@catladder/cli 0.0.0-next-6ea918c7 → 0.0.0-next-e3ccf7d4
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/bundles/catenv/index.js +33 -8
- package/dist/bundles/cli/index.js +114 -25
- package/dist/cli/src/apps/cli/commands/project/commandConfigSecrets.js +1 -1
- package/dist/cli/src/apps/cli/commands/project/commandConfigSecrets.js.map +1 -1
- package/dist/cli/src/commands/project/commandSecretsSyncGithub.d.ts +17 -3
- package/dist/cli/src/commands/project/commandSecretsSyncGithub.js +60 -11
- package/dist/cli/src/commands/project/commandSecretsSyncGithub.js.map +1 -1
- package/dist/cli/src/utils/github.d.ts +7 -2
- package/dist/cli/src/utils/github.js +21 -6
- package/dist/cli/src/utils/github.js.map +1 -1
- package/dist/pipeline/src/backends/github/createGithubJobs.js +32 -7
- package/dist/pipeline/src/backends/github/createGithubJobs.js.map +1 -1
- package/dist/pipeline/src/constants.js +1 -1
- package/dist/tsconfig.tsbuildinfo +1 -1
- package/package.json +1 -1
- package/src/apps/cli/commands/project/commandConfigSecrets.ts +7 -1
- package/src/commands/project/commandSecretsSyncGithub.ts +81 -9
- package/src/utils/github.ts +50 -5
|
@@ -2004,6 +2004,36 @@ const makeGithubJob = (context, job, allJobs, uploadProviderIds, images, scripts
|
|
|
2004
2004
|
...getReferencedSecretsEnv(runScript, secretKinds),
|
|
2005
2005
|
CL_JOB_IMAGE: image !== null && image !== void 0 ? image : "runner"
|
|
2006
2006
|
};
|
|
2007
|
+
/**
|
|
2008
|
+
* the github environment of the job — serving two purposes:
|
|
2009
|
+
* deployment tracking on deploy jobs, and access to environment
|
|
2010
|
+
* secrets (the repo-level cap of 100 secrets doesn't scale to
|
|
2011
|
+
* multiple envs). Names are keyed by env NAME, never env type: an
|
|
2012
|
+
* app can have several envs of the same type.
|
|
2013
|
+
*
|
|
2014
|
+
* - deploy jobs: `<env>-<component>` — static (unlike the former
|
|
2015
|
+
* per-PR review names), so environment secrets can attach, and
|
|
2016
|
+
* each component keeps its own deployment badge/url in the
|
|
2017
|
+
* github ui. For review, PRs share the component's environment:
|
|
2018
|
+
* a newer PR's deploy marks the previous one Inactive (the badge,
|
|
2019
|
+
* not the app) — the price of a static name.
|
|
2020
|
+
* - other jobs referencing secrets join the shared `<env>`
|
|
2021
|
+
* environment — deliberately NOT the per-component one, whose
|
|
2022
|
+
* Active deploy badge their deployment records would displace.
|
|
2023
|
+
* NOTE: build-time and deploy-time vars are not differentiated
|
|
2024
|
+
* yet, so this environment holds roughly ALL of the env's
|
|
2025
|
+
* secrets (the build's dotenv references every component).
|
|
2026
|
+
* - jobs without secret references get no environment
|
|
2027
|
+
*/
|
|
2028
|
+
const referencesSecrets = Object.values(env).some(value => typeof value === "string" && (value.includes("${{ secrets.") || value.includes("${{ vars.")));
|
|
2029
|
+
const githubEnvironment = job.environment && isComponent ? {
|
|
2030
|
+
name: `${context.env}-${context.name}`,
|
|
2031
|
+
...(createsJobEnv ? {
|
|
2032
|
+
url: "${{ steps.main.outputs.url }}"
|
|
2033
|
+
} : {})
|
|
2034
|
+
} : referencesSecrets ? {
|
|
2035
|
+
name: context.env
|
|
2036
|
+
} : undefined;
|
|
2007
2037
|
const githubJob = {
|
|
2008
2038
|
name: githubJobName(context, job.name),
|
|
2009
2039
|
"runs-on": "ubuntu-latest",
|
|
@@ -2025,13 +2055,8 @@ const makeGithubJob = (context, job, allJobs, uploadProviderIds, images, scripts
|
|
|
2025
2055
|
...(Object.keys(services).length > 0 ? {
|
|
2026
2056
|
services
|
|
2027
2057
|
} : {}),
|
|
2028
|
-
...(
|
|
2029
|
-
environment:
|
|
2030
|
-
name: context.environment.envType === "review" ? `review-pr\${{ github.event.number }}-${context.name}` : `${context.env}-${context.name}`,
|
|
2031
|
-
...(createsJobEnv ? {
|
|
2032
|
-
url: "${{ steps.main.outputs.url }}"
|
|
2033
|
-
} : {})
|
|
2034
|
-
}
|
|
2058
|
+
...(githubEnvironment ? {
|
|
2059
|
+
environment: githubEnvironment
|
|
2035
2060
|
} : {}),
|
|
2036
2061
|
env,
|
|
2037
2062
|
steps: [...(skipCheckout ? [] : [{
|
|
@@ -5224,7 +5249,7 @@ Object.defineProperty(exports, "__esModule", ({
|
|
|
5224
5249
|
value: true
|
|
5225
5250
|
}));
|
|
5226
5251
|
exports.DOCKER_REGISTRY = exports.PIPELINE_IMAGE_TAG = void 0;
|
|
5227
|
-
exports.PIPELINE_IMAGE_TAG = "next-
|
|
5252
|
+
exports.PIPELINE_IMAGE_TAG = "next-e3ccf7d4" || 0;
|
|
5228
5253
|
exports.DOCKER_REGISTRY = "git.panter.ch:5001/catladder/catladder" || 0;
|
|
5229
5254
|
|
|
5230
5255
|
/***/ }),
|
|
@@ -560,7 +560,7 @@ const mirrorSecretsToCiBackends = async (instance, config, envAndComponents, val
|
|
|
560
560
|
return;
|
|
561
561
|
}
|
|
562
562
|
instance.log(`mirroring ${secrets.length} secrets to github ('${repo}')...`);
|
|
563
|
-
await (0, commandSecretsSyncGithub_1.pushSecretsToGithub)(instance, repo, secrets);
|
|
563
|
+
await (0, commandSecretsSyncGithub_1.pushSecretsToGithub)(instance, repo, secrets, await (0, commandSecretsSyncGithub_1.collectSecretTargets)(config));
|
|
564
564
|
};
|
|
565
565
|
const projectConfigSecrets = async (io, envComponent) => {
|
|
566
566
|
if (!envComponent) {
|
|
@@ -3392,7 +3392,7 @@ exports.commandSecretsClearBackups = (0, defineCommand_1.defineCommand)({
|
|
|
3392
3392
|
Object.defineProperty(exports, "__esModule", ({
|
|
3393
3393
|
value: true
|
|
3394
3394
|
}));
|
|
3395
|
-
exports.commandSecretsSyncGithub = exports.getConfiguredGithubRepo = exports.pushSecretsToGithub = exports.collectSecretsFromVault = void 0;
|
|
3395
|
+
exports.commandSecretsSyncGithub = exports.getConfiguredGithubRepo = exports.pushSecretsToGithub = exports.collectSecretTargets = exports.collectSecretsFromVault = void 0;
|
|
3396
3396
|
const pipeline_1 = __nccwpck_require__(60241);
|
|
3397
3397
|
const getProjectConfig_1 = __nccwpck_require__(50001);
|
|
3398
3398
|
const defineCommand_1 = __nccwpck_require__(39489);
|
|
@@ -3437,22 +3437,71 @@ const collectSecretsFromVault = async (io, envFilter) => {
|
|
|
3437
3437
|
};
|
|
3438
3438
|
};
|
|
3439
3439
|
exports.collectSecretsFromVault = collectSecretsFromVault;
|
|
3440
|
+
/** marker for repo-level (environment-less) targets */
|
|
3441
|
+
const REPO_LEVEL = "";
|
|
3440
3442
|
/**
|
|
3441
|
-
*
|
|
3442
|
-
*
|
|
3443
|
+
* derives which github environment(s) each secret/variable must live in
|
|
3444
|
+
* by scanning the GENERATED workflows: a `${{ secrets.X }}` / `${{
|
|
3445
|
+
* vars.X }}` reference in a job's env targets that job's environment
|
|
3446
|
+
* (or the repo level when the job has none). Deriving from the real
|
|
3447
|
+
* output means the sync can never drift from what the workflows expect.
|
|
3448
|
+
*
|
|
3449
|
+
* Environment secrets are the answer to github's cap of 100 secrets
|
|
3450
|
+
* per REPO (a multi-env project easily exceeds it): the cap applies
|
|
3451
|
+
* per environment instead.
|
|
3452
|
+
*/
|
|
3453
|
+
const collectSecretTargets = async config => {
|
|
3454
|
+
var _a;
|
|
3455
|
+
const workflows = await new pipeline_1.GithubBackend().createWorkflows(config);
|
|
3456
|
+
const targets = new Map();
|
|
3457
|
+
for (const workflow of Object.values(workflows)) {
|
|
3458
|
+
for (const job of Object.values(workflow.jobs)) {
|
|
3459
|
+
const environment = typeof job.environment === "object" ? job.environment.name : job.environment;
|
|
3460
|
+
for (const value of Object.values((_a = job.env) !== null && _a !== void 0 ? _a : {})) {
|
|
3461
|
+
if (typeof value !== "string") continue;
|
|
3462
|
+
for (const match of value.matchAll(/\$\{\{\s*(?:secrets|vars)\.([A-Za-z0-9_]+)\s*\}\}/g)) {
|
|
3463
|
+
const name = match[1];
|
|
3464
|
+
if (!targets.has(name)) {
|
|
3465
|
+
targets.set(name, new Set());
|
|
3466
|
+
}
|
|
3467
|
+
targets.get(name).add(environment !== null && environment !== void 0 ? environment : REPO_LEVEL);
|
|
3468
|
+
}
|
|
3469
|
+
}
|
|
3470
|
+
}
|
|
3471
|
+
}
|
|
3472
|
+
return targets;
|
|
3473
|
+
};
|
|
3474
|
+
exports.collectSecretTargets = collectSecretTargets;
|
|
3475
|
+
/**
|
|
3476
|
+
* pushes vault values to github via the gh cli: sensitive ones as
|
|
3477
|
+
* secrets (masked), "variable"-kind ones as variables (plain) — each
|
|
3478
|
+
* into the environment(s) whose jobs reference them
|
|
3443
3479
|
*/
|
|
3444
|
-
const pushSecretsToGithub = async (io, repo, secrets) => {
|
|
3480
|
+
const pushSecretsToGithub = async (io, repo, secrets, targets) => {
|
|
3481
|
+
const environments = [...new Set([...targets.values()].flatMap(envs => [...envs].filter(env => env !== REPO_LEVEL)))];
|
|
3482
|
+
for (const environment of environments) {
|
|
3483
|
+
await (0, github_1.ensureGithubEnvironment)(repo, environment);
|
|
3484
|
+
io.log(`🌍 environment ${environment}`);
|
|
3485
|
+
}
|
|
3445
3486
|
for (const {
|
|
3446
3487
|
name,
|
|
3447
3488
|
value,
|
|
3448
3489
|
kind
|
|
3449
3490
|
} of secrets) {
|
|
3450
|
-
|
|
3451
|
-
|
|
3452
|
-
io.log(
|
|
3453
|
-
|
|
3454
|
-
|
|
3455
|
-
|
|
3491
|
+
const envs = targets.get(name);
|
|
3492
|
+
if (!envs) {
|
|
3493
|
+
io.log(`⏭️ ${name} (not referenced by any generated workflow)`);
|
|
3494
|
+
continue;
|
|
3495
|
+
}
|
|
3496
|
+
for (const environment of envs) {
|
|
3497
|
+
const suffix = environment === REPO_LEVEL ? "" : ` → ${environment}`;
|
|
3498
|
+
if (kind === "variable") {
|
|
3499
|
+
await (0, github_1.setGithubVariable)(repo, name, value, environment || undefined);
|
|
3500
|
+
io.log(`📖 ${name} (variable)${suffix}`);
|
|
3501
|
+
} else {
|
|
3502
|
+
await (0, github_1.setGithubSecret)(repo, name, value, environment || undefined);
|
|
3503
|
+
io.log(`✅ ${name}${suffix}`);
|
|
3504
|
+
}
|
|
3456
3505
|
}
|
|
3457
3506
|
}
|
|
3458
3507
|
};
|
|
@@ -3532,7 +3581,7 @@ exports.commandSecretsSyncGithub = (0, defineCommand_1.defineCommand)({
|
|
|
3532
3581
|
if (!confirmed) {
|
|
3533
3582
|
throw new Error("abort");
|
|
3534
3583
|
}
|
|
3535
|
-
await (0, exports.pushSecretsToGithub)(ctx, repo, secrets);
|
|
3584
|
+
await (0, exports.pushSecretsToGithub)(ctx, repo, secrets, await (0, exports.collectSecretTargets)(config));
|
|
3536
3585
|
ctx.log("");
|
|
3537
3586
|
ctx.log("done! 😻 the github pipeline can use them as ${{ secrets.<NAME> }}");
|
|
3538
3587
|
}
|
|
@@ -5729,7 +5778,7 @@ exports["default"] = async () => {
|
|
|
5729
5778
|
Object.defineProperty(exports, "__esModule", ({
|
|
5730
5779
|
value: true
|
|
5731
5780
|
}));
|
|
5732
|
-
exports.setGithubVariable = exports.setGithubSecret = exports.getGithubRepoFromRemote = exports.isGhAuthenticated = void 0;
|
|
5781
|
+
exports.ensureGithubEnvironment = exports.setGithubVariable = exports.setGithubSecret = exports.getGithubRepoFromRemote = exports.isGhAuthenticated = void 0;
|
|
5733
5782
|
const child_process_1 = __nccwpck_require__(35317);
|
|
5734
5783
|
const util_1 = __nccwpck_require__(39023);
|
|
5735
5784
|
const execFile = (0, util_1.promisify)(child_process_1.execFile);
|
|
@@ -5762,9 +5811,9 @@ const getGithubRepoFromRemote = async remoteName => {
|
|
|
5762
5811
|
}
|
|
5763
5812
|
};
|
|
5764
5813
|
exports.getGithubRepoFromRemote = getGithubRepoFromRemote;
|
|
5765
|
-
const ghSetViaStdin = (kind, repo, name, value) => new Promise((resolve, reject) => {
|
|
5814
|
+
const ghSetViaStdin = (kind, repo, name, value, environment) => new Promise((resolve, reject) => {
|
|
5766
5815
|
var _a, _b;
|
|
5767
|
-
const child = (0, child_process_1.spawn)("gh", [kind, "set", name, "--repo", repo], {
|
|
5816
|
+
const child = (0, child_process_1.spawn)("gh", [kind, "set", name, "--repo", repo, ...(environment ? ["--env", environment] : [])], {
|
|
5768
5817
|
stdio: ["pipe", "ignore", "pipe"]
|
|
5769
5818
|
});
|
|
5770
5819
|
let stderr = "";
|
|
@@ -5777,14 +5826,29 @@ const ghSetViaStdin = (kind, repo, name, value) => new Promise((resolve, reject)
|
|
|
5777
5826
|
* sets a github actions repository secret via the gh cli.
|
|
5778
5827
|
* The value is passed via stdin so it never shows up in a process list.
|
|
5779
5828
|
*/
|
|
5780
|
-
const setGithubSecret = async (repo, name, value) => ghSetViaStdin("secret", repo, name, value);
|
|
5829
|
+
const setGithubSecret = async (repo, name, value, environment) => ghSetViaStdin("secret", repo, name, value, environment);
|
|
5781
5830
|
exports.setGithubSecret = setGithubSecret;
|
|
5782
5831
|
/**
|
|
5783
5832
|
* sets a github actions repository variable (plain, unmasked) via the
|
|
5784
5833
|
* gh cli — for vault values classified as not sensitive
|
|
5785
5834
|
*/
|
|
5786
|
-
const setGithubVariable = async (repo, name, value) => ghSetViaStdin("variable", repo, name, value);
|
|
5835
|
+
const setGithubVariable = async (repo, name, value, environment) => ghSetViaStdin("variable", repo, name, value, environment);
|
|
5787
5836
|
exports.setGithubVariable = setGithubVariable;
|
|
5837
|
+
/**
|
|
5838
|
+
* creates the github environment when it does not exist (idempotent —
|
|
5839
|
+
* PUT with an empty body leaves existing settings untouched)
|
|
5840
|
+
*/
|
|
5841
|
+
const ensureGithubEnvironment = async (repo, environment) => new Promise((resolve, reject) => {
|
|
5842
|
+
var _a;
|
|
5843
|
+
const child = (0, child_process_1.spawn)("gh", ["api", "-X", "PUT", `repos/${repo}/environments/${encodeURIComponent(environment)}`], {
|
|
5844
|
+
stdio: ["ignore", "ignore", "pipe"]
|
|
5845
|
+
});
|
|
5846
|
+
let stderr = "";
|
|
5847
|
+
(_a = child.stderr) === null || _a === void 0 ? void 0 : _a.on("data", data => stderr += data);
|
|
5848
|
+
child.on("error", reject);
|
|
5849
|
+
child.on("close", code => code === 0 ? resolve() : reject(new Error(`creating github environment ${environment} failed: ${stderr.trim()}`)));
|
|
5850
|
+
});
|
|
5851
|
+
exports.ensureGithubEnvironment = ensureGithubEnvironment;
|
|
5788
5852
|
|
|
5789
5853
|
/***/ }),
|
|
5790
5854
|
|
|
@@ -7255,6 +7319,36 @@ const makeGithubJob = (context, job, allJobs, uploadProviderIds, images, scripts
|
|
|
7255
7319
|
...getReferencedSecretsEnv(runScript, secretKinds),
|
|
7256
7320
|
CL_JOB_IMAGE: image !== null && image !== void 0 ? image : "runner"
|
|
7257
7321
|
};
|
|
7322
|
+
/**
|
|
7323
|
+
* the github environment of the job — serving two purposes:
|
|
7324
|
+
* deployment tracking on deploy jobs, and access to environment
|
|
7325
|
+
* secrets (the repo-level cap of 100 secrets doesn't scale to
|
|
7326
|
+
* multiple envs). Names are keyed by env NAME, never env type: an
|
|
7327
|
+
* app can have several envs of the same type.
|
|
7328
|
+
*
|
|
7329
|
+
* - deploy jobs: `<env>-<component>` — static (unlike the former
|
|
7330
|
+
* per-PR review names), so environment secrets can attach, and
|
|
7331
|
+
* each component keeps its own deployment badge/url in the
|
|
7332
|
+
* github ui. For review, PRs share the component's environment:
|
|
7333
|
+
* a newer PR's deploy marks the previous one Inactive (the badge,
|
|
7334
|
+
* not the app) — the price of a static name.
|
|
7335
|
+
* - other jobs referencing secrets join the shared `<env>`
|
|
7336
|
+
* environment — deliberately NOT the per-component one, whose
|
|
7337
|
+
* Active deploy badge their deployment records would displace.
|
|
7338
|
+
* NOTE: build-time and deploy-time vars are not differentiated
|
|
7339
|
+
* yet, so this environment holds roughly ALL of the env's
|
|
7340
|
+
* secrets (the build's dotenv references every component).
|
|
7341
|
+
* - jobs without secret references get no environment
|
|
7342
|
+
*/
|
|
7343
|
+
const referencesSecrets = Object.values(env).some(value => typeof value === "string" && (value.includes("${{ secrets.") || value.includes("${{ vars.")));
|
|
7344
|
+
const githubEnvironment = job.environment && isComponent ? {
|
|
7345
|
+
name: `${context.env}-${context.name}`,
|
|
7346
|
+
...(createsJobEnv ? {
|
|
7347
|
+
url: "${{ steps.main.outputs.url }}"
|
|
7348
|
+
} : {})
|
|
7349
|
+
} : referencesSecrets ? {
|
|
7350
|
+
name: context.env
|
|
7351
|
+
} : undefined;
|
|
7258
7352
|
const githubJob = {
|
|
7259
7353
|
name: githubJobName(context, job.name),
|
|
7260
7354
|
"runs-on": "ubuntu-latest",
|
|
@@ -7276,13 +7370,8 @@ const makeGithubJob = (context, job, allJobs, uploadProviderIds, images, scripts
|
|
|
7276
7370
|
...(Object.keys(services).length > 0 ? {
|
|
7277
7371
|
services
|
|
7278
7372
|
} : {}),
|
|
7279
|
-
...(
|
|
7280
|
-
environment:
|
|
7281
|
-
name: context.environment.envType === "review" ? `review-pr\${{ github.event.number }}-${context.name}` : `${context.env}-${context.name}`,
|
|
7282
|
-
...(createsJobEnv ? {
|
|
7283
|
-
url: "${{ steps.main.outputs.url }}"
|
|
7284
|
-
} : {})
|
|
7285
|
-
}
|
|
7373
|
+
...(githubEnvironment ? {
|
|
7374
|
+
environment: githubEnvironment
|
|
7286
7375
|
} : {}),
|
|
7287
7376
|
env,
|
|
7288
7377
|
steps: [...(skipCheckout ? [] : [{
|
|
@@ -10475,7 +10564,7 @@ Object.defineProperty(exports, "__esModule", ({
|
|
|
10475
10564
|
value: true
|
|
10476
10565
|
}));
|
|
10477
10566
|
exports.DOCKER_REGISTRY = exports.PIPELINE_IMAGE_TAG = void 0;
|
|
10478
|
-
exports.PIPELINE_IMAGE_TAG = "next-
|
|
10567
|
+
exports.PIPELINE_IMAGE_TAG = "next-e3ccf7d4" || 0;
|
|
10479
10568
|
exports.DOCKER_REGISTRY = "git.panter.ch:5001/catladder/catladder" || 0;
|
|
10480
10569
|
|
|
10481
10570
|
/***/ }),
|
|
@@ -166,7 +166,7 @@ const mirrorSecretsToCiBackends = async (instance, config, envAndComponents, val
|
|
|
166
166
|
return;
|
|
167
167
|
}
|
|
168
168
|
instance.log(`mirroring ${secrets.length} secrets to github ('${repo}')...`);
|
|
169
|
-
await (0, commandSecretsSyncGithub_1.pushSecretsToGithub)(instance, repo, secrets);
|
|
169
|
+
await (0, commandSecretsSyncGithub_1.pushSecretsToGithub)(instance, repo, secrets, await (0, commandSecretsSyncGithub_1.collectSecretTargets)(config));
|
|
170
170
|
};
|
|
171
171
|
const projectConfigSecrets = async (io, envComponent) => {
|
|
172
172
|
if (!envComponent) {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"commandConfigSecrets.js","sourceRoot":"","sources":["../../../../../../../src/apps/cli/commands/project/commandConfigSecrets.ts"],"names":[],"mappings":";;;AAAA,kDAI6B;AAE7B,6CAA2C;AAC3C,yCAAuC;AAEvC,0EAQ6C;AAC7C,
|
|
1
|
+
{"version":3,"file":"commandConfigSecrets.js","sourceRoot":"","sources":["../../../../../../../src/apps/cli/commands/project/commandConfigSecrets.ts"],"names":[],"mappings":";;;AAAA,kDAI6B;AAE7B,6CAA2C;AAC3C,yCAAuC;AAEvC,0EAQ6C;AAC7C,oGAI+D;AAC/D,6DAA0D;AAC1D,qDAA6D;AAC7D,qDAA8D;AAC9D,uDAAkD;AAOlD,+FAA+F;AAC/F,MAAM,WAAW,GAAG,CAAC,CAAO,EAAE,EAAE,CAC9B,MAAM,CAAC,WAAW,CAChB,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,aAAa,EAAE,IAAI,CAAC,EAAE,EAAE;IAC9C,OAAO;QACL,aAAa;QACb,MAAM,CAAC,WAAW,CAChB,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC;YAC3C,GAAG;YACH,MAAM,CAAC,WAAW,CAChB,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE;gBAC3C,IAAI,CAAC;oBACH,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;gBAClC,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;gBACtB,CAAC;YACH,CAAC,CAAC,CACH;SACF,CAAC,CACH;KACF,CAAC;AACJ,CAAC,CAAC,CACH,CAAC;AAEJ,MAAM,8BAA8B,GAAG,KAAK,EAC1C,GAAW,EACX,aAAqB,EACrB,EAAE;IACF,MAAM,EAAE,gBAAgB,EAAE,WAAW,EAAE,GAAG,MAAM,IAAA,iCAAc,EAC5D,GAAG,EACH,aAAa,CACd,CAAC;IACF,OAAO;QACL,GAAG,WAAW,CAAC,KAAK,CAAC,gBAAgB;QACrC,GAAG,WAAW,CAAC,MAAM,CAAC,gBAAgB;QACtC,GAAG,gBAAgB;KACpB;SACE,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;SACxB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;AACvB,CAAC,CAAC;AACF,MAAM,gBAAgB,GAAG,KAAK,EAC5B,QAAY,EACZ,GAAW,EACX,aAAqB,EACrB,EAAE;IACF,MAAM,gBAAgB,GAAG,MAAM,8BAA8B,CAC3D,GAAG,EACH,aAAa,CACd,CAAC;IAEF,MAAM,aAAa,GAAG,MAAM,IAAA,qCAAkB,EAAC,QAAQ,EAAE,GAAG,EAAE,aAAa,CAAC,CAAC;IAC7E,MAAM,cAAc,GAAG,MAAM,IAAA,4CAAyB,EACpD,QAAQ,EACR,GAAG,EACH,aAAa,CACd,CAAC;IACF,MAAM,UAAU,GAAG;QACjB,GAAG,aAAa;QAChB,GAAG,cAAc;KAClB,CAAC;IACF,OAAO,MAAM,CAAC,WAAW,CACvB,gBAAgB,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;QAC3B,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;QAC9B,oHAAoH;QACpH,MAAM,gBAAgB,GACpB,KAAK,KAAK,GAAG,GAAG,IAAA,2BAAgB,EAAC,GAAG,EAAE,aAAa,EAAE,GAAG,CAAC,CAAC;QAC5D,OAAO,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACxD,CAAC,CAAC,CACH,CAAC;AACJ,CAAC,CAAC;AACF,MAAM,OAAO,GAAG,KAAK,EACnB,QAAY,EACZ,gBAEC,EACD,EAAE;IACF,IAAI,YAAY,GAAS,MAAM,CAAC,WAAW,CACzC,MAAM,OAAO,CAAC,GAAG,CACf,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,aAAa,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;QACpE,aAAa;QACb,MAAM,CAAC,WAAW,CAChB,MAAM,OAAO,CAAC,GAAG,CACf,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC;YACtB,GAAG;YACH,MAAM,gBAAgB,CAAC,QAAQ,EAAE,GAAG,EAAE,aAAa,CAAC;SACrD,CAAC,CACH,CACF;KACF,CAAC,CACH,CACF,CAAC;IACF,IAAI,SAAS,GAAG,IAAI,CAAC;IACrB,OAAO,SAAS,EAAE,CAAC;QACjB,YAAY,GAAG,MAAM,IAAA,uBAAU,EAC7B,WAAW,CAAC,YAAY,CAAC,EACzB,IAAA,0BAAY,EAAA;;;UAGR,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC;aAC/B,GAAG,CACF,CAAC,CAAC,aAAa,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,KAAK,aAAa,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACpE;aACA,IAAI,CAAC,IAAI,CAAC;;SAEZ,CACJ,CAAC;QACF,mBAAmB;QACnB,SAAS,GAAG,KAAK,CAAC;QAClB,KAAK,MAAM,CAAC,aAAa,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACrE,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,MAAM,QAAQ,GAAG,YAAY,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC;oBAC/C,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,CAAC;oBAC/C,CAAC,CAAC,EAAE,CAAC;gBACP,wDAAwD;gBACxD,MAAM,gBAAgB,GAAG,MAAM,8BAA8B,CAC3D,GAAG,EACH,aAAa,CACd,CAAC;gBAEF,MAAM,SAAS,GAAG,IAAA,sBAAU,EAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC;gBACzD,MAAM,OAAO,GAAG,IAAA,sBAAU,EAAC,gBAAgB,EAAE,QAAQ,CAAC,CAAC;gBAEvD,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAC/C,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;oBACjB,QAAQ,CAAC,GAAG,CACV,4CAA4C,aAAa,GAAG,CAC7D,CAAC;oBACF,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;oBACjB,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBACzB,QAAQ,CAAC,GAAG,CAAC,8CAA8C,CAAC,CAAC;wBAC7D,SAAS,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;wBAC9C,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;oBACnB,CAAC;oBACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBACvB,QAAQ,CAAC,GAAG,CAAC,uCAAuC,CAAC,CAAC;wBACtD,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;wBAC5C,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;oBACnB,CAAC;oBAED,MAAM,IAAA,eAAK,EAAC,IAAI,CAAC,CAAC;oBAClB,MAAM,cAAc,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;oBAE/D,IAAI,CAAC,cAAc,EAAE,CAAC;wBACpB,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;oBAC3B,CAAC;oBACD,SAAS,GAAG,IAAI,CAAC;gBACnB,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,IAAA,mCAAgB,GAAE,CAAC;IACxC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC/C,CAAC;IAED,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACjB,QAAQ,CAAC,GAAG,CAAC,kDAAkD,CAAC,CAAC;IACjE,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACjB,KAAK,MAAM,CAAC,aAAa,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACrE,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,QAAQ,CAAC,GAAG,CAAC,UAAU,GAAG,GAAG,GAAG,GAAG,GAAG,aAAa,GAAG,OAAO,CAAC,CAAC;YAC/D,MAAM,CACJ,MAAM,QAAQ,CAAC,eAAe,EAAE,CACjC,CAAC,YAAY,CAAC,GAAG,EAAE,aAAa,EAAE,YAAY,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACrE,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACjB,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,GAAG,GAAG,GAAG,aAAa,CAAC,CAAC;YAC/C,QAAQ,CAAC,GAAG,CAAC,oCAAoC,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;IAED,MAAM,yBAAyB,CAC7B,QAAQ,EACR,MAAM,EACN,gBAAgB,EAChB,YAAY,CACb,CAAC;IAEF,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACzB,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AACnB,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,yBAAyB,GAAG,KAAK,EACrC,QAAY,EACZ,MAAc,EACd,gBAAuD,EACvD,YAAkB,EAClB,EAAE;IACF,MAAM,OAAO,GAAG,IAAA,kCAAuB,EAAC,MAAM,CAAC,CAAC;IAEhD,+DAA+D;IAC/D,mBAAmB;IACnB,IAAI,IAAA,yBAAc,EAAC,MAAM,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3E,KAAK,MAAM,CAAC,aAAa,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACrE,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,MAAM,IAAA,2BAAkB,EACtB,QAAQ,EACR,YAAY,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,EAChC,GAAG,EACH,aAAa,CACd,CAAC;YACJ,CAAC;QACH,CAAC;QACD,QAAQ,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;IACvC,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChC,OAAO;IACT,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAiC,CAAC;IACvD,KAAK,MAAM,CAAC,aAAa,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACrE,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,EAAE,gBAAgB,EAAE,WAAW,EAAE,GAAG,MAAM,IAAA,iCAAc,EAC5D,GAAG,EACH,aAAa,CACd,CAAC;YACF;gBACE,GAAG,gBAAgB;gBACnB,GAAG,WAAW,CAAC,KAAK,CAAC,gBAAgB;gBACrC,GAAG,WAAW,CAAC,MAAM,CAAC,gBAAgB;aACvC,CAAC,OAAO,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,CAC1B,KAAK,CAAC,GAAG,CAAC,IAAA,2BAAgB,EAAC,GAAG,EAAE,aAAa,EAAE,GAAG,CAAC,EAAE,IAAI,aAAJ,IAAI,cAAJ,IAAI,GAAI,QAAQ,CAAC,CACvE,CAAC;QACJ,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,OAAO,CACtD,CAAC,CAAC,aAAa,EAAE,IAAI,CAAC,EAAE,EAAE,CACxB,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE;;QACnB,OAAA,MAAM,CAAC,OAAO,CAAC,MAAA,YAAY,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,mCAAI,EAAE,CAAC,CAAC,GAAG,CACxD,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE;;YACf,MAAM,IAAI,GAAG,IAAA,2BAAgB,EAAC,GAAG,EAAE,aAAa,EAAE,GAAG,CAAC,CAAC;YACvD,OAAO;gBACL,IAAI;gBACJ,KAAK,EACH,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,aAAL,KAAK,cAAL,KAAK,GAAI,EAAE,CAAC;gBACjE,IAAI,EAAE,MAAA,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,mCAAK,QAAkB;aAC7C,CAAC;QACJ,CAAC,CACF,CAAA;KAAA,CACF,CACJ,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO;IACT,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,IAAA,0BAAiB,GAAE,CAAC,EAAE,CAAC;QACjC,QAAQ,CAAC,GAAG,CACV,6IAA6I,CAC9I,CAAC;QACF,OAAO;IACT,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,IAAA,kDAAuB,GAAE,CAAC;IAC7C,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,QAAQ,CAAC,GAAG,CACV,mIAAmI,CACpI,CAAC;QACF,OAAO;IACT,CAAC;IACD,QAAQ,CAAC,GAAG,CAAC,aAAa,OAAO,CAAC,MAAM,wBAAwB,IAAI,OAAO,CAAC,CAAC;IAC7E,MAAM,IAAA,8CAAmB,EACvB,QAAQ,EACR,IAAI,EACJ,OAAO,EACP,MAAM,IAAA,+CAAoB,EAAC,MAAM,CAAC,CACnC,CAAC;AACJ,CAAC,CAAC;AAEK,MAAM,oBAAoB,GAAG,KAAK,EAAE,EAAM,EAAE,YAAqB,EAAE,EAAE;IAC1E,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,mBAAmB,GAAG,MAAM,IAAA,0DAAuC,GAAE,CAAC;QAC5E,MAAM,OAAO,CAAC,EAAE,EAAE,mBAAmB,CAAC,CAAC;IACzC,CAAC;SAAM,CAAC;QACN,MAAM,EAAE,GAAG,EAAE,aAAa,EAAE,GAAG,IAAA,8BAAW,EAAC,YAAY,CAAC,CAAC;QAEzD,wEAAwE;QACxE,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,UAAU,GAAG,MAAM,IAAA,uCAAoB,GAAE,CAAC;YAChD,MAAM,OAAO,CAAC,EAAE,EAAE,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3E,CAAC;QACD,IAAI,aAAa,EAAE,CAAC;YAClB,MAAM,OAAO,CAAC,EAAE,EAAE;gBAChB,CAAC,aAAa,CAAC,EAAE,CAAC,GAAG,CAAC;aACvB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC,CAAC;AAlBW,QAAA,oBAAoB,wBAkB/B"}
|
|
@@ -1,3 +1,4 @@
|
|
|
1
|
+
import type { Config } from "../../../../pipeline/src/index.js";
|
|
1
2
|
import type { IO } from "../../core/types";
|
|
2
3
|
/**
|
|
3
4
|
* all secrets declared in the config, with their values read from the
|
|
@@ -12,14 +13,27 @@ export declare const collectSecretsFromVault: (io: IO, envFilter?: string[]) =>
|
|
|
12
13
|
missing: string[];
|
|
13
14
|
}>;
|
|
14
15
|
/**
|
|
15
|
-
*
|
|
16
|
-
*
|
|
16
|
+
* derives which github environment(s) each secret/variable must live in
|
|
17
|
+
* by scanning the GENERATED workflows: a `${{ secrets.X }}` / `${{
|
|
18
|
+
* vars.X }}` reference in a job's env targets that job's environment
|
|
19
|
+
* (or the repo level when the job has none). Deriving from the real
|
|
20
|
+
* output means the sync can never drift from what the workflows expect.
|
|
21
|
+
*
|
|
22
|
+
* Environment secrets are the answer to github's cap of 100 secrets
|
|
23
|
+
* per REPO (a multi-env project easily exceeds it): the cap applies
|
|
24
|
+
* per environment instead.
|
|
25
|
+
*/
|
|
26
|
+
export declare const collectSecretTargets: (config: Config) => Promise<Map<string, Set<string>>>;
|
|
27
|
+
/**
|
|
28
|
+
* pushes vault values to github via the gh cli: sensitive ones as
|
|
29
|
+
* secrets (masked), "variable"-kind ones as variables (plain) — each
|
|
30
|
+
* into the environment(s) whose jobs reference them
|
|
17
31
|
*/
|
|
18
32
|
export declare const pushSecretsToGithub: (io: IO, repo: string, secrets: {
|
|
19
33
|
name: string;
|
|
20
34
|
value: string;
|
|
21
35
|
kind: "secret" | "variable";
|
|
22
|
-
}[]) => Promise<void>;
|
|
36
|
+
}[], targets: Map<string, Set<string>>) => Promise<void>;
|
|
23
37
|
/**
|
|
24
38
|
* resolves the github repository from the configured git remote
|
|
25
39
|
* (`pipelines.github.gitRemote`, defaults to origin)
|
|
@@ -3,7 +3,7 @@
|
|
|
3
3
|
Object.defineProperty(exports, "__esModule", {
|
|
4
4
|
value: true
|
|
5
5
|
});
|
|
6
|
-
exports.commandSecretsSyncGithub = exports.getConfiguredGithubRepo = exports.pushSecretsToGithub = exports.collectSecretsFromVault = void 0;
|
|
6
|
+
exports.commandSecretsSyncGithub = exports.getConfiguredGithubRepo = exports.pushSecretsToGithub = exports.collectSecretTargets = exports.collectSecretsFromVault = void 0;
|
|
7
7
|
const pipeline_1 = require("../../../../pipeline/src/index.js");
|
|
8
8
|
const getProjectConfig_1 = require("../../config/getProjectConfig");
|
|
9
9
|
const defineCommand_1 = require("../../core/defineCommand");
|
|
@@ -48,22 +48,71 @@ const collectSecretsFromVault = async (io, envFilter) => {
|
|
|
48
48
|
};
|
|
49
49
|
};
|
|
50
50
|
exports.collectSecretsFromVault = collectSecretsFromVault;
|
|
51
|
+
/** marker for repo-level (environment-less) targets */
|
|
52
|
+
const REPO_LEVEL = "";
|
|
51
53
|
/**
|
|
52
|
-
*
|
|
53
|
-
*
|
|
54
|
+
* derives which github environment(s) each secret/variable must live in
|
|
55
|
+
* by scanning the GENERATED workflows: a `${{ secrets.X }}` / `${{
|
|
56
|
+
* vars.X }}` reference in a job's env targets that job's environment
|
|
57
|
+
* (or the repo level when the job has none). Deriving from the real
|
|
58
|
+
* output means the sync can never drift from what the workflows expect.
|
|
59
|
+
*
|
|
60
|
+
* Environment secrets are the answer to github's cap of 100 secrets
|
|
61
|
+
* per REPO (a multi-env project easily exceeds it): the cap applies
|
|
62
|
+
* per environment instead.
|
|
54
63
|
*/
|
|
55
|
-
const
|
|
64
|
+
const collectSecretTargets = async config => {
|
|
65
|
+
var _a;
|
|
66
|
+
const workflows = await new pipeline_1.GithubBackend().createWorkflows(config);
|
|
67
|
+
const targets = new Map();
|
|
68
|
+
for (const workflow of Object.values(workflows)) {
|
|
69
|
+
for (const job of Object.values(workflow.jobs)) {
|
|
70
|
+
const environment = typeof job.environment === "object" ? job.environment.name : job.environment;
|
|
71
|
+
for (const value of Object.values((_a = job.env) !== null && _a !== void 0 ? _a : {})) {
|
|
72
|
+
if (typeof value !== "string") continue;
|
|
73
|
+
for (const match of value.matchAll(/\$\{\{\s*(?:secrets|vars)\.([A-Za-z0-9_]+)\s*\}\}/g)) {
|
|
74
|
+
const name = match[1];
|
|
75
|
+
if (!targets.has(name)) {
|
|
76
|
+
targets.set(name, new Set());
|
|
77
|
+
}
|
|
78
|
+
targets.get(name).add(environment !== null && environment !== void 0 ? environment : REPO_LEVEL);
|
|
79
|
+
}
|
|
80
|
+
}
|
|
81
|
+
}
|
|
82
|
+
}
|
|
83
|
+
return targets;
|
|
84
|
+
};
|
|
85
|
+
exports.collectSecretTargets = collectSecretTargets;
|
|
86
|
+
/**
|
|
87
|
+
* pushes vault values to github via the gh cli: sensitive ones as
|
|
88
|
+
* secrets (masked), "variable"-kind ones as variables (plain) — each
|
|
89
|
+
* into the environment(s) whose jobs reference them
|
|
90
|
+
*/
|
|
91
|
+
const pushSecretsToGithub = async (io, repo, secrets, targets) => {
|
|
92
|
+
const environments = [...new Set([...targets.values()].flatMap(envs => [...envs].filter(env => env !== REPO_LEVEL)))];
|
|
93
|
+
for (const environment of environments) {
|
|
94
|
+
await (0, github_1.ensureGithubEnvironment)(repo, environment);
|
|
95
|
+
io.log(`🌍 environment ${environment}`);
|
|
96
|
+
}
|
|
56
97
|
for (const {
|
|
57
98
|
name,
|
|
58
99
|
value,
|
|
59
100
|
kind
|
|
60
101
|
} of secrets) {
|
|
61
|
-
|
|
62
|
-
|
|
63
|
-
io.log(
|
|
64
|
-
|
|
65
|
-
|
|
66
|
-
|
|
102
|
+
const envs = targets.get(name);
|
|
103
|
+
if (!envs) {
|
|
104
|
+
io.log(`⏭️ ${name} (not referenced by any generated workflow)`);
|
|
105
|
+
continue;
|
|
106
|
+
}
|
|
107
|
+
for (const environment of envs) {
|
|
108
|
+
const suffix = environment === REPO_LEVEL ? "" : ` → ${environment}`;
|
|
109
|
+
if (kind === "variable") {
|
|
110
|
+
await (0, github_1.setGithubVariable)(repo, name, value, environment || undefined);
|
|
111
|
+
io.log(`📖 ${name} (variable)${suffix}`);
|
|
112
|
+
} else {
|
|
113
|
+
await (0, github_1.setGithubSecret)(repo, name, value, environment || undefined);
|
|
114
|
+
io.log(`✅ ${name}${suffix}`);
|
|
115
|
+
}
|
|
67
116
|
}
|
|
68
117
|
}
|
|
69
118
|
};
|
|
@@ -143,7 +192,7 @@ exports.commandSecretsSyncGithub = (0, defineCommand_1.defineCommand)({
|
|
|
143
192
|
if (!confirmed) {
|
|
144
193
|
throw new Error("abort");
|
|
145
194
|
}
|
|
146
|
-
await (0, exports.pushSecretsToGithub)(ctx, repo, secrets);
|
|
195
|
+
await (0, exports.pushSecretsToGithub)(ctx, repo, secrets, await (0, exports.collectSecretTargets)(config));
|
|
147
196
|
ctx.log("");
|
|
148
197
|
ctx.log("done! 😻 the github pipeline can use them as ${{ secrets.<NAME> }}");
|
|
149
198
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"commandSecretsSyncGithub.js","sourceRoot":"","sources":["../../../../../src/commands/project/commandSecretsSyncGithub.ts"],"names":[],"mappings":";;;
|
|
1
|
+
{"version":3,"file":"commandSecretsSyncGithub.js","sourceRoot":"","sources":["../../../../../src/commands/project/commandSecretsSyncGithub.ts"],"names":[],"mappings":";;;AACA,kDAK6B;AAC7B,oEAIuC;AACvC,4DAAyD;AAEzD,+CAM4B;AAE5B;;;GAGG;AACI,MAAM,uBAAuB,GAAG,KAAK,EAAE,EAAM,EAAE,SAAoB,EAAE,EAAE;IAC5E,MAAM,gBAAgB,GAAG,MAAM,IAAA,0DAAuC,GAAE,CAAC;IAEzE,MAAM,KAAK,GAAG,IAAI,GAAG,EAAiC,CAAC;IACvD,KAAK,MAAM,CAAC,aAAa,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACrE,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,SAAS,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC1C,SAAS;YACX,CAAC;YACD,MAAM,EAAE,gBAAgB,EAAE,WAAW,EAAE,GAAG,MAAM,IAAA,iCAAc,EAC5D,GAAG,EACH,aAAa,CACd,CAAC;YACF,MAAM,IAAI,GAAG;gBACX,GAAG,gBAAgB;gBACnB,GAAG,WAAW,CAAC,KAAK,CAAC,gBAAgB;gBACrC,GAAG,WAAW,CAAC,MAAM,CAAC,gBAAgB;aACvC,CAAC;YACF,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,CAC7B,KAAK,CAAC,GAAG,CAAC,IAAA,2BAAgB,EAAC,GAAG,EAAE,aAAa,EAAE,GAAG,CAAC,EAAE,IAAI,aAAJ,IAAI,cAAJ,IAAI,GAAI,QAAQ,CAAC,CACvE,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAG,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IAChC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,eAAe,EAAE,CAAC,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACzE,MAAM,OAAO,GAAG,KAAK;SAClB,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC;SAC5C,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;;QAAC,OAAA,CAAC;YACd,IAAI;YACJ,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC;YACnB,IAAI,EAAE,MAAA,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,mCAAK,QAAkB;SAC7C,CAAC,CAAA;KAAA,CAAC,CAAC;IACN,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC,CAAC;IACnE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAC9B,CAAC,CAAC;AAnCW,QAAA,uBAAuB,2BAmClC;AAEF,uDAAuD;AACvD,MAAM,UAAU,GAAG,EAAE,CAAC;AAEtB;;;;;;;;;;GAUG;AACI,MAAM,oBAAoB,GAAG,KAAK,EACvC,MAAc,EACqB,EAAE;;IACrC,MAAM,SAAS,GAAG,MAAM,IAAI,wBAAa,EAAE,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;IACpE,MAAM,OAAO,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC/C,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;QAChD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/C,MAAM,WAAW,GACf,OAAO,GAAG,CAAC,WAAW,KAAK,QAAQ;gBACjC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI;gBACtB,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC;YACtB,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,MAAA,GAAG,CAAC,GAAG,mCAAI,EAAE,CAAC,EAAE,CAAC;gBACjD,IAAI,OAAO,KAAK,KAAK,QAAQ;oBAAE,SAAS;gBACxC,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,QAAQ,CAChC,oDAAoD,CACrD,EAAE,CAAC;oBACF,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;oBACtB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;wBACvB,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC;oBAC/B,CAAC;oBACD,OAAO,CAAC,GAAG,CAAC,IAAI,CAAE,CAAC,GAAG,CAAC,WAAW,aAAX,WAAW,cAAX,WAAW,GAAI,UAAU,CAAC,CAAC;gBACpD,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC,CAAC;AA1BW,QAAA,oBAAoB,wBA0B/B;AAEF;;;;GAIG;AACI,MAAM,mBAAmB,GAAG,KAAK,EACtC,EAAM,EACN,IAAY,EACZ,OAAuE,EACvE,OAAiC,EACjC,EAAE;IACF,MAAM,YAAY,GAAG;QACnB,GAAG,IAAI,GAAG,CACR,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CACrC,CAAC,GAAG,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,UAAU,CAAC,CAC9C,CACF;KACF,CAAC;IACF,KAAK,MAAM,WAAW,IAAI,YAAY,EAAE,CAAC;QACvC,MAAM,IAAA,gCAAuB,EAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QACjD,EAAE,CAAC,GAAG,CAAC,kBAAkB,WAAW,EAAE,CAAC,CAAC;IAC1C,CAAC;IAED,KAAK,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,OAAO,EAAE,CAAC;QAC5C,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,EAAE,CAAC,GAAG,CAAC,MAAM,IAAI,6CAA6C,CAAC,CAAC;YAChE,SAAS;QACX,CAAC;QACD,KAAK,MAAM,WAAW,IAAI,IAAI,EAAE,CAAC;YAC/B,MAAM,MAAM,GAAG,WAAW,KAAK,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,WAAW,EAAE,CAAC;YACrE,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;gBACxB,MAAM,IAAA,0BAAiB,EAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,IAAI,SAAS,CAAC,CAAC;gBACrE,EAAE,CAAC,GAAG,CAAC,MAAM,IAAI,cAAc,MAAM,EAAE,CAAC,CAAC;YAC3C,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAA,wBAAe,EAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,IAAI,SAAS,CAAC,CAAC;gBACnE,EAAE,CAAC,GAAG,CAAC,KAAK,IAAI,GAAG,MAAM,EAAE,CAAC,CAAC;YAC/B,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC,CAAC;AAnCW,QAAA,mBAAmB,uBAmC9B;AAEF;;;GAGG;AACI,MAAM,uBAAuB,GAAG,KAAK,IAE1C,EAAE;IACF,MAAM,MAAM,GAAG,MAAM,IAAA,mCAAgB,GAAE,CAAC;IACxC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,IAAA,gCAAuB,EAAC,IAAA,+BAAoB,EAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;AACzE,CAAC,CAAC;AARW,QAAA,uBAAuB,2BAQlC;AAEF;;;;GAIG;AACU,QAAA,wBAAwB,GAAG,IAAA,6BAAa,EAAC;IACpD,IAAI,EAAE,6BAA6B;IACnC,WAAW,EACT,gGAAgG;IAClG,KAAK,EAAE,SAAS;IAChB,MAAM,EAAE;QACN,IAAI,EAAE;YACJ,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,gCAAgC;YACzC,UAAU,EAAE,IAAI;YAChB,QAAQ,EAAE,KAAK;SAChB;QACD,GAAG,EAAE;YACH,IAAI,EAAE,QAAQ;YACd,OAAO,EACL,0GAA0G;YAC5G,UAAU,EAAE,IAAI;YAChB,QAAQ,EAAE,KAAK;SAChB;KACF;IACD,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;;QACrB,MAAM,MAAM,GAAG,MAAM,IAAA,mCAAgB,GAAE,CAAC;QACxC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC/C,CAAC;QACD,MAAM,OAAO,GAAG,IAAA,kCAAuB,EAAC,MAAM,CAAC,CAAC;QAChD,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CACb,wEAAwE,CACzE,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,CAAC,MAAM,IAAA,0BAAiB,GAAE,CAAC,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CACb,uFAAuF,CACxF,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,MAAA,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,mCAAI,CAAC,MAAM,IAAA,+BAAuB,GAAE,CAAC,CAAC;QAC1E,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CACb,sCAAsC,IAAA,+BAAoB,EAAC,MAAM,EAAE,QAAQ,CAAC,0EAA0E,CACvJ,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAG,MAAA,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,0CAAE,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1E,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,MAAM,IAAA,+BAAuB,EAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAE3E,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,GAAG,CAAC,GAAG,CACL,MAAM,OAAO,CAAC,MAAM,wDAAwD,CAC7E,CAAC;YACF,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC;YAClD,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACd,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,GAAG,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;YACjC,OAAO;QACT,CAAC;QAED,GAAG,CAAC,GAAG,CAAC,gBAAgB,OAAO,CAAC,MAAM,gBAAgB,IAAI,IAAI,CAAC,CAAC;QAChE,OAAO,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC;QACtD,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACZ,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QACpD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;QAC3B,CAAC;QAED,MAAM,IAAA,2BAAmB,EACvB,GAAG,EACH,IAAI,EACJ,OAAO,EACP,MAAM,IAAA,4BAAoB,EAAC,MAAM,CAAC,CACnC,CAAC;QACF,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACZ,GAAG,CAAC,GAAG,CACL,oEAAoE,CACrE,CAAC;IACJ,CAAC;CACF,CAAC,CAAC"}
|
|
@@ -12,9 +12,14 @@ export declare const getGithubRepoFromRemote: (remoteName: string) => Promise<st
|
|
|
12
12
|
* sets a github actions repository secret via the gh cli.
|
|
13
13
|
* The value is passed via stdin so it never shows up in a process list.
|
|
14
14
|
*/
|
|
15
|
-
export declare const setGithubSecret: (repo: string, name: string, value: string) => Promise<void>;
|
|
15
|
+
export declare const setGithubSecret: (repo: string, name: string, value: string, environment?: string) => Promise<void>;
|
|
16
16
|
/**
|
|
17
17
|
* sets a github actions repository variable (plain, unmasked) via the
|
|
18
18
|
* gh cli — for vault values classified as not sensitive
|
|
19
19
|
*/
|
|
20
|
-
export declare const setGithubVariable: (repo: string, name: string, value: string) => Promise<void>;
|
|
20
|
+
export declare const setGithubVariable: (repo: string, name: string, value: string, environment?: string) => Promise<void>;
|
|
21
|
+
/**
|
|
22
|
+
* creates the github environment when it does not exist (idempotent —
|
|
23
|
+
* PUT with an empty body leaves existing settings untouched)
|
|
24
|
+
*/
|
|
25
|
+
export declare const ensureGithubEnvironment: (repo: string, environment: string) => Promise<void>;
|
|
@@ -3,7 +3,7 @@
|
|
|
3
3
|
Object.defineProperty(exports, "__esModule", {
|
|
4
4
|
value: true
|
|
5
5
|
});
|
|
6
|
-
exports.setGithubVariable = exports.setGithubSecret = exports.getGithubRepoFromRemote = exports.isGhAuthenticated = void 0;
|
|
6
|
+
exports.ensureGithubEnvironment = exports.setGithubVariable = exports.setGithubSecret = exports.getGithubRepoFromRemote = exports.isGhAuthenticated = void 0;
|
|
7
7
|
const child_process_1 = require("child_process");
|
|
8
8
|
const util_1 = require("util");
|
|
9
9
|
const execFile = (0, util_1.promisify)(child_process_1.execFile);
|
|
@@ -36,9 +36,9 @@ const getGithubRepoFromRemote = async remoteName => {
|
|
|
36
36
|
}
|
|
37
37
|
};
|
|
38
38
|
exports.getGithubRepoFromRemote = getGithubRepoFromRemote;
|
|
39
|
-
const ghSetViaStdin = (kind, repo, name, value) => new Promise((resolve, reject) => {
|
|
39
|
+
const ghSetViaStdin = (kind, repo, name, value, environment) => new Promise((resolve, reject) => {
|
|
40
40
|
var _a, _b;
|
|
41
|
-
const child = (0, child_process_1.spawn)("gh", [kind, "set", name, "--repo", repo], {
|
|
41
|
+
const child = (0, child_process_1.spawn)("gh", [kind, "set", name, "--repo", repo, ...(environment ? ["--env", environment] : [])], {
|
|
42
42
|
stdio: ["pipe", "ignore", "pipe"]
|
|
43
43
|
});
|
|
44
44
|
let stderr = "";
|
|
@@ -51,11 +51,26 @@ const ghSetViaStdin = (kind, repo, name, value) => new Promise((resolve, reject)
|
|
|
51
51
|
* sets a github actions repository secret via the gh cli.
|
|
52
52
|
* The value is passed via stdin so it never shows up in a process list.
|
|
53
53
|
*/
|
|
54
|
-
const setGithubSecret = async (repo, name, value) => ghSetViaStdin("secret", repo, name, value);
|
|
54
|
+
const setGithubSecret = async (repo, name, value, environment) => ghSetViaStdin("secret", repo, name, value, environment);
|
|
55
55
|
exports.setGithubSecret = setGithubSecret;
|
|
56
56
|
/**
|
|
57
57
|
* sets a github actions repository variable (plain, unmasked) via the
|
|
58
58
|
* gh cli — for vault values classified as not sensitive
|
|
59
59
|
*/
|
|
60
|
-
const setGithubVariable = async (repo, name, value) => ghSetViaStdin("variable", repo, name, value);
|
|
61
|
-
exports.setGithubVariable = setGithubVariable;
|
|
60
|
+
const setGithubVariable = async (repo, name, value, environment) => ghSetViaStdin("variable", repo, name, value, environment);
|
|
61
|
+
exports.setGithubVariable = setGithubVariable;
|
|
62
|
+
/**
|
|
63
|
+
* creates the github environment when it does not exist (idempotent —
|
|
64
|
+
* PUT with an empty body leaves existing settings untouched)
|
|
65
|
+
*/
|
|
66
|
+
const ensureGithubEnvironment = async (repo, environment) => new Promise((resolve, reject) => {
|
|
67
|
+
var _a;
|
|
68
|
+
const child = (0, child_process_1.spawn)("gh", ["api", "-X", "PUT", `repos/${repo}/environments/${encodeURIComponent(environment)}`], {
|
|
69
|
+
stdio: ["ignore", "ignore", "pipe"]
|
|
70
|
+
});
|
|
71
|
+
let stderr = "";
|
|
72
|
+
(_a = child.stderr) === null || _a === void 0 ? void 0 : _a.on("data", data => stderr += data);
|
|
73
|
+
child.on("error", reject);
|
|
74
|
+
child.on("close", code => code === 0 ? resolve() : reject(new Error(`creating github environment ${environment} failed: ${stderr.trim()}`)));
|
|
75
|
+
});
|
|
76
|
+
exports.ensureGithubEnvironment = ensureGithubEnvironment;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"github.js","sourceRoot":"","sources":["../../../../src/utils/github.ts"],"names":[],"mappings":";;;AAAA,iDAA8D;AAC9D,+BAAiC;AAEjC,MAAM,QAAQ,GAAG,IAAA,gBAAS,EAAC,wBAAU,CAAC,CAAC;AAEvC;;GAEG;AACI,MAAM,iBAAiB,GAAG,KAAK,IAAsB,EAAE;IAC5D,IAAI,CAAC;QACH,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;QACzC,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,WAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC,CAAC;AAPW,QAAA,iBAAiB,qBAO5B;AAEF;;;;GAIG;AACI,MAAM,uBAAuB,GAAG,KAAK,EAC1C,UAAkB,EACW,EAAE;IAC/B,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,QAAQ,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC;QAC5E,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CACxB,gDAAgD,CACjD,CAAC;QACF,OAAO,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAG,CAAC,CAAC,CAAC;IACpB,CAAC;IAAC,WAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC,CAAC;AAZW,QAAA,uBAAuB,2BAYlC;AAEF,MAAM,aAAa,GAAG,CACpB,IAA2B,EAC3B,IAAY,EACZ,IAAY,EACZ,KAAa,
|
|
1
|
+
{"version":3,"file":"github.js","sourceRoot":"","sources":["../../../../src/utils/github.ts"],"names":[],"mappings":";;;AAAA,iDAA8D;AAC9D,+BAAiC;AAEjC,MAAM,QAAQ,GAAG,IAAA,gBAAS,EAAC,wBAAU,CAAC,CAAC;AAEvC;;GAEG;AACI,MAAM,iBAAiB,GAAG,KAAK,IAAsB,EAAE;IAC5D,IAAI,CAAC;QACH,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;QACzC,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,WAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC,CAAC;AAPW,QAAA,iBAAiB,qBAO5B;AAEF;;;;GAIG;AACI,MAAM,uBAAuB,GAAG,KAAK,EAC1C,UAAkB,EACW,EAAE;IAC/B,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,QAAQ,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC;QAC5E,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CACxB,gDAAgD,CACjD,CAAC;QACF,OAAO,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAG,CAAC,CAAC,CAAC;IACpB,CAAC;IAAC,WAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC,CAAC;AAZW,QAAA,uBAAuB,2BAYlC;AAEF,MAAM,aAAa,GAAG,CACpB,IAA2B,EAC3B,IAAY,EACZ,IAAY,EACZ,KAAa,EACb,WAAoB,EACL,EAAE,CACjB,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;;IACpC,MAAM,KAAK,GAAG,IAAA,qBAAK,EACjB,IAAI,EACJ;QACE,IAAI;QACJ,KAAK;QACL,IAAI;QACJ,QAAQ;QACR,IAAI;QACJ,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/C,EACD,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,CACtC,CAAC;IACF,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,MAAA,KAAK,CAAC,MAAM,0CAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC;IACrD,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1B,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CACzB,IAAI,KAAK,CAAC;QACR,CAAC,CAAC,OAAO,EAAE;QACX,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,IAAI,QAAQ,IAAI,YAAY,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CACzE,CAAC;IACF,MAAA,KAAK,CAAC,KAAK,0CAAE,GAAG,CAAC,KAAK,CAAC,CAAC;AAC1B,CAAC,CAAC,CAAC;AAEL;;;GAGG;AACI,MAAM,eAAe,GAAG,KAAK,EAClC,IAAY,EACZ,IAAY,EACZ,KAAa,EACb,WAAoB,EACL,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;AAL/D,QAAA,eAAe,mBAKgD;AAE5E;;;GAGG;AACI,MAAM,iBAAiB,GAAG,KAAK,EACpC,IAAY,EACZ,IAAY,EACZ,KAAa,EACb,WAAoB,EACL,EAAE,CAAC,aAAa,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;AALjE,QAAA,iBAAiB,qBAKgD;AAE9E;;;GAGG;AACI,MAAM,uBAAuB,GAAG,KAAK,EAC1C,IAAY,EACZ,WAAmB,EACJ,EAAE,CACjB,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;;IACpC,MAAM,KAAK,GAAG,IAAA,qBAAK,EACjB,IAAI,EACJ;QACE,KAAK;QACL,IAAI;QACJ,KAAK;QACL,SAAS,IAAI,iBAAiB,kBAAkB,CAAC,WAAW,CAAC,EAAE;KAChE,EACD,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,CACxC,CAAC;IACF,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,MAAA,KAAK,CAAC,MAAM,0CAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC;IACrD,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1B,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CACzB,IAAI,KAAK,CAAC;QACR,CAAC,CAAC,OAAO,EAAE;QACX,CAAC,CAAC,MAAM,CACJ,IAAI,KAAK,CACP,+BAA+B,WAAW,YAAY,MAAM,CAAC,IAAI,EAAE,EAAE,CACtE,CACF,CACN,CAAC;AACJ,CAAC,CAAC,CAAC;AA3BQ,QAAA,uBAAuB,2BA2B/B"}
|
|
@@ -198,6 +198,36 @@ const makeGithubJob = (context, job, allJobs, uploadProviderIds, images, scripts
|
|
|
198
198
|
...getReferencedSecretsEnv(runScript, secretKinds),
|
|
199
199
|
CL_JOB_IMAGE: image !== null && image !== void 0 ? image : "runner"
|
|
200
200
|
};
|
|
201
|
+
/**
|
|
202
|
+
* the github environment of the job — serving two purposes:
|
|
203
|
+
* deployment tracking on deploy jobs, and access to environment
|
|
204
|
+
* secrets (the repo-level cap of 100 secrets doesn't scale to
|
|
205
|
+
* multiple envs). Names are keyed by env NAME, never env type: an
|
|
206
|
+
* app can have several envs of the same type.
|
|
207
|
+
*
|
|
208
|
+
* - deploy jobs: `<env>-<component>` — static (unlike the former
|
|
209
|
+
* per-PR review names), so environment secrets can attach, and
|
|
210
|
+
* each component keeps its own deployment badge/url in the
|
|
211
|
+
* github ui. For review, PRs share the component's environment:
|
|
212
|
+
* a newer PR's deploy marks the previous one Inactive (the badge,
|
|
213
|
+
* not the app) — the price of a static name.
|
|
214
|
+
* - other jobs referencing secrets join the shared `<env>`
|
|
215
|
+
* environment — deliberately NOT the per-component one, whose
|
|
216
|
+
* Active deploy badge their deployment records would displace.
|
|
217
|
+
* NOTE: build-time and deploy-time vars are not differentiated
|
|
218
|
+
* yet, so this environment holds roughly ALL of the env's
|
|
219
|
+
* secrets (the build's dotenv references every component).
|
|
220
|
+
* - jobs without secret references get no environment
|
|
221
|
+
*/
|
|
222
|
+
const referencesSecrets = Object.values(env).some(value => typeof value === "string" && (value.includes("${{ secrets.") || value.includes("${{ vars.")));
|
|
223
|
+
const githubEnvironment = job.environment && isComponent ? {
|
|
224
|
+
name: `${context.env}-${context.name}`,
|
|
225
|
+
...(createsJobEnv ? {
|
|
226
|
+
url: "${{ steps.main.outputs.url }}"
|
|
227
|
+
} : {})
|
|
228
|
+
} : referencesSecrets ? {
|
|
229
|
+
name: context.env
|
|
230
|
+
} : undefined;
|
|
201
231
|
const githubJob = {
|
|
202
232
|
name: githubJobName(context, job.name),
|
|
203
233
|
"runs-on": "ubuntu-latest",
|
|
@@ -219,13 +249,8 @@ const makeGithubJob = (context, job, allJobs, uploadProviderIds, images, scripts
|
|
|
219
249
|
...(Object.keys(services).length > 0 ? {
|
|
220
250
|
services
|
|
221
251
|
} : {}),
|
|
222
|
-
...(
|
|
223
|
-
environment:
|
|
224
|
-
name: context.environment.envType === "review" ? `review-pr\${{ github.event.number }}-${context.name}` : `${context.env}-${context.name}`,
|
|
225
|
-
...(createsJobEnv ? {
|
|
226
|
-
url: "${{ steps.main.outputs.url }}"
|
|
227
|
-
} : {})
|
|
228
|
-
}
|
|
252
|
+
...(githubEnvironment ? {
|
|
253
|
+
environment: githubEnvironment
|
|
229
254
|
} : {}),
|
|
230
255
|
env,
|
|
231
256
|
steps: [...(skipCheckout ? [] : [{
|