@intentius/chant-lexicon-gitlab 0.13.0 → 0.15.0

package/src/components/generate-pipeline.test.ts

@@ -0,0 +1,238 @@
+/**
+ * Tests for generate mode's component → GitLab CI YAML synthesis (#563,
+ * epic #551, Phase 3). Three things this must prove, matching the issue's
+ * acceptance criteria:
+ *
+ *  1. A component set produces structurally valid GitLab CI YAML (parses
+ *     back via `../yaml.ts`'s `parseYAML`, with `stages:` + one job per
+ *     component, each job carrying a `script:`/`stage:`/`image:`).
+ *  2. Jobs map onto components in wave order — a component's job lands in
+ *     the same wave `resolveComponentGraph` (the driver's own graph
+ *     resolution, ../driver.ts) computes, and depends (`needs:`) only on its
+ *     own `dependsOn` edges, never on unrelated jobs.
+ *  3. A cross-cutting generator change (e.g. "sign every image before
+ *     deploy") is a single edit to the generator's options — reflected in
+ *     every job's script — never a per-component edit.
+ */
+
+import { describe, test, expect } from "vitest";
+import { parseYAML } from "@intentius/chant/yaml";
+import { generateGitlabPipeline } from "./generate-pipeline";
+import { resolveComponentGraph, DependencyCycleError, UnknownDependencyError, type DriverComponent } from "@intentius/chant/components/driver";
+import { searchService } from "@intentius/chant/components/pilots/alb-ecs.pilot";
+import { ordersTable } from "@intentius/chant/components/pilots/dynamodb.pilot";
+
+/** Real pilot components (#555) plus the shared-alb infra `search-service` depends on, as a realistic multi-wave input. */
+function pilotComponents(): DriverComponent[] {
+  return [
+    { name: ordersTable.name, dependsOn: ordersTable.dependsOn, deploy: ordersTable.deploy },
+    { name: "shared-alb", dependsOn: [], deploy: [] },
+    { name: searchService.name, dependsOn: searchService.dependsOn, deploy: searchService.deploy },
+  ];
+}
+
+describe("generateGitlabPipeline: cross-stack output threading (artifacts)", () => {
+  test("a depended-upon component dumps its outputs as an artifact; its dependents seed from it", () => {
+    // search-service dependsOn shared-alb; orders-table is depended on by nothing.
+    const parsed = parseYAML(generateGitlabPipeline(pilotComponents()).yaml);
+
+    // Producer: shared-alb hands its resolved outputs to a separate downstream
+    // job, so it dumps them and publishes the file as an artifact.
+    const shared = parsed["shared-alb"] as Record<string, unknown>;
+    expect((shared.script as string[]).join(" ")).toContain("--dump-outputs shared-alb.outputs.json");
+    expect(shared.artifacts).toEqual({ paths: ["shared-alb.outputs.json"] });
+
+    // Consumer: search-service seeds from shared-alb's dumped outputs (delivered
+    // across the needs: edge) so its stackOutput() references resolve.
+    const svc = parsed["search-service"] as Record<string, unknown>;
+    expect((svc.script as string[]).join(" ")).toContain("--seed-outputs shared-alb.outputs.json");
+
+    // A component nothing depends on neither dumps nor carries an artifact.
+    const orders = parsed["orders-table"] as Record<string, unknown>;
+    expect((orders.script as string[]).join(" ")).not.toContain("--dump-outputs");
+    expect(orders.artifacts).toBeUndefined();
+    expect((orders.script as string[]).join(" ")).not.toContain("--seed-outputs");
+  });
+});
+
+describe("generateGitlabPipeline: structurally valid YAML", () => {
+  test("produces YAML with a stages: list and one job per component", () => {
+    const result = generateGitlabPipeline(pilotComponents(), { env: "staging" });
+
+    const parsed = parseYAML(result.yaml);
+    expect(Array.isArray(parsed.stages)).toBe(true);
+    expect(parsed.stages).toEqual(["wave-1", "wave-2"]);
+
+    for (const name of ["orders-table", "shared-alb", "search-service"]) {
+      const job = parsed[name] as Record<string, unknown>;
+      expect(job).toBeDefined();
+      expect(typeof job.stage).toBe("string");
+      expect(typeof job.image).toBe("string");
+      expect(Array.isArray(job.script)).toBe(true);
+      expect((job.script as string[]).length).toBeGreaterThan(0);
+    }
+  });
+
+  test("every job's script is a single thin trigger invocation, not inlined deploy steps", () => {
+    const result = generateGitlabPipeline(pilotComponents(), { env: "staging" });
+    const parsed = parseYAML(result.yaml);
+
+    for (const job of result.jobs) {
+      const props = parsed[job.jobName] as Record<string, unknown>;
+      const script = props.script as string[];
+      // The thin trigger: hands off to the component via `chant run`, carrying
+      // no build/publish/apply/cfn-deploy/ecs-update-service keywords — those
+      // verbs live in the component's own composition, never in the YAML.
+      expect(script.some((line) => line.includes(`chant run --components ${job.component}`))).toBe(true);
+      for (const line of script) {
+        expect(line).not.toMatch(/docker build|docker push|aws cloudformation|ecs update-service/);
+      }
+    }
+  });
+
+  test("an empty component set produces a pipeline with no stages and no jobs", () => {
+    const result = generateGitlabPipeline([]);
+    expect(result.stages).toEqual([]);
+    expect(result.jobs).toEqual([]);
+    const parsed = parseYAML(result.yaml);
+    expect(parsed.stages).toEqual([]);
+  });
+
+  test("propagates a dependency cycle error the same way the interpret driver's own graph resolution does", () => {
+    const cyclical: DriverComponent[] = [
+      { name: "a", dependsOn: ["b"], deploy: [] },
+      { name: "b", dependsOn: ["a"], deploy: [] },
+    ];
+    expect(() => generateGitlabPipeline(cyclical)).toThrow(DependencyCycleError);
+  });
+
+  test("propagates an unknown-dependency error for a dangling dependsOn", () => {
+    const dangling: DriverComponent[] = [{ name: "a", dependsOn: ["ghost"], deploy: [] }];
+    expect(() => generateGitlabPipeline(dangling)).toThrow(UnknownDependencyError);
+  });
+});
+
+describe("generateGitlabPipeline: jobs map to components in wave order", () => {
+  test("independent components share one stage; a dependent lands in a strictly later stage", () => {
+    const components = pilotComponents();
+    const { waves } = resolveComponentGraph(components);
+    const result = generateGitlabPipeline(components);
+
+    // Same wave count/membership as the driver's own graph resolution — no
+    // separate, divergent ordering logic in the generator.
+    expect(result.stages).toHaveLength(waves.length);
+
+    const stageOf = (name: string) => result.jobs.find((j) => j.component === name)!.stage;
+    expect(stageOf("orders-table")).toBe(stageOf("shared-alb")); // independent, same wave
+    expect(result.stages.indexOf(stageOf("search-service"))).toBeGreaterThan(
+      result.stages.indexOf(stageOf("shared-alb")),
+    ); // dependent, later wave
+  });
+
+  test("a job's needs: are exactly its component's dependsOn edges, no more and no less", () => {
+    const result = generateGitlabPipeline(pilotComponents());
+
+    const ordersJob = result.jobs.find((j) => j.component === "orders-table")!;
+    const albJob = result.jobs.find((j) => j.component === "shared-alb")!;
+    const searchJob = result.jobs.find((j) => j.component === "search-service")!;
+
+    expect(ordersJob.needs).toEqual([]);
+    expect(albJob.needs).toEqual([]);
+    expect(searchJob.needs).toEqual(["shared-alb"]);
+  });
+
+  test("a three-wave fan-out produces three stages in dependency order", () => {
+    const components: DriverComponent[] = [
+      { name: "base", dependsOn: [], deploy: [] },
+      { name: "middle", dependsOn: ["base"], deploy: [] },
+      { name: "top", dependsOn: ["middle"], deploy: [] },
+    ];
+    const result = generateGitlabPipeline(components);
+
+    expect(result.stages).toEqual(["wave-1", "wave-2", "wave-3"]);
+    expect(result.jobs.find((j) => j.component === "base")!.stage).toBe("wave-1");
+    expect(result.jobs.find((j) => j.component === "middle")!.stage).toBe("wave-2");
+    expect(result.jobs.find((j) => j.component === "top")!.stage).toBe("wave-3");
+  });
+});
+
+describe("generateGitlabPipeline: a cross-cutting change is one generator edit, not per-pipeline", () => {
+  test("adding extraScript (e.g. image signing) appears in every job with no per-component changes", () => {
+    const components = pilotComponents();
+
+    const before = generateGitlabPipeline(components, { env: "production" });
+    for (const job of before.jobs) {
+      const parsed = parseYAML(before.yaml);
+      const script = (parsed[job.jobName] as Record<string, unknown>).script as string[];
+      expect(script).not.toContain("cosign sign --yes $IMAGE_REF");
+    }
+
+    // Simulates the cross-cutting change from the epic's worked example
+    // ("sign every image"): ONE edit to the generator's options, applied
+    // uniformly, with the component declarations themselves untouched.
+    const after = generateGitlabPipeline(components, {
+      env: "production",
+      extraScript: ["cosign sign --yes $IMAGE_REF"],
+    });
+
+    const parsedAfter = parseYAML(after.yaml);
+    expect(after.jobs.length).toBe(before.jobs.length);
+    for (const job of after.jobs) {
+      const script = (parsedAfter[job.jobName] as Record<string, unknown>).script as string[];
+      expect(script).toContain("cosign sign --yes $IMAGE_REF");
+    }
+  });
+
+  test("changing the trigger command (runCommand) updates every job's script uniformly", () => {
+    const components = pilotComponents();
+    const result = generateGitlabPipeline(components, {
+      runCommand: ["chant", "run", "--components", "{name}", "--env", "staging", "--temporal"],
+    });
+    const parsed = parseYAML(result.yaml);
+
+    for (const job of result.jobs) {
+      const script = (parsed[job.jobName] as Record<string, unknown>).script as string[];
+      // The runCommand prefix reflects in every job; output-threading flags
+      // (--seed-outputs/--dump-outputs) may be appended per the dependency graph.
+      expect(script[0].startsWith(`chant run --components ${job.component} --env staging --temporal`)).toBe(true);
+    }
+  });
+
+  test("changing beforeScript (e.g. a registry login) prepends to every job uniformly", () => {
+    const components = pilotComponents();
+    const result = generateGitlabPipeline(components, {
+      beforeScript: ["echo $CI_REGISTRY_PASSWORD | docker login -u $CI_REGISTRY_USER --password-stdin $CI_REGISTRY"],
+    });
+    const parsed = parseYAML(result.yaml);
+
+    for (const job of result.jobs) {
+      const script = (parsed[job.jobName] as Record<string, unknown>).script as string[];
+      expect(script[0]).toMatch(/docker login/);
+    }
+  });
+});
+
+describe("generateGitlabPipeline: options", () => {
+  test("emits a variables: block when provided", () => {
+    const result = generateGitlabPipeline(pilotComponents(), {
+      variables: { CHANT_ENV: "staging" },
+    });
+    const parsed = parseYAML(result.yaml);
+    expect(parsed.variables).toEqual({ CHANT_ENV: "staging" });
+  });
+
+  test("uses a custom image for every job when provided", () => {
+    const result = generateGitlabPipeline(pilotComponents(), { image: "chant/cli:latest" });
+    const parsed = parseYAML(result.yaml);
+    for (const job of result.jobs) {
+      expect((parsed[job.jobName] as Record<string, unknown>).image).toBe("chant/cli:latest");
+    }
+  });
+
+  test("defaults env to production when not provided", () => {
+    const result = generateGitlabPipeline(pilotComponents());
+    const parsed = parseYAML(result.yaml);
+    const job = parsed["shared-alb"] as Record<string, unknown>;
+    expect((job.script as string[])[0]).toContain("--env production");
+  });
+});

package/src/components/generate-pipeline.ts

@@ -0,0 +1,137 @@
+/**
+ * Generate mode — component → GitLab CI YAML (#563, epic #551, Phase 3).
+ *
+ * The other half of "two modes, both anti-sprawl" (see
+ * docs/src/content/docs/components/orchestration.mdx#generate-mode and epic
+ * #551 §"5. Orchestrator → generate mode"): interpret mode (`../driver.ts`,
+ * #556) runs components directly; generate mode synthesizes a **thin**
+ * `.gitlab-ci.yml` from the same declarations for teams who want plain CI as
+ * the trigger/runner.
+ *
+ * The generated pipeline is a trigger, not the deploy logic:
+ *  - Ordering + parallel-safe waves are resolved once, generically, by
+ *    `resolveComponentGraph` (../driver.ts) — the exact function the local
+ *    interpret driver uses. Generate mode does not re-derive or duplicate
+ *    that graph logic.
+ *  - Each wave becomes one GitLab CI `stage`; every component in a wave
+ *    becomes one job in that stage, so independent components run in
+ *    parallel and dependents wait for their dependencies via natural stage
+ *    ordering (mirrored explicitly with `needs:` for direct edges, so GitLab
+ *    can still parallelize across non-adjacent stages when safe).
+ *  - Each job's `script` is exactly one invocation that hands off to the
+ *    component's own composition (`chant run --components <name> ...` by
+ *    default) — never inlined build/publish/apply steps. The deploy logic
+ *    lives in the component's `deploy` phases and the capabilities they
+ *    reference, not in this YAML.
+ *
+ * Cross-cutting changes (e.g. "sign every image before deploy") are made by
+ * editing `GenerateGitlabOptions.extraScript`/`beforeScript` (or the
+ * component's own composition) ONCE here — never per generated job. See
+ * `generate-gitlab.test.ts`'s "cross-cutting change" case for a
+ * demonstration: one generator-option edit reflects in every job without
+ * touching the component declarations.
+ */
+
+import { emitYAML } from "@intentius/chant/yaml";
+import { resolveComponentGraph, type DriverComponent } from "@intentius/chant/components/driver";
+import type {
+  ComponentPipelineJob as GeneratedJob,
+  ComponentPipelineOptions as GenerateGitlabOptions,
+  ComponentPipelineResult as GenerateGitlabResult,
+} from "@intentius/chant/lexicon";
+
+export type { GeneratedJob, GenerateGitlabOptions, GenerateGitlabResult };
+
+/** GitLab CI job names must be safe YAML keys; component names are already kebab-case in every fixture, but normalize defensively. */
+function toJobName(componentName: string): string {
+  return componentName.replace(/([a-z0-9])([A-Z])/g, "$1-$2").toLowerCase();
+}
+
+const DEFAULT_IMAGE = "node:22-slim";
+
+/**
+ * Synthesize a `.gitlab-ci.yml` pipeline from a set of components: one stage
+ * per parallel-safe wave (`resolveComponentGraph`), one thin trigger job per
+ * component. Throws `DependencyCycleError`/`UnknownDependencyError` (from
+ * core's driver) exactly like the interpret driver does, since both consume
+ * the same graph resolution. Wired into core's generate mode via the gitlab
+ * lexicon plugin's `generateComponentPipeline` (../plugin.ts).
+ */
+export function generateGitlabPipeline(
+  components: DriverComponent[],
+  options: GenerateGitlabOptions = {},
+): GenerateGitlabResult {
+  const env = options.env ?? "production";
+  const image = options.image ?? DEFAULT_IMAGE;
+  const runCommand = options.runCommand ?? ["chant", "run", "--components", "{name}", "--env", env];
+  const beforeScript = options.beforeScript ?? [];
+  const extraScript = options.extraScript ?? [];
+
+  const { waves } = resolveComponentGraph(components);
+  const byName = new Map(components.map((c) => [c.name, c]));
+
+  // Components that something else depends on must hand their resolved outputs
+  // (stack outputs, published artifact refs) to their dependents, which run as
+  // separate jobs/processes. Each such producer dumps its outputs to a file and
+  // declares it a job artifact; each dependent seeds from that file (delivered
+  // across the `needs:` edge by GitLab's artifact passing) so a `stackOutput()`
+  // / `@<dep>.publish.*` reference resolves even though the producer ran in a
+  // different job. Without this, a single-component job has no in-memory outputs
+  // for its dependencies — see epic #551 / the adopt-alb-services example.
+  const dependedUpon = new Set<string>();
+  for (const c of components) for (const dep of c.dependsOn ?? []) dependedUpon.add(dep);
+  const outputsFile = (name: string) => `${name}.outputs.json`;
+
+  const stages = waves.map((_, i) => `wave-${i + 1}`);
+  const jobs: GeneratedJob[] = [];
+  const jobNameByComponent = new Map<string, string>();
+  for (const wave of waves) {
+    for (const name of wave) jobNameByComponent.set(name, toJobName(name));
+  }
+
+  const doc: Record<string, unknown> = {};
+  doc.stages = stages;
+  if (options.variables && Object.keys(options.variables).length > 0) {
+    doc.variables = options.variables;
+  }
+
+  waves.forEach((wave, waveIndex) => {
+    const stage = stages[waveIndex];
+    for (const name of wave) {
+      const component = byName.get(name)!;
+      const jobName = jobNameByComponent.get(name)!;
+      const needs = (component.dependsOn ?? []).map((dep) => jobNameByComponent.get(dep)!).sort();
+
+      jobs.push({ jobName, component: name, stage, needs });
+
+      // Build the run invocation, then append output-threading flags: seed from
+      // each dependency's dumped outputs, and dump this component's own outputs
+      // if a dependent will need them.
+      const runParts = runCommand.map((part) => part.replace("{name}", name));
+      for (const dep of component.dependsOn ?? []) runParts.push("--seed-outputs", outputsFile(dep));
+      if (dependedUpon.has(name)) runParts.push("--dump-outputs", outputsFile(name));
+
+      const script = [...beforeScript, runParts.join(" "), ...extraScript];
+
+      const jobProps: Record<string, unknown> = {
+        stage,
+        image,
+        script,
+      };
+      if (needs.length > 0) jobProps.needs = needs;
+      // Publish this component's dumped outputs so dependent jobs receive it.
+      if (dependedUpon.has(name)) jobProps.artifacts = { paths: [outputsFile(name)] };
+      doc[jobName] = jobProps;
+    }
+  });
+
+  const sections: string[] = [];
+  sections.push("stages:" + emitYAML(stages, 1));
+  if (doc.variables) sections.push("variables:" + emitYAML(doc.variables, 1));
+  for (const job of jobs) {
+    const props = doc[job.jobName] as Record<string, unknown>;
+    sections.push(`${job.jobName}:` + emitYAML(props, 1));
+  }
+
+  return { yaml: sections.join("\n\n") + "\n", stages, jobs };
+}

package/src/lint/audit-catalog.ts

@@ -0,0 +1,47 @@
+/**
+ * The gitlab lexicon's chant audit catalog — metadata for its post-synth rules
+ * (WGL GitLab CI rules). Contributed via gitlabPlugin.auditCatalog() (#687).
+ */
+import { auditRule, GH_INJECTION, GH_OIDC, GH_PWN, GH_SECRETS, SCORECARD_PINNED, type RuleMeta } from "@intentius/chant/audit/catalog";
+
+export const gitlabAuditCatalog: Record<string, RuleMeta> = {
+  WGL010: auditRule("WGL010", "merge-worthy", "guidance", "Job references an undefined stage", "Add the stage to `stages:` or fix the job's `stage:`.", { category: "correctness" }),
+  WGL011: auditRule("WGL011", "merge-worthy", "guidance", "Job rules always evaluate to never", "Fix the `rules:` so the job can run; it is currently unreachable.", { category: "correctness" }),
+  WGL012: auditRule("WGL012", "report-only", "guidance", "Deprecated property", "Replace the deprecated GitLab CI property.", { category: "best-practice" }),
+  WGL013: auditRule("WGL013", "merge-worthy", "guidance", "Invalid needs target", "Fix the dangling/self `needs:` reference.", { category: "correctness" }),
+  WGL014: auditRule("WGL014", "merge-worthy", "guidance", "Invalid extends target", "Point `extends:` at a template that exists in the pipeline.", { category: "correctness" }),
+  WGL015: auditRule("WGL015", "merge-worthy", "guidance", "Circular needs chain", "Break the cycle in the job dependency graph.", { category: "correctness" }),
+  WGL016: auditRule("WGL016", "merge-worthy", "guidance", "Hardcoded secret in variables", "Move the secret out of `variables:` into a masked/protected CI variable and rotate it.", { authority: [GH_SECRETS] }),
+  WGL017: auditRule("WGL017", "merge-worthy", "guidance", "Insecure (non-HTTPS) registry", "Use an HTTPS registry endpoint.", { category: "security" }),
+  WGL018: auditRule("WGL018", "report-only", "guidance", "Missing job timeout", "Add a `timeout:` to bound long-running jobs.", { category: "best-practice" }),
+  WGL019: auditRule("WGL019", "report-only", "guidance", "Missing retry on deploy job", "Add a `retry:` strategy to deploy jobs.", { category: "best-practice" }),
+  WGL020: auditRule("WGL020", "merge-worthy", "guidance", "Duplicate job names", "Rename so each job resolves to a unique name.", { category: "correctness" }),
+  WGL021: auditRule("WGL021", "report-only", "guidance", "Unused global variable", "Remove the unused global `variables:` entry.", { category: "best-practice" }),
+  WGL022: auditRule("WGL022", "report-only", "guidance", "Missing artifacts expiry", "Add `expire_in:` to artifacts to avoid disk bloat.", { category: "best-practice" }),
+  WGL023: auditRule("WGL023", "report-only", "guidance", "Overly broad rules (when: always)", "Add real conditions to the job's `rules:`.", { category: "best-practice" }),
+  WGL024: auditRule("WGL024", "report-only", "guidance", "Manual job without allow_failure", "Add `allow_failure: true` so a manual job doesn't block the pipeline.", { category: "best-practice" }),
+  WGL025: auditRule("WGL025", "report-only", "guidance", "Cache without a key", "Add a `cache.key` to avoid cross-job cache collisions.", { category: "best-practice" }),
+  WGL026: auditRule("WGL026", "merge-worthy", "guidance", "Privileged DinD service without TLS", "Set `DOCKER_TLS_CERTDIR` for privileged Docker-in-Docker services.", { category: "security" }),
+  WGL027: auditRule("WGL027", "merge-worthy", "guidance", "Empty script", "Give the job a non-empty `script:`; it currently does nothing.", { category: "correctness" }),
+  WGL028: auditRule("WGL028", "report-only", "guidance", "Redundant needs", "Drop `needs:` already implied by stage ordering.", { category: "best-practice" }),
+  WGL029: auditRule("WGL029", "merge-worthy", "guidance", "include/component resolved by a moving ref", "Pin `include:project`/component to a tag or commit SHA, not a branch.", { authority: [SCORECARD_PINNED] }),
+  WGL030: auditRule("WGL030", "merge-worthy", "guidance", "Insecure or mutable include:remote", "Use HTTPS and pin the remote include to an immutable ref.", { authority: [SCORECARD_PINNED] }),
+  WGL031: auditRule("WGL031", "merge-worthy", "deterministic", "Container image not pinned to a digest", "Pin the image to an immutable `@sha256:` digest.", { authority: [SCORECARD_PINNED] }),
+  WGL032: auditRule("WGL032", "merge-worthy", "guidance", "Possible include/component impersonation", "Verify the include source; it resembles a well-known project.", { authority: [SCORECARD_PINNED] }),
+  WGL033: auditRule("WGL033", "merge-worthy", "guidance", "OIDC id_token without a scoped audience", "Set a specific `aud:` on the OIDC id_token.", { authority: [GH_OIDC] }),
+  WGL034: auditRule("WGL034", "merge-worthy", "guidance", "OIDC id_token mintable from a merge-request pipeline", "Restrict OIDC token minting to protected pipelines.", { authority: [GH_OIDC, GH_PWN] }),
+  WGL035: auditRule("WGL035", "merge-worthy", "guidance", "Untrusted CI variable interpolated into a script", "Pass untrusted variables via the environment and quote them; don't inline.", { authority: [GH_INJECTION] }),
+  WGL036: auditRule("WGL036", "merge-worthy", "guidance", "Privileged service reachable from merge-request pipelines", "Block privileged/DinD services on merge-request pipelines.", { authority: [GH_PWN] }),
+  WGL037: auditRule("WGL037", "merge-worthy", "guidance", "Security gate on an untrusted ref regex", "Don't gate security decisions on a regex over an untrusted ref variable.", { authority: [GH_PWN] }),
+  WGL038: auditRule("WGL038", "merge-worthy", "guidance", "Secret reachable from a merge-request pipeline", "Scope secret-like variables to protected branches/pipelines.", { authority: [GH_SECRETS, GH_PWN] }),
+  WGL039: auditRule("WGL039", "merge-worthy", "guidance", "Secret printed to job logs", "Stop echoing the secret-like variable; mask it.", { authority: [GH_SECRETS] }),
+  WGL040: auditRule("WGL040", "merge-worthy", "guidance", "Hardcoded credential in a registry login", "Move the credential to a masked CI variable and rotate it.", { authority: [GH_SECRETS] }),
+  WGL041: auditRule("WGL041", "merge-worthy", "guidance", "Tautological rules:if condition", "Fix the always-true `rules:if`; it may neutralize a gate.", { category: "correctness" }),
+  WGL042: auditRule("WGL042", "report-only", "guidance", "Unreachable rules after an unconditional match", "Remove the dead `rules:` entries after the catch-all.", { category: "best-practice" }),
+  WGL043: auditRule("WGL043", "merge-worthy", "guidance", "Match-anything regex gate in rules:if", "Tighten the regex; a match-anything gate is no gate.", { authority: [GH_PWN] }),
+  WGL044: auditRule("WGL044", "merge-worthy", "guidance", "Public artifacts expose build output", "Mark sensitive artifacts non-public (`public: false`).", { category: "security" }),
+  WGL045: auditRule("WGL045", "merge-worthy", "guidance", "Artifact path may capture a credential file", "Narrow the artifact path so it can't capture credential files.", { authority: [GH_SECRETS] }),
+  WGL046: auditRule("WGL046", "merge-worthy", "guidance", "Cache populated in a merge-request pipeline", "Don't populate caches from merge-request pipelines (poisoning risk).", { authority: [GH_PWN] }),
+  WGL047: auditRule("WGL047", "merge-worthy", "guidance", "Software piped to a shell without verification", "Verify a checksum/signature before executing fetched scripts.", { authority: [SCORECARD_PINNED] }),
+  WGL048: auditRule("WGL048", "report-only", "guidance", "Pipeline without workflow:name", "Add a `workflow:name` for clearer pipeline naming.", { category: "best-practice" }),
+};

package/src/plugin.ts

@@ -8,6 +8,7 @@
 import type { LexiconPlugin, IntrinsicDef, InitTemplateSet } from "@intentius/chant/lexicon";
 import type { LintRule } from "@intentius/chant/lint/rule";
 import { postSynthChecks as postSynthCheckList } from "./lint/post-synth";
+import { gitlabAuditCatalog } from "./lint/audit-catalog";
 import { createSkillsLoader, createDiffTool, createCatalogResource } from "@intentius/chant/lexicon-plugin-helpers";
 import { join, dirname } from "path";
 import { fileURLToPath } from "url";
@@ -21,9 +22,21 @@ import { gitlabCompletions } from "./lsp/completions";
 import { gitlabHover } from "./lsp/hover";
 import { GitLabParser } from "./import/parser";
 import { GitLabGenerator } from "./import/generator";
+import { generateGitlabPipeline } from "./components/generate-pipeline";
 
 export const gitlabPlugin: LexiconPlugin = {
   name: "gitlab",
+  auditCatalog: () => gitlabAuditCatalog,
+  // Generate mode (#688): synthesize a .gitlab-ci.yml from the component graph.
+  generateComponentPipeline: (components, options) => generateGitlabPipeline(components, options),
+  // Self-upgrade: where the pinned GitLab schema version lives + its upstream (#685).
+  upstreamPin: {
+    file: "src/codegen/fetch.ts",
+    pattern: /export const GITLAB_SCHEMA_VERSION\s*=\s*"([^"]+)"/,
+    replace: (v, line) =>
+      line.replace(/export const GITLAB_SCHEMA_VERSION\s*=\s*"[^"]+"/, `export const GITLAB_SCHEMA_VERSION = "${v}"`),
+    upstream: { owner: "gitlab-org", repo: "gitlab", kind: "tags", tagSuffix: "-ee" },
+  },
   serializer: gitlabSerializer,
 
   lintRules(): LintRule[] {