            }
+        }
+    }
+    return diagnostics;
+}
+export const wgl014 = {
+    id: "WGL014",
+    description: "Invalid extends: target — references a template not in the pipeline",
+    check(ctx) {
+        return checkInvalidExtends(ctx);
+    },
+};

package/dist/lint/post-synth/wgl015.js

@@ -0,0 +1,70 @@
+/**
+ * WGL015: Circular `needs:` Chain
+ *
+ * DFS-based cycle detection on the `needs:` dependency graph.
+ * If A needs B and B needs A, GitLab rejects the pipeline.
+ *
+ * Reports one diagnostic per cycle found, listing the full chain.
+ */
+import { getPrimaryOutput, extractJobs } from "./yaml-helpers.js";
+export function checkCircularNeeds(ctx) {
+    const diagnostics = [];
+    for (const [, output] of ctx.outputs) {
+        const yaml = getPrimaryOutput(output);
+        const jobs = extractJobs(yaml);
+        // Build adjacency list from needs
+        const graph = new Map();
+        for (const [jobName, job] of jobs) {
+            graph.set(jobName, job.needs ?? []);
+        }
+        // DFS cycle detection
+        const visited = new Set();
+        const inStack = new Set();
+        const reportedInCycle = new Set();
+        function dfs(node, path) {
+            if (inStack.has(node)) {
+                // Found a cycle — extract the cycle portion
+                const cycleStart = path.indexOf(node);
+                const cycle = path.slice(cycleStart);
+                cycle.push(node);
+                // Only report if we haven't already reported a cycle containing these nodes
+                const cycleKey = [...cycle].sort().join(",");
+                if (!reportedInCycle.has(cycleKey)) {
+                    reportedInCycle.add(cycleKey);
+                    diagnostics.push({
+                        checkId: "WGL015",
+                        severity: "error",
+                        message: `Circular needs: chain detected: ${cycle.join(" → ")}`,
+                        entity: node,
+                        lexicon: "gitlab",
+                    });
+                }
+                return;
+            }
+            if (visited.has(node))
+                return;
+            visited.add(node);
+            inStack.add(node);
+            for (const neighbor of graph.get(node) ?? []) {
+                // Only follow edges to known jobs
+                if (graph.has(neighbor)) {
+                    dfs(neighbor, [...path, node]);
+                }
+            }
+            inStack.delete(node);
+        }
+        for (const jobName of graph.keys()) {
+            if (!visited.has(jobName)) {
+                dfs(jobName, []);
+            }
+        }
+    }
+    return diagnostics;
+}
+export const wgl015 = {
+    id: "WGL015",
+    description: "Circular needs: chain — cycle in job dependency graph",
+    check(ctx) {
+        return checkCircularNeeds(ctx);
+    },
+};

package/dist/lint/post-synth/wgl016.js

@@ -0,0 +1,70 @@
+/**
+ * WGL016: Secrets in Variables
+ *
+ * Detects hardcoded passwords, tokens, or secrets in `variables:` blocks.
+ * These should use CI/CD masked variables instead.
+ */
+import { getPrimaryOutput } from "./yaml-helpers.js";
+const SECRET_PATTERNS = [
+    /password\s*[:=]\s*['"]?[^\s'"]+/i,
+    /secret\s*[:=]\s*['"]?[^\s'"]+/i,
+    /token\s*[:=]\s*['"]?[^\s'"]+/i,
+    /api[_-]?key\s*[:=]\s*['"]?[^\s'"]+/i,
+    /private[_-]?key\s*[:=]\s*['"]?[^\s'"]+/i,
+];
+/** Variable name patterns that indicate credentials. */
+const SECRET_VAR_NAMES = [
+    /password/i,
+    /secret/i,
+    /token/i,
+    /api[_-]?key/i,
+    /private[_-]?key/i,
+    /credentials?/i,
+];
+/** Values that are clearly references (not hardcoded secrets). */
+function isReference(value) {
+    return value.startsWith("$") || value.startsWith("${");
+}
+export function checkSecretsInVariables(yaml) {
+    const diagnostics = [];
+    // Extract variables blocks (global and per-job)
+    const varBlocks = yaml.matchAll(/^(\s*)variables:\n((?:\1\s+.+\n?)+)/gm);
+    for (const block of varBlocks) {
+        const lines = block[2].split("\n");
+        for (const line of lines) {
+            const kv = line.match(/^\s+(\w+):\s+(.+)$/);
+            if (!kv)
+                continue;
+            const [, varName, rawValue] = kv;
+            const value = rawValue.trim().replace(/^['"]|['"]$/g, "");
+            if (isReference(value))
+                continue;
+            // Check if variable name suggests a secret
+            for (const pattern of SECRET_VAR_NAMES) {
+                if (pattern.test(varName)) {
+                    diagnostics.push({
+                        checkId: "WGL016",
+                        severity: "error",
+                        message: `Variable "${varName}" appears to contain a hardcoded secret — use a CI/CD masked variable instead`,
+                        entity: varName,
+                        lexicon: "gitlab",
+                    });
+                    break;
+                }
+            }
+        }
+    }
+    return diagnostics;
+}
+export const wgl016 = {
+    id: "WGL016",
+    description: "Secrets in variables — hardcoded passwords or tokens in variables blocks",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [, output] of ctx.outputs) {
+            const yaml = getPrimaryOutput(output);
+            diagnostics.push(...checkSecretsInVariables(yaml));
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/wgl017.js

@@ -0,0 +1,38 @@
+/**
+ * WGL017: Insecure Registry
+ *
+ * Detects Docker push/pull to non-HTTPS registries in job scripts.
+ * Using HTTP for container registries is a security risk.
+ */
+import { getPrimaryOutput, topLevelSections } from "./yaml-helpers.js";
+const INSECURE_REGISTRY_PATTERN = /docker\s+(push|pull|tag|login)\s+.*http:\/\/[^\s]+/;
+export function checkInsecureRegistry(yaml) {
+    const diagnostics = [];
+    for (const { key: jobName, text } of topLevelSections(yaml)) {
+        for (const line of text.split("\n")) {
+            if (INSECURE_REGISTRY_PATTERN.test(line)) {
+                diagnostics.push({
+                    checkId: "WGL017",
+                    severity: "warning",
+                    message: `Job "${jobName}" uses an insecure (HTTP) container registry — use HTTPS instead`,
+                    entity: jobName,
+                    lexicon: "gitlab",
+                });
+                break;
+            }
+        }
+    }
+    return diagnostics;
+}
+export const wgl017 = {
+    id: "WGL017",
+    description: "Insecure registry — Docker push/pull to non-HTTPS registry",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [, output] of ctx.outputs) {
+            const yaml = getPrimaryOutput(output);
+            diagnostics.push(...checkInsecureRegistry(yaml));
+        }
+        return diagnostics;
+    },
+};