@intentius/chant-lexicon-gitlab 0.54.3 → 0.55.0

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "e87c43d9cb00e94d0f53c692e7d29cd0a83c55ebe064d68b76e7f0892eadb45c",
+    "manifest.json": "10235e3780420be85794137bc118da96898b436d59f50852909c8e08fc0b3548",
     "meta.json": "931fc3246a55645b1493080bbeb160e5d205e42349e8bdca96ca243adb5f0da3",
     "types/index.d.ts": "5cd2e99f135a929b72bdd822d00d780d39b1cd407ba0cfb3d511c7ac9d667b58",
     "rules/artifact-no-expiry.ts": "3f3cabf9792cbf8207e53a25f506715466b19ec25e9c3b4d0d77fed6b2eb4542",
@@ -55,5 +55,5 @@
     "skills/chant-gitlab-migrate.md": "4853d04980560b379e5b0f7267dcb0a1e5d5879cb9e9931681ce76b2a5fe69d8",
     "skills/chant-gitlab-patterns.md": "6d9a44e9e8de4c3820be9d65381b0d2ede4cb3626aaaf0011e21838a9fbf556e"
   },
-  "composite": "9b4849c8012da2a3aa52211ff9b51747531688587ab091a1f95cef6916886693"
+  "composite": "dc6c6b199c36d9037f397354d966a9ca063c727a81602e87fbaebf870aaf567b"
 }

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "gitlab",
-  "version": "0.54.3",
+  "version": "0.55.0",
   "chantVersion": ">=0.1.0",
   "namespace": "GitLab",
   "intrinsics": [

package/dist/plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAiC,MAAM,0BAA0B,CAAC;AAoB7F,eAAO,MAAM,YAAY,EAAE,aA8gB1B,CAAC"}
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAiC,MAAM,0BAA0B,CAAC;AAoB7F,eAAO,MAAM,YAAY,EAAE,aAmhB1B,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-gitlab",
-  "version": "0.54.3",
+  "version": "0.55.0",
   "description": "GitLab CI lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -67,8 +67,8 @@
     "typescript": "^5.9.3"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.54.3",
-    "@intentius/chant-lexicon-github": "^0.54.3",
+    "@intentius/chant": "^0.55.0",
+    "@intentius/chant-lexicon-github": "^0.55.0",
     "typescript": "^5.9.3"
   },
   "peerDependenciesMeta": {

package/src/plugin.test.ts

@@ -213,6 +213,28 @@ describe("gitlabPlugin", () => {
     expect(typeof gen.generate).toBe("function");
   });
 
+  // -----------------------------------------------------------------------
+  // Migration source (#2066)
+  // -----------------------------------------------------------------------
+
+  test("migrationSource transform passes security through and returns securityPosture", async () => {
+    const src = gitlabPlugin.migrationSource!("github")!;
+    const workflow = `on: push
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - run: echo "$TOKEN"
+        env:
+          TOKEN: \${{ secrets.TOKEN }}
+`;
+    const result = await src.transform(workflow, { emit: "yaml", security: true });
+    expect(result.securityPosture).toContain("## Security posture");
+    // The security option reached the transform: the secret-reference fate
+    // shows up as a posture row, not the "nothing detected" fallback.
+    expect(result.securityPosture).toContain("Secret reference");
+  });
+
   // -----------------------------------------------------------------------
   // Skills
   // -----------------------------------------------------------------------

package/src/plugin.ts

@@ -289,6 +289,7 @@ export const test = new Job({
             emit: { type: "string", enum: ["yaml", "ts"], description: "Output format (default: yaml)" },
             useComposites: { type: "boolean", description: "Recognise composite patterns and emit NodePipeline/NodeCI calls" },
             strict: { type: "boolean", description: "Escalate needs-review diagnostics to errors" },
+            security: { type: "boolean", description: "Run security-aware migration analysis (classify property fates + GitLab security checks)" },
           },
           required: ["content"],
         },
@@ -298,6 +299,7 @@ export const test = new Job({
             emit: (params.emit as "yaml" | "ts" | undefined) ?? "yaml",
             useComposites: !!params.useComposites,
             strict: !!params.strict,
+            security: !!params.security,
             sourceFile: "<mcp-input>",
           });
           return {
@@ -305,6 +307,7 @@ export const test = new Job({
             diagnostics: result.diagnostics,
             provenance: result.provenance,
             stages: result.stages,
+            securityPosture: result.securityPosture,
           };
         },
       },
@@ -326,6 +329,7 @@ export const test = new Job({
           useComposites: opts.useComposites,
           sourceFile: opts.sourceFile,
           strict: opts.strict,
+          security: opts.security,
         });
         // The composites rewriter (when enabled) replaces several Job
         // resources with a single Composite resource — stages: in the
@@ -336,6 +340,7 @@ export const test = new Job({
           output: result.output,
           provenance: result.provenance as unknown as Array<Record<string, unknown>>,
           diagnostics: result.diagnostics as unknown as Array<Record<string, unknown>>,
+          securityPosture: result.securityPosture,
         };
       },
     };