@intentius/chant-lexicon-gitlab 0.49.0 → 0.50.0

package/dist/components/generate-op-pipeline.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Generate mode — scheduled Op → GitLab CI YAML (#927).
+ *
+ * The Op counterpart to `./generate-pipeline.ts` (#563): that module
+ * synthesizes a deploy-time component graph as one `.gitlab-ci.yml`; this one
+ * synthesizes a cron-triggered job per stateless Op — the CI-native
+ * alternative to a Temporal `TemporalSchedule` for downstream projects that
+ * don't run Temporal (`WorkflowAuditOp`/`PipelineAuditOp`/`ReconcileOp` all
+ * accept an optional `schedule` precisely for this).
+ *
+ * Unlike GitHub Actions' per-workflow `on.schedule`, GitLab has no in-file
+ * cron at all — a schedule is a project-level object (Settings → CI/CD →
+ * Schedules) that runs the project's *existing* `.gitlab-ci.yml` with a
+ * chosen cron and CI/CD variables. So every scheduled Op here becomes one
+ * job in a single generated file, gated to run only under its own Pipeline
+ * Schedule (`$CI_PIPELINE_SOURCE == "schedule"` plus a per-op selector
+ * variable) — the cron itself is configured on the Pipeline Schedule, not in
+ * this YAML, and the generated file's header comment states what to set up.
+ * Each job runs exactly one invocation, `chant run <name>` by default — never
+ * inlined audit/reconcile logic. The finding-mode itself is already baked
+ * into the Op's own activity args at build time by the composite that
+ * created it; GitLab has no per-job `permissions:` concept (unlike GitHub
+ * Actions), so a non-`report` mode's write access comes from whatever
+ * `GITLAB_TOKEN`/CI-CD-variable configuration the project already has —
+ * this generator documents the requirement rather than fabricating a
+ * variable nothing reads.
+ */
+import type { ComponentPipelineOptions as GenerateGitlabOpOptions, OpPipelineResult as GenerateGitlabOpResult, ScheduledOpSpec } from "@intentius/chant/lexicon";
+export type { GenerateGitlabOpOptions, GenerateGitlabOpResult };
+/**
+ * Synthesize one `.gitlab-ci.yml` job per scheduled Op, all in a single file
+ * (GitLab has no per-file cron — see the module doc). Wired into core's Op
+ * generate mode via the gitlab lexicon plugin's `generateOpPipeline`
+ * (../plugin.ts).
+ */
+export declare function generateGitlabOpPipeline(ops: ScheduledOpSpec[], options?: GenerateGitlabOpOptions): GenerateGitlabOpResult;
+//# sourceMappingURL=generate-op-pipeline.d.ts.map

package/dist/components/generate-op-pipeline.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"generate-op-pipeline.d.ts","sourceRoot":"","sources":["../../src/components/generate-op-pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAGH,OAAO,KAAK,EACV,wBAAwB,IAAI,uBAAuB,EAGnD,gBAAgB,IAAI,sBAAsB,EAC1C,eAAe,EAChB,MAAM,0BAA0B,CAAC;AAElC,YAAY,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,CAAC;AAmBhE;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,eAAe,EAAE,EACtB,OAAO,GAAE,uBAA4B,GACpC,sBAAsB,CA6CxB"}

package/dist/index.d.ts

@@ -1,5 +1,6 @@
 export { gitlabSerializer } from "./serializer.js";
 export { gitlabPlugin } from "./plugin.js";
+export { gitlabPipeline } from "./op/builders.js";
 export { reference, ReferenceIntrinsic } from "./intrinsics.js";
 export { CI } from "./variables.js";
 export * from "./generated/index.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAGhD,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAGxC,OAAO,EAAE,SAAS,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAG7D,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAIjC,cAAc,mBAAmB,CAAC;AAGlC,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,cAAc,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACnI,YAAY,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAGtI,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AACrF,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpF,YAAY,EAAE,iBAAiB,EAAE,cAAc,EAAE,cAAc,EAAE,kBAAkB,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAGzH,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAGhD,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAQxC,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAG/C,OAAO,EAAE,SAAS,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAG7D,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAIjC,cAAc,mBAAmB,CAAC;AAGlC,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,cAAc,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACnI,YAAY,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAGtI,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AACrF,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpF,YAAY,EAAE,iBAAiB,EAAE,cAAc,EAAE,cAAc,EAAE,kBAAkB,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAGzH,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC"}

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "6e5bfe31912b7af3fa1bd5241c2a22ae87b5e95afbe871d0736fd8d96cd3cd69",
+    "manifest.json": "b1cc9643fe6dbb20872dbccf6f0ac296fd7b2ab57a3d92b8a45915b1eeaf7743",
     "meta.json": "931fc3246a55645b1493080bbeb160e5d205e42349e8bdca96ca243adb5f0da3",
     "types/index.d.ts": "5cd2e99f135a929b72bdd822d00d780d39b1cd407ba0cfb3d511c7ac9d667b58",
     "rules/artifact-no-expiry.ts": "3f3cabf9792cbf8207e53a25f506715466b19ec25e9c3b4d0d77fed6b2eb4542",
@@ -48,10 +48,12 @@
     "rules/wgl046.ts": "bbd8f5075aa390db546f5e787ce542f31a9d5eb031578780480e770cd86f9b5b",
     "rules/wgl047.ts": "e6dba6a0c6c042e90a200859e52a0da28c56ce52705e147760eca0a0a37c3255",
     "rules/wgl048.ts": "810590da4e7eaf70a6332ae247dbd34e000e2af57c89d3bd5a19bb2a923fcbb1",
+    "rules/wgl049.ts": "875ba2203d66a2a444edf17b43c2ae438a3a23a7f579b81a448efc3d5dd4336e",
+    "rules/wgl050.ts": "c96ef683ecf6e55699ea62d669ba6359616d723dd1bc24880823da0ff6c86503",
     "rules/yaml-helpers.ts": "5835982d5d088eb4788ebad8160b181bfdb6fc94d546eabee90a4c278a913988",
     "skills/chant-gitlab.md": "1e26a0c50ea891423479bd7fec3bc133f9185727c4a3eaadd525d7e7436056b6",
     "skills/chant-gitlab-migrate.md": "4853d04980560b379e5b0f7267dcb0a1e5d5879cb9e9931681ce76b2a5fe69d8",
     "skills/chant-gitlab-patterns.md": "6d9a44e9e8de4c3820be9d65381b0d2ede4cb3626aaaf0011e21838a9fbf556e"
   },
-  "composite": "9f91a75e02d3e027b840d19762da56a8155b6c95227917df289e27fe46d48f8b"
+  "composite": "ea16ce1e577f7c99329bab5b18295456acec8809608d0fb006f6715479863b74"
 }

package/dist/lint/audit-catalog.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit-catalog.d.ts","sourceRoot":"","sources":["../../src/lint/audit-catalog.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAA0E,KAAK,QAAQ,EAAE,MAAM,gCAAgC,CAAC;AAEvI,eAAO,MAAM,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAwCvD,CAAC"}
+{"version":3,"file":"audit-catalog.d.ts","sourceRoot":"","sources":["../../src/lint/audit-catalog.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAA0E,KAAK,QAAQ,EAAE,MAAM,gCAAgC,CAAC;AAEvI,eAAO,MAAM,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CA6CvD,CAAC"}

package/dist/lint/post-synth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAyCvE,eAAO,MAAM,eAAe,EAAE,cAAc,EAwC3C,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AA2CvE,eAAO,MAAM,eAAe,EAAE,cAAc,EA0C3C,CAAC"}

package/dist/lint/post-synth/wgl049.d.ts

@@ -0,0 +1,14 @@
+/**
+ * WGL049: Dependency Install Without a Cache
+ *
+ * Flags a job whose `script:` runs a package-manager install command (`npm
+ * ci`, `pip install`, `bundle install`, etc.) with no `cache:` in scope —
+ * neither on the job itself, nor at the pipeline's `default:`/top level.
+ * Every run re-fetches the same dependencies from a cold cache. A job that
+ * `extends:` another config is left alone — the cache may be inherited and
+ * this check has no way to confirm that. Efficiency (#444), not a
+ * correctness or security issue.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const wgl049: PostSynthCheck;
+//# sourceMappingURL=wgl049.d.ts.map

package/dist/lint/post-synth/wgl049.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wgl049.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/wgl049.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAY9G,eAAO,MAAM,MAAM,EAAE,cAgCpB,CAAC"}

package/dist/lint/post-synth/wgl050.d.ts

@@ -0,0 +1,13 @@
+/**
+ * WGL050: Merge-Request Job Missing interruptible
+ *
+ * Flags a job reachable from merge-request pipelines that doesn't set
+ * `interruptible: true`. Without it, GitLab's auto-cancel-redundant-pipelines
+ * setting can't cancel the job when a new push supersedes it, so the runner
+ * keeps spending capacity on a pipeline nobody wants anymore. Deploy jobs are
+ * left alone — cancelling mid-deploy is its own hazard, not an efficiency
+ * win. Efficiency (#444), not a correctness or security issue.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const wgl050: PostSynthCheck;
+//# sourceMappingURL=wgl050.d.ts.map

package/dist/lint/post-synth/wgl050.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wgl050.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/wgl050.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAK9G,eAAO,MAAM,MAAM,EAAE,cAgCpB,CAAC"}

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "gitlab",
-  "version": "0.49.0",
+  "version": "0.50.0",
   "chantVersion": ">=0.1.0",
   "namespace": "GitLab",
   "intrinsics": [

package/dist/okf/index.md

@@ -53,3 +53,5 @@ okf_version: '0.2'
 * [WGL046](/rules/WGL046.md) - Cache populated in a merge-request pipeline (poisoning risk)
 * [WGL047](/rules/WGL047.md) - Software fetched and piped to a shell without verification
 * [WGL048](/rules/WGL048.md) - Pipeline defines workflow: but no workflow:name
+* [WGL049](/rules/WGL049.md) - Job installs dependencies with no cache: in scope
+* [WGL050](/rules/WGL050.md) - Merge-request-reachable job is not interruptible

package/dist/okf/rules/WGL049.md

@@ -0,0 +1,15 @@
+---
+type: post-synth-check
+title: WGL049
+description: 'Job installs dependencies with no cache: in scope'
+id: WGL049
+severity: error
+category: post-synth
+lexicon: gitlab
+docs: https://intentius.io/chant/lexicons/gitlab/rules/
+---
+Job installs dependencies with no cache: in scope
+
+## Applies to
+
+- [Job](/types/Job.md)

package/dist/okf/rules/WGL050.md

@@ -0,0 +1,15 @@
+---
+type: post-synth-check
+title: WGL050
+description: Merge-request-reachable job is not interruptible
+id: WGL050
+severity: error
+category: post-synth
+lexicon: gitlab
+docs: https://intentius.io/chant/lexicons/gitlab/rules/
+---
+Merge-request-reachable job is not interruptible
+
+## Applies to
+
+- [Job](/types/Job.md)

package/dist/okf/types/Job.md

@@ -84,3 +84,5 @@ resource_type: GitLab::CI::Job
 - [WGL045](/rules/WGL045.md): Artifact path that may capture a credential file
 - [WGL046](/rules/WGL046.md): Cache populated in a merge-request pipeline (poisoning risk)
 - [WGL047](/rules/WGL047.md): Software fetched and piped to a shell without verification
+- [WGL049](/rules/WGL049.md): Job installs dependencies with no cache: in scope
+- [WGL050](/rules/WGL050.md): Merge-request-reachable job is not interruptible

package/dist/op/builders.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Typed step-builder wrapper for this lexicon's `gitlabPipeline` activity
+ * (chant #1288 Stage 2 — "regenerate the step builders as fully typed
+ * wrappers"). Core cannot import a lexicon's `*Args` types (lexicons depend
+ * on core, not the other way around), so a fully typed `gitlabPipeline` has
+ * to live beside {@link GitlabPipelineArgs} — here, next to
+ * `./activities/gitlab.ts`. `opts`'s type below IS `GitlabPipelineArgs`
+ * itself (via `Omit`/`WithStepRefs`) — never a hand-restated mirror.
+ *
+ * `core`'s own `gitlabPipeline` (in `@intentius/chant/op`, re-exported from
+ * `@intentius/chant-lexicon-temporal`) is UNCHANGED and produces a
+ * byte-identical `ActivityStep` for the same inputs — purely additive, and
+ * deliberately not swapped into the temporal barrel (see
+ * `lexicons/k8s/src/op/builders.ts`'s module doc for why: that would make
+ * temporal depend on this package at runtime). An author who wants the typed
+ * surface imports it from here — `@intentius/chant-lexicon-gitlab`.
+ */
+import { type ActivityStep, type NamedActivityStep, type WithStepRefs } from "@intentius/chant/op";
+import type { GitlabPipelineArgs } from "./activities/gitlab.js";
+/**
+ * Trigger and wait for a GitLab CI pipeline to complete — the fully typed
+ * twin of core's `gitlabPipeline`. `opts` is {@link GitlabPipelineArgs}
+ * itself, minus the positional `name`. Defaults to the `longInfra` profile.
+ */
+export declare const gitlabPipeline: (name: string, opts?: WithStepRefs<Omit<GitlabPipelineArgs, "name">> & {
+    profile?: ActivityStep["profile"];
+    id?: string;
+}) => NamedActivityStep;
+//# sourceMappingURL=builders.d.ts.map

package/dist/op/builders.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"builders.d.ts","sourceRoot":"","sources":["../../src/op/builders.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAGL,KAAK,YAAY,EACjB,KAAK,iBAAiB,EACtB,KAAK,YAAY,EAClB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAE9D;;;;GAIG;AACH,eAAO,MAAM,cAAc,GACzB,MAAM,MAAM,EACZ,OAAO,YAAY,CAAC,IAAI,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAC,GAAG;IAAE,OAAO,CAAC,EAAE,YAAY,CAAC,SAAS,CAAC,CAAC;IAAC,EAAE,CAAC,EAAE,MAAM,CAAA;CAAE,KACzG,iBAGF,CAAC"}

package/dist/plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAiC,MAAM,0BAA0B,CAAC;AAmB7F,eAAO,MAAM,YAAY,EAAE,aA4gB1B,CAAC"}
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAiC,MAAM,0BAA0B,CAAC;AAoB7F,eAAO,MAAM,YAAY,EAAE,aA8gB1B,CAAC"}

package/dist/rules/wgl049.ts

@@ -0,0 +1,57 @@
+/**
+ * WGL049: Dependency Install Without a Cache
+ *
+ * Flags a job whose `script:` runs a package-manager install command (`npm
+ * ci`, `pip install`, `bundle install`, etc.) with no `cache:` in scope —
+ * neither on the job itself, nor at the pipeline's `default:`/top level.
+ * Every run re-fetches the same dependencies from a cold cache. A job that
+ * `extends:` another config is left alone — the cache may be inherited and
+ * this check has no way to confirm that. Efficiency (#444), not a
+ * correctness or security issue.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { getPrimaryOutput, extractJobs, extractJobSection } from "./yaml-helpers";
+
+const DEP_INSTALL_RE = /\b(npm (install|ci)|yarn install|pnpm install|pip install|pip3 install|bundle install|composer install|go mod download|mvn (install|dependency:resolve))\b/i;
+
+function hasPipelineWideCache(yaml: string): boolean {
+  const sections = yaml.split("\n\n");
+  if (sections.some((s) => /^cache:/.test(s))) return true;
+  const defaultSection = sections.find((s) => /^default:/.test(s));
+  return !!defaultSection && /\n\s+cache:/.test(defaultSection);
+}
+
+export const wgl049: PostSynthCheck = {
+  id: "WGL049",
+  description: "Job installs dependencies with no cache: in scope",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const [, output] of ctx.outputs) {
+      const yaml = getPrimaryOutput(output);
+      if (hasPipelineWideCache(yaml)) continue;
+
+      for (const [jobName, job] of extractJobs(yaml)) {
+        if (jobName.startsWith(".")) continue; // hidden/template job, not run directly
+        if (job.extends && job.extends.length > 0) continue; // cache may be inherited; can't confirm
+
+        const section = extractJobSection(yaml, jobName);
+        if (!section) continue;
+        if (/^\s+cache:/m.test(section)) continue; // job-level cache present
+        if (!DEP_INSTALL_RE.test(section)) continue;
+
+        diagnostics.push({
+          checkId: "WGL049",
+          severity: "info",
+          message: `Job "${jobName}" installs dependencies with no cache: in scope — every run re-fetches from the registry. Add a cache: covering the dependency directory.`,
+          entity: jobName,
+          lexicon: "gitlab",
+        });
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/dist/rules/wgl050.ts

@@ -0,0 +1,49 @@
+/**
+ * WGL050: Merge-Request Job Missing interruptible
+ *
+ * Flags a job reachable from merge-request pipelines that doesn't set
+ * `interruptible: true`. Without it, GitLab's auto-cancel-redundant-pipelines
+ * setting can't cancel the job when a new push supersedes it, so the runner
+ * keeps spending capacity on a pipeline nobody wants anymore. Deploy jobs are
+ * left alone — cancelling mid-deploy is its own hazard, not an efficiency
+ * win. Efficiency (#444), not a correctness or security issue.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { getPrimaryOutput, isMergeRequestReachable } from "./yaml-helpers";
+
+const RESERVED_TOP_LEVEL_KEYS = new Set(["stages", "default", "workflow", "variables", "include", "cache"]);
+
+export const wgl050: PostSynthCheck = {
+  id: "WGL050",
+  description: "Merge-request-reachable job is not interruptible",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const [, output] of ctx.outputs) {
+      const yaml = getPrimaryOutput(output);
+
+      for (const section of yaml.split("\n\n")) {
+        const top = section.split("\n")[0]?.match(/^(\.?[a-z][a-z0-9_.-]*):/i);
+        if (!top) continue;
+        const jobName = top[1];
+        if (jobName.startsWith(".") || RESERVED_TOP_LEVEL_KEYS.has(jobName)) continue;
+        if (/deploy/i.test(jobName)) continue; // cancelling mid-deploy is a hazard, not a win
+
+        if (!isMergeRequestReachable(section)) continue;
+        if (/^\s+interruptible:\s*true\s*$/m.test(section)) continue;
+
+        diagnostics.push({
+          checkId: "WGL050",
+          severity: "info",
+          message: `Job "${jobName}" runs on merge-request pipelines but is not interruptible: true — when a new commit supersedes this pipeline, this job keeps running instead of being cancelled. Add interruptible: true.`,
+          entity: jobName,
+          lexicon: "gitlab",
+        });
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-gitlab",
-  "version": "0.49.0",
+  "version": "0.50.0",
   "description": "GitLab CI lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -67,8 +67,8 @@
     "typescript": "^5.9.3"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.49.0",
-    "@intentius/chant-lexicon-github": "^0.49.0",
+    "@intentius/chant": "^0.50.0",
+    "@intentius/chant-lexicon-github": "^0.50.0",
     "typescript": "^5.9.3"
   },
   "peerDependenciesMeta": {

package/src/components/generate-op-pipeline.test.ts

@@ -0,0 +1,94 @@
+/**
+ * Tests for generate mode's scheduled Op → GitLab CI YAML synthesis (#927).
+ * Three things this must prove, mirroring `./generate-pipeline.test.ts`'s
+ * acceptance style:
+ *
+ *  1. Every scheduled Op lands as one job in a single generated file (GitLab
+ *     has no in-file cron — see the module doc), each job gated to its own
+ *     Pipeline Schedule via `rules:`.
+ *  2. The header comment names every Op's cron and finding-mode, since the
+ *     cron itself can't live in the YAML.
+ *  3. A cross-cutting generator change (runCommand/beforeScript/extraScript)
+ *     is a single edit reflected in every job's script.
+ */
+
+import { describe, test, expect } from "vitest";
+import { parseYAML } from "@intentius/chant/yaml";
+import { generateGitlabOpPipeline } from "./generate-op-pipeline";
+import type { ScheduledOpSpec } from "@intentius/chant/lexicon";
+
+describe("generateGitlabOpPipeline: one file, one job per scheduled Op", () => {
+  test("produces a single file with stages: and one job per Op", () => {
+    const specs: ScheduledOpSpec[] = [
+      { name: "actions-audit", schedule: "0 6 * * *" },
+      { name: "prod-reconcile", schedule: "0 * * * *", findingMode: "merge-request" },
+    ];
+    const result = generateGitlabOpPipeline(specs);
+
+    expect(result.files).toHaveLength(1);
+    expect(result.files[0].name).toBe("scheduled-ops.gitlab-ci.yml");
+
+    const parsed = parseYAML(result.files[0].yaml);
+    expect(parsed.stages).toEqual(["scheduled-ops"]);
+    expect(parsed["actions-audit"]).toBeDefined();
+    expect(parsed["prod-reconcile"]).toBeDefined();
+  });
+
+  test("each job is gated to its own Pipeline Schedule via rules:, runs chant run <name>", () => {
+    const result = generateGitlabOpPipeline([{ name: "actions-audit", schedule: "0 6 * * *" }]);
+    const parsed = parseYAML(result.files[0].yaml);
+    const job = parsed["actions-audit"] as Record<string, unknown>;
+
+    expect(job.stage).toBe("scheduled-ops");
+    expect(job.rules).toEqual([
+      { if: '$CI_PIPELINE_SOURCE == "schedule" && $CHANT_SCHEDULED_OP == "actions-audit"' },
+    ]);
+    expect(job.script).toEqual(["chant run actions-audit"]);
+  });
+
+  test("the header comment names every Op's cron, selector value, and finding-mode", () => {
+    const result = generateGitlabOpPipeline([
+      { name: "actions-audit", schedule: "0 6 * * *", findingMode: "issue" },
+    ]);
+    expect(result.files[0].yaml).toContain('cron "0 6 * * *"');
+    expect(result.files[0].yaml).toContain('CHANT_SCHEDULED_OP="actions-audit"');
+    expect(result.files[0].yaml).toContain("finding-mode issue");
+    expect(result.files[0].yaml).toContain("GITLAB_TOKEN");
+  });
+
+  test("report mode's header line carries no token requirement", () => {
+    const result = generateGitlabOpPipeline([{ name: "actions-audit", schedule: "0 6 * * *" }]);
+    expect(result.files[0].yaml).not.toContain("GITLAB_TOKEN");
+  });
+
+  test("an empty Op set still produces the (empty) stages file", () => {
+    const result = generateGitlabOpPipeline([]);
+    expect(result.files).toHaveLength(1);
+    expect(result.jobs).toEqual([]);
+    const parsed = parseYAML(result.files[0].yaml);
+    expect(parsed.stages).toEqual(["scheduled-ops"]);
+  });
+});
+
+describe("generateGitlabOpPipeline: a cross-cutting change is one generator edit, not per-job", () => {
+  test("runCommand/beforeScript/extraScript apply uniformly across every job", () => {
+    const specs: ScheduledOpSpec[] = [
+      { name: "actions-audit", schedule: "0 6 * * *" },
+      { name: "prod-reconcile", schedule: "0 * * * *" },
+    ];
+    const result = generateGitlabOpPipeline(specs, {
+      runCommand: ["chant", "run", "{name}", "--temporal"],
+      beforeScript: ["npm ci"],
+      extraScript: ["echo done"],
+    });
+    const parsed = parseYAML(result.files[0].yaml);
+
+    for (const spec of specs) {
+      const job = parsed[spec.name] as Record<string, unknown>;
+      const script = job.script as string[];
+      expect(script[0]).toBe("npm ci");
+      expect(script[1]).toContain("--temporal");
+      expect(script[2]).toBe("echo done");
+    }
+  });
+});

package/src/components/generate-op-pipeline.ts

@@ -0,0 +1,111 @@
+/**
+ * Generate mode — scheduled Op → GitLab CI YAML (#927).
+ *
+ * The Op counterpart to `./generate-pipeline.ts` (#563): that module
+ * synthesizes a deploy-time component graph as one `.gitlab-ci.yml`; this one
+ * synthesizes a cron-triggered job per stateless Op — the CI-native
+ * alternative to a Temporal `TemporalSchedule` for downstream projects that
+ * don't run Temporal (`WorkflowAuditOp`/`PipelineAuditOp`/`ReconcileOp` all
+ * accept an optional `schedule` precisely for this).
+ *
+ * Unlike GitHub Actions' per-workflow `on.schedule`, GitLab has no in-file
+ * cron at all — a schedule is a project-level object (Settings → CI/CD →
+ * Schedules) that runs the project's *existing* `.gitlab-ci.yml` with a
+ * chosen cron and CI/CD variables. So every scheduled Op here becomes one
+ * job in a single generated file, gated to run only under its own Pipeline
+ * Schedule (`$CI_PIPELINE_SOURCE == "schedule"` plus a per-op selector
+ * variable) — the cron itself is configured on the Pipeline Schedule, not in
+ * this YAML, and the generated file's header comment states what to set up.
+ * Each job runs exactly one invocation, `chant run <name>` by default — never
+ * inlined audit/reconcile logic. The finding-mode itself is already baked
+ * into the Op's own activity args at build time by the composite that
+ * created it; GitLab has no per-job `permissions:` concept (unlike GitHub
+ * Actions), so a non-`report` mode's write access comes from whatever
+ * `GITLAB_TOKEN`/CI-CD-variable configuration the project already has —
+ * this generator documents the requirement rather than fabricating a
+ * variable nothing reads.
+ */
+
+import { emitYAML } from "@intentius/chant/yaml";
+import type {
+  ComponentPipelineOptions as GenerateGitlabOpOptions,
+  OpFindingMode,
+  OpPipelineJob,
+  OpPipelineResult as GenerateGitlabOpResult,
+  ScheduledOpSpec,
+} from "@intentius/chant/lexicon";
+
+export type { GenerateGitlabOpOptions, GenerateGitlabOpResult };
+
+/** GitLab CI job names must be safe YAML keys; Op names are already kebab-case in every fixture, but normalize defensively (mirrors `./generate-pipeline.ts`'s `toJobName`). */
+function toJobName(opName: string): string {
+  return opName.replace(/([a-z0-9])([A-Z])/g, "$1-$2").toLowerCase();
+}
+
+const DEFAULT_IMAGE = "node:22-slim";
+const STAGE = "scheduled-ops";
+
+/** The CI/CD variable a Pipeline Schedule sets to select which job it runs. */
+const SELECTOR_VAR = "CHANT_SCHEDULED_OP";
+
+/** One setup line per Op in the generated file's header comment. */
+function setupLine(spec: ScheduledOpSpec, jobName: string, mode: OpFindingMode): string {
+  const tokenNote = mode === "report" ? "" : " — needs a GITLAB_TOKEN CI/CD variable (masked, scope: api)";
+  return `#   ${jobName}: cron "${spec.schedule}", ${SELECTOR_VAR}="${spec.name}", finding-mode ${mode}${tokenNote}`;
+}
+
+/**
+ * Synthesize one `.gitlab-ci.yml` job per scheduled Op, all in a single file
+ * (GitLab has no per-file cron — see the module doc). Wired into core's Op
+ * generate mode via the gitlab lexicon plugin's `generateOpPipeline`
+ * (../plugin.ts).
+ */
+export function generateGitlabOpPipeline(
+  ops: ScheduledOpSpec[],
+  options: GenerateGitlabOpOptions = {},
+): GenerateGitlabOpResult {
+  const image = options.image ?? DEFAULT_IMAGE;
+  const runCommand = options.runCommand ?? ["chant", "run", "{name}"];
+  const beforeScript = options.beforeScript ?? [];
+  const extraScript = options.extraScript ?? [];
+
+  const jobs: OpPipelineJob[] = [];
+  const doc: Record<string, unknown> = { stages: [STAGE] };
+  if (options.variables && Object.keys(options.variables).length > 0) doc.variables = options.variables;
+
+  const headerLines = [
+    "# Scheduled Ops (chant #927) — GitLab has no in-file cron. Create one",
+    "# Pipeline Schedule per Op below (Settings > CI/CD > Schedules): set its",
+    `# cron to the value noted here and its ${SELECTOR_VAR} CI/CD variable to`,
+    "# the Op's name, so only that job runs on that schedule.",
+    "#",
+  ];
+
+  for (const spec of ops) {
+    const findingMode = spec.findingMode ?? "report";
+    const jobName = toJobName(spec.name);
+    jobs.push({ jobName, op: spec.name, schedule: spec.schedule, findingMode });
+    headerLines.push(setupLine(spec, jobName, findingMode));
+
+    const runParts = runCommand.map((part) => part.replace("{name}", spec.name));
+    const script = [...beforeScript, runParts.join(" "), ...extraScript];
+
+    doc[jobName] = {
+      stage: STAGE,
+      image,
+      rules: [{ if: `$CI_PIPELINE_SOURCE == "schedule" && $${SELECTOR_VAR} == "${spec.name}"` }],
+      script,
+    };
+  }
+
+  const sections: string[] = [];
+  sections.push("stages:" + emitYAML(doc.stages, 1));
+  if (doc.variables) sections.push("variables:" + emitYAML(doc.variables, 1));
+  for (const { jobName } of jobs) {
+    sections.push(`${jobName}:` + emitYAML(doc[jobName], 1));
+  }
+
+  const yaml = headerLines.join("\n") + "\n\n" + sections.join("\n\n") + "\n";
+
+  return { files: [{ name: "scheduled-ops.gitlab-ci.yml", yaml }], jobs };
+}

package/src/index.ts

@@ -4,6 +4,14 @@ export { gitlabSerializer } from "./serializer";
 // Plugin
 export { gitlabPlugin } from "./plugin";
 
+// Typed Op step-builder wrapper (chant #1288 Stage 2) — gitlabPipeline with
+// authoring-time types derived from this lexicon's own GitlabPipelineArgs
+// (see lexicons/k8s/src/op/builders.ts's module doc for why this lives here
+// rather than in core or the temporal barrel). Opt-in:
+// `@intentius/chant-lexicon-temporal`'s same-named export is core's original
+// untyped builder, unchanged, for cloud-agnostic authoring.
+export { gitlabPipeline } from "./op/builders";
+
 // Intrinsics
 export { reference, ReferenceIntrinsic } from "./intrinsics";
 

package/src/lint/audit-catalog.ts

@@ -44,4 +44,9 @@ export const gitlabAuditCatalog: Record<string, RuleMeta> = {
   WGL046: auditRule("WGL046", "merge-worthy", "guidance", "Cache populated in a merge-request pipeline", "Don't populate caches from merge-request pipelines (poisoning risk).", { authority: [GH_PWN] }),
   WGL047: auditRule("WGL047", "merge-worthy", "guidance", "Software piped to a shell without verification", "Verify a checksum/signature before executing fetched scripts.", { authority: [SCORECARD_PINNED] }),
   WGL048: auditRule("WGL048", "report-only", "guidance", "Pipeline without workflow:name", "Add a `workflow:name` for clearer pipeline naming.", { category: "best-practice" }),
+
+  // Efficiency (#444) — waste, not a safety/correctness issue. Always
+  // report-only: none of these warrant a merge on their own.
+  WGL049: auditRule("WGL049", "report-only", "guidance", "Dependency install without a cache", "Add a `cache:` covering the dependency directory.", { category: "efficiency" }),
+  WGL050: auditRule("WGL050", "report-only", "guidance", "Merge-request job missing interruptible", "Add `interruptible: true` so a superseded pipeline can be cancelled.", { category: "efficiency" }),
 };

package/src/lint/post-synth/index.ts

@@ -39,6 +39,8 @@ import { wgl045 } from "./wgl045";
 import { wgl046 } from "./wgl046";
 import { wgl047 } from "./wgl047";
 import { wgl048 } from "./wgl048";
+import { wgl049 } from "./wgl049";
+import { wgl050 } from "./wgl050";
 
 export const postSynthChecks: PostSynthCheck[] = [
   wgl010,
@@ -80,4 +82,6 @@ export const postSynthChecks: PostSynthCheck[] = [
   wgl046,
   wgl047,
   wgl048,
+  wgl049,
+  wgl050,
 ];

package/src/lint/post-synth/wgl049.test.ts

@@ -0,0 +1,71 @@
+import { describe, test, expect } from "vitest";
+import type { PostSynthContext } from "@intentius/chant/lint/post-synth";
+import { wgl049 } from "./wgl049";
+
+function makeCtx(yaml: string): PostSynthContext {
+  return {
+    outputs: new Map([["gitlab", yaml]]),
+    entities: new Map(),
+    buildResult: { outputs: new Map([["gitlab", yaml]]), entities: new Map(), warnings: [], errors: [], sourceFileCount: 1 },
+  };
+}
+
+describe("WGL049: dependency install without a cache", () => {
+  test("flags a job that installs deps with no cache in scope", () => {
+    const yaml = `build:
+  stage: build
+  script:
+    - npm ci
+    - npm run build
+`;
+    const diags = wgl049.check(makeCtx(yaml));
+    expect(diags).toHaveLength(1);
+    expect(diags[0].checkId).toBe("WGL049");
+    expect(diags[0].entity).toBe("build");
+  });
+
+  test("does not flag when the job has its own cache", () => {
+    const yaml = `build:
+  stage: build
+  cache:
+    key: npm-cache
+    paths:
+      - node_modules/
+  script:
+    - npm ci
+`;
+    expect(wgl049.check(makeCtx(yaml))).toHaveLength(0);
+  });
+
+  test("does not flag when a pipeline-wide cache: block exists", () => {
+    const yaml = `cache:
+  key: global
+  paths:
+    - node_modules/
+
+build:
+  stage: build
+  script:
+    - npm ci
+`;
+    expect(wgl049.check(makeCtx(yaml))).toHaveLength(0);
+  });
+
+  test("does not flag a job that extends another config", () => {
+    const yaml = `build:
+  extends: .node-job
+  script:
+    - npm ci
+`;
+    expect(wgl049.check(makeCtx(yaml))).toHaveLength(0);
+  });
+
+  test("does not flag a job with no dependency install command", () => {
+    const yaml = `lint:
+  stage: test
+  script:
+    - eslint .
+`;
+    expect(wgl049.check(makeCtx(yaml))).toHaveLength(0);
+  });
+});

package/src/lint/post-synth/wgl049.ts

@@ -0,0 +1,57 @@
+/**
+ * WGL049: Dependency Install Without a Cache
+ *
+ * Flags a job whose `script:` runs a package-manager install command (`npm
+ * ci`, `pip install`, `bundle install`, etc.) with no `cache:` in scope —
+ * neither on the job itself, nor at the pipeline's `default:`/top level.
+ * Every run re-fetches the same dependencies from a cold cache. A job that
+ * `extends:` another config is left alone — the cache may be inherited and
+ * this check has no way to confirm that. Efficiency (#444), not a
+ * correctness or security issue.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { getPrimaryOutput, extractJobs, extractJobSection } from "./yaml-helpers";
+
+const DEP_INSTALL_RE = /\b(npm (install|ci)|yarn install|pnpm install|pip install|pip3 install|bundle install|composer install|go mod download|mvn (install|dependency:resolve))\b/i;
+
+function hasPipelineWideCache(yaml: string): boolean {
+  const sections = yaml.split("\n\n");
+  if (sections.some((s) => /^cache:/.test(s))) return true;
+  const defaultSection = sections.find((s) => /^default:/.test(s));
+  return !!defaultSection && /\n\s+cache:/.test(defaultSection);
+}
+
+export const wgl049: PostSynthCheck = {
+  id: "WGL049",
+  description: "Job installs dependencies with no cache: in scope",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const [, output] of ctx.outputs) {
+      const yaml = getPrimaryOutput(output);
+      if (hasPipelineWideCache(yaml)) continue;
+
+      for (const [jobName, job] of extractJobs(yaml)) {
+        if (jobName.startsWith(".")) continue; // hidden/template job, not run directly
+        if (job.extends && job.extends.length > 0) continue; // cache may be inherited; can't confirm
+
+        const section = extractJobSection(yaml, jobName);
+        if (!section) continue;
+        if (/^\s+cache:/m.test(section)) continue; // job-level cache present
+        if (!DEP_INSTALL_RE.test(section)) continue;
+
+        diagnostics.push({
+          checkId: "WGL049",
+          severity: "info",
+          message: `Job "${jobName}" installs dependencies with no cache: in scope — every run re-fetches from the registry. Add a cache: covering the dependency directory.`,
+          entity: jobName,
+          lexicon: "gitlab",
+        });
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/src/lint/post-synth/wgl050.test.ts

@@ -0,0 +1,57 @@
+import { describe, test, expect } from "vitest";
+import type { PostSynthContext } from "@intentius/chant/lint/post-synth";
+import { wgl050 } from "./wgl050";
+
+function makeCtx(yaml: string): PostSynthContext {
+  return {
+    outputs: new Map([["gitlab", yaml]]),
+    entities: new Map(),
+    buildResult: { outputs: new Map([["gitlab", yaml]]), entities: new Map(), warnings: [], errors: [], sourceFileCount: 1 },
+  };
+}
+
+describe("WGL050: merge-request job missing interruptible", () => {
+  test("flags a merge-request-reachable job with no interruptible: true", () => {
+    const yaml = `test:
+  rules:
+    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
+  script:
+    - npm test
+`;
+    const diags = wgl050.check(makeCtx(yaml));
+    expect(diags).toHaveLength(1);
+    expect(diags[0].checkId).toBe("WGL050");
+    expect(diags[0].entity).toBe("test");
+  });
+
+  test("does not flag when interruptible: true is set", () => {
+    const yaml = `test:
+  rules:
+    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
+  interruptible: true
+  script:
+    - npm test
+`;
+    expect(wgl050.check(makeCtx(yaml))).toHaveLength(0);
+  });
+
+  test("does not flag a deploy job", () => {
+    const yaml = `deploy-app:
+  rules:
+    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
+  script:
+    - ./deploy.sh
+`;
+    expect(wgl050.check(makeCtx(yaml))).toHaveLength(0);
+  });
+
+  test("does not flag a job not reachable from merge requests", () => {
+    const yaml = `test:
+  rules:
+    - if: $CI_COMMIT_BRANCH == "main"
+  script:
+    - npm test
+`;
+    expect(wgl050.check(makeCtx(yaml))).toHaveLength(0);
+  });
+});

package/src/lint/post-synth/wgl050.ts

@@ -0,0 +1,49 @@
+/**
+ * WGL050: Merge-Request Job Missing interruptible
+ *
+ * Flags a job reachable from merge-request pipelines that doesn't set
+ * `interruptible: true`. Without it, GitLab's auto-cancel-redundant-pipelines
+ * setting can't cancel the job when a new push supersedes it, so the runner
+ * keeps spending capacity on a pipeline nobody wants anymore. Deploy jobs are
+ * left alone — cancelling mid-deploy is its own hazard, not an efficiency
+ * win. Efficiency (#444), not a correctness or security issue.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { getPrimaryOutput, isMergeRequestReachable } from "./yaml-helpers";
+
+const RESERVED_TOP_LEVEL_KEYS = new Set(["stages", "default", "workflow", "variables", "include", "cache"]);
+
+export const wgl050: PostSynthCheck = {
+  id: "WGL050",
+  description: "Merge-request-reachable job is not interruptible",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const [, output] of ctx.outputs) {
+      const yaml = getPrimaryOutput(output);
+
+      for (const section of yaml.split("\n\n")) {
+        const top = section.split("\n")[0]?.match(/^(\.?[a-z][a-z0-9_.-]*):/i);
+        if (!top) continue;
+        const jobName = top[1];
+        if (jobName.startsWith(".") || RESERVED_TOP_LEVEL_KEYS.has(jobName)) continue;
+        if (/deploy/i.test(jobName)) continue; // cancelling mid-deploy is a hazard, not a win
+
+        if (!isMergeRequestReachable(section)) continue;
+        if (/^\s+interruptible:\s*true\s*$/m.test(section)) continue;
+
+        diagnostics.push({
+          checkId: "WGL050",
+          severity: "info",
+          message: `Job "${jobName}" runs on merge-request pipelines but is not interruptible: true — when a new commit supersedes this pipeline, this job keeps running instead of being cancelled. Add interruptible: true.`,
+          entity: jobName,
+          lexicon: "gitlab",
+        });
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/src/op/builders.test.ts

@@ -0,0 +1,43 @@
+/**
+ * Typed step-builder wrapper (chant #1288 Stage 2) — see
+ * `lexicons/k8s/src/op/builders.test.ts`'s module doc for what's asserted
+ * and why.
+ */
+
+import { describe, test, expect } from "vitest";
+import { gitlabPipeline as gitlabPipelineOld, stepOutput, type StepOutputRef } from "@intentius/chant/op";
+import { gitlabPipeline } from "./builders";
+
+describe("gitlab typed step builder (#1288 Stage 2)", () => {
+  test("gitlabPipeline: identical ActivityStep to core's original for a minimal call", () => {
+    expect(gitlabPipeline("alb-api")).toEqual(gitlabPipelineOld("alb-api"));
+  });
+
+  test("gitlabPipeline: identical ActivityStep with opts", () => {
+    const opts = { ref: "main", intervalMs: 15000, profile: "fastIdempotent" as const };
+    expect(gitlabPipeline("alb-api", opts)).toEqual(gitlabPipelineOld("alb-api", opts));
+  });
+
+  test("gitlabPipeline: accepts a StepOutputRef in a typed slot", () => {
+    const ref = stepOutput("resolve-ref", "sha");
+    const step = gitlabPipeline("alb-api", { ref });
+    expect(step.args?.ref).toBe(ref);
+  });
+
+  test("gitlabPipeline: .out is reachable when an id is given", () => {
+    const step = gitlabPipeline("alb-api", { id: "pipeline" });
+    const ref: StepOutputRef = step.out.name;
+    expect(ref.step).toBe("pipeline");
+  });
+});
+
+// ── Compile-time-only: authoring-time type errors (never executed) ──────────
+function _typeChecksOnly(): void {
+  // @ts-expect-error — "project" is not a key of GitlabPipelineArgs (the
+  // field is `name`, and it's positional here besides).
+  gitlabPipeline("alb-api", { project: "group/other" });
+
+  // @ts-expect-error — intervalMs must be a number.
+  gitlabPipeline("alb-api", { intervalMs: "15000" });
+}
+void _typeChecksOnly;

package/src/op/builders.ts

@@ -0,0 +1,39 @@
+/**
+ * Typed step-builder wrapper for this lexicon's `gitlabPipeline` activity
+ * (chant #1288 Stage 2 — "regenerate the step builders as fully typed
+ * wrappers"). Core cannot import a lexicon's `*Args` types (lexicons depend
+ * on core, not the other way around), so a fully typed `gitlabPipeline` has
+ * to live beside {@link GitlabPipelineArgs} — here, next to
+ * `./activities/gitlab.ts`. `opts`'s type below IS `GitlabPipelineArgs`
+ * itself (via `Omit`/`WithStepRefs`) — never a hand-restated mirror.
+ *
+ * `core`'s own `gitlabPipeline` (in `@intentius/chant/op`, re-exported from
+ * `@intentius/chant-lexicon-temporal`) is UNCHANGED and produces a
+ * byte-identical `ActivityStep` for the same inputs — purely additive, and
+ * deliberately not swapped into the temporal barrel (see
+ * `lexicons/k8s/src/op/builders.ts`'s module doc for why: that would make
+ * temporal depend on this package at runtime). An author who wants the typed
+ * surface imports it from here — `@intentius/chant-lexicon-gitlab`.
+ */
+
+import {
+  activity,
+  takeProfileAndId,
+  type ActivityStep,
+  type NamedActivityStep,
+  type WithStepRefs,
+} from "@intentius/chant/op";
+import type { GitlabPipelineArgs } from "./activities/gitlab";
+
+/**
+ * Trigger and wait for a GitLab CI pipeline to complete — the fully typed
+ * twin of core's `gitlabPipeline`. `opts` is {@link GitlabPipelineArgs}
+ * itself, minus the positional `name`. Defaults to the `longInfra` profile.
+ */
+export const gitlabPipeline = (
+  name: string,
+  opts?: WithStepRefs<Omit<GitlabPipelineArgs, "name">> & { profile?: ActivityStep["profile"]; id?: string },
+): NamedActivityStep => {
+  const { args, profile, id } = takeProfileAndId(opts as Record<string, unknown> | undefined);
+  return activity("gitlabPipeline", { name, ...args }, { profile: profile ?? "longInfra", ...(id ? { id } : {}) });
+};

package/src/plugin.test.ts

@@ -87,7 +87,7 @@ describe("gitlabPlugin", () => {
 
   test("returns post-synth checks", () => {
     const checks = gitlabPlugin.postSynthChecks!();
-    expect(checks).toHaveLength(39);
+    expect(checks).toHaveLength(41);
     const ids = checks.map((c) => c.id);
     expect(ids).toContain("WGL010");
     expect(ids).toContain("WGL011");

package/src/plugin.ts

@@ -23,12 +23,15 @@ import { gitlabHover } from "./lsp/hover";
 import { GitLabParser } from "./import/parser";
 import { GitLabGenerator } from "./import/generator";
 import { generateGitlabPipeline } from "./components/generate-pipeline";
+import { generateGitlabOpPipeline } from "./components/generate-op-pipeline";
 
 export const gitlabPlugin: LexiconPlugin = {
   name: "gitlab",
   auditCatalog: () => gitlabAuditCatalog,
   // Generate mode (#688): synthesize a .gitlab-ci.yml from the component graph.
   generateComponentPipeline: (components, options) => generateGitlabPipeline(components, options),
+  // Generate mode, Op counterpart (#927): scheduled Op → GitLab CI job.
+  generateOpPipeline: (ops, options) => generateGitlabOpPipeline(ops, options),
   // Self-upgrade: where the pinned GitLab schema version lives + its upstream (#685).
   upstreamPin: {
     file: "src/codegen/fetch.ts",