@apex-actions/cli 0.88.1 → 0.89.1

package/dist/cli/migrate/main.js

@@ -119,19 +119,21 @@ const printScan = (scan, limit) => {
  * first thing somebody evaluating a migration wants: an answer about a
  * repository they already have, without handing anybody credentials.
  */
-const deps = (options, engine) => {
-    const checker = new EngineBinaryCompat(engine);
+const deps = async (options, engine) => {
     if (options.path !== undefined)
-        return { workflows: new LocalWorkflowSource(options.path), checker };
+        return { workflows: new LocalWorkflowSource(options.path), checker: new EngineBinaryCompat(await engine()) };
+    // The token first: resolving the engine can download it (ADR-0040), and a scan that cannot run must say so before
+    // spending seven megabytes on it.
+    let api;
     try {
-        const api = new GitHubApi();
-        return { workflows: api, checker, names: api };
+        api = new GitHubApi();
     }
     catch (err) {
         console.error(chalk.red(err instanceof NoTokenError ? err.message : String(err)));
         process.exitCode = 2;
         return undefined;
     }
+    return { workflows: api, checker: new EngineBinaryCompat(await engine()), names: api };
 };
 const handler = async (org, options) => {
     if (org === undefined && options.path === undefined) {
@@ -139,7 +141,7 @@ const handler = async (org, options) => {
         process.exitCode = 2;
         return;
     }
-    const built = deps(options, await resolveBinary('apex-engine', 'APEX_ENGINE_BIN'));
+    const built = await deps(options, () => resolveBinary('apex-engine', 'APEX_ENGINE_BIN'));
     if (built === undefined)
         return;
     // A local scan has no organization. The directory's name is what the person

package/dist/cli/runner/main.js

@@ -127,6 +127,7 @@ const registerCommand = new Command('register')
     .description('Attach this machine as a self-hosted runner and start leasing work')
     .requiredOption('--labels <labels>', 'comma-separated labels, e.g. self-hosted,linux,gpu')
     .option('--server <host:port>', 'runner endpoint (APEX_RUNNER_SERVER)', process.env['APEX_RUNNER_SERVER'])
+    .option('--server-ca <file>', "PEM file with the endpoint's certificate; set, the runner speaks TLS and trusts only it (APEX_RUNNER_SERVER_CA)", process.env['APEX_RUNNER_SERVER_CA'])
     .option('--name <name>', 'display name (default: this hostname)')
     .option('--work-dir <path>', 'scratch root for job workspaces')
     .option('--idle-timeout <duration>', 'stop after this long with no job, e.g. 30m (default: never)')
@@ -145,6 +146,7 @@ const registerCommand = new Command('register')
     console.error(chalk.dim(`registering ${opts.name ?? 'this machine'} with ${opts.server} as [${opts.labels}]`));
     const outcome = await registerRunner(client, new RunnerBinaryExecutor(await resolveBinary('apex-runner', 'APEX_RUNNER_BIN')), {
         server: opts.server,
+        serverCa: opts.serverCa,
         labels: opts.labels.split(','),
         name: opts.name,
         workDir: opts.workDir,

package/dist/cli/secret/main.js

@@ -2,7 +2,7 @@ import { Command, Option } from 'commander';
 import chalk from 'chalk';
 import { batchExitCode, listSecrets, setEverywhere } from '../../src/application/manage-secrets.js';
 import { ValueInputError, promptHidden, readToEnd, readValueFile } from '../../src/infrastructure/secret-input.js';
-import { api, collect, deleteAction, ORG_OPTION, printResults, reachLabel, reachOf, targetsFrom, usage, validName } from './shared.js';
+import { api, APP_OPTION, collect, deleteAction, ORG_OPTION, printResults, reachLabel, reachOf, targetsFrom, usage, validName } from './shared.js';
 /**
  * The refusal, in full, because the person who typed `--value` deserves the
  * reason and the alternative in one breath (BUG-0157).
@@ -31,6 +31,7 @@ const setCommand = new Command('set')
     .argument('<name>', 'secret name, as a workflow reads it: secrets.NAME')
     .option('--repo <owner/repo>', 'repository to set it on (repeatable: one value, many repositories)', collect, [])
     .option(...ORG_OPTION)
+    .option(...APP_OPTION)
     .option('--visibility <visibility>', 'with --org <organization>: which repositories reach it — all (default), private or selected')
     .option('--repos <names>', 'with --org <organization>: the repositories that reach it, comma-separated (implies --visibility selected)')
     .option('--from-file <path>', 'read the value from this file (one trailing newline is dropped)')
@@ -67,6 +68,7 @@ const listCommand = new Command('list')
     .description("A repository's secret names — never values: the API has none to give")
     .option('--repo <owner/repo>', 'repository', collect, [])
     .option(...ORG_OPTION)
+    .option(...APP_OPTION)
     .option('--json', 'machine-readable output')
     .action(async (opts) => {
     const targets = targetsFrom(opts, true);
@@ -100,6 +102,7 @@ const deleteCommand = new Command('delete')
     .argument('<name>', 'secret name')
     .option('--repo <owner/repo>', 'repository (repeatable)', collect, [])
     .option(...ORG_OPTION)
+    .option(...APP_OPTION)
     .option('-y, --yes', 'do not ask; required when not on a terminal')
     .action(deleteAction('secret'));
 export default new Command('secret')

package/dist/cli/secret/shared.js

@@ -2,10 +2,12 @@ import chalk from 'chalk';
 import { splitRepository } from '../../src/application/manage-caches.js';
 import { batchExitCode, deleteEverywhere } from '../../src/application/manage-secrets.js';
 import { confirm } from '../../src/infrastructure/secret-input.js';
-import { nameProblem, reachFrom } from '../../src/domain/secrets.js';
+import { nameProblem, reachFrom, secretAppFrom } from '../../src/domain/secrets.js';
 import { HttpControlPlane, NotConfiguredError } from '../../src/infrastructure/control-plane-http.js';
 /** What `--org` says in every subcommand's help. */
 export const ORG_OPTION = ['--org [organization]', 'an organization’s scope, by its GitHub login (bare: the operator organization)'];
+/** `gh secret --app`'s spelling (context TASK-0394): Dependabot's store is handed only to a run Dependabot started. */
+export const APP_OPTION = ['--app <app>', 'which store: actions (default) or dependabot, handed only to runs Dependabot started'];
 export const collect = (value, previous) => [...previous, value];
 export const usage = (message) => {
     console.error(chalk.red(message));
@@ -33,6 +35,18 @@ export const validName = (name) => {
  * is for `list`, which answers about one place at a time.
  */
 export const targetsFrom = (opts, single = false) => {
+    const found = placesFrom(opts, single);
+    if (found === undefined)
+        return undefined;
+    const app = secretAppFrom(opts.app);
+    if (typeof app !== 'string') {
+        usage(app.problem);
+        return undefined;
+    }
+    // The Actions store is the default and stays unnamed; only `apex secret` offers --app.
+    return app === 'actions' ? found : found.map((t) => ({ ...t, app }));
+};
+const placesFrom = (opts, single) => {
     if (opts.org !== undefined && opts.org !== false && opts.repo.length > 0) {
         usage('pass --repo or --org, not both');
         return undefined;

package/dist/src/domain/secrets.js

@@ -1,5 +1,17 @@
 // domain layer — see ../../../../docs/conventions.md §1
-export const targetLabel = (target) => target.kind === 'repo' ? `${target.owner}/${target.repo}` : target.org === undefined ? 'the organisation' : `the ${target.org} organization`;
+/** GitHub's two secret stores, as `gh secret --app` names them: every workflow's, and Dependabot's runs' only. */
+export const SECRET_APPS = ['actions', 'dependabot'];
+/** `--app` into a store, or the reason it is not one. Absent is `actions`. */
+export const secretAppFrom = (app) => {
+    if (app === undefined)
+        return 'actions';
+    const lower = app.toLowerCase();
+    return SECRET_APPS.includes(lower) ? lower : { problem: `--app is one of ${SECRET_APPS.join(', ')}, not ${JSON.stringify(app)}` };
+};
+export const targetLabel = (target) => {
+    const place = target.kind === 'repo' ? `${target.owner}/${target.repo}` : target.org === undefined ? 'the organisation' : `the ${target.org} organization`;
+    return target.app === 'dependabot' ? `${place} (Dependabot)` : place;
+};
 /** Which of an Organization's repositories an organisation entry reaches — GitHub's three. */
 export const VISIBILITIES = ['all', 'private', 'selected'];
 /**

package/dist/src/infrastructure/control-plane-http.js

@@ -15,6 +15,8 @@ export class HttpError extends Error {
     }
 }
 /** A named Organization's reach, as the API takes it (control-plane ADR-0084); nothing for any other scope. */
+/** Dependabot's store is named; the Actions store is the routes' default, so its paths are unchanged (TASK-0394). */
+const appQuery = (target) => (target.app === 'dependabot' ? '?app=dependabot' : '');
 const reachBody = (target, reach) => target.kind === 'org' && target.org !== undefined && reach !== undefined
     ? { visibility: reach.visibility, ...(reach.visibility === 'selected' ? { selectedRepositories: [...reach.repos] } : {}) }
     : {};
@@ -95,11 +97,11 @@ export class HttpControlPlane {
     }
     // ── secrets and variables (values are write-only) ──
     async listSecrets(target) {
-        const body = await this.#json('GET', `${this.#scopePath(target)}/secrets`);
+        const body = await this.#json('GET', `${this.#scopePath(target)}/secrets${appQuery(target)}`);
         return body.secrets;
     }
     async setSecret(target, name, value, reach) {
-        await this.#noContent('PUT', `${this.#scopePath(target)}/secrets/${encodeURIComponent(name)}`, { value, ...reachBody(target, reach) });
+        await this.#noContent('PUT', `${this.#scopePath(target)}/secrets/${encodeURIComponent(name)}${appQuery(target)}`, { value, ...reachBody(target, reach) });
     }
     /**
      * `apex logout`: revoke the token this client authenticates with. A 401 means
@@ -113,7 +115,7 @@ export class HttpControlPlane {
         throw new HttpError(await this.#errorMessage(response), response.status);
     }
     async deleteSecret(target, name) {
-        return await this.#deleted(`${this.#scopePath(target)}/secrets/${encodeURIComponent(name)}`);
+        return await this.#deleted(`${this.#scopePath(target)}/secrets/${encodeURIComponent(name)}${appQuery(target)}`);
     }
     async listVariables(target) {
         const body = await this.#json('GET', `${this.#scopePath(target)}/variables`);

package/dist/src/infrastructure/runner-binary.js

@@ -29,6 +29,8 @@ export const runnerArgs = (request) => {
 /** Builds the remote-mode argv for `apex runner register` (pure, tested). */
 export const registerArgs = (request) => {
     const args = ['--server', request.server, '--registration-token', request.token, '--labels', request.labels.join(',')];
+    if (request.serverCa !== undefined)
+        args.push('--server-ca', request.serverCa);
     if (request.name !== undefined)
         args.push('--name', request.name);
     if (request.workDir !== undefined)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@apex-actions/cli",
-  "version": "0.88.1",
+  "version": "0.89.1",
   "license": "SEE LICENSE IN LICENSE",
   "//files": "Without this npm ships src, test and the CI config alongside the binary a user installs.",
   "files": [