@intentius/terragucci 0.4.45 → 0.4.46

package/dist/terragucci.schema.json

@@ -638,13 +638,13 @@
           "anyOf": [
             {
               "type": "string",
-              "pattern": "^(?:git-tags$|oci://[^/]+/.)"
+              "pattern": "^(?:git-tags$|oci://[^/]+/.|gitlab$|gitlab://[^/\\s]+/[^/\\s?#]+/[^\\s?#]+$|hcp://(?:[^/\\s]+\\.[^/\\s]+/)?[A-Za-z0-9_-]+$|(?:artifactory|nexus)://[^/\\s]+/[A-Za-z0-9._-]+(?:/[A-Za-z0-9_-]+)?$)"
             },
             {
               "type": "array",
               "items": {
                 "type": "string",
-                "pattern": "^(?:git-tags$|oci://[^/]+/.)"
+                "pattern": "^(?:git-tags$|oci://[^/]+/.|gitlab$|gitlab://[^/\\s]+/[^/\\s?#]+/[^\\s?#]+$|hcp://(?:[^/\\s]+\\.[^/\\s]+/)?[A-Za-z0-9_-]+$|(?:artifactory|nexus)://[^/\\s]+/[A-Za-z0-9._-]+(?:/[A-Za-z0-9_-]+)?$)"
               }
             }
           ]
@@ -669,6 +669,10 @@
         "require": {
           "const": "attested"
         },
+        "gitlab_token": {
+          "type": "string",
+          "pattern": "^[A-Za-z_][A-Za-z0-9_]*$"
+        },
         "trusted": {
           "type": "array",
           "items": {
@@ -743,6 +747,46 @@
                 "git-tags",
                 "oci"
               ]
+            },
+            "edge": {
+              "enum": [
+                "cloudflare",
+                "cloudfront",
+                "pages",
+                "none"
+              ]
+            },
+            "auth": {
+              "enum": [
+                "off",
+                "token"
+              ]
+            },
+            "tokens": {
+              "enum": [
+                "zip",
+                "ssm",
+                "secrets-manager"
+              ]
+            },
+            "tokens_name": {
+              "type": "string",
+              "minLength": 1
+            },
+            "tokens_region": {
+              "type": "string",
+              "pattern": "^[a-z]{2}(-[a-z]+)+-\\d$"
+            },
+            "providers": {
+              "enum": [
+                "mirror"
+              ]
+            },
+            "catalog": {
+              "enum": [
+                "on",
+                "off"
+              ]
             }
           },
           "additionalProperties": false,
@@ -1154,12 +1198,67 @@
             "type": "string",
             "pattern": "^[^\\s,;'\"]+$"
           }
+        },
+        "proxies": {
+          "type": "array",
+          "minItems": 1,
+          "items": {
+            "type": "object",
+            "properties": {
+              "artifactory": {
+                "type": "string",
+                "pattern": "^[A-Za-z0-9-]+(\\.[A-Za-z0-9-]+)*(:\\d+)?$"
+              },
+              "nexus": {
+                "type": "string",
+                "pattern": "^https?://[^/\\s]+/?$"
+              },
+              "repo": {
+                "type": "string",
+                "pattern": "^[A-Za-z0-9._-]+$"
+              },
+              "upstream": {
+                "type": "string",
+                "pattern": "^[A-Za-z0-9-]+(\\.[A-Za-z0-9-]+)*(:\\d+)?$"
+              },
+              "host": {
+                "type": "string",
+                "pattern": "^[A-Za-z0-9-]+(\\.[A-Za-z0-9-]+)*(:\\d+)?$"
+              }
+            },
+            "additionalProperties": false,
+            "required": [
+              "repo"
+            ],
+            "oneOf": [
+              {
+                "required": [
+                  "artifactory"
+                ]
+              },
+              {
+                "required": [
+                  "nexus"
+                ]
+              }
+            ]
+          }
         }
       },
       "additionalProperties": false,
       "minProperties": 1,
       "description": "Globs of the module sources and provider addresses a root may use, checked before init."
     },
+    "check": {
+      "type": "object",
+      "properties": {
+        "pre_commit": {
+          "type": "boolean"
+        }
+      },
+      "additionalProperties": false,
+      "description": "What tf-check runs beyond its own checks: the repo's pre-commit hooks."
+    },
     "atlantis_comments": {
       "type": "boolean",
       "description": "Read atlantis plan and atlantis apply comments as terragucci's."
@@ -2463,13 +2562,13 @@
               "anyOf": [
                 {
                   "type": "string",
-                  "pattern": "^(?:git-tags$|oci://[^/]+/.)"
+                  "pattern": "^(?:git-tags$|oci://[^/]+/.|gitlab$|gitlab://[^/\\s]+/[^/\\s?#]+/[^\\s?#]+$|hcp://(?:[^/\\s]+\\.[^/\\s]+/)?[A-Za-z0-9_-]+$|(?:artifactory|nexus)://[^/\\s]+/[A-Za-z0-9._-]+(?:/[A-Za-z0-9_-]+)?$)"
                 },
                 {
                   "type": "array",
                   "items": {
                     "type": "string",
-                    "pattern": "^(?:git-tags$|oci://[^/]+/.)"
+                    "pattern": "^(?:git-tags$|oci://[^/]+/.|gitlab$|gitlab://[^/\\s]+/[^/\\s?#]+/[^\\s?#]+$|hcp://(?:[^/\\s]+\\.[^/\\s]+/)?[A-Za-z0-9_-]+$|(?:artifactory|nexus)://[^/\\s]+/[A-Za-z0-9._-]+(?:/[A-Za-z0-9_-]+)?$)"
                   }
                 }
               ]
@@ -2494,6 +2593,10 @@
             "require": {
               "const": "attested"
             },
+            "gitlab_token": {
+              "type": "string",
+              "pattern": "^[A-Za-z_][A-Za-z0-9_]*$"
+            },
             "trusted": {
               "type": "array",
               "items": {
@@ -2568,6 +2671,46 @@
                     "git-tags",
                     "oci"
                   ]
+                },
+                "edge": {
+                  "enum": [
+                    "cloudflare",
+                    "cloudfront",
+                    "pages",
+                    "none"
+                  ]
+                },
+                "auth": {
+                  "enum": [
+                    "off",
+                    "token"
+                  ]
+                },
+                "tokens": {
+                  "enum": [
+                    "zip",
+                    "ssm",
+                    "secrets-manager"
+                  ]
+                },
+                "tokens_name": {
+                  "type": "string",
+                  "minLength": 1
+                },
+                "tokens_region": {
+                  "type": "string",
+                  "pattern": "^[a-z]{2}(-[a-z]+)+-\\d$"
+                },
+                "providers": {
+                  "enum": [
+                    "mirror"
+                  ]
+                },
+                "catalog": {
+                  "enum": [
+                    "on",
+                    "off"
+                  ]
                 }
               },
               "additionalProperties": false,
@@ -2979,12 +3122,67 @@
                 "type": "string",
                 "pattern": "^[^\\s,;'\"]+$"
               }
+            },
+            "proxies": {
+              "type": "array",
+              "minItems": 1,
+              "items": {
+                "type": "object",
+                "properties": {
+                  "artifactory": {
+                    "type": "string",
+                    "pattern": "^[A-Za-z0-9-]+(\\.[A-Za-z0-9-]+)*(:\\d+)?$"
+                  },
+                  "nexus": {
+                    "type": "string",
+                    "pattern": "^https?://[^/\\s]+/?$"
+                  },
+                  "repo": {
+                    "type": "string",
+                    "pattern": "^[A-Za-z0-9._-]+$"
+                  },
+                  "upstream": {
+                    "type": "string",
+                    "pattern": "^[A-Za-z0-9-]+(\\.[A-Za-z0-9-]+)*(:\\d+)?$"
+                  },
+                  "host": {
+                    "type": "string",
+                    "pattern": "^[A-Za-z0-9-]+(\\.[A-Za-z0-9-]+)*(:\\d+)?$"
+                  }
+                },
+                "additionalProperties": false,
+                "required": [
+                  "repo"
+                ],
+                "oneOf": [
+                  {
+                    "required": [
+                      "artifactory"
+                    ]
+                  },
+                  {
+                    "required": [
+                      "nexus"
+                    ]
+                  }
+                ]
+              }
             }
           },
           "additionalProperties": false,
           "minProperties": 1,
           "description": "Globs of the module sources and provider addresses a root may use, checked before init."
         },
+        "check": {
+          "type": "object",
+          "properties": {
+            "pre_commit": {
+              "type": "boolean"
+            }
+          },
+          "additionalProperties": false,
+          "description": "What tf-check runs beyond its own checks: the repo's pre-commit hooks."
+        },
         "atlantis_comments": {
           "type": "boolean",
           "description": "Read atlantis plan and atlantis apply comments as terragucci's."

package/dist/types.d.ts

@@ -289,6 +289,16 @@ export interface TerragruntSettings {
     credentials?: Record<string, RolePair>;
 }
 /** Atmos settings. Atmos mode is detected (`atmos.yaml` at the repo root); this block only tunes it. */
+/** `check`: what tf-check runs beyond its own checks. */
+export interface CheckSettings {
+    /**
+     * Run the repo's `.pre-commit-config.yaml` in tf-check, as a chant check
+     * hook (./pre-commit.ts), with `PCT_TFPATH` set to the binary and
+     * `terraform_fmt` skipped. Off by default; init never turns it on.
+     */
+    pre_commit?: boolean;
+}
+export declare const CHECK_KEYS: readonly ["pre_commit"];
 export interface AtmosSettings {
     /** The Atmos release every job installs. Default: the one this terragucci release pins. */
     version?: string;
@@ -626,6 +636,8 @@ export interface ProjectSettings {
     policy?: PolicySettings;
     /** The module and provider sources a root may use, checked before init; see SourcesSettings. Off when absent. */
     sources?: SourcesSettings;
+    /** What tf-check runs beyond its own checks: the repo's pre-commit hooks; see CheckSettings. */
+    check?: CheckSettings;
     /**
      * `atlantis plan` and `atlantis apply` comments read as `/terragucci plan`
      * and `/terragucci apply`. Off by default. The alias changes the words
@@ -859,6 +871,8 @@ export declare const RELEASE_VERSION: RegExp;
 export declare const NOTIFY_KEYS: string[];
 export declare const POLICY_KEYS: string[];
 export declare const SOURCES_KEYS: string[];
+/** The settings of one `sources.proxies` entry. */
+export declare const SOURCE_PROXY_KEYS: string[];
 /** One `sources` entry: a glob with no whitespace, commas, semicolons or quotes. */
 export declare const SOURCE_GLOB = "^[^\\s,;'\"]+$";
 export declare const OIDC_KEYS: string[];
@@ -885,10 +899,53 @@ export declare function agentLoginWarning(agent: {
 export declare const STEPS_MOVED = "steps are ci.hooks in chant.workspace.json now, each with a command list and perRun: true (before: init or drift is before.observe, after: init is before.plan, after: drift is after.plan, roots is targets, on_failure is onFailure); see https://intentius.io/terragucci/guides/run-steps/";
 export declare const MODULES_KEYS: Set<string>;
 export declare const REGISTRY_KEYS: string[];
+/** `modules.registry.providers`: `mirror` serves the providers the lock files pin as a network mirror under `providers/` (chant#4564). */
+export declare const REGISTRY_PROVIDERS: readonly ["mirror"];
+/** `modules.registry.catalog`: the release catalog under `catalog/` beside the registry's files (terragucci#1297). `on` by default; `off` writes none. */
+export declare const REGISTRY_CATALOG: readonly ["on", "off"];
+/**
+ * `modules.registry.edge`: what sends Terraform the X-Terraform-Get header a
+ * stored download answer cannot carry (terragucci#1287). `cloudflare` is a
+ * Worker, `cloudfront` a Lambda@Edge function, `pages` a `_headers` file for
+ * Cloudflare Pages or Netlify, and `none` serves the files as they are, which
+ * OpenTofu reads and Terraform does not.
+ */
+export declare const REGISTRY_EDGES: readonly ["cloudflare", "cloudfront", "pages", "none"];
+export type RegistryEdge = (typeof REGISTRY_EDGES)[number];
+/** `modules.registry.auth`: `token` has the edge function check each reader's bearer token. Default `off`. */
+export declare const REGISTRY_AUTHS: readonly ["off", "token"];
+export type RegistryAuth = (typeof REGISTRY_AUTHS)[number];
+/**
+ * `modules.registry.tokens`: where Lambda@Edge reads the accepted tokens
+ * (chant#4590). `zip` builds them into the function's options file (the
+ * default); `ssm` reads an SSM parameter and `secrets-manager` a secret at run
+ * time, so rotation needs no redeploy and no token reaches `registry-edge.json`.
+ */
+export declare const REGISTRY_TOKENS: readonly ["zip", "ssm", "secrets-manager"];
+export type RegistryTokens = (typeof REGISTRY_TOKENS)[number];
+/** The region the token store is read from when `tokens_region` is unset: where Lambda@Edge functions are created. */
+export declare const REGISTRY_TOKENS_REGION = "us-east-1";
+/**
+ * The edge preset a registry gets when `edge` is unset, picked by where its
+ * files are: a dir deploys to a Pages site, so `pages`; an R2 bucket (an
+ * endpoint on r2.cloudflarestorage.com) and a GCS or Azure bucket get a
+ * Cloudflare Worker; any other S3 bucket gets CloudFront's Lambda@Edge.
+ */
+export declare function registryEdge(reg: Pick<RegistrySettings, "edge" | "dir" | "bucket" | "endpoint">): RegistryEdge;
 /** A registry namespace or module name, as the Terraform module registry protocol allows them. */
 export declare const REGISTRY_NAME: RegExp;
 /** A registry module's system (its target provider): lower-case letters and digits. */
 export declare const REGISTRY_SYSTEM: RegExp;
+/**
+ * A GitLab module registry in `modules.publish` (terragucci#1300): `gitlab`,
+ * the project a GitLab CI job runs in, or `gitlab://<host>/<project path>`.
+ */
+export declare const gitlabPublishForm: RegExp;
+export declare const isGitlabTarget: (t: string) => boolean;
+/** HCP Terraform's private registry in `modules.publish` (terragucci#1301): `hcp://<org>`, or `hcp://<host>/<org>` for Terraform Enterprise. */
+export declare const hcpPublishForm: RegExp;
+/** An Artifactory or Nexus hosted repository in `modules.publish` (terragucci#1302): `<kind>://<host>/<repository>[/<namespace>]`. */
+export declare const repositoryPublishForm: RegExp;
 /** A publisher in another repo whose releases `modules.require: attested` checks. */
 export interface TrustedModuleSource {
     /** How the roots' module sources begin: an `oci://` prefix, or the publisher's git URL with or without `git::`. */
@@ -913,7 +970,11 @@ export interface ModulesSettings {
     test?: boolean;
     /** Write each release as the Terraform module registry protocol, as static files a bucket or a Pages site serves. */
     registry?: RegistrySettings;
+    /** The secret holding a GitLab token with the api scope, which a GitHub or Forgejo publish job passes as `GITLAB_TOKEN` for a `gitlab://` target. Default `GITLAB_TOKEN`. */
+    gitlab_token?: string;
 }
+/** The secret a GitHub or Forgejo publish job reads the GitLab token from, when `modules.publish` names a `gitlab://` project; undefined when it names none. */
+export declare function gitlabPublishToken(m: ModulesSettings | undefined): string | undefined;
 /**
  * `sources`: the module and provider sources a root may use (./sources.ts).
  * A list that is set refuses every source of its kind that no glob in it
@@ -925,6 +986,24 @@ export interface SourcesSettings {
     modules?: string[];
     /** Globs of provider addresses, such as `hashicorp/*` or `registry.example.com/acme/*`. */
     providers?: string[];
+    /** Registry proxies a source may be written through, each standing for its upstream (terragucci#1302). */
+    proxies?: SourceProxy[];
+}
+/**
+ * One `sources.proxies` entry: an Artifactory remote or virtual Terraform
+ * repository (`artifactory: <host>`), or a Nexus proxy or group Terraform
+ * repository (`nexus: <https url>`), each with its repository and the
+ * upstream it stands for. A source written through one matches the globs as
+ * its upstream form, and `modules.require` reads through it.
+ */
+export interface SourceProxy {
+    artifactory?: string;
+    nexus?: string;
+    repo: string;
+    /** The registry host the proxy stands for. Default registry.terraform.io. */
+    upstream?: string;
+    /** Nexus: the label of the consumers' CLI `host` block. Default the upstream. */
+    host?: string;
 }
 /** `modules.registry`: the module registry protocol as static files. */
 export interface RegistrySettings {
@@ -946,6 +1025,20 @@ export interface RegistrySettings {
     system?: string;
     /** What a version's download points at: a tarball beside it (the default), its git tag, or its OCI artifact. */
     download?: "tarball" | "git-tags" | "oci";
+    /** What adds the X-Terraform-Get header Terraform reads: a Cloudflare Worker, CloudFront's Lambda@Edge, a Pages `_headers` file, or nothing. Default: picked from `bucket`, `endpoint` or `dir` (registryEdge). */
+    edge?: RegistryEdge;
+    /** `token`: the edge function refuses a read without one of its bearer tokens and signs tarball URLs. Default `off`. */
+    auth?: RegistryAuth;
+    /** Where CloudFront's Lambda@Edge reads the accepted tokens with `auth: token`: `zip` (built into the function, the default), `ssm` or `secrets-manager`. */
+    tokens?: RegistryTokens;
+    /** The SSM parameter's name or the secret's name or ARN, for `tokens: ssm` or `secrets-manager`. */
+    tokens_name?: string;
+    /** The token store's region. Default us-east-1. */
+    tokens_region?: string;
+    /** `mirror`: publish also serves every provider the lock files pin as a provider network mirror under `providers/`. */
+    providers?: (typeof REGISTRY_PROVIDERS)[number];
+    /** `off`: publish writes no release catalog under `catalog/`. Default `on`. */
+    catalog?: (typeof REGISTRY_CATALOG)[number];
 }
 /** Why a control repo's projects take no `rollouts` job: each project's pipeline sees only its own roots. */
 /** Why `waves.compose` is refused in a Terragrunt repo. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/terragucci",
-  "version": "0.4.45",
+  "version": "0.4.46",
   "description": "The whole Terraform lifecycle, handled: one config file, generated pipelines for GitHub, GitLab and Forgejo.",
   "license": "Apache-2.0",
   "type": "module",
@@ -36,7 +36,7 @@
     "build": "node ../../scripts/build-cli.mjs"
   },
   "dependencies": {
-    "@intentius/chant": "0.124.52"
+    "@intentius/chant": "0.124.55"
   },
   "peerDependencies": {
     "@intentius/tsad-reference": "2.x",
@@ -52,10 +52,10 @@
   },
   "devDependencies": {
     "@cdktn/hcl2json": "0.24.0",
-    "@intentius/chant-lexicon-forgejo": "0.124.52",
-    "@intentius/chant-lexicon-github": "0.124.52",
-    "@intentius/chant-lexicon-gitlab": "0.124.52",
-    "@intentius/chant-lexicon-terraform": "0.124.52",
+    "@intentius/chant-lexicon-forgejo": "0.124.55",
+    "@intentius/chant-lexicon-github": "0.124.55",
+    "@intentius/chant-lexicon-gitlab": "0.124.55",
+    "@intentius/chant-lexicon-terraform": "0.124.55",
     "@intentius/tsad-reference": "2.1.0",
     "@modelcontextprotocol/sdk": "1.30.1"
   }