@catladder/cli 0.0.0-next-e9e5af68 → 0.0.0-next-1c65899f

package/src/commands/project/secrets/document.ts

@@ -0,0 +1,269 @@
+import type { Config } from "@catladder/pipeline";
+import {
+  getEnabledPipelineTypes,
+  getSecretVarName,
+  getVaultConfig,
+} from "@catladder/pipeline";
+import {
+  getEnvironment,
+  getProjectConfig,
+} from "../../../config/getProjectConfig";
+import type { IO } from "../../../core/types";
+import { isGhAuthenticated } from "../../../utils/github";
+import { upsertAllVariables } from "../../../utils/gitlab";
+import {
+  collectSecretTargets,
+  getConfiguredGithubRepo,
+  pushSecretsToGithub,
+} from "../commandSecretsSyncGithub";
+import type { ScopedSecretKeys } from "./scope";
+
+/** placeholder for secrets that have no value in the vault yet */
+export const FILL_ME = "🚨 FILL ME";
+
+/**
+ * component → env → key → value: the document shape shared by the
+ * editor, `secrets-pull` and `secrets-push`
+ */
+export type SecretsDocument = {
+  [componentName: string]: {
+    [env: string]: Record<string, unknown>;
+  };
+};
+
+/** secrets of one env of one component, ready to be written */
+export type SecretsWrite = {
+  env: string;
+  componentName: string;
+  secrets: Record<string, unknown>;
+};
+
+/* for convenience, parse json values. that makes it easier to edit secrets that are objects */
+const parseJsonValue = (value: string): unknown => {
+  try {
+    return JSON.parse(value);
+  } catch (e) {
+    return value;
+  }
+};
+
+/**
+ * builds the document for the given scope with the current values from
+ * the vault; unset secrets appear as the FILL_ME placeholder
+ */
+export const buildSecretsDocument = async (
+  io: IO,
+  scoped: ScopedSecretKeys,
+): Promise<SecretsDocument> => {
+  const names = scoped.flatMap(({ env, componentName, keys }) =>
+    keys.map((key) => getSecretVarName(env, componentName, key)),
+  );
+  const values = await (await io.getVaultManager()).readSecrets(names, io);
+
+  const document: SecretsDocument = {};
+  for (const { env, componentName, keys } of scoped) {
+    document[componentName] ??= {};
+    document[componentName][env] = Object.fromEntries(
+      keys.map((key) => {
+        const value = values[getSecretVarName(env, componentName, key)];
+        return [key, value === undefined ? FILL_ME : parseJsonValue(value)];
+      }),
+    );
+  }
+  return document;
+};
+
+/**
+ * validates a document against the scope. Undeclared components, envs
+ * or keys are always problems; missing keys only when `requireComplete`
+ * (the guided editor flow) — pushes may be partial.
+ */
+export const checkSecretsDocument = (
+  document: SecretsDocument,
+  scoped: ScopedSecretKeys,
+  { requireComplete }: { requireComplete: boolean },
+): string[] => {
+  const problems: string[] = [];
+
+  const scopedKeys = new Map<string, string[]>();
+  scoped.forEach(({ env, componentName, keys }) =>
+    scopedKeys.set(`${env}:${componentName}`, keys),
+  );
+  const scopedComponents = new Set(scoped.map((s) => s.componentName));
+
+  for (const [componentName, envs] of Object.entries(document ?? {})) {
+    if (!scopedComponents.has(componentName)) {
+      problems.push(
+        `"${componentName}" is not a component in this scope — remove it or widen the scope`,
+      );
+      continue;
+    }
+    for (const [env, secrets] of Object.entries(envs ?? {})) {
+      const keys = scopedKeys.get(`${env}:${componentName}`);
+      if (!keys) {
+        problems.push(
+          `"${env}:${componentName}" is not in this scope — remove it or widen the scope`,
+        );
+        continue;
+      }
+      const extraneous = Object.keys(secrets ?? {}).filter(
+        (key) => !keys.includes(key),
+      );
+      extraneous.forEach((key) =>
+        problems.push(
+          `"${env}:${componentName}": "${key}" is not declared in the config (or filtered out by --key)`,
+        ),
+      );
+    }
+  }
+
+  if (requireComplete) {
+    for (const { env, componentName, keys } of scoped) {
+      const provided = Object.keys(document?.[componentName]?.[env] ?? {});
+      keys
+        .filter((key) => !provided.includes(key))
+        .forEach((key) =>
+          problems.push(
+            `"${env}:${componentName}": "${key}" has not been provided`,
+          ),
+        );
+    }
+  }
+
+  return problems;
+};
+
+/**
+ * turns a (validated) document into writes. FILL_ME placeholders and
+ * empty (null) values are skipped, so an untouched placeholder can
+ * never end up as a live secret value.
+ */
+export const collectSecretsWrites = (
+  document: SecretsDocument,
+  scoped: ScopedSecretKeys,
+): { writes: SecretsWrite[]; skipped: string[] } => {
+  const writes: SecretsWrite[] = [];
+  const skipped: string[] = [];
+  for (const { env, componentName, keys } of scoped) {
+    const provided = document?.[componentName]?.[env] ?? {};
+    const secrets: Record<string, unknown> = {};
+    for (const key of keys) {
+      if (!(key in provided)) {
+        continue;
+      }
+      const value = provided[key];
+      if (value === FILL_ME || value === null || value === undefined) {
+        skipped.push(`${env}:${componentName} ${key}`);
+        continue;
+      }
+      secrets[key] = value;
+    }
+    if (Object.keys(secrets).length > 0) {
+      writes.push({ env, componentName, secrets });
+    }
+  }
+  return { writes, skipped };
+};
+
+/**
+ * writes secrets to the vault (the source of truth) and mirrors them
+ * to every enabled CI backend — which backends exist is invisible to
+ * the caller
+ */
+export const writeSecretsAndMirror = async (
+  io: IO,
+  writes: SecretsWrite[],
+): Promise<void> => {
+  const config = await getProjectConfig();
+  if (!config) {
+    throw new Error("no catladder config found");
+  }
+
+  io.log("");
+  io.log("writing secrets to the vault, please wait...");
+  io.log("");
+  for (const { env, componentName, secrets } of writes) {
+    io.log("writing " + env + ":" + componentName + "...\n");
+    await (
+      await io.getVaultManager()
+    ).writeSecrets(env, componentName, secrets);
+    io.log("");
+    io.log("✅ " + env + ":" + componentName);
+    io.log("--------------------------------\n");
+  }
+
+  await mirrorSecretsToCiBackends(io, config, writes);
+};
+
+/**
+ * the vault is the source of truth; every enabled CI backend receives
+ * a mirrored copy of the written secrets (gitlab variables, github
+ * secrets), so all CI systems stay in sync
+ */
+const mirrorSecretsToCiBackends = async (
+  io: IO,
+  config: Config,
+  writes: SecretsWrite[],
+) => {
+  const enabled = getEnabledPipelineTypes(config);
+
+  // gitlab mirror (unless gitlab is the vault itself, then it is
+  // already written)
+  if (getVaultConfig(config).type !== "gitlab" && enabled.includes("gitlab")) {
+    for (const { env, componentName, secrets } of writes) {
+      await upsertAllVariables(io, secrets, env, componentName);
+    }
+    io.log("✅ mirrored to gitlab");
+  }
+
+  if (!enabled.includes("github")) {
+    return;
+  }
+  const kinds = new Map<string, "secret" | "variable">();
+  for (const { env, componentName } of writes) {
+    const { secretEnvVarKeys, jobOnlyVars } = await getEnvironment(
+      env,
+      componentName,
+    );
+    [
+      ...secretEnvVarKeys,
+      ...jobOnlyVars.build.secretEnvVarKeys,
+      ...jobOnlyVars.deploy.secretEnvVarKeys,
+    ].forEach(({ key, kind }) =>
+      kinds.set(getSecretVarName(env, componentName, key), kind ?? "secret"),
+    );
+  }
+  const secrets = writes.flatMap(({ env, componentName, secrets }) =>
+    Object.entries(secrets).map(([key, value]) => {
+      const name = getSecretVarName(env, componentName, key);
+      return {
+        name,
+        value: typeof value === "string" ? value : JSON.stringify(value ?? ""),
+        kind: kinds.get(name) ?? ("secret" as const),
+      };
+    }),
+  );
+  if (secrets.length === 0) {
+    return;
+  }
+  if (!(await isGhAuthenticated())) {
+    io.log(
+      "⚠️ github pipeline is enabled, but the github cli (gh) is not authenticated — run `project secrets-sync-github` later to mirror the secrets",
+    );
+    return;
+  }
+  const repo = await getConfiguredGithubRepo();
+  if (!repo) {
+    io.log(
+      "⚠️ github pipeline is enabled, but no github repository was found — run `project secrets-sync-github` later to mirror the secrets",
+    );
+    return;
+  }
+  io.log(`mirroring ${secrets.length} secrets to github ('${repo}')...`);
+  await pushSecretsToGithub(
+    io,
+    repo,
+    secrets,
+    await collectSecretTargets(config),
+  );
+};

package/src/commands/project/secrets/parseKeysInput.ts

@@ -0,0 +1,8 @@
+/** parses a comma-separated `--key` input into a list of keys */
+export const parseKeysInput = (input?: string): string[] | undefined => {
+  const keys = input
+    ?.split(",")
+    .map((key) => key.trim())
+    .filter(Boolean);
+  return keys && keys.length > 0 ? keys : undefined;
+};

package/src/commands/project/secrets/scope.ts

@@ -0,0 +1,151 @@
+import {
+  getAllComponentsWithAllEnvsHierarchical,
+  getEnvironment,
+} from "../../../config/getProjectConfig";
+
+/** which envs of which components a secrets command operates on */
+export type SecretsScope = {
+  [componentName: string]: string[];
+};
+
+/**
+ * resolves a scope expression to component → envs:
+ * - (empty): all components, all envs
+ * - `env:component`: one env of one component
+ * - `env` / `env:`: one env, every component that has it
+ * - `:component`: every env of one component
+ */
+export const resolveSecretsScope = async (
+  scope?: string,
+): Promise<SecretsScope> => {
+  const all = await getAllComponentsWithAllEnvsHierarchical();
+  if (Object.keys(all).length === 0) {
+    throw new Error("no catladder config found");
+  }
+  if (!scope) {
+    return all;
+  }
+
+  const [env, componentName] = scope.split(":").map((x) => x || null);
+
+  if (componentName && !(componentName in all)) {
+    throw new Error(
+      `unknown component "${componentName}" — components: ${Object.keys(all).join(", ")}`,
+    );
+  }
+
+  const scoped = Object.fromEntries(
+    Object.entries(all)
+      .filter(([name]) => !componentName || name === componentName)
+      .map(([name, envs]): [string, string[]] => [
+        name,
+        env ? envs.filter((e) => e === env) : envs,
+      ])
+      .filter(([, envs]) => envs.length > 0),
+  );
+
+  if (Object.keys(scoped).length === 0) {
+    const allEnvs = [...new Set(Object.values(all).flat())];
+    throw new Error(
+      `no component has the environment "${env}" — environments: ${allEnvs.join(", ")}`,
+    );
+  }
+  return scoped;
+};
+
+/**
+ * all valid scope expressions, for autocompletion: `env:component`
+ * pairs plus the `env:` (one env, all components) and `:component`
+ * (one component, all envs) forms
+ */
+export const secretsScopeChoices = async (): Promise<string[]> => {
+  const all = await getAllComponentsWithAllEnvsHierarchical();
+  const pairs = Object.entries(all).flatMap(([componentName, envs]) =>
+    envs.map((env) => `${env}:${componentName}`),
+  );
+  const envs = [...new Set(Object.values(all).flat())];
+  return [
+    ...pairs,
+    ...envs.map((env) => `${env}:`),
+    ...Object.keys(all).map((componentName) => `:${componentName}`),
+  ];
+};
+
+/** one env of one component together with its (filtered) secret keys */
+export type ScopedSecretKeys = Array<{
+  env: string;
+  componentName: string;
+  keys: string[];
+}>;
+
+/** the secret keys declared in the config for one env of one component */
+export const getDeclaredSecretKeys = async (
+  env: string,
+  componentName: string,
+): Promise<string[]> => {
+  const { secretEnvVarKeys, jobOnlyVars } = await getEnvironment(
+    env,
+    componentName,
+  );
+  return [
+    ...jobOnlyVars.build.secretEnvVarKeys,
+    ...jobOnlyVars.deploy.secretEnvVarKeys,
+    ...secretEnvVarKeys,
+  ]
+    .filter((k) => !k.hidden)
+    .map((k) => k.key);
+};
+
+/**
+ * expands a scope to its declared secret keys, optionally filtered to
+ * `onlyKeys`. Throws when a requested key is not declared anywhere in
+ * the scope (typo protection); env/component pairs without matching
+ * keys are dropped.
+ */
+export const getScopedSecretKeys = async (
+  scope: SecretsScope,
+  onlyKeys?: string[],
+): Promise<ScopedSecretKeys> => {
+  const scoped: ScopedSecretKeys = [];
+  const declaredAnywhere = new Set<string>();
+  for (const [componentName, envs] of Object.entries(scope)) {
+    for (const env of envs) {
+      const declared = await getDeclaredSecretKeys(env, componentName);
+      declared.forEach((key) => declaredAnywhere.add(key));
+      const keys = onlyKeys
+        ? declared.filter((key) => onlyKeys.includes(key))
+        : declared;
+      if (keys.length > 0) {
+        scoped.push({ env, componentName, keys });
+      }
+    }
+  }
+
+  const unknownKeys = (onlyKeys ?? []).filter(
+    (key) => !declaredAnywhere.has(key),
+  );
+  if (unknownKeys.length > 0) {
+    throw new Error(
+      `these secrets are not declared in this scope: ${unknownKeys.join(", ")}` +
+        `\ndeclared secrets: ${[...declaredAnywhere].join(", ")}`,
+    );
+  }
+  if (scoped.length === 0) {
+    throw new Error("there are no secrets to configure in this scope");
+  }
+  return scoped;
+};
+
+/** human-readable one-line-per-component summary of a scope */
+export const formatScope = (scoped: ScopedSecretKeys): string => {
+  const byComponent = new Map<string, string[]>();
+  for (const { env, componentName } of scoped) {
+    byComponent.set(componentName, [
+      ...(byComponent.get(componentName) ?? []),
+      env,
+    ]);
+  }
+  return [...byComponent.entries()]
+    .map(([componentName, envs]) => `- ${componentName}: ${envs.join(", ")}`)
+    .join("\n");
+};

package/src/utils/readStdin.ts

@@ -0,0 +1,8 @@
+/** reads the whole stdin stream (for piped input in non-interactive use) */
+export const readStdin = async (): Promise<string> => {
+  const chunks: Buffer[] = [];
+  for await (const chunk of process.stdin) {
+    chunks.push(chunk as Buffer);
+  }
+  return Buffer.concat(chunks).toString("utf-8");
+};

package/babel-inline.json

@@ -1,11 +0,0 @@
-{
-  "plugins": [
-    "@babel/plugin-syntax-typescript",
-    [
-      "transform-inline-environment-variables",
-      {
-        "include": ["INLINE_PIPELINE_IMAGE_TAG", "INLINE_DOCKER_REGISTRY"]
-      }
-    ]
-  ]
-}

package/dist/bundles/runner-images/semantic-release-central.Dockerfile

@@ -1,36 +0,0 @@
-# LEGACY-COMPAT build of the semantic-release image for the CENTRAL
-# registry only (build context: repo root, see .gitlab-ci-yaml-custom.yaml).
-#
-# The shipped definition (semantic-release/Dockerfile) is self-contained:
-# repos generated by current catladder run the security audit via the
-# materialized `.catladder-generated/catci/` bundle. But the central
-# `:latest` tag is shared with repos on OLD catladder versions whose
-# generated pipelines expect `catladder` on the PATH — so the central
-# build additionally bakes the cli in, exactly as before.
-#
-# Delete together with the central registry / central mode.
-FROM node:lts-alpine
-
-RUN apk add --no-cache bash git git-lfs
-
-RUN mkdir /packages
-COPY ./cli /packages/cli
-
-# add semantic release (pinned exactly — keep in sync with
-# semantic-release/Dockerfile; @semantic-release/changelog@7 is ESM-only
-# and incompatible with the CJS semantic-release@19)
-RUN yarn global add \
-    semantic-release@19.0.5 \
-    @semantic-release/commit-analyzer@13.0.1 \
-    @semantic-release/release-notes-generator@14.1.1 \
-    https://github.com/panter/git.git#b4037626cc583d3e9f7995ea0604b23730d0a22e \
-    @semantic-release/changelog@6.0.3 \
-    @semantic-release/gitlab@9.5.1 \
-    @semantic-release/exec@6.0.3 \
-    /packages/cli
-
-RUN mkdir -p /scripts
-COPY ./runner-images/semantic-release/scripts/* /scripts/
-RUN chmod +x /scripts/*
-
-ENV PATH="/scripts:${PATH}"

package/dist/cli/src/apps/cli/commands/project/commandConfigSecrets.d.ts

@@ -1,2 +0,0 @@
-import type { IO } from "../../../../core/types";
-export declare const projectConfigSecrets: (io: IO, envComponent?: string) => Promise<void>;

package/dist/cli/src/apps/cli/commands/project/commandConfigSecrets.js

@@ -1,192 +0,0 @@
-"use strict";
-
-Object.defineProperty(exports, "__esModule", {
-  value: true
-});
-exports.projectConfigSecrets = void 0;
-const pipeline_1 = require("../../../../../../pipeline/src/index.js");
-const common_tags_1 = require("common-tags");
-const lodash_es_1 = require("lodash-es");
-const getProjectConfig_1 = require("../../../../config/getProjectConfig");
-const commandSecretsSyncGithub_1 = require("../../../../commands/project/commandSecretsSyncGithub");
-const editAsFile_1 = require("../../../../utils/editAsFile");
-const github_1 = require("../../../../utils/github");
-const gitlab_1 = require("../../../../utils/gitlab");
-const promise_1 = require("../../../../utils/promise");
-/* for convenience, parse json objects. that makes it easier to edit secrets that are object */
-const resolveJson = v => Object.fromEntries(Object.entries(v).map(([componentName, envs]) => {
-  return [componentName, Object.fromEntries(Object.entries(envs).map(([env, secrets]) => [env, Object.fromEntries(Object.entries(secrets).map(([key, value]) => {
-    try {
-      return [key, JSON.parse(value)];
-    } catch (e) {
-      return [key, value];
-    }
-  }))]))];
-}));
-const getSecretEnvVarKeysToConfigure = async (env, componentName) => {
-  const {
-    secretEnvVarKeys,
-    jobOnlyVars
-  } = await (0, getProjectConfig_1.getEnvironment)(env, componentName);
-  return [...jobOnlyVars.build.secretEnvVarKeys, ...jobOnlyVars.deploy.secretEnvVarKeys, ...secretEnvVarKeys].filter(k => !k.hidden).map(k => k.key);
-};
-const getEnvVarsToEdit = async (instance, env, componentName) => {
-  const secretEnvVarKeys = await getSecretEnvVarKeysToConfigure(env, componentName);
-  const normalEnvVars = await (0, getProjectConfig_1.getEnvVarsResolved)(instance, env, componentName);
-  const jobOnlyEnvVars = await (0, getProjectConfig_1.getJobOnlyEnvVarsResolved)(instance, env, componentName);
-  const allEnvVars = {
-    ...normalEnvVars,
-    ...jobOnlyEnvVars
-  };
-  return Object.fromEntries(secretEnvVarKeys.map(key => {
-    const value = allEnvVars[key];
-    // due to some quirky way to resolve these variables, unset variables have the $CL_ prefix, so we remove thouse here
-    const variableIsNotSet = value === "$" + (0, pipeline_1.getSecretVarName)(env, componentName, key);
-    return [key, variableIsNotSet ? "🚨 FILL ME" : value];
-  }));
-};
-const doItFor = async (instance, envAndComponents) => {
-  let valuesToEdit = Object.fromEntries(await Promise.all(Object.entries(envAndComponents).map(async ([componentName, envs]) => [componentName, Object.fromEntries(await Promise.all(envs.map(async env => [env, await getEnvVarsToEdit(instance, env, componentName)])))])));
-  let hasErrors = true;
-  while (hasErrors) {
-    valuesToEdit = await (0, editAsFile_1.editAsFile)(resolveJson(valuesToEdit), (0, common_tags_1.stripIndents)`
-        Please fill in all secrets for: 
-
-        ${Object.entries(envAndComponents).map(([componentName, envs]) => `- ${componentName}: ${envs.join(", ")}`).join("\n")}
-
-        `);
-    // check for errors
-    hasErrors = false;
-    for (const [componentName, envs] of Object.entries(envAndComponents)) {
-      for (const env of envs) {
-        const usedKeys = valuesToEdit[componentName][env] ? Object.keys(valuesToEdit[componentName][env]) : [];
-        // check whether newValues have the exact number of keys
-        const secretEnvVarKeys = await getSecretEnvVarKeysToConfigure(env, componentName);
-        const extranous = (0, lodash_es_1.difference)(usedKeys, secretEnvVarKeys);
-        const missing = (0, lodash_es_1.difference)(secretEnvVarKeys, usedKeys);
-        if (extranous.length > 0 || missing.length > 0) {
-          instance.log("");
-          instance.log(`😿 Oh no! There is something wrong with "${componentName}"`);
-          instance.log("");
-          if (extranous.length > 0) {
-            instance.log("these secrets are not declared in the config");
-            extranous.forEach(key => instance.log(key));
-            instance.log("");
-          }
-          if (missing.length > 0) {
-            instance.log("these secrets have not been provided:");
-            missing.forEach(key => instance.log(key));
-            instance.log("");
-          }
-          await (0, promise_1.delay)(1000);
-          const shouldContinue = await instance.confirm("Try again? 🤔");
-          if (!shouldContinue) {
-            throw new Error("abort");
-          }
-          hasErrors = true;
-        }
-      }
-    }
-  }
-  const config = await (0, getProjectConfig_1.getProjectConfig)();
-  if (!config) {
-    throw new Error("no catladder config found");
-  }
-  instance.log("");
-  instance.log("writing all secrets to the vault, please wait...");
-  instance.log("");
-  for (const [componentName, envs] of Object.entries(envAndComponents)) {
-    for (const env of envs) {
-      instance.log("writing " + env + ":" + componentName + "...\n");
-      await (await instance.getVaultManager()).writeSecrets(env, componentName, valuesToEdit[componentName][env]);
-      instance.log("");
-      instance.log("✅ " + env + ":" + componentName);
-      instance.log("--------------------------------\n");
-    }
-  }
-  await mirrorSecretsToCiBackends(instance, config, envAndComponents, valuesToEdit);
-  instance.log("done! 😻");
-  instance.log("");
-};
-/**
- * the vault is the source of truth; every enabled CI backend receives
- * a mirrored copy of the edited secrets (gitlab variables, github
- * secrets), so all CI systems stay in sync
- */
-const mirrorSecretsToCiBackends = async (instance, config, envAndComponents, valuesToEdit) => {
-  const enabled = (0, pipeline_1.getEnabledPipelineTypes)(config);
-  // gitlab mirror (unless gitlab is the vault itself, then it is
-  // already written)
-  if ((0, pipeline_1.getVaultConfig)(config).type !== "gitlab" && enabled.includes("gitlab")) {
-    for (const [componentName, envs] of Object.entries(envAndComponents)) {
-      for (const env of envs) {
-        await (0, gitlab_1.upsertAllVariables)(instance, valuesToEdit[componentName][env], env, componentName);
-      }
-    }
-    instance.log("✅ mirrored to gitlab");
-  }
-  if (!enabled.includes("github")) {
-    return;
-  }
-  const kinds = new Map();
-  for (const [componentName, envs] of Object.entries(envAndComponents)) {
-    for (const env of envs) {
-      const {
-        secretEnvVarKeys,
-        jobOnlyVars
-      } = await (0, getProjectConfig_1.getEnvironment)(env, componentName);
-      [...secretEnvVarKeys, ...jobOnlyVars.build.secretEnvVarKeys, ...jobOnlyVars.deploy.secretEnvVarKeys].forEach(({
-        key,
-        kind
-      }) => kinds.set((0, pipeline_1.getSecretVarName)(env, componentName, key), kind !== null && kind !== void 0 ? kind : "secret"));
-    }
-  }
-  const secrets = Object.entries(envAndComponents).flatMap(([componentName, envs]) => envs.flatMap(env => {
-    var _a;
-    return Object.entries((_a = valuesToEdit[componentName][env]) !== null && _a !== void 0 ? _a : {}).map(([key, value]) => {
-      var _a;
-      const name = (0, pipeline_1.getSecretVarName)(env, componentName, key);
-      return {
-        name,
-        value: typeof value === "string" ? value : JSON.stringify(value !== null && value !== void 0 ? value : ""),
-        kind: (_a = kinds.get(name)) !== null && _a !== void 0 ? _a : "secret"
-      };
-    });
-  }));
-  if (secrets.length === 0) {
-    return;
-  }
-  if (!(await (0, github_1.isGhAuthenticated)())) {
-    instance.log("⚠️ github pipeline is enabled, but the github cli (gh) is not authenticated — run `project secrets-sync-github` later to mirror the secrets");
-    return;
-  }
-  const repo = await (0, commandSecretsSyncGithub_1.getConfiguredGithubRepo)();
-  if (!repo) {
-    instance.log("⚠️ github pipeline is enabled, but no github repository was found — run `project secrets-sync-github` later to mirror the secrets");
-    return;
-  }
-  instance.log(`mirroring ${secrets.length} secrets to github ('${repo}')...`);
-  await (0, commandSecretsSyncGithub_1.pushSecretsToGithub)(instance, repo, secrets, await (0, commandSecretsSyncGithub_1.collectSecretTargets)(config));
-};
-const projectConfigSecrets = async (io, envComponent) => {
-  if (!envComponent) {
-    const allEnvAndcomponents = await (0, getProjectConfig_1.getAllComponentsWithAllEnvsHierarchical)();
-    await doItFor(io, allEnvAndcomponents);
-  } else {
-    const {
-      env,
-      componentName
-    } = (0, getProjectConfig_1.parseChoice)(envComponent);
-    // componentName can be null. in this case, iterate over all  components
-    if (!componentName) {
-      const components = await (0, getProjectConfig_1.getProjectComponents)();
-      await doItFor(io, Object.fromEntries(components.map(c => [c, [env]])));
-    }
-    if (componentName) {
-      await doItFor(io, {
-        [componentName]: [env]
-      });
-    }
-  }
-};
-exports.projectConfigSecrets = projectConfigSecrets;