@intentius/chant-lexicon-gitlab 0.58.0 → 0.59.0

package/dist/components/generate-op-pipeline.d.ts

@@ -22,10 +22,36 @@
  * inlined audit/reconcile logic. The finding-mode itself is already baked
  * into the Op's own activity args at build time by the composite that
  * created it; GitLab has no per-job `permissions:` concept (unlike GitHub
- * Actions), so a non-`report` mode's write access comes from whatever
+ * Actions), and `findingMode: "comment"` is refused by name here because it
+ * posts onto a GitHub pull-request event GitLab does not have (#2231), so a
+ * non-`report` mode's write access comes from whatever
  * `GITLAB_TOKEN`/CI-CD-variable configuration the project already has —
  * this generator documents the requirement rather than fabricating a
  * variable nothing reads.
+ *
+ * Neither of #2242's two per-Op options survives the crossing, and both are
+ * refused by name rather than dropped. A `setup` entry spelled `{ uses }` is
+ * a GitHub Actions marketplace action; GitLab CI has `script` and nothing
+ * else, so there is no shape to translate it into and no way to approximate
+ * `aws-actions/configure-aws-credentials` in a shell line. A `{ run }` entry
+ * translates exactly, and is emitted ahead of the `beforeScript` lines, the
+ * same position the github generator gives it. An additive `permissions` map
+ * is refused for the same reason `permissions:` is absent here at all: GitLab
+ * has no per-job token-scope mapping, and its OIDC surface is a different
+ * declaration (`id_tokens:` with an `aud`, exchanged for cloud credentials by
+ * the job itself) that chant does not generate. Ignoring the map would emit a
+ * job that reads as having OIDC and runs with no credentials.
+ *
+ * The gated-apply mapping (#2243) has nothing to attach to here. It exists
+ * because a push-to-main apply that stops at its gate exits 3 and paints the
+ * branch red on every merge; this generator has no push pipeline at all,
+ * refusing a `push` trigger by name (#2084) because a GitLab schedule is a
+ * project-level cron object rather than an event. GitLab does have its own
+ * equivalent of the mapping should one ever be wanted — `allow_failure:
+ * { exit_codes: [3] }` turns one exit code into a warning rather than a
+ * failure, without a flag on the invocation — so the day this generator
+ * grows a push trigger, that is the shape to reach for rather than
+ * `--gated-exit`.
  */
 import type { ComponentPipelineOptions as GenerateGitlabOpOptions, OpPipelineResult as GenerateGitlabOpResult, ScheduledOpSpec } from "@intentius/chant/lexicon";
 export type { GenerateGitlabOpOptions, GenerateGitlabOpResult };

package/dist/components/generate-op-pipeline.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generate-op-pipeline.d.ts","sourceRoot":"","sources":["../../src/components/generate-op-pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAIH,OAAO,KAAK,EACV,wBAAwB,IAAI,uBAAuB,EAGnD,gBAAgB,IAAI,sBAAsB,EAC1C,eAAe,EAChB,MAAM,0BAA0B,CAAC;AAElC,YAAY,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,CAAC;AAmBhE;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,eAAe,EAAE,EACtB,OAAO,GAAE,uBAA4B,GACpC,sBAAsB,CAoDxB"}
+{"version":3,"file":"generate-op-pipeline.d.ts","sourceRoot":"","sources":["../../src/components/generate-op-pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AAIH,OAAO,KAAK,EACV,wBAAwB,IAAI,uBAAuB,EAGnD,gBAAgB,IAAI,sBAAsB,EAC1C,eAAe,EAChB,MAAM,0BAA0B,CAAC;AAiClC,YAAY,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,CAAC;AAmBhE;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,eAAe,EAAE,EACtB,OAAO,GAAE,uBAA4B,GACpC,sBAAsB,CAmExB"}

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "35158c32b55ed8f86ec453b7575d06fd8005641a5edb2ad972f0f4cf06fccd7e",
+    "manifest.json": "05eca8e8e24c1045cd8d1b9903dfa59661449d40b52b9d2f880eb2a5a00c67d2",
     "meta.json": "931fc3246a55645b1493080bbeb160e5d205e42349e8bdca96ca243adb5f0da3",
     "types/index.d.ts": "5cd2e99f135a929b72bdd822d00d780d39b1cd407ba0cfb3d511c7ac9d667b58",
     "rules/artifact-no-expiry.ts": "3f3cabf9792cbf8207e53a25f506715466b19ec25e9c3b4d0d77fed6b2eb4542",
@@ -55,5 +55,5 @@
     "skills/chant-gitlab-migrate.md": "4853d04980560b379e5b0f7267dcb0a1e5d5879cb9e9931681ce76b2a5fe69d8",
     "skills/chant-gitlab-patterns.md": "6d9a44e9e8de4c3820be9d65381b0d2ede4cb3626aaaf0011e21838a9fbf556e"
   },
-  "composite": "59706e7a6edf95b2ecec5fe2220d0899b0282322ef921583a940a03fb623e7c0"
+  "composite": "5ba4e358f25944a07f0966355b274aebb3c199d11fc997aa7713830c7ff5320e"
 }

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "gitlab",
-  "version": "0.58.0",
+  "version": "0.59.0",
   "chantVersion": ">=0.1.0",
   "namespace": "GitLab",
   "intrinsics": [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-gitlab",
-  "version": "0.58.0",
+  "version": "0.59.0",
   "description": "GitLab CI lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -67,8 +67,8 @@
     "typescript": "^5.9.3"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.58.0",
-    "@intentius/chant-lexicon-github": "^0.58.0",
+    "@intentius/chant": "^0.59.0",
+    "@intentius/chant-lexicon-github": "^0.59.0",
     "typescript": "^5.9.3"
   },
   "peerDependenciesMeta": {

package/src/components/generate-op-pipeline.test.ts

@@ -82,6 +82,24 @@ describe("generateGitlabOpPipeline: no pull_request/push event model (#2084)", (
   });
 });
 
+describe("generateGitlabOpPipeline: no comment finding mode (#2231)", () => {
+  test("findingMode comment is refused by name, even on a cron trigger GitLab does support", () => {
+    const specs: ScheduledOpSpec[] = [
+      { name: "app-plan", schedule: "0 6 * * *", findingMode: "comment" },
+    ];
+    expect(() => generateGitlabOpPipeline(specs)).toThrow(
+      /Scheduled Op "app-plan".*findingMode "comment".*GitLab has no pull_request event/s,
+    );
+  });
+
+  test("the refusal names the modes GitLab does have", () => {
+    const specs: ScheduledOpSpec[] = [{ name: "app-plan", schedule: "0 6 * * *", findingMode: "comment" }];
+    expect(() => generateGitlabOpPipeline(specs)).toThrow(
+      /findingMode "issue" or "merge-request"/,
+    );
+  });
+});
+
 describe("generateGitlabOpPipeline: a cross-cutting change is one generator edit, not per-job", () => {
   test("runCommand/beforeScript/extraScript apply uniformly across every job", () => {
     const specs: ScheduledOpSpec[] = [
@@ -104,3 +122,50 @@ describe("generateGitlabOpPipeline: a cross-cutting change is one generator edit
     }
   });
 });
+
+/**
+ * #2242's two per-Op options against a provider that has neither concept.
+ * Both degrade by name at build time rather than being dropped into a job
+ * that would run without the thing the option asked for.
+ */
+describe("generateGitlabOpPipeline: setup steps and additive permissions (#2242)", () => {
+  test("refuses a `uses` setup step by name, and names the action", () => {
+    expect(() =>
+      generateGitlabOpPipeline([
+        {
+          name: "actions-audit",
+          schedule: "0 6 * * *",
+          setup: [{ uses: "aws-actions/configure-aws-credentials@v6" }],
+        },
+      ]),
+    ).toThrow(/setup step 1 is `uses: "aws-actions\/configure-aws-credentials@v6"`.*GitLab CI jobs run/s);
+  });
+
+  test("emits a `run` setup entry ahead of the beforeScript lines", () => {
+    const result = generateGitlabOpPipeline(
+      [
+        {
+          name: "actions-audit",
+          schedule: "0 6 * * *",
+          setup: [{ run: "aws sts get-caller-identity" }],
+        },
+      ],
+      { beforeScript: ["npm ci"], extraScript: ["echo done"] },
+    );
+    const job = parseYAML(result.files[0].yaml)["actions-audit"] as { script: string[] };
+    expect(job.script).toEqual([
+      "aws sts get-caller-identity",
+      "npm ci",
+      "chant run actions-audit",
+      "echo done",
+    ]);
+  });
+
+  test("refuses additive permissions by name, and points at GitLab's own OIDC surface", () => {
+    expect(() =>
+      generateGitlabOpPipeline([
+        { name: "actions-audit", schedule: "0 6 * * *", permissions: { "id-token": "write" } },
+      ]),
+    ).toThrow(/adds permissions \{ id-token: write \}.*id_tokens:/s);
+  });
+});

package/src/components/generate-op-pipeline.ts

@@ -22,10 +22,36 @@
  * inlined audit/reconcile logic. The finding-mode itself is already baked
  * into the Op's own activity args at build time by the composite that
  * created it; GitLab has no per-job `permissions:` concept (unlike GitHub
- * Actions), so a non-`report` mode's write access comes from whatever
+ * Actions), and `findingMode: "comment"` is refused by name here because it
+ * posts onto a GitHub pull-request event GitLab does not have (#2231), so a
+ * non-`report` mode's write access comes from whatever
  * `GITLAB_TOKEN`/CI-CD-variable configuration the project already has —
  * this generator documents the requirement rather than fabricating a
  * variable nothing reads.
+ *
+ * Neither of #2242's two per-Op options survives the crossing, and both are
+ * refused by name rather than dropped. A `setup` entry spelled `{ uses }` is
+ * a GitHub Actions marketplace action; GitLab CI has `script` and nothing
+ * else, so there is no shape to translate it into and no way to approximate
+ * `aws-actions/configure-aws-credentials` in a shell line. A `{ run }` entry
+ * translates exactly, and is emitted ahead of the `beforeScript` lines, the
+ * same position the github generator gives it. An additive `permissions` map
+ * is refused for the same reason `permissions:` is absent here at all: GitLab
+ * has no per-job token-scope mapping, and its OIDC surface is a different
+ * declaration (`id_tokens:` with an `aud`, exchanged for cloud credentials by
+ * the job itself) that chant does not generate. Ignoring the map would emit a
+ * job that reads as having OIDC and runs with no credentials.
+ *
+ * The gated-apply mapping (#2243) has nothing to attach to here. It exists
+ * because a push-to-main apply that stops at its gate exits 3 and paints the
+ * branch red on every merge; this generator has no push pipeline at all,
+ * refusing a `push` trigger by name (#2084) because a GitLab schedule is a
+ * project-level cron object rather than an event. GitLab does have its own
+ * equivalent of the mapping should one ever be wanted — `allow_failure:
+ * { exit_codes: [3] }` turns one exit code into a warning rather than a
+ * failure, without a flag on the invocation — so the day this generator
+ * grows a push trigger, that is the shape to reach for rather than
+ * `--gated-exit`.
  */
 
 import { emitYAML } from "@intentius/chant/yaml";
@@ -38,6 +64,37 @@ import type {
   ScheduledOpSpec,
 } from "@intentius/chant/lexicon";
 
+/**
+ * Refuse the two #2242 options GitLab cannot honour, by name and before any
+ * YAML exists, and return the `run` setup lines that do translate. See the
+ * module doc for why each one is a refusal rather than a silent drop.
+ */
+function gitlabSetupScript(spec: ScheduledOpSpec): string[] {
+  if (spec.permissions && Object.keys(spec.permissions).length > 0) {
+    const scopes = Object.entries(spec.permissions)
+      .map(([scope, value]) => `${scope}: ${value}`)
+      .join(", ");
+    throw new Error(
+      `Scheduled Op "${spec.name}" adds permissions { ${scopes} }, but GitLab CI has no per-job token-scope ` +
+        `mapping — there is no \`permissions:\` key to add them to (#2242). Its OIDC surface is a separate ` +
+        `\`id_tokens:\` declaration the job exchanges for cloud credentials itself, which chant does not ` +
+        `generate. Drop the option here, or generate this Op for github.`,
+    );
+  }
+  const lines: string[] = [];
+  (spec.setup ?? []).forEach((step, index) => {
+    if ("uses" in step) {
+      throw new Error(
+        `Scheduled Op "${spec.name}" setup step ${index + 1} is \`uses: "${step.uses}"\`, a GitHub Actions ` +
+          `marketplace action. GitLab CI jobs run \`script\` lines only, so there is nothing to translate it ` +
+          `into (#2242). Express the setup as a \`{ run }\` entry, or generate this Op for github/forgejo.`,
+      );
+    }
+    lines.push(step.run);
+  });
+  return lines;
+}
+
 export type { GenerateGitlabOpOptions, GenerateGitlabOpResult };
 
 /** GitLab CI job names must be safe YAML keys; Op names are already kebab-case in every fixture, but normalize defensively (mirrors `./generate-pipeline.ts`'s `toJobName`). */
@@ -85,7 +142,22 @@ export function generateGitlabOpPipeline(
   ];
 
   for (const spec of ops) {
+    const setupScript = gitlabSetupScript(spec);
     const findingMode = spec.findingMode ?? "report";
+    if (findingMode === "comment") {
+      // The mode posts onto the pull request that triggered the run (#2231),
+      // read out of the GitHub Actions event payload by `reconcilePr`. GitLab
+      // has neither that event model nor that payload, and core carries no
+      // GitLab API client that would post the merge-request note instead, so
+      // this refuses the mode by name rather than emitting a job whose finding
+      // step fails on every pipeline.
+      throw new Error(
+        `Scheduled Op "${spec.name}" has findingMode "comment", which posts its finding on the pull request ` +
+          `that triggered the run. GitLab has no pull_request event and chant has no GitLab merge-request ` +
+          `note activity (#2231). Use findingMode "issue" or "merge-request" here, or generate this Op for ` +
+          `github.`,
+      );
+    }
     const trigger = resolveOpTrigger(spec);
     if (trigger.kind !== "cron") {
       throw new Error(
@@ -98,7 +170,7 @@ export function generateGitlabOpPipeline(
     headerLines.push(setupLine(spec, trigger.schedule, jobName, findingMode));
 
     const runParts = runCommand.map((part) => part.replace("{name}", spec.name));
-    const script = [...beforeScript, runParts.join(" "), ...extraScript];
+    const script = [...setupScript, ...beforeScript, runParts.join(" "), ...extraScript];
 
     doc[jobName] = {
       stage: STAGE,