@intentius/chant-lexicon-gitlab 0.46.0 → 0.49.0

package/dist/integrity.json

@@ -1,13 +1,14 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "c3703cd4ebf4f650408c0bd187c1a242041dfdb0461b52d67db198d2cf486c67",
+    "manifest.json": "6e5bfe31912b7af3fa1bd5241c2a22ae87b5e95afbe871d0736fd8d96cd3cd69",
     "meta.json": "931fc3246a55645b1493080bbeb160e5d205e42349e8bdca96ca243adb5f0da3",
     "types/index.d.ts": "5cd2e99f135a929b72bdd822d00d780d39b1cd407ba0cfb3d511c7ac9d667b58",
     "rules/artifact-no-expiry.ts": "3f3cabf9792cbf8207e53a25f506715466b19ec25e9c3b4d0d77fed6b2eb4542",
     "rules/deprecated-only-except.ts": "2341b95c0aaf3013c375fb404969858e23451e3430f3d1a63b128fcb21b90156",
-    "rules/missing-script.ts": "1dba062d77fa248fc02857fd08bc7789f90eefd3206e552ac63782a04b843888",
-    "rules/missing-stage.ts": "ce810703cba6c8942282c4ebaeff23fe3312c4ecc362acce05baf85d0fd32ea3",
+    "rules/import-source.ts": "b5b2e79ef4c18a21711a380dce60e8bbab840223eda568b18039879d3a0a549f",
+    "rules/missing-script.ts": "c9efd57e2d5cc0a022c6e7858f7ffa98d2fbb055e6ea915d2d54cf2b2d130e47",
+    "rules/missing-stage.ts": "b0f4b7e0b70e496ddc9d239d78a26410da4c18fcf9c518813523bb2459ffa5f7",
     "rules/wgl010.ts": "e9a14d5f9e4c49b1524ba5ee3746be739603125ec3c2dc4eb4b7c0bfc32581b0",
     "rules/wgl011.ts": "2fbb164669204ac8c3662b9c1ae156b59589913e59dd596fb38f289a0f218aaf",
     "rules/wgl012.ts": "ec4bd3fe93d30824c74223bb4e5929e493a06561a7bd3265b68dc1ba5d734da4",
@@ -17,7 +18,7 @@
     "rules/wgl016.ts": "d8bf9a371b22f37a767f92e3361d5f8e064e6dd6ba879ff1a5fc90b4b09fd304",
     "rules/wgl017.ts": "2d212de62eee4f7b086b49c92975b09d988c1ff05c2fb20cffccdc500a14e668",
     "rules/wgl018.ts": "dba1e1357becb1bbea9b435d9ce88b12138a53d8fc934483bc0ec8f22e4b18f5",
-    "rules/wgl019.ts": "d54038ed7b24ac8e8d59efba9645ef435fe090647138fff1946443dcd75ebfd1",
+    "rules/wgl019.ts": "01d703b2734385c3a9c6a132e1988f07d24636aa5e8fc22d8e06cc7b4aae5d97",
     "rules/wgl020.ts": "81a84b49308f36ab2b01342bd0e262b59b2a8395d233760ac52a679c2a4ae0e6",
     "rules/wgl021.ts": "59a75e0b0123779bcd4c7f66eb068c4302860df8333a4bc7b41c68e3983505da",
     "rules/wgl022.ts": "96b87f8f410f5ffa6358823f4c8cb08a59166a7575166ede24e8c41b50f3be65",
@@ -52,5 +53,5 @@
     "skills/chant-gitlab-migrate.md": "4853d04980560b379e5b0f7267dcb0a1e5d5879cb9e9931681ce76b2a5fe69d8",
     "skills/chant-gitlab-patterns.md": "6d9a44e9e8de4c3820be9d65381b0d2ede4cb3626aaaf0011e21838a9fbf556e"
   },
-  "composite": "b01961b1bd64c168d5d5d28d9d6cd160745f706b69b7451fe5b9218dff4c1d66"
+  "composite": "9f91a75e02d3e027b840d19762da56a8155b6c95227917df289e27fe46d48f8b"
 }

package/dist/lint/post-synth/wgl019.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"wgl019.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/wgl019.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAK9G,eAAO,MAAM,MAAM,EAAE,cA+BpB,CAAC"}
+{"version":3,"file":"wgl019.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/wgl019.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAK9G,eAAO,MAAM,MAAM,EAAE,cAoCpB,CAAC"}

package/dist/lint/rules/import-source.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Shared helper for gitlab lint rules that match a bare TypeScript
+ * identifier (`Job`, ...) and need to know whether it actually came from
+ * this lexicon before flagging it (chant #1544 — cross-lexicon rule bleed:
+ * `new Job(...)` matches ANY lexicon's `Job` class by name alone, so a
+ * multi-lexicon project got gitlab-only rules applied to github/forgejo
+ * jobs that were never missing anything).
+ */
+import * as ts from "typescript";
+/**
+ * The module specifier a top-level import bound `name` to, whether via a
+ * named import (`import { Job } from "..."`, matched on its local —
+ * possibly aliased — binding) or a namespace import (`import * as gl from
+ * "..."`, matched on the namespace's own name). Undefined when `name` isn't
+ * bound by any top-level import in this file (no import at all, a
+ * re-export chain, a dynamic `require`, …) — the caller should treat that
+ * as "can't tell", not "not gitlab", to stay conservative for the common
+ * single-lexicon-project case (and every pre-#1544 unit test fixture, which
+ * has no import statements at all).
+ */
+export declare function importSourceFor(sourceFile: ts.SourceFile, name: string): string | undefined;
+/**
+ * True when `expression` (a `new`-expression callee) resolves — via a
+ * traced import — to a lexicon OTHER than gitlab. False for an unresolved
+ * import (conservative: still checked) or one that does resolve to gitlab.
+ */
+export declare function isJobFromAnotherLexicon(sourceFile: ts.SourceFile, expression: ts.LeftHandSideExpression): boolean;
+//# sourceMappingURL=import-source.d.ts.map

package/dist/lint/rules/import-source.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"import-source.d.ts","sourceRoot":"","sources":["../../../src/lint/rules/import-source.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,MAAM,YAAY,CAAC;AAEjC;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAiB3F;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,EAAE,UAAU,EAAE,EAAE,CAAC,sBAAsB,GAAG,OAAO,CAWjH"}

package/dist/lint/rules/missing-script.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"missing-script.d.ts","sourceRoot":"","sources":["../../../src/lint/rules/missing-script.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAA+B,MAAM,4BAA4B,CAAC;AAKxF,eAAO,MAAM,iBAAiB,EAAE,QAoD/B,CAAC"}
+{"version":3,"file":"missing-script.d.ts","sourceRoot":"","sources":["../../../src/lint/rules/missing-script.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAA+B,MAAM,4BAA4B,CAAC;AAMxF,eAAO,MAAM,iBAAiB,EAAE,QAgE/B,CAAC"}

package/dist/lint/rules/missing-stage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"missing-stage.d.ts","sourceRoot":"","sources":["../../../src/lint/rules/missing-stage.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAA+B,MAAM,4BAA4B,CAAC;AAGxF,eAAO,MAAM,gBAAgB,EAAE,QAmD9B,CAAC"}
+{"version":3,"file":"missing-stage.d.ts","sourceRoot":"","sources":["../../../src/lint/rules/missing-stage.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAA+B,MAAM,4BAA4B,CAAC;AAIxF,eAAO,MAAM,gBAAgB,EAAE,QA0D9B,CAAC"}

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "gitlab",
-  "version": "0.46.0",
+  "version": "0.49.0",
   "chantVersion": ">=0.1.0",
   "namespace": "GitLab",
   "intrinsics": [

package/dist/rules/import-source.ts

@@ -0,0 +1,58 @@
+/**
+ * Shared helper for gitlab lint rules that match a bare TypeScript
+ * identifier (`Job`, ...) and need to know whether it actually came from
+ * this lexicon before flagging it (chant #1544 — cross-lexicon rule bleed:
+ * `new Job(...)` matches ANY lexicon's `Job` class by name alone, so a
+ * multi-lexicon project got gitlab-only rules applied to github/forgejo
+ * jobs that were never missing anything).
+ */
+
+import * as ts from "typescript";
+
+/**
+ * The module specifier a top-level import bound `name` to, whether via a
+ * named import (`import { Job } from "..."`, matched on its local —
+ * possibly aliased — binding) or a namespace import (`import * as gl from
+ * "..."`, matched on the namespace's own name). Undefined when `name` isn't
+ * bound by any top-level import in this file (no import at all, a
+ * re-export chain, a dynamic `require`, …) — the caller should treat that
+ * as "can't tell", not "not gitlab", to stay conservative for the common
+ * single-lexicon-project case (and every pre-#1544 unit test fixture, which
+ * has no import statements at all).
+ */
+export function importSourceFor(sourceFile: ts.SourceFile, name: string): string | undefined {
+  for (const stmt of sourceFile.statements) {
+    if (!ts.isImportDeclaration(stmt)) continue;
+    const moduleSpecifier = stmt.moduleSpecifier;
+    if (!ts.isStringLiteral(moduleSpecifier)) continue;
+    const namedBindings = stmt.importClause?.namedBindings;
+    if (!namedBindings) continue;
+
+    if (ts.isNamespaceImport(namedBindings)) {
+      if (namedBindings.name.text === name) return moduleSpecifier.text;
+    } else if (ts.isNamedImports(namedBindings)) {
+      for (const element of namedBindings.elements) {
+        if (element.name.text === name) return moduleSpecifier.text;
+      }
+    }
+  }
+  return undefined;
+}
+
+/**
+ * True when `expression` (a `new`-expression callee) resolves — via a
+ * traced import — to a lexicon OTHER than gitlab. False for an unresolved
+ * import (conservative: still checked) or one that does resolve to gitlab.
+ */
+export function isJobFromAnotherLexicon(sourceFile: ts.SourceFile, expression: ts.LeftHandSideExpression): boolean {
+  let bindingName: string | undefined;
+  if (ts.isIdentifier(expression)) {
+    bindingName = expression.text;
+  } else if (ts.isPropertyAccessExpression(expression)) {
+    bindingName = ts.isIdentifier(expression.expression) ? expression.expression.text : undefined;
+  }
+  if (!bindingName) return false;
+
+  const source = importSourceFor(sourceFile, bindingName);
+  return source !== undefined && !source.includes("chant-lexicon-gitlab");
+}

package/dist/rules/missing-script.ts

@@ -7,6 +7,7 @@
 
 import type { LintRule, LintDiagnostic, LintContext } from "@intentius/chant/lint/rule";
 import * as ts from "typescript";
+import { isJobFromAnotherLexicon } from "./import-source";
 
 const VALID_EXECUTION_PROPS = new Set(["script", "trigger", "run"]);
 
@@ -31,6 +32,18 @@ export const missingScriptRule: LintRule = {
           isJob = true;
         }
 
+        // chant #1544 — cross-lexicon rule bleed: `new Job(...)` matches
+        // ANY lexicon's `Job` class by bare name alone (github's, forgejo's,
+        // ...), so a multi-lexicon project got WGL002 (gitlab-only) applied
+        // to github/forgejo jobs that were never missing anything — they
+        // just don't use `script`/`trigger`/`run`. Skip when the import
+        // resolves to a lexicon other than gitlab; an unresolved import
+        // (no `import` statement — most unit-test fixtures, a re-export) is
+        // "can't tell", so it keeps the previous, conservative behavior.
+        if (isJob && isJobFromAnotherLexicon(sourceFile, expression)) {
+          isJob = false;
+        }
+
         if (isJob && node.arguments && node.arguments.length > 0) {
           const props = node.arguments[0];
           if (ts.isObjectLiteralExpression(props)) {

package/dist/rules/missing-stage.ts

@@ -7,6 +7,7 @@
 
 import type { LintRule, LintDiagnostic, LintContext } from "@intentius/chant/lint/rule";
 import * as ts from "typescript";
+import { isJobFromAnotherLexicon } from "./import-source";
 
 export const missingStageRule: LintRule = {
   id: "WGL003",
@@ -28,6 +29,13 @@ export const missingStageRule: LintRule = {
           isJob = true;
         }
 
+        // chant #1544 — same cross-lexicon rule bleed as WGL002 (see
+        // missing-script.ts): a github/forgejo `Job` must not be judged
+        // against gitlab's `stage` convention.
+        if (isJob && isJobFromAnotherLexicon(sourceFile, expression)) {
+          isJob = false;
+        }
+
         if (isJob && node.arguments && node.arguments.length > 0) {
           const props = node.arguments[0];
           if (ts.isObjectLiteralExpression(props)) {

package/dist/rules/wgl019.ts

@@ -28,7 +28,12 @@ export const wgl019: PostSynthCheck = {
       const stage = props.stage as string | undefined;
       if (!stage || !DEPLOY_STAGES.has(stage.toLowerCase())) continue;
 
-      if (!props.retry) {
+      // chant #1544 — `!props.retry` treated an explicit `retry: 0` the same
+      // as no `retry` at all, warning on a job that stated its policy
+      // ("retrying a deploy without a human is deliberate") as if it hadn't.
+      // `retry: 0` is falsy but present — only an actually-absent key means
+      // "no retry strategy".
+      if (props.retry === undefined) {
         diagnostics.push({
           checkId: "WGL019",
           severity: "info",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-gitlab",
-  "version": "0.46.0",
+  "version": "0.49.0",
   "description": "GitLab CI lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -67,8 +67,8 @@
     "typescript": "^5.9.3"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.46.0",
-    "@intentius/chant-lexicon-github": "^0.46.0",
+    "@intentius/chant": "^0.49.0",
+    "@intentius/chant-lexicon-github": "^0.49.0",
     "typescript": "^5.9.3"
   },
   "peerDependenciesMeta": {

package/src/lint/post-synth/wgl019.test.ts

@@ -53,6 +53,14 @@ describe("WGL019: Missing Retry on Deploy Jobs", () => {
     expect(diags).toHaveLength(0);
   });
 
+  test("does not flag deploy job with explicit retry: 0 (#1544)", () => {
+    const entities = new Map<string, Declarable>([
+      ["deployApp", new MockJob({ script: ["deploy.sh"], stage: "deploy", retry: 0 })],
+    ]);
+    const diags = wgl019.check(makeCtx(entities));
+    expect(diags).toHaveLength(0);
+  });
+
   test("does not flag non-deploy job without retry", () => {
     const entities = new Map<string, Declarable>([
       ["testJob", new MockJob({ script: ["npm test"], stage: "test" })],

package/src/lint/post-synth/wgl019.ts

@@ -28,7 +28,12 @@ export const wgl019: PostSynthCheck = {
       const stage = props.stage as string | undefined;
       if (!stage || !DEPLOY_STAGES.has(stage.toLowerCase())) continue;
 
-      if (!props.retry) {
+      // chant #1544 — `!props.retry` treated an explicit `retry: 0` the same
+      // as no `retry` at all, warning on a job that stated its policy
+      // ("retrying a deploy without a human is deliberate") as if it hadn't.
+      // `retry: 0` is falsy but present — only an actually-absent key means
+      // "no retry strategy".
+      if (props.retry === undefined) {
         diagnostics.push({
           checkId: "WGL019",
           severity: "info",

package/src/lint/rules/import-source.ts

@@ -0,0 +1,58 @@
+/**
+ * Shared helper for gitlab lint rules that match a bare TypeScript
+ * identifier (`Job`, ...) and need to know whether it actually came from
+ * this lexicon before flagging it (chant #1544 — cross-lexicon rule bleed:
+ * `new Job(...)` matches ANY lexicon's `Job` class by name alone, so a
+ * multi-lexicon project got gitlab-only rules applied to github/forgejo
+ * jobs that were never missing anything).
+ */
+
+import * as ts from "typescript";
+
+/**
+ * The module specifier a top-level import bound `name` to, whether via a
+ * named import (`import { Job } from "..."`, matched on its local —
+ * possibly aliased — binding) or a namespace import (`import * as gl from
+ * "..."`, matched on the namespace's own name). Undefined when `name` isn't
+ * bound by any top-level import in this file (no import at all, a
+ * re-export chain, a dynamic `require`, …) — the caller should treat that
+ * as "can't tell", not "not gitlab", to stay conservative for the common
+ * single-lexicon-project case (and every pre-#1544 unit test fixture, which
+ * has no import statements at all).
+ */
+export function importSourceFor(sourceFile: ts.SourceFile, name: string): string | undefined {
+  for (const stmt of sourceFile.statements) {
+    if (!ts.isImportDeclaration(stmt)) continue;
+    const moduleSpecifier = stmt.moduleSpecifier;
+    if (!ts.isStringLiteral(moduleSpecifier)) continue;
+    const namedBindings = stmt.importClause?.namedBindings;
+    if (!namedBindings) continue;
+
+    if (ts.isNamespaceImport(namedBindings)) {
+      if (namedBindings.name.text === name) return moduleSpecifier.text;
+    } else if (ts.isNamedImports(namedBindings)) {
+      for (const element of namedBindings.elements) {
+        if (element.name.text === name) return moduleSpecifier.text;
+      }
+    }
+  }
+  return undefined;
+}
+
+/**
+ * True when `expression` (a `new`-expression callee) resolves — via a
+ * traced import — to a lexicon OTHER than gitlab. False for an unresolved
+ * import (conservative: still checked) or one that does resolve to gitlab.
+ */
+export function isJobFromAnotherLexicon(sourceFile: ts.SourceFile, expression: ts.LeftHandSideExpression): boolean {
+  let bindingName: string | undefined;
+  if (ts.isIdentifier(expression)) {
+    bindingName = expression.text;
+  } else if (ts.isPropertyAccessExpression(expression)) {
+    bindingName = ts.isIdentifier(expression.expression) ? expression.expression.text : undefined;
+  }
+  if (!bindingName) return false;
+
+  const source = importSourceFor(sourceFile, bindingName);
+  return source !== undefined && !source.includes("chant-lexicon-gitlab");
+}

package/src/lint/rules/missing-script.ts

@@ -7,6 +7,7 @@
 
 import type { LintRule, LintDiagnostic, LintContext } from "@intentius/chant/lint/rule";
 import * as ts from "typescript";
+import { isJobFromAnotherLexicon } from "./import-source";
 
 const VALID_EXECUTION_PROPS = new Set(["script", "trigger", "run"]);
 
@@ -31,6 +32,18 @@ export const missingScriptRule: LintRule = {
           isJob = true;
         }
 
+        // chant #1544 — cross-lexicon rule bleed: `new Job(...)` matches
+        // ANY lexicon's `Job` class by bare name alone (github's, forgejo's,
+        // ...), so a multi-lexicon project got WGL002 (gitlab-only) applied
+        // to github/forgejo jobs that were never missing anything — they
+        // just don't use `script`/`trigger`/`run`. Skip when the import
+        // resolves to a lexicon other than gitlab; an unresolved import
+        // (no `import` statement — most unit-test fixtures, a re-export) is
+        // "can't tell", so it keeps the previous, conservative behavior.
+        if (isJob && isJobFromAnotherLexicon(sourceFile, expression)) {
+          isJob = false;
+        }
+
         if (isJob && node.arguments && node.arguments.length > 0) {
           const props = node.arguments[0];
           if (ts.isObjectLiteralExpression(props)) {

package/src/lint/rules/missing-stage.ts

@@ -7,6 +7,7 @@
 
 import type { LintRule, LintDiagnostic, LintContext } from "@intentius/chant/lint/rule";
 import * as ts from "typescript";
+import { isJobFromAnotherLexicon } from "./import-source";
 
 export const missingStageRule: LintRule = {
   id: "WGL003",
@@ -28,6 +29,13 @@ export const missingStageRule: LintRule = {
           isJob = true;
         }
 
+        // chant #1544 — same cross-lexicon rule bleed as WGL002 (see
+        // missing-script.ts): a github/forgejo `Job` must not be judged
+        // against gitlab's `stage` convention.
+        if (isJob && isJobFromAnotherLexicon(sourceFile, expression)) {
+          isJob = false;
+        }
+
         if (isJob && node.arguments && node.arguments.length > 0) {
           const props = node.arguments[0];
           if (ts.isObjectLiteralExpression(props)) {

package/src/lint/rules/rules.test.ts

@@ -88,6 +88,49 @@ describe("WGL002: missing-script", () => {
     const diags = missingScriptRule.check(ctx);
     expect(diags).toHaveLength(0);
   });
+
+  // chant #1544 — cross-lexicon rule bleed: a github/forgejo `Job` imported
+  // from its own lexicon package must not be judged by gitlab's `script`/
+  // `trigger`/`run` requirement.
+  test("does not flag a Job imported from the github lexicon", () => {
+    const ctx = createContext(
+      `import { Job } from "@intentius/chant-lexicon-github";\nconst j = new Job({ "runs-on": "ubuntu-latest", steps: [] });`,
+    );
+    const diags = missingScriptRule.check(ctx);
+    expect(diags).toHaveLength(0);
+  });
+
+  test("does not flag a Job imported from the forgejo lexicon", () => {
+    const ctx = createContext(
+      `import { Job } from "@intentius/chant-lexicon-forgejo";\nconst j = new Job({ "runs-on": "ubuntu-latest", steps: [] });`,
+    );
+    const diags = missingScriptRule.check(ctx);
+    expect(diags).toHaveLength(0);
+  });
+
+  test("still flags a Job imported from the gitlab lexicon", () => {
+    const ctx = createContext(
+      `import { Job } from "@intentius/chant-lexicon-gitlab";\nconst j = new Job({ stage: "test" });`,
+    );
+    const diags = missingScriptRule.check(ctx);
+    expect(diags).toHaveLength(1);
+  });
+
+  test("still flags a namespace-imported gl.Job() from the gitlab lexicon", () => {
+    const ctx = createContext(
+      `import * as gl from "@intentius/chant-lexicon-gitlab";\nconst j = new gl.Job({ stage: "build" });`,
+    );
+    const diags = missingScriptRule.check(ctx);
+    expect(diags).toHaveLength(1);
+  });
+
+  test("does not flag a namespace-imported Job from another lexicon", () => {
+    const ctx = createContext(
+      `import * as gh from "@intentius/chant-lexicon-github";\nconst j = new gh.Job({ "runs-on": "ubuntu-latest", steps: [] });`,
+    );
+    const diags = missingScriptRule.check(ctx);
+    expect(diags).toHaveLength(0);
+  });
 });
 
 // ── WGL003: missing stage ───────────────────────────────────────────
@@ -107,6 +150,23 @@ describe("WGL003: missing-stage", () => {
     const diags = missingStageRule.check(ctx);
     expect(diags).toHaveLength(0);
   });
+
+  // chant #1544 — same cross-lexicon rule bleed as WGL002.
+  test("does not flag a Job imported from the github lexicon", () => {
+    const ctx = createContext(
+      `import { Job } from "@intentius/chant-lexicon-github";\nconst j = new Job({ "runs-on": "ubuntu-latest", steps: [] });`,
+    );
+    const diags = missingStageRule.check(ctx);
+    expect(diags).toHaveLength(0);
+  });
+
+  test("still flags a Job imported from the gitlab lexicon", () => {
+    const ctx = createContext(
+      `import { Job } from "@intentius/chant-lexicon-gitlab";\nconst j = new Job({ script: ["test"] });`,
+    );
+    const diags = missingStageRule.check(ctx);
+    expect(diags).toHaveLength(1);
+  });
 });
 
 // ── WGL004: artifact no expiry ──────────────────────────────────────