@intentius/chant-lexicon-gitlab 0.6.0 → 0.8.0

package/dist/index.d.ts

@@ -0,0 +1,14 @@
+export { gitlabSerializer } from "./serializer.js";
+export { gitlabPlugin } from "./plugin.js";
+export { reference, ReferenceIntrinsic } from "./intrinsics.js";
+export { CI } from "./variables.js";
+export * from "./generated/index.js";
+export { DockerBuild, NodePipeline, BunPipeline, PnpmPipeline, PythonPipeline, ReviewApp, MrPlanReport } from "./composites/index.js";
+export type { DockerBuildProps, NodePipelineProps, PythonPipelineProps, ReviewAppProps, MrPlanReportProps } from "./composites/index.js";
+export { fetchCISchema, fetchSchemas, GITLAB_SCHEMA_VERSION } from "./codegen/fetch.js";
+export { parseCISchema, gitlabShortName, gitlabServiceName } from "./codegen/parse.js";
+export type { GitLabParseResult, ParsedResource, ParsedProperty, ParsedPropertyType, ParsedEnum } from "./codegen/parse.js";
+export { generate, writeGeneratedFiles } from "./codegen/generate.js";
+export { packageLexicon } from "./codegen/package.js";
+export type { PackageOptions, PackageResult } from "./codegen/package.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAGhD,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAGxC,OAAO,EAAE,SAAS,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAG7D,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAIjC,cAAc,mBAAmB,CAAC;AAGlC,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,cAAc,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACnI,YAAY,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAGtI,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AACrF,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpF,YAAY,EAAE,iBAAiB,EAAE,cAAc,EAAE,cAAc,EAAE,kBAAkB,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAGzH,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC"}

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "42750391641456c6cc935ece1c39526f1c65f9a610cabbfe8193011ae7e87145",
+    "manifest.json": "8280f5cc822f0966f949ebb45e470ee00866edc747332a5ecf43ae8656f41a89",
     "meta.json": "931fc3246a55645b1493080bbeb160e5d205e42349e8bdca96ca243adb5f0da3",
     "types/index.d.ts": "5cd2e99f135a929b72bdd822d00d780d39b1cd407ba0cfb3d511c7ac9d667b58",
     "rules/artifact-no-expiry.ts": "3f3cabf9792cbf8207e53a25f506715466b19ec25e9c3b4d0d77fed6b2eb4542",
@@ -9,23 +9,23 @@
     "rules/missing-script.ts": "1dba062d77fa248fc02857fd08bc7789f90eefd3206e552ac63782a04b843888",
     "rules/missing-stage.ts": "ce810703cba6c8942282c4ebaeff23fe3312c4ecc362acce05baf85d0fd32ea3",
     "rules/wgl010.ts": "e9a14d5f9e4c49b1524ba5ee3746be739603125ec3c2dc4eb4b7c0bfc32581b0",
-    "rules/wgl011.ts": "15954191c836d416f27585303b24bfbe458779520212fa47e854f2214a4deef6",
-    "rules/wgl012.ts": "baf33141114cfd80316fb1f0f7cf23d8966c58d0bb7c6cd99d92166cfe7e900b",
+    "rules/wgl011.ts": "2fbb164669204ac8c3662b9c1ae156b59589913e59dd596fb38f289a0f218aaf",
+    "rules/wgl012.ts": "ec4bd3fe93d30824c74223bb4e5929e493a06561a7bd3265b68dc1ba5d734da4",
     "rules/wgl013.ts": "f1309b1c048c00684181b9488a633f44068b537fd743ac21b0ae2712478158ba",
     "rules/wgl014.ts": "acbbeec029ec7f23e74cebcd4965dae12ea991a5a29e754040edd4a0c3fd8f0c",
     "rules/wgl015.ts": "040da46b2fe8126ba18c8d44957b402a710537eca0dc05d885498022ccec006a",
     "rules/wgl016.ts": "d8bf9a371b22f37a767f92e3361d5f8e064e6dd6ba879ff1a5fc90b4b09fd304",
     "rules/wgl017.ts": "2d212de62eee4f7b086b49c92975b09d988c1ff05c2fb20cffccdc500a14e668",
-    "rules/wgl018.ts": "6ba795cb9dddcc6f3432f4ffc86f2351d9db0e7fa1a71ffb35791d3631a73bad",
-    "rules/wgl019.ts": "9bc86b3f8e8f5a4b52fffc728c15850ce89b1a5c9e6a400ced987e24fc1b56f6",
+    "rules/wgl018.ts": "dba1e1357becb1bbea9b435d9ce88b12138a53d8fc934483bc0ec8f22e4b18f5",
+    "rules/wgl019.ts": "d54038ed7b24ac8e8d59efba9645ef435fe090647138fff1946443dcd75ebfd1",
     "rules/wgl020.ts": "81a84b49308f36ab2b01342bd0e262b59b2a8395d233760ac52a679c2a4ae0e6",
     "rules/wgl021.ts": "59a75e0b0123779bcd4c7f66eb068c4302860df8333a4bc7b41c68e3983505da",
-    "rules/wgl022.ts": "b901e9c5386cdcd9ac61cf94ead46ffeb08a6c0bb7b02e54e916075160c41eca",
-    "rules/wgl023.ts": "8a34c5bd5cf690bc3b22c583d2fc1412cf8c9b438c0e18385ebd119983e8b8de",
-    "rules/wgl024.ts": "07db98e5e3d7419f347e9c717e834b207168df9e8d029db61e9c3e3769ca9ccf",
-    "rules/wgl025.ts": "52dbd9d363230fd5bdea0407bc3363d408dd5f750c58c83cf8d87e55568bb81c",
-    "rules/wgl026.ts": "b7d9f075aa8fc9623e28745b68c2368c223c2899641cbb7796952018717dcee5",
-    "rules/wgl027.ts": "1ff29b9101a268c58756593b0d86396b557a79527b5dc390c190ae224c12597a",
+    "rules/wgl022.ts": "96b87f8f410f5ffa6358823f4c8cb08a59166a7575166ede24e8c41b50f3be65",
+    "rules/wgl023.ts": "069ee847f09751319dc6ae6f8ff6eccb30d5c15242e526165ff98b386eb4ac3d",
+    "rules/wgl024.ts": "4665b340defd39ec627d9a12468b1f85e6a90021836baec3729acac195a6441b",
+    "rules/wgl025.ts": "2093a4e4f4e2ccdd4d6cc6f0cd389ae266ee6c36ac4189c5f597dfa2d7987cf3",
+    "rules/wgl026.ts": "3e8c0f24b065ac60f4348ba6a8435c717cc1cb113e0105b3eea7c2757bef8d8c",
+    "rules/wgl027.ts": "ba5d0e020ffda2b3adedff9aeb95c963bdfa01b4d00de6460dbd4fa535a03856",
     "rules/wgl028.ts": "f1c64eda25e2ad8da634d64a397f877a46ae8327713db5cf3193882bb9b96453",
     "rules/wgl029.ts": "f06d36689d5e5649ae4465ea3b45e6e5e797223f246c45b7cb4dab7bef09ab05",
     "rules/wgl030.ts": "6acd43eadebde694676257de0a1b1b8477f3acd8f4db3380a987fafb8d65b68f",
@@ -52,5 +52,5 @@
     "skills/chant-gitlab-migrate.md": "4853d04980560b379e5b0f7267dcb0a1e5d5879cb9e9931681ce76b2a5fe69d8",
     "skills/chant-gitlab-patterns.md": "6d9a44e9e8de4c3820be9d65381b0d2ede4cb3626aaaf0011e21838a9fbf556e"
   },
-  "composite": "6a2610f0bbceebd8efe4b2a60d556eac296bcbfa9c3da9f4947cb93157ff701e"
+  "composite": "37c0127c26164d77a012a046f7d699d94f491d5bf9b1e5584f381f3615e3b562"
 }

package/dist/intrinsics.d.ts

@@ -0,0 +1,30 @@
+/**
+ * GitLab CI/CD intrinsic functions.
+ *
+ * GitLab CI has a single intrinsic: the !reference tag.
+ * CI/CD variables ($CI_*) are just strings, not intrinsic functions.
+ */
+import { INTRINSIC_MARKER, type Intrinsic } from "@intentius/chant/intrinsic";
+/**
+ * !reference tag intrinsic.
+ * References another job's properties: !reference [job_name, key]
+ */
+export declare class ReferenceIntrinsic implements Intrinsic {
+    readonly [INTRINSIC_MARKER]: true;
+    private path;
+    constructor(...path: string[]);
+    toJSON(): string[];
+    /**
+     * YAML representation uses the !reference tag.
+     */
+    toYAML(): {
+        tag: "!reference";
+        value: string[];
+    };
+}
+/**
+ * Create a !reference intrinsic.
+ * Usage: reference("job_name", "script") → !reference [job_name, script]
+ */
+export declare function reference(...path: string[]): ReferenceIntrinsic;
+//# sourceMappingURL=intrinsics.d.ts.map

package/dist/intrinsics.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"intrinsics.d.ts","sourceRoot":"","sources":["../src/intrinsics.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,gBAAgB,EAAE,KAAK,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAE9E;;;GAGG;AACH,qBAAa,kBAAmB,YAAW,SAAS;IAClD,QAAQ,CAAC,CAAC,gBAAgB,CAAC,EAAG,IAAI,CAAU;IAC5C,OAAO,CAAC,IAAI,CAAW;gBAEX,GAAG,IAAI,EAAE,MAAM,EAAE;IAI7B,MAAM,IAAI,MAAM,EAAE;IAIlB;;OAEG;IACH,MAAM,IAAI;QAAE,GAAG,EAAE,YAAY,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,CAAA;KAAE;CAGjD;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,GAAG,IAAI,EAAE,MAAM,EAAE,GAAG,kBAAkB,CAE/D"}

package/dist/lint/post-synth/index.d.ts

@@ -0,0 +1,3 @@
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const postSynthChecks: PostSynthCheck[];
+//# sourceMappingURL=index.d.ts.map

package/dist/lint/post-synth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAyCvE,eAAO,MAAM,eAAe,EAAE,cAAc,EAwC3C,CAAC"}

package/dist/lint/post-synth/wgl010.d.ts

@@ -0,0 +1,9 @@
+/**
+ * WGL010: Undefined stage
+ *
+ * Detects jobs that reference a stage not declared in the `stages:` list.
+ * This will cause a pipeline validation error in GitLab.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const wgl010: PostSynthCheck;
+//# sourceMappingURL=wgl010.d.ts.map

package/dist/lint/post-synth/wgl010.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wgl010.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/wgl010.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAG9G,eAAO,MAAM,MAAM,EAAE,cA8BpB,CAAC"}

package/dist/lint/post-synth/wgl011.d.ts

@@ -0,0 +1,13 @@
+/**
+ * WGL011: Unreachable job
+ *
+ * Detects jobs where all `rules:` entries evaluate to `when: never`,
+ * making the job unreachable. This usually indicates a configuration error.
+ *
+ * Note: This is a simple static check — it only catches the obvious case
+ * where every rule has `when: "never"` literally set. Complex conditions
+ * with `if:` expressions are not evaluated.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const wgl011: PostSynthCheck;
+//# sourceMappingURL=wgl011.d.ts.map

package/dist/lint/post-synth/wgl011.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wgl011.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/wgl011.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAG9G,eAAO,MAAM,MAAM,EAAE,cAuCpB,CAAC"}

package/dist/lint/post-synth/wgl012.d.ts

@@ -0,0 +1,13 @@
+/**
+ * WGL012: Deprecated Property Usage
+ *
+ * Flags properties marked as deprecated in the GitLab CI schema.
+ * Sources: description text mining (keywords like "Deprecated", "legacy").
+ */
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+/**
+ * Core detection logic — exported for direct testing with synthetic data.
+ */
+export declare function checkDeprecatedProperties(ctx: PostSynthContext, deprecated: Map<string, Set<string>>): PostSynthDiagnostic[];
+export declare const wgl012: PostSynthCheck;
+//# sourceMappingURL=wgl012.d.ts.map

package/dist/lint/post-synth/wgl012.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wgl012.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/wgl012.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAgC9G;;GAEG;AACH,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,gBAAgB,EACrB,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,GACnC,mBAAmB,EAAE,CA6BvB;AAED,eAAO,MAAM,MAAM,EAAE,cAOpB,CAAC"}

package/dist/lint/post-synth/wgl013.d.ts

@@ -0,0 +1,16 @@
+/**
+ * WGL013: Invalid `needs:` Target
+ *
+ * Detects two cases in the serialized YAML:
+ * - Dangling reference: `needs:` names a job not defined in the pipeline
+ * - Self-reference: job lists itself in `needs:`
+ *
+ * Both cause GitLab pipeline validation failures.
+ *
+ * Caveat: when `include:` is present, referenced jobs may come from
+ * included files, so the check is skipped.
+ */
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+export declare function checkInvalidNeeds(ctx: PostSynthContext): PostSynthDiagnostic[];
+export declare const wgl013: PostSynthCheck;
+//# sourceMappingURL=wgl013.d.ts.map

package/dist/lint/post-synth/wgl013.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wgl013.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/wgl013.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAG9G,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,gBAAgB,GAAG,mBAAmB,EAAE,CAoC9E;AAED,eAAO,MAAM,MAAM,EAAE,cAOpB,CAAC"}

package/dist/lint/post-synth/wgl014.d.ts

@@ -0,0 +1,13 @@
+/**
+ * WGL014: Invalid `extends:` Target
+ *
+ * Detects jobs that `extends:` a template not defined in the pipeline YAML.
+ * GitLab rejects pipelines with unresolved extends references.
+ *
+ * Caveat: when `include:` is present, templates may come from
+ * included files, so the check is skipped.
+ */
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+export declare function checkInvalidExtends(ctx: PostSynthContext): PostSynthDiagnostic[];
+export declare const wgl014: PostSynthCheck;
+//# sourceMappingURL=wgl014.d.ts.map

package/dist/lint/post-synth/wgl014.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wgl014.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/wgl014.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAG9G,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,gBAAgB,GAAG,mBAAmB,EAAE,CA4BhF;AAED,eAAO,MAAM,MAAM,EAAE,cAOpB,CAAC"}

package/dist/lint/post-synth/wgl015.d.ts

@@ -0,0 +1,12 @@
+/**
+ * WGL015: Circular `needs:` Chain
+ *
+ * DFS-based cycle detection on the `needs:` dependency graph.
+ * If A needs B and B needs A, GitLab rejects the pipeline.
+ *
+ * Reports one diagnostic per cycle found, listing the full chain.
+ */
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+export declare function checkCircularNeeds(ctx: PostSynthContext): PostSynthDiagnostic[];
+export declare const wgl015: PostSynthCheck;
+//# sourceMappingURL=wgl015.d.ts.map

package/dist/lint/post-synth/wgl015.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wgl015.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/wgl015.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAG9G,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,gBAAgB,GAAG,mBAAmB,EAAE,CA+D/E;AAED,eAAO,MAAM,MAAM,EAAE,cAOpB,CAAC"}

package/dist/lint/post-synth/wgl016.d.ts

@@ -0,0 +1,10 @@
+/**
+ * WGL016: Secrets in Variables
+ *
+ * Detects hardcoded passwords, tokens, or secrets in `variables:` blocks.
+ * These should use CI/CD masked variables instead.
+ */
+import type { PostSynthCheck, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+export declare function checkSecretsInVariables(yaml: string): PostSynthDiagnostic[];
+export declare const wgl016: PostSynthCheck;
+//# sourceMappingURL=wgl016.d.ts.map

package/dist/lint/post-synth/wgl016.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wgl016.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/wgl016.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAoB,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AA0B9G,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,mBAAmB,EAAE,CAkC3E;AAED,eAAO,MAAM,MAAM,EAAE,cAYpB,CAAC"}

package/dist/lint/post-synth/wgl017.d.ts

@@ -0,0 +1,10 @@
+/**
+ * WGL017: Insecure Registry
+ *
+ * Detects Docker push/pull to non-HTTPS registries in job scripts.
+ * Using HTTP for container registries is a security risk.
+ */
+import type { PostSynthCheck, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+export declare function checkInsecureRegistry(yaml: string): PostSynthDiagnostic[];
+export declare const wgl017: PostSynthCheck;
+//# sourceMappingURL=wgl017.d.ts.map

package/dist/lint/post-synth/wgl017.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wgl017.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/wgl017.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAoB,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAK9G,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,mBAAmB,EAAE,CA2BzE;AAED,eAAO,MAAM,MAAM,EAAE,cAYpB,CAAC"}

package/dist/lint/post-synth/wgl018.d.ts

@@ -0,0 +1,9 @@
+/**
+ * WGL018: Missing Timeout
+ *
+ * Warns about jobs without an explicit `timeout:` setting.
+ * The default (1 hour) may be too long for most jobs.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const wgl018: PostSynthCheck;
+//# sourceMappingURL=wgl018.d.ts.map

package/dist/lint/post-synth/wgl018.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wgl018.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/wgl018.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAG9G,eAAO,MAAM,MAAM,EAAE,cA4BpB,CAAC"}

package/dist/lint/post-synth/wgl019.d.ts

@@ -0,0 +1,9 @@
+/**
+ * WGL019: Missing Retry on Deploy Jobs
+ *
+ * Deploy-stage jobs should have a `retry:` strategy to handle transient
+ * infrastructure failures. This is informational, not a hard requirement.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const wgl019: PostSynthCheck;
+//# sourceMappingURL=wgl019.d.ts.map

package/dist/lint/post-synth/wgl019.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wgl019.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/wgl019.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAK9G,eAAO,MAAM,MAAM,EAAE,cA+BpB,CAAC"}

package/dist/lint/post-synth/wgl020.d.ts

@@ -0,0 +1,11 @@
+/**
+ * WGL020: Duplicate Job Names
+ *
+ * Detects multiple jobs that resolve to the same kebab-case name in
+ * the serialized YAML. GitLab silently merges duplicate keys, which
+ * causes unexpected behavior.
+ */
+import type { PostSynthCheck, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+export declare function checkDuplicateJobNames(yaml: string): PostSynthDiagnostic[];
+export declare const wgl020: PostSynthCheck;
+//# sourceMappingURL=wgl020.d.ts.map

package/dist/lint/post-synth/wgl020.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wgl020.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/wgl020.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAoB,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAG9G,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,mBAAmB,EAAE,CA8B1E;AAED,eAAO,MAAM,MAAM,EAAE,cAYpB,CAAC"}

package/dist/lint/post-synth/wgl021.d.ts

@@ -0,0 +1,10 @@
+/**
+ * WGL021: Unused Variables
+ *
+ * Detects global `variables:` that are not referenced by any job script.
+ * Unused variables add noise and may indicate stale configuration.
+ */
+import type { PostSynthCheck, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+export declare function checkUnusedVariables(yaml: string): PostSynthDiagnostic[];
+export declare const wgl021: PostSynthCheck;
+//# sourceMappingURL=wgl021.d.ts.map

package/dist/lint/post-synth/wgl021.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wgl021.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/wgl021.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAoB,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAG9G,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,mBAAmB,EAAE,CAqCxE;AAED,eAAO,MAAM,MAAM,EAAE,cAYpB,CAAC"}

package/dist/lint/post-synth/wgl022.d.ts

@@ -0,0 +1,10 @@
+/**
+ * WGL022: Missing Artifacts Expiry
+ *
+ * Warns about `artifacts:` without `expire_in:`, which causes disk bloat
+ * on the GitLab instance. Default retention is "never expire" in some
+ * GitLab configurations.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const wgl022: PostSynthCheck;
+//# sourceMappingURL=wgl022.d.ts.map

package/dist/lint/post-synth/wgl022.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wgl022.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/wgl022.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAG9G,eAAO,MAAM,MAAM,EAAE,cAgCpB,CAAC"}

package/dist/lint/post-synth/wgl023.d.ts

@@ -0,0 +1,10 @@
+/**
+ * WGL023: Overly Broad Rules
+ *
+ * Flags jobs with a single rule that has only `when: always` and no
+ * conditions (no `if:`, `changes:`, etc.). This effectively disables
+ * all pipeline filtering for the job, which is usually unintended.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const wgl023: PostSynthCheck;
+//# sourceMappingURL=wgl023.d.ts.map

package/dist/lint/post-synth/wgl023.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wgl023.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/wgl023.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAG9G,eAAO,MAAM,MAAM,EAAE,cAuCpB,CAAC"}

package/dist/lint/post-synth/wgl024.d.ts

@@ -0,0 +1,10 @@
+/**
+ * WGL024: Manual Without allow_failure
+ *
+ * Warns about jobs with `when: manual` that don't set `allow_failure: true`.
+ * Without it, the manual job blocks the pipeline from progressing past
+ * its stage until someone manually triggers it.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const wgl024: PostSynthCheck;
+//# sourceMappingURL=wgl024.d.ts.map

package/dist/lint/post-synth/wgl024.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wgl024.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/wgl024.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAG9G,eAAO,MAAM,MAAM,EAAE,cAkCpB,CAAC"}

package/dist/lint/post-synth/wgl025.d.ts

@@ -0,0 +1,10 @@
+/**
+ * WGL025: Missing Cache Key
+ *
+ * Warns about `cache:` without `key:`. Without an explicit key, GitLab
+ * uses `default` as the key, which causes cache collisions between
+ * unrelated jobs sharing the same runner.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const wgl025: PostSynthCheck;
+//# sourceMappingURL=wgl025.d.ts.map

package/dist/lint/post-synth/wgl025.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wgl025.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/wgl025.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAG9G,eAAO,MAAM,MAAM,EAAE,cAqCpB,CAAC"}

package/dist/lint/post-synth/wgl026.d.ts

@@ -0,0 +1,10 @@
+/**
+ * WGL026: Privileged Services Without TLS
+ *
+ * Warns about Docker-in-Docker (DinD) services that don't set
+ * DOCKER_TLS_CERTDIR. Running DinD without TLS exposes the Docker
+ * daemon on an unencrypted socket.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const wgl026: PostSynthCheck;
+//# sourceMappingURL=wgl026.d.ts.map

package/dist/lint/post-synth/wgl026.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wgl026.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/wgl026.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAS9G,eAAO,MAAM,MAAM,EAAE,cAiDpB,CAAC"}

package/dist/lint/post-synth/wgl027.d.ts

@@ -0,0 +1,9 @@
+/**
+ * WGL027: Empty Script
+ *
+ * Detects jobs with `script: []` or scripts containing only empty strings.
+ * GitLab rejects jobs with empty scripts at pipeline validation time.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const wgl027: PostSynthCheck;
+//# sourceMappingURL=wgl027.d.ts.map

package/dist/lint/post-synth/wgl027.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wgl027.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/wgl027.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAG9G,eAAO,MAAM,MAAM,EAAE,cA2CpB,CAAC"}

package/dist/lint/post-synth/wgl028.d.ts

@@ -0,0 +1,11 @@
+/**
+ * WGL028: Redundant Needs
+ *
+ * Detects `needs:` entries that list jobs already implied by stage ordering.
+ * While not incorrect, redundant needs add noise and make the pipeline
+ * harder to maintain. This is informational only.
+ */
+import type { PostSynthCheck, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+export declare function checkRedundantNeeds(yaml: string): PostSynthDiagnostic[];
+export declare const wgl028: PostSynthCheck;
+//# sourceMappingURL=wgl028.d.ts.map

package/dist/lint/post-synth/wgl028.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wgl028.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/wgl028.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAoB,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAG9G,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,mBAAmB,EAAE,CAyCvE;AAED,eAAO,MAAM,MAAM,EAAE,cAYpB,CAAC"}

package/dist/lint/post-synth/wgl029.d.ts

@@ -0,0 +1,11 @@
+/**
+ * WGL029: Unpinned include:project / component Reference
+ *
+ * Flags an `include:project` or CI/CD `component:` resolved by a moving ref — a
+ * branch, no `ref:` at all (defaults to the project's default branch), or a
+ * floating component version — instead of a pinned tag or commit SHA. A
+ * repointed ref turns the included configuration into a supply-chain entry point.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const wgl029: PostSynthCheck;
+//# sourceMappingURL=wgl029.d.ts.map

package/dist/lint/post-synth/wgl029.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wgl029.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/wgl029.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAG9G,eAAO,MAAM,MAAM,EAAE,cA8CpB,CAAC"}

package/dist/lint/post-synth/wgl030.d.ts

@@ -0,0 +1,11 @@
+/**
+ * WGL030: Mutable or Insecure include:remote
+ *
+ * Flags `include:remote` URLs that are fetched over HTTP (no transport
+ * integrity) or over HTTPS but inherently mutable (a raw URL can be repointed
+ * at any time). Prefer `include:project` pinned to a tag/SHA, or a pinned
+ * component, over a remote URL. Generalizes WGL017 (non-HTTPS) to includes.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const wgl030: PostSynthCheck;
+//# sourceMappingURL=wgl030.d.ts.map

package/dist/lint/post-synth/wgl030.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wgl030.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/wgl030.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAG9G,eAAO,MAAM,MAAM,EAAE,cAmCpB,CAAC"}

package/dist/lint/post-synth/wgl031.d.ts

@@ -0,0 +1,11 @@
+/**
+ * WGL031: Container Image Without an Immutable Digest
+ *
+ * Flags `image:` and `services:` references that are not pinned to an immutable
+ * `@sha256:` digest. A mutable tag can be repointed to a different image after
+ * review. Images built from a variable (e.g. `$CI_REGISTRY_IMAGE:tag`) are
+ * skipped — their concrete reference is not knowable from the static config.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const wgl031: PostSynthCheck;
+//# sourceMappingURL=wgl031.d.ts.map

package/dist/lint/post-synth/wgl031.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wgl031.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/wgl031.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAG9G,eAAO,MAAM,MAAM,EAAE,cAwBpB,CAAC"}

package/dist/lint/post-synth/wgl032.d.ts

@@ -0,0 +1,12 @@
+/**
+ * WGL032: Include/Component Source Resembling a Well-Known Project
+ *
+ * Flags an `include:project` path or `component:` source that is a near-miss
+ * (edit distance 1–2) of a well-known GitLab CI source but not an exact match —
+ * a likely typo or an impersonation of the trusted project. Advisory; backed by
+ * a vendored reference list.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare function nearestKnownSource(path: string): string | undefined;
+export declare const wgl032: PostSynthCheck;
+//# sourceMappingURL=wgl032.d.ts.map

package/dist/lint/post-synth/wgl032.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wgl032.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/wgl032.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAkB9G,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAYnE;AAED,eAAO,MAAM,MAAM,EAAE,cA0BpB,CAAC"}

package/dist/lint/post-synth/wgl033.d.ts

@@ -0,0 +1,11 @@
+/**
+ * WGL033: OIDC id_token Without a Scoped Audience
+ *
+ * Flags an `id_tokens:` declaration with no `aud:` or a wildcard audience. The
+ * audience binds the minted OIDC token to a specific relying party; without it
+ * (or with `*`), a leaked token is accepted anywhere, defeating the point of
+ * short-lived federated identity. Set `aud:` to the exact audience(s) needed.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const wgl033: PostSynthCheck;
+//# sourceMappingURL=wgl033.d.ts.map

package/dist/lint/post-synth/wgl033.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wgl033.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/wgl033.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAG9G,eAAO,MAAM,MAAM,EAAE,cAyBpB,CAAC"}

package/dist/lint/post-synth/wgl034.d.ts

@@ -0,0 +1,12 @@
+/**
+ * WGL034: OIDC id_token Mintable from a Merge-Request Pipeline
+ *
+ * Flags a job that declares an `id_tokens:` (OIDC) and is reachable from
+ * merge-request pipelines. MR pipelines can be triggered by outside
+ * contributors, so a job that mints a cloud-federated token there hands fork
+ * code a path to your cloud roles. Gate OIDC jobs to protected refs, or require
+ * approval before they run.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const wgl034: PostSynthCheck;
+//# sourceMappingURL=wgl034.d.ts.map

package/dist/lint/post-synth/wgl034.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wgl034.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/wgl034.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAG9G,eAAO,MAAM,MAAM,EAAE,cA4BpB,CAAC"}

package/dist/lint/post-synth/wgl035.d.ts

@@ -0,0 +1,12 @@
+/**
+ * WGL035: Untrusted CI Variable Interpolated into a Script
+ *
+ * Flags an attacker-controllable predefined variable (branch/tag name, commit or
+ * merge-request title/description, author) referenced in a `script:` command. A
+ * crafted branch name or commit title containing shell metacharacters can break
+ * out of the command. Quote the reference and avoid using it in sensitive
+ * commands, or sanitize it first.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const wgl035: PostSynthCheck;
+//# sourceMappingURL=wgl035.d.ts.map

package/dist/lint/post-synth/wgl035.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wgl035.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/wgl035.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAI9G,eAAO,MAAM,MAAM,EAAE,cA6BpB,CAAC"}

package/dist/lint/post-synth/wgl036.d.ts

@@ -0,0 +1,14 @@
+/**
+ * WGL036: Privileged Service / Docker-in-Docker Reachable from Merge Requests
+ *
+ * Flags a job that uses Docker-in-Docker (a privileged service) and is reachable
+ * from merge-request pipelines. MR pipelines can run code from an outside
+ * contributor; a privileged DinD service shares the host daemon socket and can
+ * be used to escape the build and reach the runner. Restrict privileged services
+ * to protected refs, or require approval before such jobs run.
+ *
+ * Complements WGL026 (DinD without TLS) by adding the trust-boundary dimension.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const wgl036: PostSynthCheck;
+//# sourceMappingURL=wgl036.d.ts.map

package/dist/lint/post-synth/wgl036.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wgl036.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/wgl036.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAK9G,eAAO,MAAM,MAAM,EAAE,cA0BpB,CAAC"}

package/dist/lint/post-synth/wgl037.d.ts

@@ -0,0 +1,12 @@
+/**
+ * WGL037: Security Gate on a Regex Match of an Untrusted Ref
+ *
+ * Flags a `rules:if` that gates execution on a regex match (`=~`) over an
+ * attacker-controllable ref variable (e.g. `$CI_COMMIT_REF_NAME =~ /^release/`).
+ * An outside contributor can craft a branch name that satisfies the pattern
+ * (`release-evil`), passing a gate meant for trusted refs. Match the full ref
+ * with `==`, or gate on a protected condition instead.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const wgl037: PostSynthCheck;
+//# sourceMappingURL=wgl037.d.ts.map

package/dist/lint/post-synth/wgl037.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wgl037.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/wgl037.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAO9G,eAAO,MAAM,MAAM,EAAE,cA6BpB,CAAC"}

package/dist/lint/post-synth/wgl038.d.ts

@@ -0,0 +1,14 @@
+/**
+ * WGL038: Secret Reachable from a Merge-Request Pipeline
+ *
+ * Flags a user-defined secret-like variable (`*_PASSWORD`, `*_SECRET`,
+ * `*_TOKEN`, `*_API_KEY`, …) referenced in a job reachable from merge-request
+ * pipelines. Those pipelines can run an outside contributor's code, so a secret
+ * they can read is a secret they can exfiltrate. Gate secret-using jobs to
+ * protected refs, or make the variable protected so MR pipelines can't see it.
+ *
+ * Built-in `CI_*` variables are project-managed and excluded.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const wgl038: PostSynthCheck;
+//# sourceMappingURL=wgl038.d.ts.map

package/dist/lint/post-synth/wgl038.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wgl038.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/wgl038.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAK9G,eAAO,MAAM,MAAM,EAAE,cA8BpB,CAAC"}