@catladder/cli 0.0.0-next-6ea918c7 → 0.0.0-next-e3ccf7d4

package/package.json

@@ -53,7 +53,7 @@
     }
   ],
   "license": "MIT",
-  "version": "0.0.0-next-6ea918c7",
+  "version": "0.0.0-next-e3ccf7d4",
   "scripts": {
     "lint": "eslint \"src/**/*.ts\"",
     "lint:fix": "eslint \"src/**/*.ts\" --fix",

package/src/apps/cli/commands/project/commandConfigSecrets.ts

@@ -17,6 +17,7 @@ import {
   parseChoice,
 } from "../../../../config/getProjectConfig";
 import {
+  collectSecretTargets,
   getConfiguredGithubRepo,
   pushSecretsToGithub,
 } from "../../../../commands/project/commandSecretsSyncGithub";
@@ -292,7 +293,12 @@ const mirrorSecretsToCiBackends = async (
     return;
   }
   instance.log(`mirroring ${secrets.length} secrets to github ('${repo}')...`);
-  await pushSecretsToGithub(instance, repo, secrets);
+  await pushSecretsToGithub(
+    instance,
+    repo,
+    secrets,
+    await collectSecretTargets(config),
+  );
 };
 
 export const projectConfigSecrets = async (io: IO, envComponent?: string) => {

package/src/commands/project/commandSecretsSyncGithub.ts

@@ -1,7 +1,9 @@
+import type { Config } from "@catladder/pipeline";
 import {
   getEnabledPipelineTypes,
   getPipelineGitRemote,
   getSecretVarName,
+  GithubBackend,
 } from "@catladder/pipeline";
 import {
   getAllComponentsWithAllEnvsHierarchical,
@@ -11,6 +13,7 @@ import {
 import { defineCommand } from "../../core/defineCommand";
 import type { IO } from "../../core/types";
 import {
+  ensureGithubEnvironment,
   getGithubRepoFromRemote,
   isGhAuthenticated,
   setGithubSecret,
@@ -58,22 +61,86 @@ export const collectSecretsFromVault = async (io: IO, envFilter?: string[]) => {
   return { secrets, missing };
 };
 
+/** marker for repo-level (environment-less) targets */
+const REPO_LEVEL = "";
+
 /**
- * pushes vault values to github via the gh cli: sensitive ones as repo
- * secrets (masked), "variable"-kind ones as repo variables (plain)
+ * derives which github environment(s) each secret/variable must live in
+ * by scanning the GENERATED workflows: a `${{ secrets.X }}` / `${{
+ * vars.X }}` reference in a job's env targets that job's environment
+ * (or the repo level when the job has none). Deriving from the real
+ * output means the sync can never drift from what the workflows expect.
+ *
+ * Environment secrets are the answer to github's cap of 100 secrets
+ * per REPO (a multi-env project easily exceeds it): the cap applies
+ * per environment instead.
+ */
+export const collectSecretTargets = async (
+  config: Config,
+): Promise<Map<string, Set<string>>> => {
+  const workflows = await new GithubBackend().createWorkflows(config);
+  const targets = new Map<string, Set<string>>();
+  for (const workflow of Object.values(workflows)) {
+    for (const job of Object.values(workflow.jobs)) {
+      const environment =
+        typeof job.environment === "object"
+          ? job.environment.name
+          : job.environment;
+      for (const value of Object.values(job.env ?? {})) {
+        if (typeof value !== "string") continue;
+        for (const match of value.matchAll(
+          /\$\{\{\s*(?:secrets|vars)\.([A-Za-z0-9_]+)\s*\}\}/g,
+        )) {
+          const name = match[1];
+          if (!targets.has(name)) {
+            targets.set(name, new Set());
+          }
+          targets.get(name)!.add(environment ?? REPO_LEVEL);
+        }
+      }
+    }
+  }
+  return targets;
+};
+
+/**
+ * pushes vault values to github via the gh cli: sensitive ones as
+ * secrets (masked), "variable"-kind ones as variables (plain) — each
+ * into the environment(s) whose jobs reference them
  */
 export const pushSecretsToGithub = async (
   io: IO,
   repo: string,
   secrets: { name: string; value: string; kind: "secret" | "variable" }[],
+  targets: Map<string, Set<string>>,
 ) => {
+  const environments = [
+    ...new Set(
+      [...targets.values()].flatMap((envs) =>
+        [...envs].filter((env) => env !== REPO_LEVEL),
+      ),
+    ),
+  ];
+  for (const environment of environments) {
+    await ensureGithubEnvironment(repo, environment);
+    io.log(`🌍 environment ${environment}`);
+  }
+
   for (const { name, value, kind } of secrets) {
-    if (kind === "variable") {
-      await setGithubVariable(repo, name, value);
-      io.log(`📖 ${name} (variable)`);
-    } else {
-      await setGithubSecret(repo, name, value);
-      io.log(`✅ ${name}`);
+    const envs = targets.get(name);
+    if (!envs) {
+      io.log(`⏭️ ${name} (not referenced by any generated workflow)`);
+      continue;
+    }
+    for (const environment of envs) {
+      const suffix = environment === REPO_LEVEL ? "" : ` → ${environment}`;
+      if (kind === "variable") {
+        await setGithubVariable(repo, name, value, environment || undefined);
+        io.log(`📖 ${name} (variable)${suffix}`);
+      } else {
+        await setGithubSecret(repo, name, value, environment || undefined);
+        io.log(`✅ ${name}${suffix}`);
+      }
     }
   }
 };
@@ -163,7 +230,12 @@ export const commandSecretsSyncGithub = defineCommand({
       throw new Error("abort");
     }
 
-    await pushSecretsToGithub(ctx, repo, secrets);
+    await pushSecretsToGithub(
+      ctx,
+      repo,
+      secrets,
+      await collectSecretTargets(config),
+    );
     ctx.log("");
     ctx.log(
       "done! 😻 the github pipeline can use them as ${{ secrets.<NAME> }}",

package/src/utils/github.ts

@@ -39,11 +39,21 @@ const ghSetViaStdin = (
   repo: string,
   name: string,
   value: string,
+  environment?: string,
 ): Promise<void> =>
   new Promise<void>((resolve, reject) => {
-    const child = spawn("gh", [kind, "set", name, "--repo", repo], {
-      stdio: ["pipe", "ignore", "pipe"],
-    });
+    const child = spawn(
+      "gh",
+      [
+        kind,
+        "set",
+        name,
+        "--repo",
+        repo,
+        ...(environment ? ["--env", environment] : []),
+      ],
+      { stdio: ["pipe", "ignore", "pipe"] },
+    );
     let stderr = "";
     child.stderr?.on("data", (data) => (stderr += data));
     child.on("error", reject);
@@ -63,7 +73,8 @@ export const setGithubSecret = async (
   repo: string,
   name: string,
   value: string,
-): Promise<void> => ghSetViaStdin("secret", repo, name, value);
+  environment?: string,
+): Promise<void> => ghSetViaStdin("secret", repo, name, value, environment);
 
 /**
  * sets a github actions repository variable (plain, unmasked) via the
@@ -73,4 +84,38 @@ export const setGithubVariable = async (
   repo: string,
   name: string,
   value: string,
-): Promise<void> => ghSetViaStdin("variable", repo, name, value);
+  environment?: string,
+): Promise<void> => ghSetViaStdin("variable", repo, name, value, environment);
+
+/**
+ * creates the github environment when it does not exist (idempotent —
+ * PUT with an empty body leaves existing settings untouched)
+ */
+export const ensureGithubEnvironment = async (
+  repo: string,
+  environment: string,
+): Promise<void> =>
+  new Promise<void>((resolve, reject) => {
+    const child = spawn(
+      "gh",
+      [
+        "api",
+        "-X",
+        "PUT",
+        `repos/${repo}/environments/${encodeURIComponent(environment)}`,
+      ],
+      { stdio: ["ignore", "ignore", "pipe"] },
+    );
+    let stderr = "";
+    child.stderr?.on("data", (data) => (stderr += data));
+    child.on("error", reject);
+    child.on("close", (code) =>
+      code === 0
+        ? resolve()
+        : reject(
+            new Error(
+              `creating github environment ${environment} failed: ${stderr.trim()}`,
+            ),
+          ),
+    );
+  });