@intentius/chant-lexicon-gitlab 0.46.0 → 0.50.0

package/dist/components/generate-op-pipeline.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Generate mode — scheduled Op → GitLab CI YAML (#927).
+ *
+ * The Op counterpart to `./generate-pipeline.ts` (#563): that module
+ * synthesizes a deploy-time component graph as one `.gitlab-ci.yml`; this one
+ * synthesizes a cron-triggered job per stateless Op — the CI-native
+ * alternative to a Temporal `TemporalSchedule` for downstream projects that
+ * don't run Temporal (`WorkflowAuditOp`/`PipelineAuditOp`/`ReconcileOp` all
+ * accept an optional `schedule` precisely for this).
+ *
+ * Unlike GitHub Actions' per-workflow `on.schedule`, GitLab has no in-file
+ * cron at all — a schedule is a project-level object (Settings → CI/CD →
+ * Schedules) that runs the project's *existing* `.gitlab-ci.yml` with a
+ * chosen cron and CI/CD variables. So every scheduled Op here becomes one
+ * job in a single generated file, gated to run only under its own Pipeline
+ * Schedule (`$CI_PIPELINE_SOURCE == "schedule"` plus a per-op selector
+ * variable) — the cron itself is configured on the Pipeline Schedule, not in
+ * this YAML, and the generated file's header comment states what to set up.
+ * Each job runs exactly one invocation, `chant run <name>` by default — never
+ * inlined audit/reconcile logic. The finding-mode itself is already baked
+ * into the Op's own activity args at build time by the composite that
+ * created it; GitLab has no per-job `permissions:` concept (unlike GitHub
+ * Actions), so a non-`report` mode's write access comes from whatever
+ * `GITLAB_TOKEN`/CI-CD-variable configuration the project already has —
+ * this generator documents the requirement rather than fabricating a
+ * variable nothing reads.
+ */
+import type { ComponentPipelineOptions as GenerateGitlabOpOptions, OpPipelineResult as GenerateGitlabOpResult, ScheduledOpSpec } from "@intentius/chant/lexicon";
+export type { GenerateGitlabOpOptions, GenerateGitlabOpResult };
+/**
+ * Synthesize one `.gitlab-ci.yml` job per scheduled Op, all in a single file
+ * (GitLab has no per-file cron — see the module doc). Wired into core's Op
+ * generate mode via the gitlab lexicon plugin's `generateOpPipeline`
+ * (../plugin.ts).
+ */
+export declare function generateGitlabOpPipeline(ops: ScheduledOpSpec[], options?: GenerateGitlabOpOptions): GenerateGitlabOpResult;
+//# sourceMappingURL=generate-op-pipeline.d.ts.map

package/dist/components/generate-op-pipeline.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"generate-op-pipeline.d.ts","sourceRoot":"","sources":["../../src/components/generate-op-pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAGH,OAAO,KAAK,EACV,wBAAwB,IAAI,uBAAuB,EAGnD,gBAAgB,IAAI,sBAAsB,EAC1C,eAAe,EAChB,MAAM,0BAA0B,CAAC;AAElC,YAAY,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,CAAC;AAmBhE;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,eAAe,EAAE,EACtB,OAAO,GAAE,uBAA4B,GACpC,sBAAsB,CA6CxB"}

package/dist/index.d.ts

@@ -1,5 +1,6 @@
 export { gitlabSerializer } from "./serializer.js";
 export { gitlabPlugin } from "./plugin.js";
+export { gitlabPipeline } from "./op/builders.js";
 export { reference, ReferenceIntrinsic } from "./intrinsics.js";
 export { CI } from "./variables.js";
 export * from "./generated/index.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAGhD,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAGxC,OAAO,EAAE,SAAS,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAG7D,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAIjC,cAAc,mBAAmB,CAAC;AAGlC,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,cAAc,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACnI,YAAY,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAGtI,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AACrF,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpF,YAAY,EAAE,iBAAiB,EAAE,cAAc,EAAE,cAAc,EAAE,kBAAkB,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAGzH,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAGhD,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAQxC,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAG/C,OAAO,EAAE,SAAS,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAG7D,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAIjC,cAAc,mBAAmB,CAAC;AAGlC,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,cAAc,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACnI,YAAY,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAGtI,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AACrF,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpF,YAAY,EAAE,iBAAiB,EAAE,cAAc,EAAE,cAAc,EAAE,kBAAkB,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAGzH,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC"}

package/dist/integrity.json

@@ -1,13 +1,14 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "c3703cd4ebf4f650408c0bd187c1a242041dfdb0461b52d67db198d2cf486c67",
+    "manifest.json": "b1cc9643fe6dbb20872dbccf6f0ac296fd7b2ab57a3d92b8a45915b1eeaf7743",
     "meta.json": "931fc3246a55645b1493080bbeb160e5d205e42349e8bdca96ca243adb5f0da3",
     "types/index.d.ts": "5cd2e99f135a929b72bdd822d00d780d39b1cd407ba0cfb3d511c7ac9d667b58",
     "rules/artifact-no-expiry.ts": "3f3cabf9792cbf8207e53a25f506715466b19ec25e9c3b4d0d77fed6b2eb4542",
     "rules/deprecated-only-except.ts": "2341b95c0aaf3013c375fb404969858e23451e3430f3d1a63b128fcb21b90156",
-    "rules/missing-script.ts": "1dba062d77fa248fc02857fd08bc7789f90eefd3206e552ac63782a04b843888",
-    "rules/missing-stage.ts": "ce810703cba6c8942282c4ebaeff23fe3312c4ecc362acce05baf85d0fd32ea3",
+    "rules/import-source.ts": "b5b2e79ef4c18a21711a380dce60e8bbab840223eda568b18039879d3a0a549f",
+    "rules/missing-script.ts": "c9efd57e2d5cc0a022c6e7858f7ffa98d2fbb055e6ea915d2d54cf2b2d130e47",
+    "rules/missing-stage.ts": "b0f4b7e0b70e496ddc9d239d78a26410da4c18fcf9c518813523bb2459ffa5f7",
     "rules/wgl010.ts": "e9a14d5f9e4c49b1524ba5ee3746be739603125ec3c2dc4eb4b7c0bfc32581b0",
     "rules/wgl011.ts": "2fbb164669204ac8c3662b9c1ae156b59589913e59dd596fb38f289a0f218aaf",
     "rules/wgl012.ts": "ec4bd3fe93d30824c74223bb4e5929e493a06561a7bd3265b68dc1ba5d734da4",
@@ -17,7 +18,7 @@
     "rules/wgl016.ts": "d8bf9a371b22f37a767f92e3361d5f8e064e6dd6ba879ff1a5fc90b4b09fd304",
     "rules/wgl017.ts": "2d212de62eee4f7b086b49c92975b09d988c1ff05c2fb20cffccdc500a14e668",
     "rules/wgl018.ts": "dba1e1357becb1bbea9b435d9ce88b12138a53d8fc934483bc0ec8f22e4b18f5",
-    "rules/wgl019.ts": "d54038ed7b24ac8e8d59efba9645ef435fe090647138fff1946443dcd75ebfd1",
+    "rules/wgl019.ts": "01d703b2734385c3a9c6a132e1988f07d24636aa5e8fc22d8e06cc7b4aae5d97",
     "rules/wgl020.ts": "81a84b49308f36ab2b01342bd0e262b59b2a8395d233760ac52a679c2a4ae0e6",
     "rules/wgl021.ts": "59a75e0b0123779bcd4c7f66eb068c4302860df8333a4bc7b41c68e3983505da",
     "rules/wgl022.ts": "96b87f8f410f5ffa6358823f4c8cb08a59166a7575166ede24e8c41b50f3be65",
@@ -47,10 +48,12 @@
     "rules/wgl046.ts": "bbd8f5075aa390db546f5e787ce542f31a9d5eb031578780480e770cd86f9b5b",
     "rules/wgl047.ts": "e6dba6a0c6c042e90a200859e52a0da28c56ce52705e147760eca0a0a37c3255",
     "rules/wgl048.ts": "810590da4e7eaf70a6332ae247dbd34e000e2af57c89d3bd5a19bb2a923fcbb1",
+    "rules/wgl049.ts": "875ba2203d66a2a444edf17b43c2ae438a3a23a7f579b81a448efc3d5dd4336e",
+    "rules/wgl050.ts": "c96ef683ecf6e55699ea62d669ba6359616d723dd1bc24880823da0ff6c86503",
     "rules/yaml-helpers.ts": "5835982d5d088eb4788ebad8160b181bfdb6fc94d546eabee90a4c278a913988",
     "skills/chant-gitlab.md": "1e26a0c50ea891423479bd7fec3bc133f9185727c4a3eaadd525d7e7436056b6",
     "skills/chant-gitlab-migrate.md": "4853d04980560b379e5b0f7267dcb0a1e5d5879cb9e9931681ce76b2a5fe69d8",
     "skills/chant-gitlab-patterns.md": "6d9a44e9e8de4c3820be9d65381b0d2ede4cb3626aaaf0011e21838a9fbf556e"
   },
-  "composite": "b01961b1bd64c168d5d5d28d9d6cd160745f706b69b7451fe5b9218dff4c1d66"
+  "composite": "ea16ce1e577f7c99329bab5b18295456acec8809608d0fb006f6715479863b74"
 }

package/dist/lint/audit-catalog.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit-catalog.d.ts","sourceRoot":"","sources":["../../src/lint/audit-catalog.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAA0E,KAAK,QAAQ,EAAE,MAAM,gCAAgC,CAAC;AAEvI,eAAO,MAAM,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAwCvD,CAAC"}
+{"version":3,"file":"audit-catalog.d.ts","sourceRoot":"","sources":["../../src/lint/audit-catalog.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAA0E,KAAK,QAAQ,EAAE,MAAM,gCAAgC,CAAC;AAEvI,eAAO,MAAM,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CA6CvD,CAAC"}

package/dist/lint/post-synth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAyCvE,eAAO,MAAM,eAAe,EAAE,cAAc,EAwC3C,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AA2CvE,eAAO,MAAM,eAAe,EAAE,cAAc,EA0C3C,CAAC"}

package/dist/lint/post-synth/wgl019.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"wgl019.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/wgl019.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAK9G,eAAO,MAAM,MAAM,EAAE,cA+BpB,CAAC"}
+{"version":3,"file":"wgl019.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/wgl019.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAK9G,eAAO,MAAM,MAAM,EAAE,cAoCpB,CAAC"}

package/dist/lint/post-synth/wgl049.d.ts

@@ -0,0 +1,14 @@
+/**
+ * WGL049: Dependency Install Without a Cache
+ *
+ * Flags a job whose `script:` runs a package-manager install command (`npm
+ * ci`, `pip install`, `bundle install`, etc.) with no `cache:` in scope —
+ * neither on the job itself, nor at the pipeline's `default:`/top level.
+ * Every run re-fetches the same dependencies from a cold cache. A job that
+ * `extends:` another config is left alone — the cache may be inherited and
+ * this check has no way to confirm that. Efficiency (#444), not a
+ * correctness or security issue.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const wgl049: PostSynthCheck;
+//# sourceMappingURL=wgl049.d.ts.map

package/dist/lint/post-synth/wgl049.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wgl049.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/wgl049.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAY9G,eAAO,MAAM,MAAM,EAAE,cAgCpB,CAAC"}

package/dist/lint/post-synth/wgl050.d.ts

@@ -0,0 +1,13 @@
+/**
+ * WGL050: Merge-Request Job Missing interruptible
+ *
+ * Flags a job reachable from merge-request pipelines that doesn't set
+ * `interruptible: true`. Without it, GitLab's auto-cancel-redundant-pipelines
+ * setting can't cancel the job when a new push supersedes it, so the runner
+ * keeps spending capacity on a pipeline nobody wants anymore. Deploy jobs are
+ * left alone — cancelling mid-deploy is its own hazard, not an efficiency
+ * win. Efficiency (#444), not a correctness or security issue.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const wgl050: PostSynthCheck;
+//# sourceMappingURL=wgl050.d.ts.map

package/dist/lint/post-synth/wgl050.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wgl050.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/wgl050.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAK9G,eAAO,MAAM,MAAM,EAAE,cAgCpB,CAAC"}

package/dist/lint/rules/import-source.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Shared helper for gitlab lint rules that match a bare TypeScript
+ * identifier (`Job`, ...) and need to know whether it actually came from
+ * this lexicon before flagging it (chant #1544 — cross-lexicon rule bleed:
+ * `new Job(...)` matches ANY lexicon's `Job` class by name alone, so a
+ * multi-lexicon project got gitlab-only rules applied to github/forgejo
+ * jobs that were never missing anything).
+ */
+import * as ts from "typescript";
+/**
+ * The module specifier a top-level import bound `name` to, whether via a
+ * named import (`import { Job } from "..."`, matched on its local —
+ * possibly aliased — binding) or a namespace import (`import * as gl from
+ * "..."`, matched on the namespace's own name). Undefined when `name` isn't
+ * bound by any top-level import in this file (no import at all, a
+ * re-export chain, a dynamic `require`, …) — the caller should treat that
+ * as "can't tell", not "not gitlab", to stay conservative for the common
+ * single-lexicon-project case (and every pre-#1544 unit test fixture, which
+ * has no import statements at all).
+ */
+export declare function importSourceFor(sourceFile: ts.SourceFile, name: string): string | undefined;
+/**
+ * True when `expression` (a `new`-expression callee) resolves — via a
+ * traced import — to a lexicon OTHER than gitlab. False for an unresolved
+ * import (conservative: still checked) or one that does resolve to gitlab.
+ */
+export declare function isJobFromAnotherLexicon(sourceFile: ts.SourceFile, expression: ts.LeftHandSideExpression): boolean;
+//# sourceMappingURL=import-source.d.ts.map

package/dist/lint/rules/import-source.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"import-source.d.ts","sourceRoot":"","sources":["../../../src/lint/rules/import-source.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,MAAM,YAAY,CAAC;AAEjC;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAiB3F;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,EAAE,UAAU,EAAE,EAAE,CAAC,sBAAsB,GAAG,OAAO,CAWjH"}

package/dist/lint/rules/missing-script.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"missing-script.d.ts","sourceRoot":"","sources":["../../../src/lint/rules/missing-script.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAA+B,MAAM,4BAA4B,CAAC;AAKxF,eAAO,MAAM,iBAAiB,EAAE,QAoD/B,CAAC"}
+{"version":3,"file":"missing-script.d.ts","sourceRoot":"","sources":["../../../src/lint/rules/missing-script.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAA+B,MAAM,4BAA4B,CAAC;AAMxF,eAAO,MAAM,iBAAiB,EAAE,QAgE/B,CAAC"}

package/dist/lint/rules/missing-stage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"missing-stage.d.ts","sourceRoot":"","sources":["../../../src/lint/rules/missing-stage.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAA+B,MAAM,4BAA4B,CAAC;AAGxF,eAAO,MAAM,gBAAgB,EAAE,QAmD9B,CAAC"}
+{"version":3,"file":"missing-stage.d.ts","sourceRoot":"","sources":["../../../src/lint/rules/missing-stage.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAA+B,MAAM,4BAA4B,CAAC;AAIxF,eAAO,MAAM,gBAAgB,EAAE,QA0D9B,CAAC"}

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "gitlab",
-  "version": "0.46.0",
+  "version": "0.50.0",
   "chantVersion": ">=0.1.0",
   "namespace": "GitLab",
   "intrinsics": [

package/dist/okf/index.md

@@ -53,3 +53,5 @@ okf_version: '0.2'
 * [WGL046](/rules/WGL046.md) - Cache populated in a merge-request pipeline (poisoning risk)
 * [WGL047](/rules/WGL047.md) - Software fetched and piped to a shell without verification
 * [WGL048](/rules/WGL048.md) - Pipeline defines workflow: but no workflow:name
+* [WGL049](/rules/WGL049.md) - Job installs dependencies with no cache: in scope
+* [WGL050](/rules/WGL050.md) - Merge-request-reachable job is not interruptible

package/dist/okf/rules/WGL049.md

@@ -0,0 +1,15 @@
+---
+type: post-synth-check
+title: WGL049
+description: 'Job installs dependencies with no cache: in scope'
+id: WGL049
+severity: error
+category: post-synth
+lexicon: gitlab
+docs: https://intentius.io/chant/lexicons/gitlab/rules/
+---
+Job installs dependencies with no cache: in scope
+
+## Applies to
+
+- [Job](/types/Job.md)

package/dist/okf/rules/WGL050.md

@@ -0,0 +1,15 @@
+---
+type: post-synth-check
+title: WGL050
+description: Merge-request-reachable job is not interruptible
+id: WGL050
+severity: error
+category: post-synth
+lexicon: gitlab
+docs: https://intentius.io/chant/lexicons/gitlab/rules/
+---
+Merge-request-reachable job is not interruptible
+
+## Applies to
+
+- [Job](/types/Job.md)

package/dist/okf/types/Job.md

@@ -84,3 +84,5 @@ resource_type: GitLab::CI::Job
 - [WGL045](/rules/WGL045.md): Artifact path that may capture a credential file
 - [WGL046](/rules/WGL046.md): Cache populated in a merge-request pipeline (poisoning risk)
 - [WGL047](/rules/WGL047.md): Software fetched and piped to a shell without verification
+- [WGL049](/rules/WGL049.md): Job installs dependencies with no cache: in scope
+- [WGL050](/rules/WGL050.md): Merge-request-reachable job is not interruptible

package/dist/op/builders.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Typed step-builder wrapper for this lexicon's `gitlabPipeline` activity
+ * (chant #1288 Stage 2 — "regenerate the step builders as fully typed
+ * wrappers"). Core cannot import a lexicon's `*Args` types (lexicons depend
+ * on core, not the other way around), so a fully typed `gitlabPipeline` has
+ * to live beside {@link GitlabPipelineArgs} — here, next to
+ * `./activities/gitlab.ts`. `opts`'s type below IS `GitlabPipelineArgs`
+ * itself (via `Omit`/`WithStepRefs`) — never a hand-restated mirror.
+ *
+ * `core`'s own `gitlabPipeline` (in `@intentius/chant/op`, re-exported from
+ * `@intentius/chant-lexicon-temporal`) is UNCHANGED and produces a
+ * byte-identical `ActivityStep` for the same inputs — purely additive, and
+ * deliberately not swapped into the temporal barrel (see
+ * `lexicons/k8s/src/op/builders.ts`'s module doc for why: that would make
+ * temporal depend on this package at runtime). An author who wants the typed
+ * surface imports it from here — `@intentius/chant-lexicon-gitlab`.
+ */
+import { type ActivityStep, type NamedActivityStep, type WithStepRefs } from "@intentius/chant/op";
+import type { GitlabPipelineArgs } from "./activities/gitlab.js";
+/**
+ * Trigger and wait for a GitLab CI pipeline to complete — the fully typed
+ * twin of core's `gitlabPipeline`. `opts` is {@link GitlabPipelineArgs}
+ * itself, minus the positional `name`. Defaults to the `longInfra` profile.
+ */
+export declare const gitlabPipeline: (name: string, opts?: WithStepRefs<Omit<GitlabPipelineArgs, "name">> & {
+    profile?: ActivityStep["profile"];
+    id?: string;
+}) => NamedActivityStep;
+//# sourceMappingURL=builders.d.ts.map

package/dist/op/builders.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"builders.d.ts","sourceRoot":"","sources":["../../src/op/builders.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAGL,KAAK,YAAY,EACjB,KAAK,iBAAiB,EACtB,KAAK,YAAY,EAClB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAE9D;;;;GAIG;AACH,eAAO,MAAM,cAAc,GACzB,MAAM,MAAM,EACZ,OAAO,YAAY,CAAC,IAAI,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAC,GAAG;IAAE,OAAO,CAAC,EAAE,YAAY,CAAC,SAAS,CAAC,CAAC;IAAC,EAAE,CAAC,EAAE,MAAM,CAAA;CAAE,KACzG,iBAGF,CAAC"}

package/dist/plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAiC,MAAM,0BAA0B,CAAC;AAmB7F,eAAO,MAAM,YAAY,EAAE,aA4gB1B,CAAC"}
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAiC,MAAM,0BAA0B,CAAC;AAoB7F,eAAO,MAAM,YAAY,EAAE,aA8gB1B,CAAC"}

package/dist/rules/import-source.ts

@@ -0,0 +1,58 @@
+/**
+ * Shared helper for gitlab lint rules that match a bare TypeScript
+ * identifier (`Job`, ...) and need to know whether it actually came from
+ * this lexicon before flagging it (chant #1544 — cross-lexicon rule bleed:
+ * `new Job(...)` matches ANY lexicon's `Job` class by name alone, so a
+ * multi-lexicon project got gitlab-only rules applied to github/forgejo
+ * jobs that were never missing anything).
+ */
+
+import * as ts from "typescript";
+
+/**
+ * The module specifier a top-level import bound `name` to, whether via a
+ * named import (`import { Job } from "..."`, matched on its local —
+ * possibly aliased — binding) or a namespace import (`import * as gl from
+ * "..."`, matched on the namespace's own name). Undefined when `name` isn't
+ * bound by any top-level import in this file (no import at all, a
+ * re-export chain, a dynamic `require`, …) — the caller should treat that
+ * as "can't tell", not "not gitlab", to stay conservative for the common
+ * single-lexicon-project case (and every pre-#1544 unit test fixture, which
+ * has no import statements at all).
+ */
+export function importSourceFor(sourceFile: ts.SourceFile, name: string): string | undefined {
+  for (const stmt of sourceFile.statements) {
+    if (!ts.isImportDeclaration(stmt)) continue;
+    const moduleSpecifier = stmt.moduleSpecifier;
+    if (!ts.isStringLiteral(moduleSpecifier)) continue;
+    const namedBindings = stmt.importClause?.namedBindings;
+    if (!namedBindings) continue;
+
+    if (ts.isNamespaceImport(namedBindings)) {
+      if (namedBindings.name.text === name) return moduleSpecifier.text;
+    } else if (ts.isNamedImports(namedBindings)) {
+      for (const element of namedBindings.elements) {
+        if (element.name.text === name) return moduleSpecifier.text;
+      }
+    }
+  }
+  return undefined;
+}
+
+/**
+ * True when `expression` (a `new`-expression callee) resolves — via a
+ * traced import — to a lexicon OTHER than gitlab. False for an unresolved
+ * import (conservative: still checked) or one that does resolve to gitlab.
+ */
+export function isJobFromAnotherLexicon(sourceFile: ts.SourceFile, expression: ts.LeftHandSideExpression): boolean {
+  let bindingName: string | undefined;
+  if (ts.isIdentifier(expression)) {
+    bindingName = expression.text;
+  } else if (ts.isPropertyAccessExpression(expression)) {
+    bindingName = ts.isIdentifier(expression.expression) ? expression.expression.text : undefined;
+  }
+  if (!bindingName) return false;
+
+  const source = importSourceFor(sourceFile, bindingName);
+  return source !== undefined && !source.includes("chant-lexicon-gitlab");
+}

package/dist/rules/missing-script.ts

@@ -7,6 +7,7 @@
 
 import type { LintRule, LintDiagnostic, LintContext } from "@intentius/chant/lint/rule";
 import * as ts from "typescript";
+import { isJobFromAnotherLexicon } from "./import-source";
 
 const VALID_EXECUTION_PROPS = new Set(["script", "trigger", "run"]);
 
@@ -31,6 +32,18 @@ export const missingScriptRule: LintRule = {
           isJob = true;
         }
 
+        // chant #1544 — cross-lexicon rule bleed: `new Job(...)` matches
+        // ANY lexicon's `Job` class by bare name alone (github's, forgejo's,
+        // ...), so a multi-lexicon project got WGL002 (gitlab-only) applied
+        // to github/forgejo jobs that were never missing anything — they
+        // just don't use `script`/`trigger`/`run`. Skip when the import
+        // resolves to a lexicon other than gitlab; an unresolved import
+        // (no `import` statement — most unit-test fixtures, a re-export) is
+        // "can't tell", so it keeps the previous, conservative behavior.
+        if (isJob && isJobFromAnotherLexicon(sourceFile, expression)) {
+          isJob = false;
+        }
+
         if (isJob && node.arguments && node.arguments.length > 0) {
           const props = node.arguments[0];
           if (ts.isObjectLiteralExpression(props)) {

package/dist/rules/missing-stage.ts

@@ -7,6 +7,7 @@
 
 import type { LintRule, LintDiagnostic, LintContext } from "@intentius/chant/lint/rule";
 import * as ts from "typescript";
+import { isJobFromAnotherLexicon } from "./import-source";
 
 export const missingStageRule: LintRule = {
   id: "WGL003",
@@ -28,6 +29,13 @@ export const missingStageRule: LintRule = {
           isJob = true;
         }
 
+        // chant #1544 — same cross-lexicon rule bleed as WGL002 (see
+        // missing-script.ts): a github/forgejo `Job` must not be judged
+        // against gitlab's `stage` convention.
+        if (isJob && isJobFromAnotherLexicon(sourceFile, expression)) {
+          isJob = false;
+        }
+
         if (isJob && node.arguments && node.arguments.length > 0) {
           const props = node.arguments[0];
           if (ts.isObjectLiteralExpression(props)) {

package/dist/rules/wgl019.ts

@@ -28,7 +28,12 @@ export const wgl019: PostSynthCheck = {
       const stage = props.stage as string | undefined;
       if (!stage || !DEPLOY_STAGES.has(stage.toLowerCase())) continue;
 
-      if (!props.retry) {
+      // chant #1544 — `!props.retry` treated an explicit `retry: 0` the same
+      // as no `retry` at all, warning on a job that stated its policy
+      // ("retrying a deploy without a human is deliberate") as if it hadn't.
+      // `retry: 0` is falsy but present — only an actually-absent key means
+      // "no retry strategy".
+      if (props.retry === undefined) {
         diagnostics.push({
           checkId: "WGL019",
           severity: "info",

package/dist/rules/wgl049.ts

@@ -0,0 +1,57 @@
+/**
+ * WGL049: Dependency Install Without a Cache
+ *
+ * Flags a job whose `script:` runs a package-manager install command (`npm
+ * ci`, `pip install`, `bundle install`, etc.) with no `cache:` in scope —
+ * neither on the job itself, nor at the pipeline's `default:`/top level.
+ * Every run re-fetches the same dependencies from a cold cache. A job that
+ * `extends:` another config is left alone — the cache may be inherited and
+ * this check has no way to confirm that. Efficiency (#444), not a
+ * correctness or security issue.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { getPrimaryOutput, extractJobs, extractJobSection } from "./yaml-helpers";
+
+const DEP_INSTALL_RE = /\b(npm (install|ci)|yarn install|pnpm install|pip install|pip3 install|bundle install|composer install|go mod download|mvn (install|dependency:resolve))\b/i;
+
+function hasPipelineWideCache(yaml: string): boolean {
+  const sections = yaml.split("\n\n");
+  if (sections.some((s) => /^cache:/.test(s))) return true;
+  const defaultSection = sections.find((s) => /^default:/.test(s));
+  return !!defaultSection && /\n\s+cache:/.test(defaultSection);
+}
+
+export const wgl049: PostSynthCheck = {
+  id: "WGL049",
+  description: "Job installs dependencies with no cache: in scope",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const [, output] of ctx.outputs) {
+      const yaml = getPrimaryOutput(output);
+      if (hasPipelineWideCache(yaml)) continue;
+
+      for (const [jobName, job] of extractJobs(yaml)) {
+        if (jobName.startsWith(".")) continue; // hidden/template job, not run directly
+        if (job.extends && job.extends.length > 0) continue; // cache may be inherited; can't confirm
+
+        const section = extractJobSection(yaml, jobName);
+        if (!section) continue;
+        if (/^\s+cache:/m.test(section)) continue; // job-level cache present
+        if (!DEP_INSTALL_RE.test(section)) continue;
+
+        diagnostics.push({
+          checkId: "WGL049",
+          severity: "info",
+          message: `Job "${jobName}" installs dependencies with no cache: in scope — every run re-fetches from the registry. Add a cache: covering the dependency directory.`,
+          entity: jobName,
+          lexicon: "gitlab",
+        });
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/dist/rules/wgl050.ts

@@ -0,0 +1,49 @@
+/**
+ * WGL050: Merge-Request Job Missing interruptible
+ *
+ * Flags a job reachable from merge-request pipelines that doesn't set
+ * `interruptible: true`. Without it, GitLab's auto-cancel-redundant-pipelines
+ * setting can't cancel the job when a new push supersedes it, so the runner
+ * keeps spending capacity on a pipeline nobody wants anymore. Deploy jobs are
+ * left alone — cancelling mid-deploy is its own hazard, not an efficiency
+ * win. Efficiency (#444), not a correctness or security issue.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { getPrimaryOutput, isMergeRequestReachable } from "./yaml-helpers";
+
+const RESERVED_TOP_LEVEL_KEYS = new Set(["stages", "default", "workflow", "variables", "include", "cache"]);
+
+export const wgl050: PostSynthCheck = {
+  id: "WGL050",
+  description: "Merge-request-reachable job is not interruptible",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const [, output] of ctx.outputs) {
+      const yaml = getPrimaryOutput(output);
+
+      for (const section of yaml.split("\n\n")) {
+        const top = section.split("\n")[0]?.match(/^(\.?[a-z][a-z0-9_.-]*):/i);
+        if (!top) continue;
+        const jobName = top[1];
+        if (jobName.startsWith(".") || RESERVED_TOP_LEVEL_KEYS.has(jobName)) continue;
+        if (/deploy/i.test(jobName)) continue; // cancelling mid-deploy is a hazard, not a win
+
+        if (!isMergeRequestReachable(section)) continue;
+        if (/^\s+interruptible:\s*true\s*$/m.test(section)) continue;
+
+        diagnostics.push({
+          checkId: "WGL050",
+          severity: "info",
+          message: `Job "${jobName}" runs on merge-request pipelines but is not interruptible: true — when a new commit supersedes this pipeline, this job keeps running instead of being cancelled. Add interruptible: true.`,
+          entity: jobName,
+          lexicon: "gitlab",
+        });
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-gitlab",
-  "version": "0.46.0",
+  "version": "0.50.0",
   "description": "GitLab CI lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -67,8 +67,8 @@
     "typescript": "^5.9.3"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.46.0",
-    "@intentius/chant-lexicon-github": "^0.46.0",
+    "@intentius/chant": "^0.50.0",
+    "@intentius/chant-lexicon-github": "^0.50.0",
     "typescript": "^5.9.3"
   },
   "peerDependenciesMeta": {