@intentius/chant-lexicon-gitlab 0.124.56 → 0.124.57

package/dist/components/generate-op-waves-pipeline.d.ts

@@ -18,6 +18,14 @@
  * A wave's `environment` is the job's own `environment:`; protect it in the
  * project settings to put a reviewer in front of the job as well.
  *
+ * The wave jobs carry no `resource_group` (ruling for ci-products
+ * 2026-10-28, "Ledger lock"), the same as the GitHub and Forgejo waves files
+ * carry no concurrency group: a per-wave resource group would keep two
+ * pipelines' plunge stacks apart where their resource rows do not meet. A
+ * stock Pulumi stack or a Terraform root waits for its row on chant's ledger,
+ * oldest commit first, up to the job's `timeout`, which `CHANT_LOCK_WAIT`
+ * sits five minutes under; the project's own maximum timeout still caps it.
+ *
  * With `resume` on the spec (#3683), a `<name>-resume` job runs `chant run
  * resume --op <name>` in scheduled pipelines only: create a pipeline schedule
  * with the spec's cron. It retries a waiting wave's job once its approval

package/dist/components/generate-op-waves-pipeline.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generate-op-waves-pipeline.d.ts","sourceRoot":"","sources":["../../src/components/generate-op-waves-pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4DG;AAkBH,OAAO,EAYL,KAAK,WAAW,EACjB,MAAM,8BAA8B,CAAC;AAEtC,OAAO,KAAK,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAO9F,yHAAyH;AACzH,eAAO,MAAM,oBAAoB,GAAoB,CAAC;AAEtD,gHAAgH;AAChH,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,sBAAsB,GAAG,qBAAqB,CAqKvH"}
+{"version":3,"file":"generate-op-waves-pipeline.d.ts","sourceRoot":"","sources":["../../src/components/generate-op-waves-pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoEG;AAkBH,OAAO,EAaL,KAAK,WAAW,EACjB,MAAM,8BAA8B,CAAC;AAEtC,OAAO,KAAK,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAO9F,yHAAyH;AACzH,eAAO,MAAM,oBAAoB,GAAoB,CAAC;AAEtD,gHAAgH;AAChH,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,sBAAsB,GAAG,qBAAqB,CAuKvH"}

package/dist/components/generate-op-waves-pipeline.js

@@ -18,6 +18,14 @@
  * A wave's `environment` is the job's own `environment:`; protect it in the
  * project settings to put a reviewer in front of the job as well.
  *
+ * The wave jobs carry no `resource_group` (ruling for ci-products
+ * 2026-10-28, "Ledger lock"), the same as the GitHub and Forgejo waves files
+ * carry no concurrency group: a per-wave resource group would keep two
+ * pipelines' plunge stacks apart where their resource rows do not meet. A
+ * stock Pulumi stack or a Terraform root waits for its row on chant's ledger,
+ * oldest commit first, up to the job's `timeout`, which `CHANT_LOCK_WAIT`
+ * sits five minutes under; the project's own maximum timeout still caps it.
+ *
  * With `resume` on the spec (#3683), a `<name>-resume` job runs `chant run
  * resume --op <name>` in scheduled pipelines only: create a pipeline schedule
  * with the spec's cron. It retries a waiting wave's job once its approval
@@ -60,7 +68,7 @@
  * after it stop.
  */
 import { assertGitlabBranch, assertGitlabEnvironment, assertRunnerLabels, CI_IMAGE, environmentDoc, GITLAB_FULL_HISTORY, GITLAB_MERGE_REQUEST_SOURCE, GITLAB_SCHEDULE_SOURCE, gitlabIdTokensDoc, gitlabPushRule, gitlabSetupScript, gitlabTags, nonEmpty, pushBranches, } from "@intentius/chant/ci-jobs";
-import { opWaveGroupOf, opWaveJobs, opWaveOutcomeDir, opWavesControlTarget, opWavesLastJobs, OP_WAVES_APPROVAL_STATUS_VAR, opWavesApprovalStatusCommand, opWavesPostsApprovalStatus, opWavesOutcomeCommand, opWavesRecordPlansCommand, opWavesResumeCommand, } from "@intentius/chant/op/op-waves";
+import { opWaveGroupOf, opWaveJobs, opWaveJobTimeout, opWaveOutcomeDir, opWavesControlTarget, opWavesLastJobs, OP_WAVES_APPROVAL_STATUS_VAR, opWavesApprovalStatusCommand, opWavesPostsApprovalStatus, opWavesOutcomeCommand, opWavesRecordPlansCommand, opWavesResumeCommand, } from "@intentius/chant/op/op-waves";
 import { CONTROL_OUTCOME_VAR, CONTROL_TOKEN_VARS, controlDispatchJob } from "@intentius/chant/control/dispatch";
 import { gitlabTradeIdTokens, gitlabTradeLines, TRADE_SPEC_ENV } from "@intentius/chant/ci-identity";
 import { JOB_GUARD_ENV, jobGuardLine, jobGuardSpec, opWaveJobLabel } from "@intentius/chant/ci-job-guard";
@@ -108,6 +116,8 @@ export function generateGitlabOpWavesPipeline(spec, options) {
     if (spec.resume)
         stages.push("resume");
     const entries = [["stages", stages]];
+    // The ruling for ci-products (2026-10-28): each wave job's timeout, and the lock wait five minutes under it.
+    const timeout = opWaveJobTimeout(options.jobTimeoutMinutes);
     const variables = nonEmpty("variables", options.variables).variables;
     if (variables)
         entries.push(["variables", variables]);
@@ -162,10 +172,10 @@ export function generateGitlabOpWavesPipeline(spec, options) {
                 stage: stages[job.wave - 1 + (byReview ? 1 : 0)],
                 image,
                 ...(tags ? { tags } : {}),
-                resource_group: `${spec.name}-${wave.name}`,
+                timeout: `${timeout.minutes} minutes`,
                 ...(environment ? { environment: environmentDoc(environment) } : {}),
                 ...(idTokens ? { id_tokens: idTokens } : {}),
-                variables: { ...GITLAB_FULL_HISTORY, ...(wave.variables ?? {}), ...(group?.variables ?? {}), ...(cloud ? { [TRADE_SPEC_ENV]: JSON.stringify(cloud) } : {}), [JOB_GUARD_ENV]: JSON.stringify(guard) },
+                variables: { ...GITLAB_FULL_HISTORY, ...timeout.env, ...(wave.variables ?? {}), ...(group?.variables ?? {}), ...(cloud ? { [TRADE_SPEC_ENV]: JSON.stringify(cloud) } : {}), [JOB_GUARD_ENV]: JSON.stringify(guard) },
                 rules,
                 ...(job.needs.length > 0 ? { needs: job.needs } : {}),
                 script: [jobGuardLine(), ...(cloud ? gitlabTradeLines() : []), ...dropControl, ...setup, ...(options.beforeScript ?? []), job.command.join(" "), ...(options.extraScript ?? [])],

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "601276a64d47a1758b2b6e26d232c5f746ec007b05950d993fc37ef4f09e2250",
+    "manifest.json": "617558151e681cf5f4ea5df936170cd8ec7739e81744fb3157b8f34f416b02eb",
     "meta.json": "db082fbf90c5941c498b2bee0f106103449c1a4c257716ca2220f0dd490450b2",
     "types/index.d.ts": "a048a66ebe20da0cb5fc889054cac69044d9bf882e2c56b5c5bf113d1f3ba57c",
     "rules/artifact-no-expiry.ts": "0ca5bb972d4a542126e8a0229d43b55658394cb7dd9b9923b2c590bec1c2ad7d",
@@ -55,5 +55,5 @@
     "skills/chant-gitlab-migrate.md": "4853d04980560b379e5b0f7267dcb0a1e5d5879cb9e9931681ce76b2a5fe69d8",
     "skills/chant-gitlab-patterns.md": "6d9a44e9e8de4c3820be9d65381b0d2ede4cb3626aaaf0011e21838a9fbf556e"
   },
-  "composite": "9ed920259d4f54b7734a8887fd98ea4e6357311cde69b7a84197365dc95505b5"
+  "composite": "841ec4d4eec31c0a7724d61da9bf8b8f1592960dde4938b1b9140fe3ec0d9b7b"
 }

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "gitlab",
-  "version": "0.124.56",
+  "version": "0.124.57",
   "chantVersion": ">=0.1.0",
   "namespace": "GitLab",
   "intrinsics": [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-gitlab",
-  "version": "0.124.56",
+  "version": "0.124.57",
   "description": "GitLab CI lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -67,8 +67,8 @@
     "typescript": "^5.9.3"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.124.56",
-    "@intentius/chant-lexicon-github": "^0.124.56"
+    "@intentius/chant": "^0.124.57",
+    "@intentius/chant-lexicon-github": "^0.124.57"
   },
   "peerDependenciesMeta": {
     "@intentius/chant-lexicon-github": {

package/src/components/__golden__/op-waves-jobs.yml

@@ -15,9 +15,10 @@ wave-1-dev:
   tags:
     - docker
     - dev
-  resource_group: migrations-dev
+  timeout: '180 minutes'
   variables:
     GIT_DEPTH: '0'
+    CHANT_LOCK_WAIT: '10500'
     CHANT_JOB_GUARD: '{"forge":"gitlab","job":"wave 1 (dev) of migrations","branches":["main"],"runnerTags":["docker","dev"]}'
   rules:
     - if: '$CI_PIPELINE_SOURCE == "push" && $CI_COMMIT_BRANCH == "main"'
@@ -38,12 +39,13 @@ wave-2-prod-decide:
   image: node:22
   tags:
     - plan
-  resource_group: migrations-prod
+  timeout: '180 minutes'
   id_tokens:
     PLAN_TOKEN:
       aud: plan.example
   variables:
     GIT_DEPTH: '0'
+    CHANT_LOCK_WAIT: '10500'
     CHANT_JOB_GUARD: '{"forge":"gitlab","job":"the deciding job of wave 2 (prod) of migrations","branches":["main"],"runnerTags":["plan"]}'
   rules:
     - if: '$CI_PIPELINE_SOURCE == "push" && $CI_COMMIT_BRANCH == "main"'
@@ -67,7 +69,7 @@ wave-2-prod-us:
   image: node:22
   tags:
     - us-apply
-  resource_group: migrations-prod
+  timeout: '180 minutes'
   environment:
     name: prod-us
   id_tokens:
@@ -75,6 +77,7 @@ wave-2-prod-us:
       aud: us.example
   variables:
     GIT_DEPTH: '0'
+    CHANT_LOCK_WAIT: '10500'
     REGION: us
     CHANT_JOB_GUARD: '{"forge":"gitlab","job":"job group us of wave 2 (prod) of migrations","forgeEnvironment":"prod-us","branches":["main"],"runnerTags":["us-apply"]}'
   rules:
@@ -99,7 +102,7 @@ wave-2-prod-eu:
   image: node:22
   tags:
     - eu-apply
-  resource_group: migrations-prod
+  timeout: '180 minutes'
   environment:
     name: prod-eu
   id_tokens:
@@ -107,6 +110,7 @@ wave-2-prod-eu:
       aud: eu.example
   variables:
     GIT_DEPTH: '0'
+    CHANT_LOCK_WAIT: '10500'
     CHANT_JOB_GUARD: '{"forge":"gitlab","job":"job group eu of wave 2 (prod) of migrations","forgeEnvironment":"prod-eu","branches":["main"],"runnerTags":["eu-apply"]}'
   rules:
     - if: '$CI_PIPELINE_SOURCE == "push" && $CI_COMMIT_BRANCH == "main"'

package/src/components/generate-op-waves-pipeline.test.ts

@@ -95,9 +95,9 @@ describe("a runner per wave and job groups per wave (#3914)", () => {
   test("tags, environment, id_tokens, variables and the group's command on each job", () => {
     const yaml = generateGitlabOpWavesPipeline(grouped, { specFile: "waves.json" }).files[0]!.yaml;
     expect(yaml).toMatch(/wave-1-dev:\n\s+stage: wave-1-dev\n\s+image: node:22\n\s+tags:\n\s+- docker\n\s+- dev\n/);
-    expect(yaml).toMatch(/wave-2-prod-decide:\n\s+stage: wave-2-prod\n\s+image: node:22\n\s+tags:\n\s+- plan\n\s+resource_group: migrations-prod\n\s+id_tokens:\n\s+PLAN_TOKEN:\n\s+aud: plan.example\n/);
+    expect(yaml).toMatch(/wave-2-prod-decide:\n\s+stage: wave-2-prod\n\s+image: node:22\n\s+tags:\n\s+- plan\n\s+timeout: '180 minutes'\n\s+id_tokens:\n\s+PLAN_TOKEN:\n\s+aud: plan.example\n/);
     expect(yaml).toMatch(
-      /wave-2-prod-us:\n\s+stage: wave-2-prod\n\s+image: node:22\n\s+tags:\n\s+- us-apply\n\s+resource_group: migrations-prod\n\s+environment:\n\s+name: prod-us\n\s+id_tokens:\n\s+CLOUD_TOKEN:\n\s+aud: us.example\n\s+variables:\n\s+GIT_DEPTH: '0'\n\s+REGION: us\n\s+CHANT_JOB_GUARD: [^\n]*\n[\s\S]*?needs:\n\s+- wave-2-prod-decide\n\s+script:\n\s+- [^\n]*node -e[^\n]*\n\s+- echo us\n\s+- chant run wave --spec waves.json --wave 2 --group us\n/,
+      /wave-2-prod-us:\n\s+stage: wave-2-prod\n\s+image: node:22\n\s+tags:\n\s+- us-apply\n\s+timeout: '180 minutes'\n\s+environment:\n\s+name: prod-us\n\s+id_tokens:\n\s+CLOUD_TOKEN:\n\s+aud: us.example\n\s+variables:\n\s+GIT_DEPTH: '0'\n\s+CHANT_LOCK_WAIT: '10500'\n\s+REGION: us\n\s+CHANT_JOB_GUARD: [^\n]*\n[\s\S]*?needs:\n\s+- wave-2-prod-decide\n\s+script:\n\s+- [^\n]*node -e[^\n]*\n\s+- echo us\n\s+- chant run wave --spec waves.json --wave 2 --group us\n/,
     );
     expect(yaml).toMatch(/wave-2-prod-eu:[\s\S]*?id_tokens:\n\s+CLOUD_TOKEN:\n\s+aud: eu.example\n/);
     expect(yaml).not.toContain("_AUDIENCE");
@@ -149,3 +149,12 @@ describe("an Op wave's jobs by cloud identity (#4332)", () => {
     expect(jobs.every((j) => j.command[0] === "chant")).toBe(true);
   });
 });
+
+describe("the ledger lock (ruling for ci-products 2026-10-28)", () => {
+  test("the wave jobs carry no resource_group; each carries its timeout and the lock wait under it", () => {
+    const yaml = generateGitlabOpWavesPipeline(spec, { specFile: "waves.json" }).files[0]!.yaml;
+    expect(yaml).not.toContain("resource_group");
+    expect(yaml).toContain("timeout: '180 minutes'\n");
+    expect(yaml).toContain("CHANT_LOCK_WAIT: '10500'\n");
+  });
+});

package/src/components/generate-op-waves-pipeline.ts

@@ -18,6 +18,14 @@
  * A wave's `environment` is the job's own `environment:`; protect it in the
  * project settings to put a reviewer in front of the job as well.
  *
+ * The wave jobs carry no `resource_group` (ruling for ci-products
+ * 2026-10-28, "Ledger lock"), the same as the GitHub and Forgejo waves files
+ * carry no concurrency group: a per-wave resource group would keep two
+ * pipelines' plunge stacks apart where their resource rows do not meet. A
+ * stock Pulumi stack or a Terraform root waits for its row on chant's ledger,
+ * oldest commit first, up to the job's `timeout`, which `CHANT_LOCK_WAIT`
+ * sits five minutes under; the project's own maximum timeout still caps it.
+ *
  * With `resume` on the spec (#3683), a `<name>-resume` job runs `chant run
  * resume --op <name>` in scheduled pipelines only: create a pipeline schedule
  * with the spec's cron. It retries a waiting wave's job once its approval
@@ -79,6 +87,7 @@ import {
 import {
   opWaveGroupOf,
   opWaveJobs,
+  opWaveJobTimeout,
   opWaveOutcomeDir,
   opWavesControlTarget,
   opWavesLastJobs,
@@ -136,6 +145,8 @@ export function generateGitlabOpWavesPipeline(spec: OpWavesSpec, options: OpWave
   if (control) stages.push("control");
   if (spec.resume) stages.push("resume");
   const entries: Array<readonly [string, unknown]> = [["stages", stages]];
+  // The ruling for ci-products (2026-10-28): each wave job's timeout, and the lock wait five minutes under it.
+  const timeout = opWaveJobTimeout(options.jobTimeoutMinutes);
   const variables = nonEmpty("variables", options.variables).variables;
   if (variables) entries.push(["variables", variables]);
   if (byReview) {
@@ -189,10 +200,10 @@ export function generateGitlabOpWavesPipeline(spec: OpWavesSpec, options: OpWave
         stage: stages[job.wave - 1 + (byReview ? 1 : 0)],
         image,
         ...(tags ? { tags } : {}),
-        resource_group: `${spec.name}-${wave.name}`,
+        timeout: `${timeout.minutes} minutes`,
         ...(environment ? { environment: environmentDoc(environment) } : {}),
         ...(idTokens ? { id_tokens: idTokens } : {}),
-        variables: { ...GITLAB_FULL_HISTORY, ...(wave.variables ?? {}), ...(group?.variables ?? {}), ...(cloud ? { [TRADE_SPEC_ENV]: JSON.stringify(cloud) } : {}), [JOB_GUARD_ENV]: JSON.stringify(guard) },
+        variables: { ...GITLAB_FULL_HISTORY, ...timeout.env, ...(wave.variables ?? {}), ...(group?.variables ?? {}), ...(cloud ? { [TRADE_SPEC_ENV]: JSON.stringify(cloud) } : {}), [JOB_GUARD_ENV]: JSON.stringify(guard) },
         rules,
         ...(job.needs.length > 0 ? { needs: job.needs } : {}),
         script: [jobGuardLine(), ...(cloud ? gitlabTradeLines() : []), ...dropControl, ...setup, ...(options.beforeScript ?? []), job.command.join(" "), ...(options.extraScript ?? [])],