@intentius/chant-lexicon-gitlab 0.41.20 → 0.42.1

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "b735d6b0ca7dddfcb9b75e81d13864af5aa9250dd1711b982dfe606680dab1b4",
+    "manifest.json": "bcd38257eca7fcbebfa718b63cacf476393cf71240a7726382207de45e6a907b",
     "meta.json": "931fc3246a55645b1493080bbeb160e5d205e42349e8bdca96ca243adb5f0da3",
     "types/index.d.ts": "5cd2e99f135a929b72bdd822d00d780d39b1cd407ba0cfb3d511c7ac9d667b58",
     "rules/artifact-no-expiry.ts": "3f3cabf9792cbf8207e53a25f506715466b19ec25e9c3b4d0d77fed6b2eb4542",
@@ -52,5 +52,5 @@
     "skills/chant-gitlab-migrate.md": "4853d04980560b379e5b0f7267dcb0a1e5d5879cb9e9931681ce76b2a5fe69d8",
     "skills/chant-gitlab-patterns.md": "6d9a44e9e8de4c3820be9d65381b0d2ede4cb3626aaaf0011e21838a9fbf556e"
   },
-  "composite": "442a763a4c853dd9941b0be51f95c32f86ee17ee6766d989d1905ee902328324"
+  "composite": "5c97a16e2b070303abdd6b5ba92e1ff4f5a731a0d48d1d223c046d34d5ebb8a6"
 }

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "gitlab",
-  "version": "0.41.20",
+  "version": "0.42.1",
   "chantVersion": ">=0.1.0",
   "namespace": "GitLab",
   "intrinsics": [

package/dist/okf/index.md

@@ -0,0 +1,55 @@
+---
+okf_version: '0.2'
+---
+
+# Resource types
+
+* [Default](/types/Default.md) - GitLab::CI::Default
+* [Job](/types/Job.md) - GitLab::CI::Job
+* [Workflow](/types/Workflow.md) - GitLab::CI::Workflow
+
+# Rules
+
+* [WGL001](/rules/WGL001.md) - Deprecated only/except keywords
+* [WGL002](/rules/WGL002.md) - Missing script
+* [WGL003](/rules/WGL003.md) - Missing stage
+* [WGL004](/rules/WGL004.md) - Artifacts without expiry
+* [WGL010](/rules/WGL010.md) - Job references a stage not in the stages list
+* [WGL011](/rules/WGL011.md) - Job has rules that always evaluate to never (unreachable)
+* [WGL012](/rules/WGL012.md) - Deprecated property usage — flags properties marked as deprecated in the GitLab CI schema
+* [WGL013](/rules/WGL013.md) - Invalid needs: target — dangling reference or self-reference
+* [WGL014](/rules/WGL014.md) - Invalid extends: target — references a template not in the pipeline
+* [WGL015](/rules/WGL015.md) - Circular needs: chain — cycle in job dependency graph
+* [WGL016](/rules/WGL016.md) - Secrets in variables — hardcoded passwords or tokens in variables blocks
+* [WGL017](/rules/WGL017.md) - Insecure registry — Docker push/pull to non-HTTPS registry
+* [WGL018](/rules/WGL018.md) - Missing timeout — jobs without explicit timeout may run too long
+* [WGL019](/rules/WGL019.md) - Missing retry — deploy jobs without retry strategy
+* [WGL020](/rules/WGL020.md) - Duplicate job names — multiple jobs resolving to same name
+* [WGL021](/rules/WGL021.md) - Unused variables — global variables not referenced by any job
+* [WGL022](/rules/WGL022.md) - Missing artifacts expiry — artifacts without expire_in cause disk bloat
+* [WGL023](/rules/WGL023.md) - Overly broad rules — job with only when: always rule (no conditions)
+* [WGL024](/rules/WGL024.md) - Manual without allow_failure — manual jobs block pipeline without allow_failure: true
+* [WGL025](/rules/WGL025.md) - Missing cache key — cache without key causes collisions
+* [WGL026](/rules/WGL026.md) - Privileged services without TLS — DinD services without DOCKER_TLS_CERTDIR
+* [WGL027](/rules/WGL027.md) - Empty script — jobs with empty or blank script entries
+* [WGL028](/rules/WGL028.md) - Redundant needs — needs listing jobs already implied by stage ordering
+* [WGL029](/rules/WGL029.md) - include:project / component resolved by a moving ref instead of a pinned tag or SHA
+* [WGL030](/rules/WGL030.md) - include:remote is insecure (HTTP) or mutable
+* [WGL031](/rules/WGL031.md) - Container image not pinned to an immutable digest
+* [WGL032](/rules/WGL032.md) - Include/component source resembles a well-known project (possible impersonation)
+* [WGL033](/rules/WGL033.md) - OIDC id_token without a scoped audience
+* [WGL034](/rules/WGL034.md) - OIDC id_token mintable from a merge-request pipeline
+* [WGL035](/rules/WGL035.md) - Untrusted CI variable interpolated into a script command
+* [WGL036](/rules/WGL036.md) - Privileged service / DinD reachable from merge-request pipelines
+* [WGL037](/rules/WGL037.md) - Security gate on a regex match of an untrusted ref variable
+* [WGL038](/rules/WGL038.md) - Secret-like variable reachable from a merge-request pipeline
+* [WGL039](/rules/WGL039.md) - Secret-like variable printed to job logs
+* [WGL040](/rules/WGL040.md) - Hardcoded credential in a registry login command
+* [WGL041](/rules/WGL041.md) - Logically unsound (tautological) rules:if condition
+* [WGL042](/rules/WGL042.md) - Unreachable rules after an unconditional match
+* [WGL043](/rules/WGL043.md) - Match-anything regex gate in rules:if
+* [WGL044](/rules/WGL044.md) - Public artifacts expose build output
+* [WGL045](/rules/WGL045.md) - Artifact path that may capture a credential file
+* [WGL046](/rules/WGL046.md) - Cache populated in a merge-request pipeline (poisoning risk)
+* [WGL047](/rules/WGL047.md) - Software fetched and piped to a shell without verification
+* [WGL048](/rules/WGL048.md) - Pipeline defines workflow: but no workflow:name

package/dist/okf/rules/WGL001.md

@@ -0,0 +1,15 @@
+---
+type: lint-rule
+title: WGL001
+description: Deprecated only/except keywords
+id: WGL001
+severity: warning
+category: style
+lexicon: gitlab
+docs: https://intentius.io/chant/lexicons/gitlab/rules/
+---
+Deprecated only/except keywords
+
+## Applies to
+
+- [Job](/types/Job.md)

package/dist/okf/rules/WGL002.md

@@ -0,0 +1,15 @@
+---
+type: lint-rule
+title: WGL002
+description: Missing script
+id: WGL002
+severity: error
+category: correctness
+lexicon: gitlab
+docs: https://intentius.io/chant/lexicons/gitlab/rules/
+---
+Missing script
+
+## Applies to
+
+- [Job](/types/Job.md)

package/dist/okf/rules/WGL003.md

@@ -0,0 +1,15 @@
+---
+type: lint-rule
+title: WGL003
+description: Missing stage
+id: WGL003
+severity: info
+category: style
+lexicon: gitlab
+docs: https://intentius.io/chant/lexicons/gitlab/rules/
+---
+Missing stage
+
+## Applies to
+
+- [Job](/types/Job.md)

package/dist/okf/rules/WGL004.md

@@ -0,0 +1,11 @@
+---
+type: lint-rule
+title: WGL004
+description: Artifacts without expiry
+id: WGL004
+severity: warning
+category: performance
+lexicon: gitlab
+docs: https://intentius.io/chant/lexicons/gitlab/rules/
+---
+Artifacts without expiry

package/dist/okf/rules/WGL010.md

@@ -0,0 +1,15 @@
+---
+type: post-synth-check
+title: WGL010
+description: Job references a stage not in the stages list
+id: WGL010
+severity: error
+category: post-synth
+lexicon: gitlab
+docs: https://intentius.io/chant/lexicons/gitlab/rules/
+---
+Job references a stage not in the stages list
+
+## Applies to
+
+- [Job](/types/Job.md)

package/dist/okf/rules/WGL011.md

@@ -0,0 +1,15 @@
+---
+type: post-synth-check
+title: WGL011
+description: Job has rules that always evaluate to never (unreachable)
+id: WGL011
+severity: error
+category: post-synth
+lexicon: gitlab
+docs: https://intentius.io/chant/lexicons/gitlab/rules/
+---
+Job has rules that always evaluate to never (unreachable)
+
+## Applies to
+
+- [Job](/types/Job.md)

package/dist/okf/rules/WGL012.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: WGL012
+description: Deprecated property usage — flags properties marked as deprecated in the GitLab CI schema
+id: WGL012
+severity: error
+category: post-synth
+lexicon: gitlab
+docs: https://intentius.io/chant/lexicons/gitlab/rules/
+---
+Deprecated property usage — flags properties marked as deprecated in the GitLab CI schema

package/dist/okf/rules/WGL013.md

@@ -0,0 +1,15 @@
+---
+type: post-synth-check
+title: WGL013
+description: 'Invalid needs: target — dangling reference or self-reference'
+id: WGL013
+severity: error
+category: post-synth
+lexicon: gitlab
+docs: https://intentius.io/chant/lexicons/gitlab/rules/
+---
+Invalid needs: target — dangling reference or self-reference
+
+## Applies to
+
+- [Job](/types/Job.md)

package/dist/okf/rules/WGL014.md

@@ -0,0 +1,15 @@
+---
+type: post-synth-check
+title: WGL014
+description: 'Invalid extends: target — references a template not in the pipeline'
+id: WGL014
+severity: error
+category: post-synth
+lexicon: gitlab
+docs: https://intentius.io/chant/lexicons/gitlab/rules/
+---
+Invalid extends: target — references a template not in the pipeline
+
+## Applies to
+
+- [Job](/types/Job.md)

package/dist/okf/rules/WGL015.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: WGL015
+description: 'Circular needs: chain — cycle in job dependency graph'
+id: WGL015
+severity: error
+category: post-synth
+lexicon: gitlab
+docs: https://intentius.io/chant/lexicons/gitlab/rules/
+---
+Circular needs: chain — cycle in job dependency graph

package/dist/okf/rules/WGL016.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: WGL016
+description: Secrets in variables — hardcoded passwords or tokens in variables blocks
+id: WGL016
+severity: error
+category: post-synth
+lexicon: gitlab
+docs: https://intentius.io/chant/lexicons/gitlab/rules/
+---
+Secrets in variables — hardcoded passwords or tokens in variables blocks

package/dist/okf/rules/WGL017.md

@@ -0,0 +1,15 @@
+---
+type: post-synth-check
+title: WGL017
+description: Insecure registry — Docker push/pull to non-HTTPS registry
+id: WGL017
+severity: error
+category: post-synth
+lexicon: gitlab
+docs: https://intentius.io/chant/lexicons/gitlab/rules/
+---
+Insecure registry — Docker push/pull to non-HTTPS registry
+
+## Applies to
+
+- [Job](/types/Job.md)

package/dist/okf/rules/WGL018.md

@@ -0,0 +1,15 @@
+---
+type: post-synth-check
+title: WGL018
+description: Missing timeout — jobs without explicit timeout may run too long
+id: WGL018
+severity: error
+category: post-synth
+lexicon: gitlab
+docs: https://intentius.io/chant/lexicons/gitlab/rules/
+---
+Missing timeout — jobs without explicit timeout may run too long
+
+## Applies to
+
+- [Job](/types/Job.md)

package/dist/okf/rules/WGL019.md

@@ -0,0 +1,15 @@
+---
+type: post-synth-check
+title: WGL019
+description: Missing retry — deploy jobs without retry strategy
+id: WGL019
+severity: error
+category: post-synth
+lexicon: gitlab
+docs: https://intentius.io/chant/lexicons/gitlab/rules/
+---
+Missing retry — deploy jobs without retry strategy
+
+## Applies to
+
+- [Job](/types/Job.md)

package/dist/okf/rules/WGL020.md

@@ -0,0 +1,15 @@
+---
+type: post-synth-check
+title: WGL020
+description: Duplicate job names — multiple jobs resolving to same name
+id: WGL020
+severity: error
+category: post-synth
+lexicon: gitlab
+docs: https://intentius.io/chant/lexicons/gitlab/rules/
+---
+Duplicate job names — multiple jobs resolving to same name
+
+## Applies to
+
+- [Job](/types/Job.md)

package/dist/okf/rules/WGL021.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: WGL021
+description: Unused variables — global variables not referenced by any job
+id: WGL021
+severity: error
+category: post-synth
+lexicon: gitlab
+docs: https://intentius.io/chant/lexicons/gitlab/rules/
+---
+Unused variables — global variables not referenced by any job

package/dist/okf/rules/WGL022.md

@@ -0,0 +1,16 @@
+---
+type: post-synth-check
+title: WGL022
+description: Missing artifacts expiry — artifacts without expire_in cause disk bloat
+id: WGL022
+severity: error
+category: post-synth
+lexicon: gitlab
+docs: https://intentius.io/chant/lexicons/gitlab/rules/
+---
+Missing artifacts expiry — artifacts without expire_in cause disk bloat
+
+## Applies to
+
+- [Default](/types/Default.md)
+- [Job](/types/Job.md)

package/dist/okf/rules/WGL023.md

@@ -0,0 +1,15 @@
+---
+type: post-synth-check
+title: WGL023
+description: 'Overly broad rules — job with only when: always rule (no conditions)'
+id: WGL023
+severity: error
+category: post-synth
+lexicon: gitlab
+docs: https://intentius.io/chant/lexicons/gitlab/rules/
+---
+Overly broad rules — job with only when: always rule (no conditions)
+
+## Applies to
+
+- [Job](/types/Job.md)

package/dist/okf/rules/WGL024.md

@@ -0,0 +1,15 @@
+---
+type: post-synth-check
+title: WGL024
+description: 'Manual without allow_failure — manual jobs block pipeline without allow_failure: true'
+id: WGL024
+severity: error
+category: post-synth
+lexicon: gitlab
+docs: https://intentius.io/chant/lexicons/gitlab/rules/
+---
+Manual without allow_failure — manual jobs block pipeline without allow_failure: true
+
+## Applies to
+
+- [Job](/types/Job.md)

package/dist/okf/rules/WGL025.md

@@ -0,0 +1,15 @@
+---
+type: post-synth-check
+title: WGL025
+description: Missing cache key — cache without key causes collisions
+id: WGL025
+severity: error
+category: post-synth
+lexicon: gitlab
+docs: https://intentius.io/chant/lexicons/gitlab/rules/
+---
+Missing cache key — cache without key causes collisions
+
+## Applies to
+
+- [Job](/types/Job.md)

package/dist/okf/rules/WGL026.md

@@ -0,0 +1,15 @@
+---
+type: post-synth-check
+title: WGL026
+description: Privileged services without TLS — DinD services without DOCKER_TLS_CERTDIR
+id: WGL026
+severity: error
+category: post-synth
+lexicon: gitlab
+docs: https://intentius.io/chant/lexicons/gitlab/rules/
+---
+Privileged services without TLS — DinD services without DOCKER_TLS_CERTDIR
+
+## Applies to
+
+- [Job](/types/Job.md)

package/dist/okf/rules/WGL027.md

@@ -0,0 +1,15 @@
+---
+type: post-synth-check
+title: WGL027
+description: Empty script — jobs with empty or blank script entries
+id: WGL027
+severity: error
+category: post-synth
+lexicon: gitlab
+docs: https://intentius.io/chant/lexicons/gitlab/rules/
+---
+Empty script — jobs with empty or blank script entries
+
+## Applies to
+
+- [Job](/types/Job.md)

package/dist/okf/rules/WGL028.md

@@ -0,0 +1,15 @@
+---
+type: post-synth-check
+title: WGL028
+description: Redundant needs — needs listing jobs already implied by stage ordering
+id: WGL028
+severity: error
+category: post-synth
+lexicon: gitlab
+docs: https://intentius.io/chant/lexicons/gitlab/rules/
+---
+Redundant needs — needs listing jobs already implied by stage ordering
+
+## Applies to
+
+- [Job](/types/Job.md)

package/dist/okf/rules/WGL029.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: WGL029
+description: include:project / component resolved by a moving ref instead of a pinned tag or SHA
+id: WGL029
+severity: error
+category: post-synth
+lexicon: gitlab
+docs: https://intentius.io/chant/lexicons/gitlab/rules/
+---
+include:project / component resolved by a moving ref instead of a pinned tag or SHA

package/dist/okf/rules/WGL030.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: WGL030
+description: include:remote is insecure (HTTP) or mutable
+id: WGL030
+severity: error
+category: post-synth
+lexicon: gitlab
+docs: https://intentius.io/chant/lexicons/gitlab/rules/
+---
+include:remote is insecure (HTTP) or mutable

package/dist/okf/rules/WGL031.md

@@ -0,0 +1,15 @@
+---
+type: post-synth-check
+title: WGL031
+description: Container image not pinned to an immutable digest
+id: WGL031
+severity: error
+category: post-synth
+lexicon: gitlab
+docs: https://intentius.io/chant/lexicons/gitlab/rules/
+---
+Container image not pinned to an immutable digest
+
+## Applies to
+
+- [Job](/types/Job.md)

package/dist/okf/rules/WGL032.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: WGL032
+description: Include/component source resembles a well-known project (possible impersonation)
+id: WGL032
+severity: error
+category: post-synth
+lexicon: gitlab
+docs: https://intentius.io/chant/lexicons/gitlab/rules/
+---
+Include/component source resembles a well-known project (possible impersonation)

package/dist/okf/rules/WGL033.md

@@ -0,0 +1,15 @@
+---
+type: post-synth-check
+title: WGL033
+description: OIDC id_token without a scoped audience
+id: WGL033
+severity: error
+category: post-synth
+lexicon: gitlab
+docs: https://intentius.io/chant/lexicons/gitlab/rules/
+---
+OIDC id_token without a scoped audience
+
+## Applies to
+
+- [Job](/types/Job.md)

package/dist/okf/rules/WGL034.md

@@ -0,0 +1,15 @@
+---
+type: post-synth-check
+title: WGL034
+description: OIDC id_token mintable from a merge-request pipeline
+id: WGL034
+severity: error
+category: post-synth
+lexicon: gitlab
+docs: https://intentius.io/chant/lexicons/gitlab/rules/
+---
+OIDC id_token mintable from a merge-request pipeline
+
+## Applies to
+
+- [Job](/types/Job.md)

package/dist/okf/rules/WGL035.md

@@ -0,0 +1,15 @@
+---
+type: post-synth-check
+title: WGL035
+description: Untrusted CI variable interpolated into a script command
+id: WGL035
+severity: error
+category: post-synth
+lexicon: gitlab
+docs: https://intentius.io/chant/lexicons/gitlab/rules/
+---
+Untrusted CI variable interpolated into a script command
+
+## Applies to
+
+- [Job](/types/Job.md)

package/dist/okf/rules/WGL036.md

@@ -0,0 +1,15 @@
+---
+type: post-synth-check
+title: WGL036
+description: Privileged service / DinD reachable from merge-request pipelines
+id: WGL036
+severity: error
+category: post-synth
+lexicon: gitlab
+docs: https://intentius.io/chant/lexicons/gitlab/rules/
+---
+Privileged service / DinD reachable from merge-request pipelines
+
+## Applies to
+
+- [Job](/types/Job.md)

package/dist/okf/rules/WGL037.md

@@ -0,0 +1,15 @@
+---
+type: post-synth-check
+title: WGL037
+description: Security gate on a regex match of an untrusted ref variable
+id: WGL037
+severity: error
+category: post-synth
+lexicon: gitlab
+docs: https://intentius.io/chant/lexicons/gitlab/rules/
+---
+Security gate on a regex match of an untrusted ref variable
+
+## Applies to
+
+- [Job](/types/Job.md)

package/dist/okf/rules/WGL038.md

@@ -0,0 +1,15 @@
+---
+type: post-synth-check
+title: WGL038
+description: Secret-like variable reachable from a merge-request pipeline
+id: WGL038
+severity: error
+category: post-synth
+lexicon: gitlab
+docs: https://intentius.io/chant/lexicons/gitlab/rules/
+---
+Secret-like variable reachable from a merge-request pipeline
+
+## Applies to
+
+- [Job](/types/Job.md)

package/dist/okf/rules/WGL039.md

@@ -0,0 +1,15 @@
+---
+type: post-synth-check
+title: WGL039
+description: Secret-like variable printed to job logs
+id: WGL039
+severity: error
+category: post-synth
+lexicon: gitlab
+docs: https://intentius.io/chant/lexicons/gitlab/rules/
+---
+Secret-like variable printed to job logs
+
+## Applies to
+
+- [Job](/types/Job.md)

package/dist/okf/rules/WGL040.md

@@ -0,0 +1,15 @@
+---
+type: post-synth-check
+title: WGL040
+description: Hardcoded credential in a registry login command
+id: WGL040
+severity: error
+category: post-synth
+lexicon: gitlab
+docs: https://intentius.io/chant/lexicons/gitlab/rules/
+---
+Hardcoded credential in a registry login command
+
+## Applies to
+
+- [Job](/types/Job.md)

package/dist/okf/rules/WGL041.md

@@ -0,0 +1,15 @@
+---
+type: post-synth-check
+title: WGL041
+description: Logically unsound (tautological) rules:if condition
+id: WGL041
+severity: error
+category: post-synth
+lexicon: gitlab
+docs: https://intentius.io/chant/lexicons/gitlab/rules/
+---
+Logically unsound (tautological) rules:if condition
+
+## Applies to
+
+- [Job](/types/Job.md)

package/dist/okf/rules/WGL042.md

@@ -0,0 +1,15 @@
+---
+type: post-synth-check
+title: WGL042
+description: Unreachable rules after an unconditional match
+id: WGL042
+severity: error
+category: post-synth
+lexicon: gitlab
+docs: https://intentius.io/chant/lexicons/gitlab/rules/
+---
+Unreachable rules after an unconditional match
+
+## Applies to
+
+- [Job](/types/Job.md)

package/dist/okf/rules/WGL043.md

@@ -0,0 +1,15 @@
+---
+type: post-synth-check
+title: WGL043
+description: Match-anything regex gate in rules:if
+id: WGL043
+severity: error
+category: post-synth
+lexicon: gitlab
+docs: https://intentius.io/chant/lexicons/gitlab/rules/
+---
+Match-anything regex gate in rules:if
+
+## Applies to
+
+- [Job](/types/Job.md)

package/dist/okf/rules/WGL044.md

@@ -0,0 +1,15 @@
+---
+type: post-synth-check
+title: WGL044
+description: Public artifacts expose build output
+id: WGL044
+severity: error
+category: post-synth
+lexicon: gitlab
+docs: https://intentius.io/chant/lexicons/gitlab/rules/
+---
+Public artifacts expose build output
+
+## Applies to
+
+- [Job](/types/Job.md)

package/dist/okf/rules/WGL045.md

@@ -0,0 +1,15 @@
+---
+type: post-synth-check
+title: WGL045
+description: Artifact path that may capture a credential file
+id: WGL045
+severity: error
+category: post-synth
+lexicon: gitlab
+docs: https://intentius.io/chant/lexicons/gitlab/rules/
+---
+Artifact path that may capture a credential file
+
+## Applies to
+
+- [Job](/types/Job.md)

package/dist/okf/rules/WGL046.md

@@ -0,0 +1,15 @@
+---
+type: post-synth-check
+title: WGL046
+description: Cache populated in a merge-request pipeline (poisoning risk)
+id: WGL046
+severity: error
+category: post-synth
+lexicon: gitlab
+docs: https://intentius.io/chant/lexicons/gitlab/rules/
+---
+Cache populated in a merge-request pipeline (poisoning risk)
+
+## Applies to
+
+- [Job](/types/Job.md)

package/dist/okf/rules/WGL047.md

@@ -0,0 +1,15 @@
+---
+type: post-synth-check
+title: WGL047
+description: Software fetched and piped to a shell without verification
+id: WGL047
+severity: error
+category: post-synth
+lexicon: gitlab
+docs: https://intentius.io/chant/lexicons/gitlab/rules/
+---
+Software fetched and piped to a shell without verification
+
+## Applies to
+
+- [Job](/types/Job.md)

package/dist/okf/rules/WGL048.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: WGL048
+description: 'Pipeline defines workflow: but no workflow:name'
+id: WGL048
+severity: error
+category: post-synth
+lexicon: gitlab
+docs: https://intentius.io/chant/lexicons/gitlab/rules/
+---
+Pipeline defines workflow: but no workflow:name

package/dist/okf/types/Default.md

@@ -0,0 +1,29 @@
+---
+type: resource-type
+title: Default
+description: gitlab resource type GitLab::CI::Default
+name: Default
+lexicon: gitlab
+resource_type: GitLab::CI::Default
+---
+`GitLab::CI::Default`, a resource type of the gitlab lexicon.
+
+## Properties
+
+- `after_script` (`string | string[]`, optional)
+- `artifacts` (`Artifacts`, optional)
+- `before_script` (`string | string[]`, optional)
+- `cache` (`Cache | Cache[]`, optional)
+- `hooks` (`Record<string, unknown>`, optional)
+- `id_tokens` (`Record<string, { aud: string | string[] }>`, optional)
+- `identity` (`"google_cloud"`, optional)
+- `image` (`Image`, optional)
+- `interruptible` (`boolean`, optional)
+- `retry` (`Retry | number`, optional)
+- `services` (`Service[]`, optional)
+- `tags` (`any[]`, optional)
+- `timeout` (`string`, optional)
+
+## Governed by
+
+- [WGL022](/rules/WGL022.md): Missing artifacts expiry — artifacts without expire_in cause disk bloat

package/dist/okf/types/Job.md

@@ -0,0 +1,86 @@
+---
+type: resource-type
+title: Job
+description: gitlab resource type GitLab::CI::Job
+name: Job
+lexicon: gitlab
+resource_type: GitLab::CI::Job
+---
+`GitLab::CI::Job`, a resource type of the gitlab lexicon.
+
+## Properties
+
+- `after_script` (`string | string[]`, optional)
+- `allow_failure` (`AllowFailure | boolean`, optional)
+- `artifacts` (`Artifacts`, optional)
+- `before_script` (`string | string[]`, optional)
+- `cache` (`Cache | Cache[]`, optional)
+- `coverage` (`string`, optional): Must be a regular expression, optionally but recommended to be quoted, and must be surrounded with '/'. Example: '/Code coverage: \d+\.\d+/'
+- `dependencies` (`string[]`, optional): Specify a list of job names from earlier stages from which artifacts should be loaded. By default, all previous artifacts are passed. Use an empty array to skip downloading artifacts.
+- `environment` (`Environment | string`, optional): Used to associate environment metadata with a deploy. Environment can have a name and URL attached to it, and will be displayed under /environments under the project.
+- `except` (`any`, optional): Job will run *except* for when these filtering options match.
+- `extends` (`string | string[]`, optional): The name of one or more jobs to inherit configuration from.
+- `hooks` (`Record<string, unknown>`, optional)
+- `id_tokens` (`Record<string, { aud: string | string[] }>`, optional)
+- `identity` (`"google_cloud"`, optional)
+- `image` (`Image`, optional)
+- `inherit` (`Inherit`, optional)
+- `interruptible` (`boolean`, optional)
+- `manual_confirmation` (`string`, optional)
+- `needs` (`Need[]`, optional): The list of jobs in previous stages whose sole completion is needed to start the current job.
+- `only` (`any`, optional): Job will run *only* when these filtering options match.
+- `pages` (`Record<string, any> | boolean`, optional)
+- `parallel` (`Parallel | number`, optional)
+- `publish` (`string`, optional): A path to a directory that contains the files to be published with Pages
+- `release` (`Release`, optional): Indicates that the job creates a Release.
+- `resource_group` (`string`, optional): Limit job concurrency. Can be used to ensure that the Runner will not run certain jobs simultaneously.
+- `retry` (`Retry | number`, optional)
+- `rules` (`Rule[]`, optional)
+- `run` (`any[]`, optional)
+- `script` (`string | string[]`, optional)
+- `secrets` (`Record<string, unknown>`, optional)
+- `services` (`Service[]`, optional)
+- `stage` (`string | string[]`, optional): Define what stage the job will run in.
+- `start_in` (`string`, optional)
+- `tags` (`any[]`, optional)
+- `timeout` (`string`, optional)
+- `trigger` (`Trigger | string`, optional)
+- `variables` (`Record<string, unknown>`, optional)
+- `when` (`"on_success" | "on_failure" | "always" | "never" | "manual" | "delayed"`, optional)
+
+## Governed by
+
+- [WGL001](/rules/WGL001.md): Deprecated only/except keywords
+- [WGL002](/rules/WGL002.md): Missing script
+- [WGL003](/rules/WGL003.md): Missing stage
+- [WGL010](/rules/WGL010.md): Job references a stage not in the stages list
+- [WGL011](/rules/WGL011.md): Job has rules that always evaluate to never (unreachable)
+- [WGL013](/rules/WGL013.md): Invalid needs: target — dangling reference or self-reference
+- [WGL014](/rules/WGL014.md): Invalid extends: target — references a template not in the pipeline
+- [WGL017](/rules/WGL017.md): Insecure registry — Docker push/pull to non-HTTPS registry
+- [WGL018](/rules/WGL018.md): Missing timeout — jobs without explicit timeout may run too long
+- [WGL019](/rules/WGL019.md): Missing retry — deploy jobs without retry strategy
+- [WGL020](/rules/WGL020.md): Duplicate job names — multiple jobs resolving to same name
+- [WGL022](/rules/WGL022.md): Missing artifacts expiry — artifacts without expire_in cause disk bloat
+- [WGL023](/rules/WGL023.md): Overly broad rules — job with only when: always rule (no conditions)
+- [WGL024](/rules/WGL024.md): Manual without allow_failure — manual jobs block pipeline without allow_failure: true
+- [WGL025](/rules/WGL025.md): Missing cache key — cache without key causes collisions
+- [WGL026](/rules/WGL026.md): Privileged services without TLS — DinD services without DOCKER_TLS_CERTDIR
+- [WGL027](/rules/WGL027.md): Empty script — jobs with empty or blank script entries
+- [WGL028](/rules/WGL028.md): Redundant needs — needs listing jobs already implied by stage ordering
+- [WGL031](/rules/WGL031.md): Container image not pinned to an immutable digest
+- [WGL033](/rules/WGL033.md): OIDC id_token without a scoped audience
+- [WGL034](/rules/WGL034.md): OIDC id_token mintable from a merge-request pipeline
+- [WGL035](/rules/WGL035.md): Untrusted CI variable interpolated into a script command
+- [WGL036](/rules/WGL036.md): Privileged service / DinD reachable from merge-request pipelines
+- [WGL037](/rules/WGL037.md): Security gate on a regex match of an untrusted ref variable
+- [WGL038](/rules/WGL038.md): Secret-like variable reachable from a merge-request pipeline
+- [WGL039](/rules/WGL039.md): Secret-like variable printed to job logs
+- [WGL040](/rules/WGL040.md): Hardcoded credential in a registry login command
+- [WGL041](/rules/WGL041.md): Logically unsound (tautological) rules:if condition
+- [WGL042](/rules/WGL042.md): Unreachable rules after an unconditional match
+- [WGL043](/rules/WGL043.md): Match-anything regex gate in rules:if
+- [WGL044](/rules/WGL044.md): Public artifacts expose build output
+- [WGL045](/rules/WGL045.md): Artifact path that may capture a credential file
+- [WGL046](/rules/WGL046.md): Cache populated in a merge-request pipeline (poisoning risk)
+- [WGL047](/rules/WGL047.md): Software fetched and piped to a shell without verification

package/dist/okf/types/Workflow.md

@@ -0,0 +1,15 @@
+---
+type: resource-type
+title: Workflow
+description: gitlab resource type GitLab::CI::Workflow
+name: Workflow
+lexicon: gitlab
+resource_type: GitLab::CI::Workflow
+---
+`GitLab::CI::Workflow`, a resource type of the gitlab lexicon.
+
+## Properties
+
+- `auto_cancel` (`AutoCancel`, optional)
+- `name` (`string`, optional)
+- `rules` (`WorkflowRule[]`, optional)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-gitlab",
-  "version": "0.41.20",
+  "version": "0.42.1",
   "description": "GitLab CI lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -67,8 +67,8 @@
     "typescript": "^5.9.3"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.41.20",
-    "@intentius/chant-lexicon-github": "^0.41.20",
+    "@intentius/chant": "^0.42.1",
+    "@intentius/chant-lexicon-github": "^0.42.1",
     "typescript": "^5.9.3"
   },
   "peerDependenciesMeta": {

package/src/package-cli.ts

@@ -5,7 +5,7 @@
  */
 import { generate, writeGeneratedFiles } from "./codegen/generate";
 import { packageLexicon } from "./codegen/package";
-import { writeFileSync, mkdirSync } from "fs";
+import { writeBundleSpec } from "@intentius/chant/codegen/package";
 import { join, dirname } from "path";
 import { fileURLToPath } from "url";
 
@@ -20,24 +20,7 @@ console.error(`Generated ${genResult.resources} entities, ${genResult.properties
 const { spec, stats } = await packageLexicon({ verbose: true });
 
 const distDir = join(pkgDir, "dist");
-mkdirSync(join(distDir, "types"), { recursive: true });
-mkdirSync(join(distDir, "rules"), { recursive: true });
-mkdirSync(join(distDir, "skills"), { recursive: true });
-
-writeFileSync(join(distDir, "manifest.json"), JSON.stringify(spec.manifest, null, 2));
-writeFileSync(join(distDir, "meta.json"), spec.registry);
-writeFileSync(join(distDir, "types", "index.d.ts"), spec.typesDTS);
-
-for (const [name, content] of spec.rules) {
-  writeFileSync(join(distDir, "rules", name), content);
-}
-for (const [name, content] of spec.skills) {
-  writeFileSync(join(distDir, "skills", name), content);
-}
-
-if (spec.integrity) {
-  writeFileSync(join(distDir, "integrity.json"), JSON.stringify(spec.integrity, null, 2));
-}
+writeBundleSpec(spec, distDir);
 
 console.error(`Packaged ${stats.resources} entities, ${stats.ruleCount} rules, ${stats.skillCount} skills`);
 console.error(`dist/ written to ${distDir}`);