@intentius/chant-lexicon-gitlab 0.124.43 → 0.124.45

package/dist/components/generate-op-waves-pipeline.d.ts

@@ -24,6 +24,11 @@
  * deciding job with the wave's own settings and a job per group (per share of
  * a group) with the group's: its tags, environment, variables over the
  * wave's, setup after the wave's, and `id_tokens:` from its `idTokens`.
+ *
+ * A job whose wave or group gives `cloud` (#4332) takes an `id_tokens:`
+ * entry per cloud, and its script starts by trading them for those
+ * identities and unsetting the token variables, before any line of the
+ * checkout runs.
  */
 import { type OpWavesSpec } from "@intentius/chant/op/op-waves";
 import type { OpWavesPipelineOptions, OpWavesPipelineResult } from "@intentius/chant/lexicon";

package/dist/components/generate-op-waves-pipeline.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generate-op-waves-pipeline.d.ts","sourceRoot":"","sources":["../../src/components/generate-op-waves-pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAkBH,OAAO,EAAmD,KAAK,WAAW,EAAE,MAAM,8BAA8B,CAAC;AACjH,OAAO,KAAK,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAG9F,gHAAgH;AAChH,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,sBAAsB,GAAG,qBAAqB,CAyFvH"}
+{"version":3,"file":"generate-op-waves-pipeline.d.ts","sourceRoot":"","sources":["../../src/components/generate-op-waves-pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAkBH,OAAO,EAAmD,KAAK,WAAW,EAAE,MAAM,8BAA8B,CAAC;AACjH,OAAO,KAAK,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAI9F,gHAAgH;AAChH,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,sBAAsB,GAAG,qBAAqB,CA4FvH"}

package/dist/components/generate-op-waves-pipeline.js

@@ -24,9 +24,15 @@
  * deciding job with the wave's own settings and a job per group (per share of
  * a group) with the group's: its tags, environment, variables over the
  * wave's, setup after the wave's, and `id_tokens:` from its `idTokens`.
+ *
+ * A job whose wave or group gives `cloud` (#4332) takes an `id_tokens:`
+ * entry per cloud, and its script starts by trading them for those
+ * identities and unsetting the token variables, before any line of the
+ * checkout runs.
  */
 import { assertGitlabBranch, assertGitlabEnvironment, assertRunnerLabels, CI_IMAGE, environmentDoc, GITLAB_FULL_HISTORY, GITLAB_MERGE_REQUEST_SOURCE, GITLAB_SCHEDULE_SOURCE, gitlabIdTokensDoc, gitlabPushRule, gitlabSetupScript, gitlabTags, nonEmpty, pushBranches, } from "@intentius/chant/ci-jobs";
 import { opWaveGroupOf, opWaveJobs, opWavesResumeCommand } from "@intentius/chant/op/op-waves";
+import { gitlabTradeIdTokens, gitlabTradeLines, TRADE_SPEC_ENV } from "@intentius/chant/ci-identity";
 import { emitGitlabFile } from "./ci-jobs.js";
 /** Render an Op waves spec as one GitLab CI file, `<name>.gitlab-ci.yml` unless `opsFileName` names another. */
 export function generateGitlabOpWavesPipeline(spec, options) {
@@ -82,7 +88,10 @@ export function generateGitlabOpWavesPipeline(spec, options) {
         const setup = [...setupOf[job.wave - 1], ...(group ? groupSetup.get(`${wave.name}/${group.name}`) : [])];
         const tags = gitlabTags(group?.runner ?? wave.runner ?? spec.runner);
         const environment = group?.environment ?? wave.environment;
-        const idTokens = gitlabIdTokensDoc(group?.idTokens ?? wave.idTokens);
+        // #4332: the job's cloud identities, traded first.
+        const cloud = group?.cloud ?? wave.cloud;
+        const declared = gitlabIdTokensDoc(group?.idTokens ?? wave.idTokens);
+        const idTokens = cloud ? { ...declared, ...gitlabTradeIdTokens(cloud) } : declared;
         entries.push([
             job.jobName,
             {
@@ -92,10 +101,10 @@ export function generateGitlabOpWavesPipeline(spec, options) {
                 resource_group: `${spec.name}-${wave.name}`,
                 ...(environment ? { environment: environmentDoc(environment) } : {}),
                 ...(idTokens ? { id_tokens: idTokens } : {}),
-                variables: { ...GITLAB_FULL_HISTORY, ...(wave.variables ?? {}), ...(group?.variables ?? {}) },
+                variables: { ...GITLAB_FULL_HISTORY, ...(wave.variables ?? {}), ...(group?.variables ?? {}), ...(cloud ? { [TRADE_SPEC_ENV]: JSON.stringify(cloud) } : {}) },
                 rules,
                 ...(job.needs.length > 0 ? { needs: job.needs } : {}),
-                script: [...setup, ...(options.beforeScript ?? []), job.command.join(" "), ...(options.extraScript ?? [])],
+                script: [...(cloud ? gitlabTradeLines() : []), ...setup, ...(options.beforeScript ?? []), job.command.join(" "), ...(options.extraScript ?? [])],
                 ...(job.kind === "decide" ? { artifacts: { when: "always", paths: [job.record], expire_in: "30 days" } } : {}),
             },
         ]);

package/dist/components/generate-pipeline.js

@@ -422,6 +422,10 @@ function prEnvGitlabJobs(image, beforeScript, extraScript, enter, loop, member,
     const group = `chant-pr-env-${member ? `${member.name}-` : ""}$CI_MERGE_REQUEST_IID`;
     const script = (j) => [...prLoopSetup(image), ...enter, ...beforeScript, ...(j.build ?? []), j.command, ...extraScript];
     const artifacts = { when: "always", paths: [reportPath] };
+    // #4330: env-up, env-down and env-sweep trade the job's OIDC token for the pull request environments' identity first.
+    const identity = loop.prEnvIdentity;
+    const trading = identity ? { id_tokens: gitlabTradeIdTokens(identity) } : {};
+    const tradeVars = identity ? { [TRADE_SPEC_ENV]: JSON.stringify(identity) } : {};
     return {
         jobs: {
             [named("env-up")]: {
@@ -430,9 +434,11 @@ function prEnvGitlabJobs(image, beforeScript, extraScript, enter, loop, member,
                 rules: [{ if: onMergeRequest }],
                 resource_group: group,
                 environment: { name: environment, on_stop: named("env-down") },
-                variables: up.env,
+                ...trading,
+                variables: { ...up.env, ...tradeVars },
                 // #4295: the merge request's code runs in this job, so the job's shell drops the forge tokens first.
-                script: [GITLAB_DROP_FORGE_TOKENS, ...script(up)],
+                // #4330: with an identity, the trade runs before that, and the same unset drops the token variables too.
+                script: [...(identity ? gitlabTradeLines(FORGE_TOKEN_VARS) : [GITLAB_DROP_FORGE_TOKENS]), ...script(up)],
                 artifacts,
             },
             [named(PR_ENV_POST_JOB)]: {
@@ -451,8 +457,9 @@ function prEnvGitlabJobs(image, beforeScript, extraScript, enter, loop, member,
                 allow_failure: true,
                 resource_group: group,
                 environment: { name: environment, action: "stop" },
-                variables: down.env,
-                script: script(down),
+                ...trading,
+                variables: { ...down.env, ...tradeVars },
+                script: [...(identity ? gitlabTradeLines() : []), ...script(down)],
                 artifacts,
             },
             [named("env-sweep")]: {
@@ -460,8 +467,9 @@ function prEnvGitlabJobs(image, beforeScript, extraScript, enter, loop, member,
                 image,
                 rules: [{ if: GITLAB_SCHEDULE_RULE }],
                 resource_group: `chant-pr-env-sweep${member ? `-${member.name}` : ""}`,
-                variables: sweep.env,
-                script: script(sweep),
+                ...trading,
+                variables: { ...sweep.env, ...tradeVars },
+                script: [...(identity ? gitlabTradeLines() : []), ...script(sweep)],
                 artifacts,
             },
         },

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "94ae30275c785d868f487e6ea2f8cd1d0a1236acfd4160df5578024e351e4336",
+    "manifest.json": "88db3565e73e6e08093cc50a58cd3ff61cac32c75781ca00817628cf7d27daa7",
     "meta.json": "db082fbf90c5941c498b2bee0f106103449c1a4c257716ca2220f0dd490450b2",
     "types/index.d.ts": "a048a66ebe20da0cb5fc889054cac69044d9bf882e2c56b5c5bf113d1f3ba57c",
     "rules/artifact-no-expiry.ts": "0ca5bb972d4a542126e8a0229d43b55658394cb7dd9b9923b2c590bec1c2ad7d",
@@ -55,5 +55,5 @@
     "skills/chant-gitlab-migrate.md": "4853d04980560b379e5b0f7267dcb0a1e5d5879cb9e9931681ce76b2a5fe69d8",
     "skills/chant-gitlab-patterns.md": "6d9a44e9e8de4c3820be9d65381b0d2ede4cb3626aaaf0011e21838a9fbf556e"
   },
-  "composite": "f66b0452e1ea5496564529fc156a4cdf9123a85cf40b9dc73c6c6a22ce377d34"
+  "composite": "6aa6f17b680f94ee132550ccaf9ba993840b3eef23113c79ec226031546800f0"
 }

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "gitlab",
-  "version": "0.124.43",
+  "version": "0.124.45",
   "chantVersion": ">=0.1.0",
   "namespace": "GitLab",
   "intrinsics": [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-gitlab",
-  "version": "0.124.43",
+  "version": "0.124.45",
   "description": "GitLab CI lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -67,8 +67,8 @@
     "typescript": "^5.9.3"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.124.43",
-    "@intentius/chant-lexicon-github": "^0.124.43"
+    "@intentius/chant": "^0.124.45",
+    "@intentius/chant-lexicon-github": "^0.124.45"
   },
   "peerDependenciesMeta": {
     "@intentius/chant-lexicon-github": {

package/src/components/generate-op-waves-pipeline.test.ts

@@ -109,3 +109,24 @@ describe("a runner per wave and job groups per wave (#3914)", () => {
     expect(() => generateGitlabOpWavesPipeline({ ...spec, runner: { group: "apply" } }, { specFile: "waves.json" })).toThrow(/Op waves "migrations": runner is the runner group/);
   });
 });
+
+describe("an Op wave's jobs by cloud identity (#4332)", () => {
+  test("each job takes an id_tokens entry per cloud and starts its script with the trade, the deciding job for the plan identities", async () => {
+    const { parseYAML } = await import("@intentius/chant/yaml");
+    const { cloudIdentityWave, gitlabTradeLines, TRADE_SPEC_ENV, tradeIdentities } = await import("@intentius/chant/ci-identity");
+    const decl = { aws: { rules: [{ targets: ["envs/prod/**"], plan: "prod-plan", apply: "prod-apply" }, { plan: "own-plan", apply: "own-apply" }] } };
+    const roots = ["envs/prod/net", "shared/dns"];
+    const grouped: OpWavesSpec = { ...spec, waves: [{ name: "prod", runs: roots.map((target) => ({ target })), idTokens: { OTHER_TOKEN: "other.example" }, ...cloudIdentityWave(decl, "prod", "infra", roots) }] };
+    const doc = parseYAML(generateGitlabOpWavesPipeline(grouped, { specFile: "waves.json", beforeScript: ["npm ci"] }).files[0]!.yaml) as Record<string, { id_tokens?: Record<string, { aud: string }>; variables: Record<string, string>; script: string[] }>;
+    const want: Record<string, string[]> = { "wave-1-prod-decide": ["own-plan", "prod-plan"], "wave-1-prod-envs-prod": ["prod-apply"], "wave-1-prod-default": ["own-apply"] };
+    for (const [name, ids] of Object.entries(want)) {
+      const job = doc[name]!;
+      expect(job.id_tokens).toEqual({ OTHER_TOKEN: { aud: "other.example" }, CHANT_ID_TOKEN_AWS: { aud: "sts.amazonaws.com" } });
+      expect(job.script.slice(0, 3)).toEqual(gitlabTradeLines());
+      expect(job.script[3]).toBe("npm ci");
+      expect(tradeIdentities(JSON.parse(job.variables[TRADE_SPEC_ENV]!))).toEqual(ids);
+    }
+    expect(JSON.stringify(doc["wave-1-prod-decide"])).not.toContain("apply\"");
+    expect(JSON.stringify(doc["wave-1-prod-default"])).not.toContain("prod-apply");
+  });
+});

package/src/components/generate-op-waves-pipeline.ts

@@ -24,6 +24,11 @@
  * deciding job with the wave's own settings and a job per group (per share of
  * a group) with the group's: its tags, environment, variables over the
  * wave's, setup after the wave's, and `id_tokens:` from its `idTokens`.
+ *
+ * A job whose wave or group gives `cloud` (#4332) takes an `id_tokens:`
+ * entry per cloud, and its script starts by trading them for those
+ * identities and unsetting the token variables, before any line of the
+ * checkout runs.
  */
 
 import {
@@ -44,6 +49,7 @@ import {
 } from "@intentius/chant/ci-jobs";
 import { opWaveGroupOf, opWaveJobs, opWavesResumeCommand, type OpWavesSpec } from "@intentius/chant/op/op-waves";
 import type { OpWavesPipelineOptions, OpWavesPipelineResult } from "@intentius/chant/lexicon";
+import { gitlabTradeIdTokens, gitlabTradeLines, TRADE_SPEC_ENV } from "@intentius/chant/ci-identity";
 import { emitGitlabFile } from "./ci-jobs";
 
 /** Render an Op waves spec as one GitLab CI file, `<name>.gitlab-ci.yml` unless `opsFileName` names another. */
@@ -96,7 +102,10 @@ export function generateGitlabOpWavesPipeline(spec: OpWavesSpec, options: OpWave
     const setup = [...setupOf[job.wave - 1]!, ...(group ? groupSetup.get(`${wave.name}/${group.name}`)! : [])];
     const tags = gitlabTags(group?.runner ?? wave.runner ?? spec.runner);
     const environment = group?.environment ?? wave.environment;
-    const idTokens = gitlabIdTokensDoc(group?.idTokens ?? wave.idTokens);
+    // #4332: the job's cloud identities, traded first.
+    const cloud = group?.cloud ?? wave.cloud;
+    const declared = gitlabIdTokensDoc(group?.idTokens ?? wave.idTokens);
+    const idTokens = cloud ? { ...declared, ...gitlabTradeIdTokens(cloud) } : declared;
     entries.push([
       job.jobName,
       {
@@ -106,10 +115,10 @@ export function generateGitlabOpWavesPipeline(spec: OpWavesSpec, options: OpWave
         resource_group: `${spec.name}-${wave.name}`,
         ...(environment ? { environment: environmentDoc(environment) } : {}),
         ...(idTokens ? { id_tokens: idTokens } : {}),
-        variables: { ...GITLAB_FULL_HISTORY, ...(wave.variables ?? {}), ...(group?.variables ?? {}) },
+        variables: { ...GITLAB_FULL_HISTORY, ...(wave.variables ?? {}), ...(group?.variables ?? {}), ...(cloud ? { [TRADE_SPEC_ENV]: JSON.stringify(cloud) } : {}) },
         rules,
         ...(job.needs.length > 0 ? { needs: job.needs } : {}),
-        script: [...setup, ...(options.beforeScript ?? []), job.command.join(" "), ...(options.extraScript ?? [])],
+        script: [...(cloud ? gitlabTradeLines() : []), ...setup, ...(options.beforeScript ?? []), job.command.join(" "), ...(options.extraScript ?? [])],
         ...(job.kind === "decide" ? { artifacts: { when: "always", paths: [job.record!], expire_in: "30 days" } } : {}),
       },
     ]);

package/src/components/generate-pipeline.ts

@@ -496,6 +496,10 @@ function prEnvGitlabJobs(
   const group = `chant-pr-env-${member ? `${member.name}-` : ""}$CI_MERGE_REQUEST_IID`;
   const script = (j: typeof up): string[] => [...prLoopSetup(image), ...enter, ...beforeScript, ...(j.build ?? []), j.command, ...extraScript];
   const artifacts = { when: "always", paths: [reportPath] };
+  // #4330: env-up, env-down and env-sweep trade the job's OIDC token for the pull request environments' identity first.
+  const identity = loop.prEnvIdentity;
+  const trading = identity ? { id_tokens: gitlabTradeIdTokens(identity) } : {};
+  const tradeVars: Record<string, string> = identity ? { [TRADE_SPEC_ENV]: JSON.stringify(identity) } : {};
   return {
     jobs: {
       [named("env-up")]: {
@@ -504,9 +508,11 @@ function prEnvGitlabJobs(
         rules: [{ if: onMergeRequest }],
         resource_group: group,
         environment: { name: environment, on_stop: named("env-down") },
-        variables: up.env,
+        ...trading,
+        variables: { ...up.env, ...tradeVars },
         // #4295: the merge request's code runs in this job, so the job's shell drops the forge tokens first.
-        script: [GITLAB_DROP_FORGE_TOKENS, ...script(up)],
+        // #4330: with an identity, the trade runs before that, and the same unset drops the token variables too.
+        script: [...(identity ? gitlabTradeLines(FORGE_TOKEN_VARS) : [GITLAB_DROP_FORGE_TOKENS]), ...script(up)],
         artifacts,
       },
       [named(PR_ENV_POST_JOB)]: {
@@ -525,8 +531,9 @@ function prEnvGitlabJobs(
         allow_failure: true,
         resource_group: group,
         environment: { name: environment, action: "stop" },
-        variables: down.env,
-        script: script(down),
+        ...trading,
+        variables: { ...down.env, ...tradeVars },
+        script: [...(identity ? gitlabTradeLines() : []), ...script(down)],
         artifacts,
       },
       [named("env-sweep")]: {
@@ -534,8 +541,9 @@ function prEnvGitlabJobs(
         image,
         rules: [{ if: GITLAB_SCHEDULE_RULE }],
         resource_group: `chant-pr-env-sweep${member ? `-${member.name}` : ""}`,
-        variables: sweep.env,
-        script: script(sweep),
+        ...trading,
+        variables: { ...sweep.env, ...tradeVars },
+        script: [...(identity ? gitlabTradeLines() : []), ...script(sweep)],
         artifacts,
       },
     },

package/src/components/generate-pr-env-pipeline.test.ts

@@ -89,3 +89,23 @@ describe("the GitLab env-up job holds no forge token while the merge request's c
     expect(post.script.join("\n")).not.toMatch(/chant (build|lint)|pr-env up/);
   });
 });
+
+describe("the environment's cloud identity (#4330)", () => {
+  const prEnvIdentity = { aws: { role: "arn:aws:iam::000000000000:role/pr-env-apply", region: "us-east-1", audience: "sts.amazonaws.com", endpoint: "http://localhost:4566" } };
+  const doc = parseYAML(generateGitlabPipeline(ESTATE, { env: "staging", image: "node:22", prLoop: { prEnvironment: true, prEnvIdentity } }).yaml) as Record<string, Job & { id_tokens?: Record<string, unknown> }>;
+
+  test("env-up trades first, and the same line drops the forge tokens before the merge request's code runs", () => {
+    const up = doc["env-up"]!;
+    expect(up.id_tokens).toBeDefined();
+    expect(up.variables.CHANT_CLOUD_TRADE).toBe(JSON.stringify(prEnvIdentity));
+    expect(up.script).not.toContain(GITLAB_DROP_FORGE_TOKENS);
+    const unset = up.script.findIndex((l) => l.startsWith("unset ") && l.includes("CHANT_FORGE_TOKEN"));
+    expect(unset).toBeGreaterThan(-1);
+    expect(unset).toBeLessThan(up.script.findIndex((l) => l.startsWith("chant components pr-env up")));
+  });
+
+  test("env-down and env-sweep trade for it too, and env-post does not", () => {
+    for (const name of ["env-down", "env-sweep"]) expect(doc[name]!.variables.CHANT_CLOUD_TRADE).toBe(JSON.stringify(prEnvIdentity));
+    expect(doc["env-post"]!.variables.CHANT_CLOUD_TRADE).toBeUndefined();
+  });
+});