@aspruyt/xfg 6.1.0 → 6.3.0

package/dist/cli/unified-summary.d.ts

@@ -1,6 +1,4 @@
-import type { LifecycleReport } from "../output/lifecycle-report.js";
-import type { SyncReport } from "../output/types.js";
-import type { SettingsReport } from "../output/settings-report.js";
+import { type LifecycleReport, type SyncReport, type SettingsReport } from "../output/index.js";
 interface UnifiedSummaryInput {
     lifecycle?: LifecycleReport;
     sync?: SyncReport;

package/dist/cli/unified-summary.js

@@ -1,7 +1,4 @@
-import { hasLifecycleChanges } from "../output/lifecycle-report.js";
-import { writeGitHubStepSummary } from "../output/github-summary.js";
-import { renderSyncLines } from "../output/sync-report.js";
-import { renderRepoSettingsDiffLines, formatCountEntry, } from "../output/settings-report.js";
+import { hasLifecycleChanges, writeGitHubStepSummary, renderSyncLines, renderRepoSettingsDiffLines, formatCountEntry, } from "../output/index.js";
 // =============================================================================
 // Helpers
 // =============================================================================
@@ -121,6 +118,11 @@ function renderLifecycleLines(lcAction, diffLines) {
         case "migrated":
             diffLines.push(`+ MIGRATE ${lcAction.source ?? "source"} -> ${lcAction.repoName}`);
             break;
+        /* c8 ignore next 4 */
+        default: {
+            const _exhaustive = lcAction.action;
+            throw new Error(`Unexpected lifecycle action: ${_exhaustive}`);
+        }
     }
     if (lcAction.settings) {
         if (lcAction.settings.visibility) {
@@ -188,7 +190,7 @@ export function formatUnifiedSummaryMarkdown(input) {
         if (hasLcChange && hasSyncChanges)
             diffLines.push("");
         if (syncRepo)
-            renderSyncLines(syncRepo, diffLines);
+            diffLines.push(...renderSyncLines(syncRepo));
         // Blank line between files and settings sections
         if (hasSyncChanges && hasSettingsChanges)
             diffLines.push("");

package/dist/cli.js

@@ -1,3 +1,4 @@
 #!/usr/bin/env node
-import { program } from "./cli/program.js";
+import { program, getVersion } from "./cli/program.js";
+program.version(getVersion());
 program.parse();

package/dist/{shared → config}/env.js

@@ -3,8 +3,8 @@
  * Supports ${VAR}, ${VAR:-default}, and ${VAR:?message} syntax.
  * Use $${VAR} to escape and output literal ${VAR}.
  */
-import { interpolateString, interpolateValue, } from "./interpolation-engine.js";
-import { ValidationError } from "./errors.js";
+import { interpolateString, interpolateValue, } from "../shared/interpolation-engine.js";
+import { ValidationError } from "../shared/errors.js";
 /**
  * Regex to match environment variable placeholders.
  * Captures:

package/dist/config/extends-resolver.js

@@ -1,3 +1,4 @@
+import { ValidationError } from "../shared/errors.js";
 const MAX_EXTENDS_DEPTH = 100;
 /**
  * Resolves a single group's extends chain into an ordered list of group names.
@@ -7,16 +8,16 @@ const MAX_EXTENDS_DEPTH = 100;
 export function resolveExtendsChain(groupName, groupDefs) {
     function walk(name, visited, depth) {
         if (depth > MAX_EXTENDS_DEPTH) {
-            throw new Error(`Extends chain exceeds maximum depth of ${MAX_EXTENDS_DEPTH} — likely misconfigured`);
+            throw new ValidationError(`Extends chain exceeds maximum depth of ${MAX_EXTENDS_DEPTH} — likely misconfigured`);
         }
         if (visited.has(name)) {
             const cycle = [...visited, name].join(" -> ");
-            throw new Error(`Circular extends detected: ${cycle}`);
+            throw new ValidationError(`Circular extends detected: ${cycle}`);
         }
         visited.add(name);
         const group = groupDefs[name];
         if (!group) {
-            throw new Error(`Group '${name}' referenced in extends chain does not exist`);
+            throw new ValidationError(`Group '${name}' referenced in extends chain does not exist`);
         }
         if (!group.extends) {
             return [name];

package/dist/config/file-reference-resolver.js

@@ -44,7 +44,7 @@ export function resolveFileReference(reference, configDir) {
     }
     catch (error) {
         const msg = toErrorMessage(error);
-        throw new ValidationError(`Failed to load file reference "${reference}": ${msg}`);
+        throw new ValidationError(`Failed to load file reference "${reference}": ${msg}`, { cause: error });
     }
     // Parse based on extension
     const ext = extname(relativePath).toLowerCase();
@@ -65,7 +65,9 @@ function parseWithContext(fn, errorPrefix) {
         return fn();
     }
     catch (error) {
-        throw new ValidationError(`${errorPrefix}: ${toErrorMessage(error)}`);
+        throw new ValidationError(`${errorPrefix}: ${toErrorMessage(error)}`, {
+            cause: error,
+        });
     }
 }
 /**

package/dist/config/formatter.js

@@ -103,6 +103,7 @@ export function convertContentToString(content, fileName, options) {
             indent: 2,
             defaultStringType: "QUOTE_DOUBLE",
             defaultKeyType: "PLAIN",
+            lineWidth: 0,
         });
     }
     if (format === "json5" && options) {

package/dist/config/index.d.ts

@@ -1,5 +1,5 @@
-export type { MergeMode, MergeStrategy, BypassActor, StatusCheckConfig, CodeScanningTool, PullRequestRuleParameters, RulesetRule, Ruleset, GitHubRepoSettings, RepoVisibility, SquashMergeCommitTitle, SquashMergeCommitMessage, MergeCommitTitle, MergeCommitMessage, Label, CodeScanningSettings, CodeScanningState, CodeScanningQuerySuite, CodeScanningLanguage, RepoSettings, RawFileConfig, RawRepoFileOverride, RawGroupConfig, RawRepoSettings, RawRepoConfig, RawConfig, RawConditionalGroupWhen, RawConditionalGroupConfig, RepoConfig, Config, FileContent, ContentValue, } from "./types.js";
+export type { PRMergeOptions, MergeMode, MergeStrategy, BypassActor, StatusCheckConfig, CodeScanningTool, PullRequestRuleParameters, RulesetRule, Ruleset, GitHubRepoSettings, RepoVisibility, SquashMergeCommitTitle, SquashMergeCommitMessage, MergeCommitTitle, MergeCommitMessage, Label, CodeScanningSettings, CodeScanningState, CodeScanningQuerySuite, CodeScanningLanguage, RepoSettings, RawFileConfig, RawRepoFileOverride, RawGroupConfig, SecretConfig, RawRootSettings, RawRepoSettings, RawRepoConfig, RawConfig, RawConditionalGroupWhen, RawConditionalGroupConfig, RepoConfig, Config, FileContent, ContentValue, } from "./types.js";
 export { RULESET_COMPARABLE_FIELDS } from "./types.js";
 export { loadRawConfig, loadConfig, normalizeConfig } from "./loader.js";
 export { convertContentToString } from "./formatter.js";
-export { validateForSync } from "./validator.js";
+export { validateForSync, validateSecretsConfig } from "./validator.js";

package/dist/config/index.js

@@ -5,4 +5,4 @@ export { loadRawConfig, loadConfig, normalizeConfig } from "./loader.js";
 // Config formatting
 export { convertContentToString } from "./formatter.js";
 // Config validation
-export { validateForSync } from "./validator.js";
+export { validateForSync, validateSecretsConfig } from "./validator.js";

package/dist/config/loader.js

@@ -13,7 +13,13 @@ export { normalizeConfigInternal as normalizeConfig };
  * Use this when you need to perform command-specific validation before normalizing.
  */
 export function loadRawConfig(configPath) {
-    const stat = statSync(configPath);
+    let stat;
+    try {
+        stat = statSync(configPath);
+    }
+    catch (error) {
+        throw new ValidationError(`Failed to read config at ${configPath}: ${toErrorMessage(error)}`, { cause: error });
+    }
     if (stat.isDirectory()) {
         return loadRawConfigFromDirectory(configPath);
     }
@@ -24,7 +30,13 @@ export function loadConfig(configPath, env) {
     return normalizeConfigInternal(rawConfig, env);
 }
 function loadRawConfigFromFile(filePath) {
-    const content = readFileSync(filePath, "utf-8");
+    let content;
+    try {
+        content = readFileSync(filePath, "utf-8");
+    }
+    catch (error) {
+        throw new ValidationError(`Failed to read config file ${filePath}: ${toErrorMessage(error)}`, { cause: error });
+    }
     const configDir = dirname(filePath);
     let rawConfig;
     try {
@@ -32,7 +44,7 @@ function loadRawConfigFromFile(filePath) {
     }
     catch (error) {
         const message = toErrorMessage(error);
-        throw new ValidationError(`Failed to parse YAML config at ${filePath}: ${message}`);
+        throw new ValidationError(`Failed to parse YAML config at ${filePath}: ${message}`, { cause: error });
     }
     // Resolve file references before validation so content type checking works
     rawConfig = resolveFileReferencesInConfig(rawConfig, { configDir });
@@ -40,7 +52,13 @@ function loadRawConfigFromFile(filePath) {
     return rawConfig;
 }
 function loadRawConfigFromDirectory(dirPath) {
-    const entries = readdirSync(dirPath, { withFileTypes: true });
+    let entries;
+    try {
+        entries = readdirSync(dirPath, { withFileTypes: true });
+    }
+    catch (error) {
+        throw new ValidationError(`Failed to read config directory ${dirPath}: ${toErrorMessage(error)}`, { cause: error });
+    }
     const yamlFiles = entries
         .filter((entry) => entry.isFile() &&
         [".yaml", ".yml"].includes(extname(entry.name).toLowerCase()))
@@ -51,7 +69,13 @@ function loadRawConfigFromDirectory(dirPath) {
     }
     const fragments = yamlFiles.map((fileName) => {
         const filePath = join(dirPath, fileName);
-        const content = readFileSync(filePath, "utf-8");
+        let content;
+        try {
+            content = readFileSync(filePath, "utf-8");
+        }
+        catch (error) {
+            throw new ValidationError(`Failed to read config file ${filePath}: ${toErrorMessage(error)}`, { cause: error });
+        }
         const configDir = dirname(filePath);
         let config;
         try {
@@ -59,7 +83,7 @@ function loadRawConfigFromDirectory(dirPath) {
         }
         catch (error) {
             const message = toErrorMessage(error);
-            throw new ValidationError(`Failed to parse YAML config at ${filePath}: ${message}`);
+            throw new ValidationError(`Failed to parse YAML config at ${filePath}: ${message}`, { cause: error });
         }
         if (!config || typeof config !== "object") {
             throw new ValidationError(`Config file ${fileName} is empty or invalid — expected a YAML mapping`);

package/dist/config/merge.d.ts

@@ -2,7 +2,17 @@
  * Deep merge utilities for JSON configuration objects.
  * Supports per-field array merge strategies via $arrayMerge + $values directives.
  */
-export type ArrayMergeStrategy = "replace" | "append" | "prepend";
+/**
+ * Candidate keys for matching array items by identity rather than index.
+ * Order matters — first key found across all items wins.
+ */
+export declare const MATCH_KEY_CANDIDATES: readonly ["type", "actor_id"];
+/**
+ * Finds a key that uniquely identifies items in both arrays.
+ * Returns the first candidate key present in every item of both arrays, or undefined.
+ */
+export declare function findMatchKey(base: unknown[], overlay: unknown[]): string | undefined;
+export type ArrayMergeStrategy = "replace" | "append" | "prepend" | "merge";
 export interface MergeContext {
     defaultArrayStrategy: ArrayMergeStrategy;
 }

package/dist/config/merge.js

@@ -3,16 +3,87 @@
  * Supports per-field array merge strategies via $arrayMerge + $values directives.
  */
 import { isPlainObject } from "../shared/type-guards.js";
+/**
+ * Candidate keys for matching array items by identity rather than index.
+ * Order matters — first key found across all items wins.
+ */
+export const MATCH_KEY_CANDIDATES = ["type", "actor_id"];
+/**
+ * Finds a key that uniquely identifies items in both arrays.
+ * Returns the first candidate key present in every item of both arrays, or undefined.
+ */
+export function findMatchKey(base, overlay) {
+    if (base.length === 0 && overlay.length === 0)
+        return undefined;
+    const hasKey = (item, key) => isPlainObject(item) && key in item;
+    for (const candidate of MATCH_KEY_CANDIDATES) {
+        if (base.every((item) => hasKey(item, candidate)) &&
+            overlay.every((item) => hasKey(item, candidate))) {
+            return candidate;
+        }
+    }
+    return undefined;
+}
 /**
  * Keys reserved for xfg merge directives.
  * Only these are stripped during merge — standard $-prefixed keys
  * like $schema, $id, $ref, $generated are preserved.
  */
 const XFG_DIRECTIVES = new Set(["$arrayMerge", "$values"]);
+function mergeByKey(base, overlay, matchKey, ctx) {
+    const baseByKey = new Map();
+    // findMatchKey guarantees every item in both arrays is a plain object with matchKey
+    for (let i = 0; i < base.length; i++) {
+        const item = base[i];
+        const keyValue = item[matchKey];
+        if (keyValue !== undefined && !baseByKey.has(keyValue)) {
+            baseByKey.set(keyValue, { item, index: i });
+        }
+    }
+    const appended = [];
+    for (const overlayItem of overlay) {
+        const item = overlayItem;
+        const keyValue = item[matchKey];
+        const baseEntry = baseByKey.get(keyValue);
+        if (baseEntry) {
+            baseByKey.set(keyValue, {
+                item: deepMerge(baseEntry.item, item, ctx),
+                index: baseEntry.index,
+            });
+        }
+        else {
+            appended.push(overlayItem);
+        }
+    }
+    const result = [];
+    for (let i = 0; i < base.length; i++) {
+        const item = base[i];
+        const keyValue = item[matchKey];
+        const entry = baseByKey.get(keyValue);
+        if (entry && entry.index === i) {
+            result.push(entry.item);
+        }
+        else {
+            result.push(item);
+        }
+    }
+    result.push(...appended);
+    return result;
+}
 const arrayMergeStrategies = new Map([
     ["replace", (_base, overlay) => overlay],
     ["append", (base, overlay) => [...base, ...overlay]],
     ["prepend", (base, overlay) => [...overlay, ...base]],
+    [
+        "merge",
+        (base, overlay, ctx) => {
+            const matchKey = findMatchKey(base, overlay);
+            if (!matchKey) {
+                return [...base, ...overlay];
+            }
+            return mergeByKey(base, overlay, matchKey, ctx);
+        },
+    ],
 ]);
 /**
  * Checks if a value is an unresolved $arrayMerge directive object
@@ -28,12 +99,11 @@ function isUnresolvedDirective(value) {
         arrayMergeStrategies.has(value.$arrayMerge) &&
         Array.isArray(value.$values));
 }
-function mergeArrays(base, overlay, strategy) {
+function mergeArrays(base, overlay, strategy, ctx) {
     const handler = arrayMergeStrategies.get(strategy);
     if (handler) {
-        return handler(base, overlay);
+        return handler(base, overlay, ctx);
     }
-    // Fallback to replace for unknown strategies
     return overlay;
 }
 /**
@@ -61,16 +131,17 @@ export function deepMerge(base, overlay, ctx) {
             const values = overlayValue.$values;
             if ((strategy === "replace" ||
                 strategy === "append" ||
-                strategy === "prepend") &&
+                strategy === "prepend" ||
+                strategy === "merge") &&
                 Array.isArray(values) &&
                 Array.isArray(resolvedBase)) {
-                result[key] = mergeArrays(resolvedBase, values, strategy);
+                result[key] = mergeArrays(resolvedBase, values, strategy, ctx);
                 continue;
             }
         }
         // Both are arrays — use default strategy
         if (Array.isArray(resolvedBase) && Array.isArray(overlayValue)) {
-            result[key] = mergeArrays(resolvedBase, overlayValue, ctx.defaultArrayStrategy);
+            result[key] = mergeArrays(resolvedBase, overlayValue, ctx.defaultArrayStrategy, ctx);
             continue;
         }
         // Both are plain objects — recurse
@@ -144,6 +215,7 @@ export function mergeTextContent(base, overlay, strategy = "replace") {
     if (Array.isArray(base)) {
         switch (strategy) {
             case "append":
+            case "merge":
                 return [...base, ...overlay];
             case "prepend":
                 return [...overlay, ...base];

package/dist/config/normalizer.js

@@ -1,5 +1,5 @@
 import { deepMerge, stripMergeDirectives, createMergeContext, isTextContent, mergeTextContent, } from "./merge.js";
-import { interpolateContent } from "../shared/env.js";
+import { interpolateContent } from "./env.js";
 import { expandRepoGroups } from "./extends-resolver.js";
 /**
  * Clone content, stripping merge directives from object content.
@@ -79,22 +79,8 @@ function mergePROptions(global, perRepo) {
         return perRepo;
     if (!perRepo)
         return global;
-    const result = {};
-    const merge = perRepo.merge ?? global.merge;
-    const mergeStrategy = perRepo.mergeStrategy ?? global.mergeStrategy;
-    const deleteBranch = perRepo.deleteBranch ?? global.deleteBranch;
-    const bypassReason = perRepo.bypassReason ?? global.bypassReason;
-    const labels = perRepo.labels ?? global.labels;
-    if (merge !== undefined)
-        result.merge = merge;
-    if (mergeStrategy !== undefined)
-        result.mergeStrategy = mergeStrategy;
-    if (deleteBranch !== undefined)
-        result.deleteBranch = deleteBranch;
-    if (bypassReason !== undefined)
-        result.bypassReason = bypassReason;
-    if (labels !== undefined)
-        result.labels = labels;
+    const merged = { ...global, ...perRepo };
+    const result = Object.fromEntries(Object.entries(merged).filter(([, v]) => v !== undefined));
     return Object.keys(result).length > 0 ? result : undefined;
 }
 /**
@@ -141,6 +127,23 @@ function mergeLabels(rootLabels, repoLabels) {
     }
     return Object.keys(result).length > 0 ? result : undefined;
 }
+// GitHub treats variable names case-insensitively; overlay keys win over base keys with same name but different casing.
+function mergeVariablesCaseInsensitive(base, overlay) {
+    const overlayUpper = new Map();
+    for (const key of Object.keys(overlay)) {
+        overlayUpper.set(key.toUpperCase(), key);
+    }
+    const result = {};
+    for (const [key, value] of Object.entries(base)) {
+        if (!overlayUpper.has(key.toUpperCase())) {
+            result[key] = value;
+        }
+    }
+    for (const [key, value] of Object.entries(overlay)) {
+        result[key] = value;
+    }
+    return result;
+}
 /**
  * Merges settings: per-repo settings deep merge with root settings.
  * Returns undefined if no settings are defined.
@@ -179,7 +182,9 @@ export function mergeSettings(root, perRepo) {
         }
     }
     // deleteOrphaned: per-repo overrides root
-    const deleteOrphaned = perRepo?.deleteOrphaned ?? root?.deleteOrphaned;
+    const deleteOrphaned = perRepo?.deleteOrphaned !== undefined
+        ? perRepo.deleteOrphaned
+        : root?.deleteOrphaned;
     if (deleteOrphaned !== undefined) {
         result.deleteOrphaned = deleteOrphaned;
     }
@@ -223,6 +228,37 @@ export function mergeSettings(root, perRepo) {
             }
         }
     }
+    // Variables merging — deleteOrphaned is a peer key (like secrets' deleteOrphaned)
+    if (root?.variables || perRepo?.variables) {
+        const rootVars = root?.variables ?? {};
+        const repoVars = perRepo?.variables ?? {};
+        const rootDeleteOrphaned = rootVars
+            .deleteOrphaned;
+        const repoDeleteOrphaned = repoVars
+            .deleteOrphaned;
+        const effectiveDeleteOrphaned = repoDeleteOrphaned !== undefined
+            ? repoDeleteOrphaned
+            : rootDeleteOrphaned;
+        const inherit = repoVars.inherit;
+        if (inherit === false) {
+            const { inherit: _, deleteOrphaned: _d, ...rest } = repoVars;
+            result.variables = Object.fromEntries(Object.entries(rest).filter(([, v]) => v !== false));
+        }
+        else {
+            const combined = mergeVariablesCaseInsensitive(rootVars, repoVars);
+            const { inherit: _, deleteOrphaned: _d, ...rest } = combined;
+            result.variables = Object.fromEntries(Object.entries(rest).filter(([, v]) => v !== false));
+        }
+        if (effectiveDeleteOrphaned !== undefined) {
+            result.variables.deleteOrphaned =
+                effectiveDeleteOrphaned;
+        }
+        // Only delete if no variable entries remain (deleteOrphaned alone is not actionable)
+        const { deleteOrphaned: _check, ...varEntries } = result.variables;
+        if (Object.keys(varEntries).length === 0 && !effectiveDeleteOrphaned) {
+            delete result.variables;
+        }
+    }
     return Object.keys(result).length > 0 ? result : undefined;
 }
 /**
@@ -362,6 +398,40 @@ function mergeRawSettings(base, overlay) {
             result.codeScanning = structuredClone(overlay.codeScanning);
         }
     }
+    // Variables: simple string values with false opt-outs (mergeNamedEntries won't work for strings)
+    if (overlay.variables) {
+        const overlayVars = overlay.variables;
+        const inherit = overlayVars.inherit !== false;
+        const baseVars = inherit
+            ? { ...(result.variables ?? {}) }
+            : {};
+        // Build overlay entries (excluding meta keys)
+        const overlayEntries = {};
+        for (const [name, entry] of Object.entries(overlay.variables)) {
+            if (name === "inherit" || name === "deleteOrphaned")
+                continue;
+            overlayEntries[name] = entry;
+        }
+        // Case-insensitive merge: overlay keys replace base keys with same name
+        const merged = mergeVariablesCaseInsensitive(baseVars, overlayEntries);
+        // Apply false opt-outs
+        const cleaned = {};
+        for (const [name, value] of Object.entries(merged)) {
+            if (name === "inherit" || name === "deleteOrphaned")
+                continue;
+            if (value !== false) {
+                cleaned[name] = value;
+            }
+        }
+        const baseDelete = baseVars.deleteOrphaned;
+        const effectiveDelete = overlayVars.deleteOrphaned !== undefined
+            ? overlayVars.deleteOrphaned
+            : baseDelete;
+        if (effectiveDelete !== undefined) {
+            cleaned.deleteOrphaned = effectiveDelete;
+        }
+        result.variables = cleaned;
+    }
     // deleteOrphaned: overlay wins
     if (overlay.deleteOrphaned !== undefined) {
         result.deleteOrphaned = overlay.deleteOrphaned;
@@ -454,6 +524,35 @@ function resolveFileEntry(fileName, fileConfig, repoOverride, inheritFiles, glob
             globalDeleteOrphaned,
     };
 }
+function normalizeRepoEntry(ctx) {
+    const files = [];
+    const inheritFiles = shouldInherit(ctx.rawRepo.files);
+    for (const fileName of ctx.fileNames) {
+        if (fileName === "inherit")
+            continue;
+        const entry = resolveFileEntry(fileName, ctx.effectiveRootFiles[fileName], ctx.rawRepo.files?.[fileName], inheritFiles, ctx.globalDeleteOrphaned, ctx.env);
+        if (entry)
+            files.push(entry);
+    }
+    for (const fileName of ctx.repoOnlyFileNames) {
+        const repoOverride = ctx.rawRepo.files[fileName];
+        if (repoOverride === false)
+            continue;
+        const entry = resolveFileEntry(fileName, {}, repoOverride, true, ctx.globalDeleteOrphaned, ctx.env);
+        if (entry)
+            files.push(entry);
+    }
+    const prOptions = mergePROptions(ctx.effectivePROptions, ctx.rawRepo.prOptions);
+    const settings = mergeSettings(ctx.effectiveSettings, ctx.rawRepo.settings);
+    return {
+        git: ctx.gitUrl,
+        files,
+        prOptions,
+        settings,
+        upstream: ctx.rawRepo.upstream,
+        source: ctx.rawRepo.source,
+    };
+}
 /**
  * Normalizes raw config into expanded, merged config.
  * Pipeline: expand git arrays -> merge content -> interpolate env vars
@@ -497,37 +596,17 @@ export function normalizeConfig(raw, env) {
             }
         }
         for (const gitUrl of gitUrls) {
-            const files = [];
-            const inheritFiles = shouldInherit(rawRepo.files);
-            for (const fileName of fileNames) {
-                // Skip reserved key
-                if (fileName === "inherit")
-                    continue;
-                const entry = resolveFileEntry(fileName, effectiveRootFiles[fileName], rawRepo.files?.[fileName], inheritFiles, raw.deleteOrphaned, env);
-                if (entry)
-                    files.push(entry);
-            }
-            // Process repo-only files (standalone definitions not in root/groups)
-            for (const fileName of repoOnlyFileNames) {
-                const repoOverride = rawRepo.files[fileName];
-                if (repoOverride === false)
-                    continue;
-                const entry = resolveFileEntry(fileName, {}, repoOverride, true, raw.deleteOrphaned, env);
-                if (entry)
-                    files.push(entry);
-            }
-            // Merge PR options: per-repo overrides effective (root + groups)
-            const prOptions = mergePROptions(effectivePROptions, rawRepo.prOptions);
-            // Merge settings: per-repo deep merges with effective (root + groups)
-            const settings = mergeSettings(effectiveSettings, rawRepo.settings);
-            expandedRepos.push({
-                git: gitUrl,
-                files,
-                prOptions,
-                settings,
-                upstream: rawRepo.upstream,
-                source: rawRepo.source,
-            });
+            expandedRepos.push(normalizeRepoEntry({
+                gitUrl,
+                rawRepo,
+                effectiveRootFiles,
+                fileNames,
+                repoOnlyFileNames,
+                effectivePROptions,
+                effectiveSettings,
+                globalDeleteOrphaned: raw.deleteOrphaned,
+                env,
+            }));
         }
     }
     // Normalize root settings by reusing mergeSettings with no per-repo overlay.
@@ -542,5 +621,6 @@ export function normalizeConfig(raw, env) {
         githubHosts: raw.githubHosts,
         deleteOrphaned: raw.deleteOrphaned,
         settings: normalizedRootSettings,
+        secrets: raw.secrets,
     };
 }

package/dist/config/types.d.ts

@@ -267,6 +267,9 @@ export interface CodeScanningSettings {
     querySuite?: CodeScanningQuerySuite;
     languages?: CodeScanningLanguage[];
 }
+export interface SecretConfig {
+    env: string;
+}
 export interface RepoSettings {
     /** GitHub rulesets keyed by name */
     rulesets?: Record<string, Ruleset>;
@@ -276,6 +279,10 @@ export interface RepoSettings {
     labels?: Record<string, Label>;
     /** GitHub code scanning default setup */
     codeScanning?: CodeScanningSettings;
+    /** GitHub Actions variables keyed by name */
+    variables?: Record<string, string> & {
+        deleteOrphaned?: boolean;
+    };
     deleteOrphaned?: boolean;
 }
 export type ContentValue = Record<string, unknown> | string | string[];
@@ -336,6 +343,9 @@ export interface RawRootSettings {
     repo?: GitHubRepoSettings | false;
     labels?: Record<string, Label | false>;
     codeScanning?: CodeScanningSettings | false;
+    variables?: Record<string, string | false> & {
+        deleteOrphaned?: boolean;
+    };
     deleteOrphaned?: boolean;
 }
 export interface RawRepoSettings {
@@ -347,6 +357,10 @@ export interface RawRepoSettings {
         inherit?: boolean;
     };
     codeScanning?: CodeScanningSettings | false;
+    variables?: Record<string, string | false> & {
+        inherit?: boolean;
+        deleteOrphaned?: boolean;
+    };
     deleteOrphaned?: boolean;
 }
 export interface RawRepoConfig {
@@ -373,6 +387,9 @@ export interface RawConfig {
     githubHosts?: string[];
     deleteOrphaned?: boolean;
     settings?: RawRootSettings;
+    secrets?: Record<string, SecretConfig | boolean> & {
+        deleteOrphaned?: boolean;
+    };
 }
 export interface FileContent {
     fileName: string;
@@ -402,5 +419,8 @@ export interface Config {
     githubHosts?: string[];
     deleteOrphaned?: boolean;
     settings?: RepoSettings;
+    secrets?: Record<string, SecretConfig | boolean> & {
+        deleteOrphaned?: boolean;
+    };
 }
 export {};

package/dist/config/validator.d.ts

@@ -1,4 +1,4 @@
-import type { RawConfig, RawRepoSettings, RawRootSettings } from "./types.js";
+import type { RawConfig, RawRootSettings, RawRepoSettings } from "./types.js";
 /**
  * Validates raw config structure before normalization.
  * @throws ValidationError if validation fails
@@ -9,7 +9,8 @@ export declare function validateRawConfig(config: RawConfig): void;
  * @throws ValidationError if neither files nor settings are present
  */
 export declare function validateForSync(config: RawConfig): void;
-/**
- * Checks if settings contain actionable configuration.
- */
+export declare function validateVariableSecretOverlaps(config: RawConfig): void;
 export declare function hasActionableSettings(settings: RawRootSettings | RawRepoSettings | undefined): boolean;
+export declare function validateVariableName(name: string): void;
+export declare function validateSecretName(name: string): void;
+export declare function validateSecretsConfig(config: RawConfig): void;