@intentius/chant-lexicon-gitlab 0.124.41 → 0.124.43

package/dist/components/generate-pipeline.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generate-pipeline.d.ts","sourceRoot":"","sources":["../../src/components/generate-pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAWH,OAAO,EAAyB,KAAK,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAuBjG,OAAO,KAAK,EACV,oBAAoB,IAAI,YAAY,EACpC,wBAAwB,IAAI,qBAAqB,EACjD,uBAAuB,IAAI,oBAAoB,EAEhD,MAAM,0BAA0B,CAAC;AAIlC,YAAY,EAAE,YAAY,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,CAAC;AAE1E;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,eAAe,EAAE,EAC7B,OAAO,GAAE,qBAA0B,GAClC,oBAAoB,CAkJtB"}
+{"version":3,"file":"generate-pipeline.d.ts","sourceRoot":"","sources":["../../src/components/generate-pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAWH,OAAO,EAAyB,KAAK,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAwBjG,OAAO,KAAK,EACV,oBAAoB,IAAI,YAAY,EACpC,wBAAwB,IAAI,qBAAqB,EACjD,uBAAuB,IAAI,oBAAoB,EAEhD,MAAM,0BAA0B,CAAC;AAIlC,YAAY,EAAE,YAAY,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,CAAC;AAE1E;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,eAAe,EAAE,EAC7B,OAAO,GAAE,qBAA0B,GAClC,oBAAoB,CAkJtB"}

package/dist/components/generate-pipeline.js

@@ -35,7 +35,7 @@ import { assertGitlabBranch, CI_IMAGE, ciJobName, fillCommand, GITLAB_FULL_HISTO
 import { resolveComponentGraph } from "@intentius/chant/components/driver";
 import { hasPublishStep, promoteArchivePaths } from "@intentius/chant/components/promote";
 import { GATED_WAVE_RECORD, gatedWaveJobs } from "@intentius/chant/components/gated-wave-pipeline";
-import { PR_APPLY_RECORD, PR_LOOP_REPORT_DIR, prApplyGroup, prRecordGroup, prApplyRecordKey, prApplyWaveJobName, prLoopJobs, prLoopPostJob, prLoopSetup, PR_PLAN_NOTE_JOB, prLoopWaveJobs, prLoopWithWaves, prEnvJobs, PR_ENV_REPORT_DIR, PR_ENV_POST_JOB, } from "@intentius/chant/components/pr-pipeline";
+import { PR_APPLY_RECORD, PR_LOOP_REPORT_DIR, prApplyGroup, prRecordGroup, prApplyRecordKey, prApplyWaveJobName, prLoopJobs, GITLAB_APPLY_PR_VAR, prLoopPostJob, prLoopSetup, PR_PLAN_NOTE_JOB, prLoopWaveJobs, prLoopWithWaves, prEnvJobs, PR_ENV_REPORT_DIR, PR_ENV_POST_JOB, } from "@intentius/chant/components/pr-pipeline";
 import { memberGitlabChanges, memberRepoPath, memberShellDir } from "@intentius/chant/lexicon";
 import { FORGE_TOKEN_VARS, GITLAB_DROP_FORGE_TOKENS } from "@intentius/chant/ci-handover";
 import { gitlabTradeIdTokens, gitlabTradeLines, TRADE_SPEC_ENV } from "@intentius/chant/ci-identity";
@@ -279,6 +279,17 @@ function gatedWaveGitlabPipeline(components, env, image, beforeScript, extraScri
  */
 /** The dotenv report a gated apply wave hands the green commit it applies through (#4221). */
 const WAVE_GREEN_DOTENV = "chant-green.env";
+/**
+ * The rule of the apply before merge (#4301, ws-106): a pipeline of `branch`
+ * that a person started from the UI, the API or a trigger with
+ * `CHANT_APPLY_PR` set to the merge request's iid. GitLab builds a merge
+ * request's own pipeline from its own files, so the apply runs in one of the
+ * target branch's. The variable only names the merge request; `pr-apply
+ * --before-merge` reads the rest from GitLab.
+ */
+function gitlabApplyPrRule(branch) {
+    return `$CI_PIPELINE_SOURCE =~ /^(web|api|trigger)$/ && $${GITLAB_APPLY_PR_VAR} =~ /^[0-9]+$/ && $CI_COMMIT_BRANCH == ${branch}`;
+}
 /** The rule of a pipeline for a pushed `ci/green/` tag (#4168 step 9), which runs the apply under apply on merge. */
 const GITLAB_GREEN_TAG_RULE = '$CI_COMMIT_TAG =~ /^ci\\/green\\//';
 function prLoopGitlabPipeline(components, env, image, beforeScript, extraScript, options) {
@@ -293,7 +304,7 @@ function prLoopGitlabPipeline(components, env, image, beforeScript, extraScript,
     // #4168 step 9: a push to the branch records, and under apply on merge a ci/green/ tag pipeline applies.
     const greens = loop.waveGate
         ? waveJobs.map((job) => ({ job, name: named(prApplyWaveJobName(job.wave)), stage: prApplyWaveJobName(job.wave) }))
-        : loop.applyOnMerge
+        : loop.applyOnMerge || loop.applyBeforeMerge
             ? [{ job: apply, name: named("apply"), stage: "apply" }]
             : [];
     const applies = [{ job: record, name: named("record"), stage: "record" }, ...greens];
@@ -301,7 +312,8 @@ function prLoopGitlabPipeline(components, env, image, beforeScript, extraScript,
     if (loop.branch !== undefined)
         assertGitlabBranch("The merge-request pipeline", loop.branch);
     const onMerge = gitlabPushRule(loop.branch ? JSON.stringify(loop.branch) : "$CI_DEFAULT_BRANCH");
-    const onGreen = GITLAB_GREEN_TAG_RULE;
+    // #4301: the apply before merge runs in a pipeline of the target branch a person starts with CHANT_APPLY_PR set.
+    const onGreen = loop.applyBeforeMerge ? gitlabApplyPrRule(loop.branch ? JSON.stringify(loop.branch) : "$CI_DEFAULT_BRANCH") : GITLAB_GREEN_TAG_RULE;
     // A member's jobs start in its directory, after the image's install lines.
     const enter = rooted ? [] : [`cd ${memberShellDir(member)}`];
     // The command runs through chant ci run (#4156), which writes the job's run record, signed when the CHANT_RUNNER_KEY variable is set.
@@ -378,7 +390,7 @@ function prLoopGitlabPipeline(components, env, image, beforeScript, extraScript,
         { jobName: noteJob, component: "merge request plan note", stage: PR_PLAN_NOTE_JOB, needs: [planJob] },
         ...applies.map(({ job, name, stage }, i) => ({
             jobName: name,
-            component: job.wave ? `green apply, wave ${job.wave}` : job.jobName === "record" ? "merge record" : "green apply",
+            component: job.wave ? `green apply, wave ${job.wave}` : job.jobName === "record" ? "merge record" : loop.applyBeforeMerge ? "apply before merge" : "green apply",
             stage,
             needs: i > 1 ? [applies[i - 1].name] : [],
         })),

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "f0aa9cd82d2d03eb7ed4f027c87c39f5a6b1b8ca2f6e58b635249f82e99884f9",
+    "manifest.json": "94ae30275c785d868f487e6ea2f8cd1d0a1236acfd4160df5578024e351e4336",
     "meta.json": "db082fbf90c5941c498b2bee0f106103449c1a4c257716ca2220f0dd490450b2",
     "types/index.d.ts": "a048a66ebe20da0cb5fc889054cac69044d9bf882e2c56b5c5bf113d1f3ba57c",
     "rules/artifact-no-expiry.ts": "0ca5bb972d4a542126e8a0229d43b55658394cb7dd9b9923b2c590bec1c2ad7d",
@@ -55,5 +55,5 @@
     "skills/chant-gitlab-migrate.md": "4853d04980560b379e5b0f7267dcb0a1e5d5879cb9e9931681ce76b2a5fe69d8",
     "skills/chant-gitlab-patterns.md": "6d9a44e9e8de4c3820be9d65381b0d2ede4cb3626aaaf0011e21838a9fbf556e"
   },
-  "composite": "bc6817f93592903583a564a620c6bbf849d732d2ad59c960c4159c6294aaf55c"
+  "composite": "f66b0452e1ea5496564529fc156a4cdf9123a85cf40b9dc73c6c6a22ce377d34"
 }

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "gitlab",
-  "version": "0.124.41",
+  "version": "0.124.43",
   "chantVersion": ">=0.1.0",
   "namespace": "GitLab",
   "intrinsics": [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-gitlab",
-  "version": "0.124.41",
+  "version": "0.124.43",
   "description": "GitLab CI lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -67,8 +67,8 @@
     "typescript": "^5.9.3"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.124.41",
-    "@intentius/chant-lexicon-github": "^0.124.41"
+    "@intentius/chant": "^0.124.43",
+    "@intentius/chant-lexicon-github": "^0.124.43"
   },
   "peerDependenciesMeta": {
     "@intentius/chant-lexicon-github": {

package/src/components/generate-pipeline.ts

@@ -52,6 +52,7 @@ import {
   prApplyRecordKey,
   prApplyWaveJobName,
   prLoopJobs,
+  GITLAB_APPLY_PR_VAR,
   prLoopPostJob,
   prLoopSetup,
   PR_PLAN_NOTE_JOB,
@@ -329,6 +330,18 @@ function gatedWaveGitlabPipeline(
 /** The dotenv report a gated apply wave hands the green commit it applies through (#4221). */
 const WAVE_GREEN_DOTENV = "chant-green.env";
 
+/**
+ * The rule of the apply before merge (#4301, ws-106): a pipeline of `branch`
+ * that a person started from the UI, the API or a trigger with
+ * `CHANT_APPLY_PR` set to the merge request's iid. GitLab builds a merge
+ * request's own pipeline from its own files, so the apply runs in one of the
+ * target branch's. The variable only names the merge request; `pr-apply
+ * --before-merge` reads the rest from GitLab.
+ */
+function gitlabApplyPrRule(branch: string): string {
+  return `$CI_PIPELINE_SOURCE =~ /^(web|api|trigger)$/ && $${GITLAB_APPLY_PR_VAR} =~ /^[0-9]+$/ && $CI_COMMIT_BRANCH == ${branch}`;
+}
+
 /** The rule of a pipeline for a pushed `ci/green/` tag (#4168 step 9), which runs the apply under apply on merge. */
 const GITLAB_GREEN_TAG_RULE = '$CI_COMMIT_TAG =~ /^ci\\/green\\//';
 
@@ -351,14 +364,15 @@ function prLoopGitlabPipeline(
   // #4168 step 9: a push to the branch records, and under apply on merge a ci/green/ tag pipeline applies.
   const greens = loop.waveGate
     ? waveJobs.map((job) => ({ job, name: named(prApplyWaveJobName(job.wave!)), stage: prApplyWaveJobName(job.wave!) }))
-    : loop.applyOnMerge
+    : loop.applyOnMerge || loop.applyBeforeMerge
       ? [{ job: apply, name: named("apply"), stage: "apply" }]
       : [];
   const applies = [{ job: record, name: named("record"), stage: "record" }, ...greens];
   const onMergeRequest = GITLAB_MERGE_REQUEST_SOURCE;
   if (loop.branch !== undefined) assertGitlabBranch("The merge-request pipeline", loop.branch);
   const onMerge = gitlabPushRule(loop.branch ? JSON.stringify(loop.branch) : "$CI_DEFAULT_BRANCH");
-  const onGreen = GITLAB_GREEN_TAG_RULE;
+  // #4301: the apply before merge runs in a pipeline of the target branch a person starts with CHANT_APPLY_PR set.
+  const onGreen = loop.applyBeforeMerge ? gitlabApplyPrRule(loop.branch ? JSON.stringify(loop.branch) : "$CI_DEFAULT_BRANCH") : GITLAB_GREEN_TAG_RULE;
   // A member's jobs start in its directory, after the image's install lines.
   const enter = rooted ? [] : [`cd ${memberShellDir(member!)}`];
   // The command runs through chant ci run (#4156), which writes the job's run record, signed when the CHANT_RUNNER_KEY variable is set.
@@ -438,7 +452,7 @@ function prLoopGitlabPipeline(
     { jobName: noteJob, component: "merge request plan note", stage: PR_PLAN_NOTE_JOB, needs: [planJob] },
     ...applies.map(({ job, name, stage }, i) => ({
       jobName: name,
-      component: job.wave ? `green apply, wave ${job.wave}` : job.jobName === "record" ? "merge record" : "green apply",
+      component: job.wave ? `green apply, wave ${job.wave}` : job.jobName === "record" ? "merge record" : loop.applyBeforeMerge ? "apply before merge" : "green apply",
       stage,
       needs: i > 1 ? [applies[i - 1]!.name] : [],
     })),

package/src/components/generate-pr-pipeline.before-merge.test.ts

@@ -0,0 +1,37 @@
+/**
+ * The merge-request pipeline with an apply before merge (#4301, ws-106).
+ * GitLab builds a merge request's own pipeline from its own files, so the
+ * apply runs in a pipeline of the target branch a person starts with
+ * CHANT_APPLY_PR set, and checks out the merge request's head there.
+ */
+
+import { describe, expect, test } from "vitest";
+import { parseYAML } from "@intentius/chant/yaml";
+import type { DriverComponent } from "@intentius/chant/components/driver";
+import { pullRequestCheckout } from "@intentius/chant/components/pr-pipeline";
+import { generateGitlabPipeline } from "./generate-pipeline";
+
+const ESTATE: DriverComponent[] = [
+  { name: "net", dependsOn: [], deploy: [{ phase: "Apply", steps: [{ kind: "terraform-apply", root: "net" }] }] },
+];
+
+interface Job { rules: Array<{ if: string }>; variables: Record<string, string>; script: string[]; resource_group?: string }
+
+describe("the GitLab pipeline with --apply-before-merge", () => {
+  const doc = parseYAML(generateGitlabPipeline(ESTATE, { env: "prod", prLoop: { applyBeforeMerge: true } }).yaml) as { workflow: { rules: Array<{ if: string }> }; record: Job; apply: Job };
+  const RULE = '$CI_PIPELINE_SOURCE =~ /^(web|api|trigger)$/ && $CHANT_APPLY_PR =~ /^[0-9]+$/ && $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH';
+
+  test("the apply runs in a target-branch pipeline started with CHANT_APPLY_PR, and a push still records", () => {
+    expect(doc.apply.rules).toEqual([{ if: RULE }]);
+    expect(doc.workflow.rules.map((r) => r.if)).toContain(RULE);
+    expect(doc.record.rules[0]!.if).toContain('$CI_PIPELINE_SOURCE == "push"');
+    expect(doc.apply.resource_group).toBe("chant-apply-prod");
+  });
+
+  test("it checks out the merge request's head and applies before merge from the pipeline's commit", () => {
+    expect(doc.apply.variables).toMatchObject({ BASE_SHA: "$CI_COMMIT_SHA", PR_NUMBER: "$CHANT_APPLY_PR" });
+    const at = doc.apply.script.indexOf(pullRequestCheckout("gitlab"));
+    expect(at).toBeGreaterThanOrEqual(0);
+    expect(doc.apply.script.at(-1)).toBe('chant ci run apply --in-place --base "$BASE_SHA" --pr "$PR_NUMBER" --apply-before-merge --env prod --gate pr-apply --forge gitlab');
+  });
+});