@intentius/chant-lexicon-gitlab 0.13.1 → 0.15.0

package/dist/codegen/fetch.d.ts

@@ -15,15 +15,34 @@ export declare const GITLAB_SCHEMA_VERSION = "v17.8.1-ee";
  * Get the cache file path for the CI schema.
  */
 export declare function getCachePath(): string;
+/**
+ * Path to the vendored CI schema committed in this lexicon. Reading it offline
+ * is the default so `generate` never depends on gitlab.com — which aggressively
+ * 429-rate-limits the raw endpoint and chronically flaked CI (#574). The
+ * `GITLAB_SCHEMA_VERSION` pin already makes the fetch deterministic, so a
+ * committed copy is equivalent and network-free.
+ */
+export declare function getVendoredSchemaPath(): string;
 /**
  * Fetch the GitLab CI JSON Schema, returning the raw JSON buffer.
- * Uses local file caching with 24-hour TTL.
  *
- * @param force  Bypass cache and download fresh.
+ * Default (pinned version, no force): read the vendored, committed schema —
+ * offline, deterministic, no gitlab.com 429s (#574). Pass `force` or a custom
+ * `version` to fetch live — used to verify against upstream or to refresh the
+ * vendored copy when bumping the pin (see {@link refreshVendoredSchema}).
+ *
+ * @param force  Bypass the vendored copy and download fresh.
  * @param version  GitLab ref (tag, branch, or SHA) to fetch from.
  *                 Defaults to {@link GITLAB_SCHEMA_VERSION}.
  */
 export declare function fetchCISchema(force?: boolean, version?: string): Promise<Buffer>;
+/**
+ * Refresh the vendored schema from upstream. Call this when bumping
+ * `GITLAB_SCHEMA_VERSION` so the committed copy tracks the new pin — the
+ * lexicon-upgrade pipeline (#523) runs it as part of a gitlab pin bump.
+ * Fetches the given version live and overwrites the vendored file.
+ */
+export declare function refreshVendoredSchema(version?: string): Promise<void>;
 /**
  * Fetch the CI schema and return it as a Map<typeName, Buffer>
  * compatible with the generatePipeline fetchSchemas callback.

package/dist/codegen/fetch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fetch.d.ts","sourceRoot":"","sources":["../../src/codegen/fetch.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAMH;;;;;;;GAOG;AACH,eAAO,MAAM,qBAAqB,eAAe,CAAC;AASlD;;GAEG;AACH,wBAAgB,YAAY,IAAI,MAAM,CAErC;AAED;;;;;;;GAOG;AACH,wBAAsB,aAAa,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAStF;AAED;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAKlG;AAED;;GAEG;AACH,wBAAgB,UAAU,IAAI,IAAI,CAEjC"}
+{"version":3,"file":"fetch.d.ts","sourceRoot":"","sources":["../../src/codegen/fetch.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAQH;;;;;;;GAOG;AACH,eAAO,MAAM,qBAAqB,eAAe,CAAC;AASlD;;GAEG;AACH,wBAAgB,YAAY,IAAI,MAAM,CAErC;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,IAAI,MAAM,CAE9C;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAYtF;AAED;;;;;GAKG;AACH,wBAAsB,qBAAqB,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAI3E;AAED;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAKlG;AAED;;GAEG;AACH,wBAAgB,UAAU,IAAI,IAAI,CAEjC"}

package/dist/components/generate-pipeline.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Generate mode — component → GitLab CI YAML (#563, epic #551, Phase 3).
+ *
+ * The other half of "two modes, both anti-sprawl" (see
+ * docs/src/content/docs/components/orchestration.mdx#generate-mode and epic
+ * #551 §"5. Orchestrator → generate mode"): interpret mode (`../driver.ts`,
+ * #556) runs components directly; generate mode synthesizes a **thin**
+ * `.gitlab-ci.yml` from the same declarations for teams who want plain CI as
+ * the trigger/runner.
+ *
+ * The generated pipeline is a trigger, not the deploy logic:
+ *  - Ordering + parallel-safe waves are resolved once, generically, by
+ *    `resolveComponentGraph` (../driver.ts) — the exact function the local
+ *    interpret driver uses. Generate mode does not re-derive or duplicate
+ *    that graph logic.
+ *  - Each wave becomes one GitLab CI `stage`; every component in a wave
+ *    becomes one job in that stage, so independent components run in
+ *    parallel and dependents wait for their dependencies via natural stage
+ *    ordering (mirrored explicitly with `needs:` for direct edges, so GitLab
+ *    can still parallelize across non-adjacent stages when safe).
+ *  - Each job's `script` is exactly one invocation that hands off to the
+ *    component's own composition (`chant run --components <name> ...` by
+ *    default) — never inlined build/publish/apply steps. The deploy logic
+ *    lives in the component's `deploy` phases and the capabilities they
+ *    reference, not in this YAML.
+ *
+ * Cross-cutting changes (e.g. "sign every image before deploy") are made by
+ * editing `GenerateGitlabOptions.extraScript`/`beforeScript` (or the
+ * component's own composition) ONCE here — never per generated job. See
+ * `generate-gitlab.test.ts`'s "cross-cutting change" case for a
+ * demonstration: one generator-option edit reflects in every job without
+ * touching the component declarations.
+ */
+import { type DriverComponent } from "@intentius/chant/components/driver";
+import type { ComponentPipelineJob as GeneratedJob, ComponentPipelineOptions as GenerateGitlabOptions, ComponentPipelineResult as GenerateGitlabResult } from "@intentius/chant/lexicon";
+export type { GeneratedJob, GenerateGitlabOptions, GenerateGitlabResult };
+/**
+ * Synthesize a `.gitlab-ci.yml` pipeline from a set of components: one stage
+ * per parallel-safe wave (`resolveComponentGraph`), one thin trigger job per
+ * component. Throws `DependencyCycleError`/`UnknownDependencyError` (from
+ * core's driver) exactly like the interpret driver does, since both consume
+ * the same graph resolution. Wired into core's generate mode via the gitlab
+ * lexicon plugin's `generateComponentPipeline` (../plugin.ts).
+ */
+export declare function generateGitlabPipeline(components: DriverComponent[], options?: GenerateGitlabOptions): GenerateGitlabResult;
+//# sourceMappingURL=generate-pipeline.d.ts.map

package/dist/components/generate-pipeline.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"generate-pipeline.d.ts","sourceRoot":"","sources":["../../src/components/generate-pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAGH,OAAO,EAAyB,KAAK,eAAe,EAAE,MAAM,oCAAoC,CAAC;AACjG,OAAO,KAAK,EACV,oBAAoB,IAAI,YAAY,EACpC,wBAAwB,IAAI,qBAAqB,EACjD,uBAAuB,IAAI,oBAAoB,EAChD,MAAM,0BAA0B,CAAC;AAElC,YAAY,EAAE,YAAY,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,CAAC;AAS1E;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,eAAe,EAAE,EAC7B,OAAO,GAAE,qBAA0B,GAClC,oBAAoB,CA0EtB"}

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "5c5732ddb378a185d655ade5495b91794270b3f00aabe835c4c17c56c09da026",
+    "manifest.json": "13b637c8dab06c761181a88812696e9dc09aca30b39d106c3816e58bb280f89b",
     "meta.json": "931fc3246a55645b1493080bbeb160e5d205e42349e8bdca96ca243adb5f0da3",
     "types/index.d.ts": "5cd2e99f135a929b72bdd822d00d780d39b1cd407ba0cfb3d511c7ac9d667b58",
     "rules/artifact-no-expiry.ts": "3f3cabf9792cbf8207e53a25f506715466b19ec25e9c3b4d0d77fed6b2eb4542",
@@ -52,5 +52,5 @@
     "skills/chant-gitlab-migrate.md": "4853d04980560b379e5b0f7267dcb0a1e5d5879cb9e9931681ce76b2a5fe69d8",
     "skills/chant-gitlab-patterns.md": "6d9a44e9e8de4c3820be9d65381b0d2ede4cb3626aaaf0011e21838a9fbf556e"
   },
-  "composite": "d300b51cafba79d86b2f96259693328ebd4e285323b323c03229f985e5f3ef65"
+  "composite": "6dc26e7c6720bda599259130d3097d5f8d6e711dd864d3cbbc873bcbe910b004"
 }

package/dist/lint/audit-catalog.d.ts

@@ -0,0 +1,7 @@
+/**
+ * The gitlab lexicon's chant audit catalog — metadata for its post-synth rules
+ * (WGL GitLab CI rules). Contributed via gitlabPlugin.auditCatalog() (#687).
+ */
+import { type RuleMeta } from "@intentius/chant/audit/catalog";
+export declare const gitlabAuditCatalog: Record<string, RuleMeta>;
+//# sourceMappingURL=audit-catalog.d.ts.map

package/dist/lint/audit-catalog.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-catalog.d.ts","sourceRoot":"","sources":["../../src/lint/audit-catalog.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAA0E,KAAK,QAAQ,EAAE,MAAM,gCAAgC,CAAC;AAEvI,eAAO,MAAM,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAwCvD,CAAC"}

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "gitlab",
-  "version": "0.13.1",
+  "version": "0.15.0",
   "chantVersion": ">=0.1.0",
   "namespace": "GitLab",
   "intrinsics": [

package/dist/plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAiC,MAAM,0BAA0B,CAAC;AAiB7F,eAAO,MAAM,YAAY,EAAE,aA2f1B,CAAC"}
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAiC,MAAM,0BAA0B,CAAC;AAmB7F,eAAO,MAAM,YAAY,EAAE,aAsgB1B,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-gitlab",
-  "version": "0.13.1",
+  "version": "0.15.0",
   "description": "GitLab CI lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -62,8 +62,8 @@
     "typescript": "^5.9.3"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.13.1",
-    "@intentius/chant-lexicon-github": "^0.13.1"
+    "@intentius/chant": "^0.15.0",
+    "@intentius/chant-lexicon-github": "^0.15.0"
   },
   "peerDependenciesMeta": {
     "@intentius/chant-lexicon-github": {

package/src/codegen/fetch.test.ts

@@ -21,7 +21,7 @@ describe("fetch", () => {
     expect(cachePath).toContain("gitlab-ci-schema.json");
   });
 
-  test.skip("integration: fetchCISchema returns Buffer (requires network)", async () => {
+  test("fetchCISchema reads the vendored schema offline (no network)", async () => {
     const data = await fetchCISchema();
     expect(data).toBeInstanceOf(Buffer);
     const parsed = JSON.parse(data.toString("utf-8"));

package/src/codegen/fetch.ts

@@ -3,8 +3,10 @@
  * and caches it locally.
  */
 
-import { join } from "path";
+import { join, dirname } from "path";
 import { homedir } from "os";
+import { readFileSync, writeFileSync } from "fs";
+import { fileURLToPath } from "url";
 import { fetchWithCache, clearCacheFile } from "@intentius/chant/codegen/fetch";
 
 /**
@@ -31,16 +33,34 @@ export function getCachePath(): string {
   return join(homedir(), ".chant", "gitlab-ci-schema.json");
 }
 
+/**
+ * Path to the vendored CI schema committed in this lexicon. Reading it offline
+ * is the default so `generate` never depends on gitlab.com — which aggressively
+ * 429-rate-limits the raw endpoint and chronically flaked CI (#574). The
+ * `GITLAB_SCHEMA_VERSION` pin already makes the fetch deterministic, so a
+ * committed copy is equivalent and network-free.
+ */
+export function getVendoredSchemaPath(): string {
+  return join(dirname(fileURLToPath(import.meta.url)), "vendored", "gitlab-ci-schema.json");
+}
+
 /**
  * Fetch the GitLab CI JSON Schema, returning the raw JSON buffer.
- * Uses local file caching with 24-hour TTL.
  *
- * @param force  Bypass cache and download fresh.
+ * Default (pinned version, no force): read the vendored, committed schema —
+ * offline, deterministic, no gitlab.com 429s (#574). Pass `force` or a custom
+ * `version` to fetch live — used to verify against upstream or to refresh the
+ * vendored copy when bumping the pin (see {@link refreshVendoredSchema}).
+ *
+ * @param force  Bypass the vendored copy and download fresh.
  * @param version  GitLab ref (tag, branch, or SHA) to fetch from.
  *                 Defaults to {@link GITLAB_SCHEMA_VERSION}.
  */
 export async function fetchCISchema(force?: boolean, version?: string): Promise<Buffer> {
   const ref = version ?? GITLAB_SCHEMA_VERSION;
+  if (!force && ref === GITLAB_SCHEMA_VERSION) {
+    return readFileSync(getVendoredSchemaPath());
+  }
   return fetchWithCache(
     {
       url: schemaUrl(ref),
@@ -50,6 +70,18 @@ export async function fetchCISchema(force?: boolean, version?: string): Promise<
   );
 }
 
+/**
+ * Refresh the vendored schema from upstream. Call this when bumping
+ * `GITLAB_SCHEMA_VERSION` so the committed copy tracks the new pin — the
+ * lexicon-upgrade pipeline (#523) runs it as part of a gitlab pin bump.
+ * Fetches the given version live and overwrites the vendored file.
+ */
+export async function refreshVendoredSchema(version?: string): Promise<void> {
+  const ref = version ?? GITLAB_SCHEMA_VERSION;
+  const data = await fetchWithCache({ url: schemaUrl(ref), cacheFile: getCachePath() }, true);
+  writeFileSync(getVendoredSchemaPath(), data);
+}
+
 /**
  * Fetch the CI schema and return it as a Map<typeName, Buffer>
  * compatible with the generatePipeline fetchSchemas callback.