@intentius/chant-lexicon-gitlab 0.46.0 → 0.50.0

package/src/components/generate-op-pipeline.test.ts

@@ -0,0 +1,94 @@
+/**
+ * Tests for generate mode's scheduled Op → GitLab CI YAML synthesis (#927).
+ * Three things this must prove, mirroring `./generate-pipeline.test.ts`'s
+ * acceptance style:
+ *
+ *  1. Every scheduled Op lands as one job in a single generated file (GitLab
+ *     has no in-file cron — see the module doc), each job gated to its own
+ *     Pipeline Schedule via `rules:`.
+ *  2. The header comment names every Op's cron and finding-mode, since the
+ *     cron itself can't live in the YAML.
+ *  3. A cross-cutting generator change (runCommand/beforeScript/extraScript)
+ *     is a single edit reflected in every job's script.
+ */
+
+import { describe, test, expect } from "vitest";
+import { parseYAML } from "@intentius/chant/yaml";
+import { generateGitlabOpPipeline } from "./generate-op-pipeline";
+import type { ScheduledOpSpec } from "@intentius/chant/lexicon";
+
+describe("generateGitlabOpPipeline: one file, one job per scheduled Op", () => {
+  test("produces a single file with stages: and one job per Op", () => {
+    const specs: ScheduledOpSpec[] = [
+      { name: "actions-audit", schedule: "0 6 * * *" },
+      { name: "prod-reconcile", schedule: "0 * * * *", findingMode: "merge-request" },
+    ];
+    const result = generateGitlabOpPipeline(specs);
+
+    expect(result.files).toHaveLength(1);
+    expect(result.files[0].name).toBe("scheduled-ops.gitlab-ci.yml");
+
+    const parsed = parseYAML(result.files[0].yaml);
+    expect(parsed.stages).toEqual(["scheduled-ops"]);
+    expect(parsed["actions-audit"]).toBeDefined();
+    expect(parsed["prod-reconcile"]).toBeDefined();
+  });
+
+  test("each job is gated to its own Pipeline Schedule via rules:, runs chant run <name>", () => {
+    const result = generateGitlabOpPipeline([{ name: "actions-audit", schedule: "0 6 * * *" }]);
+    const parsed = parseYAML(result.files[0].yaml);
+    const job = parsed["actions-audit"] as Record<string, unknown>;
+
+    expect(job.stage).toBe("scheduled-ops");
+    expect(job.rules).toEqual([
+      { if: '$CI_PIPELINE_SOURCE == "schedule" && $CHANT_SCHEDULED_OP == "actions-audit"' },
+    ]);
+    expect(job.script).toEqual(["chant run actions-audit"]);
+  });
+
+  test("the header comment names every Op's cron, selector value, and finding-mode", () => {
+    const result = generateGitlabOpPipeline([
+      { name: "actions-audit", schedule: "0 6 * * *", findingMode: "issue" },
+    ]);
+    expect(result.files[0].yaml).toContain('cron "0 6 * * *"');
+    expect(result.files[0].yaml).toContain('CHANT_SCHEDULED_OP="actions-audit"');
+    expect(result.files[0].yaml).toContain("finding-mode issue");
+    expect(result.files[0].yaml).toContain("GITLAB_TOKEN");
+  });
+
+  test("report mode's header line carries no token requirement", () => {
+    const result = generateGitlabOpPipeline([{ name: "actions-audit", schedule: "0 6 * * *" }]);
+    expect(result.files[0].yaml).not.toContain("GITLAB_TOKEN");
+  });
+
+  test("an empty Op set still produces the (empty) stages file", () => {
+    const result = generateGitlabOpPipeline([]);
+    expect(result.files).toHaveLength(1);
+    expect(result.jobs).toEqual([]);
+    const parsed = parseYAML(result.files[0].yaml);
+    expect(parsed.stages).toEqual(["scheduled-ops"]);
+  });
+});
+
+describe("generateGitlabOpPipeline: a cross-cutting change is one generator edit, not per-job", () => {
+  test("runCommand/beforeScript/extraScript apply uniformly across every job", () => {
+    const specs: ScheduledOpSpec[] = [
+      { name: "actions-audit", schedule: "0 6 * * *" },
+      { name: "prod-reconcile", schedule: "0 * * * *" },
+    ];
+    const result = generateGitlabOpPipeline(specs, {
+      runCommand: ["chant", "run", "{name}", "--temporal"],
+      beforeScript: ["npm ci"],
+      extraScript: ["echo done"],
+    });
+    const parsed = parseYAML(result.files[0].yaml);
+
+    for (const spec of specs) {
+      const job = parsed[spec.name] as Record<string, unknown>;
+      const script = job.script as string[];
+      expect(script[0]).toBe("npm ci");
+      expect(script[1]).toContain("--temporal");
+      expect(script[2]).toBe("echo done");
+    }
+  });
+});

package/src/components/generate-op-pipeline.ts

@@ -0,0 +1,111 @@
+/**
+ * Generate mode — scheduled Op → GitLab CI YAML (#927).
+ *
+ * The Op counterpart to `./generate-pipeline.ts` (#563): that module
+ * synthesizes a deploy-time component graph as one `.gitlab-ci.yml`; this one
+ * synthesizes a cron-triggered job per stateless Op — the CI-native
+ * alternative to a Temporal `TemporalSchedule` for downstream projects that
+ * don't run Temporal (`WorkflowAuditOp`/`PipelineAuditOp`/`ReconcileOp` all
+ * accept an optional `schedule` precisely for this).
+ *
+ * Unlike GitHub Actions' per-workflow `on.schedule`, GitLab has no in-file
+ * cron at all — a schedule is a project-level object (Settings → CI/CD →
+ * Schedules) that runs the project's *existing* `.gitlab-ci.yml` with a
+ * chosen cron and CI/CD variables. So every scheduled Op here becomes one
+ * job in a single generated file, gated to run only under its own Pipeline
+ * Schedule (`$CI_PIPELINE_SOURCE == "schedule"` plus a per-op selector
+ * variable) — the cron itself is configured on the Pipeline Schedule, not in
+ * this YAML, and the generated file's header comment states what to set up.
+ * Each job runs exactly one invocation, `chant run <name>` by default — never
+ * inlined audit/reconcile logic. The finding-mode itself is already baked
+ * into the Op's own activity args at build time by the composite that
+ * created it; GitLab has no per-job `permissions:` concept (unlike GitHub
+ * Actions), so a non-`report` mode's write access comes from whatever
+ * `GITLAB_TOKEN`/CI-CD-variable configuration the project already has —
+ * this generator documents the requirement rather than fabricating a
+ * variable nothing reads.
+ */
+
+import { emitYAML } from "@intentius/chant/yaml";
+import type {
+  ComponentPipelineOptions as GenerateGitlabOpOptions,
+  OpFindingMode,
+  OpPipelineJob,
+  OpPipelineResult as GenerateGitlabOpResult,
+  ScheduledOpSpec,
+} from "@intentius/chant/lexicon";
+
+export type { GenerateGitlabOpOptions, GenerateGitlabOpResult };
+
+/** GitLab CI job names must be safe YAML keys; Op names are already kebab-case in every fixture, but normalize defensively (mirrors `./generate-pipeline.ts`'s `toJobName`). */
+function toJobName(opName: string): string {
+  return opName.replace(/([a-z0-9])([A-Z])/g, "$1-$2").toLowerCase();
+}
+
+const DEFAULT_IMAGE = "node:22-slim";
+const STAGE = "scheduled-ops";
+
+/** The CI/CD variable a Pipeline Schedule sets to select which job it runs. */
+const SELECTOR_VAR = "CHANT_SCHEDULED_OP";
+
+/** One setup line per Op in the generated file's header comment. */
+function setupLine(spec: ScheduledOpSpec, jobName: string, mode: OpFindingMode): string {
+  const tokenNote = mode === "report" ? "" : " — needs a GITLAB_TOKEN CI/CD variable (masked, scope: api)";
+  return `#   ${jobName}: cron "${spec.schedule}", ${SELECTOR_VAR}="${spec.name}", finding-mode ${mode}${tokenNote}`;
+}
+
+/**
+ * Synthesize one `.gitlab-ci.yml` job per scheduled Op, all in a single file
+ * (GitLab has no per-file cron — see the module doc). Wired into core's Op
+ * generate mode via the gitlab lexicon plugin's `generateOpPipeline`
+ * (../plugin.ts).
+ */
+export function generateGitlabOpPipeline(
+  ops: ScheduledOpSpec[],
+  options: GenerateGitlabOpOptions = {},
+): GenerateGitlabOpResult {
+  const image = options.image ?? DEFAULT_IMAGE;
+  const runCommand = options.runCommand ?? ["chant", "run", "{name}"];
+  const beforeScript = options.beforeScript ?? [];
+  const extraScript = options.extraScript ?? [];
+
+  const jobs: OpPipelineJob[] = [];
+  const doc: Record<string, unknown> = { stages: [STAGE] };
+  if (options.variables && Object.keys(options.variables).length > 0) doc.variables = options.variables;
+
+  const headerLines = [
+    "# Scheduled Ops (chant #927) — GitLab has no in-file cron. Create one",
+    "# Pipeline Schedule per Op below (Settings > CI/CD > Schedules): set its",
+    `# cron to the value noted here and its ${SELECTOR_VAR} CI/CD variable to`,
+    "# the Op's name, so only that job runs on that schedule.",
+    "#",
+  ];
+
+  for (const spec of ops) {
+    const findingMode = spec.findingMode ?? "report";
+    const jobName = toJobName(spec.name);
+    jobs.push({ jobName, op: spec.name, schedule: spec.schedule, findingMode });
+    headerLines.push(setupLine(spec, jobName, findingMode));
+
+    const runParts = runCommand.map((part) => part.replace("{name}", spec.name));
+    const script = [...beforeScript, runParts.join(" "), ...extraScript];
+
+    doc[jobName] = {
+      stage: STAGE,
+      image,
+      rules: [{ if: `$CI_PIPELINE_SOURCE == "schedule" && $${SELECTOR_VAR} == "${spec.name}"` }],
+      script,
+    };
+  }
+
+  const sections: string[] = [];
+  sections.push("stages:" + emitYAML(doc.stages, 1));
+  if (doc.variables) sections.push("variables:" + emitYAML(doc.variables, 1));
+  for (const { jobName } of jobs) {
+    sections.push(`${jobName}:` + emitYAML(doc[jobName], 1));
+  }
+
+  const yaml = headerLines.join("\n") + "\n\n" + sections.join("\n\n") + "\n";
+
+  return { files: [{ name: "scheduled-ops.gitlab-ci.yml", yaml }], jobs };
+}

package/src/index.ts

@@ -4,6 +4,14 @@ export { gitlabSerializer } from "./serializer";
 // Plugin
 export { gitlabPlugin } from "./plugin";
 
+// Typed Op step-builder wrapper (chant #1288 Stage 2) — gitlabPipeline with
+// authoring-time types derived from this lexicon's own GitlabPipelineArgs
+// (see lexicons/k8s/src/op/builders.ts's module doc for why this lives here
+// rather than in core or the temporal barrel). Opt-in:
+// `@intentius/chant-lexicon-temporal`'s same-named export is core's original
+// untyped builder, unchanged, for cloud-agnostic authoring.
+export { gitlabPipeline } from "./op/builders";
+
 // Intrinsics
 export { reference, ReferenceIntrinsic } from "./intrinsics";
 

package/src/lint/audit-catalog.ts

@@ -44,4 +44,9 @@ export const gitlabAuditCatalog: Record<string, RuleMeta> = {
   WGL046: auditRule("WGL046", "merge-worthy", "guidance", "Cache populated in a merge-request pipeline", "Don't populate caches from merge-request pipelines (poisoning risk).", { authority: [GH_PWN] }),
   WGL047: auditRule("WGL047", "merge-worthy", "guidance", "Software piped to a shell without verification", "Verify a checksum/signature before executing fetched scripts.", { authority: [SCORECARD_PINNED] }),
   WGL048: auditRule("WGL048", "report-only", "guidance", "Pipeline without workflow:name", "Add a `workflow:name` for clearer pipeline naming.", { category: "best-practice" }),
+
+  // Efficiency (#444) — waste, not a safety/correctness issue. Always
+  // report-only: none of these warrant a merge on their own.
+  WGL049: auditRule("WGL049", "report-only", "guidance", "Dependency install without a cache", "Add a `cache:` covering the dependency directory.", { category: "efficiency" }),
+  WGL050: auditRule("WGL050", "report-only", "guidance", "Merge-request job missing interruptible", "Add `interruptible: true` so a superseded pipeline can be cancelled.", { category: "efficiency" }),
 };

package/src/lint/post-synth/index.ts

@@ -39,6 +39,8 @@ import { wgl045 } from "./wgl045";
 import { wgl046 } from "./wgl046";
 import { wgl047 } from "./wgl047";
 import { wgl048 } from "./wgl048";
+import { wgl049 } from "./wgl049";
+import { wgl050 } from "./wgl050";
 
 export const postSynthChecks: PostSynthCheck[] = [
   wgl010,
@@ -80,4 +82,6 @@ export const postSynthChecks: PostSynthCheck[] = [
   wgl046,
   wgl047,
   wgl048,
+  wgl049,
+  wgl050,
 ];

package/src/lint/post-synth/wgl019.test.ts

@@ -53,6 +53,14 @@ describe("WGL019: Missing Retry on Deploy Jobs", () => {
     expect(diags).toHaveLength(0);
   });
 
+  test("does not flag deploy job with explicit retry: 0 (#1544)", () => {
+    const entities = new Map<string, Declarable>([
+      ["deployApp", new MockJob({ script: ["deploy.sh"], stage: "deploy", retry: 0 })],
+    ]);
+    const diags = wgl019.check(makeCtx(entities));
+    expect(diags).toHaveLength(0);
+  });
+
   test("does not flag non-deploy job without retry", () => {
     const entities = new Map<string, Declarable>([
       ["testJob", new MockJob({ script: ["npm test"], stage: "test" })],

package/src/lint/post-synth/wgl019.ts

@@ -28,7 +28,12 @@ export const wgl019: PostSynthCheck = {
       const stage = props.stage as string | undefined;
       if (!stage || !DEPLOY_STAGES.has(stage.toLowerCase())) continue;
 
-      if (!props.retry) {
+      // chant #1544 — `!props.retry` treated an explicit `retry: 0` the same
+      // as no `retry` at all, warning on a job that stated its policy
+      // ("retrying a deploy without a human is deliberate") as if it hadn't.
+      // `retry: 0` is falsy but present — only an actually-absent key means
+      // "no retry strategy".
+      if (props.retry === undefined) {
         diagnostics.push({
           checkId: "WGL019",
           severity: "info",

package/src/lint/post-synth/wgl049.test.ts

@@ -0,0 +1,71 @@
+import { describe, test, expect } from "vitest";
+import type { PostSynthContext } from "@intentius/chant/lint/post-synth";
+import { wgl049 } from "./wgl049";
+
+function makeCtx(yaml: string): PostSynthContext {
+  return {
+    outputs: new Map([["gitlab", yaml]]),
+    entities: new Map(),
+    buildResult: { outputs: new Map([["gitlab", yaml]]), entities: new Map(), warnings: [], errors: [], sourceFileCount: 1 },
+  };
+}
+
+describe("WGL049: dependency install without a cache", () => {
+  test("flags a job that installs deps with no cache in scope", () => {
+    const yaml = `build:
+  stage: build
+  script:
+    - npm ci
+    - npm run build
+`;
+    const diags = wgl049.check(makeCtx(yaml));
+    expect(diags).toHaveLength(1);
+    expect(diags[0].checkId).toBe("WGL049");
+    expect(diags[0].entity).toBe("build");
+  });
+
+  test("does not flag when the job has its own cache", () => {
+    const yaml = `build:
+  stage: build
+  cache:
+    key: npm-cache
+    paths:
+      - node_modules/
+  script:
+    - npm ci
+`;
+    expect(wgl049.check(makeCtx(yaml))).toHaveLength(0);
+  });
+
+  test("does not flag when a pipeline-wide cache: block exists", () => {
+    const yaml = `cache:
+  key: global
+  paths:
+    - node_modules/
+
+build:
+  stage: build
+  script:
+    - npm ci
+`;
+    expect(wgl049.check(makeCtx(yaml))).toHaveLength(0);
+  });
+
+  test("does not flag a job that extends another config", () => {
+    const yaml = `build:
+  extends: .node-job
+  script:
+    - npm ci
+`;
+    expect(wgl049.check(makeCtx(yaml))).toHaveLength(0);
+  });
+
+  test("does not flag a job with no dependency install command", () => {
+    const yaml = `lint:
+  stage: test
+  script:
+    - eslint .
+`;
+    expect(wgl049.check(makeCtx(yaml))).toHaveLength(0);
+  });
+});

package/src/lint/post-synth/wgl049.ts

@@ -0,0 +1,57 @@
+/**
+ * WGL049: Dependency Install Without a Cache
+ *
+ * Flags a job whose `script:` runs a package-manager install command (`npm
+ * ci`, `pip install`, `bundle install`, etc.) with no `cache:` in scope —
+ * neither on the job itself, nor at the pipeline's `default:`/top level.
+ * Every run re-fetches the same dependencies from a cold cache. A job that
+ * `extends:` another config is left alone — the cache may be inherited and
+ * this check has no way to confirm that. Efficiency (#444), not a
+ * correctness or security issue.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { getPrimaryOutput, extractJobs, extractJobSection } from "./yaml-helpers";
+
+const DEP_INSTALL_RE = /\b(npm (install|ci)|yarn install|pnpm install|pip install|pip3 install|bundle install|composer install|go mod download|mvn (install|dependency:resolve))\b/i;
+
+function hasPipelineWideCache(yaml: string): boolean {
+  const sections = yaml.split("\n\n");
+  if (sections.some((s) => /^cache:/.test(s))) return true;
+  const defaultSection = sections.find((s) => /^default:/.test(s));
+  return !!defaultSection && /\n\s+cache:/.test(defaultSection);
+}
+
+export const wgl049: PostSynthCheck = {
+  id: "WGL049",
+  description: "Job installs dependencies with no cache: in scope",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const [, output] of ctx.outputs) {
+      const yaml = getPrimaryOutput(output);
+      if (hasPipelineWideCache(yaml)) continue;
+
+      for (const [jobName, job] of extractJobs(yaml)) {
+        if (jobName.startsWith(".")) continue; // hidden/template job, not run directly
+        if (job.extends && job.extends.length > 0) continue; // cache may be inherited; can't confirm
+
+        const section = extractJobSection(yaml, jobName);
+        if (!section) continue;
+        if (/^\s+cache:/m.test(section)) continue; // job-level cache present
+        if (!DEP_INSTALL_RE.test(section)) continue;
+
+        diagnostics.push({
+          checkId: "WGL049",
+          severity: "info",
+          message: `Job "${jobName}" installs dependencies with no cache: in scope — every run re-fetches from the registry. Add a cache: covering the dependency directory.`,
+          entity: jobName,
+          lexicon: "gitlab",
+        });
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/src/lint/post-synth/wgl050.test.ts

@@ -0,0 +1,57 @@
+import { describe, test, expect } from "vitest";
+import type { PostSynthContext } from "@intentius/chant/lint/post-synth";
+import { wgl050 } from "./wgl050";
+
+function makeCtx(yaml: string): PostSynthContext {
+  return {
+    outputs: new Map([["gitlab", yaml]]),
+    entities: new Map(),
+    buildResult: { outputs: new Map([["gitlab", yaml]]), entities: new Map(), warnings: [], errors: [], sourceFileCount: 1 },
+  };
+}
+
+describe("WGL050: merge-request job missing interruptible", () => {
+  test("flags a merge-request-reachable job with no interruptible: true", () => {
+    const yaml = `test:
+  rules:
+    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
+  script:
+    - npm test
+`;
+    const diags = wgl050.check(makeCtx(yaml));
+    expect(diags).toHaveLength(1);
+    expect(diags[0].checkId).toBe("WGL050");
+    expect(diags[0].entity).toBe("test");
+  });
+
+  test("does not flag when interruptible: true is set", () => {
+    const yaml = `test:
+  rules:
+    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
+  interruptible: true
+  script:
+    - npm test
+`;
+    expect(wgl050.check(makeCtx(yaml))).toHaveLength(0);
+  });
+
+  test("does not flag a deploy job", () => {
+    const yaml = `deploy-app:
+  rules:
+    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
+  script:
+    - ./deploy.sh
+`;
+    expect(wgl050.check(makeCtx(yaml))).toHaveLength(0);
+  });
+
+  test("does not flag a job not reachable from merge requests", () => {
+    const yaml = `test:
+  rules:
+    - if: $CI_COMMIT_BRANCH == "main"
+  script:
+    - npm test
+`;
+    expect(wgl050.check(makeCtx(yaml))).toHaveLength(0);
+  });
+});

package/src/lint/post-synth/wgl050.ts

@@ -0,0 +1,49 @@
+/**
+ * WGL050: Merge-Request Job Missing interruptible
+ *
+ * Flags a job reachable from merge-request pipelines that doesn't set
+ * `interruptible: true`. Without it, GitLab's auto-cancel-redundant-pipelines
+ * setting can't cancel the job when a new push supersedes it, so the runner
+ * keeps spending capacity on a pipeline nobody wants anymore. Deploy jobs are
+ * left alone — cancelling mid-deploy is its own hazard, not an efficiency
+ * win. Efficiency (#444), not a correctness or security issue.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { getPrimaryOutput, isMergeRequestReachable } from "./yaml-helpers";
+
+const RESERVED_TOP_LEVEL_KEYS = new Set(["stages", "default", "workflow", "variables", "include", "cache"]);
+
+export const wgl050: PostSynthCheck = {
+  id: "WGL050",
+  description: "Merge-request-reachable job is not interruptible",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const [, output] of ctx.outputs) {
+      const yaml = getPrimaryOutput(output);
+
+      for (const section of yaml.split("\n\n")) {
+        const top = section.split("\n")[0]?.match(/^(\.?[a-z][a-z0-9_.-]*):/i);
+        if (!top) continue;
+        const jobName = top[1];
+        if (jobName.startsWith(".") || RESERVED_TOP_LEVEL_KEYS.has(jobName)) continue;
+        if (/deploy/i.test(jobName)) continue; // cancelling mid-deploy is a hazard, not a win
+
+        if (!isMergeRequestReachable(section)) continue;
+        if (/^\s+interruptible:\s*true\s*$/m.test(section)) continue;
+
+        diagnostics.push({
+          checkId: "WGL050",
+          severity: "info",
+          message: `Job "${jobName}" runs on merge-request pipelines but is not interruptible: true — when a new commit supersedes this pipeline, this job keeps running instead of being cancelled. Add interruptible: true.`,
+          entity: jobName,
+          lexicon: "gitlab",
+        });
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/src/lint/rules/import-source.ts

@@ -0,0 +1,58 @@
+/**
+ * Shared helper for gitlab lint rules that match a bare TypeScript
+ * identifier (`Job`, ...) and need to know whether it actually came from
+ * this lexicon before flagging it (chant #1544 — cross-lexicon rule bleed:
+ * `new Job(...)` matches ANY lexicon's `Job` class by name alone, so a
+ * multi-lexicon project got gitlab-only rules applied to github/forgejo
+ * jobs that were never missing anything).
+ */
+
+import * as ts from "typescript";
+
+/**
+ * The module specifier a top-level import bound `name` to, whether via a
+ * named import (`import { Job } from "..."`, matched on its local —
+ * possibly aliased — binding) or a namespace import (`import * as gl from
+ * "..."`, matched on the namespace's own name). Undefined when `name` isn't
+ * bound by any top-level import in this file (no import at all, a
+ * re-export chain, a dynamic `require`, …) — the caller should treat that
+ * as "can't tell", not "not gitlab", to stay conservative for the common
+ * single-lexicon-project case (and every pre-#1544 unit test fixture, which
+ * has no import statements at all).
+ */
+export function importSourceFor(sourceFile: ts.SourceFile, name: string): string | undefined {
+  for (const stmt of sourceFile.statements) {
+    if (!ts.isImportDeclaration(stmt)) continue;
+    const moduleSpecifier = stmt.moduleSpecifier;
+    if (!ts.isStringLiteral(moduleSpecifier)) continue;
+    const namedBindings = stmt.importClause?.namedBindings;
+    if (!namedBindings) continue;
+
+    if (ts.isNamespaceImport(namedBindings)) {
+      if (namedBindings.name.text === name) return moduleSpecifier.text;
+    } else if (ts.isNamedImports(namedBindings)) {
+      for (const element of namedBindings.elements) {
+        if (element.name.text === name) return moduleSpecifier.text;
+      }
+    }
+  }
+  return undefined;
+}
+
+/**
+ * True when `expression` (a `new`-expression callee) resolves — via a
+ * traced import — to a lexicon OTHER than gitlab. False for an unresolved
+ * import (conservative: still checked) or one that does resolve to gitlab.
+ */
+export function isJobFromAnotherLexicon(sourceFile: ts.SourceFile, expression: ts.LeftHandSideExpression): boolean {
+  let bindingName: string | undefined;
+  if (ts.isIdentifier(expression)) {
+    bindingName = expression.text;
+  } else if (ts.isPropertyAccessExpression(expression)) {
+    bindingName = ts.isIdentifier(expression.expression) ? expression.expression.text : undefined;
+  }
+  if (!bindingName) return false;
+
+  const source = importSourceFor(sourceFile, bindingName);
+  return source !== undefined && !source.includes("chant-lexicon-gitlab");
+}

package/src/lint/rules/missing-script.ts

@@ -7,6 +7,7 @@
 
 import type { LintRule, LintDiagnostic, LintContext } from "@intentius/chant/lint/rule";
 import * as ts from "typescript";
+import { isJobFromAnotherLexicon } from "./import-source";
 
 const VALID_EXECUTION_PROPS = new Set(["script", "trigger", "run"]);
 
@@ -31,6 +32,18 @@ export const missingScriptRule: LintRule = {
           isJob = true;
         }
 
+        // chant #1544 — cross-lexicon rule bleed: `new Job(...)` matches
+        // ANY lexicon's `Job` class by bare name alone (github's, forgejo's,
+        // ...), so a multi-lexicon project got WGL002 (gitlab-only) applied
+        // to github/forgejo jobs that were never missing anything — they
+        // just don't use `script`/`trigger`/`run`. Skip when the import
+        // resolves to a lexicon other than gitlab; an unresolved import
+        // (no `import` statement — most unit-test fixtures, a re-export) is
+        // "can't tell", so it keeps the previous, conservative behavior.
+        if (isJob && isJobFromAnotherLexicon(sourceFile, expression)) {
+          isJob = false;
+        }
+
         if (isJob && node.arguments && node.arguments.length > 0) {
           const props = node.arguments[0];
           if (ts.isObjectLiteralExpression(props)) {

package/src/lint/rules/missing-stage.ts

@@ -7,6 +7,7 @@
 
 import type { LintRule, LintDiagnostic, LintContext } from "@intentius/chant/lint/rule";
 import * as ts from "typescript";
+import { isJobFromAnotherLexicon } from "./import-source";
 
 export const missingStageRule: LintRule = {
   id: "WGL003",
@@ -28,6 +29,13 @@ export const missingStageRule: LintRule = {
           isJob = true;
         }
 
+        // chant #1544 — same cross-lexicon rule bleed as WGL002 (see
+        // missing-script.ts): a github/forgejo `Job` must not be judged
+        // against gitlab's `stage` convention.
+        if (isJob && isJobFromAnotherLexicon(sourceFile, expression)) {
+          isJob = false;
+        }
+
         if (isJob && node.arguments && node.arguments.length > 0) {
           const props = node.arguments[0];
           if (ts.isObjectLiteralExpression(props)) {