@intentius/chant-lexicon-gitlab 0.57.0 → 0.59.0

package/dist/components/generate-op-pipeline.d.ts

@@ -3,10 +3,12 @@
  *
  * The Op counterpart to `./generate-pipeline.ts` (#563): that module
  * synthesizes a deploy-time component graph as one `.gitlab-ci.yml`; this one
- * synthesizes a cron-triggered job per stateless Op — the CI-native
- * alternative to a Temporal `TemporalSchedule` for downstream projects that
- * don't run Temporal (`WorkflowAuditOp`/`PipelineAuditOp`/`ReconcileOp` all
- * accept an optional `schedule` precisely for this).
+ * synthesizes a cron-triggered job per stateless Op. An Op's cadence is an
+ * `OpSchedule` on the Op itself (`packages/core/src/op/types.ts`),
+ * runtime-neutral data each reader interprets; this module is the reader that
+ * turns it into a GitLab pipeline schedule (`WorkflowAuditOp`/
+ * `PipelineAuditOp`/`ReconcileOp` all accept an optional `schedule` precisely
+ * for this).
  *
  * Unlike GitHub Actions' per-workflow `on.schedule`, GitLab has no in-file
  * cron at all — a schedule is a project-level object (Settings → CI/CD →
@@ -20,10 +22,36 @@
  * inlined audit/reconcile logic. The finding-mode itself is already baked
  * into the Op's own activity args at build time by the composite that
  * created it; GitLab has no per-job `permissions:` concept (unlike GitHub
- * Actions), so a non-`report` mode's write access comes from whatever
+ * Actions), and `findingMode: "comment"` is refused by name here because it
+ * posts onto a GitHub pull-request event GitLab does not have (#2231), so a
+ * non-`report` mode's write access comes from whatever
  * `GITLAB_TOKEN`/CI-CD-variable configuration the project already has —
  * this generator documents the requirement rather than fabricating a
  * variable nothing reads.
+ *
+ * Neither of #2242's two per-Op options survives the crossing, and both are
+ * refused by name rather than dropped. A `setup` entry spelled `{ uses }` is
+ * a GitHub Actions marketplace action; GitLab CI has `script` and nothing
+ * else, so there is no shape to translate it into and no way to approximate
+ * `aws-actions/configure-aws-credentials` in a shell line. A `{ run }` entry
+ * translates exactly, and is emitted ahead of the `beforeScript` lines, the
+ * same position the github generator gives it. An additive `permissions` map
+ * is refused for the same reason `permissions:` is absent here at all: GitLab
+ * has no per-job token-scope mapping, and its OIDC surface is a different
+ * declaration (`id_tokens:` with an `aud`, exchanged for cloud credentials by
+ * the job itself) that chant does not generate. Ignoring the map would emit a
+ * job that reads as having OIDC and runs with no credentials.
+ *
+ * The gated-apply mapping (#2243) has nothing to attach to here. It exists
+ * because a push-to-main apply that stops at its gate exits 3 and paints the
+ * branch red on every merge; this generator has no push pipeline at all,
+ * refusing a `push` trigger by name (#2084) because a GitLab schedule is a
+ * project-level cron object rather than an event. GitLab does have its own
+ * equivalent of the mapping should one ever be wanted — `allow_failure:
+ * { exit_codes: [3] }` turns one exit code into a warning rather than a
+ * failure, without a flag on the invocation — so the day this generator
+ * grows a push trigger, that is the shape to reach for rather than
+ * `--gated-exit`.
  */
 import type { ComponentPipelineOptions as GenerateGitlabOpOptions, OpPipelineResult as GenerateGitlabOpResult, ScheduledOpSpec } from "@intentius/chant/lexicon";
 export type { GenerateGitlabOpOptions, GenerateGitlabOpResult };

package/dist/components/generate-op-pipeline.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generate-op-pipeline.d.ts","sourceRoot":"","sources":["../../src/components/generate-op-pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAGH,OAAO,KAAK,EACV,wBAAwB,IAAI,uBAAuB,EAGnD,gBAAgB,IAAI,sBAAsB,EAC1C,eAAe,EAChB,MAAM,0BAA0B,CAAC;AAElC,YAAY,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,CAAC;AAmBhE;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,eAAe,EAAE,EACtB,OAAO,GAAE,uBAA4B,GACpC,sBAAsB,CA6CxB"}
+{"version":3,"file":"generate-op-pipeline.d.ts","sourceRoot":"","sources":["../../src/components/generate-op-pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AAIH,OAAO,KAAK,EACV,wBAAwB,IAAI,uBAAuB,EAGnD,gBAAgB,IAAI,sBAAsB,EAC1C,eAAe,EAChB,MAAM,0BAA0B,CAAC;AAiClC,YAAY,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,CAAC;AAmBhE;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,eAAe,EAAE,EACtB,OAAO,GAAE,uBAA4B,GACpC,sBAAsB,CAmExB"}

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAGhD,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAQxC,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAG/C,OAAO,EAAE,SAAS,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAG7D,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAIjC,cAAc,mBAAmB,CAAC;AAGlC,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,cAAc,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACnI,YAAY,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAGtI,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AACrF,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpF,YAAY,EAAE,iBAAiB,EAAE,cAAc,EAAE,cAAc,EAAE,kBAAkB,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAGzH,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAGhD,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAOxC,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAG/C,OAAO,EAAE,SAAS,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAG7D,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAIjC,cAAc,mBAAmB,CAAC;AAGlC,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,cAAc,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACnI,YAAY,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAGtI,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AACrF,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpF,YAAY,EAAE,iBAAiB,EAAE,cAAc,EAAE,cAAc,EAAE,kBAAkB,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAGzH,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC"}

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "2c3566b38dbbfa11a15c278371c596b68388a8c1a7e1d55293d51fec467d8303",
+    "manifest.json": "05eca8e8e24c1045cd8d1b9903dfa59661449d40b52b9d2f880eb2a5a00c67d2",
     "meta.json": "931fc3246a55645b1493080bbeb160e5d205e42349e8bdca96ca243adb5f0da3",
     "types/index.d.ts": "5cd2e99f135a929b72bdd822d00d780d39b1cd407ba0cfb3d511c7ac9d667b58",
     "rules/artifact-no-expiry.ts": "3f3cabf9792cbf8207e53a25f506715466b19ec25e9c3b4d0d77fed6b2eb4542",
@@ -55,5 +55,5 @@
     "skills/chant-gitlab-migrate.md": "4853d04980560b379e5b0f7267dcb0a1e5d5879cb9e9931681ce76b2a5fe69d8",
     "skills/chant-gitlab-patterns.md": "6d9a44e9e8de4c3820be9d65381b0d2ede4cb3626aaaf0011e21838a9fbf556e"
   },
-  "composite": "b121d7b8bd7d52a80a08fc2797792e895b16093302af3ded870482d6f5af1b9c"
+  "composite": "5ba4e358f25944a07f0966355b274aebb3c199d11fc997aa7713830c7ff5320e"
 }

package/dist/lint/audit-catalog.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit-catalog.d.ts","sourceRoot":"","sources":["../../src/lint/audit-catalog.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAA0E,KAAK,QAAQ,EAAE,MAAM,gCAAgC,CAAC;AAEvI,eAAO,MAAM,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CA6CvD,CAAC"}
+{"version":3,"file":"audit-catalog.d.ts","sourceRoot":"","sources":["../../src/lint/audit-catalog.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAA0E,KAAK,QAAQ,EAAgB,MAAM,gCAAgC,CAAC;AAGrJ,eAAO,MAAM,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CA6CvD,CAAC"}

package/dist/lint/audit-lineage.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Prior art for these audit rules: the open-source tools whose checks cover the
+ * same condition, credited per rule. See packages/core/src/audit/prior-art.ts for
+ * the registry, the relation vocabulary, and why this is credit rather than
+ * authority. Kept by hand; the prior-art sweep (scripts/prior-art-sweep.ts) reports
+ * when a credited tool's index no longer lists a rule cited here.
+ */
+import type { Lineage } from "@intentius/chant/audit/catalog";
+export declare const gitlabAuditLineage: Record<string, Lineage[]>;
+//# sourceMappingURL=audit-lineage.d.ts.map

package/dist/lint/audit-lineage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-lineage.d.ts","sourceRoot":"","sources":["../../src/lint/audit-lineage.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAC;AAE9D,eAAO,MAAM,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,CA+DxD,CAAC"}

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "gitlab",
-  "version": "0.57.0",
+  "version": "0.59.0",
   "chantVersion": ">=0.1.0",
   "namespace": "GitLab",
   "intrinsics": [

package/dist/op/activities/gitlab.d.ts

@@ -9,7 +9,7 @@ export interface GitlabPipelineArgs {
 /**
  * Trigger a GitLab CI pipeline and wait for it to complete successfully.
  * Requires `glab` CLI authenticated in the environment.
- * Uses longInfra profile — 20m timeout, heartbeat every poll.
+ * Uses the longInfra profile: 20m timeout, three attempts backing off from 30s.
  */
 export declare function gitlabPipeline(args: GitlabPipelineArgs, signal?: AbortSignal): Promise<void>;
 //# sourceMappingURL=gitlab.d.ts.map

package/dist/op/activities/gitlab.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gitlab.d.ts","sourceRoot":"","sources":["../../../src/op/activities/gitlab.ts"],"names":[],"mappings":"AAMA,MAAM,WAAW,kBAAkB;IACjC,0DAA0D;IAC1D,IAAI,EAAE,MAAM,CAAC;IACb,+DAA+D;IAC/D,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,2CAA2C;IAC3C,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;GAIG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAAE,kBAAkB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAsClG"}
+{"version":3,"file":"gitlab.d.ts","sourceRoot":"","sources":["../../../src/op/activities/gitlab.ts"],"names":[],"mappings":"AAMA,MAAM,WAAW,kBAAkB;IACjC,0DAA0D;IAC1D,IAAI,EAAE,MAAM,CAAC;IACb,+DAA+D;IAC/D,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,2CAA2C;IAC3C,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;GAIG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAAE,kBAAkB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAqClG"}

package/dist/op/activities/index.d.ts

@@ -1,10 +1,11 @@
 /**
  * gitlab Op activities — resolved by the core activity registry when a project's
  * `chant.config.ts` lists the `gitlab` lexicon. `gitlabPipeline` triggers a
- * pipeline over the GitLab CLI with heartbeat/retry semantics; relocated from the
- * temporal lexicon (#809) so gitlab's imperative activity lives with its product.
- * The `gitlabPipeline` step builder stays in core, re-exported from the temporal
- * Op-authoring barrel like the other core builders.
+ * pipeline over the GitLab CLI and polls it to completion under the step's
+ * profile; relocated from the hosting lexicon (#809) so gitlab's imperative
+ * activity lives with its product. The `gitlabPipeline` step builder stays in
+ * core and reaches authors through `@intentius/chant/op` like the other core
+ * builders.
  */
 export { gitlabPipeline } from "./gitlab.js";
 export type { GitlabPipelineArgs } from "./gitlab.js";

package/dist/op/activities/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/op/activities/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAC1C,YAAY,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/op/activities/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAC1C,YAAY,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC"}

package/dist/op/builders.d.ts

@@ -7,12 +7,11 @@
  * `./activities/gitlab.ts`. `opts`'s type below IS `GitlabPipelineArgs`
  * itself (via `Omit`/`WithStepRefs`) — never a hand-restated mirror.
  *
- * `core`'s own `gitlabPipeline` (in `@intentius/chant/op`, re-exported from
- * `@intentius/chant-lexicon-temporal`) is UNCHANGED and produces a
- * byte-identical `ActivityStep` for the same inputs — purely additive, and
- * deliberately not swapped into the temporal barrel (see
+ * `core`'s own `gitlabPipeline` (in `@intentius/chant/op`) is UNCHANGED and
+ * produces a byte-identical `ActivityStep` for the same inputs — purely
+ * additive, and deliberately not swapped into core's barrel (see
  * `lexicons/k8s/src/op/builders.ts`'s module doc for why: that would make
- * temporal depend on this package at runtime). An author who wants the typed
+ * core depend on this package at runtime). An author who wants the typed
  * surface imports it from here — `@intentius/chant-lexicon-gitlab`.
  */
 import { type ActivityStep, type NamedActivityStep, type WithStepRefs } from "@intentius/chant/op";

package/dist/op/builders.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"builders.d.ts","sourceRoot":"","sources":["../../src/op/builders.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAGL,KAAK,YAAY,EACjB,KAAK,iBAAiB,EACtB,KAAK,YAAY,EAClB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAE9D;;;;GAIG;AACH,eAAO,MAAM,cAAc,GACzB,MAAM,MAAM,EACZ,OAAO,YAAY,CAAC,IAAI,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAC,GAAG;IAAE,OAAO,CAAC,EAAE,YAAY,CAAC,SAAS,CAAC,CAAC;IAAC,EAAE,CAAC,EAAE,MAAM,CAAA;CAAE,KACzG,iBAGF,CAAC"}
+{"version":3,"file":"builders.d.ts","sourceRoot":"","sources":["../../src/op/builders.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAGL,KAAK,YAAY,EACjB,KAAK,iBAAiB,EACtB,KAAK,YAAY,EAClB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAE9D;;;;GAIG;AACH,eAAO,MAAM,cAAc,GACzB,MAAM,MAAM,EACZ,OAAO,YAAY,CAAC,IAAI,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAC,GAAG;IAAE,OAAO,CAAC,EAAE,YAAY,CAAC,SAAS,CAAC,CAAC;IAAC,EAAE,CAAC,EAAE,MAAM,CAAA;CAAE,KACzG,iBAGF,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-gitlab",
-  "version": "0.57.0",
+  "version": "0.59.0",
   "description": "GitLab CI lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -67,8 +67,8 @@
     "typescript": "^5.9.3"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.57.0",
-    "@intentius/chant-lexicon-github": "^0.57.0",
+    "@intentius/chant": "^0.59.0",
+    "@intentius/chant-lexicon-github": "^0.59.0",
     "typescript": "^5.9.3"
   },
   "peerDependenciesMeta": {

package/src/components/generate-op-pipeline.test.ts

@@ -70,6 +70,36 @@ describe("generateGitlabOpPipeline: one file, one job per scheduled Op", () => {
   });
 });
 
+describe("generateGitlabOpPipeline: no pull_request/push event model (#2084)", () => {
+  test("a pull_request trigger throws a clear error instead of silently ignoring it", () => {
+    const specs: ScheduledOpSpec[] = [{ name: "tf-plan", trigger: { kind: "pull_request" } }];
+    expect(() => generateGitlabOpPipeline(specs)).toThrow(/pull_request.*GitLab has no pull_request\/push event model/s);
+  });
+
+  test("a push trigger throws a clear error instead of silently ignoring it", () => {
+    const specs: ScheduledOpSpec[] = [{ name: "tf-apply", trigger: { kind: "push" } }];
+    expect(() => generateGitlabOpPipeline(specs)).toThrow(/push.*GitLab has no pull_request\/push event model/s);
+  });
+});
+
+describe("generateGitlabOpPipeline: no comment finding mode (#2231)", () => {
+  test("findingMode comment is refused by name, even on a cron trigger GitLab does support", () => {
+    const specs: ScheduledOpSpec[] = [
+      { name: "app-plan", schedule: "0 6 * * *", findingMode: "comment" },
+    ];
+    expect(() => generateGitlabOpPipeline(specs)).toThrow(
+      /Scheduled Op "app-plan".*findingMode "comment".*GitLab has no pull_request event/s,
+    );
+  });
+
+  test("the refusal names the modes GitLab does have", () => {
+    const specs: ScheduledOpSpec[] = [{ name: "app-plan", schedule: "0 6 * * *", findingMode: "comment" }];
+    expect(() => generateGitlabOpPipeline(specs)).toThrow(
+      /findingMode "issue" or "merge-request"/,
+    );
+  });
+});
+
 describe("generateGitlabOpPipeline: a cross-cutting change is one generator edit, not per-job", () => {
   test("runCommand/beforeScript/extraScript apply uniformly across every job", () => {
     const specs: ScheduledOpSpec[] = [
@@ -77,7 +107,7 @@ describe("generateGitlabOpPipeline: a cross-cutting change is one generator edit
       { name: "prod-reconcile", schedule: "0 * * * *" },
     ];
     const result = generateGitlabOpPipeline(specs, {
-      runCommand: ["chant", "run", "{name}", "--temporal"],
+      runCommand: ["chant", "run", "{name}", "--json"],
       beforeScript: ["npm ci"],
       extraScript: ["echo done"],
     });
@@ -87,8 +117,55 @@ describe("generateGitlabOpPipeline: a cross-cutting change is one generator edit
       const job = parsed[spec.name] as Record<string, unknown>;
       const script = job.script as string[];
       expect(script[0]).toBe("npm ci");
-      expect(script[1]).toContain("--temporal");
+      expect(script[1]).toContain("--json");
       expect(script[2]).toBe("echo done");
     }
   });
 });
+
+/**
+ * #2242's two per-Op options against a provider that has neither concept.
+ * Both degrade by name at build time rather than being dropped into a job
+ * that would run without the thing the option asked for.
+ */
+describe("generateGitlabOpPipeline: setup steps and additive permissions (#2242)", () => {
+  test("refuses a `uses` setup step by name, and names the action", () => {
+    expect(() =>
+      generateGitlabOpPipeline([
+        {
+          name: "actions-audit",
+          schedule: "0 6 * * *",
+          setup: [{ uses: "aws-actions/configure-aws-credentials@v6" }],
+        },
+      ]),
+    ).toThrow(/setup step 1 is `uses: "aws-actions\/configure-aws-credentials@v6"`.*GitLab CI jobs run/s);
+  });
+
+  test("emits a `run` setup entry ahead of the beforeScript lines", () => {
+    const result = generateGitlabOpPipeline(
+      [
+        {
+          name: "actions-audit",
+          schedule: "0 6 * * *",
+          setup: [{ run: "aws sts get-caller-identity" }],
+        },
+      ],
+      { beforeScript: ["npm ci"], extraScript: ["echo done"] },
+    );
+    const job = parseYAML(result.files[0].yaml)["actions-audit"] as { script: string[] };
+    expect(job.script).toEqual([
+      "aws sts get-caller-identity",
+      "npm ci",
+      "chant run actions-audit",
+      "echo done",
+    ]);
+  });
+
+  test("refuses additive permissions by name, and points at GitLab's own OIDC surface", () => {
+    expect(() =>
+      generateGitlabOpPipeline([
+        { name: "actions-audit", schedule: "0 6 * * *", permissions: { "id-token": "write" } },
+      ]),
+    ).toThrow(/adds permissions \{ id-token: write \}.*id_tokens:/s);
+  });
+});

package/src/components/generate-op-pipeline.ts

@@ -3,10 +3,12 @@
  *
  * The Op counterpart to `./generate-pipeline.ts` (#563): that module
  * synthesizes a deploy-time component graph as one `.gitlab-ci.yml`; this one
- * synthesizes a cron-triggered job per stateless Op — the CI-native
- * alternative to a Temporal `TemporalSchedule` for downstream projects that
- * don't run Temporal (`WorkflowAuditOp`/`PipelineAuditOp`/`ReconcileOp` all
- * accept an optional `schedule` precisely for this).
+ * synthesizes a cron-triggered job per stateless Op. An Op's cadence is an
+ * `OpSchedule` on the Op itself (`packages/core/src/op/types.ts`),
+ * runtime-neutral data each reader interprets; this module is the reader that
+ * turns it into a GitLab pipeline schedule (`WorkflowAuditOp`/
+ * `PipelineAuditOp`/`ReconcileOp` all accept an optional `schedule` precisely
+ * for this).
  *
  * Unlike GitHub Actions' per-workflow `on.schedule`, GitLab has no in-file
  * cron at all — a schedule is a project-level object (Settings → CI/CD →
@@ -20,13 +22,40 @@
  * inlined audit/reconcile logic. The finding-mode itself is already baked
  * into the Op's own activity args at build time by the composite that
  * created it; GitLab has no per-job `permissions:` concept (unlike GitHub
- * Actions), so a non-`report` mode's write access comes from whatever
+ * Actions), and `findingMode: "comment"` is refused by name here because it
+ * posts onto a GitHub pull-request event GitLab does not have (#2231), so a
+ * non-`report` mode's write access comes from whatever
  * `GITLAB_TOKEN`/CI-CD-variable configuration the project already has —
  * this generator documents the requirement rather than fabricating a
  * variable nothing reads.
+ *
+ * Neither of #2242's two per-Op options survives the crossing, and both are
+ * refused by name rather than dropped. A `setup` entry spelled `{ uses }` is
+ * a GitHub Actions marketplace action; GitLab CI has `script` and nothing
+ * else, so there is no shape to translate it into and no way to approximate
+ * `aws-actions/configure-aws-credentials` in a shell line. A `{ run }` entry
+ * translates exactly, and is emitted ahead of the `beforeScript` lines, the
+ * same position the github generator gives it. An additive `permissions` map
+ * is refused for the same reason `permissions:` is absent here at all: GitLab
+ * has no per-job token-scope mapping, and its OIDC surface is a different
+ * declaration (`id_tokens:` with an `aud`, exchanged for cloud credentials by
+ * the job itself) that chant does not generate. Ignoring the map would emit a
+ * job that reads as having OIDC and runs with no credentials.
+ *
+ * The gated-apply mapping (#2243) has nothing to attach to here. It exists
+ * because a push-to-main apply that stops at its gate exits 3 and paints the
+ * branch red on every merge; this generator has no push pipeline at all,
+ * refusing a `push` trigger by name (#2084) because a GitLab schedule is a
+ * project-level cron object rather than an event. GitLab does have its own
+ * equivalent of the mapping should one ever be wanted — `allow_failure:
+ * { exit_codes: [3] }` turns one exit code into a warning rather than a
+ * failure, without a flag on the invocation — so the day this generator
+ * grows a push trigger, that is the shape to reach for rather than
+ * `--gated-exit`.
  */
 
 import { emitYAML } from "@intentius/chant/yaml";
+import { resolveOpTrigger } from "@intentius/chant/lexicon";
 import type {
   ComponentPipelineOptions as GenerateGitlabOpOptions,
   OpFindingMode,
@@ -35,6 +64,37 @@ import type {
   ScheduledOpSpec,
 } from "@intentius/chant/lexicon";
 
+/**
+ * Refuse the two #2242 options GitLab cannot honour, by name and before any
+ * YAML exists, and return the `run` setup lines that do translate. See the
+ * module doc for why each one is a refusal rather than a silent drop.
+ */
+function gitlabSetupScript(spec: ScheduledOpSpec): string[] {
+  if (spec.permissions && Object.keys(spec.permissions).length > 0) {
+    const scopes = Object.entries(spec.permissions)
+      .map(([scope, value]) => `${scope}: ${value}`)
+      .join(", ");
+    throw new Error(
+      `Scheduled Op "${spec.name}" adds permissions { ${scopes} }, but GitLab CI has no per-job token-scope ` +
+        `mapping — there is no \`permissions:\` key to add them to (#2242). Its OIDC surface is a separate ` +
+        `\`id_tokens:\` declaration the job exchanges for cloud credentials itself, which chant does not ` +
+        `generate. Drop the option here, or generate this Op for github.`,
+    );
+  }
+  const lines: string[] = [];
+  (spec.setup ?? []).forEach((step, index) => {
+    if ("uses" in step) {
+      throw new Error(
+        `Scheduled Op "${spec.name}" setup step ${index + 1} is \`uses: "${step.uses}"\`, a GitHub Actions ` +
+          `marketplace action. GitLab CI jobs run \`script\` lines only, so there is nothing to translate it ` +
+          `into (#2242). Express the setup as a \`{ run }\` entry, or generate this Op for github/forgejo.`,
+      );
+    }
+    lines.push(step.run);
+  });
+  return lines;
+}
+
 export type { GenerateGitlabOpOptions, GenerateGitlabOpResult };
 
 /** GitLab CI job names must be safe YAML keys; Op names are already kebab-case in every fixture, but normalize defensively (mirrors `./generate-pipeline.ts`'s `toJobName`). */
@@ -49,9 +109,9 @@ const STAGE = "scheduled-ops";
 const SELECTOR_VAR = "CHANT_SCHEDULED_OP";
 
 /** One setup line per Op in the generated file's header comment. */
-function setupLine(spec: ScheduledOpSpec, jobName: string, mode: OpFindingMode): string {
+function setupLine(spec: ScheduledOpSpec, cron: string, jobName: string, mode: OpFindingMode): string {
   const tokenNote = mode === "report" ? "" : " — needs a GITLAB_TOKEN CI/CD variable (masked, scope: api)";
-  return `#   ${jobName}: cron "${spec.schedule}", ${SELECTOR_VAR}="${spec.name}", finding-mode ${mode}${tokenNote}`;
+  return `#   ${jobName}: cron "${cron}", ${SELECTOR_VAR}="${spec.name}", finding-mode ${mode}${tokenNote}`;
 }
 
 /**
@@ -82,13 +142,35 @@ export function generateGitlabOpPipeline(
   ];
 
   for (const spec of ops) {
+    const setupScript = gitlabSetupScript(spec);
     const findingMode = spec.findingMode ?? "report";
+    if (findingMode === "comment") {
+      // The mode posts onto the pull request that triggered the run (#2231),
+      // read out of the GitHub Actions event payload by `reconcilePr`. GitLab
+      // has neither that event model nor that payload, and core carries no
+      // GitLab API client that would post the merge-request note instead, so
+      // this refuses the mode by name rather than emitting a job whose finding
+      // step fails on every pipeline.
+      throw new Error(
+        `Scheduled Op "${spec.name}" has findingMode "comment", which posts its finding on the pull request ` +
+          `that triggered the run. GitLab has no pull_request event and chant has no GitLab merge-request ` +
+          `note activity (#2231). Use findingMode "issue" or "merge-request" here, or generate this Op for ` +
+          `github.`,
+      );
+    }
+    const trigger = resolveOpTrigger(spec);
+    if (trigger.kind !== "cron") {
+      throw new Error(
+        `Scheduled Op "${spec.name}" has a "${trigger.kind}" trigger, but GitLab has no pull_request/push event model ` +
+          `(#2084) — only a project-level Pipeline Schedule (cron). Give it a cron trigger, or generate it for github/forgejo instead.`,
+      );
+    }
     const jobName = toJobName(spec.name);
-    jobs.push({ jobName, op: spec.name, schedule: spec.schedule, findingMode });
-    headerLines.push(setupLine(spec, jobName, findingMode));
+    jobs.push({ jobName, op: spec.name, trigger, findingMode });
+    headerLines.push(setupLine(spec, trigger.schedule, jobName, findingMode));
 
     const runParts = runCommand.map((part) => part.replace("{name}", spec.name));
-    const script = [...beforeScript, runParts.join(" "), ...extraScript];
+    const script = [...setupScript, ...beforeScript, runParts.join(" "), ...extraScript];
 
     doc[jobName] = {
       stage: STAGE,

package/src/components/generate-pipeline.test.ts

@@ -186,7 +186,7 @@ describe("generateGitlabPipeline: a cross-cutting change is one generator edit,
   test("changing the trigger command (runCommand) updates every job's script uniformly", () => {
     const components = pilotComponents();
     const result = generateGitlabPipeline(components, {
-      runCommand: ["chant", "run", "--components", "{name}", "--env", "staging", "--temporal"],
+      runCommand: ["chant", "run", "--components", "{name}", "--env", "staging", "--verbose"],
     });
     const parsed = parseYAML(result.yaml);
 
@@ -194,7 +194,7 @@ describe("generateGitlabPipeline: a cross-cutting change is one generator edit,
       const script = (parsed[job.jobName] as Record<string, unknown>).script as string[];
       // The runCommand prefix reflects in every job; output-threading flags
       // (--seed-outputs/--dump-outputs) may be appended per the dependency graph.
-      expect(script[0].startsWith(`chant run --components ${job.component} --env staging --temporal`)).toBe(true);
+      expect(script[0].startsWith(`chant run --components ${job.component} --env staging --verbose`)).toBe(true);
     }
   });
 

package/src/index.ts

@@ -7,9 +7,8 @@ export { gitlabPlugin } from "./plugin";
 // Typed Op step-builder wrapper (chant #1288 Stage 2) — gitlabPipeline with
 // authoring-time types derived from this lexicon's own GitlabPipelineArgs
 // (see lexicons/k8s/src/op/builders.ts's module doc for why this lives here
-// rather than in core or the temporal barrel). Opt-in:
-// `@intentius/chant-lexicon-temporal`'s same-named export is core's original
-// untyped builder, unchanged, for cloud-agnostic authoring.
+// rather than in core). Opt-in: `@intentius/chant/op`'s same-named export is
+// core's original untyped builder, unchanged, for cloud-agnostic authoring.
 export { gitlabPipeline } from "./op/builders";
 
 // Intrinsics

package/src/lint/audit-catalog.ts

@@ -2,7 +2,8 @@
  * The gitlab lexicon's chant audit catalog — metadata for its post-synth rules
  * (WGL GitLab CI rules). Contributed via gitlabPlugin.auditCatalog() (#687).
  */
-import { auditRule, GH_INJECTION, GH_OIDC, GH_PWN, GH_SECRETS, SCORECARD_PINNED, type RuleMeta } from "@intentius/chant/audit/catalog";
+import { auditRule, GH_INJECTION, GH_OIDC, GH_PWN, GH_SECRETS, SCORECARD_PINNED, type RuleMeta, applyLineage } from "@intentius/chant/audit/catalog";
+import { gitlabAuditLineage } from "./audit-lineage";
 
 export const gitlabAuditCatalog: Record<string, RuleMeta> = {
   WGL010: auditRule("WGL010", "merge-worthy", "guidance", "Job references an undefined stage", "Add the stage to `stages:` or fix the job's `stage:`.", { category: "correctness" }),
@@ -50,3 +51,6 @@ export const gitlabAuditCatalog: Record<string, RuleMeta> = {
   WGL049: auditRule("WGL049", "report-only", "guidance", "Dependency install without a cache", "Add a `cache:` covering the dependency directory.", { category: "efficiency" }),
   WGL050: auditRule("WGL050", "report-only", "guidance", "Merge-request job missing interruptible", "Add `interruptible: true` so a superseded pipeline can be cancelled.", { category: "efficiency" }),
 };
+
+// Prior art credits live beside the rules in ./audit-lineage.ts (see core audit/prior-art.ts).
+applyLineage(gitlabAuditCatalog, gitlabAuditLineage);

package/src/lint/audit-lineage.ts

@@ -0,0 +1,73 @@
+/**
+ * Prior art for these audit rules: the open-source tools whose checks cover the
+ * same condition, credited per rule. See packages/core/src/audit/prior-art.ts for
+ * the registry, the relation vocabulary, and why this is credit rather than
+ * authority. Kept by hand; the prior-art sweep (scripts/prior-art-sweep.ts) reports
+ * when a credited tool's index no longer lists a rule cited here.
+ */
+import type { Lineage } from "@intentius/chant/audit/catalog";
+
+export const gitlabAuditLineage: Record<string, Lineage[]> = {
+  WGL010: [
+    { tool: "gitlab-docs", rule: "stage: supported values are the default stages or stages listed in `stages`", url: "https://docs.gitlab.com/ci/yaml/#stage", relation: "equivalent" },
+  ],
+  WGL012: [
+    { tool: "gitlab-docs", rule: "Deprecated keywords (only/except, globally-defined image/services/cache/before_script/after_script)", url: "https://docs.gitlab.com/ci/yaml/deprecated_keywords/#only--except", relation: "equivalent" },
+  ],
+  WGL013: [
+    { tool: "gitlab-docs", rule: "Error: 'job' does not exist in the pipeline (needs)", url: "https://docs.gitlab.com/ci/yaml/needs/#error-job-does-not-exist-in-the-pipeline", relation: "equivalent" },
+  ],
+  WGL014: [
+    { tool: "gitlab-docs", rule: "extends: supported values are the name(s) of another job in the pipeline", url: "https://docs.gitlab.com/ci/yaml/#extends", relation: "equivalent" },
+  ],
+  WGL016: [
+    { tool: "gitlab-docs", rule: "CI/CD variable security (secrets belong in masked/protected variables, not in .gitlab-ci.yml)", url: "https://docs.gitlab.com/ci/variables/#cicd-variable-security", relation: "overlaps" },
+  ],
+  WGL023: [
+    { tool: "gitlab-docs", rule: "Pipeline warning: Job may allow multiple pipelines to run for a single action (final `when` rule without conditions)", url: "https://docs.gitlab.com/ci/debugging/#job-may-allow-multiple-pipelines-to-run-for-a-single-action-warning", relation: "overlaps" },
+  ],
+  WGL024: [
+    { tool: "gitlab-docs", rule: "allow_failure default: true for manual jobs, false for rules:when: manual", url: "https://docs.gitlab.com/ci/yaml/#allow_failure", relation: "overlaps" },
+  ],
+  WGL025: [
+    { tool: "gitlab-docs", rule: "cache:key: all jobs with `cache` but no `cache:key` share the `default` cache", url: "https://docs.gitlab.com/ci/yaml/#cachekey", relation: "overlaps" },
+  ],
+  WGL026: [
+    { tool: "gitlab-docs", rule: "Docker-in-Docker with TLS enabled (recommended); DOCKER_TLS_CERTDIR", url: "https://docs.gitlab.com/ci/docker/docker_in_docker/#docker-in-docker-with-tls-enabled-in-the-docker-executor-recommended", relation: "overlaps" },
+  ],
+  WGL029: [
+    { tool: "gitlab-docs", rule: "include:project ref guidance: use a specific SHA hash, protected branch/tag rules", url: "https://docs.gitlab.com/ci/yaml/#includeproject", relation: "overlaps" },
+    { tool: "gitlab-docs", rule: "CI/CD component security best practices: use pinned versions (commit SHA preferred), avoid `latest`", url: "https://docs.gitlab.com/ci/components/#for-component-users", relation: "overlaps" },
+  ],
+  WGL030: [
+    { tool: "gitlab-docs", rule: "include:remote: treat as a third-party dependency; verify integrity with include:integrity", url: "https://docs.gitlab.com/ci/yaml/#includeremote", relation: "overlaps" },
+  ],
+  WGL031: [
+    { tool: "gitlab-docs", rule: "Use checksum to keep your image secure (image@sha256:digest)", url: "https://docs.gitlab.com/ci/docker/using_docker_images/#use-checksum-to-keep-your-image-secure", relation: "overlaps" },
+  ],
+  WGL033: [
+    { tool: "gitlab-docs", rule: "id_tokens: the required `aud` sub-keyword configures the aud claim", url: "https://docs.gitlab.com/ci/yaml/#id_tokens", relation: "overlaps" },
+  ],
+  WGL035: [
+    { tool: "poutine", rule: "injection", url: "https://boostsecurityio.github.io/poutine/rules/injection/", relation: "overlaps" },
+  ],
+  WGL038: [
+    { tool: "gitlab-docs", rule: "Protect a CI/CD variable (available only to protected branches/tags)", url: "https://docs.gitlab.com/ci/variables/#protect-a-cicd-variable", relation: "overlaps" },
+    { tool: "gitlab-docs", rule: "Merge request pipelines from forked projects can steal secrets in the parent project", url: "https://docs.gitlab.com/ci/pipelines/merge_request_pipelines/#use-with-forked-projects", relation: "overlaps" },
+  ],
+  WGL039: [
+    { tool: "gitlab-docs", rule: "CI/CD variable security: accidental-leak-job example (echo of $PASSWORD); mask sensitive variables", url: "https://docs.gitlab.com/ci/variables/#mask-a-cicd-variable", relation: "overlaps" },
+  ],
+  WGL044: [
+    { tool: "gitlab-docs", rule: "artifacts:public (default true: downloadable by anonymous users in public pipelines)", url: "https://docs.gitlab.com/ci/yaml/#artifactspublic", relation: "overlaps" },
+  ],
+  WGL046: [
+    { tool: "gitlab-docs", rule: "Cache key names: protected and non-protected branches do not share the cache by default", url: "https://docs.gitlab.com/ci/caching/#cache-key-names", relation: "overlaps" },
+  ],
+  WGL047: [
+    { tool: "poutine", rule: "unverified_script_exec", url: "https://boostsecurityio.github.io/poutine/rules/unverified_script_exec/", relation: "equivalent" },
+  ],
+  WGL048: [
+    { tool: "gitlab-docs", rule: "Use pipeline names (workflow:name)", url: "https://docs.gitlab.com/ci/debugging/#use-pipeline-names", relation: "overlaps" },
+  ],
+};

package/src/op/activities/gitlab.ts

@@ -1,6 +1,6 @@
 import { exec } from "node:child_process";
 import { promisify } from "node:util";
-import { safeHeartbeat, sleep } from "@intentius/chant/op";
+import { sleep } from "@intentius/chant/op";
 
 const execAsync = promisify(exec);
 
@@ -16,7 +16,7 @@ export interface GitlabPipelineArgs {
 /**
  * Trigger a GitLab CI pipeline and wait for it to complete successfully.
  * Requires `glab` CLI authenticated in the environment.
- * Uses longInfra profile — 20m timeout, heartbeat every poll.
+ * Uses the longInfra profile: 20m timeout, three attempts backing off from 30s.
  */
 export async function gitlabPipeline(args: GitlabPipelineArgs, signal?: AbortSignal): Promise<void> {
   const ref = args.ref ?? "HEAD";
@@ -34,7 +34,6 @@ export async function gitlabPipeline(args: GitlabPipelineArgs, signal?: AbortSig
   while (true) {
     if (signal?.aborted) throw new Error("gitlabPipeline aborted");
     attempt++;
-    safeHeartbeat({ step: "gitlabPipeline", project: args.name, attempt });
 
     const { stdout } = await execAsync(
       `glab ci status --project ${args.name} --format json`,

package/src/op/activities/index.ts

@@ -1,10 +1,11 @@
 /**
  * gitlab Op activities — resolved by the core activity registry when a project's
  * `chant.config.ts` lists the `gitlab` lexicon. `gitlabPipeline` triggers a
- * pipeline over the GitLab CLI with heartbeat/retry semantics; relocated from the
- * temporal lexicon (#809) so gitlab's imperative activity lives with its product.
- * The `gitlabPipeline` step builder stays in core, re-exported from the temporal
- * Op-authoring barrel like the other core builders.
+ * pipeline over the GitLab CLI and polls it to completion under the step's
+ * profile; relocated from the hosting lexicon (#809) so gitlab's imperative
+ * activity lives with its product. The `gitlabPipeline` step builder stays in
+ * core and reaches authors through `@intentius/chant/op` like the other core
+ * builders.
  */
 export { gitlabPipeline } from "./gitlab";
 export type { GitlabPipelineArgs } from "./gitlab";

package/src/op/builders.ts

@@ -7,12 +7,11 @@
  * `./activities/gitlab.ts`. `opts`'s type below IS `GitlabPipelineArgs`
  * itself (via `Omit`/`WithStepRefs`) — never a hand-restated mirror.
  *
- * `core`'s own `gitlabPipeline` (in `@intentius/chant/op`, re-exported from
- * `@intentius/chant-lexicon-temporal`) is UNCHANGED and produces a
- * byte-identical `ActivityStep` for the same inputs — purely additive, and
- * deliberately not swapped into the temporal barrel (see
+ * `core`'s own `gitlabPipeline` (in `@intentius/chant/op`) is UNCHANGED and
+ * produces a byte-identical `ActivityStep` for the same inputs — purely
+ * additive, and deliberately not swapped into core's barrel (see
  * `lexicons/k8s/src/op/builders.ts`'s module doc for why: that would make
- * temporal depend on this package at runtime). An author who wants the typed
+ * core depend on this package at runtime). An author who wants the typed
  * surface imports it from here — `@intentius/chant-lexicon-gitlab`.
  */