@abgov/nx-oc 12.6.0 → 12.8.0

package/generators.json

@@ -13,6 +13,11 @@
       "schema": "./src/generators/apply-infra/schema.json",
       "description": "Generator that applies OpenShift manifests for pipeline."
     },
+    "setup-secrets": {
+      "factory": "./src/generators/setup-secrets/setup-secrets",
+      "schema": "./src/generators/setup-secrets/schema.json",
+      "description": "Sets GitHub Actions secrets and OpenShift GHCR pull secret for the pipeline."
+    },
     "deployment": {
       "factory": "./src/generators/deployment/deployment",
       "schema": "./src/generators/deployment/schema.json",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@abgov/nx-oc",
-  "version": "12.6.0",
+  "version": "12.8.0",
   "license": "Apache-2.0",
   "main": "src/index.js",
   "description": "Government of Alberta - Nx plugin for OpenShift.",

package/src/adsp/environments.js

@@ -1,18 +1,19 @@
 "use strict";
+var _a, _b, _c, _d, _e, _f;
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.environments = void 0;
 exports.environments = {
     dev: {
-        accessServiceUrl: 'https://access.adsp-dev.gov.ab.ca',
-        directoryServiceUrl: 'https://directory-service.adsp-dev.gov.ab.ca',
+        accessServiceUrl: (_a = process.env.ADSP_E2E_ACCESS_URL) !== null && _a !== void 0 ? _a : 'https://access.adsp-dev.gov.ab.ca',
+        directoryServiceUrl: (_b = process.env.ADSP_E2E_DIRECTORY_URL) !== null && _b !== void 0 ? _b : 'https://directory-service.adsp-dev.gov.ab.ca',
     },
     test: {
-        accessServiceUrl: 'https://access-uat.alberta.ca',
-        directoryServiceUrl: 'https://directory-service.adsp-uat.alberta.ca',
+        accessServiceUrl: (_c = process.env.ADSP_E2E_ACCESS_URL) !== null && _c !== void 0 ? _c : 'https://access-uat.alberta.ca',
+        directoryServiceUrl: (_d = process.env.ADSP_E2E_DIRECTORY_URL) !== null && _d !== void 0 ? _d : 'https://directory-service.adsp-uat.alberta.ca',
     },
     prod: {
-        accessServiceUrl: 'https://access.alberta.ca',
-        directoryServiceUrl: 'https://directory-service.adsp.alberta.ca',
+        accessServiceUrl: (_e = process.env.ADSP_E2E_ACCESS_URL) !== null && _e !== void 0 ? _e : 'https://access.alberta.ca',
+        directoryServiceUrl: (_f = process.env.ADSP_E2E_DIRECTORY_URL) !== null && _f !== void 0 ? _f : 'https://directory-service.adsp.alberta.ca',
     },
 };
 //# sourceMappingURL=environments.js.map

package/src/adsp/environments.js.map

@@ -1 +1 @@
-{"version":3,"file":"environments.js","sourceRoot":"","sources":["../../../../../packages/nx-oc/src/adsp/environments.ts"],"names":[],"mappings":";;;AAMa,QAAA,YAAY,GAAyC;IAChE,GAAG,EAAE;QACH,gBAAgB,EAAE,mCAAmC;QACrD,mBAAmB,EAAE,8CAA8C;KACpE;IACD,IAAI,EAAE;QACJ,gBAAgB,EAAE,+BAA+B;QACjD,mBAAmB,EAAE,+CAA+C;KACrE;IACD,IAAI,EAAE;QACJ,gBAAgB,EAAE,2BAA2B;QAC7C,mBAAmB,EAAE,2CAA2C;KACjE;CACF,CAAC"}
+{"version":3,"file":"environments.js","sourceRoot":"","sources":["../../../../../packages/nx-oc/src/adsp/environments.ts"],"names":[],"mappings":";;;;AAMa,QAAA,YAAY,GAAyC;IAChE,GAAG,EAAE;QACH,gBAAgB,EAAE,MAAA,OAAO,CAAC,GAAG,CAAC,mBAAmB,mCAAI,mCAAmC;QACxF,mBAAmB,EAAE,MAAA,OAAO,CAAC,GAAG,CAAC,sBAAsB,mCAAI,8CAA8C;KAC1G;IACD,IAAI,EAAE;QACJ,gBAAgB,EAAE,MAAA,OAAO,CAAC,GAAG,CAAC,mBAAmB,mCAAI,+BAA+B;QACpF,mBAAmB,EAAE,MAAA,OAAO,CAAC,GAAG,CAAC,sBAAsB,mCAAI,+CAA+C;KAC3G;IACD,IAAI,EAAE;QACJ,gBAAgB,EAAE,MAAA,OAAO,CAAC,GAAG,CAAC,mBAAmB,mCAAI,2BAA2B;QAChF,mBAAmB,EAAE,MAAA,OAAO,CAAC,GAAG,CAAC,sBAAsB,mCAAI,2CAA2C;KACvG;CACF,CAAC"}

package/src/generators/pipeline/actions/workflows/pipeline.yml__tmpl__

@@ -21,6 +21,8 @@ on:
     branches:
       - main
 
+  pull_request:
+
   workflow_dispatch:
     inputs:
       SELECTED_BASE:
@@ -37,7 +39,50 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
+  check:
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    permissions:
+      contents: read
+    env:
+      AFFECTED_BASE: "origin/main"
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-node@v5
+        with:
+          node-version: "24"
+          cache: "npm"
+      - run: npm ci
+      - name: Get last successful commit
+        id: last_successful_commit
+        uses: nrwl/nx-set-shas@v5
+      - name: Set AFFECTED_BASE to last successful build commit
+        if: ${{ steps.last_successful_commit.outputs.base }}
+        run: echo "AFFECTED_BASE=${{ steps.last_successful_commit.outputs.base }}" >> $GITHUB_ENV
+      - name: Lint
+        run: npx nx affected --target=lint --base=${{ env.AFFECTED_BASE }}
+      - name: Test
+        run: npx nx affected --target=test --base=${{ env.AFFECTED_BASE }}
+      - name: Build
+        run: npx nx affected --target=build --base=${{ env.AFFECTED_BASE }}
+      - name: Audit dependencies
+        run: npm audit --audit-level=high
+      - name: Install Semgrep
+        run: pip install semgrep
+      - name: Semgrep SAST
+        run: npx nx affected --target=semgrep --base=${{ env.AFFECTED_BASE }}
+      - uses: trufflesecurity/trufflehog@main
+        with:
+          extra_args: --only-verified
+      - uses: hadolint/hadolint-action@v3
+        with:
+          recursive: true
+
   build:
+    if: github.event_name != 'pull_request'
     runs-on: ubuntu-24.04
     timeout-minutes: 30
     permissions:

package/src/generators/pipeline/pipeline.js

@@ -7,8 +7,9 @@ const path = require("path");
 const pipeline_envs_1 = require("../../pipeline-envs");
 const git_utils_1 = require("../../utils/git-utils");
 const apply_infra_1 = require("../apply-infra/apply-infra");
+const setup_secrets_1 = require("../setup-secrets/setup-secrets");
 function normalizeOptions(host, options) {
-    var _a;
+    var _a, _b;
     const ocEnvProjects = ((_a = options.envs) === null || _a === void 0 ? void 0 : _a.split(' ')) || [options.infra];
     const envsProjectsSet = new Set(ocEnvProjects);
     if (envsProjectsSet.size !== ocEnvProjects.length) {
@@ -17,7 +18,28 @@ function normalizeOptions(host, options) {
     else if (ocEnvProjects.length > pipeline_envs_1.pipelineEnvs.length) {
         throw new Error(`Provided projects must correspond to ${pipeline_envs_1.pipelineEnvs.join(', ')} environments.`);
     }
-    return Object.assign(Object.assign({}, options), { ocPipelineName: options.pipeline, ocInfraProject: options.infra, ocEnvProjects: ocEnvProjects, applyPipeline: !!options.apply, pipelineType: options.type === 'jenkins' ? 'jenkins' : 'actions' });
+    return Object.assign(Object.assign({}, options), { registry: (_b = options.registry) !== null && _b !== void 0 ? _b : '', ocPipelineName: options.pipeline, ocInfraProject: options.infra, ocEnvProjects: ocEnvProjects, applyPipeline: !!options.apply, pipelineType: options.type === 'jenkins' ? 'jenkins' : 'actions' });
+}
+// Resolves the container registry: CLI flag → derived from git remote → prompted.
+function resolveRegistry(registry) {
+    return tslib_1.__awaiter(this, void 0, void 0, function* () {
+        var _a;
+        if (registry)
+            return registry;
+        const remoteUrl = (_a = (0, git_utils_1.getGitRemoteUrl)()) === null || _a === void 0 ? void 0 : _a.trim();
+        const derived = (0, git_utils_1.deriveRegistryFromRemote)(remoteUrl);
+        if (derived) {
+            console.log(`\n✓ Container registry: ${derived} (derived from git remote)\n`);
+            return derived;
+        }
+        const { prompt } = yield Promise.resolve().then(() => require('enquirer'));
+        const answer = yield prompt({
+            type: 'input',
+            name: 'registry',
+            message: 'What container registry should images be published to (e.g., ghcr.io/my-org)?',
+        });
+        return answer.registry;
+    });
 }
 function addFiles(host, options) {
     var _a;
@@ -34,11 +56,22 @@ function addFiles(host, options) {
 }
 function default_1(host, options) {
     return tslib_1.__awaiter(this, void 0, void 0, function* () {
-        const normalizedOptions = normalizeOptions(host, options);
+        var _a;
+        const registry = yield resolveRegistry(options.registry);
+        const normalizedOptions = normalizeOptions(host, Object.assign(Object.assign({}, options), { registry }));
         addFiles(host, normalizedOptions);
         yield (0, devkit_1.formatFiles)(host);
         if (normalizedOptions.applyPipeline) {
             yield (0, apply_infra_1.default)(host);
+            const remoteUrl = (_a = (0, git_utils_1.getGitRemoteUrl)()) === null || _a === void 0 ? void 0 : _a.trim();
+            if (remoteUrl) {
+                yield (0, setup_secrets_1.default)(host, { infra: normalizedOptions.ocInfraProject });
+            }
+            else {
+                console.log('\n⚠  No git remote found — skipping GitHub secrets setup.\n' +
+                    `   Push to GitHub first then run:\n` +
+                    `   npx nx g @abgov/nx-oc:setup-secrets --infra ${normalizedOptions.ocInfraProject}\n`);
+            }
         }
     });
 }

package/src/generators/pipeline/pipeline.js.map

@@ -1 +1 @@
-{"version":3,"file":"pipeline.js","sourceRoot":"","sources":["../../../../../../packages/nx-oc/src/generators/pipeline/pipeline.ts"],"names":[],"mappings":";;AAgEA,4BASC;;AAzED,uCAA8D;AAC9D,6BAA6B;AAC7B,uDAA2D;AAC3D,qDAAwD;AACxD,4DAA6D;AAG7D,SAAS,gBAAgB,CAAC,IAAU,EAAE,OAAe;;IACnD,MAAM,aAAa,GAAG,CAAA,MAAA,OAAO,CAAC,IAAI,0CAAE,KAAK,CAAC,GAAG,CAAC,KAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAElE,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC;IAC/C,IAAI,eAAe,CAAC,IAAI,KAAK,aAAa,CAAC,MAAM,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;SAAM,IAAI,aAAa,CAAC,MAAM,GAAG,4BAAI,CAAC,MAAM,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CACb,wCAAwC,4BAAI,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CACxE,CAAC;IACJ,CAAC;IAED,uCACK,OAAO,KACV,cAAc,EAAE,OAAO,CAAC,QAAQ,EAChC,cAAc,EAAE,OAAO,CAAC,KAAK,EAC7B,aAAa,EAAE,aAAa,EAC5B,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAC9B,YAAY,EAAE,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,IAChE;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,IAAU,EAAE,OAAyB;;IACrD,MAAM,eAAe,mCAChB,OAAO,KACV,mBAAmB,EAAE,MAAA,IAAA,2BAAe,GAAE,0CAAE,IAAI,EAAE,EAC9C,IAAI,EAAJ,4BAAI,EACJ,IAAI,EAAE,EAAE,GACT,CAAC;IAEF,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACvC,OAAO,CAAC,IAAI,CACV,iGAAiG;YAC/F,6BAA6B,CAChC,CAAC;QACF,IAAA,sBAAa,EACX,IAAI,EACJ,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,EAC/B,cAAc,EACd,eAAe,CAChB,CAAC;IACJ,CAAC;SAAM,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QAC9C,IAAA,sBAAa,EACX,IAAI,EACJ,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,mBAAmB,CAAC,EACzC,cAAc,EACd,eAAe,CAChB,CAAC;QACF,IAAA,sBAAa,EACX,IAAI,EACJ,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,mBAAmB,CAAC,EACzC,qBAAqB,EACrB,eAAe,CAChB,CAAC;IACJ,CAAC;AACH,CAAC;AAED,mBAA+B,IAAU,EAAE,OAAe;;QACxD,MAAM,iBAAiB,GAAG,gBAAgB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAE1D,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;QAClC,MAAM,IAAA,oBAAW,EAAC,IAAI,CAAC,CAAC;QAExB,IAAI,iBAAiB,CAAC,aAAa,EAAE,CAAC;YACpC,MAAM,IAAA,qBAAmB,EAAC,IAAI,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;CAAA"}
+{"version":3,"file":"pipeline.js","sourceRoot":"","sources":["../../../../../../packages/nx-oc/src/generators/pipeline/pipeline.ts"],"names":[],"mappings":";;AAsFA,4BAqBC;;AA3GD,uCAA8D;AAC9D,6BAA6B;AAC7B,uDAA2D;AAC3D,qDAAkF;AAClF,4DAA6D;AAC7D,kEAAmE;AAGnE,SAAS,gBAAgB,CAAC,IAAU,EAAE,OAAe;;IACnD,MAAM,aAAa,GAAG,CAAA,MAAA,OAAO,CAAC,IAAI,0CAAE,KAAK,CAAC,GAAG,CAAC,KAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAElE,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC;IAC/C,IAAI,eAAe,CAAC,IAAI,KAAK,aAAa,CAAC,MAAM,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;SAAM,IAAI,aAAa,CAAC,MAAM,GAAG,4BAAI,CAAC,MAAM,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CACb,wCAAwC,4BAAI,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CACxE,CAAC;IACJ,CAAC;IAED,uCACK,OAAO,KACV,QAAQ,EAAE,MAAA,OAAO,CAAC,QAAQ,mCAAI,EAAE,EAChC,cAAc,EAAE,OAAO,CAAC,QAAQ,EAChC,cAAc,EAAE,OAAO,CAAC,KAAK,EAC7B,aAAa,EAAE,aAAa,EAC5B,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAC9B,YAAY,EAAE,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,IAChE;AACJ,CAAC;AAED,kFAAkF;AAClF,SAAe,eAAe,CAAC,QAAiB;;;QAC9C,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAE9B,MAAM,SAAS,GAAG,MAAA,IAAA,2BAAe,GAAE,0CAAE,IAAI,EAAE,CAAC;QAC5C,MAAM,OAAO,GAAG,IAAA,oCAAwB,EAAC,SAAS,CAAC,CAAC;QACpD,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,CAAC,GAAG,CAAC,2BAA2B,OAAO,8BAA8B,CAAC,CAAC;YAC9E,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,MAAM,EAAE,MAAM,EAAE,GAAG,2CAAa,UAAU,EAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAuB;YAChD,IAAI,EAAE,OAAO;YACb,IAAI,EAAE,UAAU;YAChB,OAAO,EAAE,+EAA+E;SACzF,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,QAAQ,CAAC;IACzB,CAAC;CAAA;AAED,SAAS,QAAQ,CAAC,IAAU,EAAE,OAAyB;;IACrD,MAAM,eAAe,mCAChB,OAAO,KACV,mBAAmB,EAAE,MAAA,IAAA,2BAAe,GAAE,0CAAE,IAAI,EAAE,EAC9C,IAAI,EAAJ,4BAAI,EACJ,IAAI,EAAE,EAAE,GACT,CAAC;IAEF,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACvC,OAAO,CAAC,IAAI,CACV,iGAAiG;YAC/F,6BAA6B,CAChC,CAAC;QACF,IAAA,sBAAa,EACX,IAAI,EACJ,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,EAC/B,cAAc,EACd,eAAe,CAChB,CAAC;IACJ,CAAC;SAAM,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QAC9C,IAAA,sBAAa,EACX,IAAI,EACJ,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,mBAAmB,CAAC,EACzC,cAAc,EACd,eAAe,CAChB,CAAC;QACF,IAAA,sBAAa,EACX,IAAI,EACJ,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,mBAAmB,CAAC,EACzC,qBAAqB,EACrB,eAAe,CAChB,CAAC;IACJ,CAAC;AACH,CAAC;AAED,mBAA+B,IAAU,EAAE,OAAe;;;QACxD,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACzD,MAAM,iBAAiB,GAAG,gBAAgB,CAAC,IAAI,kCAAO,OAAO,KAAE,QAAQ,IAAG,CAAC;QAE3E,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;QAClC,MAAM,IAAA,oBAAW,EAAC,IAAI,CAAC,CAAC;QAExB,IAAI,iBAAiB,CAAC,aAAa,EAAE,CAAC;YACpC,MAAM,IAAA,qBAAmB,EAAC,IAAI,CAAC,CAAC;YAEhC,MAAM,SAAS,GAAG,MAAA,IAAA,2BAAe,GAAE,0CAAE,IAAI,EAAE,CAAC;YAC5C,IAAI,SAAS,EAAE,CAAC;gBACd,MAAM,IAAA,uBAAqB,EAAC,IAAI,EAAE,EAAE,KAAK,EAAE,iBAAiB,CAAC,cAAc,EAAE,CAAC,CAAC;YACjF,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,GAAG,CACT,6DAA6D;oBAC7D,qCAAqC;oBACrC,kDAAkD,iBAAiB,CAAC,cAAc,IAAI,CACvF,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;CAAA"}

package/src/generators/pipeline/schema.d.ts

@@ -3,11 +3,12 @@ export interface Schema {
   type: string;
   infra: string;
   envs: string;
-  registry: string;
+  registry?: string;
   apply?: boolean;
 }
 
 export interface NormalizedSchema extends Schema {
+  registry: string;
   ocPipelineName: string;
   ocInfraProject: string;
   ocEnvProjects: string[];

package/src/generators/pipeline/schema.json

@@ -37,9 +37,8 @@
     },
     "registry": {
       "type": "string",
-      "description": "Container registry to publish images to (e.g., ghcr.io/my-org).",
-      "alias": "r",
-      "x-prompt": "What container registry should images be published to (e.g., ghcr.io/my-org)?"
+      "description": "Container registry to publish images to (e.g., ghcr.io/my-org). Derived from the git remote when not provided.",
+      "alias": "r"
     },
     "apply": {
       "type": "boolean",
@@ -52,8 +51,7 @@
     "pipeline",
     "infra",
     "type",
-    "envs",
-    "registry"
+    "envs"
   ],
   "additionalProperties": false
 }

package/src/generators/setup-secrets/schema.d.ts

@@ -0,0 +1,3 @@
+export interface Schema {
+  infra: string;
+}

package/src/generators/setup-secrets/schema.json

@@ -0,0 +1,16 @@
+{
+  "$schema": "http://json-schema.org/schema",
+  "id": "NxOcSetupSecrets",
+  "title": "Setup Pipeline Secrets",
+  "type": "object",
+  "properties": {
+    "infra": {
+      "type": "string",
+      "description": "Name of the OpenShift infra project containing the github-actions service account.",
+      "alias": "i",
+      "x-prompt": "What is the OpenShift infra project?"
+    }
+  },
+  "required": ["infra"],
+  "additionalProperties": false
+}

package/src/generators/setup-secrets/setup-secrets.d.ts

@@ -0,0 +1,3 @@
+import { Tree } from '@nx/devkit';
+import { Schema } from './schema';
+export default function (host: Tree, options: Schema): Promise<void>;

package/src/generators/setup-secrets/setup-secrets.js

@@ -0,0 +1,80 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.default = default_1;
+const tslib_1 = require("tslib");
+const oc_utils_1 = require("../../utils/oc-utils");
+const gh_utils_1 = require("../../utils/gh-utils");
+const git_utils_1 = require("../../utils/git-utils");
+function default_1(host, options) {
+    return tslib_1.__awaiter(this, void 0, void 0, function* () {
+        var _a, _b;
+        try {
+            (0, oc_utils_1.ensureOcLogin)();
+        }
+        catch (e) {
+            console.log(e instanceof Error ? e.message : String(e));
+            return;
+        }
+        const remoteUrl = (_a = (0, git_utils_1.getGitRemoteUrl)()) === null || _a === void 0 ? void 0 : _a.trim();
+        const repo = (0, git_utils_1.getGitHubRepo)(remoteUrl);
+        if (!repo) {
+            console.log('\n⚠  No GitHub remote found — skipping GitHub Actions secrets setup.\n' +
+                '   Push to GitHub first then re-run this generator.');
+            return;
+        }
+        try {
+            (0, gh_utils_1.checkGhCli)();
+        }
+        catch (e) {
+            console.log(e instanceof Error ? e.message : String(e));
+            return;
+        }
+        console.log('\nSetting up pipeline secrets...');
+        const serverUrl = (0, oc_utils_1.getOcServerUrl)();
+        if (serverUrl) {
+            const ok = (0, gh_utils_1.setGhSecret)('OPENSHIFT_SERVER', serverUrl, repo);
+            console.log(ok ? '✓ OPENSHIFT_SERVER set' : '✗ Failed to set OPENSHIFT_SERVER');
+        }
+        else {
+            console.log('⚠  Could not determine OpenShift server URL — set OPENSHIFT_SERVER manually.');
+        }
+        const saToken = (0, oc_utils_1.getSaToken)('github-actions', options.infra);
+        if (saToken) {
+            const ok = (0, gh_utils_1.setGhSecret)('OPENSHIFT_TOKEN', saToken, repo);
+            console.log(ok ? '✓ OPENSHIFT_TOKEN set' : '✗ Failed to set OPENSHIFT_TOKEN');
+        }
+        else {
+            console.log('⚠  Could not retrieve github-actions token — set OPENSHIFT_TOKEN manually.');
+        }
+        const org = (_b = (0, git_utils_1.deriveRegistryFromRemote)(remoteUrl)) === null || _b === void 0 ? void 0 : _b.replace('ghcr.io/', '');
+        if (!org) {
+            console.log('⚠  Could not derive GitHub org from remote — create ghcr-pull-secret manually.');
+            return;
+        }
+        const { prompt } = yield Promise.resolve().then(() => require('enquirer'));
+        let pat;
+        try {
+            const answer = yield prompt({
+                type: 'password',
+                name: 'pat',
+                message: 'Enter a GitHub PAT with read:packages scope (for OpenShift image import):',
+            });
+            pat = answer.pat;
+        }
+        catch (_c) {
+            return;
+        }
+        if (!pat)
+            return;
+        const secretCreated = (0, oc_utils_1.createDockerRegistrySecret)('ghcr-pull-secret', 'ghcr.io', org, pat, options.infra);
+        if (secretCreated) {
+            console.log(`✓ ghcr-pull-secret created in ${options.infra}`);
+            const linked = (0, oc_utils_1.linkSecretToServiceAccount)('ghcr-pull-secret', 'github-actions', options.infra);
+            console.log(linked ? '✓ ghcr-pull-secret linked to github-actions service account' : '✗ Failed to link secret');
+        }
+        else {
+            console.log(`✗ Failed to create ghcr-pull-secret in ${options.infra}`);
+        }
+    });
+}
+//# sourceMappingURL=setup-secrets.js.map

package/src/generators/setup-secrets/setup-secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup-secrets.js","sourceRoot":"","sources":["../../../../../../packages/nx-oc/src/generators/setup-secrets/setup-secrets.ts"],"names":[],"mappings":";;AAYA,4BAyEC;;AApFD,mDAM8B;AAC9B,mDAA+D;AAC/D,qDAAiG;AAGjG,mBAA+B,IAAU,EAAE,OAAe;;;QACxD,IAAI,CAAC;YACH,IAAA,wBAAa,GAAE,CAAC;QAClB,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,CAAC,GAAG,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;YACxD,OAAO;QACT,CAAC;QAED,MAAM,SAAS,GAAG,MAAA,IAAA,2BAAe,GAAE,0CAAE,IAAI,EAAE,CAAC;QAC5C,MAAM,IAAI,GAAG,IAAA,yBAAa,EAAC,SAAS,CAAC,CAAC;QAEtC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,CAAC,GAAG,CACT,wEAAwE;gBACxE,qDAAqD,CACtD,CAAC;YACF,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,IAAA,qBAAU,GAAE,CAAC;QACf,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,CAAC,GAAG,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;YACxD,OAAO;QACT,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC;QAEhD,MAAM,SAAS,GAAG,IAAA,yBAAc,GAAE,CAAC;QACnC,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,EAAE,GAAG,IAAA,sBAAW,EAAC,kBAAkB,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;YAC5D,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,kCAAkC,CAAC,CAAC;QAClF,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,8EAA8E,CAAC,CAAC;QAC9F,CAAC;QAED,MAAM,OAAO,GAAG,IAAA,qBAAU,EAAC,gBAAgB,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QAC5D,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,EAAE,GAAG,IAAA,sBAAW,EAAC,iBAAiB,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;YACzD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,iCAAiC,CAAC,CAAC;QAChF,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,4EAA4E,CAAC,CAAC;QAC5F,CAAC;QAED,MAAM,GAAG,GAAG,MAAA,IAAA,oCAAwB,EAAC,SAAS,CAAC,0CAAE,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;QACzE,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,CAAC,GAAG,CAAC,gFAAgF,CAAC,CAAC;YAC9F,OAAO;QACT,CAAC;QAED,MAAM,EAAE,MAAM,EAAE,GAAG,2CAAa,UAAU,EAAC,CAAC;QAC5C,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAkB;gBAC3C,IAAI,EAAE,UAAU;gBAChB,IAAI,EAAE,KAAK;gBACX,OAAO,EAAE,2EAA2E;aACrF,CAAC,CAAC;YACH,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;QACnB,CAAC;QAAC,WAAM,CAAC;YACP,OAAO;QACT,CAAC;QAED,IAAI,CAAC,GAAG;YAAE,OAAO;QAEjB,MAAM,aAAa,GAAG,IAAA,qCAA0B,EAAC,kBAAkB,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QACzG,IAAI,aAAa,EAAE,CAAC;YAClB,OAAO,CAAC,GAAG,CAAC,iCAAiC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;YAC9D,MAAM,MAAM,GAAG,IAAA,qCAA0B,EAAC,kBAAkB,EAAE,gBAAgB,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;YAC/F,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,6DAA6D,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC;QAClH,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,0CAA0C,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;CAAA"}

package/src/generators/setup-secrets/setup-secrets.spec.ts

@@ -0,0 +1,78 @@
+import { createTreeWithEmptyWorkspace } from '@nx/devkit/testing';
+import * as ocUtils from '../../utils/oc-utils';
+import * as ghUtils from '../../utils/gh-utils';
+import * as gitUtils from '../../utils/git-utils';
+import { Schema } from './schema';
+import generator from './setup-secrets';
+
+jest.mock('../../utils/oc-utils');
+jest.mock('../../utils/gh-utils');
+jest.mock('../../utils/git-utils');
+jest.mock('enquirer', () => ({
+  prompt: jest.fn().mockResolvedValue({ pat: 'test-pat' }),
+}));
+
+const ocMock = ocUtils as jest.Mocked<typeof ocUtils>;
+const ghMock = ghUtils as jest.Mocked<typeof ghUtils>;
+const gitMock = gitUtils as jest.Mocked<typeof gitUtils>;
+
+describe('Setup Secrets Generator', () => {
+  const options: Schema = { infra: 'my-infra' };
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    ocMock.ensureOcLogin.mockImplementation(() => undefined);
+    ocMock.getOcServerUrl.mockReturnValue('https://api.example.com:6443');
+    ocMock.getSaToken.mockReturnValue('test-sa-token');
+    ocMock.createDockerRegistrySecret.mockReturnValue(true);
+    ocMock.linkSecretToServiceAccount.mockReturnValue(true);
+    ghMock.checkGhCli.mockImplementation(() => undefined);
+    ghMock.setGhSecret.mockReturnValue(true);
+    gitMock.getGitRemoteUrl.mockReturnValue('https://github.com/GovAlta/nx-tools.git');
+    gitMock.getGitHubRepo.mockReturnValue('GovAlta/nx-tools');
+    gitMock.deriveRegistryFromRemote.mockReturnValue('ghcr.io/GovAlta');
+  });
+
+  it('sets GitHub secrets and creates GHCR pull secret', async () => {
+    const host = createTreeWithEmptyWorkspace();
+    await generator(host, options);
+
+    expect(ghMock.setGhSecret).toHaveBeenCalledWith('OPENSHIFT_SERVER', 'https://api.example.com:6443', 'GovAlta/nx-tools');
+    expect(ghMock.setGhSecret).toHaveBeenCalledWith('OPENSHIFT_TOKEN', 'test-sa-token', 'GovAlta/nx-tools');
+    expect(ocMock.createDockerRegistrySecret).toHaveBeenCalledWith(
+      'ghcr-pull-secret', 'ghcr.io', 'GovAlta', 'test-pat', 'my-infra'
+    );
+    expect(ocMock.linkSecretToServiceAccount).toHaveBeenCalledWith(
+      'ghcr-pull-secret', 'github-actions', 'my-infra'
+    );
+  });
+
+  it('skips secrets when no GitHub remote is found', async () => {
+    gitMock.getGitRemoteUrl.mockReturnValue(undefined);
+    gitMock.getGitHubRepo.mockReturnValue(undefined);
+
+    const host = createTreeWithEmptyWorkspace();
+    await generator(host, options);
+
+    expect(ghMock.setGhSecret).not.toHaveBeenCalled();
+    expect(ocMock.createDockerRegistrySecret).not.toHaveBeenCalled();
+  });
+
+  it('skips secrets when gh CLI is not available', async () => {
+    ghMock.checkGhCli.mockImplementation(() => { throw new Error('gh: not found'); });
+
+    const host = createTreeWithEmptyWorkspace();
+    await generator(host, options);
+
+    expect(ghMock.setGhSecret).not.toHaveBeenCalled();
+  });
+
+  it('skips GHCR secret when SA token cannot be retrieved', async () => {
+    ocMock.getSaToken.mockReturnValue(undefined);
+
+    const host = createTreeWithEmptyWorkspace();
+    await generator(host, options);
+
+    expect(ocMock.createDockerRegistrySecret).toHaveBeenCalled();
+  });
+});

package/src/utils/gh-utils.d.ts

@@ -0,0 +1,2 @@
+export declare function checkGhCli(): void;
+export declare function setGhSecret(name: string, value: string, repo: string): boolean;

package/src/utils/gh-utils.js

@@ -0,0 +1,26 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkGhCli = checkGhCli;
+exports.setGhSecret = setGhSecret;
+const child_process_1 = require("child_process");
+function checkGhCli() {
+    try {
+        (0, child_process_1.execFileSync)('gh', ['auth', 'status'], { stdio: 'pipe' });
+    }
+    catch (_a) {
+        throw new Error('gh CLI is not installed or not authenticated. Run `gh auth login` then re-try.');
+    }
+}
+function setGhSecret(name, value, repo) {
+    try {
+        (0, child_process_1.execFileSync)('gh', ['secret', 'set', name, '--repo', repo], {
+            input: Buffer.from(value),
+            stdio: ['pipe', 'pipe', 'pipe'],
+        });
+        return true;
+    }
+    catch (_a) {
+        return false;
+    }
+}
+//# sourceMappingURL=gh-utils.js.map

package/src/utils/gh-utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gh-utils.js","sourceRoot":"","sources":["../../../../../packages/nx-oc/src/utils/gh-utils.ts"],"names":[],"mappings":";;AAEA,gCAQC;AAED,kCAUC;AAtBD,iDAA6C;AAE7C,SAAgB,UAAU;IACxB,IAAI,CAAC;QACH,IAAA,4BAAY,EAAC,IAAI,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IAC5D,CAAC;IAAC,WAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,gFAAgF,CACjF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAgB,WAAW,CAAC,IAAY,EAAE,KAAa,EAAE,IAAY;IACnE,IAAI,CAAC;QACH,IAAA,4BAAY,EAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,EAAE;YAC1D,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;YACzB,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;SAChC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,WAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/src/utils/gh-utils.spec.ts

@@ -0,0 +1,39 @@
+import { execFileSync } from 'child_process';
+import { mocked } from 'jest-mock';
+import { checkGhCli, setGhSecret } from './gh-utils';
+
+jest.mock('child_process');
+const mockedExecFileSync = mocked(execFileSync);
+
+describe('checkGhCli', () => {
+  beforeEach(() => mockedExecFileSync.mockReset());
+
+  it('does not throw when gh is authenticated', () => {
+    mockedExecFileSync.mockReturnValue(Buffer.from('Logged in to github.com'));
+    expect(() => checkGhCli()).not.toThrow();
+  });
+
+  it('throws a clear error when gh CLI is unavailable or unauthenticated', () => {
+    mockedExecFileSync.mockImplementation(() => { throw new Error('gh: command not found'); });
+    expect(() => checkGhCli()).toThrow('gh CLI is not installed or not authenticated');
+  });
+});
+
+describe('setGhSecret', () => {
+  beforeEach(() => mockedExecFileSync.mockReset());
+
+  it('returns true on success', () => {
+    mockedExecFileSync.mockReturnValue(Buffer.from(''));
+    expect(setGhSecret('OPENSHIFT_TOKEN', 'tok', 'GovAlta/nx-tools')).toBe(true);
+    expect(mockedExecFileSync).toHaveBeenCalledWith(
+      'gh',
+      ['secret', 'set', 'OPENSHIFT_TOKEN', '--repo', 'GovAlta/nx-tools'],
+      expect.objectContaining({ input: Buffer.from('tok') })
+    );
+  });
+
+  it('returns false when gh command fails', () => {
+    mockedExecFileSync.mockImplementation(() => { throw new Error('gh: not found'); });
+    expect(setGhSecret('OPENSHIFT_TOKEN', 'tok', 'GovAlta/nx-tools')).toBe(false);
+  });
+});

package/src/utils/git-utils.d.ts

@@ -1 +1,3 @@
 export declare function getGitRemoteUrl(): string | undefined;
+export declare function deriveRegistryFromRemote(remoteUrl?: string): string | undefined;
+export declare function getGitHubRepo(remoteUrl?: string): string | undefined;

package/src/utils/git-utils.js

@@ -1,6 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getGitRemoteUrl = getGitRemoteUrl;
+exports.deriveRegistryFromRemote = deriveRegistryFromRemote;
+exports.getGitHubRepo = getGitHubRepo;
 const child_process_1 = require("child_process");
 function getGitRemoteUrl() {
     try {
@@ -11,4 +13,27 @@ function getGitRemoteUrl() {
         console.log(`Failed to execute git`, e);
     }
 }
+// Parses a GitHub remote URL and returns the ghcr.io registry for the org.
+// Handles both HTTPS (https://github.com/ORG/REPO.git) and
+// SSH (git@github.com:ORG/REPO.git) formats.
+function deriveRegistryFromRemote(remoteUrl) {
+    var _a;
+    if (!remoteUrl)
+        return undefined;
+    const url = remoteUrl.trim();
+    const httpsMatch = url.match(/https:\/\/github\.com\/([^/]+)\//);
+    const sshMatch = url.match(/git@github\.com:([^/]+)\//);
+    const org = (_a = httpsMatch === null || httpsMatch === void 0 ? void 0 : httpsMatch[1]) !== null && _a !== void 0 ? _a : sshMatch === null || sshMatch === void 0 ? void 0 : sshMatch[1];
+    return org ? `ghcr.io/${org}` : undefined;
+}
+// Returns the "owner/repo" slug for use with `gh secret set --repo`.
+function getGitHubRepo(remoteUrl) {
+    var _a;
+    if (!remoteUrl)
+        return undefined;
+    const url = remoteUrl.trim();
+    const httpsMatch = url.match(/https:\/\/github\.com\/(.+?)(?:\.git)?\s*$/);
+    const sshMatch = url.match(/git@github\.com:(.+?)(?:\.git)?\s*$/);
+    return (_a = httpsMatch === null || httpsMatch === void 0 ? void 0 : httpsMatch[1]) !== null && _a !== void 0 ? _a : sshMatch === null || sshMatch === void 0 ? void 0 : sshMatch[1];
+}
 //# sourceMappingURL=git-utils.js.map

package/src/utils/git-utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"git-utils.js","sourceRoot":"","sources":["../../../../../packages/nx-oc/src/utils/git-utils.ts"],"names":[],"mappings":";;AAEA,0CAWC;AAbD,iDAAwC;AAExC,SAAgB,eAAe;IAC7B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAA,wBAAQ,EACrB,oCAAoC,EACpC,EAAE,KAAK,EAAE,MAAM,EAAE,CAClB,CAAC,QAAQ,EAAE,CAAA;QAEZ,OAAO,MAAM,CAAA;IACf,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,CAAC,GAAG,CAAC,uBAAuB,EAAE,CAAC,CAAC,CAAA;IACzC,CAAC;AACH,CAAC"}
+{"version":3,"file":"git-utils.js","sourceRoot":"","sources":["../../../../../packages/nx-oc/src/utils/git-utils.ts"],"names":[],"mappings":";;AAEA,0CAWC;AAKD,4DAOC;AAGD,sCAMC;AAlCD,iDAAwC;AAExC,SAAgB,eAAe;IAC7B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAA,wBAAQ,EACrB,oCAAoC,EACpC,EAAE,KAAK,EAAE,MAAM,EAAE,CAClB,CAAC,QAAQ,EAAE,CAAA;QAEZ,OAAO,MAAM,CAAA;IACf,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,CAAC,GAAG,CAAC,uBAAuB,EAAE,CAAC,CAAC,CAAA;IACzC,CAAC;AACH,CAAC;AAED,2EAA2E;AAC3E,2DAA2D;AAC3D,6CAA6C;AAC7C,SAAgB,wBAAwB,CAAC,SAAkB;;IACzD,IAAI,CAAC,SAAS;QAAE,OAAO,SAAS,CAAC;IACjC,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC;IAC7B,MAAM,UAAU,GAAG,GAAG,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACjE,MAAM,QAAQ,GAAK,GAAG,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC1D,MAAM,GAAG,GAAG,MAAA,UAAU,aAAV,UAAU,uBAAV,UAAU,CAAG,CAAC,CAAC,mCAAI,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAG,CAAC,CAAC,CAAC;IAC7C,OAAO,GAAG,CAAC,CAAC,CAAC,WAAW,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAC5C,CAAC;AAED,qEAAqE;AACrE,SAAgB,aAAa,CAAC,SAAkB;;IAC9C,IAAI,CAAC,SAAS;QAAE,OAAO,SAAS,CAAC;IACjC,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC;IAC7B,MAAM,UAAU,GAAG,GAAG,CAAC,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAC3E,MAAM,QAAQ,GAAK,GAAG,CAAC,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACpE,OAAO,MAAA,UAAU,aAAV,UAAU,uBAAV,UAAU,CAAG,CAAC,CAAC,mCAAI,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAG,CAAC,CAAC,CAAC;AAC1C,CAAC"}

package/src/utils/git-utils.spec.ts

@@ -1,6 +1,6 @@
 import { execSync } from 'child_process';
 import { mocked } from 'jest-mock';
-import { getGitRemoteUrl } from './git-utils';
+import { getGitRemoteUrl, deriveRegistryFromRemote, getGitHubRepo } from './git-utils';
 
 jest.mock('child_process');
 const mockedExecSync = mocked(execSync);
@@ -32,3 +32,53 @@ describe('getGitRemoteUrl', () => {
     expect(url).toBeUndefined();
   });
 });
+
+describe('deriveRegistryFromRemote', () => {
+  it('derives registry from HTTPS remote', () => {
+    expect(deriveRegistryFromRemote('https://github.com/GovAlta/nx-tools.git'))
+      .toBe('ghcr.io/GovAlta');
+  });
+
+  it('derives registry from SSH remote', () => {
+    expect(deriveRegistryFromRemote('git@github.com:GovAlta/nx-tools.git'))
+      .toBe('ghcr.io/GovAlta');
+  });
+
+  it('returns undefined for non-GitHub remote', () => {
+    expect(deriveRegistryFromRemote('https://gitlab.com/org/repo.git')).toBeUndefined();
+  });
+
+  it('returns undefined when remoteUrl is undefined', () => {
+    expect(deriveRegistryFromRemote(undefined)).toBeUndefined();
+  });
+
+  it('handles trailing newline from git output', () => {
+    expect(deriveRegistryFromRemote('https://github.com/GovAlta/nx-tools.git\n'))
+      .toBe('ghcr.io/GovAlta');
+  });
+});
+
+describe('getGitHubRepo', () => {
+  it('returns owner/repo from HTTPS remote', () => {
+    expect(getGitHubRepo('https://github.com/GovAlta/nx-tools.git'))
+      .toBe('GovAlta/nx-tools');
+  });
+
+  it('returns owner/repo from SSH remote', () => {
+    expect(getGitHubRepo('git@github.com:GovAlta/nx-tools.git'))
+      .toBe('GovAlta/nx-tools');
+  });
+
+  it('handles trailing newline from git output', () => {
+    expect(getGitHubRepo('https://github.com/GovAlta/nx-tools.git\n'))
+      .toBe('GovAlta/nx-tools');
+  });
+
+  it('returns undefined for non-GitHub remote', () => {
+    expect(getGitHubRepo('https://gitlab.com/org/repo.git')).toBeUndefined();
+  });
+
+  it('returns undefined when remoteUrl is undefined', () => {
+    expect(getGitHubRepo(undefined)).toBeUndefined();
+  });
+});

package/src/utils/oc-utils.d.ts

@@ -1,3 +1,7 @@
+export declare function getOcServerUrl(): string | undefined;
+export declare function getSaToken(saName: string, namespace: string): string | undefined;
+export declare function createDockerRegistrySecret(name: string, server: string, username: string, password: string, namespace: string): boolean;
+export declare function linkSecretToServiceAccount(secretName: string, saName: string, namespace: string): boolean;
 export declare function runOcCommand(command: 'project' | 'start-build' | 'process' | 'apply', params: string[], input?: Buffer): {
     success: boolean;
     stdout?: Buffer;

package/src/utils/oc-utils.js

@@ -1,8 +1,59 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.getOcServerUrl = getOcServerUrl;
+exports.getSaToken = getSaToken;
+exports.createDockerRegistrySecret = createDockerRegistrySecret;
+exports.linkSecretToServiceAccount = linkSecretToServiceAccount;
 exports.runOcCommand = runOcCommand;
 exports.ensureOcLogin = ensureOcLogin;
 const child_process_1 = require("child_process");
+function getOcServerUrl() {
+    try {
+        return (0, child_process_1.execFileSync)('oc', ['config', 'view', '--minify', '-o', 'jsonpath={.clusters[0].cluster.server}'], { stdio: 'pipe' }).toString().trim() || undefined;
+    }
+    catch (_a) {
+        return undefined;
+    }
+}
+// Creates a bounded SA token valid for one year (OCP 4.11+ TokenRequest API).
+// Falls back to the legacy `oc sa get-token` on older clusters.
+function getSaToken(saName, namespace) {
+    try {
+        return (0, child_process_1.execFileSync)('oc', ['create', 'token', saName, '-n', namespace, '--duration=8760h'], { stdio: 'pipe' }).toString().trim() || undefined;
+    }
+    catch (_a) {
+        try {
+            return (0, child_process_1.execFileSync)('oc', ['sa', 'get-token', saName, '-n', namespace], { stdio: 'pipe' }).toString().trim() || undefined;
+        }
+        catch (_b) {
+            return undefined;
+        }
+    }
+}
+function createDockerRegistrySecret(name, server, username, password, namespace) {
+    try {
+        (0, child_process_1.execFileSync)('oc', [
+            'create', 'secret', 'docker-registry', name,
+            `--docker-server=${server}`,
+            `--docker-username=${username}`,
+            `--docker-password=${password}`,
+            '-n', namespace,
+        ], { stdio: 'pipe' });
+        return true;
+    }
+    catch (_a) {
+        return false;
+    }
+}
+function linkSecretToServiceAccount(secretName, saName, namespace) {
+    try {
+        (0, child_process_1.execFileSync)('oc', ['secrets', 'link', saName, secretName, '--for=pull', '-n', namespace], { stdio: 'pipe' });
+        return true;
+    }
+    catch (_a) {
+        return false;
+    }
+}
 function runOcCommand(command, params, input) {
     const args = input
         ? [command, '-f', '-', ...params]

package/src/utils/oc-utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"oc-utils.js","sourceRoot":"","sources":["../../../../../packages/nx-oc/src/utils/oc-utils.ts"],"names":[],"mappings":";;AAEA,oCAiBC;AAED,sCAmCC;AAxDD,iDAAwD;AAExD,SAAgB,YAAY,CAC1B,OAAwD,EACxD,MAAgB,EAChB,KAAc;IAEd,MAAM,IAAI,GAAG,KAAK;QAChB,CAAC,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;QACjC,CAAC,CAAC,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,CAAC;IAEzB,IAAI,CAAC;QACH,OAAO,CAAC,GAAG,CAAC,yBAAyB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACvD,MAAM,MAAM,GAAG,IAAA,4BAAY,EAAC,IAAI,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAClE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IACnC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,CAAC,GAAG,CAAC,iCAAiC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QAClE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;AACH,CAAC;AAED,SAAgB,aAAa;IAC3B,IAAI,CAAC;QACH,IAAA,4BAAY,EAAC,IAAI,EAAE,CAAC,SAAS,EAAE,UAAU,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IACjE,CAAC;IAAC,WAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,wIAAwI,CACzI,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,IAAA,4BAAY,EAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QAClD,OAAO;IACT,CAAC;IAAC,WAAM,CAAC;QACP,oDAAoD;IACtD,CAAC;IAED,IAAI,MAAM,GAAkB,IAAI,CAAC;IACjC,IAAI,CAAC;QACH,MAAM;YACJ,IAAA,4BAAY,EAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,wCAAwC,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;iBAClH,QAAQ,EAAE;iBACV,IAAI,EAAE,IAAI,IAAI,CAAC;IACtB,CAAC;IAAC,WAAM,CAAC;QACP,kDAAkD;IACpD,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,2DAA2D,CAAC,CAAC;IACzE,MAAM,SAAS,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC3E,MAAM,MAAM,GAAG,IAAA,yBAAS,EAAC,IAAI,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;IAEhE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CACb,6FAA6F,CAC9F,CAAC;IACJ,CAAC;AACH,CAAC"}
+{"version":3,"file":"oc-utils.js","sourceRoot":"","sources":["../../../../../packages/nx-oc/src/utils/oc-utils.ts"],"names":[],"mappings":";;AAEA,wCAUC;AAID,gCAgBC;AAED,gEAmBC;AAED,gEAWC;AAED,oCAiBC;AAED,sCAmCC;AA1HD,iDAAwD;AAExD,SAAgB,cAAc;IAC5B,IAAI,CAAC;QACH,OAAO,IAAA,4BAAY,EACjB,IAAI,EACJ,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,wCAAwC,CAAC,EAC9E,EAAE,KAAK,EAAE,MAAM,EAAE,CAClB,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,IAAI,SAAS,CAAC;IACnC,CAAC;IAAC,WAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,gEAAgE;AAChE,SAAgB,UAAU,CAAC,MAAc,EAAE,SAAiB;IAC1D,IAAI,CAAC;QACH,OAAO,IAAA,4BAAY,EACjB,IAAI,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,kBAAkB,CAAC,EACtE,EAAE,KAAK,EAAE,MAAM,EAAE,CAClB,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,IAAI,SAAS,CAAC;IACnC,CAAC;IAAC,WAAM,CAAC;QACP,IAAI,CAAC;YACH,OAAO,IAAA,4BAAY,EACjB,IAAI,EAAE,CAAC,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,CAAC,EAClD,EAAE,KAAK,EAAE,MAAM,EAAE,CAClB,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,IAAI,SAAS,CAAC;QACnC,CAAC;QAAC,WAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAgB,0BAA0B,CACxC,IAAY,EACZ,MAAc,EACd,QAAgB,EAChB,QAAgB,EAChB,SAAiB;IAEjB,IAAI,CAAC;QACH,IAAA,4BAAY,EAAC,IAAI,EAAE;YACjB,QAAQ,EAAE,QAAQ,EAAE,iBAAiB,EAAE,IAAI;YAC3C,mBAAmB,MAAM,EAAE;YAC3B,qBAAqB,QAAQ,EAAE;YAC/B,qBAAqB,QAAQ,EAAE;YAC/B,IAAI,EAAE,SAAS;SAChB,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,WAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAgB,0BAA0B,CACxC,UAAkB,EAClB,MAAc,EACd,SAAiB;IAEjB,IAAI,CAAC;QACH,IAAA,4BAAY,EAAC,IAAI,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,IAAI,EAAE,SAAS,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QAC9G,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,WAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAgB,YAAY,CAC1B,OAAwD,EACxD,MAAgB,EAChB,KAAc;IAEd,MAAM,IAAI,GAAG,KAAK;QAChB,CAAC,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;QACjC,CAAC,CAAC,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,CAAC;IAEzB,IAAI,CAAC;QACH,OAAO,CAAC,GAAG,CAAC,yBAAyB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACvD,MAAM,MAAM,GAAG,IAAA,4BAAY,EAAC,IAAI,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAClE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IACnC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,CAAC,GAAG,CAAC,iCAAiC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QAClE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;AACH,CAAC;AAED,SAAgB,aAAa;IAC3B,IAAI,CAAC;QACH,IAAA,4BAAY,EAAC,IAAI,EAAE,CAAC,SAAS,EAAE,UAAU,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IACjE,CAAC;IAAC,WAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,wIAAwI,CACzI,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,IAAA,4BAAY,EAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QAClD,OAAO;IACT,CAAC;IAAC,WAAM,CAAC;QACP,oDAAoD;IACtD,CAAC;IAED,IAAI,MAAM,GAAkB,IAAI,CAAC;IACjC,IAAI,CAAC;QACH,MAAM;YACJ,IAAA,4BAAY,EAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,wCAAwC,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;iBAClH,QAAQ,EAAE;iBACV,IAAI,EAAE,IAAI,IAAI,CAAC;IACtB,CAAC;IAAC,WAAM,CAAC;QACP,kDAAkD;IACpD,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,2DAA2D,CAAC,CAAC;IACzE,MAAM,SAAS,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC3E,MAAM,MAAM,GAAG,IAAA,yBAAS,EAAC,IAAI,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;IAEhE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CACb,6FAA6F,CAC9F,CAAC;IACJ,CAAC;AACH,CAAC"}

package/src/utils/oc-utils.spec.ts

@@ -1,6 +1,13 @@
 import { execFileSync, spawnSync } from 'child_process';
 import { mocked } from 'jest-mock';
-import { ensureOcLogin, runOcCommand } from './oc-utils';
+import {
+  ensureOcLogin,
+  runOcCommand,
+  getOcServerUrl,
+  getSaToken,
+  createDockerRegistrySecret,
+  linkSecretToServiceAccount,
+} from './oc-utils';
 
 jest.mock('child_process');
 const mockedExecFileSync = mocked(execFileSync);
@@ -126,3 +133,81 @@ describe('ensureOcLogin', () => {
     expect(() => ensureOcLogin()).toThrow('OpenShift login failed or was cancelled');
   });
 });
+
+describe('getOcServerUrl', () => {
+  beforeEach(() => mockedExecFileSync.mockReset());
+
+  it('returns the server URL from kubeconfig', () => {
+    mockedExecFileSync.mockReturnValue(Buffer.from('https://api.example.com:6443'));
+    expect(getOcServerUrl()).toBe('https://api.example.com:6443');
+  });
+
+  it('returns undefined when oc command fails', () => {
+    mockedExecFileSync.mockImplementation(() => { throw new Error('no config'); });
+    expect(getOcServerUrl()).toBeUndefined();
+  });
+});
+
+describe('getSaToken', () => {
+  beforeEach(() => mockedExecFileSync.mockReset());
+
+  it('returns token from oc create token', () => {
+    mockedExecFileSync.mockReturnValue(Buffer.from('eyJhbGciOi...'));
+    expect(getSaToken('github-actions', 'my-infra')).toBe('eyJhbGciOi...');
+    expect(mockedExecFileSync).toHaveBeenCalledWith(
+      'oc', ['create', 'token', 'github-actions', '-n', 'my-infra', '--duration=8760h'],
+      expect.objectContaining({ stdio: 'pipe' })
+    );
+  });
+
+  it('falls back to oc sa get-token when create token fails', () => {
+    mockedExecFileSync.mockImplementationOnce(() => { throw new Error('unsupported'); }); // oc create token
+    mockedExecFileSync.mockReturnValueOnce(Buffer.from('legacy-token'));                  // oc sa get-token
+    expect(getSaToken('github-actions', 'my-infra')).toBe('legacy-token');
+  });
+
+  it('returns undefined when both commands fail', () => {
+    mockedExecFileSync.mockImplementation(() => { throw new Error('not found'); });
+    expect(getSaToken('github-actions', 'my-infra')).toBeUndefined();
+  });
+});
+
+describe('createDockerRegistrySecret', () => {
+  beforeEach(() => mockedExecFileSync.mockReset());
+
+  it('returns true on success', () => {
+    mockedExecFileSync.mockReturnValue(Buffer.from('secret/ghcr-pull-secret created'));
+    expect(createDockerRegistrySecret('ghcr-pull-secret', 'ghcr.io', 'org', 'pat', 'my-infra')).toBe(true);
+    expect(mockedExecFileSync).toHaveBeenCalledWith(
+      'oc',
+      ['create', 'secret', 'docker-registry', 'ghcr-pull-secret',
+       '--docker-server=ghcr.io', '--docker-username=org', '--docker-password=pat',
+       '-n', 'my-infra'],
+      expect.objectContaining({ stdio: 'pipe' })
+    );
+  });
+
+  it('returns false when oc command fails', () => {
+    mockedExecFileSync.mockImplementation(() => { throw new Error('already exists'); });
+    expect(createDockerRegistrySecret('ghcr-pull-secret', 'ghcr.io', 'org', 'pat', 'my-infra')).toBe(false);
+  });
+});
+
+describe('linkSecretToServiceAccount', () => {
+  beforeEach(() => mockedExecFileSync.mockReset());
+
+  it('returns true on success', () => {
+    mockedExecFileSync.mockReturnValue(Buffer.from(''));
+    expect(linkSecretToServiceAccount('ghcr-pull-secret', 'github-actions', 'my-infra')).toBe(true);
+    expect(mockedExecFileSync).toHaveBeenCalledWith(
+      'oc',
+      ['secrets', 'link', 'github-actions', 'ghcr-pull-secret', '--for=pull', '-n', 'my-infra'],
+      expect.objectContaining({ stdio: 'pipe' })
+    );
+  });
+
+  it('returns false when oc command fails', () => {
+    mockedExecFileSync.mockImplementation(() => { throw new Error('not found'); });
+    expect(linkSecretToServiceAccount('ghcr-pull-secret', 'github-actions', 'my-infra')).toBe(false);
+  });
+});