feat(linter): add GL046-GL049 rules, AND-group support, and GL032 fix

- GL046: validate image/service pull_policy values (always, if-not-present, never)
- GL047: error when a variables.options default value is not in the options list
- GL048: error on unrecognised trigger.forward keys
- GL049: validate rules[n].allow_failure (bool or {exit_codes:} map)
- Parse and evaluate workflow.rules/job.rules nested-array AND-groups; crash
  on !!seq nodes is fixed; all members of a group must match for it to fire
- Add workflow.name and workflow.auto_cancel fields to Workflow struct
- Fix GL032 false positive: variables declared in any workflow rule's variables:
  block no longer trigger an undeclared-variable warning in sibling workflow
  rule if: expressions
- Add Windows ARM64 release build target (task build-windows-arm64)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.gitea/workflows/release.yml

@@ -32,18 +32,64 @@ jobs:
           GOARCH: amd64
           CGO_ENABLED: "0"
         run: |
-          go build -trimpath -ldflags="-s -w" \
+          go build -trimpath \
+            -ldflags="-s -w -X main.version=${{ github.ref_name }}" \
             -o glint-${{ github.ref_name }}-linux-amd64 \
             ./cmd/glint/...
 
+      - name: Build Linux (arm64)
+        env:
+          GOOS: linux
+          GOARCH: arm64
+          CGO_ENABLED: "0"
+        run: |
+          go build -trimpath \
+            -ldflags="-s -w -X main.version=${{ github.ref_name }}" \
+            -o glint-${{ github.ref_name }}-linux-arm64 \
+            ./cmd/glint/...
+
+      - name: Build macOS (amd64)
+        env:
+          GOOS: darwin
+          GOARCH: amd64
+          CGO_ENABLED: "0"
+        run: |
+          go build -trimpath \
+            -ldflags="-s -w -X main.version=${{ github.ref_name }}" \
+            -o glint-${{ github.ref_name }}-darwin-amd64 \
+            ./cmd/glint/...
+
+      - name: Build macOS (arm64)
+        env:
+          GOOS: darwin
+          GOARCH: arm64
+          CGO_ENABLED: "0"
+        run: |
+          go build -trimpath \
+            -ldflags="-s -w -X main.version=${{ github.ref_name }}" \
+            -o glint-${{ github.ref_name }}-darwin-arm64 \
+            ./cmd/glint/...
+
       - name: Build Windows (amd64)
         env:
           GOOS: windows
           GOARCH: amd64
           CGO_ENABLED: "0"
         run: |
-          go build -trimpath -ldflags="-s -w" \
+          go build -trimpath \
-            -o glint-${{ github.ref_name }}.exe \
+            -ldflags="-s -w -X main.version=${{ github.ref_name }}" \
+            -o glint-${{ github.ref_name }}-windows-amd64.exe \
+            ./cmd/glint/...
+
+      - name: Build Windows (arm64)
+        env:
+          GOOS: windows
+          GOARCH: arm64
+          CGO_ENABLED: "0"
+        run: |
+          go build -trimpath \
+            -ldflags="-s -w -X main.version=${{ github.ref_name }}" \
+            -o glint-${{ github.ref_name }}-windows-arm64.exe \
             ./cmd/glint/...
 
       - name: Create release and upload assets
@@ -60,7 +106,13 @@ jobs:
             -d "{\"tag_name\":\"$TAG\",\"name\":\"$TAG\",\"draft\":false,\"prerelease\":false}" \
             | jq -r .id)
 
-          for file in glint-${{ github.ref_name }}-linux-amd64 glint-${{ github.ref_name }}.exe; do
+          for file in \
+            glint-${TAG}-linux-amd64 \
+            glint-${TAG}-linux-arm64 \
+            glint-${TAG}-darwin-amd64 \
+            glint-${TAG}-darwin-arm64 \
+            glint-${TAG}-windows-amd64.exe \
+            glint-${TAG}-windows-arm64.exe; do
             curl -sf -X POST \
               -H "Authorization: token $TOKEN" \
               -H "Content-Type: application/octet-stream" \

.gitignore

@@ -16,6 +16,9 @@ coverage.txt
 # Task runner cache
 .task/
 
+# Tmp
+.tmp/
+
 # Claude Code project memory
 .claude/
 

CHANGELOG.md

@@ -5,6 +5,94 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 This project uses [Semantic Versioning](https://semver.org).
 
+## [0.5.0] - 2026-07-30
+
+### Added
+
+- **Windows ARM64 build target** — `task build-windows-arm64` cross-compiles `glint-<tag>-windows-arm64.exe`; the Gitea release CI uploads it alongside the other five platform binaries.
+- **`workflow.rules` AND-group support** — the `- -` nested-array rule form (AND-groups) is now parsed and evaluated with correct AND logic: all conditions in a group must match for the group to fire; `when:` and `variables:` from all matching members are merged. Previously this form caused a YAML unmarshal crash.
+- **`workflow.name` and `workflow.auto_cancel` fields** — no longer cause a parse error when present; both are decoded into the `Workflow` struct.
+- **GL046 — `pull_policy` validation** — errors when `image.pull_policy` or `services[n].pull_policy` uses a value other than `always`, `if-not-present`, or `never`; both the string scalar and list-of-strings forms are checked.
+- **GL047 — `variables.options` default validation** — errors when a pipeline-level or job-level variable declares an `options:` list and its `value:` (default) is absent from that list; GitLab rejects such pipelines at creation time.
+- **GL048 — `trigger.forward` key validation** — errors on unrecognised keys inside `trigger.forward:`; only `pipeline_variables` and `yaml_variables` are valid.
+- **GL049 — `rules[n].allow_failure` validation** — validates rule-level `allow_failure:` (GitLab CI 15.0+): must be a boolean or a map with an `exit_codes:` key; applies the same checks as the job-level GL014.
+
+### Fixed
+
+- **GL032 false positive in workflow rules** — variables set by any workflow rule's `variables:` block are now excluded from GL032 undeclared-variable warnings when referenced in sibling workflow rule `if:` expressions; previously only pipeline-level `variables:` entries were exempt.
+
+## [0.4.1] - 2026-06-26
+
+### Fixed
+
+- **Release CI** — added Linux arm64, macOS Intel, and macOS Apple Silicon build steps; renamed Windows output to `glint-<tag>-windows-amd64.exe` for consistency; added missing `-X main.version=<tag>` ldflags so release binaries report the correct version instead of `"dev"`.
+
+## [0.4.0] - 2026-06-26
+
+### Added
+
+- **Git branch auto-detection** — `glint check` and `glint graph` now run `git rev-parse --abbrev-ref HEAD` in the pipeline file's directory to determine the current branch when no `--branch`/`--tag`/`--source`/`--var` flags are given. Falls back to `main` when not inside a git repository or in detached-HEAD state (e.g. CI runners).
+
+- **GitLab predefined variable injection** — two categories of predefined variables are now present in the simulation context automatically:
+  - `CI=true` and `GITLAB_CI=true` are injected for every non-empty context, so expressions like `$CI == "true"` evaluate correctly without `--var`.
+  - MR-specific variables (`CI_MERGE_REQUEST_IID`, `CI_MERGE_REQUEST_SOURCE_BRANCH_NAME`, `CI_MERGE_REQUEST_TARGET_BRANCH_NAME`, and four others) are injected as placeholders when `--source merge_request_event` is given. `CI_MERGE_REQUEST_SOURCE_BRANCH_NAME` is derived from `--branch` when provided. All injected defaults can be overridden with `--var`.
+
+- **Multi-platform release binaries** — `task build-release` now builds for all five platforms at once: Linux amd64, Linux arm64, macOS Intel, macOS Apple Silicon, Windows x86-64. Individual targets: `task build-linux-amd64`, `task build-linux-arm64`, `task build-darwin-amd64`, `task build-darwin-arm64`, `task build-windows`.
+
+- **Homebrew formula** — `Formula/glint.rb` is a source-build Homebrew formula. Set up a tap at `k3nny/homebrew-glint` on GitHub, then install with `brew tap k3nny/glint https://github.com/k3nny/homebrew-glint && brew install glint`.
+
+- **`INSTALL.md`** — installation guide covering pre-built binary download for all platforms, Homebrew tap, `go install`, and build-from-source with `/usr/local/bin` placement.
+
+## [0.3.1] - 2026-06-26
+
+### Changed
+
+- **`glint graph` default mode** — no-mode invocation now prints the job tree only (previously printed tree + `---` separator + Mermaid include graph). Use `glint graph includes` for the Mermaid include-dependency output.
+
+### Fixed
+
+- **`glint check --help`** — `--proxy` option was implemented but missing from the help text.
+- **`glint graph --help`** — `--cache-dir`, `--offline`, and `--proxy` options were implemented but missing from the help text.
+- **CI test** — `TestLoad_ReadError` skipped when running as root; Gitea runners execute as root which bypasses file permission checks, causing the test to fail.
+
+## [0.3.0] - 2026-06-26
+
+### Added
+
+- **`glint render` subcommand** — resolves all `include:` and `extends:` chains and writes the fully flattened pipeline to a single YAML file (default: `rendered.gitlab-ci.yml`; use `--output -` for stdout). Strips the consumed `include:` and `extends:` keys; retains template jobs (`.name`). Accepts the same network flags as `glint check` (`--token`, `--gitlab-url`, `--cache-dir`, `--offline`, `--proxy`). Useful for inspecting what GitLab CI actually sees or running further local tooling.
+
+- **`glint check --no-warn`** — discard all warning findings before output and exit-code calculation. Mixed pipelines (errors + warnings) still exit 2 but only errors are printed. Warnings-only pipelines report "OK" and exit 0.
+
+- **`glint graph --no-skipped`** — remove jobs that evaluate to `skipped` in the given context (or the implicit `branch=main` default) from all graph output: tree, SVG, HTML, and Mermaid.
+
+- **Colorized, columnized text output** — `glint check` (text format) now renders findings in four aligned columns: location, rule ID, severity, message. `error` is printed in bold red; `warning` in bold orange. Colors are auto-detected (stdout must be a terminal) and suppressed when `NO_COLOR` is set. Location uses `file:line:col` format when column information is available.
+
+- **`line:col` locations** — `Column int` added to `model.Job` (set from the YAML parser's `yaml.Node.Column`) and propagated to `Finding.Column` across all linter rules. Plain-text and `Finding.String()` now emit `file:line:col` when column is known.
+
+### Changed
+
+- **Exit codes** *(breaking)* — `glint check` now exits `2` when one or more error findings are present (previously `1`) and `10` when findings contain only warnings. Exit `0` remains for a clean pipeline. Errors take precedence over warnings. Scripts that test `[ $? -eq 1 ]` need to be updated to `[ $? -eq 2 ]`.
+
+## [0.2.31] - 2026-06-26
+
+### Added
+
+- **Proxy support** — `--proxy <URL>` flag on `glint check`, `glint graph`, and `glint lsp`; also configurable via `proxy:` in `.glint.yml`. When set it takes precedence over `HTTP_PROXY` / `HTTPS_PROXY` env vars; when unset, system proxy settings are honoured automatically. Covers all remote include fetches and GitLab API calls.
+
+- **GL045: HTTP remote include warning** — new pipeline-level lint rule that warns when `include: remote:` uses a plain `http://` URL. CI templates fetched over unencrypted HTTP are at risk of in-transit tampering; `https://` is always preferred.
+
+### Fixed
+
+- **Path traversal in local includes** — `include: local:` paths containing `../` sequences that would escape the repository root (e.g. `../../etc/passwd`) are now rejected with a warning instead of reading arbitrary files from the host.
+
+- **HTTP timeout on remote fetches** — all HTTP calls in `internal/fetcher` now use a 30-second timeout; previously the client had no timeout and could hang indefinitely on slow or unresponsive servers.
+
+- **Unbounded response size** — remote include and GitLab API responses are now capped at 10 MiB using `io.LimitReader`; previously an arbitrarily large response could exhaust process memory.
+
+- **Cache file permissions** — the cache directory is created with mode `0700` (was `0755`) and cache files with `0600` (was `0644`), preventing other local users from reading cached GitLab tokens or pipeline content.
+
+- **LSP Content-Length DoS** — `glint lsp` now rejects incoming messages whose `Content-Length` header exceeds 64 MiB, preventing memory exhaustion from a malicious or misbehaving LSP client.
+
 ## [0.2.30] - 2026-06-26
 
 ### Added

FEATURES.md

@@ -7,7 +7,7 @@ For planned work see [ROADMAP.md](ROADMAP.md).
 
 ## Lint rules
 
-Every finding carries a stable rule ID (`GL001` – `GL043`) that can be used to
+Every finding carries a stable rule ID (`GL001` – `GL045`) that can be used to
 suppress, filter, or look up the check. Run `glint explain <ID>` for a
 description, bad-YAML example, and fix.
 
@@ -19,6 +19,7 @@ description, bad-YAML example, and fix.
 | GL002 | ERR | `workflow.rules[*].when` must be `always` or `never` |
 | GL036 | ERR | `default.timeout` is not a valid GitLab CI duration string |
 | GL040 | WARN | A stage name appears more than once in `stages:` |
+| GL045 | WARN | `include: remote:` uses plain `http://` — CI templates fetched unencrypted; prefer `https://` |
 
 ### Job structure
 
@@ -117,6 +118,30 @@ Jobs whose name starts with `.` are reusable templates; most rules are skipped f
 
 ---
 
+## Pipeline rendering (`glint render`)
+
+`glint render <PIPELINE>` resolves all `include:` and `extends:` chains and
+writes the fully flattened pipeline to a single YAML file. This is what GitLab
+CI processes server-side.
+
+```bash
+glint render .gitlab-ci.yml                        # writes rendered.gitlab-ci.yml
+glint render --output merged.yml .gitlab-ci.yml    # custom output path
+glint render --output - .gitlab-ci.yml | yq .      # stream to stdout
+glint render --offline --cache-dir ~/.cache/glint .gitlab-ci.yml
+```
+
+**Output order:** `stages`, `variables`, `default`, `workflow`, template jobs
+(`.name`, alphabetical), then regular jobs (alphabetical). The `include:` key
+(consumed by resolution) and `extends:` keys (merged into each job) are
+stripped. All other fields are preserved verbatim.
+
+Accepts the same network flags as `glint check`: `--token`, `--gitlab-url`,
+`--cache-dir`, `--offline`, `--proxy`. When writing to a file (not stdout)
+a summary line is printed to stderr: `rendered: <file> (N job(s), M stage(s))`.
+
+---
+
 ## Context simulation
 
 Pass `--branch`, `--tag`, `--source`, or `--var` to evaluate `rules:if:` and
@@ -183,27 +208,37 @@ test-job    active       active
 
 ---
 
-## Output formats
+## Output formats (`glint check`)
 
 Pass `--format` to `glint check`. In structured formats the summary line is
 written to stderr so stdout contains only the machine-readable payload.
 
 | Format | Flag | Description |
 |--------|------|-------------|
-| Text (default) | `--format text` | Ruff-style `file:line: RULE [sev] message` |
+| Text (default) | `--format text` | Four aligned columns (location, rule, severity, message); `error` in bold red, `warning` in bold orange; colors auto-detected (suppressed when `NO_COLOR` is set or stdout is not a terminal) |
 | JSON | `--format json` | Stable schema (version 1); `findings` array + `summary` block |
 | SARIF 2.1.0 | `--format sarif` | Consumed by GitHub Code Scanning and GitLab SAST |
 | JUnit XML | `--format junit` | CI test-report artifact (`artifacts:reports:junit`) |
 | GitHub annotations | `--format github` | `::error file=…,line=…,title=RULE::message` inline PR comments |
 
+**Exit codes:**
+
+| Code | Meaning |
+|------|---------|
+| `0` | No findings (clean pipeline) |
+| `2` | One or more error findings |
+| `10` | One or more warning findings, no errors |
+
+Use `--no-warn` to suppress all warnings; a pipeline with only warnings then exits `0`.
+
 **JSON schema (`schema_version: 1`):**
 ```json
 {
   "schema_version": 1,
-  "glint_version": "v0.2.20",
+  "glint_version": "v0.3.0",
   "pipeline": ".gitlab-ci.yml",
   "findings": [
-    {"rule":"GL004","severity":"error","file":".gitlab-ci.yml","line":14,
+    {"rule":"GL004","severity":"error","file":".gitlab-ci.yml","line":14,"column":1,
      "job":"deploy","message":"stage \"production\" is not defined in 'stages'"}
   ],
   "summary": {"total": 1, "errors": 1, "warnings": 0}
@@ -243,9 +278,14 @@ url: https://gitlab.example.com
 
 # Default cache directory.
 cache_dir: ~/.cache/glint
+
+# HTTP proxy for remote includes and GitLab API calls.
+# Overrides HTTP_PROXY / HTTPS_PROXY env vars when set.
+# Leave empty to use system proxy settings.
+proxy: http://proxy.example.com:8080
 ```
 
-**Priority chain:** `--token`/`--gitlab-url` flags > `.glint.yml` > environment variables.
+**Priority chain:** `--token`/`--gitlab-url`/`--proxy` flags > `.glint.yml` > environment variables.
 
 ### Inline suppression (`# glint: ignore`)
 
@@ -277,10 +317,10 @@ jobs or pipeline-level findings.
 
 | Mode | Output |
 |------|--------|
-| `tree` (default) | Terminal job tree: stages as branches, jobs as leaves; annotated with `[manual]`, `[delayed]`, `[trigger]` where applicable |
+| `tree` *(default)* | Terminal job tree: stages as branches, jobs as leaves; annotated with `[manual]`, `[delayed]`, `[trigger]` where applicable |
-| `includes` | Mermaid flowchart to stdout; colour-coded nodes by include type (local, remote, project, component, template) |
+| `includes` | Mermaid flowchart of include dependencies to stdout; colour-coded by include type (local, remote, project, component, template) |
 | `pipeline` | GitLab CI-style SVG/PNG written to `--out` directory (default: `glint-out/`); converted to PNG when `rsvg-convert`, `inkscape`, or `magick` is available |
-| `all` | `includes` to stdout + `pipeline` file path to stderr |
+| `all` | `includes` Mermaid to stdout + `pipeline` SVG/PNG path to stderr |
 
 **`glint graph pipeline --format <FORMAT>`**
 
@@ -290,6 +330,8 @@ jobs or pipeline-level findings.
 | `mermaid` | Print Mermaid flowchart to stdout (paste into [mermaid.live](https://mermaid.live)) |
 | `html` | Write self-contained HTML to `--out` with mouse pan/zoom and a click-to-open job-detail sidebar |
 
+**Context flags** (`--branch`, `--tag`, `--source`, `--var`, `--changes`, `--changes-from`) work on all modes and annotate or colour jobs based on their evaluated state. Use `--no-skipped` to remove jobs that would not run in the given context from all output entirely (tree, SVG, HTML, and Mermaid).
+
 **Visual distinctions in SVG and HTML output:**
 
 - **Regular** — blue circle with checkmark
@@ -297,7 +339,7 @@ jobs or pipeline-level findings.
 - **Trigger** — purple circle with chevron
 - **Delayed** — yellow circle with clock
 - **`when: on_failure`** — red circle (`#d9534f`) with X mark; dashed chip border
-- **Skipped** (with `--branch`/`--tag`/`--source` context flags) — grey circle, dimmed job name
+- **Skipped** (with context flags, without `--no-skipped`) — grey circle, dimmed job name
 
 In DAG pipelines (any job has `needs:`) the pipeline graph uses job-to-job
 Bézier connectors. In classic mode a bus-bar pattern (vertical rail + per-job
@@ -312,7 +354,10 @@ shown as a tooltip in SVG viewers and as a sidebar panel in HTML output.
 
 | Tool | Description |
 |------|-------------|
+| `glint render <PIPELINE>` | Resolve all includes and extends; write the fully merged pipeline to a single YAML file. See [Pipeline rendering](#pipeline-rendering-glint-render) above. |
 | `glint explain <RULE>` | Print description, rationale, bad-YAML example, and fix for a rule. Case-insensitive (`gl007` = `GL007`). |
 | `glint explain` | List all rules with ID, severity, and title. |
-| `--list-vars` | Print all resolved pipeline variables (pipeline + workflow rules + context) to stderr before linting. |
+| `--no-warn` | (`glint check`) Discard all warning findings before output and exit-code calculation. |
+| `--no-skipped` | (`glint graph`) Remove skipped jobs from graph output entirely. |
+| `--list-vars` | (`glint check`, `glint graph`) Print all resolved pipeline variables to stderr before continuing. |
 | `--version` / `-v` | Print the compiled version string. |

Formula/glint.rb

@@ -0,0 +1,29 @@
+class Glint < Formula
+  desc "Local linter and validator for .gitlab-ci.yml pipelines"
+  homepage "https://git.k3nny.fr/k3nny/glint"
+  url "https://git.k3nny.fr/k3nny/glint/archive/v0.4.0.tar.gz"
+  # Update sha256 on each release: sha256sum glint-vX.Y.Z.tar.gz
+  sha256 ""
+  license "Apache-2.0"
+  head "https://git.k3nny.fr/k3nny/glint.git", branch: "main"
+
+  depends_on "go" => :build
+
+  def install
+    system "go", "build",
+           "-ldflags", "-X main.version=#{version}",
+           "-o", bin/"glint",
+           "./cmd/glint/..."
+  end
+
+  test do
+    assert_match version.to_s, shell_output("#{bin}/glint --version")
+    (testpath/".gitlab-ci.yml").write <<~YAML
+      stages: [build]
+      build-job:
+        stage: build
+        script: echo ok
+    YAML
+    system bin/"glint", "check", ".gitlab-ci.yml"
+  end
+end

INSTALL.md

@@ -0,0 +1,140 @@
+# Installing glint
+
+## Requirements
+
+- Go 1.21 or later (for building from source)
+- Any 64-bit Linux, macOS, or Windows system (for pre-built binaries)
+
+---
+
+## Option 1 — Build from source
+
+```bash
+git clone https://git.k3nny.fr/k3nny/glint
+cd glint
+go build -o glint ./cmd/glint/...
+sudo mv glint /usr/local/bin/
+```
+
+Or with [Task](https://taskfile.dev):
+
+```bash
+task build
+sudo mv glint /usr/local/bin/
+```
+
+---
+
+## Option 2 — Download a pre-built binary
+
+Pre-built binaries are attached to each [release](https://git.k3nny.fr/k3nny/glint/releases).
+
+| Platform | File |
+|----------|------|
+| Linux x86-64 | `glint-vX.Y.Z-linux-amd64` |
+| Linux ARM64 | `glint-vX.Y.Z-linux-arm64` |
+| macOS Intel | `glint-vX.Y.Z-darwin-amd64` |
+| macOS Apple Silicon | `glint-vX.Y.Z-darwin-arm64` |
+| Windows x86-64 | `glint-vX.Y.Z-windows-amd64.exe` |
+| Windows ARM64 | `glint-vX.Y.Z-windows-arm64.exe` |
+
+### Linux (amd64)
+
+```bash
+VERSION=v0.4.0
+curl -Lo glint https://git.k3nny.fr/k3nny/glint/releases/download/${VERSION}/glint-${VERSION}-linux-amd64
+chmod +x glint
+sudo mv glint /usr/local/bin/
+```
+
+### Linux (ARM64 — Raspberry Pi 4, AWS Graviton, …)
+
+```bash
+VERSION=v0.4.0
+curl -Lo glint https://git.k3nny.fr/k3nny/glint/releases/download/${VERSION}/glint-${VERSION}-linux-arm64
+chmod +x glint
+sudo mv glint /usr/local/bin/
+```
+
+### macOS (Apple Silicon — M1/M2/M3)
+
+```bash
+VERSION=v0.4.0
+curl -Lo glint https://git.k3nny.fr/k3nny/glint/releases/download/${VERSION}/glint-${VERSION}-darwin-arm64
+chmod +x glint
+sudo mv glint /usr/local/bin/
+```
+
+### macOS (Intel)
+
+```bash
+VERSION=v0.4.0
+curl -Lo glint https://git.k3nny.fr/k3nny/glint/releases/download/${VERSION}/glint-${VERSION}-darwin-amd64
+chmod +x glint
+sudo mv glint /usr/local/bin/
+```
+
+### Verify the installation
+
+```bash
+glint --version
+```
+
+---
+
+## Option 3 — Homebrew (macOS and Linux)
+
+A Homebrew tap is available at `k3nny/glint`.
+
+> **First-time setup:** create a GitHub repository named `homebrew-glint`
+> under your account and copy [`Formula/glint.rb`](Formula/glint.rb) into it.
+> Users then install via the tap as shown below.
+
+```bash
+brew tap k3nny/glint https://github.com/k3nny/homebrew-glint
+brew install glint
+```
+
+To upgrade:
+
+```bash
+brew upgrade glint
+```
+
+The formula builds glint from source using Go, which Homebrew provides
+automatically as a build dependency. No pre-built binary download is needed.
+
+### Updating the formula on a new release
+
+After tagging a new release, update `Formula/glint.rb`:
+
+1. Compute the tarball checksum:
+   ```bash
+   curl -sL https://git.k3nny.fr/k3nny/glint/archive/vX.Y.Z.tar.gz | sha256sum
+   ```
+2. Update `url` and `sha256` in the formula.
+3. Commit and push to `homebrew-glint`.
+
+---
+
+## Option 4 — Go install
+
+If you already have Go 1.21+:
+
+```bash
+go install git.k3nny.fr/k3nny/glint/cmd/glint@latest
+```
+
+The binary is placed in `$(go env GOPATH)/bin/`. Add that directory to your
+`PATH` if it is not already there:
+
+```bash
+export PATH="$PATH:$(go env GOPATH)/bin"
+```
+
+---
+
+## Integrations
+
+For editor and CI integrations (pre-commit hook, GitLab CI component, GitHub
+Actions, VS Code extension) see [README.md](README.md#integrations).

README.md

@@ -6,7 +6,7 @@
 
 <p align="center">
   <a href="LICENSE"><img src="https://img.shields.io/badge/license-Apache%202.0-blue.svg" alt="License"></a>
-  <a href="CHANGELOG.md"><img src="https://img.shields.io/badge/release-v0.2.30-blue.svg" alt="Release"></a>
+  <a href="CHANGELOG.md"><img src="https://img.shields.io/badge/release-v0.5.0-blue.svg" alt="Release"></a>
 </p>
 
 > **Disclaimer:** This tool was built through iterative AI-assisted development with [Claude](https://claude.ai). It is experimental, incomplete, and not intended for production use. Coverage of GitLab CI keywords is best-effort and may lag behind GitLab's evolving spec. Use it at your own discretion — no correctness guarantees are made. Contributions and bug reports are welcome.
@@ -15,51 +15,57 @@ A local tool to validate and lint `.gitlab-ci.yml` pipelines without needing a G
 
 ## What it does
 
-- **Lints** — 43 rules covering pipeline structure, keyword constraints, `needs:`/`dependencies:` graphs, expression reachability, and deprecations (GL001–GL043); run `glint explain <ID>` for any rule
+- **Lints** — 49 rules covering pipeline structure, keyword constraints, `needs:`/`dependencies:` graphs, expression reachability, and deprecations (GL001–GL049); run `glint explain <ID>` for any rule
-- **Resolves includes** — local files, HTTPS URLs, GitLab project templates, and CI/CD Catalog components, with offline cache support
+- **Resolves includes** — local files, HTTPS URLs, GitLab project templates, and CI/CD Catalog components, with offline cache support and HTTP proxy support (`--proxy` flag or `proxy:` in `.glint.yml`)
+- **Renders merged pipeline** — `glint render` resolves all includes and `extends:` chains into a single flat YAML file, matching what GitLab CI actually processes
 - **Simulates context** — `--branch`, `--tag`, `--source` flags evaluate `rules:if:` and `only`/`except` to show which jobs would be active, manual, or skipped; `--context branch=main --context branch=develop` prints a multi-column comparison table across multiple contexts in one run
-- **Multiple output formats** — `--format text` (default, ruff-style), `json`, `sarif` (GitHub Code Scanning / GitLab SAST), `junit`, `github` (PR annotations)
+- **Multiple output formats** — `--format text` (default, colorized and column-aligned), `json`, `sarif` (GitHub Code Scanning / GitLab SAST), `junit`, `github` (PR annotations); exits `2` on errors, `10` on warnings only
-- **Project config** — `.glint.yml` for rule suppression, severity overrides, token/URL defaults; `# glint: ignore RULE` for per-job inline suppression
+- **Project config** — `.glint.yml` for rule suppression, severity overrides, token/URL/proxy defaults; `# glint: ignore RULE` for per-job inline suppression; `--no-warn` flag to suppress all warnings
-- **Graph visualization** — `glint graph` prints a terminal job tree; `glint graph pipeline` renders a GitLab CI-style SVG/PNG; `--format mermaid` emits a Mermaid flowchart; `--format html` produces a self-contained HTML file with pan/zoom and a job-detail sidebar; context flags grey out skipped jobs
+- **Graph visualization** — `glint graph` prints a terminal job tree (default); `glint graph includes` emits a Mermaid include-dependency graph; `glint graph pipeline` renders a GitLab CI-style SVG/PNG; `--format mermaid` or `--format html` for alternative pipeline output; `--no-skipped` hides jobs that would not run in the given context
 - **LSP server** — `glint lsp` starts a Language Server Protocol server over stdin/stdout; connect with any LSP client to get inline diagnostics (rule ID as code, error/warning severity) in VS Code, Neovim, Emacs, JetBrains, etc.
 - **VS Code extension** — `editors/vscode/` wraps the LSP server; inline squiggles for every glint rule directly in the editor
 
 See [FEATURES.md](FEATURES.md) for the complete feature reference and lint rules table, and [ROADMAP.md](ROADMAP.md) for planned improvements.
 
-## Requirements
-
-- Go 1.21 or later
-- [Task](https://taskfile.dev) (optional, for development tasks)
-
 ## Installation
 
+See [INSTALL.md](INSTALL.md) for all options: pre-built binaries (Linux amd64/arm64, macOS Intel/Apple Silicon, Windows), Homebrew tap, and building from source.
+
+Quick start (Linux/macOS, building from source):
+
 ```bash
 git clone https://git.k3nny.fr/k3nny/glint
 cd glint
 go build -o glint ./cmd/glint/...
+sudo mv glint /usr/local/bin/
 ```
 
-Or with Task:
+Homebrew:
 
 ```bash
-task build
+brew tap k3nny/glint https://github.com/k3nny/homebrew-glint
+brew install glint
 ```
 
+## Requirements
+
+Go 1.21 or later (when building from source). Pre-built binaries have no runtime dependencies.
+
 ## Usage
 
 ```
 glint [OPTIONS] <COMMAND>
 
 Commands:
-  check    Lint a pipeline file — exits 0 (clean) or 1 (errors found)
+  check    Lint a pipeline file — exits 0 (clean), 2 (errors), or 10 (warnings only)
+  render   Resolve all includes and extends into a single merged YAML file
   graph    Visualise the pipeline as a job tree or Mermaid graph
-  explain  Print description and fix for a lint rule
+  explain  Show description and fix for a lint rule (e.g. glint explain GL007)
   lsp      Start a Language Server Protocol server (stdin/stdout)
 ```
 
-Run `glint <command> --help` for all flags. See [USAGE.md](USAGE.md) for full
+Run `glint <command> --help` for all flags. See [FEATURES.md](FEATURES.md) for the
-examples covering output formats, context simulation, remote includes, cache,
+complete feature reference.
-graph modes, and project configuration.
 
 ## Integrations
 
@@ -70,7 +76,7 @@ Add to `.pre-commit-config.yaml` in your repository to run glint automatically w
 ```yaml
 repos:
   - repo: https://git.k3nny.fr/k3nny/glint
-    rev: v0.2.28
+    rev: v0.3.0
     hooks:
       - id: glint
 ```
@@ -88,7 +94,7 @@ include:
 
 # As a Catalog component (after publishing to a GitLab instance):
 include:
-  - component: $CI_SERVER_FQDN/k3nny/glint/check@v0.2.28
+  - component: $CI_SERVER_FQDN/k3nny/glint/check@v0.3.0
     inputs:
       stage: validate          # optional, default: validate
       allow_failure: true      # optional, default: false
@@ -101,7 +107,7 @@ The component downloads the glint Linux binary, runs `glint check`, and respects
 Copy [`action.yml`](action.yml) from this repository, or mirror this repo to GitHub as `k3nny/glint` and reference it directly:
 
 ```yaml
-- uses: k3nny/glint@v0.2.28
+- uses: k3nny/glint@v0.3.0
   with:
     file: .gitlab-ci.yml   # optional, default: .gitlab-ci.yml
     args: '--format sarif' # optional
@@ -147,8 +153,13 @@ task changelog-next  # preview unreleased section (dry-run, no file written)
 task ext-install     # install VS Code extension npm dependencies
 task ext-compile     # compile the VS Code extension TypeScript source
 task ext-package     # package the VS Code extension as a .vsix
-task build-windows  # cross-compile for Windows x64 (requires a tagged commit → glint-<tag>.exe)
+task build-linux-amd64   # cross-compile for Linux x86-64 (requires a tagged commit)
-task build-linux    # cross-compile for Linux x64 (requires a tagged commit → glint-<tag>-linux-amd64)
+task build-linux-arm64   # cross-compile for Linux ARM64 (requires a tagged commit)
+task build-darwin-amd64  # cross-compile for macOS Intel (requires a tagged commit)
+task build-darwin-arm64  # cross-compile for macOS Apple Silicon (requires a tagged commit)
+task build-windows       # cross-compile for Windows x86-64 (requires a tagged commit)
+task build-windows-arm64 # cross-compile for Windows ARM64 (requires a tagged commit)
+task build-release       # build all platform binaries at once (requires a tagged commit)
 task clean        # remove build artifacts
 ```
 

ROADMAP.md

@@ -8,6 +8,7 @@ This document tracks planned improvements to `glint`. Items are grouped by theme
 
 Pass `--branch`, `--tag`, `--source`, or `--var` to `glint check` or `glint graph` to evaluate `rules:if:` expressions and `only`/`except` filters against a specific pipeline event.
 
+- [x] **`workflow.rules` AND-group semantics** — shipped v0.5.0; the `- -` nested-array rule form (AND-groups) is parsed and evaluated with correct AND logic: all conditions in a group must match for the group to fire; variables and `when:` from all matching group members are merged
 - [x] **Single-context simulation** — shipped v0.2.0; `--branch`, `--tag`, `--source`, `--var` flags on both subcommands; jobs classified as active / manual / skipped
 - [x] **`workflow:rules:variables:` propagation** — shipped post-v0.2.0; variables from the matching workflow rule entry injected into the evaluation context before job `rules:if:` expressions are evaluated
 - [x] **Expression evaluator: multi-line `if:` values** — shipped post-v0.2.0; newlines in block-scalar and folded YAML `if:` values treated as whitespace
@@ -32,6 +33,10 @@ Pass `--branch`, `--tag`, `--source`, or `--var` to `glint check` or `glint grap
 
 The current rule set covers the most common sources of broken pipelines. These are the gaps most likely to matter in practice.
 
+- [x] **`image.pull_policy` / `services[n].pull_policy` validation (GL046)** — shipped v0.5.0; validates that `pull_policy` values are one of `always`, `if-not-present`, `never`; applies to both `image:` map form and service entries; list form also checked element-by-element
+- [x] **`variables.options` default value validation (GL047)** — shipped v0.5.0; errors when a variable declares an `options:` list and its `value:` (default) is not listed; checked at pipeline level and per-job; GitLab rejects such pipelines at creation time
+- [x] **`trigger.forward` key validation (GL048)** — shipped v0.5.0; errors on unrecognised keys inside `trigger.forward:`; only `pipeline_variables` and `yaml_variables` are valid
+- [x] **`rules[n].allow_failure` validation (GL049)** — shipped v0.5.0; validates rule-level `allow_failure:` (GitLab CI 15.0+) using the same rules as job-level GL014: must be a boolean or a `{exit_codes:}` map
 - [x] **Variable reference validation (GL032)** — shipped v0.2.11; warns when a `rules:if:` expression references `$VAR` / `${VAR}` not declared anywhere in pipeline YAML; predefined GitLab namespaces (`CI_*`, `GITLAB_*`, …) exempt; variables from included files are also considered
 - [x] **`rules:if:` static reachability (GL033)** — shipped v0.2.15; warns when every rule in a job's `rules:` block has `when: never`, making the job permanently excluded from any pipeline run; no `if:` evaluation required
 - [x] **`services:` validation (GL034)** — shipped v0.2.16; map form requires `name`; `alias` must be a valid DNS label
@@ -53,6 +58,7 @@ The current rule set covers the most common sources of broken pipelines. These a
 - [x] **Recursive include depth limit** — shipped v0.2.17; depth capped at 100 (matching GitLab); project/component includes now tracked in visited set to prevent cross-file cycles
 - [x] **Offline mode / cache** — shipped v0.2.17; `--cache-dir DIR` persists fetched templates; `--offline` serves from cache only; default cache dir (`~/.cache/glint`) used automatically with `--offline`
 - [x] **`include: inputs:`** — shipped v0.2.17; `$[[ inputs.KEY ]]` and `$[[ inputs.KEY | default(…) ]]` placeholders in fetched component YAML are substituted from the include's `with:` block before parsing
+- [x] **`glint render` subcommand** — shipped v0.3.0; resolves all `include:` and `extends:` chains into a single flat YAML file; strips consumed keys; accepts same network flags as `glint check`; default output `rendered.gitlab-ci.yml`, use `--output -` for stdout
 
 ---
 
@@ -79,6 +85,7 @@ The SVG renderer and terminal tree cover the basic layout. These would bring it
 - [x] **Mermaid pipeline output** — shipped v0.2.25; `glint graph pipeline --format mermaid` prints a Mermaid flowchart to stdout (paste into mermaid.live)
 - [x] **Same-stage job ordering** — shipped v0.2.26; jobs within a stage that have `needs:` between each other are placed in topological sub-columns (left-to-right by depth); stage header spans all sub-columns
 - [x] **Graph links rendered behind job chips** — shipped v0.2.26; SVG connectors (Bézier curves and bus-bar stubs) are drawn before job chips so lines pass behind rectangles
+- [x] **`glint graph --no-skipped`** — shipped v0.3.0; removes jobs evaluated as `skipped` in the given context from tree, SVG, HTML, and Mermaid output
 
 ---
 
@@ -86,6 +93,8 @@ The SVG renderer and terminal tree cover the basic layout. These would bring it
 
 - [x] **File and line numbers on findings** — shipped post-v0.2.0; every finding includes the source file and exact line of the job key; works across local includes, remote project templates, and fetched component templates
 - [x] **Ruff-style output format** — shipped v0.2.11; findings follow `file:line: RULEID [severity] message` matching the convention used by ruff and other modern linters
+- [x] **Colorized, columnized text output** — shipped v0.3.0; four aligned columns (location, rule, severity, message); `error` in bold red, `warning` in bold orange; auto-detected terminal color (respects `NO_COLOR`)
+- [x] **`line:col` locations** — shipped v0.3.0; `Column int` on `model.Job` and `Finding`; text output and `Finding.String()` emit `file:line:col` when column is known
 - [x] **`needs: optional: true` false-positive errors** — shipped post-v0.2.0; optional missing needs are downgraded to `[WARNING]`
 - [x] **`extends:` jobs with missing script false errors** — shipped post-v0.2.0; jobs using `extends:` that have no `script` after resolution emit `[WARNING]` (the script may come from an unfetchable remote base)
 - [x] **`rules:if:` static reachability (GL042)** — shipped v0.2.20; warns when all `rules:if:` conditions evaluate to false given declared variable values (only fires when all referenced vars are declared in YAML)
@@ -106,6 +115,18 @@ The SVG renderer and terminal tree cover the basic layout. These would bring it
 
 - [x] **`.glint.yml` config file** — shipped v0.2.19; `ignore:`, `severity:`, `stages:`, `token:`, `url:`, `cache_dir:`; searched from the pipeline directory up to the git root
 - [x] **Inline suppression comments** — shipped v0.2.19; `# glint: ignore GL007` before a job definition; comma/space-separated rules; `# glint: ignore all` wildcard
+- [x] **Proxy support** — shipped v0.2.31; `--proxy` flag on `check`, `graph`, and `lsp` subcommands; also configurable via `proxy:` in `.glint.yml`; overrides `HTTP_PROXY` / `HTTPS_PROXY` env vars when set
+
+---
+
+## Security & hardening
+
+- [x] **Path traversal guard for local includes** — shipped v0.2.31; `include: local:` paths containing `../../` or similar sequences are rejected instead of reading files outside the repository root
+- [x] **HTTP timeout on remote fetches** — shipped v0.2.31; all HTTP calls via the fetcher use a 30-second timeout to prevent indefinite hangs on slow or unresponsive servers
+- [x] **Unbounded response size cap** — shipped v0.2.31; remote include and GitLab API responses are capped at 10 MiB; responses exceeding the limit are rejected to prevent memory exhaustion
+- [x] **Cache file permissions** — shipped v0.2.31; cache directories are created with mode `0700` and cache files with mode `0600`; previously used world-readable `0755`/`0644`
+- [x] **GL045: HTTP remote include warning** — shipped v0.2.31; warns when `include: remote:` uses a plain `http://` URL; CI templates fetched unencrypted are at risk of tampering
+- [x] **LSP Content-Length DoS cap** — shipped v0.2.31; `glint lsp` rejects messages with `Content-Length` exceeding 64 MiB to prevent memory exhaustion from a malicious client
 
 ---
 
@@ -117,3 +138,10 @@ The SVG renderer and terminal tree cover the basic layout. These would bring it
 - [x] **Subcommand CLI** — shipped v0.2.0 (2026-06-11); `glint check` / `glint graph [mode]` with ruff-style `--help`
 - [x] **Changelog automation** — shipped v0.2.27; `cliff.toml` configures git-cliff to produce Keep-a-Changelog–compatible release notes from Conventional Commits; `task changelog` regenerates `CHANGELOG.md`, `task changelog-next` previews unreleased entries
 - [x] **Fuzz testing** — shipped v0.2.27; `FuzzParseBytes` and `FuzzSanitizeYAMLEscapes` in `internal/model/fuzz_test.go`; seeds run as regular tests in CI; `task fuzz` runs them continuously (default 30 s)
+- [x] **`glint check --no-warn`** — shipped v0.3.0; discards all warning findings before output and exit-code calculation; mixed pipelines (errors + warnings) still exit 2 but only errors are printed; warnings-only pipelines exit 0
+- [x] **Exit codes 2 / 10** *(breaking)* — shipped v0.3.0; `glint check` exits `2` when errors are present (previously `1`) and `10` when findings contain only warnings; exit `0` for clean
+- [x] **Git branch auto-detection** — shipped v0.4.0; when no context flags are given, `glint check` and `glint graph` run `git rev-parse --abbrev-ref HEAD` in the pipeline file's directory and use the result as the default branch (falls back to `main`)
+- [x] **GitLab predefined variable injection** — shipped v0.4.0; `CI=true` and `GITLAB_CI=true` always present in a non-empty context; MR-specific variables injected as placeholders when `--source merge_request_event`; all overridable via `--var`
+- [x] **Multi-platform release binaries** — shipped v0.4.0; `task build-release` builds Linux amd64/arm64, macOS Intel/Apple Silicon, and Windows amd64 in one shot
+- [x] **Homebrew formula** — shipped v0.4.0; `Formula/glint.rb` source-build formula; tap at `k3nny/homebrew-glint`
+- [x] **`INSTALL.md`** — shipped v0.4.0; installation guide for all platforms and methods

Taskfile.yml

@@ -68,31 +68,31 @@ tasks:
       - cmd: ./{{.BINARY}} check --branch feat/x testdata/rules_if_expr.yml
         ignore_error: false
       - cmd: ./{{.BINARY}} check testdata/workflow_vars.yml
-        ignore_error: false
+        ignore_error: true
       - cmd: ./{{.BINARY}} check --branch main testdata/workflow_vars.yml
-        ignore_error: false
+        ignore_error: true
       - cmd: ./{{.BINARY}} check --branch develop testdata/workflow_vars.yml
-        ignore_error: false
+        ignore_error: true
       - cmd: ./{{.BINARY}} check --branch feat/x testdata/workflow_vars.yml
-        ignore_error: false
+        ignore_error: true
       - cmd: ./{{.BINARY}} check testdata/workflow_escape.yml
-        ignore_error: false
+        ignore_error: true
       - cmd: ./{{.BINARY}} check testdata/variable_refs.yml
         ignore_error: false
       - cmd: ./{{.BINARY}} check testdata/variable_refs_included.yml
         ignore_error: false
       - cmd: ./{{.BINARY}} check testdata/dead_rules.yml
-        ignore_error: false
+        ignore_error: true
       - cmd: ./{{.BINARY}} check testdata/new_rules_valid.yml
         ignore_error: false
       - cmd: ./{{.BINARY}} check testdata/new_rules_invalid.yml
         ignore_error: true
       - cmd: ./{{.BINARY}} check testdata/samba/.gitlab-ci.yml
-        ignore_error: false
+        ignore_error: true
       - cmd: ./{{.BINARY}} check testdata/samba/.gitlab-ci-coverage.yml
-        ignore_error: false
+        ignore_error: true
       - cmd: ./{{.BINARY}} check testdata/samba/.gitlab-ci-private.yml
-        ignore_error: false
+        ignore_error: true
       - cmd: ./{{.BINARY}} check --format json testdata/valid.yml
         ignore_error: false
       - cmd: ./{{.BINARY}} check --format sarif testdata/valid.yml
@@ -104,25 +104,29 @@ tasks:
       - cmd: ./{{.BINARY}} check testdata/config_ignored/.gitlab-ci.yml
         ignore_error: false
       - cmd: ./{{.BINARY}} check testdata/config_severity/.gitlab-ci.yml
-        ignore_error: false
+        ignore_error: true
       - cmd: ./{{.BINARY}} check testdata/config_suppress/.gitlab-ci.yml
-        ignore_error: false
+        ignore_error: true
       - cmd: ./{{.BINARY}} check testdata/static_dead_rules.yml
-        ignore_error: false
+        ignore_error: true
       - cmd: ./{{.BINARY}} check testdata/inherit_dead.yml
-        ignore_error: false
+        ignore_error: true
       - cmd: ./{{.BINARY}} check testdata/inherit_dead_fields.yml
-        ignore_error: false
+        ignore_error: true
       - cmd: ./{{.BINARY}} check testdata/rules_needs_valid.yml
         ignore_error: false
       - cmd: ./{{.BINARY}} check testdata/rules_needs_invalid.yml
         ignore_error: true
+      - cmd: ./{{.BINARY}} check testdata/nested_rules.yml
+        ignore_error: true
       - cmd: ./{{.BINARY}} explain GL007
         ignore_error: false
       - cmd: ./{{.BINARY}} explain gl042
         ignore_error: false
       - cmd: ./{{.BINARY}} explain GL044
         ignore_error: false
+      - cmd: ./{{.BINARY}} check testdata/insecure_remote_include.yml
+        ignore_error: true
       - cmd: ./{{.BINARY}} explain
         ignore_error: false
 
@@ -143,30 +147,15 @@ tasks:
       - task: build
       - task: validate
 
-  build-windows:
+  build-linux-amd64:
-    desc: Build the glint binary for Windows x64 (requires a tagged commit)
+    desc: Build the glint binary for Linux x86-64 (requires a tagged commit)
+    aliases: [build-linux]
     vars:
       TAG:
         sh: git describe --tags --exact-match
     preconditions:
       - sh: git describe --tags --exact-match
-        msg: "Current commit is not tagged — Windows build requires a git tag"
+        msg: "Current commit is not tagged — release build requires a git tag"
-    cmds:
-      - "GOOS=windows GOARCH=amd64 {{.GO}} build -ldflags \"-X main.version={{.TAG}}\" -o {{.BINARY}}-{{.TAG}}.exe ./cmd/glint/..."
-    sources:
-      - "**/*.go"
-      - go.mod
-    generates:
-      - "{{.BINARY}}-{{.TAG}}.exe"
-
-  build-linux:
-    desc: Build the glint binary for Linux x64 (requires a tagged commit)
-    vars:
-      TAG:
-        sh: git describe --tags --exact-match
-    preconditions:
-      - sh: git describe --tags --exact-match
-        msg: "Current commit is not tagged — Linux build requires a git tag"
     cmds:
       - "GOOS=linux GOARCH=amd64 {{.GO}} build -ldflags \"-X main.version={{.TAG}}\" -o {{.BINARY}}-{{.TAG}}-linux-amd64 ./cmd/glint/..."
     sources:
@@ -175,6 +164,96 @@ tasks:
     generates:
       - "{{.BINARY}}-{{.TAG}}-linux-amd64"
 
+  build-linux-arm64:
+    desc: Build the glint binary for Linux ARM64 (requires a tagged commit)
+    vars:
+      TAG:
+        sh: git describe --tags --exact-match
+    preconditions:
+      - sh: git describe --tags --exact-match
+        msg: "Current commit is not tagged — release build requires a git tag"
+    cmds:
+      - "GOOS=linux GOARCH=arm64 {{.GO}} build -ldflags \"-X main.version={{.TAG}}\" -o {{.BINARY}}-{{.TAG}}-linux-arm64 ./cmd/glint/..."
+    sources:
+      - "**/*.go"
+      - go.mod
+    generates:
+      - "{{.BINARY}}-{{.TAG}}-linux-arm64"
+
+  build-darwin-amd64:
+    desc: Build the glint binary for macOS Intel (requires a tagged commit)
+    vars:
+      TAG:
+        sh: git describe --tags --exact-match
+    preconditions:
+      - sh: git describe --tags --exact-match
+        msg: "Current commit is not tagged — release build requires a git tag"
+    cmds:
+      - "GOOS=darwin GOARCH=amd64 {{.GO}} build -ldflags \"-X main.version={{.TAG}}\" -o {{.BINARY}}-{{.TAG}}-darwin-amd64 ./cmd/glint/..."
+    sources:
+      - "**/*.go"
+      - go.mod
+    generates:
+      - "{{.BINARY}}-{{.TAG}}-darwin-amd64"
+
+  build-darwin-arm64:
+    desc: Build the glint binary for macOS Apple Silicon (requires a tagged commit)
+    vars:
+      TAG:
+        sh: git describe --tags --exact-match
+    preconditions:
+      - sh: git describe --tags --exact-match
+        msg: "Current commit is not tagged — release build requires a git tag"
+    cmds:
+      - "GOOS=darwin GOARCH=arm64 {{.GO}} build -ldflags \"-X main.version={{.TAG}}\" -o {{.BINARY}}-{{.TAG}}-darwin-arm64 ./cmd/glint/..."
+    sources:
+      - "**/*.go"
+      - go.mod
+    generates:
+      - "{{.BINARY}}-{{.TAG}}-darwin-arm64"
+
+  build-windows:
+    desc: Build the glint binary for Windows x86-64 (requires a tagged commit)
+    vars:
+      TAG:
+        sh: git describe --tags --exact-match
+    preconditions:
+      - sh: git describe --tags --exact-match
+        msg: "Current commit is not tagged — release build requires a git tag"
+    cmds:
+      - "GOOS=windows GOARCH=amd64 {{.GO}} build -ldflags \"-X main.version={{.TAG}}\" -o {{.BINARY}}-{{.TAG}}-windows-amd64.exe ./cmd/glint/..."
+    sources:
+      - "**/*.go"
+      - go.mod
+    generates:
+      - "{{.BINARY}}-{{.TAG}}-windows-amd64.exe"
+
+  build-windows-arm64:
+    desc: Build the glint binary for Windows ARM64 (requires a tagged commit)
+    vars:
+      TAG:
+        sh: git describe --tags --exact-match
+    preconditions:
+      - sh: git describe --tags --exact-match
+        msg: "Current commit is not tagged — release build requires a git tag"
+    cmds:
+      - "GOOS=windows GOARCH=arm64 {{.GO}} build -ldflags \"-X main.version={{.TAG}}\" -o {{.BINARY}}-{{.TAG}}-windows-arm64.exe ./cmd/glint/..."
+    sources:
+      - "**/*.go"
+      - go.mod
+    generates:
+      - "{{.BINARY}}-{{.TAG}}-windows-arm64.exe"
+
+  build-release:
+    desc: Build release binaries for all supported platforms (requires a tagged commit)
+    cmds:
+      - task: build-linux-amd64
+      - task: build-linux-arm64
+      - task: build-darwin-amd64
+      - task: build-darwin-arm64
+      - task: build-windows
+      - task: build-windows-arm64
+
   fuzz:
     desc: "Run all fuzz targets (set FUZZ_TIME=60s to control per-target duration, default 30s)"
     cmds:
@@ -210,4 +289,4 @@ tasks:
 
   clean:
     desc: Remove build artifacts
-    cmd: rm -f {{.BINARY}} {{.BINARY}}-*.exe {{.BINARY}}-*-linux-amd64
+    cmd: rm -f {{.BINARY}} {{.BINARY}}-*.exe {{.BINARY}}-*-linux-amd64 {{.BINARY}}-*-linux-arm64 {{.BINARY}}-*-darwin-amd64 {{.BINARY}}-*-darwin-arm64

cmd/glint/lsp.go

@@ -5,6 +5,7 @@ import (
 	"fmt"
 	"os"
 
+	"git.k3nny.fr/glint/internal/config"
 	"git.k3nny.fr/glint/internal/fetcher"
 	"git.k3nny.fr/glint/internal/lsp"
 )
@@ -15,6 +16,7 @@ func cmdLSP(args []string) {
 	gitlabURL := fs.String("gitlab-url", "", "GitLab instance URL (overrides CI_SERVER_URL / GITLAB_URL)")
 	cacheDir := fs.String("cache-dir", "", "directory for caching fetched remote includes")
 	offline := fs.Bool("offline", false, "skip all network calls; serve only from --cache-dir")
+	proxy := fs.String("proxy", "", "HTTP proxy URL for remote includes and GitLab API calls (e.g. http://proxy:8080); overrides system proxy env vars")
 	fs.Usage = func() {
 		fmt.Fprintf(os.Stderr, "glint %s\n\n", version)
 		fmt.Fprint(os.Stderr, `Start a Language Server Protocol server for .gitlab-ci.yml files.
@@ -42,6 +44,12 @@ Options:
           Do not make any network calls; resolve only local includes.
           Implies --cache-dir default (~/.cache/glint) when not set.
 
+      --proxy <URL>
+          HTTP proxy URL for remote includes and GitLab API calls
+          (e.g. http://proxy:8080). Overrides system proxy env vars
+          (HTTP_PROXY / HTTPS_PROXY). Also configurable via proxy: in
+          .glint.yml.
+
   -h, --help
           Print help
 
@@ -49,19 +57,40 @@ Examples:
   glint lsp
   glint lsp --token glpat-xxxx --cache-dir ~/.cache/glint
   glint lsp --offline
+  glint lsp --proxy http://proxy.example.com:8080
 `)
 	}
 	_ = fs.Parse(args)
 
+	// Load project config from the working directory (the project root from
+	// which the LSP server is launched). CLI flags take priority.
+	wd, _ := os.Getwd()
+	glintCfg, cfgErr := config.Load(wd)
+	if cfgErr != nil {
+		fmt.Fprintf(os.Stderr, "glint lsp: [warning] %s: %v\n", config.Filename, cfgErr)
+	}
+
+	fetcherToken := *token
+	if fetcherToken == "" {
+		fetcherToken = glintCfg.Token
+	}
+	fetcherURL := *gitlabURL
+	if fetcherURL == "" {
+		fetcherURL = glintCfg.URL
+	}
 	resolvedCacheDir := *cacheDir
+	if resolvedCacheDir == "" {
+		resolvedCacheDir = glintCfg.CacheDir
+	}
 	if resolvedCacheDir == "" {
 		resolvedCacheDir = defaultCacheDir()
 	}
-	if *offline && resolvedCacheDir == "" {
+	resolvedProxy := *proxy
-		resolvedCacheDir = defaultCacheDir()
+	if resolvedProxy == "" {
+		resolvedProxy = glintCfg.Proxy
 	}
 
-	cfg := fetcher.AutoConfig().WithOverrides(*gitlabURL, *token, resolvedCacheDir, *offline)
+	cfg := fetcher.AutoConfig().WithOverrides(fetcherURL, fetcherToken, resolvedCacheDir, *offline).WithProxy(resolvedProxy)
 
 	srv := lsp.New(os.Stdin, os.Stdout, cfg, version)
 	if err := srv.Run(); err != nil {

cmd/glint/main.go

@@ -44,6 +44,29 @@ var execCommandOutput = func(name string, args ...string) ([]byte, error) {
 	return exec.Command(name, args...).Output()
 }
 
+// gitBranchInDir is a variable so tests can mock branch detection.
+var gitBranchInDir = func(dir string) ([]byte, error) {
+	cmd := exec.Command("git", "rev-parse", "--abbrev-ref", "HEAD")
+	cmd.Dir = dir
+	return cmd.Output()
+}
+
+// detectGitBranch returns the current git branch name by running
+// "git rev-parse --abbrev-ref HEAD" in dir. Returns "" when dir is not
+// inside a git repository, when the repo is in detached-HEAD state, or
+// when git is not available.
+func detectGitBranch(dir string) string {
+	out, err := gitBranchInDir(dir)
+	if err != nil {
+		return ""
+	}
+	b := strings.TrimSpace(string(out))
+	if b == "" || b == "HEAD" {
+		return ""
+	}
+	return b
+}
+
 // gitDiffFiles runs "git diff --name-only <ref>" and returns the list of changed
 // file paths. Returns nil + error when the command fails (e.g. not in a git repo
 // or the ref doesn't exist).
@@ -66,7 +89,8 @@ const globalUsage = `glint: Lint and visualise GitLab CI pipelines locally.
 Usage: glint [OPTIONS] <COMMAND>
 
 Commands:
-  check    Lint a pipeline file — exits 0 (clean) or 1 (errors found)
+  check    Lint a pipeline file — exits 0 (clean), 2 (errors), or 10 (warnings only)
+  render   Resolve all includes and extends into a single merged YAML file
   graph    Visualise the pipeline as a job tree or Mermaid graph
   explain  Show description and fix for a lint rule (e.g. glint explain GL007)
   lsp      Start a Language Server Protocol server (stdin/stdout)
@@ -87,6 +111,8 @@ func main() {
 	switch os.Args[1] {
 	case "check":
 		cmdCheck(os.Args[2:])
+	case "render":
+		cmdRender(os.Args[2:])
 	case "graph":
 		cmdGraph(os.Args[2:])
 	case "explain":
@@ -119,7 +145,9 @@ func cmdCheck(args []string) {
 	gitlabURL := fs.String("gitlab-url", "", "GitLab instance URL (overrides CI_SERVER_URL / GITLAB_URL)")
 	cacheDir := fs.String("cache-dir", "", "directory to cache fetched remote includes (created if needed)")
 	offline := fs.Bool("offline", false, "skip all network calls; serve only from --cache-dir")
+	proxy := fs.String("proxy", "", "HTTP proxy URL for remote includes and GitLab API calls (e.g. http://proxy:8080); overrides system proxy env vars")
 	format := fs.String("format", "text", "output format: text, json, sarif, junit, github")
+	noWarn := fs.Bool("no-warn", false, "suppress warning findings; only errors are shown and affect the exit code")
 	branch := fs.String("branch", "", "simulate a branch push (sets CI_COMMIT_BRANCH, …)")
 	tag := fs.String("tag", "", "simulate a tag push (sets CI_COMMIT_TAG, …)")
 	source := fs.String("source", "", "set CI_PIPELINE_SOURCE")
@@ -136,7 +164,11 @@ func cmdCheck(args []string) {
 		fmt.Fprint(os.Stderr, `Lint a GitLab CI pipeline file.
 
 Resolves local includes and extends chains, then runs all lint rules.
-Exits 0 when no errors are found, 1 when at least one error is reported.
+
+Exit codes:
+  0   no findings (clean)
+  2   one or more errors
+  10  one or more warnings, no errors
 
 Usage: glint check [OPTIONS] <PIPELINE>
 
@@ -148,6 +180,10 @@ Options:
           Output format for findings.
           [default: text] [possible values: text, json, sarif, junit, github]
 
+      --no-warn
+          Suppress warning findings. Only errors are printed and counted toward
+          the exit code; warnings are ignored entirely.
+
       --token <TOKEN>
           GitLab personal access token. Required to fetch project: includes;
           component: includes are attempted unauthenticated.
@@ -168,6 +204,12 @@ Options:
           having no token). Implies the default cache dir (~/.cache/glint) when
           --cache-dir is not set.
 
+      --proxy <URL>
+          HTTP proxy URL for remote includes and GitLab API calls
+          (e.g. http://proxy:8080). Overrides system proxy env vars
+          (HTTP_PROXY / HTTPS_PROXY). Also configurable via proxy: in
+          .glint.yml.
+
       --branch <NAME>
           Simulate a branch push. Populates: CI_COMMIT_BRANCH,
           CI_COMMIT_REF_NAME, CI_COMMIT_REF_SLUG, CI_PIPELINE_SOURCE=push.
@@ -213,8 +255,13 @@ Options:
           Print help
 
 Note: when none of --branch, --tag, --source, or --var are given, glint
-defaults to --branch main --source push so that rules:if: expressions are
+detects the current git branch automatically and uses it as the default
-always evaluated.
+(falling back to 'main' when not inside a git repository or in detached-HEAD
+state). --source defaults to 'push' so that rules:if: expressions are always
+evaluated. GitLab's always-available predefined variables (CI=true,
+GITLAB_CI=true) are injected automatically; MR-specific variables
+(CI_MERGE_REQUEST_IID, CI_MERGE_REQUEST_SOURCE_BRANCH_NAME, …) are injected
+when --source merge_request_event is given. Override any with --var.
 
 Examples:
   glint check .gitlab-ci.yml
@@ -225,26 +272,24 @@ Examples:
   glint check --branch develop .gitlab-ci.yml
   glint check --tag v1.0.0 .gitlab-ci.yml
   glint check --source merge_request_event .gitlab-ci.yml
+  glint check --source merge_request_event --branch feature/my-branch .gitlab-ci.yml
+  glint check --source merge_request_event --var CI_MERGE_REQUEST_IID=42 .gitlab-ci.yml
   glint check --list-vars .gitlab-ci.yml
   GITLAB_TOKEN=glpat-xxxx glint check .gitlab-ci.yml
   glint check --token glpat-xxxx --gitlab-url https://gitlab.example.com .gitlab-ci.yml
   glint check --branch main --var DEPLOY_ENV=production .gitlab-ci.yml
   glint check --cache-dir ~/.cache/glint .gitlab-ci.yml
   glint check --offline --cache-dir ~/.cache/glint .gitlab-ci.yml
+  glint check --no-warn .gitlab-ci.yml
   glint check --changes src/main.go --changes Dockerfile .gitlab-ci.yml
   glint check --changes-from origin/main .gitlab-ci.yml
   glint check --context branch=main --context branch=develop .gitlab-ci.yml
   glint check --context branch=main --context tag=v1.0.0 --context source=schedule .gitlab-ci.yml
+  glint check --proxy http://proxy.example.com:8080 .gitlab-ci.yml
 `)
 	}
 	_ = fs.Parse(args)
 
-	// Apply implicit defaults only in single-context mode when no flags are given.
-	if len(contexts) == 0 && *branch == "" && *tag == "" && *source == "" && len(vars) == 0 {
-		*branch = "main"
-		*source = "push"
-	}
-
 	validFormats := map[string]bool{
 		"text": true, "json": true, "sarif": true, "junit": true, "github": true,
 	}
@@ -262,6 +307,17 @@ Examples:
 	path := fs.Arg(0)
 	rootDir := filepath.Dir(filepath.Clean(path))
 
+	// Apply implicit defaults only in single-context mode when no flags are given.
+	// Prefer the actual git branch of the repository; fall back to "main".
+	if len(contexts) == 0 && *branch == "" && *tag == "" && *source == "" && len(vars) == 0 {
+		if detected := detectGitBranch(rootDir); detected != "" {
+			*branch = detected
+		} else {
+			*branch = "main"
+		}
+		*source = "push"
+	}
+
 	// Load project config (.glint.yml), searching from the pipeline directory
 	// up to the git root.
 	glintCfg, cfgErr := config.Load(rootDir)
@@ -286,8 +342,12 @@ Examples:
 	if *offline && resolvedCacheDir == "" {
 		resolvedCacheDir = defaultCacheDir()
 	}
+	resolvedProxy := *proxy
+	if resolvedProxy == "" {
+		resolvedProxy = glintCfg.Proxy
+	}
 
-	cfg := fetcher.AutoConfig().WithOverrides(fetcherURL, fetcherToken, resolvedCacheDir, *offline)
+	cfg := fetcher.AutoConfig().WithOverrides(fetcherURL, fetcherToken, resolvedCacheDir, *offline).WithProxy(resolvedProxy)
 
 	p, err := model.Parse(path)
 	if err != nil {
@@ -397,7 +457,19 @@ Examples:
 
 	findings := linter.Lint(p, skipped)
 	findings = applyConfig(findings, glintCfg, p.Suppressions)
-	errCount, _ := countSeverities(findings)
+
+	// --no-warn: discard warnings before any output or exit-code calculation.
+	if *noWarn {
+		kept := findings[:0]
+		for _, f := range findings {
+			if f.Severity != linter.Warning {
+				kept = append(kept, f)
+			}
+		}
+		findings = kept
+	}
+
+	errCount, warnCount := countSeverities(findings)
 
 	// In structured formats the summary line goes to stderr so stdout is clean.
 	summaryOut := os.Stdout
@@ -415,19 +487,27 @@ Examples:
 	case "github":
 		writeGitHub(os.Stdout, findings)
 	default: // "text"
-		for _, f := range findings {
+		writeTextFindings(os.Stdout, findings)
-			fmt.Println(f)
-		}
 	}
 
 	if len(findings) == 0 {
 		fmt.Fprintf(summaryOut, "OK: %s — no issues found (%d job(s), %d stage(s))\n", path, len(p.Jobs), len(p.Stages))
 	} else {
-		fmt.Fprintf(summaryOut, "%d finding(s): %d error(s)\n", len(findings), errCount)
+		switch {
+		case errCount > 0 && warnCount > 0:
+			fmt.Fprintf(summaryOut, "%d finding(s): %d error(s), %d warning(s)\n", len(findings), errCount, warnCount)
+		case errCount > 0:
+			fmt.Fprintf(summaryOut, "%d finding(s): %d error(s)\n", len(findings), errCount)
+		default:
+			fmt.Fprintf(summaryOut, "%d finding(s): %d warning(s)\n", len(findings), warnCount)
+		}
 	}
 
-	if errCount > 0 {
+	switch {
-		exit(1)
+	case errCount > 0:
+		exit(2)
+	case warnCount > 0:
+		exit(10)
 	}
 }
 
@@ -448,16 +528,17 @@ func cmdGraph(args []string) {
 	gitlabURL := fs.String("gitlab-url", "", "GitLab instance URL (overrides CI_SERVER_URL / GITLAB_URL)")
 	cacheDir := fs.String("cache-dir", "", "directory to cache fetched remote includes (created if needed)")
 	offline := fs.Bool("offline", false, "skip all network calls; serve only from --cache-dir")
+	proxy := fs.String("proxy", "", "HTTP proxy URL for remote includes and GitLab API calls (e.g. http://proxy:8080)")
 	out := fs.String("out", "glint-out", "output directory for rendered graph files (pipeline mode)")
 	format := fs.String("format", "svg", "pipeline output format: svg, mermaid, or html")
 	fs.Usage = func() {
 		fmt.Fprintf(os.Stderr, "glint %s\n\n", version)
-		fmt.Fprint(os.Stderr, `Visualise the pipeline as a job tree and/or Mermaid graph.
+		fmt.Fprint(os.Stderr, `Visualise the pipeline as a job tree or graph.
 
 Usage: glint graph [MODE] [OPTIONS] <PIPELINE>
 
 Arguments:
-  [MODE]      Graph mode; must appear before options [default: tree+includes]
+  [MODE]      Graph mode; must appear before options [default: tree]
               [possible values: tree, includes, pipeline, all]
   <PIPELINE>  Path to the .gitlab-ci.yml file
 
@@ -484,6 +565,22 @@ Options:
           GitLab instance URL.
           [env: CI_SERVER_URL | GITLAB_URL] [default: https://gitlab.com]
 
+      --cache-dir <DIR>
+          Cache fetched remote templates (project: and component: includes) in
+          DIR. The directory is created on first use. Subsequent runs read from
+          cache first, avoiding repeated network calls.
+
+      --offline
+          Do not make any network calls. All remote includes must already be
+          present in --cache-dir; missing entries emit a warning. Implies the
+          default cache dir (~/.cache/glint) when --cache-dir is not set.
+
+      --proxy <URL>
+          HTTP proxy URL for remote includes and GitLab API calls
+          (e.g. http://proxy:8080). Overrides system proxy env vars
+          (HTTP_PROXY / HTTPS_PROXY). Also configurable via proxy: in
+          .glint.yml.
+
       --branch <NAME>
           Simulate a branch push. Jobs in tree output are annotated with their
           evaluated state ([skipped] or [manual]; no tag means active).
@@ -509,6 +606,12 @@ Options:
           Run "git diff --name-only <REF>" to determine changed files for
           rules:changes: evaluation.
 
+      --no-skipped
+          Omit jobs that would be skipped in the given context. Requires at
+          least one context flag (--branch, --tag, --source, --var) or the
+          implicit default context (branch=main). Skipped jobs are removed
+          from the tree, SVG, HTML, and Mermaid output entirely.
+
       --list-vars
           Print all pipeline-level variables collected from the root file and
           every included file (sorted KEY=VALUE) to stderr, then continue
@@ -518,27 +621,35 @@ Options:
           Print help
 
 Note: when none of --branch, --tag, --source, or --var are given, glint
-defaults to --branch main --source push so that rules:if: expressions are
+detects the current git branch automatically and uses it as the default
-always evaluated.
+(falling back to 'main' when not inside a git repository or in detached-HEAD
+state). --source defaults to 'push' so that rules:if: expressions are always
+evaluated. GitLab's always-available predefined variables (CI=true,
+GITLAB_CI=true) are injected automatically; MR-specific variables
+(CI_MERGE_REQUEST_IID, CI_MERGE_REQUEST_SOURCE_BRANCH_NAME, …) are injected
+when --source merge_request_event is given. Override any with --var.
 
 Examples:
   glint graph .gitlab-ci.yml
   glint graph tree .gitlab-ci.yml
+  glint graph includes .gitlab-ci.yml > includes.mmd
   glint graph tree --branch develop .gitlab-ci.yml
   glint graph tree --tag v1.0.0 .gitlab-ci.yml
   glint graph tree --list-vars .gitlab-ci.yml
   glint graph tree --changes src/main.go .gitlab-ci.yml
-  glint graph includes .gitlab-ci.yml > includes.mmd
   glint graph pipeline .gitlab-ci.yml
   glint graph pipeline --out /tmp/graphs .gitlab-ci.yml
   glint graph pipeline --format mermaid .gitlab-ci.yml
   glint graph pipeline --format html .gitlab-ci.yml
+  glint graph tree --no-skipped --branch main .gitlab-ci.yml
+  glint graph pipeline --no-skipped --branch develop .gitlab-ci.yml
   glint graph all .gitlab-ci.yml > includes.mmd
 `)
 	}
 	branch := fs.String("branch", "", "simulate a branch push (sets CI_COMMIT_BRANCH, …)")
 	tag := fs.String("tag", "", "simulate a tag push (sets CI_COMMIT_TAG, …)")
 	source := fs.String("source", "", "set CI_PIPELINE_SOURCE")
+	noSkipped := fs.Bool("no-skipped", false, "hide jobs that would be skipped in the given context (requires a context)")
 	listVars := fs.Bool("list-vars", false, "print all collected pipeline variables to stderr, then continue")
 	var vars multiFlag
 	fs.Var(&vars, "var", "set a CI variable as KEY=VALUE; repeatable")
@@ -547,25 +658,51 @@ Examples:
 	changesFrom := fs.String("changes-from", "", "git ref to diff against for rules:changes: evaluation (e.g. HEAD~1, origin/main)")
 	_ = fs.Parse(args)
 
-	// Apply implicit defaults when no context flag is given at all.
-	if *branch == "" && *tag == "" && *source == "" && len(vars) == 0 {
-		*branch = "main"
-		*source = "push"
-	}
-
 	if fs.NArg() != 1 {
 		fs.Usage()
 		exit(2)
 		return
 	}
 	path := fs.Arg(0)
+	rootDir := filepath.Dir(filepath.Clean(path))
 
+	// Apply implicit defaults when no context flag is given at all.
+	// Prefer the actual git branch of the repository; fall back to "main".
+	if *branch == "" && *tag == "" && *source == "" && len(vars) == 0 {
+		if detected := detectGitBranch(rootDir); detected != "" {
+			*branch = detected
+		} else {
+			*branch = "main"
+		}
+		*source = "push"
+	}
+
+	glintCfg, cfgErr := config.Load(rootDir)
+	if cfgErr != nil {
+		fmt.Fprintf(os.Stderr, "%s: [warning] %s: %v\n", path, config.Filename, cfgErr)
+	}
+
+	fetcherToken := *token
+	if fetcherToken == "" {
+		fetcherToken = glintCfg.Token
+	}
+	fetcherURL := *gitlabURL
+	if fetcherURL == "" {
+		fetcherURL = glintCfg.URL
+	}
 	resolvedCacheDir := *cacheDir
+	if resolvedCacheDir == "" {
+		resolvedCacheDir = glintCfg.CacheDir
+	}
 	if *offline && resolvedCacheDir == "" {
 		resolvedCacheDir = defaultCacheDir()
 	}
+	resolvedProxy := *proxy
+	if resolvedProxy == "" {
+		resolvedProxy = glintCfg.Proxy
+	}
 
-	cfg := fetcher.AutoConfig().WithOverrides(*gitlabURL, *token, resolvedCacheDir, *offline)
+	cfg := fetcher.AutoConfig().WithOverrides(fetcherURL, fetcherToken, resolvedCacheDir, *offline).WithProxy(resolvedProxy)
 
 	p, err := model.Parse(path)
 	if err != nil {
@@ -574,7 +711,6 @@ Examples:
 		return
 	}
 
-	rootDir := filepath.Dir(filepath.Clean(path))
 	resolver.ResolveIncludes(p, cfg, rootDir) //nolint:errcheck
 	resolver.Resolve(p)                       //nolint:errcheck
 
@@ -607,12 +743,18 @@ Examples:
 		printVars(p, ctx)
 	}
 
+	// --no-skipped: remove jobs that evaluate to skipped in the current context
+	// before handing the pipeline to any graph function.
+	if *noSkipped && !ctx.IsEmpty() {
+		for name, job := range p.Jobs {
+			if !strings.HasPrefix(name, ".") && cicontext.EvalJob(job, ctx) == cicontext.JobSkipped {
+				delete(p.Jobs, name)
+			}
+		}
+	}
+
 	switch mode {
-	case "default":
+	case "default", "tree":
-		fmt.Print(graph.Tree(p, ctx))
-		fmt.Println("---")
-		fmt.Print(graph.Includes(path, p.Include, cfg))
-	case "tree":
 		fmt.Print(graph.Tree(p, ctx))
 	case "includes":
 		fmt.Print(graph.Includes(path, p.Include, cfg))

cmd/glint/main_test.go

@@ -112,7 +112,7 @@ func TestCmdCheck_MissingFile(t *testing.T) {
 	if *code != 2 { t.Errorf("missing file: want exit(2), got %d", *code) }
 }
 
-func TestCmdCheck_WithErrors_ExitsOne(t *testing.T) {
+func TestCmdCheck_WithErrors_ExitsTwo(t *testing.T) {
 	code := captureExit(t)
 	// Pipeline with an error finding (invalid stage reference)
 	content := `
@@ -123,7 +123,7 @@ test-job:
 `
 	path := writePipeline(t, content)
 	cmdCheck([]string{path})
-	if *code != 1 { t.Errorf("pipeline with errors: want exit(1), got %d", *code) }
+	if *code != 2 { t.Errorf("pipeline with errors: want exit(2), got %d", *code) }
 }
 
 func TestCmdCheck_FormatJSON(t *testing.T) {
@@ -703,10 +703,10 @@ func TestCmdCheck_ChangesFrom_Fails(t *testing.T) {
 
 	code := captureExit(t)
 	path := writePipeline(t, minimalPipeline)
-	// Should warn but not crash; pipeline is clean → no exit(1).
+	// Should warn but not crash; pipeline is clean → no exit(2).
 	cmdCheck([]string{"--changes-from", "origin/main", path})
-	if *code == 1 {
+	if *code == 2 {
-		t.Errorf("expected no exit(1) when --changes-from fails gracefully, got %d", *code)
+		t.Errorf("expected no exit(2) when --changes-from fails gracefully, got %d", *code)
 	}
 }
 
@@ -753,10 +753,10 @@ build-job:
 `
 	path := writePipeline(t, content)
 	// build-job's rule fires only if src/** matches; with 0 changed files it is skipped.
-	// Pipeline is clean (no lint errors) → no exit(1).
+	// Pipeline is clean (no lint errors) → no exit(2).
 	cmdCheck([]string{"--changes-from", "origin/main", path})
-	if *code == 1 {
+	if *code == 2 {
-		t.Errorf("unexpected exit(1): %d", *code)
+		t.Errorf("unexpected exit(2): %d", *code)
 	}
 }
 
@@ -770,8 +770,8 @@ func TestCmdGraph_ChangesFrom_Fails(t *testing.T) {
 	code := captureExit(t)
 	path := writePipeline(t, minimalPipeline)
 	cmdGraph([]string{"tree", "--changes-from", "origin/main", path})
-	if *code == 1 {
+	if *code == 2 {
-		t.Errorf("unexpected exit(1) when --changes-from fails in graph mode")
+		t.Errorf("unexpected exit(2) when --changes-from fails in graph mode")
 	}
 }
 
@@ -785,8 +785,8 @@ func TestCmdGraph_ChangesFrom_Success(t *testing.T) {
 	code := captureExit(t)
 	path := writePipeline(t, minimalPipeline)
 	cmdGraph([]string{"tree", "--changes-from", "origin/main", path})
-	if *code == 1 {
+	if *code == 2 {
-		t.Errorf("unexpected exit(1) in graph --changes-from success path")
+		t.Errorf("unexpected exit(2) in graph --changes-from success path")
 	}
 }
 
@@ -801,8 +801,8 @@ func TestCmdGraph_ChangesFrom_EmptyDiff(t *testing.T) {
 	path := writePipeline(t, minimalPipeline)
 	// reliable=true, allChanged nil → allChanged = []string{} branch hit
 	cmdGraph([]string{"tree", "--changes-from", "origin/main", path})
-	if *code == 1 {
+	if *code == 2 {
-		t.Errorf("unexpected exit(1) in graph --changes-from empty diff")
+		t.Errorf("unexpected exit(2) in graph --changes-from empty diff")
 	}
 }
 
@@ -818,8 +818,8 @@ build-job:
 `
 	path := writePipeline(t, content)
 	cmdGraph([]string{"tree", "--changes", "src/app.go", path})
-	if *code == 1 {
+	if *code == 2 {
-		t.Errorf("unexpected exit(1) with valid pipeline and --changes flag")
+		t.Errorf("unexpected exit(2) with valid pipeline and --changes flag")
 	}
 }
 
@@ -848,7 +848,7 @@ deploy-job:
 	// by rules evaluation → needs cross-check suppressed → exit 0.
 	code := captureExit(t)
 	cmdCheck([]string{"--branch", "main", path})
-	if *code == 1 {
+	if *code == 2 {
 		t.Error("skipped job's needs: error should be suppressed in context-scoped lint")
 	}
 }
@@ -873,8 +873,8 @@ deploy-job:
 
 	code := captureExit(t)
 	cmdCheck([]string{"--tag", "v1.0.0", path})
-	if *code != 1 {
+	if *code != 2 {
-		t.Error("active job's bad needs: should still produce GL027 error")
+		t.Error("active job's bad needs: should still produce GL027 error (exit 2)")
 	}
 }
 
@@ -883,7 +883,7 @@ func TestCmdCheck_ContextScopedLinting_SkippedSet_IsNilWhenAllActive(t *testing.
 	code := captureExit(t)
 	path := writePipeline(t, minimalPipeline)
 	cmdCheck([]string{"--branch", "main", path})
-	if *code == 1 {
+	if *code == 2 {
 		t.Error("valid pipeline with all-active jobs should not produce errors")
 	}
 }
@@ -1142,8 +1142,8 @@ test-job:
 `
 	path := writePipeline(t, content)
 	cmdCheck([]string{"--context", "branch=main", path})
-	if *code != 1 {
+	if *code != 2 {
-		t.Errorf("multi-context error pipeline: want exit(1), got %d", *code)
+		t.Errorf("multi-context error pipeline: want exit(2), got %d", *code)
 	}
 }
 
@@ -1250,3 +1250,31 @@ func TestIsSuppressed(t *testing.T) {
 	if !isSuppressed("all-job", "GL042", suppressions) { t.Error("wildcard should suppress") }
 	if isSuppressed("unknown-job", "GL001", suppressions) { t.Error("unknown job: not suppressed") }
 }
+
+func TestDetectGitBranch(t *testing.T) {
+	orig := gitBranchInDir
+	t.Cleanup(func() { gitBranchInDir = orig })
+
+	tests := []struct {
+		name    string
+		output  string
+		err     error
+		want    string
+	}{
+		{"normal branch", "main\n", nil, "main"},
+		{"branch with trailing newline", "feature/my-branch\n", nil, "feature/my-branch"},
+		{"detached HEAD", "HEAD\n", nil, ""},
+		{"git error (not a repo)", "", errors.New("exit 128"), ""},
+		{"empty output", "\n", nil, ""},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			gitBranchInDir = func(_ string) ([]byte, error) {
+				return []byte(tt.output), tt.err
+			}
+			if got := detectGitBranch("."); got != tt.want {
+				t.Errorf("detectGitBranch() = %q, want %q", got, tt.want)
+			}
+		})
+	}
+}

cmd/glint/output.go

@@ -0,0 +1,111 @@
+package main
+
+import (
+	"fmt"
+	"io"
+	"os"
+	"strings"
+
+	"git.k3nny.fr/glint/internal/linter"
+)
+
+// ANSI escape sequences used for colorized output.
+const (
+	ansiReset  = "\033[0m"
+	ansiBold   = "\033[1m"
+	ansiDim    = "\033[2m"
+	ansiRed    = "\033[31m"
+	ansiOrange = "\033[33m" // rendered as orange/amber in most terminals
+)
+
+// colorEnabled reports whether ANSI color should be used when writing to w.
+// Colors are suppressed when NO_COLOR is set or when w is not a terminal.
+func colorEnabled(w io.Writer) bool {
+	if os.Getenv("NO_COLOR") != "" {
+		return false
+	}
+	f, ok := w.(*os.File)
+	if !ok {
+		return false
+	}
+	fi, err := f.Stat()
+	return err == nil && (fi.Mode()&os.ModeCharDevice) != 0
+}
+
+// writeTextFindings prints findings in a columnized format with optional
+// ANSI color. All findings are scanned first to compute column widths so
+// that each field aligns across all output lines.
+//
+// Output columns (space-separated, no borders):
+//
+//	location   RULE   severity   message
+func writeTextFindings(w io.Writer, findings []linter.Finding) {
+	if len(findings) == 0 {
+		return
+	}
+
+	color := colorEnabled(w)
+
+	// Pre-compute locations and maximum location width.
+	locs := make([]string, len(findings))
+	maxLoc := 0
+	for i, f := range findings {
+		locs[i] = findingLocation(f)
+		if len(locs[i]) > maxLoc {
+			maxLoc = len(locs[i])
+		}
+	}
+
+	// Rule IDs are always 5 chars (GL001–GL999).
+	const ruleWidth = 5
+	// Severity width: "warning" = 7 chars.
+	const sevWidth = 7
+
+	for i, f := range findings {
+		loc := locs[i]
+		rule := f.Rule
+		sev := strings.ToLower(string(f.Severity))
+
+		msg := f.Message
+		if f.Job != "" {
+			msg = fmt.Sprintf("job %q: %s", f.Job, msg)
+		}
+
+		if color {
+			var sevSeq string
+			if f.Severity == linter.Error {
+				sevSeq = ansiRed + ansiBold
+			} else {
+				sevSeq = ansiOrange + ansiBold
+			}
+			fmt.Fprintf(w, "%s%-*s%s  %s%-*s%s  %s%-*s%s  %s\n",
+				ansiDim, maxLoc, loc, ansiReset,
+				ansiBold, ruleWidth, rule, ansiReset,
+				sevSeq, sevWidth, sev, ansiReset,
+				msg,
+			)
+		} else {
+			fmt.Fprintf(w, "%-*s  %-*s  %-*s  %s\n",
+				maxLoc, loc,
+				ruleWidth, rule,
+				sevWidth, sev,
+				msg,
+			)
+		}
+	}
+}
+
+// findingLocation formats the file:line:col location string for a finding.
+func findingLocation(f linter.Finding) string {
+	if f.File == "" {
+		return ""
+	}
+	switch {
+	case f.Line > 0 && f.Column > 0:
+		return fmt.Sprintf("%s:%d:%d", f.File, f.Line, f.Column)
+	case f.Line > 0:
+		return fmt.Sprintf("%s:%d", f.File, f.Line)
+	default:
+		return f.File
+	}
+}

cmd/glint/render.go

@@ -0,0 +1,269 @@
+package main
+
+import (
+	"flag"
+	"fmt"
+	"os"
+	"path/filepath"
+	"sort"
+	"strings"
+
+	"git.k3nny.fr/glint/internal/config"
+	"git.k3nny.fr/glint/internal/fetcher"
+	"git.k3nny.fr/glint/internal/model"
+	"git.k3nny.fr/glint/internal/resolver"
+	"gopkg.in/yaml.v3"
+)
+
+func cmdRender(args []string) {
+	fs := flag.NewFlagSet("glint render", flag.ExitOnError)
+	output := fs.String("output", "", "output file path (default: rendered.gitlab-ci.yml; use - for stdout)")
+	token := fs.String("token", "", "GitLab personal access token (overrides GITLAB_TOKEN)")
+	gitlabURL := fs.String("gitlab-url", "", "GitLab instance URL (overrides CI_SERVER_URL / GITLAB_URL)")
+	cacheDir := fs.String("cache-dir", "", "directory to cache fetched remote includes")
+	offline := fs.Bool("offline", false, "skip all network calls; serve only from --cache-dir")
+	proxy := fs.String("proxy", "", "HTTP proxy URL for remote includes (e.g. http://proxy:8080)")
+	fs.Usage = func() {
+		fmt.Fprintf(os.Stderr, "glint %s\n\n", version)
+		fmt.Fprint(os.Stderr, `Resolve all includes and extends into a single merged YAML file.
+
+Performs the same include resolution and extends merging that GitLab CI
+does server-side, then writes the fully flattened pipeline to a single file.
+Useful for inspecting the resolved pipeline or running further local tooling.
+
+The output file strips 'include:' (consumed by resolution) and 'extends:'
+(applied to each job) keys. All other fields are preserved verbatim.
+Template jobs (names starting with '.') are retained.
+
+Usage: glint render [OPTIONS] <PIPELINE>
+
+Arguments:
+  <PIPELINE>  Path to the .gitlab-ci.yml file to resolve
+
+Options:
+      --output <FILE>
+          Write the rendered pipeline to FILE.
+          Use '-' to write to stdout.
+          [default: rendered.gitlab-ci.yml]
+
+      --token <TOKEN>
+          GitLab personal access token for fetching project: and component:
+          includes.
+          [env: GITLAB_TOKEN | CI_JOB_TOKEN | GITLAB_PRIVATE_TOKEN]
+
+      --gitlab-url <URL>
+          GitLab instance URL.
+          [env: CI_SERVER_URL | GITLAB_URL] [default: https://gitlab.com]
+
+      --cache-dir <DIR>
+          Cache directory for fetched remote includes.
+
+      --offline
+          Do not make any network calls; use cache only.
+
+      --proxy <URL>
+          HTTP proxy URL for remote includes and GitLab API calls.
+
+  -h, --help
+          Print help
+
+Examples:
+  glint render .gitlab-ci.yml
+  glint render --output merged.yml .gitlab-ci.yml
+  glint render --output - .gitlab-ci.yml | yq .
+  glint render --offline --cache-dir ~/.cache/glint .gitlab-ci.yml
+`)
+	}
+	_ = fs.Parse(args)
+
+	if fs.NArg() != 1 {
+		fs.Usage()
+		exit(2)
+		return
+	}
+	path := fs.Arg(0)
+	rootDir := filepath.Dir(filepath.Clean(path))
+
+	glintCfg, cfgErr := config.Load(rootDir)
+	if cfgErr != nil {
+		fmt.Fprintf(os.Stderr, "%s: [warning] %s: %v\n", path, config.Filename, cfgErr)
+	}
+
+	fetcherToken := *token
+	if fetcherToken == "" {
+		fetcherToken = glintCfg.Token
+	}
+	fetcherURL := *gitlabURL
+	if fetcherURL == "" {
+		fetcherURL = glintCfg.URL
+	}
+	resolvedCacheDir := *cacheDir
+	if resolvedCacheDir == "" {
+		resolvedCacheDir = glintCfg.CacheDir
+	}
+	if *offline && resolvedCacheDir == "" {
+		resolvedCacheDir = defaultCacheDir()
+	}
+	resolvedProxy := *proxy
+	if resolvedProxy == "" {
+		resolvedProxy = glintCfg.Proxy
+	}
+
+	cfg := fetcher.AutoConfig().WithOverrides(fetcherURL, fetcherToken, resolvedCacheDir, *offline).WithProxy(resolvedProxy)
+
+	p, err := model.Parse(path)
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "error: %v\n", err)
+		exit(2)
+		return
+	}
+
+	warnings, _ := resolver.ResolveIncludes(p, cfg, rootDir)
+	for _, w := range warnings {
+		fmt.Fprintf(os.Stderr, "%s: [warning] include %s\n", path, w)
+	}
+
+	extWarnings, err := resolver.Resolve(p)
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "error: resolving extends: %v\n", err)
+		exit(2)
+		return
+	}
+	for _, w := range extWarnings {
+		fmt.Fprintf(os.Stderr, "%s: [warning] job %q extends unknown job %q; extends chain skipped\n", path, w.Job, w.Base)
+	}
+
+	doc, err := buildRenderDoc(p)
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "error: building output: %v\n", err)
+		exit(2)
+		return
+	}
+
+	outPath := *output
+	if outPath == "" {
+		outPath = "rendered.gitlab-ci.yml"
+	}
+
+	var w interface{ Write([]byte) (int, error) }
+	if outPath == "-" {
+		w = os.Stdout
+	} else {
+		f, err := os.Create(outPath)
+		if err != nil {
+			fmt.Fprintf(os.Stderr, "error: creating output file: %v\n", err)
+			exit(2)
+			return
+		}
+		defer f.Close()
+		w = f
+	}
+
+	enc := yaml.NewEncoder(w)
+	enc.SetIndent(2)
+	if err := enc.Encode(doc); err != nil {
+		fmt.Fprintf(os.Stderr, "error: writing output: %v\n", err)
+		exit(2)
+		return
+	}
+	_ = enc.Close()
+
+	if outPath != "-" {
+		jobCount := 0
+		for name := range p.Jobs {
+			if !strings.HasPrefix(name, ".") {
+				jobCount++
+			}
+		}
+		fmt.Fprintf(os.Stderr, "rendered: %s (%d job(s), %d stage(s))\n", outPath, jobCount, len(p.Stages))
+	}
+}
+
+// buildRenderDoc constructs an ordered yaml.Node document from the resolved
+// pipeline. Pipeline-level keys (stages, variables, default, workflow) come
+// first, followed by template jobs (.name) then regular jobs, both sorted
+// alphabetically. 'include:' and 'extends:' are omitted — they have been
+// consumed by the resolution passes.
+func buildRenderDoc(p *model.Pipeline) (*yaml.Node, error) {
+	root := &yaml.Node{Kind: yaml.MappingNode, Tag: "!!map"}
+
+	addField := func(key string, val any) error {
+		n, err := anyToNode(val)
+		if err != nil {
+			return fmt.Errorf("encoding %q: %w", key, err)
+		}
+		root.Content = append(root.Content,
+			&yaml.Node{Kind: yaml.ScalarNode, Tag: "!!str", Value: key},
+			n,
+		)
+		return nil
+	}
+
+	if len(p.Stages) > 0 {
+		if err := addField("stages", p.Stages); err != nil {
+			return nil, err
+		}
+	}
+	if len(p.Variables) > 0 {
+		if err := addField("variables", p.Variables); err != nil {
+			return nil, err
+		}
+	}
+	if p.Default != nil {
+		if err := addField("default", p.Default); err != nil {
+			return nil, err
+		}
+	}
+	if p.Workflow != nil {
+		if err := addField("workflow", p.Workflow); err != nil {
+			return nil, err
+		}
+	}
+
+	// Collect and sort job names: template jobs first, then regular jobs.
+	var templates, regular []string
+	for name := range p.RawJobs {
+		if strings.HasPrefix(name, ".") {
+			templates = append(templates, name)
+		} else {
+			regular = append(regular, name)
+		}
+	}
+	sort.Strings(templates)
+	sort.Strings(regular)
+
+	for _, name := range append(templates, regular...) {
+		raw := p.RawJobs[name]
+		// Copy to avoid mutating the shared map; strip resolution-consumed keys.
+		cleaned := make(map[string]any, len(raw))
+		for k, v := range raw {
+			if k == "extends" {
+				continue
+			}
+			cleaned[k] = v
+		}
+		if err := addField(name, cleaned); err != nil {
+			return nil, err
+		}
+	}
+
+	doc := &yaml.Node{Kind: yaml.DocumentNode, Content: []*yaml.Node{root}}
+	return doc, nil
+}
+
+// anyToNode converts an arbitrary Go value to a *yaml.Node by round-tripping
+// through yaml.Marshal / yaml.Unmarshal, which preserves all value types.
+func anyToNode(v any) (*yaml.Node, error) {
+	data, err := yaml.Marshal(v)
+	if err != nil {
+		return nil, err
+	}
+	var doc yaml.Node
+	if err := yaml.Unmarshal(data, &doc); err != nil {
+		return nil, err
+	}
+	if doc.Kind == yaml.DocumentNode && len(doc.Content) > 0 {
+		return doc.Content[0], nil
+	}
+	return &doc, nil
+}

internal/cicontext/context.go

@@ -14,6 +14,32 @@ type Context struct {
 	changedFiles []string        // nil = not provided (permissive); non-nil = known set of changed files
 }
 
+// gitlabAlwaysVars are GitLab predefined variables that are constant across
+// every pipeline, instance, and project. Injected at the lowest priority so
+// that pipeline variables: blocks and --var overrides can still win.
+var gitlabAlwaysVars = map[string]string{
+	"CI":        "true",
+	"GITLAB_CI": "true",
+}
+
+// gitlabMRVars are predefined variables GitLab injects only for
+// CI_PIPELINE_SOURCE=merge_request_event pipelines. Placeholder values are
+// used so that rules:if: expressions that gate on MR context evaluate
+// correctly. All can be overridden with --var.
+//
+// CI_MERGE_REQUEST_SOURCE_BRANCH_NAME is left empty here and filled from
+// CI_COMMIT_BRANCH (the --branch flag) when available.
+var gitlabMRVars = map[string]string{
+	"CI_MERGE_REQUEST_ID":                  "1",
+	"CI_MERGE_REQUEST_IID":                 "1",
+	"CI_MERGE_REQUEST_SOURCE_BRANCH_NAME":  "",
+	"CI_MERGE_REQUEST_TARGET_BRANCH_NAME":  "main",
+	"CI_MERGE_REQUEST_PROJECT_PATH":        "namespace/project",
+	"CI_MERGE_REQUEST_TITLE":               "Draft: placeholder",
+	"CI_MERGE_REQUEST_LABELS":              "",
+	"CI_OPEN_MERGE_REQUESTS":               "namespace/project!1",
+}
+
 // New builds a Context from high-level shortcut values and optional KEY=VALUE
 // overrides. Predefined CI variables are derived from the shortcuts so callers
 // do not need to know their exact names.
@@ -21,15 +47,18 @@ type Context struct {
 // Returns an empty Context (IsEmpty() == true) when all inputs are zero values,
 // preserving the existing linting behaviour when no context flags are given.
 //
-// Override priority (highest wins): extraVars > branch/tag/source shortcuts.
+// Override priority (highest wins): extraVars > branch/tag/source shortcuts >
-// Both shortcut-derived and extraVar variables are pinned — they will not be
+// pipeline variables (via Inject) > GitLab predefined defaults.
-// overwritten by Inject (used for pipeline-level and workflow-rule variables).
 func New(branch, tag, source string, extraVars []string) *Context {
 	if branch == "" && tag == "" && source == "" && len(extraVars) == 0 {
 		return &Context{}
 	}
 
-	vars := make(map[string]string)
+	// Seed with always-available GitLab predefined variables at lowest priority.
+	vars := make(map[string]string, len(gitlabAlwaysVars)+8)
+	for k, v := range gitlabAlwaysVars {
+		vars[k] = v
+	}
 	pinned := make(map[string]bool)
 
 	pin := func(k, v string) {
@@ -62,6 +91,22 @@ func New(branch, tag, source string, extraVars []string) *Context {
 		vars["CI_DEFAULT_BRANCH"] = "main"
 	}
 
+	// For MR pipelines, inject placeholder values for the predefined MR
+	// variables so that rules:if: expressions like '$CI_MERGE_REQUEST_IID'
+	// evaluate as non-empty (truthy). These are non-pinned so --var overrides
+	// them and pipeline variables: can also override via Inject.
+	if source == "merge_request_event" {
+		for k, v := range gitlabMRVars {
+			if !pinned[k] {
+				vars[k] = v
+			}
+		}
+		// Derive source branch from --branch when available.
+		if branch != "" && vars["CI_MERGE_REQUEST_SOURCE_BRANCH_NAME"] == "" {
+			vars["CI_MERGE_REQUEST_SOURCE_BRANCH_NAME"] = branch
+		}
+	}
+
 	// KEY=VALUE overrides win over shortcuts and everything else.
 	for _, kv := range extraVars {
 		k, v, ok := strings.Cut(kv, "=")

internal/cicontext/context_test.go

@@ -78,6 +78,66 @@ func TestNew_DefaultBranch(t *testing.T) {
 	}
 }
 
+func TestNew_PredefinedAlwaysVars(t *testing.T) {
+	ctx := New("main", "", "", nil)
+	if ctx.Get("CI") != "true" {
+		t.Errorf("CI should be 'true', got %q", ctx.Get("CI"))
+	}
+	if ctx.Get("GITLAB_CI") != "true" {
+		t.Errorf("GITLAB_CI should be 'true', got %q", ctx.Get("GITLAB_CI"))
+	}
+}
+
+func TestNew_PredefinedAlwaysVars_EmptyContext(t *testing.T) {
+	// Always-vars must NOT be injected when the context is empty (no flags).
+	ctx := New("", "", "", nil)
+	if ctx.Get("CI") != "" {
+		t.Errorf("CI should be empty in empty context, got %q", ctx.Get("CI"))
+	}
+}
+
+func TestNew_PredefinedAlwaysVars_OverridableByVar(t *testing.T) {
+	ctx := New("main", "", "", []string{"CI=false"})
+	if ctx.Get("CI") != "false" {
+		t.Errorf("--var should override CI, got %q", ctx.Get("CI"))
+	}
+}
+
+func TestNew_PredefinedAlwaysVars_OverridableByInject(t *testing.T) {
+	ctx := New("main", "", "", nil)
+	ctx.Inject("CI", "custom")
+	if ctx.Get("CI") != "custom" {
+		t.Errorf("Inject should override non-pinned CI, got %q", ctx.Get("CI"))
+	}
+}
+
+func TestNew_MRVars(t *testing.T) {
+	ctx := New("feature/my-branch", "", "merge_request_event", nil)
+	if ctx.Get("CI_MERGE_REQUEST_IID") != "1" {
+		t.Errorf("CI_MERGE_REQUEST_IID should be '1', got %q", ctx.Get("CI_MERGE_REQUEST_IID"))
+	}
+	if ctx.Get("CI_MERGE_REQUEST_SOURCE_BRANCH_NAME") != "feature/my-branch" {
+		t.Errorf("source branch should match --branch, got %q", ctx.Get("CI_MERGE_REQUEST_SOURCE_BRANCH_NAME"))
+	}
+	if ctx.Get("CI_MERGE_REQUEST_TARGET_BRANCH_NAME") != "main" {
+		t.Errorf("target branch should be 'main', got %q", ctx.Get("CI_MERGE_REQUEST_TARGET_BRANCH_NAME"))
+	}
+}
+
+func TestNew_MRVars_NotInjectedForNonMR(t *testing.T) {
+	ctx := New("main", "", "push", nil)
+	if ctx.Get("CI_MERGE_REQUEST_IID") != "" {
+		t.Errorf("CI_MERGE_REQUEST_IID should be empty for push pipeline, got %q", ctx.Get("CI_MERGE_REQUEST_IID"))
+	}
+}
+
+func TestNew_MRVars_OverridableByVar(t *testing.T) {
+	ctx := New("", "", "merge_request_event", []string{"CI_MERGE_REQUEST_IID=42"})
+	if ctx.Get("CI_MERGE_REQUEST_IID") != "42" {
+		t.Errorf("--var should override CI_MERGE_REQUEST_IID, got %q", ctx.Get("CI_MERGE_REQUEST_IID"))
+	}
+}
+
 func TestInject(t *testing.T) {
 	ctx := New("main", "", "", nil)
 	// pinned var should not be overwritten

internal/cicontext/reachability.go

@@ -42,22 +42,18 @@ func EvalWorkflow(p *model.Pipeline, ctx *Context) (bool, map[string]string) {
 		return true, nil
 	}
 	vars := ctx.Get
-	for _, rule := range p.Workflow.Rules {
+	// Workflow rules use strict evaluation: an unparseable condition is treated
-		// Workflow rules use strict evaluation: an unparseable condition is
+	// as no-match so later rules are reached. Permissive-true would cause an
-		// treated as no-match so later rules (with valid conditions or a
+	// early rule with a complex condition to block all subsequent rules.
-		// bare when:) are reached. Permissive-true would cause an early rule
+	for _, group := range p.Workflow.Rules.Groups() {
-		// with a complex/invalid condition to block all subsequent rules.
+		matched, when, groupVars := evalRuleGroup(group, vars, ctx, true)
-		if !ruleIfMatchesStrict(rule.If, vars) {
+		if !matched {
 			continue
 		}
-		if !changesMatch(rule.Changes, ctx) {
-			continue
-		}
-		when := rule.When
 		if when == "" {
 			when = "always"
 		}
-		return when != "never", ExtractStringVars(rule.Variables)
+		return when != "never", groupVars
 	}
 	return false, nil // no rule matched → pipeline does not run
 }
@@ -74,14 +70,12 @@ func EvalJob(job model.Job, ctx *Context) JobState {
 
 	// rules: takes priority over only/except.
 	if len(job.Rules) > 0 {
-		for _, rule := range job.Rules {
+		for _, group := range job.Rules.Groups() {
-			if !ruleIfMatches(rule.If, vars) {
+			matched, when, _ := evalRuleGroup(group, vars, ctx, false)
+			if !matched {
 				continue
 			}
-			if !changesMatch(rule.Changes, ctx) {
+			return whenToState(when)
-				continue
-			}
-			return whenToState(rule.When)
 		}
 		return JobSkipped // no rule matched → job is excluded
 	}
@@ -98,6 +92,35 @@ func EvalJob(job model.Job, ctx *Context) JobState {
 
 // ── Helpers ───────────────────────────────────────────────────────────────────
 
+// evalRuleGroup evaluates one rule group (one or more rules forming an AND-group).
+// All conditions in the group must match for the group to fire.
+// Returns (matched, effectiveWhen, mergedVars). When strict=true, unparseable
+// if: expressions count as no-match; when false, they count as match (permissive).
+func evalRuleGroup(group []model.Rule, vars func(string) string, ctx *Context, strict bool) (bool, string, map[string]string) {
+	for _, rule := range group {
+		var ifOk bool
+		if strict {
+			ifOk = ruleIfMatchesStrict(rule.If, vars)
+		} else {
+			ifOk = ruleIfMatches(rule.If, vars)
+		}
+		if !ifOk || !changesMatch(rule.Changes, ctx) {
+			return false, "", nil
+		}
+	}
+	merged := make(map[string]string)
+	effectiveWhen := ""
+	for _, rule := range group {
+		for k, v := range ExtractStringVars(rule.Variables) {
+			merged[k] = v
+		}
+		if rule.When != "" {
+			effectiveWhen = rule.When
+		}
+	}
+	return true, effectiveWhen, merged
+}
+
 func ruleIfMatches(ifExpr string, vars func(string) string) bool {
 	if ifExpr == "" {
 		return true // no if: condition → rule always matches

internal/config/config.go

@@ -38,6 +38,12 @@ type Config struct {
 	// CacheDir is the default directory for caching fetched remote includes.
 	// Overridden by the --cache-dir flag.
 	CacheDir string `yaml:"cache_dir"`
+
+	// Proxy is the HTTP proxy URL for fetching remote includes and GitLab API
+	// calls (e.g. "http://proxy.example.com:8080"). Overridden by the --proxy
+	// flag. When empty, system proxy settings (HTTP_PROXY / HTTPS_PROXY /
+	// NO_PROXY env vars) are used automatically.
+	Proxy string `yaml:"proxy"`
 }
 
 // Load searches for a .glint.yml file starting from dir and walking up toward

internal/config/config_test.go

@@ -103,6 +103,9 @@ func TestLoad_StopsAtGitRoot(t *testing.T) {
 // TestLoad_ReadError covers the !os.IsNotExist(err) branch (config.go:59-61)
 // when the file exists but is not readable.
 func TestLoad_ReadError(t *testing.T) {
+	if os.Getuid() == 0 {
+		t.Skip("skipping: root bypasses file permission checks")
+	}
 	tmp := t.TempDir()
 	cfgPath := filepath.Join(tmp, Filename)
 	if err := os.WriteFile(cfgPath, []byte("ignore: []"), 0o000); err != nil {

internal/fetcher/cache.go

@@ -26,10 +26,10 @@ func cacheWrite(dir, key string, data []byte) {
 	if dir == "" {
 		return
 	}
-	if err := os.MkdirAll(dir, 0o755); err != nil {
+	if err := os.MkdirAll(dir, 0o700); err != nil {
 		return
 	}
-	_ = os.WriteFile(cachePath(dir, key), data, 0o644)
+	_ = os.WriteFile(cachePath(dir, key), data, 0o600)
 }
 
 // cachePath returns the filesystem path for a cache entry.

internal/fetcher/cache_test.go

@@ -71,3 +71,28 @@ func TestCacheWrite_MkdirAll(t *testing.T) {
 		t.Errorf("directory not created: %v", err)
 	}
 }
+
+func TestCacheWrite_FilePermissions(t *testing.T) {
+	dir := t.TempDir()
+	cacheWrite(dir, "seckey", []byte("secret"))
+	info, err := os.Stat(cachePath(dir, "seckey"))
+	if err != nil {
+		t.Fatalf("stat cache file: %v", err)
+	}
+	if mode := info.Mode().Perm(); mode != 0o600 {
+		t.Errorf("cache file mode = %04o; want 0600", mode)
+	}
+}
+
+func TestCacheWrite_DirPermissions(t *testing.T) {
+	parent := t.TempDir()
+	dir := filepath.Join(parent, "glint-cache")
+	cacheWrite(dir, "k", []byte("v"))
+	info, err := os.Stat(dir)
+	if err != nil {
+		t.Fatalf("stat cache dir: %v", err)
+	}
+	if mode := info.Mode().Perm(); mode != 0o700 {
+		t.Errorf("cache dir mode = %04o; want 0700", mode)
+	}
+}

internal/fetcher/gitlab.go

@@ -8,8 +8,18 @@ import (
 	"net/url"
 	"os"
 	"strings"
+	"time"
 )
 
+// httpClient is the shared HTTP client for all fetcher requests.
+// Timeout guards against hung remote servers. Transport is intentionally nil
+// so http.DefaultTransport is used dynamically — allowing tests to swap it.
+var httpClient = &http.Client{Timeout: 30 * time.Second}
+
+// maxResponseBytes is the per-response size cap. Responses larger than this
+// are rejected to prevent memory exhaustion from pathological servers.
+const maxResponseBytes int64 = 10 << 20 // 10 MiB
+
 // TokenSource describes where a token was found, which determines the correct
 // authentication header to use with the GitLab API.
 type TokenSource int
@@ -27,6 +37,10 @@ type GitLabConfig struct {
 	Source   TokenSource
 	CacheDir string // local cache directory; empty = caching disabled
 	Offline  bool   // when true, return an error instead of making network calls
+	// ProxyURL overrides the HTTP proxy for all requests made with this config.
+	// Empty string means use system proxy settings (HTTP_PROXY / HTTPS_PROXY /
+	// NO_PROXY env vars honoured automatically by http.DefaultTransport).
+	ProxyURL string
 }
 
 // AutoConfig builds a GitLabConfig from environment variables.
@@ -56,6 +70,33 @@ func AutoConfig() GitLabConfig {
 	return cfg
 }
 
+// WithProxy returns a copy of cfg with ProxyURL set.
+func (cfg GitLabConfig) WithProxy(proxyURL string) GitLabConfig {
+	cfg.ProxyURL = proxyURL
+	return cfg
+}
+
+// client returns an HTTP client for this config.
+// When ProxyURL is set it takes precedence over system proxy env vars;
+// otherwise http.DefaultTransport's built-in ProxyFromEnvironment is used.
+func (cfg GitLabConfig) client() *http.Client {
+	if cfg.ProxyURL == "" {
+		return httpClient
+	}
+	proxyURL, err := url.Parse(cfg.ProxyURL)
+	if err != nil {
+		return httpClient
+	}
+	// Clone the default transport so all TLS/dial settings are preserved.
+	t, ok := http.DefaultTransport.(*http.Transport)
+	if !ok {
+		return httpClient
+	}
+	transport := t.Clone()
+	transport.Proxy = http.ProxyURL(proxyURL)
+	return &http.Client{Timeout: httpClient.Timeout, Transport: transport}
+}
+
 // WithOverrides returns a copy of cfg with the provided overrides applied.
 // Non-empty strings overwrite the corresponding field; booleans are always
 // applied (so offline: false explicitly clears offline mode).
@@ -128,16 +169,19 @@ func (cfg GitLabConfig) FetchFile(project, filePath, ref string) ([]byte, error)
 		}
 	}
 
-	resp, err := http.DefaultClient.Do(req)
+	resp, err := cfg.client().Do(req)
 	if err != nil {
 		return nil, fmt.Errorf("GET %s: %w", apiURL, err)
 	}
 	defer resp.Body.Close()
 
-	body, err := io.ReadAll(resp.Body)
+	body, err := io.ReadAll(io.LimitReader(resp.Body, maxResponseBytes+1))
 	if err != nil {
 		return nil, fmt.Errorf("reading response body: %w", err)
 	}
+	if int64(len(body)) > maxResponseBytes {
+		return nil, fmt.Errorf("response body exceeds maximum size (%d MiB)", maxResponseBytes>>20)
+	}
 
 	if resp.StatusCode != http.StatusOK {
 		msg := strings.TrimSpace(string(body))
@@ -169,15 +213,18 @@ func (cfg GitLabConfig) FetchURL(rawURL string) ([]byte, error) {
 		return nil, fmt.Errorf("offline mode: %s is not in the local cache (run without --offline first to populate the cache)", rawURL)
 	}
 
-	resp, err := http.Get(rawURL) //nolint:noctx
+	resp, err := cfg.client().Get(rawURL)
 	if err != nil {
 		return nil, fmt.Errorf("GET %s: %w", rawURL, err)
 	}
 	defer resp.Body.Close()
-	body, err := io.ReadAll(resp.Body)
+	body, err := io.ReadAll(io.LimitReader(resp.Body, maxResponseBytes+1))
 	if err != nil {
 		return nil, fmt.Errorf("reading body: %w", err)
 	}
+	if int64(len(body)) > maxResponseBytes {
+		return nil, fmt.Errorf("response body exceeds maximum size (%d MiB)", maxResponseBytes>>20)
+	}
 	if resp.StatusCode != http.StatusOK {
 		return nil, fmt.Errorf("GET %s: status %d", rawURL, resp.StatusCode)
 	}

internal/fetcher/gitlab_test.go

@@ -6,6 +6,7 @@ import (
 	"net/http"
 	"net/http/httptest"
 	"os"
+	"strings"
 	"testing"
 )
 
@@ -339,3 +340,46 @@ func TestFetchURL_NotOK(t *testing.T) {
 	_, err := cfg.FetchURL(srv.URL)
 	if err == nil { t.Fatal("expected error for non-200 status") }
 }
+
+func TestFetchFile_ResponseTooLarge(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusOK)
+		// Write maxResponseBytes+1 bytes to exceed the cap.
+		chunk := make([]byte, 4096)
+		written := int64(0)
+		for written <= maxResponseBytes {
+			n, _ := w.Write(chunk)
+			written += int64(n)
+		}
+	}))
+	defer srv.Close()
+	cfg := GitLabConfig{BaseURL: srv.URL}
+	_, err := cfg.FetchFile("group/project", "/ci.yml", "main")
+	if err == nil {
+		t.Fatal("expected error for oversized response")
+	}
+	if !strings.Contains(err.Error(), "exceeds maximum size") {
+		t.Errorf("unexpected error: %v", err)
+	}
+}
+
+func TestFetchURL_ResponseTooLarge(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusOK)
+		chunk := make([]byte, 4096)
+		written := int64(0)
+		for written <= maxResponseBytes {
+			n, _ := w.Write(chunk)
+			written += int64(n)
+		}
+	}))
+	defer srv.Close()
+	cfg := GitLabConfig{}
+	_, err := cfg.FetchURL(srv.URL)
+	if err == nil {
+		t.Fatal("expected error for oversized response")
+	}
+	if !strings.Contains(err.Error(), "exceeds maximum size") {
+		t.Errorf("unexpected error: %v", err)
+	}
+}

internal/linter/dependencies.go

@@ -30,6 +30,7 @@ func checkDependencies(p *model.Pipeline, skipped map[string]bool) []Finding {
 					Job:      name,
 					File:     job.File,
 					Line:     job.Line,
+					Column:   job.Column,
 					Message:  fmt.Sprintf("'dependencies' references unknown job %q", dep),
 				})
 				continue
@@ -43,6 +44,7 @@ func checkDependencies(p *model.Pipeline, skipped map[string]bool) []Finding {
 						Job:      name,
 						File:     job.File,
 						Line:     job.Line,
+						Column:   job.Column,
 						Message:  fmt.Sprintf("'dependencies' job %q must be in an earlier stage (in %q, current job is in %q)", dep, depJob.Stage, job.Stage),
 					})
 				}

internal/linter/explain.go

@@ -853,4 +853,100 @@ test:
     - if: $CI_COMMIT_BRANCH == "main"
       needs: [build, lint]`,
 	},
+
+	RuleInsecureRemoteInclude: {
+		Title:    "remote include uses plain HTTP",
+		Severity: Warning,
+		Description: "An include: remote: entry uses an http:// URL instead of https://. " +
+			"CI templates fetched over plain HTTP are transmitted in cleartext; an " +
+			"attacker with network access could intercept or modify the template " +
+			"before it is parsed. Use https:// so the connection is encrypted and " +
+			"the server's identity is verified.",
+		Example: `include:
+  - remote: http://ci-templates.example.com/build.yml`,
+		Fix: `include:
+  - remote: https://ci-templates.example.com/build.yml`,
+	},
+
+	RuleInvalidPullPolicy: {
+		Title:    "'pull_policy:' has invalid value",
+		Severity: Error,
+		Description: "'image.pull_policy' and 'services[n].pull_policy' must be one of " +
+			"'always', 'if-not-present', or 'never', or a list of those values. " +
+			"Any other string is rejected by GitLab at pipeline creation time.",
+		Example: `my-job:
+  image:
+    name: alpine
+    pull_policy: on-demand   # not a valid value
+  script: echo hi`,
+		Fix: `my-job:
+  image:
+    name: alpine
+    pull_policy: if-not-present
+  script: echo hi`,
+	},
+
+	RuleVariableValueNotInOptions: {
+		Title:    "variable default value not listed in 'options'",
+		Severity: Error,
+		Description: "A pipeline variable declares an 'options' list that constrains what " +
+			"values can be chosen when triggering the pipeline manually. If the 'value' " +
+			"(the default) is not in that list, GitLab rejects the pipeline at creation " +
+			"time with a validation error.",
+		Example: `variables:
+  DEPLOY_ENV:
+    value: staging
+    options:
+      - production
+      - review    # 'staging' is missing from the list`,
+		Fix: `variables:
+  DEPLOY_ENV:
+    value: staging
+    options:
+      - staging
+      - production
+      - review`,
+	},
+
+	RuleInvalidTriggerForward: {
+		Title:    "'trigger.forward:' has unrecognised key",
+		Severity: Error,
+		Description: "'trigger.forward' controls which variables are forwarded to the " +
+			"downstream pipeline. Only 'pipeline_variables' and 'yaml_variables' are " +
+			"valid keys. Any other key is silently ignored by some GitLab versions and " +
+			"rejected by others.",
+		Example: `deploy:
+  trigger:
+    include:
+      - artifact: pipeline.yml
+        job: build
+    forward:
+      all_variables: true   # not a valid key`,
+		Fix: `deploy:
+  trigger:
+    include:
+      - artifact: pipeline.yml
+        job: build
+    forward:
+      pipeline_variables: true
+      yaml_variables: true`,
+	},
+
+	RuleInvalidRulesAllowFailure: {
+		Title:    "'rules[n].allow_failure:' invalid value",
+		Severity: Error,
+		Description: "'allow_failure' inside a 'rules:' entry (GitLab CI 15.0+) must be " +
+			"a boolean (true/false) or a map with an 'exit_codes' key. This overrides " +
+			"the job-level 'allow_failure' when the rule matches.",
+		Example: `my-job:
+  script: ./test.sh
+  rules:
+    - if: $CI_COMMIT_BRANCH
+      allow_failure: maybe   # must be true/false or a map`,
+		Fix: `my-job:
+  script: ./test.sh
+  rules:
+    - if: $CI_COMMIT_BRANCH
+      allow_failure: true`,
+	},
 }

internal/linter/if_reachability.go

@@ -99,6 +99,7 @@ func evalRulesReachability(name string, job model.Job, jobVars map[string]string
 		Job:      name,
 		File:     job.File,
 		Line:     job.Line,
+		Column:   job.Column,
 		Message:  "rules: block can never activate: all if: conditions evaluate to false given the declared pipeline variables",
 	}
 }

internal/linter/includes.go

@@ -0,0 +1,31 @@
+package linter
+
+import (
+	"fmt"
+	"strings"
+
+	"git.k3nny.fr/glint/internal/model"
+)
+
+// checkInsecureRemoteInclude warns when an include: remote: entry uses plain
+// HTTP (GL045). The file is still fetched and linted; the finding is a warning
+// so pipelines that use HTTP for internal infra are not blocked.
+func checkInsecureRemoteInclude(p *model.Pipeline) []Finding {
+	var findings []Finding
+	for _, inc := range p.Include {
+		m, ok := inc.(map[string]any)
+		if !ok {
+			continue
+		}
+		remote, _ := m["remote"].(string)
+		if strings.HasPrefix(remote, "http://") {
+			findings = append(findings, Finding{
+				Severity: Warning,
+				Rule:     RuleInsecureRemoteInclude,
+				File:     p.SourceFile,
+				Message:  fmt.Sprintf("remote include %q uses plain HTTP; CI templates are fetched unencrypted — prefer HTTPS", remote),
+			})
+		}
+	}
+	return findings
+}

internal/linter/includes_test.go

@@ -0,0 +1,73 @@
+package linter
+
+import (
+	"testing"
+
+	"git.k3nny.fr/glint/internal/model"
+)
+
+func TestCheckInsecureRemoteInclude(t *testing.T) {
+	tests := []struct {
+		name    string
+		include []any
+		wantGL  string // expected rule ID, empty = no findings
+	}{
+		{
+			name:    "http URL triggers GL045",
+			include: []any{map[string]any{"remote": "http://example.com/ci.yml"}},
+			wantGL:  RuleInsecureRemoteInclude,
+		},
+		{
+			name:    "https URL is clean",
+			include: []any{map[string]any{"remote": "https://example.com/ci.yml"}},
+		},
+		{
+			name:    "local include ignored",
+			include: []any{map[string]any{"local": "/templates/ci.yml"}},
+		},
+		{
+			name:    "string include ignored",
+			include: []any{"/templates/ci.yml"},
+		},
+		{
+			name:    "no includes",
+			include: nil,
+		},
+		{
+			name: "mixed: http fires, https does not",
+			include: []any{
+				map[string]any{"remote": "https://ok.example.com/ci.yml"},
+				map[string]any{"remote": "http://bad.example.com/ci.yml"},
+			},
+			wantGL: RuleInsecureRemoteInclude,
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			p := &model.Pipeline{
+				Include: tc.include,
+				Jobs:    map[string]model.Job{},
+			}
+			findings := checkInsecureRemoteInclude(p)
+			if tc.wantGL == "" {
+				if len(findings) != 0 {
+					t.Errorf("expected no findings, got: %v", findings)
+				}
+				return
+			}
+			found := false
+			for _, f := range findings {
+				if f.Rule == tc.wantGL {
+					found = true
+					if f.Severity != Warning {
+						t.Errorf("severity = %v; want Warning", f.Severity)
+					}
+				}
+			}
+			if !found {
+				t.Errorf("expected finding %s, got: %v", tc.wantGL, findings)
+			}
+		})
+	}
+}

internal/linter/inherit_completeness.go

@@ -40,6 +40,7 @@ func checkJobInheritCompleteness(p *model.Pipeline, name string, job model.Job)
 			Job:      name,
 			File:     job.File,
 			Line:     job.Line,
+			Column:   job.Column,
 			Message:  "'inherit: default:' is declared but the pipeline has no 'default:' block — declaration has no effect",
 		}}
 	}
@@ -70,6 +71,7 @@ func checkJobInheritCompleteness(p *model.Pipeline, name string, job model.Job)
 		Job:      name,
 		File:     job.File,
 		Line:     job.Line,
+		Column:   job.Column,
 		Message: fmt.Sprintf(
 			"'inherit: default: [%s]': %s not defined in the 'default:' block — %s",
 			strings.Join(dead, ", "),

internal/linter/keywords.go

@@ -114,6 +114,8 @@ func checkJobKeywords(name string, job model.Job) []Finding {
 	findings = append(findings, checkSecrets(name, job)...)
 	findings = append(findings, checkPagesKeyword(name, job)...)
 	findings = append(findings, checkCacheKeyFiles(name, job)...)
+	findings = append(findings, checkPullPolicy(name, job)...)
+	findings = append(findings, checkRulesAllowFailure(name, job)...)
 	return findings
 }
 
@@ -313,6 +315,20 @@ func checkTrigger(name string, job model.Job) []Finding {
 				Message:  "'trigger' map must specify 'project' or 'include'",
 			})
 		}
+		// GL048: validate trigger.forward keys.
+		if fwd, ok := m["forward"].(map[string]any); ok {
+			validForwardKeys := map[string]bool{"pipeline_variables": true, "yaml_variables": true}
+			for k := range fwd {
+				if !validForwardKeys[k] {
+					findings = append(findings, Finding{
+						Severity: Error,
+						Rule:     RuleInvalidTriggerForward,
+						Job:      name,
+						Message:  fmt.Sprintf("'trigger.forward' has unrecognised key %q; valid keys: pipeline_variables, yaml_variables", k),
+					})
+				}
+			}
+		}
 	}
 	return findings
 }
@@ -793,6 +809,85 @@ func checkPagesKeyword(name string, job model.Job) []Finding {
 	}}
 }
 
+// GL046: image.pull_policy and services[n].pull_policy must use recognised values.
+var validPullPolicy = map[string]bool{
+	"always": true, "if-not-present": true, "never": true,
+}
+
+func checkPullPolicy(name string, job model.Job) []Finding {
+	var findings []Finding
+	findings = append(findings, checkPullPolicyValue(name, "image", job.Image)...)
+	for i, svc := range job.Services {
+		findings = append(findings, checkPullPolicyValue(name, fmt.Sprintf("services[%d]", i), svc)...)
+	}
+	return findings
+}
+
+func checkPullPolicyValue(jobName, field string, v any) []Finding {
+	m, ok := v.(map[string]any)
+	if !ok {
+		return nil
+	}
+	pp, exists := m["pull_policy"]
+	if !exists || pp == nil {
+		return nil
+	}
+	var policies []string
+	switch x := pp.(type) {
+	case string:
+		policies = []string{x}
+	case []any:
+		for _, item := range x {
+			if s, ok := item.(string); ok {
+				policies = append(policies, s)
+			}
+		}
+	}
+	var findings []Finding
+	for _, p := range policies {
+		if !validPullPolicy[p] {
+			findings = append(findings, Finding{
+				Severity: Error,
+				Rule:     RuleInvalidPullPolicy,
+				Job:      jobName,
+				Message:  fmt.Sprintf("%s.pull_policy has unrecognised value %q; valid: always, if-not-present, never", field, p),
+			})
+		}
+	}
+	return findings
+}
+
+// GL049: rules[n].allow_failure must be a boolean or a map with exit_codes:.
+func checkRulesAllowFailure(name string, job model.Job) []Finding {
+	var findings []Finding
+	for i, rule := range job.Rules {
+		if rule.AllowFailure == nil {
+			continue
+		}
+		switch v := rule.AllowFailure.(type) {
+		case bool:
+			// valid
+		case map[string]any:
+			if _, ok := v["exit_codes"]; !ok {
+				findings = append(findings, Finding{
+					Severity: Error,
+					Rule:     RuleInvalidRulesAllowFailure,
+					Job:      name,
+					Message:  fmt.Sprintf("rules[%d].allow_failure map form must contain 'exit_codes'", i),
+				})
+			}
+		default:
+			findings = append(findings, Finding{
+				Severity: Error,
+				Rule:     RuleInvalidRulesAllowFailure,
+				Job:      name,
+				Message:  fmt.Sprintf("rules[%d].allow_failure must be a boolean or a map with 'exit_codes'", i),
+			})
+		}
+	}
+	return findings
+}
+
 // GL041: cache.key.files must be a list of exact file paths, not glob patterns.
 func checkCacheKeyFiles(name string, job model.Job) []Finding {
 	if job.Cache == nil {

internal/linter/linter.go

@@ -22,15 +22,19 @@ type Finding struct {
 	Job      string // empty for pipeline-level findings
 	File     string // source file where the finding originates
 	Line     int    // line number in File (0 = unknown)
+	Column   int    // column number in File (0 = unknown; 1-indexed)
 	Message  string
 }
 
 func (f Finding) String() string {
 	var loc string
 	if f.File != "" {
-		if f.Line > 0 {
+		switch {
+		case f.Line > 0 && f.Column > 0:
+			loc = fmt.Sprintf("%s:%d:%d: ", f.File, f.Line, f.Column)
+		case f.Line > 0:
 			loc = fmt.Sprintf("%s:%d: ", f.File, f.Line)
-		} else {
+		default:
 			loc = fmt.Sprintf("%s: ", f.File)
 		}
 	}
@@ -60,6 +64,7 @@ func Lint(p *model.Pipeline, skipped map[string]bool) []Finding {
 	findings = append(findings, checkDuplicateStages(p)...)
 	findings = append(findings, checkDefault(p)...)
 	findings = append(findings, checkWorkflow(p)...)
+	findings = append(findings, checkPipelineVariableOptions(p)...)
 	findings = append(findings, checkJobs(p)...)
 	findings = append(findings, checkNeeds(p, skipped)...)
 	findings = append(findings, checkRulesNeeds(p, skipped)...)
@@ -67,6 +72,7 @@ func Lint(p *model.Pipeline, skipped map[string]bool) []Finding {
 	findings = append(findings, checkVariableRefs(p)...)
 	findings = append(findings, checkRulesIfReachability(p)...)
 	findings = append(findings, checkInheritCompleteness(p)...)
+	findings = append(findings, checkInsecureRemoteInclude(p)...)
 	slices.SortStableFunc(findings, func(a, b Finding) int {
 		if c := cmp.Compare(a.File, b.File); c != 0 {
 			return c
@@ -218,12 +224,63 @@ func checkJob(name string, job model.Job, stageSet map[string]bool) []Finding {
 	}
 
 	findings = append(findings, checkJobKeywords(name, job)...)
+	findings = append(findings, checkVariableOptionsForJob(name, job)...)
 
 	// Attach source location to every job-scoped finding collected above.
 	for i := range findings {
 		if findings[i].Job != "" && findings[i].File == "" {
 			findings[i].File = job.File
 			findings[i].Line = job.Line
+			findings[i].Column = job.Column
+		}
+	}
+	return findings
+}
+
+// GL047: variable declared with options: must have its default value in the options list.
+
+func checkPipelineVariableOptions(p *model.Pipeline) []Finding {
+	return checkVariableOptionsMap(p.Variables, "", p.SourceFile, 0, 0)
+}
+
+func checkVariableOptionsForJob(name string, job model.Job) []Finding {
+	return checkVariableOptionsMap(job.Variables, name, job.File, job.Line, job.Column)
+}
+
+func checkVariableOptionsMap(vars map[string]any, jobName, file string, line, col int) []Finding {
+	var findings []Finding
+	for varName, v := range vars {
+		m, ok := v.(map[string]any)
+		if !ok {
+			continue
+		}
+		rawOpts, hasOpts := m["options"]
+		rawVal, hasVal := m["value"]
+		if !hasOpts || !hasVal || rawVal == nil {
+			continue
+		}
+		opts, ok := rawOpts.([]any)
+		if !ok || len(opts) == 0 {
+			continue
+		}
+		val := fmt.Sprint(rawVal)
+		inOptions := false
+		for _, opt := range opts {
+			if fmt.Sprint(opt) == val {
+				inOptions = true
+				break
+			}
+		}
+		if !inOptions {
+			findings = append(findings, Finding{
+				Severity: Error,
+				Rule:     RuleVariableValueNotInOptions,
+				Job:      jobName,
+				File:     file,
+				Line:     line,
+				Column:   col,
+				Message:  fmt.Sprintf("variable %q: default value %q is not listed in 'options'", varName, val),
+			})
 		}
 	}
 	return findings

internal/linter/needs.go

@@ -53,6 +53,7 @@ func checkNeeds(p *model.Pipeline, skipped map[string]bool) []Finding {
 					Job:      name,
 					File:     job.File,
 					Line:     job.Line,
+					Column:   job.Column,
 					Message:  fmt.Sprintf("needs unknown job %q", entry.job),
 				})
 				continue
@@ -71,6 +72,7 @@ func checkNeeds(p *model.Pipeline, skipped map[string]bool) []Finding {
 						Job:      name,
 						File:     job.File,
 						Line:     job.Line,
+						Column:   job.Column,
 						Message: fmt.Sprintf(
 							"needs %q which is in a later stage (%q after %q)",
 							entry.job, neededJob.Stage, job.Stage,
@@ -111,6 +113,7 @@ func checkRulesNeeds(p *model.Pipeline, skipped map[string]bool) []Finding {
 						Job:      name,
 						File:     job.File,
 						Line:     job.Line,
+						Column:   job.Column,
 						Message: fmt.Sprintf(
 							"rules[%d].needs: references unknown job %q",
 							i, entry.job,
@@ -171,6 +174,7 @@ func detectNeedsCycles(graph map[string][]string, jobs map[string]model.Job) []F
 					Job:      name,
 					File:     j.File,
 					Line:     j.Line,
+					Column:   j.Column,
 					Message:  fmt.Sprintf("circular dependency in needs: %v → %s", path, name),
 				})
 			}

internal/linter/rules.go

@@ -158,4 +158,24 @@ const (
 	// GL044: a rules:needs: entry references a job that does not exist in the pipeline.
 	// rules:needs: overrides the top-level needs: when a specific rule matches (GitLab CI 16.4+).
 	RuleRulesNeedsUnknown = "GL044"
+
+	// GL045: an include: remote: entry uses plain HTTP instead of HTTPS.
+	// CI templates fetched over HTTP are transmitted in cleartext and can be
+	// intercepted or modified in transit.
+	RuleInsecureRemoteInclude = "GL045"
+
+	// GL046: image: or services[n]: pull_policy: contains an unrecognised value.
+	// Valid values: always, if-not-present, never (or a list of those values).
+	RuleInvalidPullPolicy = "GL046"
+
+	// GL047: a variable declared with options: has a default value: that is not
+	// listed in the options list. GitLab rejects the pipeline at creation time.
+	RuleVariableValueNotInOptions = "GL047"
+
+	// GL048: trigger.forward: contains an unrecognised key. Only
+	// pipeline_variables and yaml_variables are valid.
+	RuleInvalidTriggerForward = "GL048"
+
+	// GL049: rules[n].allow_failure: is not a boolean or a map with exit_codes:.
+	RuleInvalidRulesAllowFailure = "GL049"
 )

internal/linter/variables.go

@@ -110,7 +110,7 @@ func checkVariableRefs(p *model.Pipeline) []Finding {
 				continue
 			}
 			for _, varName := range extractIfVars(rule.If) {
-				if isPredefinedVar(varName) || pipelineVars[varName] || seen[varName] {
+				if isPredefinedVar(varName) || pipelineVars[varName] || workflowRuleVars[varName] || seen[varName] {
 					continue
 				}
 				seen[varName] = true
@@ -148,6 +148,7 @@ func checkVariableRefs(p *model.Pipeline) []Finding {
 					Job:      name,
 					File:     job.File,
 					Line:     job.Line,
+					Column:   job.Column,
 					Message:  fmt.Sprintf("rules[%d].if: $%s is not declared in pipeline or job variables:", i, varName),
 				})
 			}

internal/lsp/server.go

@@ -66,6 +66,11 @@ func (s *Server) Run() error {
 	}
 }
 
+// maxLSPMessageBytes caps the body size accepted from an LSP client.
+// A legitimate editor message is never this large; enforcing the cap prevents
+// a crafted Content-Length from triggering a multi-gigabyte allocation.
+const maxLSPMessageBytes = 64 << 20 // 64 MiB
+
 // readMessage reads one Content-Length–framed JSON-RPC message from the stream.
 func (s *Server) readMessage() (*Message, error) {
 	var contentLength int
@@ -92,6 +97,9 @@ func (s *Server) readMessage() (*Message, error) {
 	if contentLength == 0 {
 		return nil, fmt.Errorf("missing or zero Content-Length header")
 	}
+	if contentLength > maxLSPMessageBytes {
+		return nil, fmt.Errorf("Content-Length %d exceeds maximum %d", contentLength, maxLSPMessageBytes)
+	}
 
 	body := make([]byte, contentLength)
 	if _, err := io.ReadFull(s.in, body); err != nil {

internal/lsp/server_test.go

@@ -364,6 +364,20 @@ func TestServer_DidClose_ClearsdiAgnostics(t *testing.T) {
 	}
 }
 
+func TestServer_ContentLengthTooLarge(t *testing.T) {
+	// Craft a header with a content-length that exceeds the cap.
+	// The server must reject it before allocating a giant buffer.
+	header := fmt.Sprintf("Content-Length: %d\r\n\r\n", maxLSPMessageBytes+1)
+	srv, _, _ := newTestServer([]byte(header))
+	err := srv.Run()
+	if err == nil {
+		t.Fatal("expected error for oversized Content-Length, got nil")
+	}
+	if !strings.Contains(err.Error(), "exceeds maximum") {
+		t.Errorf("unexpected error: %v", err)
+	}
+}
+
 func TestServer_UriToPath(t *testing.T) {
 	tests := []struct {
 		uri  string

internal/model/parser.go

@@ -83,7 +83,8 @@ func ParseBytes(data []byte) (*Pipeline, error) {
 			return nil, fmt.Errorf("parsing job %q: %w", key, err)
 		}
 		j.Name = key
-		j.Line = keyNode.Line // exact line of the job name key
+		j.Line = keyNode.Line     // exact line of the job name key
+		j.Column = keyNode.Column // exact column of the job name key
 		p.Jobs[key] = j
 	}
 

internal/model/pipeline.go

@@ -1,5 +1,7 @@
 package model
 
+import "gopkg.in/yaml.v3"
+
 // Pipeline represents the top-level structure of a .gitlab-ci.yml file.
 // Unknown top-level keys are collected into Jobs.
 type Pipeline struct {
@@ -41,13 +43,16 @@ type DefaultConfig struct {
 }
 
 type Workflow struct {
-	Rules []Rule `yaml:"rules"`
+	Name       string `yaml:"name"`
+	AutoCancel any    `yaml:"auto_cancel"`
+	Rules      Rules  `yaml:"rules"`
 }
 
 type Job struct {
-	Name string // set by parser, not from YAML
+	Name   string // set by parser, not from YAML
-	File string // source file; set by Parse / resolver
+	File   string // source file; set by Parse / resolver
-	Line int    // line of the job key in its source file; set by parser
+	Line   int    // line of the job key in its source file; set by parser
+	Column int    // column of the job key (1-indexed); set by parser
 	Stage        string   `yaml:"stage"`
 	Script       any `yaml:"script"`       // []string or string (block scalar)
 	Run          any `yaml:"run"`          // alternative to script (CI steps)
@@ -56,7 +61,7 @@ type Job struct {
 	Image        any      `yaml:"image"`
 	Services     []any    `yaml:"services"`
 	Variables    map[string]any `yaml:"variables"` // string or {value,description,options} map
-	Rules        []Rule         `yaml:"rules"`
+	Rules        Rules          `yaml:"rules"`
 	Only         any      `yaml:"only"`
 	Except       any      `yaml:"except"`
 	Needs        []any    `yaml:"needs"`
@@ -84,12 +89,71 @@ type Job struct {
 }
 
 type Rule struct {
-	If        string         `yaml:"if"`
+	If           string         `yaml:"if"`
-	When      string         `yaml:"when"`
+	When         string         `yaml:"when"`
-	Changes   any            `yaml:"changes"`   // []string or {paths,compare_to} map
+	Changes      any            `yaml:"changes"`       // []string or {paths,compare_to} map
-	Exists    any            `yaml:"exists"`    // []string or map form
+	Exists       any            `yaml:"exists"`        // []string or map form
-	Variables map[string]any `yaml:"variables"` // set/override variables when rule matches (GitLab CI 15.0+)
+	Variables    map[string]any `yaml:"variables"`     // set/override variables when rule matches (GitLab CI 15.0+)
-	Needs     []any          `yaml:"needs"`     // override needs: when this rule matches (GitLab CI 16.4+)
+	Needs        []any          `yaml:"needs"`         // override needs: when this rule matches (GitLab CI 16.4+)
+	AllowFailure any            `yaml:"allow_failure"` // bool or {exit_codes:} map (GitLab CI 15.0+)
+	GroupID      int            `yaml:"-"`             // >0 means AND-group; set by Rules.UnmarshalYAML
+}
+
+// Rules is a list of Rule entries that also supports GitLab CI's nested-array
+// form where each outer entry can itself be a sequence of rules (AND-group).
+// Rules with the same non-zero GroupID form an AND-group: all conditions must
+// match for the group to fire. GroupID == 0 means standalone rule.
+type Rules []Rule
+
+func (r *Rules) UnmarshalYAML(value *yaml.Node) error {
+	if value.Kind != yaml.SequenceNode {
+		return nil
+	}
+	nextGroup := 1
+	for _, item := range value.Content {
+		switch item.Kind {
+		case yaml.MappingNode:
+			var rule Rule // GroupID stays 0 (standalone)
+			if err := item.Decode(&rule); err != nil {
+				return err
+			}
+			*r = append(*r, rule)
+		case yaml.SequenceNode:
+			// AND-group: assign a shared GroupID so the evaluator can apply AND logic.
+			var group []Rule
+			if err := item.Decode(&group); err != nil {
+				return err
+			}
+			for i := range group {
+				group[i].GroupID = nextGroup
+			}
+			*r = append(*r, group...)
+			nextGroup++
+		}
+	}
+	return nil
+}
+
+// Groups returns the rules partitioned into AND-groups. Standalone rules
+// (GroupID == 0) form single-element groups; rules with a shared GroupID form
+// one group where all conditions must match.
+func (r Rules) Groups() [][]Rule {
+	var groups [][]Rule
+	seen := map[int]int{} // groupID → index in groups
+	for _, rule := range r {
+		if rule.GroupID == 0 {
+			groups = append(groups, []Rule{rule})
+		} else {
+			idx, ok := seen[rule.GroupID]
+			if !ok {
+				idx = len(groups)
+				seen[rule.GroupID] = idx
+				groups = append(groups, nil)
+			}
+			groups[idx] = append(groups[idx], rule)
+		}
+	}
+	return groups
 }
 
 // ReservedKeys are top-level GitLab CI keys that are NOT job definitions.

internal/resolver/extends.go

@@ -80,12 +80,15 @@ func Resolve(p *model.Pipeline) ([]ExtendWarning, error) {
 			return extWarnings, fmt.Errorf("job %q: re-decoding merged definition: %w", name, err)
 		}
 		j.Name = name
-		// Preserve source location — File/Line are not part of the YAML map
+		// Preserve source location — these fields are not part of the YAML map
 		// and are lost during the encode/decode round-trip.
 		orig := p.Jobs[name]
 		j.File = orig.File
 		j.Line = orig.Line
+		j.Column = orig.Column
 		p.Jobs[name] = j
+		// Write merged raw map back so p.RawJobs always reflects post-extends state.
+		p.RawJobs[name] = merged
 	}
 
 	return extWarnings, nil

internal/resolver/includes.go

@@ -133,6 +133,12 @@ func resolveLocalInclude(p *model.Pipeline, rawPath string, cfg fetcher.GitLabCo
 	absPath := filepath.Join(rootDir, relPath)
 	label := "local " + rawPath
 
+	// Guard against path traversal: reject any path that escapes rootDir.
+	rel, err := filepath.Rel(rootDir, absPath)
+	if err != nil || strings.HasPrefix(rel, "..") {
+		return []IncludeWarning{{Label: label, Err: fmt.Errorf("path escapes repository root: %s", rawPath)}}, nil
+	}
+
 	if visited[absPath] {
 		return nil, nil
 	}

internal/resolver/includes_test.go

@@ -6,6 +6,7 @@ import (
 	"net/http/httptest"
 	"os"
 	"path/filepath"
+	"strings"
 	"testing"
 
 	"git.k3nny.fr/glint/internal/fetcher"
@@ -332,6 +333,32 @@ func TestResolveLocalInclude_WithNestedIncludes(t *testing.T) {
 	}
 }
 
+func TestResolveLocalInclude_PathTraversal(t *testing.T) {
+	dir := t.TempDir()
+	p := &model.Pipeline{Jobs: map[string]model.Job{}, RawJobs: map[string]map[string]any{}}
+	// A path that escapes the repository root via "../.." must produce a warning,
+	// not silently read an arbitrary file.
+	warnings, _ := resolveLocalInclude(p, "../../etc/passwd", fetcher.GitLabConfig{}, dir, map[string]bool{}, 0)
+	if len(warnings) == 0 {
+		t.Fatal("expected warning for path traversal, got none")
+	}
+	if !strings.Contains(warnings[0].Err.Error(), "path escapes") {
+		t.Errorf("unexpected warning: %v", warnings[0])
+	}
+	if len(p.Jobs) != 0 {
+		t.Error("no jobs should be merged when path escapes root")
+	}
+}
+
+func TestResolveLocalInclude_PathTraversalWithLeadingSlash(t *testing.T) {
+	dir := t.TempDir()
+	p := &model.Pipeline{Jobs: map[string]model.Job{}, RawJobs: map[string]map[string]any{}}
+	warnings, _ := resolveLocalInclude(p, "/../../etc/shadow", fetcher.GitLabConfig{}, dir, map[string]bool{}, 0)
+	if len(warnings) == 0 {
+		t.Fatal("expected warning for path traversal via leading slash, got none")
+	}
+}
+
 // ── resolveRemoteInclude ──────────────────────────────────────────────────────
 
 func TestResolveRemoteInclude_Success(t *testing.T) {

testdata/insecure_remote_include.yml

@@ -0,0 +1,8 @@
+stages: [build]
+
+include:
+  - remote: http://ci-templates.example.invalid/template.yml
+
+build-job:
+  stage: build
+  script: echo hello

testdata/keywords_invalid.yml

@@ -2,6 +2,13 @@ stages:
   - build
   - test
 
+variables:
+  DEPLOY_ENV:
+    value: canary             # ERROR: not listed in options
+    options:
+      - staging
+      - production
+
 workflow:
   rules:
     - if: '$CI_PIPELINE_SOURCE == "push"'
@@ -126,3 +133,50 @@ bad-rule-when-job:
   rules:
     - if: '$CI_MERGE_REQUEST_ID'
       when: sometimes         # ERROR: invalid rules[0].when
+
+bad-pull-policy-job:
+  stage: build
+  script:
+    - echo hello
+  image:
+    name: alpine
+    pull_policy: on-demand    # ERROR: invalid pull_policy value
+
+bad-pull-policy-service-job:
+  stage: build
+  script:
+    - echo hello
+  services:
+    - name: postgres:15
+      pull_policy: lazy       # ERROR: invalid service pull_policy value
+
+bad-trigger-forward-job:
+  trigger:
+    project: mygroup/myproject
+    forward:
+      all_variables: true     # ERROR: unrecognised trigger.forward key
+
+bad-trigger-forward-key2-job:
+  trigger:
+    include:
+      - artifact: child.yml
+        job: build
+    forward:
+      inherit: false          # ERROR: unrecognised trigger.forward key
+
+bad-rules-allow-failure-job:
+  stage: build
+  script:
+    - echo hello
+  rules:
+    - if: $CI_COMMIT_BRANCH
+      allow_failure: maybe    # ERROR: invalid rules[0].allow_failure value
+
+bad-rules-allow-failure-map-job:
+  stage: build
+  script:
+    - echo hello
+  rules:
+    - if: $CI_COMMIT_BRANCH
+      allow_failure:
+        codes: [1]            # ERROR: map missing exit_codes key

testdata/keywords_valid.yml

@@ -15,12 +15,19 @@ default:
 
 variables:
   GO_VERSION: "1.26"
+  DEPLOY_ENV:
+    value: staging
+    options:
+      - staging
+      - production
+      - review
 
 build-job:
   stage: build
   image:
     name: golang:1.26
     entrypoint: [""]
+    pull_policy: if-not-present
   script:
     - go build ./...
   artifacts:
@@ -72,6 +79,24 @@ release-job:
     action: start
   when: on_success
 
+.trigger-valid:
+  trigger:
+    include:
+      - artifact: child.yml
+        job: build
+    forward:
+      pipeline_variables: true
+      yaml_variables: false
+
+.rules-allow-failure-valid:
+  script: echo ok
+  rules:
+    - if: $CI_COMMIT_BRANCH
+      allow_failure: true
+    - if: $CI_COMMIT_TAG
+      allow_failure:
+        exit_codes: [1, 2]
+
 .template:
   before_script:
     - echo "before"

testdata/nested_rules.yml

@@ -0,0 +1,31 @@
+---
+# Tests that workflow.rules and job.rules accept the nested-array (AND-group)
+# form where each outer entry can itself be a sequence of rule conditions.
+workflow:
+  name: "${PIPELINE_NAME}"
+  auto_cancel:
+    on_new_commit: interruptible
+  rules:
+  - if: "$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH"
+    variables:
+      PIPELINE_NAME: "main"
+  - - if: "$CI_PIPELINE_SOURCE == 'push' && $CI_COMMIT_BRANCH =~ /^feat\\///"
+      variables:
+        PIPELINE_NAME: "feature"
+  - - if: "$CI_COMMIT_TAG"
+    - if: "$DEPLOY"
+      variables:
+        PIPELINE_NAME: "deploy"
+
+variables:
+  DEPLOY: "false"
+
+build:
+  stage: build
+  script: echo building
+  rules:
+  - if: "$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH"
+  - - if: "$CI_PIPELINE_SOURCE == 'push'"
+      allow_failure: true
+    - if: "$DEPLOY"
+      when: manual

testdata/variable_refs.yml

@@ -17,6 +17,10 @@ workflow:
     - if: '$CI_COMMIT_BRANCH == "main"'
       variables:
         DEPLOY_TARGET: "production"
+        WORKFLOW_FLAG: "true"
+    # workflow rule referencing a variable set by a sibling rule's variables: — GL032 must not fire
+    - if: '$WORKFLOW_FLAG == "true"'
+      when: always
     - when: always
 
 build: