@catladder/cli 5.0.1 → 5.1.0

package/dist/apps/cli/src/commands/project/commandSecretsSyncGithub.js

@@ -1,130 +1,11 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.commandSecretsSyncGithub = exports.getConfiguredGithubRepo = exports.pushSecretsToGithub = exports.collectSecretTargets = exports.collectSecretsFromVault = void 0;
+exports.commandSecretsSyncGithub = void 0;
 const pipeline_1 = require("../../../../../packages/pipeline/src/index.js");
 const getProjectConfig_1 = require("../../config/getProjectConfig");
 const defineCommand_1 = require("../../core/defineCommand");
+const secrets_1 = require("../../secrets");
 const github_1 = require("../../utils/github");
-/**
- * all secrets declared in the config, with their values read from the
- * vault (github secrets are write-only and can never act as a source)
- */
-const collectSecretsFromVault = async (io, envFilter) => {
-    const envAndComponents = await (0, getProjectConfig_1.getAllComponentsWithAllEnvsHierarchical)();
-    const kinds = new Map();
-    for (const [componentName, envs] of Object.entries(envAndComponents)) {
-        for (const env of envs) {
-            if (envFilter && !envFilter.includes(env)) {
-                continue;
-            }
-            const { secretEnvVarKeys, jobOnlyVars } = await (0, getProjectConfig_1.getEnvironment)(env, componentName);
-            const keys = [
-                ...secretEnvVarKeys,
-                ...jobOnlyVars.build.secretEnvVarKeys,
-                ...jobOnlyVars.deploy.secretEnvVarKeys,
-            ];
-            keys.forEach(({ key, kind }) => kinds.set((0, pipeline_1.getSecretVarName)(env, componentName, key), kind !== null && kind !== void 0 ? kind : "secret"));
-        }
-    }
-    const names = [...kinds.keys()];
-    const values = await (await io.getVaultManager()).readSecrets(names, io);
-    const secrets = names
-        .filter((name) => values[name] !== undefined)
-        .map((name) => {
-        var _a;
-        return ({
-            name,
-            value: values[name],
-            kind: (_a = kinds.get(name)) !== null && _a !== void 0 ? _a : "secret",
-        });
-    });
-    const missing = names.filter((name) => values[name] === undefined);
-    return { secrets, missing };
-};
-exports.collectSecretsFromVault = collectSecretsFromVault;
-/** marker for repo-level (environment-less) targets */
-const REPO_LEVEL = "";
-/**
- * derives which github environment(s) each secret/variable must live in
- * by scanning the GENERATED workflows: a `${{ secrets.X }}` / `${{
- * vars.X }}` reference in a job's env targets that job's environment
- * (or the repo level when the job has none). Deriving from the real
- * output means the sync can never drift from what the workflows expect.
- *
- * Environment secrets are the answer to github's cap of 100 secrets
- * per REPO (a multi-env project easily exceeds it): the cap applies
- * per environment instead.
- */
-const collectSecretTargets = async (config) => {
-    var _a;
-    const workflows = await new pipeline_1.GithubBackend().createWorkflows(config);
-    const targets = new Map();
-    for (const workflow of Object.values(workflows)) {
-        for (const job of Object.values(workflow.jobs)) {
-            const environment = typeof job.environment === "object"
-                ? job.environment.name
-                : job.environment;
-            for (const value of Object.values((_a = job.env) !== null && _a !== void 0 ? _a : {})) {
-                if (typeof value !== "string")
-                    continue;
-                for (const match of value.matchAll(/\$\{\{\s*(?:secrets|vars)\.([A-Za-z0-9_]+)\s*\}\}/g)) {
-                    const name = match[1];
-                    if (!targets.has(name)) {
-                        targets.set(name, new Set());
-                    }
-                    targets.get(name).add(environment !== null && environment !== void 0 ? environment : REPO_LEVEL);
-                }
-            }
-        }
-    }
-    return targets;
-};
-exports.collectSecretTargets = collectSecretTargets;
-/**
- * pushes vault values to github via the gh cli: sensitive ones as
- * secrets (masked), "variable"-kind ones as variables (plain) — each
- * into the environment(s) whose jobs reference them
- */
-const pushSecretsToGithub = async (io, repo, secrets, targets) => {
-    const environments = [
-        ...new Set([...targets.values()].flatMap((envs) => [...envs].filter((env) => env !== REPO_LEVEL))),
-    ];
-    for (const environment of environments) {
-        await (0, github_1.ensureGithubEnvironment)(repo, environment);
-        io.log(`🌍 environment ${environment}`);
-    }
-    for (const { name, value, kind } of secrets) {
-        const envs = targets.get(name);
-        if (!envs) {
-            io.log(`⏭️ ${name} (not referenced by any generated workflow)`);
-            continue;
-        }
-        for (const environment of envs) {
-            const suffix = environment === REPO_LEVEL ? "" : ` → ${environment}`;
-            if (kind === "variable") {
-                await (0, github_1.setGithubVariable)(repo, name, value, environment || undefined);
-                io.log(`📖 ${name} (variable)${suffix}`);
-            }
-            else {
-                await (0, github_1.setGithubSecret)(repo, name, value, environment || undefined);
-                io.log(`✅ ${name}${suffix}`);
-            }
-        }
-    }
-};
-exports.pushSecretsToGithub = pushSecretsToGithub;
-/**
- * resolves the github repository from the configured git remote
- * (`pipelines.github.gitRemote`, defaults to origin)
- */
-const getConfiguredGithubRepo = async () => {
-    const config = await (0, getProjectConfig_1.getProjectConfig)();
-    if (!config) {
-        return undefined;
-    }
-    return (0, github_1.getGithubRepoFromRemote)((0, pipeline_1.getPipelineGitRemote)(config, "github"));
-};
-exports.getConfiguredGithubRepo = getConfiguredGithubRepo;
 /**
  * copies the catladder secrets from the vault to github actions
  * repository secrets, keeping the exact same names, so the github
@@ -161,12 +42,12 @@ exports.commandSecretsSyncGithub = (0, defineCommand_1.defineCommand)({
         if (!(await (0, github_1.isGhAuthenticated)())) {
             throw new Error("the github cli (gh) is not installed or not authenticated — run `gh auth login` first");
         }
-        const repo = (_a = (await ctx.get("repo"))) !== null && _a !== void 0 ? _a : (await (0, exports.getConfiguredGithubRepo)());
+        const repo = (_a = (await ctx.get("repo"))) !== null && _a !== void 0 ? _a : (await (0, secrets_1.getConfiguredGithubRepo)());
         if (!repo) {
             throw new Error(`no github repository found on the '${(0, pipeline_1.getPipelineGitRemote)(config, "github")}' remote — pass it as owner/name or configure pipelines.github.gitRemote`);
         }
         const envFilter = (_b = (await ctx.get("env"))) === null || _b === void 0 ? void 0 : _b.split(",").map((e) => e.trim());
-        const { secrets, missing } = await (0, exports.collectSecretsFromVault)(ctx, envFilter);
+        const { secrets, missing } = await (0, secrets_1.collectSecretsFromVault)(ctx, envFilter);
         if (missing.length > 0) {
             ctx.log(`⚠️ ${missing.length} secrets are not set in the vault and will be skipped:`);
             missing.forEach((name) => ctx.log(`  - ${name}`));
@@ -183,7 +64,7 @@ exports.commandSecretsSyncGithub = (0, defineCommand_1.defineCommand)({
         if (!confirmed) {
             throw new Error("abort");
         }
-        await (0, exports.pushSecretsToGithub)(ctx, repo, secrets, await (0, exports.collectSecretTargets)(config));
+        await (0, secrets_1.pushSecretsToGithub)(ctx, repo, secrets, await (0, secrets_1.collectSecretTargets)(config));
         ctx.log("");
         ctx.log("done! 😻 the github pipeline can use them as ${{ secrets.<NAME> }}");
     },

package/dist/apps/cli/src/commands/project/commandSecretsSyncGithub.js.map

@@ -1 +1 @@
-{"version":3,"file":"commandSecretsSyncGithub.js","sourceRoot":"","sources":["../../../../../../src/commands/project/commandSecretsSyncGithub.ts"],"names":[],"mappings":";;;AACA,kDAK6B;AAC7B,oEAIuC;AACvC,4DAAyD;AAEzD,+CAM4B;AAE5B;;;GAGG;AACI,MAAM,uBAAuB,GAAG,KAAK,EAAE,EAAM,EAAE,SAAoB,EAAE,EAAE;IAC5E,MAAM,gBAAgB,GAAG,MAAM,IAAA,0DAAuC,GAAE,CAAC;IAEzE,MAAM,KAAK,GAAG,IAAI,GAAG,EAAiC,CAAC;IACvD,KAAK,MAAM,CAAC,aAAa,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACrE,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,SAAS,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC1C,SAAS;YACX,CAAC;YACD,MAAM,EAAE,gBAAgB,EAAE,WAAW,EAAE,GAAG,MAAM,IAAA,iCAAc,EAC5D,GAAG,EACH,aAAa,CACd,CAAC;YACF,MAAM,IAAI,GAAG;gBACX,GAAG,gBAAgB;gBACnB,GAAG,WAAW,CAAC,KAAK,CAAC,gBAAgB;gBACrC,GAAG,WAAW,CAAC,MAAM,CAAC,gBAAgB;aACvC,CAAC;YACF,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,CAC7B,KAAK,CAAC,GAAG,CAAC,IAAA,2BAAgB,EAAC,GAAG,EAAE,aAAa,EAAE,GAAG,CAAC,EAAE,IAAI,aAAJ,IAAI,cAAJ,IAAI,GAAI,QAAQ,CAAC,CACvE,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAG,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IAChC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,eAAe,EAAE,CAAC,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACzE,MAAM,OAAO,GAAG,KAAK;SAClB,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC;SAC5C,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;;QAAC,OAAA,CAAC;YACd,IAAI;YACJ,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC;YACnB,IAAI,EAAE,MAAA,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,mCAAK,QAAkB;SAC7C,CAAC,CAAA;KAAA,CAAC,CAAC;IACN,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC,CAAC;IACnE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAC9B,CAAC,CAAC;AAnCW,QAAA,uBAAuB,2BAmClC;AAEF,uDAAuD;AACvD,MAAM,UAAU,GAAG,EAAE,CAAC;AAEtB;;;;;;;;;;GAUG;AACI,MAAM,oBAAoB,GAAG,KAAK,EACvC,MAAc,EACqB,EAAE;;IACrC,MAAM,SAAS,GAAG,MAAM,IAAI,wBAAa,EAAE,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;IACpE,MAAM,OAAO,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC/C,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;QAChD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/C,MAAM,WAAW,GACf,OAAO,GAAG,CAAC,WAAW,KAAK,QAAQ;gBACjC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI;gBACtB,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC;YACtB,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,MAAA,GAAG,CAAC,GAAG,mCAAI,EAAE,CAAC,EAAE,CAAC;gBACjD,IAAI,OAAO,KAAK,KAAK,QAAQ;oBAAE,SAAS;gBACxC,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,QAAQ,CAChC,oDAAoD,CACrD,EAAE,CAAC;oBACF,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;oBACtB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;wBACvB,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC;oBAC/B,CAAC;oBACD,OAAO,CAAC,GAAG,CAAC,IAAI,CAAE,CAAC,GAAG,CAAC,WAAW,aAAX,WAAW,cAAX,WAAW,GAAI,UAAU,CAAC,CAAC;gBACpD,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC,CAAC;AA1BW,QAAA,oBAAoB,wBA0B/B;AAEF;;;;GAIG;AACI,MAAM,mBAAmB,GAAG,KAAK,EACtC,EAAM,EACN,IAAY,EACZ,OAAuE,EACvE,OAAiC,EACjC,EAAE;IACF,MAAM,YAAY,GAAG;QACnB,GAAG,IAAI,GAAG,CACR,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CACrC,CAAC,GAAG,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,UAAU,CAAC,CAC9C,CACF;KACF,CAAC;IACF,KAAK,MAAM,WAAW,IAAI,YAAY,EAAE,CAAC;QACvC,MAAM,IAAA,gCAAuB,EAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QACjD,EAAE,CAAC,GAAG,CAAC,kBAAkB,WAAW,EAAE,CAAC,CAAC;IAC1C,CAAC;IAED,KAAK,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,OAAO,EAAE,CAAC;QAC5C,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,EAAE,CAAC,GAAG,CAAC,MAAM,IAAI,6CAA6C,CAAC,CAAC;YAChE,SAAS;QACX,CAAC;QACD,KAAK,MAAM,WAAW,IAAI,IAAI,EAAE,CAAC;YAC/B,MAAM,MAAM,GAAG,WAAW,KAAK,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,WAAW,EAAE,CAAC;YACrE,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;gBACxB,MAAM,IAAA,0BAAiB,EAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,IAAI,SAAS,CAAC,CAAC;gBACrE,EAAE,CAAC,GAAG,CAAC,MAAM,IAAI,cAAc,MAAM,EAAE,CAAC,CAAC;YAC3C,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAA,wBAAe,EAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,IAAI,SAAS,CAAC,CAAC;gBACnE,EAAE,CAAC,GAAG,CAAC,KAAK,IAAI,GAAG,MAAM,EAAE,CAAC,CAAC;YAC/B,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC,CAAC;AAnCW,QAAA,mBAAmB,uBAmC9B;AAEF;;;GAGG;AACI,MAAM,uBAAuB,GAAG,KAAK,IAE1C,EAAE;IACF,MAAM,MAAM,GAAG,MAAM,IAAA,mCAAgB,GAAE,CAAC;IACxC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,IAAA,gCAAuB,EAAC,IAAA,+BAAoB,EAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;AACzE,CAAC,CAAC;AARW,QAAA,uBAAuB,2BAQlC;AAEF;;;;GAIG;AACU,QAAA,wBAAwB,GAAG,IAAA,6BAAa,EAAC;IACpD,IAAI,EAAE,6BAA6B;IACnC,WAAW,EACT,gGAAgG;IAClG,KAAK,EAAE,SAAS;IAChB,MAAM,EAAE;QACN,IAAI,EAAE;YACJ,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,gCAAgC;YACzC,UAAU,EAAE,IAAI;YAChB,QAAQ,EAAE,KAAK;SAChB;QACD,GAAG,EAAE;YACH,IAAI,EAAE,QAAQ;YACd,OAAO,EACL,0GAA0G;YAC5G,UAAU,EAAE,IAAI;YAChB,QAAQ,EAAE,KAAK;SAChB;KACF;IACD,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;;QACrB,MAAM,MAAM,GAAG,MAAM,IAAA,mCAAgB,GAAE,CAAC;QACxC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC/C,CAAC;QACD,MAAM,OAAO,GAAG,IAAA,kCAAuB,EAAC,MAAM,CAAC,CAAC;QAChD,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CACb,wEAAwE,CACzE,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,CAAC,MAAM,IAAA,0BAAiB,GAAE,CAAC,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CACb,uFAAuF,CACxF,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,MAAA,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,mCAAI,CAAC,MAAM,IAAA,+BAAuB,GAAE,CAAC,CAAC;QAC1E,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CACb,sCAAsC,IAAA,+BAAoB,EAAC,MAAM,EAAE,QAAQ,CAAC,0EAA0E,CACvJ,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAG,MAAA,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,0CAAE,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1E,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,MAAM,IAAA,+BAAuB,EAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAE3E,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,GAAG,CAAC,GAAG,CACL,MAAM,OAAO,CAAC,MAAM,wDAAwD,CAC7E,CAAC;YACF,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC;YAClD,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACd,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,GAAG,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;YACjC,OAAO;QACT,CAAC;QAED,GAAG,CAAC,GAAG,CAAC,gBAAgB,OAAO,CAAC,MAAM,gBAAgB,IAAI,IAAI,CAAC,CAAC;QAChE,OAAO,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC;QACtD,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACZ,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QACpD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;QAC3B,CAAC;QAED,MAAM,IAAA,2BAAmB,EACvB,GAAG,EACH,IAAI,EACJ,OAAO,EACP,MAAM,IAAA,4BAAoB,EAAC,MAAM,CAAC,CACnC,CAAC;QACF,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACZ,GAAG,CAAC,GAAG,CACL,oEAAoE,CACrE,CAAC;IACJ,CAAC;CACF,CAAC,CAAC"}
+{"version":3,"file":"commandSecretsSyncGithub.js","sourceRoot":"","sources":["../../../../../../src/commands/project/commandSecretsSyncGithub.ts"],"names":[],"mappings":";;;AAAA,kDAG6B;AAC7B,oEAAiE;AACjE,4DAAyD;AACzD,2CAKuB;AACvB,+CAAuD;AAEvD;;;;GAIG;AACU,QAAA,wBAAwB,GAAG,IAAA,6BAAa,EAAC;IACpD,IAAI,EAAE,6BAA6B;IACnC,WAAW,EACT,gGAAgG;IAClG,KAAK,EAAE,SAAS;IAChB,MAAM,EAAE;QACN,IAAI,EAAE;YACJ,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,gCAAgC;YACzC,UAAU,EAAE,IAAI;YAChB,QAAQ,EAAE,KAAK;SAChB;QACD,GAAG,EAAE;YACH,IAAI,EAAE,QAAQ;YACd,OAAO,EACL,0GAA0G;YAC5G,UAAU,EAAE,IAAI;YAChB,QAAQ,EAAE,KAAK;SAChB;KACF;IACD,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;;QACrB,MAAM,MAAM,GAAG,MAAM,IAAA,mCAAgB,GAAE,CAAC;QACxC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC/C,CAAC;QACD,MAAM,OAAO,GAAG,IAAA,kCAAuB,EAAC,MAAM,CAAC,CAAC;QAChD,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CACb,wEAAwE,CACzE,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,CAAC,MAAM,IAAA,0BAAiB,GAAE,CAAC,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CACb,uFAAuF,CACxF,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,MAAA,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,mCAAI,CAAC,MAAM,IAAA,iCAAuB,GAAE,CAAC,CAAC;QAC1E,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CACb,sCAAsC,IAAA,+BAAoB,EAAC,MAAM,EAAE,QAAQ,CAAC,0EAA0E,CACvJ,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAG,MAAA,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,0CAAE,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1E,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,MAAM,IAAA,iCAAuB,EAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAE3E,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,GAAG,CAAC,GAAG,CACL,MAAM,OAAO,CAAC,MAAM,wDAAwD,CAC7E,CAAC;YACF,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC;YAClD,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACd,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,GAAG,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;YACjC,OAAO;QACT,CAAC;QAED,GAAG,CAAC,GAAG,CAAC,gBAAgB,OAAO,CAAC,MAAM,gBAAgB,IAAI,IAAI,CAAC,CAAC;QAChE,OAAO,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC;QACtD,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACZ,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QACpD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;QAC3B,CAAC;QAED,MAAM,IAAA,6BAAmB,EACvB,GAAG,EACH,IAAI,EACJ,OAAO,EACP,MAAM,IAAA,8BAAoB,EAAC,MAAM,CAAC,CACnC,CAAC;QACF,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACZ,GAAG,CAAC,GAAG,CACL,oEAAoE,CACrE,CAAC;IACJ,CAAC;CACF,CAAC,CAAC"}

package/dist/apps/cli/src/commands/project/secrets/commandSecretsPush.js

@@ -5,6 +5,7 @@ const fs_extra_1 = require("fs-extra");
 const yaml_1 = require("yaml");
 const defineCommand_1 = require("../../../core/defineCommand");
 const readStdin_1 = require("../../../utils/readStdin");
+const secrets_1 = require("../../../secrets");
 const document_1 = require("./document");
 const scope_1 = require("./scope");
 const parseKeysInput_1 = require("./parseKeysInput");
@@ -67,7 +68,7 @@ exports.commandSecretsPush = (0, defineCommand_1.defineCommand)({
         if (!confirmed) {
             throw new Error("abort");
         }
-        await (0, document_1.writeSecretsAndMirror)(ctx, writes);
+        await (0, secrets_1.writeSecretsAndMirror)(ctx, writes);
         ctx.log("done! 😻");
     },
 });

package/dist/apps/cli/src/commands/project/secrets/commandSecretsPush.js.map

@@ -1 +1 @@
-{"version":3,"file":"commandSecretsPush.js","sourceRoot":"","sources":["../../../../../../../src/commands/project/secrets/commandSecretsPush.ts"],"names":[],"mappings":";;;AAAA,uCAAoC;AACpC,+BAA6B;AAC7B,+DAA4D;AAC5D,wDAAqD;AAErD,yCAIoB;AACpB,mCAIiB;AACjB,qDAAkD;AAErC,QAAA,kBAAkB,GAAG,IAAA,6BAAa,EAAC;IAC9C,IAAI,EAAE,sBAAsB;IAC5B,WAAW,EACT,yGAAyG;IAC3G,KAAK,EAAE,SAAS;IAChB,MAAM,EAAE;QACN,YAAY,EAAE;YACZ,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,gEAAgE;YACzE,UAAU,EAAE,IAAI;YAChB,QAAQ,EAAE,KAAK;YACf,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC,IAAA,2BAAmB,GAAE;SAC3C;QACD,GAAG,EAAE;YACH,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,iDAAiD;YAC1D,QAAQ,EAAE,KAAK;SAChB;QACD,IAAI,EAAE;YACJ,IAAI,EAAE,QAAQ;YACd,OAAO,EACL,sEAAsE;YACxE,QAAQ,EAAE,KAAK;SAChB;KACF;IACD,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACrB,MAAM,KAAK,GAAG,MAAM,IAAA,2BAAmB,EAAC,MAAM,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC;QACvE,MAAM,MAAM,GAAG,MAAM,IAAA,2BAAmB,EACtC,KAAK,EACL,IAAA,+BAAc,EAAC,MAAM,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CACrC,CAAC;QAEF,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACnC,IAAI,CAAC,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CACb,yFAAyF,CAC1F,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,GAAG,IAAI;YACd,CAAC,CAAC,CAAC,MAAM,IAAA,mBAAQ,EAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;YAC1C,CAAC,CAAC,MAAM,IAAA,qBAAS,GAAE,CAAC;QACtB,MAAM,QAAQ,GAAG,IAAA,YAAK,EAAC,GAAG,CAAoB,CAAC;QAC/C,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC9C,MAAM,IAAI,KAAK,CACb,qFAAqF,CACtF,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,IAAA,+BAAoB,EAAC,QAAQ,EAAE,MAAM,EAAE;YACtD,eAAe,EAAE,KAAK;SACvB,CAAC,CAAC;QACH,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CACb,8CAA8C;gBAC5C,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CACzD,CAAC;QACJ,CAAC;QAED,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,IAAA,+BAAoB,EAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACnE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,GAAG,CAAC,GAAG,CAAC,uCAAuC,CAAC,CAAC;YACjD,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC;QACtD,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,GAAG,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;YAClC,OAAO;QACT,CAAC;QAED,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QAC3B,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,GAAG,EAAE,aAAa,EAAE,OAAO,EAAE,EAAE,EAAE,CACjD,GAAG,CAAC,GAAG,CACL,OAAO,GAAG,IAAI,aAAa,KAAK,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAClE,CACF,CAAC;QACF,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QACpD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;QAC3B,CAAC;QAED,MAAM,IAAA,gCAAqB,EAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACzC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACtB,CAAC;CACF,CAAC,CAAC"}
+{"version":3,"file":"commandSecretsPush.js","sourceRoot":"","sources":["../../../../../../../src/commands/project/secrets/commandSecretsPush.ts"],"names":[],"mappings":";;;AAAA,uCAAoC;AACpC,+BAA6B;AAC7B,+DAA4D;AAC5D,wDAAqD;AACrD,8CAAyD;AAEzD,yCAAwE;AACxE,mCAIiB;AACjB,qDAAkD;AAErC,QAAA,kBAAkB,GAAG,IAAA,6BAAa,EAAC;IAC9C,IAAI,EAAE,sBAAsB;IAC5B,WAAW,EACT,yGAAyG;IAC3G,KAAK,EAAE,SAAS;IAChB,MAAM,EAAE;QACN,YAAY,EAAE;YACZ,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,gEAAgE;YACzE,UAAU,EAAE,IAAI;YAChB,QAAQ,EAAE,KAAK;YACf,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC,IAAA,2BAAmB,GAAE;SAC3C;QACD,GAAG,EAAE;YACH,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,iDAAiD;YAC1D,QAAQ,EAAE,KAAK;SAChB;QACD,IAAI,EAAE;YACJ,IAAI,EAAE,QAAQ;YACd,OAAO,EACL,sEAAsE;YACxE,QAAQ,EAAE,KAAK;SAChB;KACF;IACD,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACrB,MAAM,KAAK,GAAG,MAAM,IAAA,2BAAmB,EAAC,MAAM,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC;QACvE,MAAM,MAAM,GAAG,MAAM,IAAA,2BAAmB,EACtC,KAAK,EACL,IAAA,+BAAc,EAAC,MAAM,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CACrC,CAAC;QAEF,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACnC,IAAI,CAAC,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CACb,yFAAyF,CAC1F,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,GAAG,IAAI;YACd,CAAC,CAAC,CAAC,MAAM,IAAA,mBAAQ,EAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;YAC1C,CAAC,CAAC,MAAM,IAAA,qBAAS,GAAE,CAAC;QACtB,MAAM,QAAQ,GAAG,IAAA,YAAK,EAAC,GAAG,CAAoB,CAAC;QAC/C,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC9C,MAAM,IAAI,KAAK,CACb,qFAAqF,CACtF,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,IAAA,+BAAoB,EAAC,QAAQ,EAAE,MAAM,EAAE;YACtD,eAAe,EAAE,KAAK;SACvB,CAAC,CAAC;QACH,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CACb,8CAA8C;gBAC5C,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CACzD,CAAC;QACJ,CAAC;QAED,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,IAAA,+BAAoB,EAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACnE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,GAAG,CAAC,GAAG,CAAC,uCAAuC,CAAC,CAAC;YACjD,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC;QACtD,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,GAAG,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;YAClC,OAAO;QACT,CAAC;QAED,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QAC3B,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,GAAG,EAAE,aAAa,EAAE,OAAO,EAAE,EAAE,EAAE,CACjD,GAAG,CAAC,GAAG,CACL,OAAO,GAAG,IAAI,aAAa,KAAK,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAClE,CACF,CAAC;QACF,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QACpD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;QAC3B,CAAC;QAED,MAAM,IAAA,+BAAqB,EAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACzC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACtB,CAAC;CACF,CAAC,CAAC"}

package/dist/apps/cli/src/commands/project/secrets/commandSecretsSet.js

@@ -4,7 +4,7 @@ exports.commandSecretsSet = void 0;
 const fs_extra_1 = require("fs-extra");
 const defineCommand_1 = require("../../../core/defineCommand");
 const readStdin_1 = require("../../../utils/readStdin");
-const document_1 = require("./document");
+const secrets_1 = require("../../../secrets");
 const scope_1 = require("./scope");
 const resolveValue = async (io, value, valueFile) => {
     if (valueFile) {
@@ -75,7 +75,7 @@ exports.commandSecretsSet = (0, defineCommand_1.defineCommand)({
             componentName,
             secrets: { [key]: value },
         }));
-        await (0, document_1.writeSecretsAndMirror)(ctx, writes);
+        await (0, secrets_1.writeSecretsAndMirror)(ctx, writes);
         ctx.log("done! 😻");
     },
 });

package/dist/apps/cli/src/commands/project/secrets/commandSecretsSet.js.map

@@ -1 +1 @@
-{"version":3,"file":"commandSecretsSet.js","sourceRoot":"","sources":["../../../../../../../src/commands/project/secrets/commandSecretsSet.ts"],"names":[],"mappings":";;;AAAA,uCAAoC;AACpC,+DAA4D;AAE5D,wDAAqD;AAErD,yCAAmD;AACnD,mCAIiB;AAEjB,MAAM,YAAY,GAAG,KAAK,EACxB,EAAM,EACN,KAAyB,EACzB,SAA6B,EACZ,EAAE;IACnB,IAAI,SAAS,EAAE,CAAC;QACd,wDAAwD;QACxD,OAAO,CAAC,MAAM,IAAA,mBAAQ,EAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACzB,OAAO,CAAC,MAAM,IAAA,qBAAS,GAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,EAAE,CAAC,YAAY,CAAC;QACrB,IAAI,EAAE,OAAO;QACb,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,OAAO;KACjB,CAAC,CAAC;AACL,CAAC,CAAC;AAEW,QAAA,iBAAiB,GAAG,IAAA,6BAAa,EAAC;IAC7C,IAAI,EAAE,qBAAqB;IAC3B,WAAW,EACT,gJAAgJ;IAClJ,KAAK,EAAE,SAAS;IAChB,MAAM,EAAE;QACN,YAAY,EAAE;YACZ,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,2CAA2C;YACpD,UAAU,EAAE,IAAI;YAChB,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC,IAAA,2BAAmB,GAAE;SAC3C;QACD,GAAG,EAAE;YACH,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,eAAe;YACxB,UAAU,EAAE,IAAI;YAChB,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;gBACrB,MAAM,KAAK,GAAG,MAAM,IAAA,2BAAmB,EAAC,MAAM,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC;gBACvE,MAAM,MAAM,GAAG,MAAM,IAAA,2BAAmB,EAAC,KAAK,CAAC,CAAC;gBAChD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC1D,CAAC;SACF;QACD,KAAK,EAAE;YACL,IAAI,EAAE,QAAQ;YACd,OAAO,EACL,oEAAoE;YACtE,QAAQ,EAAE,KAAK;SAChB;QACD,SAAS,EAAE;YACT,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,sCAAsC;YAC/C,QAAQ,EAAE,KAAK;SAChB;KACF;IACD,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACrB,MAAM,KAAK,GAAG,MAAM,IAAA,2BAAmB,EAAC,MAAM,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC;QACvE,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACjC,8DAA8D;QAC9D,kDAAkD;QAClD,MAAM,MAAM,GAAG,MAAM,IAAA,2BAAmB,EAAC,KAAK,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACvD,MAAM,KAAK,GAAG,MAAM,YAAY,CAC9B,GAAG,EACH,MAAM,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,EACtB,MAAM,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAC3B,CAAC;QAEF,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CACxB,CAAC,EAAE,GAAG,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,GAAG,GAAG,IAAI,aAAa,EAAE,CACtD,CAAC;QACF,GAAG,CAAC,GAAG,CAAC,WAAW,GAAG,QAAQ,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACpD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,OAAO,CACjC,2BAA2B,OAAO,CAAC,MAAM,mBAAmB,CAC7D,CAAC;YACF,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;YAC3B,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAAmB,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,CAAC;YACrE,GAAG;YACH,aAAa;YACb,OAAO,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE;SAC1B,CAAC,CAAC,CAAC;QACJ,MAAM,IAAA,gCAAqB,EAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACzC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACtB,CAAC;CACF,CAAC,CAAC"}
+{"version":3,"file":"commandSecretsSet.js","sourceRoot":"","sources":["../../../../../../../src/commands/project/secrets/commandSecretsSet.ts"],"names":[],"mappings":";;;AAAA,uCAAoC;AACpC,+DAA4D;AAE5D,wDAAqD;AAErD,8CAAyD;AACzD,mCAIiB;AAEjB,MAAM,YAAY,GAAG,KAAK,EACxB,EAAM,EACN,KAAyB,EACzB,SAA6B,EACZ,EAAE;IACnB,IAAI,SAAS,EAAE,CAAC;QACd,wDAAwD;QACxD,OAAO,CAAC,MAAM,IAAA,mBAAQ,EAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACzB,OAAO,CAAC,MAAM,IAAA,qBAAS,GAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,EAAE,CAAC,YAAY,CAAC;QACrB,IAAI,EAAE,OAAO;QACb,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,OAAO;KACjB,CAAC,CAAC;AACL,CAAC,CAAC;AAEW,QAAA,iBAAiB,GAAG,IAAA,6BAAa,EAAC;IAC7C,IAAI,EAAE,qBAAqB;IAC3B,WAAW,EACT,gJAAgJ;IAClJ,KAAK,EAAE,SAAS;IAChB,MAAM,EAAE;QACN,YAAY,EAAE;YACZ,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,2CAA2C;YACpD,UAAU,EAAE,IAAI;YAChB,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC,IAAA,2BAAmB,GAAE;SAC3C;QACD,GAAG,EAAE;YACH,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,eAAe;YACxB,UAAU,EAAE,IAAI;YAChB,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;gBACrB,MAAM,KAAK,GAAG,MAAM,IAAA,2BAAmB,EAAC,MAAM,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC;gBACvE,MAAM,MAAM,GAAG,MAAM,IAAA,2BAAmB,EAAC,KAAK,CAAC,CAAC;gBAChD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC1D,CAAC;SACF;QACD,KAAK,EAAE;YACL,IAAI,EAAE,QAAQ;YACd,OAAO,EACL,oEAAoE;YACtE,QAAQ,EAAE,KAAK;SAChB;QACD,SAAS,EAAE;YACT,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,sCAAsC;YAC/C,QAAQ,EAAE,KAAK;SAChB;KACF;IACD,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACrB,MAAM,KAAK,GAAG,MAAM,IAAA,2BAAmB,EAAC,MAAM,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC;QACvE,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACjC,8DAA8D;QAC9D,kDAAkD;QAClD,MAAM,MAAM,GAAG,MAAM,IAAA,2BAAmB,EAAC,KAAK,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACvD,MAAM,KAAK,GAAG,MAAM,YAAY,CAC9B,GAAG,EACH,MAAM,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,EACtB,MAAM,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAC3B,CAAC;QAEF,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CACxB,CAAC,EAAE,GAAG,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,GAAG,GAAG,IAAI,aAAa,EAAE,CACtD,CAAC;QACF,GAAG,CAAC,GAAG,CAAC,WAAW,GAAG,QAAQ,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACpD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,OAAO,CACjC,2BAA2B,OAAO,CAAC,MAAM,mBAAmB,CAC7D,CAAC;YACF,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;YAC3B,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAAmB,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,CAAC;YACrE,GAAG;YACH,aAAa;YACb,OAAO,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE;SAC1B,CAAC,CAAC,CAAC;QACJ,MAAM,IAAA,+BAAqB,EAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACzC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACtB,CAAC;CACF,CAAC,CAAC"}

package/dist/apps/cli/src/commands/project/secrets/document.d.ts

@@ -1,4 +1,5 @@
 import type { IO } from "../../../core/types";
+import type { SecretsWrite } from "../../../secrets";
 import type { ScopedSecretKeys } from "./scope";
 /** placeholder for secrets that have no value in the vault yet */
 export declare const FILL_ME = "\uD83D\uDEA8 FILL ME";
@@ -11,12 +12,6 @@ export type SecretsDocument = {
         [env: string]: Record<string, unknown>;
     };
 };
-/** secrets of one env of one component, ready to be written */
-export type SecretsWrite = {
-    env: string;
-    componentName: string;
-    secrets: Record<string, unknown>;
-};
 /**
  * builds the document for the given scope with the current values from
  * the vault; unset secrets appear as the FILL_ME placeholder
@@ -39,9 +34,3 @@ export declare const collectSecretsWrites: (document: SecretsDocument, scoped: S
     writes: SecretsWrite[];
     skipped: string[];
 };
-/**
- * writes secrets to the vault (the source of truth) and mirrors them
- * to every enabled CI backend — which backends exist is invisible to
- * the caller
- */
-export declare const writeSecretsAndMirror: (io: IO, writes: SecretsWrite[]) => Promise<void>;

package/dist/apps/cli/src/commands/project/secrets/document.js

@@ -1,11 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.writeSecretsAndMirror = exports.collectSecretsWrites = exports.checkSecretsDocument = exports.buildSecretsDocument = exports.FILL_ME = void 0;
+exports.collectSecretsWrites = exports.checkSecretsDocument = exports.buildSecretsDocument = exports.FILL_ME = void 0;
 const pipeline_1 = require("../../../../../../packages/pipeline/src/index.js");
-const getProjectConfig_1 = require("../../../config/getProjectConfig");
-const github_1 = require("../../../utils/github");
-const gitlab_1 = require("../../../utils/gitlab");
-const commandSecretsSyncGithub_1 = require("../commandSecretsSyncGithub");
 /** placeholder for secrets that have no value in the vault yet */
 exports.FILL_ME = "🚨 FILL ME";
 /* for convenience, parse json values. that makes it easier to edit secrets that are objects */
@@ -103,78 +99,4 @@ const collectSecretsWrites = (document, scoped) => {
     return { writes, skipped };
 };
 exports.collectSecretsWrites = collectSecretsWrites;
-/**
- * writes secrets to the vault (the source of truth) and mirrors them
- * to every enabled CI backend — which backends exist is invisible to
- * the caller
- */
-const writeSecretsAndMirror = async (io, writes) => {
-    const config = await (0, getProjectConfig_1.getProjectConfig)();
-    if (!config) {
-        throw new Error("no catladder config found");
-    }
-    io.log("");
-    io.log("writing secrets to the vault, please wait...");
-    io.log("");
-    for (const { env, componentName, secrets } of writes) {
-        io.log("writing " + env + ":" + componentName + "...\n");
-        await (await io.getVaultManager()).writeSecrets(env, componentName, secrets);
-        io.log("");
-        io.log("✅ " + env + ":" + componentName);
-        io.log("--------------------------------\n");
-    }
-    await mirrorSecretsToCiBackends(io, config, writes);
-};
-exports.writeSecretsAndMirror = writeSecretsAndMirror;
-/**
- * the vault is the source of truth; every enabled CI backend receives
- * a mirrored copy of the written secrets (gitlab variables, github
- * secrets), so all CI systems stay in sync
- */
-const mirrorSecretsToCiBackends = async (io, config, writes) => {
-    const enabled = (0, pipeline_1.getEnabledPipelineTypes)(config);
-    // gitlab mirror (unless gitlab is the vault itself, then it is
-    // already written)
-    if ((0, pipeline_1.getVaultConfig)(config).type !== "gitlab" && enabled.includes("gitlab")) {
-        for (const { env, componentName, secrets } of writes) {
-            await (0, gitlab_1.upsertAllVariables)(io, secrets, env, componentName);
-        }
-        io.log("✅ mirrored to gitlab");
-    }
-    if (!enabled.includes("github")) {
-        return;
-    }
-    const kinds = new Map();
-    for (const { env, componentName } of writes) {
-        const { secretEnvVarKeys, jobOnlyVars } = await (0, getProjectConfig_1.getEnvironment)(env, componentName);
-        [
-            ...secretEnvVarKeys,
-            ...jobOnlyVars.build.secretEnvVarKeys,
-            ...jobOnlyVars.deploy.secretEnvVarKeys,
-        ].forEach(({ key, kind }) => kinds.set((0, pipeline_1.getSecretVarName)(env, componentName, key), kind !== null && kind !== void 0 ? kind : "secret"));
-    }
-    const secrets = writes.flatMap(({ env, componentName, secrets }) => Object.entries(secrets).map(([key, value]) => {
-        var _a;
-        const name = (0, pipeline_1.getSecretVarName)(env, componentName, key);
-        return {
-            name,
-            value: typeof value === "string" ? value : JSON.stringify(value !== null && value !== void 0 ? value : ""),
-            kind: (_a = kinds.get(name)) !== null && _a !== void 0 ? _a : "secret",
-        };
-    }));
-    if (secrets.length === 0) {
-        return;
-    }
-    if (!(await (0, github_1.isGhAuthenticated)())) {
-        io.log("⚠️ github pipeline is enabled, but the github cli (gh) is not authenticated — run `project secrets-sync-github` later to mirror the secrets");
-        return;
-    }
-    const repo = await (0, commandSecretsSyncGithub_1.getConfiguredGithubRepo)();
-    if (!repo) {
-        io.log("⚠️ github pipeline is enabled, but no github repository was found — run `project secrets-sync-github` later to mirror the secrets");
-        return;
-    }
-    io.log(`mirroring ${secrets.length} secrets to github ('${repo}')...`);
-    await (0, commandSecretsSyncGithub_1.pushSecretsToGithub)(io, repo, secrets, await (0, commandSecretsSyncGithub_1.collectSecretTargets)(config));
-};
 //# sourceMappingURL=document.js.map

package/dist/apps/cli/src/commands/project/secrets/document.js.map

@@ -1 +1 @@
-{"version":3,"file":"document.js","sourceRoot":"","sources":["../../../../../../../src/commands/project/secrets/document.ts"],"names":[],"mappings":";;;AACA,kDAI6B;AAC7B,uEAG0C;AAE1C,kDAA0D;AAC1D,kDAA2D;AAC3D,0EAIqC;AAGrC,kEAAkE;AACrD,QAAA,OAAO,GAAG,YAAY,CAAC;AAmBpC,+FAA+F;AAC/F,MAAM,cAAc,GAAG,CAAC,KAAa,EAAW,EAAE;IAChD,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC,CAAC;AAEF;;;GAGG;AACI,MAAM,oBAAoB,GAAG,KAAK,EACvC,EAAM,EACN,MAAwB,EACE,EAAE;;IAC5B,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,GAAG,EAAE,aAAa,EAAE,IAAI,EAAE,EAAE,EAAE,CAC5D,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAA,2BAAgB,EAAC,GAAG,EAAE,aAAa,EAAE,GAAG,CAAC,CAAC,CAC7D,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,eAAe,EAAE,CAAC,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAEzE,MAAM,QAAQ,GAAoB,EAAE,CAAC;IACrC,KAAK,MAAM,EAAE,GAAG,EAAE,aAAa,EAAE,IAAI,EAAE,IAAI,MAAM,EAAE,CAAC;QAClD,MAAA,QAAQ,CAAC,aAAa,qCAAtB,QAAQ,CAAC,aAAa,IAAM,EAAE,EAAC;QAC/B,QAAQ,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,WAAW,CAC/C,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;YACf,MAAM,KAAK,GAAG,MAAM,CAAC,IAAA,2BAAgB,EAAC,GAAG,EAAE,aAAa,EAAE,GAAG,CAAC,CAAC,CAAC;YAChE,OAAO,CAAC,GAAG,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,eAAO,CAAC,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC;QACtE,CAAC,CAAC,CACH,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC,CAAC;AApBW,QAAA,oBAAoB,wBAoB/B;AAEF;;;;GAIG;AACI,MAAM,oBAAoB,GAAG,CAClC,QAAyB,EACzB,MAAwB,EACxB,EAAE,eAAe,EAAgC,EACvC,EAAE;;IACZ,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,MAAM,UAAU,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC/C,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,GAAG,EAAE,aAAa,EAAE,IAAI,EAAE,EAAE,EAAE,CAC9C,UAAU,CAAC,GAAG,CAAC,GAAG,GAAG,IAAI,aAAa,EAAE,EAAE,IAAI,CAAC,CAChD,CAAC;IACF,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC;IAErE,KAAK,MAAM,CAAC,aAAa,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,aAAR,QAAQ,cAAR,QAAQ,GAAI,EAAE,CAAC,EAAE,CAAC;QACnE,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;YACzC,QAAQ,CAAC,IAAI,CACX,IAAI,aAAa,mEAAmE,CACrF,CAAC;YACF,SAAS;QACX,CAAC;QACD,KAAK,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,aAAJ,IAAI,cAAJ,IAAI,GAAI,EAAE,CAAC,EAAE,CAAC;YACxD,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,GAAG,IAAI,aAAa,EAAE,CAAC,CAAC;YACvD,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,QAAQ,CAAC,IAAI,CACX,IAAI,GAAG,IAAI,aAAa,uDAAuD,CAChF,CAAC;gBACF,SAAS;YACX,CAAC;YACD,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,aAAP,OAAO,cAAP,OAAO,GAAI,EAAE,CAAC,CAAC,MAAM,CAClD,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAC7B,CAAC;YACF,UAAU,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CACzB,QAAQ,CAAC,IAAI,CACX,IAAI,GAAG,IAAI,aAAa,OAAO,GAAG,4DAA4D,CAC/F,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,eAAe,EAAE,CAAC;QACpB,KAAK,MAAM,EAAE,GAAG,EAAE,aAAa,EAAE,IAAI,EAAE,IAAI,MAAM,EAAE,CAAC;YAClD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,MAAA,MAAA,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAG,aAAa,CAAC,0CAAG,GAAG,CAAC,mCAAI,EAAE,CAAC,CAAC;YACrE,IAAI;iBACD,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;iBACxC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CACf,QAAQ,CAAC,IAAI,CACX,IAAI,GAAG,IAAI,aAAa,OAAO,GAAG,yBAAyB,CAC5D,CACF,CAAC;QACN,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC,CAAC;AArDW,QAAA,oBAAoB,wBAqD/B;AAEF;;;;GAIG;AACI,MAAM,oBAAoB,GAAG,CAClC,QAAyB,EACzB,MAAwB,EACuB,EAAE;;IACjD,MAAM,MAAM,GAAmB,EAAE,CAAC;IAClC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,EAAE,GAAG,EAAE,aAAa,EAAE,IAAI,EAAE,IAAI,MAAM,EAAE,CAAC;QAClD,MAAM,QAAQ,GAAG,MAAA,MAAA,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAG,aAAa,CAAC,0CAAG,GAAG,CAAC,mCAAI,EAAE,CAAC;QACxD,MAAM,OAAO,GAA4B,EAAE,CAAC;QAC5C,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,CAAC,CAAC,GAAG,IAAI,QAAQ,CAAC,EAAE,CAAC;gBACvB,SAAS;YACX,CAAC;YACD,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC5B,IAAI,KAAK,KAAK,eAAO,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBAC/D,OAAO,CAAC,IAAI,CAAC,GAAG,GAAG,IAAI,aAAa,IAAI,GAAG,EAAE,CAAC,CAAC;gBAC/C,SAAS;YACX,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACvB,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpC,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;AAC7B,CAAC,CAAC;AAzBW,QAAA,oBAAoB,wBAyB/B;AAEF;;;;GAIG;AACI,MAAM,qBAAqB,GAAG,KAAK,EACxC,EAAM,EACN,MAAsB,EACP,EAAE;IACjB,MAAM,MAAM,GAAG,MAAM,IAAA,mCAAgB,GAAE,CAAC;IACxC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC/C,CAAC;IAED,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACX,EAAE,CAAC,GAAG,CAAC,8CAA8C,CAAC,CAAC;IACvD,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACX,KAAK,MAAM,EAAE,GAAG,EAAE,aAAa,EAAE,OAAO,EAAE,IAAI,MAAM,EAAE,CAAC;QACrD,EAAE,CAAC,GAAG,CAAC,UAAU,GAAG,GAAG,GAAG,GAAG,GAAG,aAAa,GAAG,OAAO,CAAC,CAAC;QACzD,MAAM,CACJ,MAAM,EAAE,CAAC,eAAe,EAAE,CAC3B,CAAC,YAAY,CAAC,GAAG,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC;QAC5C,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACX,EAAE,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,GAAG,GAAG,GAAG,aAAa,CAAC,CAAC;QACzC,EAAE,CAAC,GAAG,CAAC,oCAAoC,CAAC,CAAC;IAC/C,CAAC;IAED,MAAM,yBAAyB,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;AACtD,CAAC,CAAC;AAvBW,QAAA,qBAAqB,yBAuBhC;AAEF;;;;GAIG;AACH,MAAM,yBAAyB,GAAG,KAAK,EACrC,EAAM,EACN,MAAc,EACd,MAAsB,EACtB,EAAE;IACF,MAAM,OAAO,GAAG,IAAA,kCAAuB,EAAC,MAAM,CAAC,CAAC;IAEhD,+DAA+D;IAC/D,mBAAmB;IACnB,IAAI,IAAA,yBAAc,EAAC,MAAM,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3E,KAAK,MAAM,EAAE,GAAG,EAAE,aAAa,EAAE,OAAO,EAAE,IAAI,MAAM,EAAE,CAAC;YACrD,MAAM,IAAA,2BAAkB,EAAC,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,aAAa,CAAC,CAAC;QAC5D,CAAC;QACD,EAAE,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;IACjC,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChC,OAAO;IACT,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAiC,CAAC;IACvD,KAAK,MAAM,EAAE,GAAG,EAAE,aAAa,EAAE,IAAI,MAAM,EAAE,CAAC;QAC5C,MAAM,EAAE,gBAAgB,EAAE,WAAW,EAAE,GAAG,MAAM,IAAA,iCAAc,EAC5D,GAAG,EACH,aAAa,CACd,CAAC;QACF;YACE,GAAG,gBAAgB;YACnB,GAAG,WAAW,CAAC,KAAK,CAAC,gBAAgB;YACrC,GAAG,WAAW,CAAC,MAAM,CAAC,gBAAgB;SACvC,CAAC,OAAO,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,CAC1B,KAAK,CAAC,GAAG,CAAC,IAAA,2BAAgB,EAAC,GAAG,EAAE,aAAa,EAAE,GAAG,CAAC,EAAE,IAAI,aAAJ,IAAI,cAAJ,IAAI,GAAI,QAAQ,CAAC,CACvE,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,GAAG,EAAE,aAAa,EAAE,OAAO,EAAE,EAAE,EAAE,CACjE,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE;;QAC3C,MAAM,IAAI,GAAG,IAAA,2BAAgB,EAAC,GAAG,EAAE,aAAa,EAAE,GAAG,CAAC,CAAC;QACvD,OAAO;YACL,IAAI;YACJ,KAAK,EAAE,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,aAAL,KAAK,cAAL,KAAK,GAAI,EAAE,CAAC;YACtE,IAAI,EAAE,MAAA,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,mCAAK,QAAkB;SAC7C,CAAC;IACJ,CAAC,CAAC,CACH,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO;IACT,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,IAAA,0BAAiB,GAAE,CAAC,EAAE,CAAC;QACjC,EAAE,CAAC,GAAG,CACJ,6IAA6I,CAC9I,CAAC;QACF,OAAO;IACT,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,IAAA,kDAAuB,GAAE,CAAC;IAC7C,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,EAAE,CAAC,GAAG,CACJ,mIAAmI,CACpI,CAAC;QACF,OAAO;IACT,CAAC;IACD,EAAE,CAAC,GAAG,CAAC,aAAa,OAAO,CAAC,MAAM,wBAAwB,IAAI,OAAO,CAAC,CAAC;IACvE,MAAM,IAAA,8CAAmB,EACvB,EAAE,EACF,IAAI,EACJ,OAAO,EACP,MAAM,IAAA,+CAAoB,EAAC,MAAM,CAAC,CACnC,CAAC;AACJ,CAAC,CAAC"}
+{"version":3,"file":"document.js","sourceRoot":"","sources":["../../../../../../../src/commands/project/secrets/document.ts"],"names":[],"mappings":";;;AAAA,kDAAuD;AAKvD,kEAAkE;AACrD,QAAA,OAAO,GAAG,YAAY,CAAC;AAYpC,+FAA+F;AAC/F,MAAM,cAAc,GAAG,CAAC,KAAa,EAAW,EAAE;IAChD,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC,CAAC;AAEF;;;GAGG;AACI,MAAM,oBAAoB,GAAG,KAAK,EACvC,EAAM,EACN,MAAwB,EACE,EAAE;;IAC5B,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,GAAG,EAAE,aAAa,EAAE,IAAI,EAAE,EAAE,EAAE,CAC5D,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAA,2BAAgB,EAAC,GAAG,EAAE,aAAa,EAAE,GAAG,CAAC,CAAC,CAC7D,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,eAAe,EAAE,CAAC,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAEzE,MAAM,QAAQ,GAAoB,EAAE,CAAC;IACrC,KAAK,MAAM,EAAE,GAAG,EAAE,aAAa,EAAE,IAAI,EAAE,IAAI,MAAM,EAAE,CAAC;QAClD,MAAA,QAAQ,CAAC,aAAa,qCAAtB,QAAQ,CAAC,aAAa,IAAM,EAAE,EAAC;QAC/B,QAAQ,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,WAAW,CAC/C,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;YACf,MAAM,KAAK,GAAG,MAAM,CAAC,IAAA,2BAAgB,EAAC,GAAG,EAAE,aAAa,EAAE,GAAG,CAAC,CAAC,CAAC;YAChE,OAAO,CAAC,GAAG,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,eAAO,CAAC,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC;QACtE,CAAC,CAAC,CACH,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC,CAAC;AApBW,QAAA,oBAAoB,wBAoB/B;AAEF;;;;GAIG;AACI,MAAM,oBAAoB,GAAG,CAClC,QAAyB,EACzB,MAAwB,EACxB,EAAE,eAAe,EAAgC,EACvC,EAAE;;IACZ,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,MAAM,UAAU,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC/C,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,GAAG,EAAE,aAAa,EAAE,IAAI,EAAE,EAAE,EAAE,CAC9C,UAAU,CAAC,GAAG,CAAC,GAAG,GAAG,IAAI,aAAa,EAAE,EAAE,IAAI,CAAC,CAChD,CAAC;IACF,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC;IAErE,KAAK,MAAM,CAAC,aAAa,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,aAAR,QAAQ,cAAR,QAAQ,GAAI,EAAE,CAAC,EAAE,CAAC;QACnE,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;YACzC,QAAQ,CAAC,IAAI,CACX,IAAI,aAAa,mEAAmE,CACrF,CAAC;YACF,SAAS;QACX,CAAC;QACD,KAAK,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,aAAJ,IAAI,cAAJ,IAAI,GAAI,EAAE,CAAC,EAAE,CAAC;YACxD,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,GAAG,IAAI,aAAa,EAAE,CAAC,CAAC;YACvD,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,QAAQ,CAAC,IAAI,CACX,IAAI,GAAG,IAAI,aAAa,uDAAuD,CAChF,CAAC;gBACF,SAAS;YACX,CAAC;YACD,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,aAAP,OAAO,cAAP,OAAO,GAAI,EAAE,CAAC,CAAC,MAAM,CAClD,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAC7B,CAAC;YACF,UAAU,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CACzB,QAAQ,CAAC,IAAI,CACX,IAAI,GAAG,IAAI,aAAa,OAAO,GAAG,4DAA4D,CAC/F,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,eAAe,EAAE,CAAC;QACpB,KAAK,MAAM,EAAE,GAAG,EAAE,aAAa,EAAE,IAAI,EAAE,IAAI,MAAM,EAAE,CAAC;YAClD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,MAAA,MAAA,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAG,aAAa,CAAC,0CAAG,GAAG,CAAC,mCAAI,EAAE,CAAC,CAAC;YACrE,IAAI;iBACD,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;iBACxC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CACf,QAAQ,CAAC,IAAI,CACX,IAAI,GAAG,IAAI,aAAa,OAAO,GAAG,yBAAyB,CAC5D,CACF,CAAC;QACN,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC,CAAC;AArDW,QAAA,oBAAoB,wBAqD/B;AAEF;;;;GAIG;AACI,MAAM,oBAAoB,GAAG,CAClC,QAAyB,EACzB,MAAwB,EACuB,EAAE;;IACjD,MAAM,MAAM,GAAmB,EAAE,CAAC;IAClC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,EAAE,GAAG,EAAE,aAAa,EAAE,IAAI,EAAE,IAAI,MAAM,EAAE,CAAC;QAClD,MAAM,QAAQ,GAAG,MAAA,MAAA,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAG,aAAa,CAAC,0CAAG,GAAG,CAAC,mCAAI,EAAE,CAAC;QACxD,MAAM,OAAO,GAA4B,EAAE,CAAC;QAC5C,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,CAAC,CAAC,GAAG,IAAI,QAAQ,CAAC,EAAE,CAAC;gBACvB,SAAS;YACX,CAAC;YACD,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC5B,IAAI,KAAK,KAAK,eAAO,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBAC/D,OAAO,CAAC,IAAI,CAAC,GAAG,GAAG,IAAI,aAAa,IAAI,GAAG,EAAE,CAAC,CAAC;gBAC/C,SAAS;YACX,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACvB,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpC,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;AAC7B,CAAC,CAAC;AAzBW,QAAA,oBAAoB,wBAyB/B"}

package/dist/apps/cli/src/gcloud/serviceAccounts.js

@@ -2,7 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.upsertGcloudServiceAccountAndSaveSecret = exports.accountExists = void 0;
 const child_process_promise_1 = require("child-process-promise");
-const gitlab_1 = require("../utils/gitlab");
+const secrets_1 = require("../secrets");
 const serviceAccountNames_1 = require("./serviceAccountNames");
 const accountExists = async (fullIdentifier) => {
     try {
@@ -39,9 +39,20 @@ const upsertGcloudServiceAccount = async (context, account) => {
 const upsertGcloudServiceAccountAndSaveSecret = async (instance, context, account, secretName) => {
     instance.log("upserting service account " + account.name + "...");
     const key = await upsertGcloudServiceAccount(context, account);
-    await (0, gitlab_1.upsertAllVariables)(instance, {
-        [secretName]: key,
-    }, context.env, context.name);
+    // through the vault (and from there to every enabled ci backend) —
+    // the key is a secret like any other, the deploy jobs read it under
+    // its declared name. Writing it to gitlab directly would break every
+    // project that has no gitlab.
+    await (0, secrets_1.writeSecretsAndMirror)(instance, [
+        {
+            env: context.env,
+            componentName: context.name,
+            secrets: { [secretName]: key },
+        },
+    ], 
+    // a fresh key is created on every run, the previous one is deleted
+    // at google — a backup copy of it would only be a dead secret
+    { backup: false });
     instance.log("done!");
 };
 exports.upsertGcloudServiceAccountAndSaveSecret = upsertGcloudServiceAccountAndSaveSecret;

package/dist/apps/cli/src/gcloud/serviceAccounts.js.map

@@ -1 +1 @@
-{"version":3,"file":"serviceAccounts.js","sourceRoot":"","sources":["../../../../../src/gcloud/serviceAccounts.ts"],"names":[],"mappings":";;;AAEA,iEAA6C;AAE7C,4CAAqD;AACrD,+DAAqE;AAE9D,MAAM,aAAa,GAAG,KAAK,EAAE,cAAsB,EAAE,EAAE;IAC5D,IAAI,CAAC;QACH,MAAM,IAAA,4BAAI,EAAC,wCAAwC,cAAc,EAAE,CAAC,CAAC;QACrE,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,WAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC,CAAC;AAPW,QAAA,aAAa,iBAOxB;AASF,MAAM,0BAA0B,GAAG,KAAK,EACtC,OAAyB,EACzB,OAAuB,EACN,EAAE;IACnB,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC;IAE/D,MAAM,EAAE,QAAQ,EAAE,cAAc,EAAE,GAAG,IAAA,kDAA4B,EAC/D,OAAO,EACP,OAAO,CACR,CAAC;IAEF,MAAM,eAAe,GAAG,GAAG,OAAO,CAAC,UAAU,CAAC,YAAY,IAAI,OAAO,CAAC,UAAU,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,IAAI,MAAM,WAAW,EAAE,CAAC;IAE3I,MAAM,QAAQ,GAAG,MAAM,IAAA,qBAAa,EAAC,cAAc,CAAC,CAAC;IAErD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAA,4BAAI,EACR,sCAAsC,QAAQ,oBAAoB,eAAe,gBAAgB,SAAS,qBAAqB,WAAW,GAAG,CAC9I,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,kBAAkB,cAAc,EAAE,CAAC;IACtD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,IAAA,4BAAI,EACR,0CAA0C,SAAS,aAAa,UAAU,WAAW,IAAI,mBAAmB,CAC7G,CAAC;IACJ,CAAC;IAED,aAAa;IAEb,wBAAwB;IACxB,MAAM,IAAI,GAAG,MAAM,IAAA,4BAAI,EACrB,uDAAuD,cAAc,kCAAkC,CACxG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IAEpC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,IAAA,4BAAI,EACR,2CAA2C,GAAG,CAAC,IAAI,0BAA0B,cAAc,EAAE,CAC9F,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,IAAA,4BAAI;IACf,kEAAkE;IAClE,qEAAqE,cAAc,QAAQ,CAC5F,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;AAC1B,CAAC,CAAC;AAEK,MAAM,uCAAuC,GAAG,KAAK,EAC1D,QAAY,EACZ,OAAyB,EACzB,OAAuB,EACvB,UAAkB,EACH,EAAE;IACjB,QAAQ,CAAC,GAAG,CAAC,4BAA4B,GAAG,OAAO,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC;IAClE,MAAM,GAAG,GAAG,MAAM,0BAA0B,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAE/D,MAAM,IAAA,2BAAkB,EACtB,QAAQ,EACR;QACE,CAAC,UAAU,CAAC,EAAE,GAAG;KAClB,EACD,OAAO,CAAC,GAAG,EACX,OAAO,CAAC,IAAI,CACb,CAAC;IACF,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AACxB,CAAC,CAAC;AAlBW,QAAA,uCAAuC,2CAkBlD"}
+{"version":3,"file":"serviceAccounts.js","sourceRoot":"","sources":["../../../../../src/gcloud/serviceAccounts.ts"],"names":[],"mappings":";;;AAEA,iEAA6C;AAE7C,wCAAmD;AACnD,+DAAqE;AAE9D,MAAM,aAAa,GAAG,KAAK,EAAE,cAAsB,EAAE,EAAE;IAC5D,IAAI,CAAC;QACH,MAAM,IAAA,4BAAI,EAAC,wCAAwC,cAAc,EAAE,CAAC,CAAC;QACrE,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,WAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC,CAAC;AAPW,QAAA,aAAa,iBAOxB;AASF,MAAM,0BAA0B,GAAG,KAAK,EACtC,OAAyB,EACzB,OAAuB,EACN,EAAE;IACnB,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC;IAE/D,MAAM,EAAE,QAAQ,EAAE,cAAc,EAAE,GAAG,IAAA,kDAA4B,EAC/D,OAAO,EACP,OAAO,CACR,CAAC;IAEF,MAAM,eAAe,GAAG,GAAG,OAAO,CAAC,UAAU,CAAC,YAAY,IAAI,OAAO,CAAC,UAAU,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,IAAI,MAAM,WAAW,EAAE,CAAC;IAE3I,MAAM,QAAQ,GAAG,MAAM,IAAA,qBAAa,EAAC,cAAc,CAAC,CAAC;IAErD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAA,4BAAI,EACR,sCAAsC,QAAQ,oBAAoB,eAAe,gBAAgB,SAAS,qBAAqB,WAAW,GAAG,CAC9I,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,kBAAkB,cAAc,EAAE,CAAC;IACtD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,IAAA,4BAAI,EACR,0CAA0C,SAAS,aAAa,UAAU,WAAW,IAAI,mBAAmB,CAC7G,CAAC;IACJ,CAAC;IAED,aAAa;IAEb,wBAAwB;IACxB,MAAM,IAAI,GAAG,MAAM,IAAA,4BAAI,EACrB,uDAAuD,cAAc,kCAAkC,CACxG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IAEpC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,IAAA,4BAAI,EACR,2CAA2C,GAAG,CAAC,IAAI,0BAA0B,cAAc,EAAE,CAC9F,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,IAAA,4BAAI;IACf,kEAAkE;IAClE,qEAAqE,cAAc,QAAQ,CAC5F,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;AAC1B,CAAC,CAAC;AAEK,MAAM,uCAAuC,GAAG,KAAK,EAC1D,QAAY,EACZ,OAAyB,EACzB,OAAuB,EACvB,UAAkB,EACH,EAAE;IACjB,QAAQ,CAAC,GAAG,CAAC,4BAA4B,GAAG,OAAO,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC;IAClE,MAAM,GAAG,GAAG,MAAM,0BAA0B,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAE/D,mEAAmE;IACnE,oEAAoE;IACpE,qEAAqE;IACrE,8BAA8B;IAC9B,MAAM,IAAA,+BAAqB,EACzB,QAAQ,EACR;QACE;YACE,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,aAAa,EAAE,OAAO,CAAC,IAAI;YAC3B,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,GAAG,EAAE;SAC/B;KACF;IACD,mEAAmE;IACnE,8DAA8D;IAC9D,EAAE,MAAM,EAAE,KAAK,EAAE,CAClB,CAAC;IACF,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AACxB,CAAC,CAAC;AA3BW,QAAA,uCAAuC,2CA2BlD"}

package/dist/apps/cli/src/secrets/github.d.ts

@@ -0,0 +1,41 @@
+import type { Config } from "../../../../packages/pipeline/src/index.js";
+import type { IO } from "../core/types";
+/**
+ * all secrets declared in the config, with their values read from the
+ * vault (github secrets are write-only and can never act as a source)
+ */
+export declare const collectSecretsFromVault: (io: IO, envFilter?: string[]) => Promise<{
+    secrets: {
+        name: string;
+        value: string;
+        kind: "secret" | "variable";
+    }[];
+    missing: string[];
+}>;
+/**
+ * derives which github environment(s) each secret/variable must live in
+ * by scanning the GENERATED workflows: a `${{ secrets.X }}` / `${{
+ * vars.X }}` reference in a job's env targets that job's environment
+ * (or the repo level when the job has none). Deriving from the real
+ * output means the sync can never drift from what the workflows expect.
+ *
+ * Environment secrets are the answer to github's cap of 100 secrets
+ * per REPO (a multi-env project easily exceeds it): the cap applies
+ * per environment instead.
+ */
+export declare const collectSecretTargets: (config: Config) => Promise<Map<string, Set<string>>>;
+/**
+ * pushes vault values to github via the gh cli: sensitive ones as
+ * secrets (masked), "variable"-kind ones as variables (plain) — each
+ * into the environment(s) whose jobs reference them
+ */
+export declare const pushSecretsToGithub: (io: IO, repo: string, secrets: {
+    name: string;
+    value: string;
+    kind: "secret" | "variable";
+}[], targets: Map<string, Set<string>>) => Promise<void>;
+/**
+ * resolves the github repository from the configured git remote
+ * (`pipelines.github.gitRemote`, defaults to origin)
+ */
+export declare const getConfiguredGithubRepo: () => Promise<string | undefined>;

package/dist/apps/cli/src/secrets/github.js

@@ -0,0 +1,127 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getConfiguredGithubRepo = exports.pushSecretsToGithub = exports.collectSecretTargets = exports.collectSecretsFromVault = void 0;
+const pipeline_1 = require("../../../../packages/pipeline/src/index.js");
+const getProjectConfig_1 = require("../config/getProjectConfig");
+const github_1 = require("../utils/github");
+/**
+ * all secrets declared in the config, with their values read from the
+ * vault (github secrets are write-only and can never act as a source)
+ */
+const collectSecretsFromVault = async (io, envFilter) => {
+    const envAndComponents = await (0, getProjectConfig_1.getAllComponentsWithAllEnvsHierarchical)();
+    const kinds = new Map();
+    for (const [componentName, envs] of Object.entries(envAndComponents)) {
+        for (const env of envs) {
+            if (envFilter && !envFilter.includes(env)) {
+                continue;
+            }
+            const { secretEnvVarKeys, jobOnlyVars } = await (0, getProjectConfig_1.getEnvironment)(env, componentName);
+            const keys = [
+                ...secretEnvVarKeys,
+                ...jobOnlyVars.build.secretEnvVarKeys,
+                ...jobOnlyVars.deploy.secretEnvVarKeys,
+            ];
+            keys.forEach(({ key, kind }) => kinds.set((0, pipeline_1.getSecretVarName)(env, componentName, key), kind !== null && kind !== void 0 ? kind : "secret"));
+        }
+    }
+    const names = [...kinds.keys()];
+    const values = await (await io.getVaultManager()).readSecrets(names, io);
+    const secrets = names
+        .filter((name) => values[name] !== undefined)
+        .map((name) => {
+        var _a;
+        return ({
+            name,
+            value: values[name],
+            kind: (_a = kinds.get(name)) !== null && _a !== void 0 ? _a : "secret",
+        });
+    });
+    const missing = names.filter((name) => values[name] === undefined);
+    return { secrets, missing };
+};
+exports.collectSecretsFromVault = collectSecretsFromVault;
+/** marker for repo-level (environment-less) targets */
+const REPO_LEVEL = "";
+/**
+ * derives which github environment(s) each secret/variable must live in
+ * by scanning the GENERATED workflows: a `${{ secrets.X }}` / `${{
+ * vars.X }}` reference in a job's env targets that job's environment
+ * (or the repo level when the job has none). Deriving from the real
+ * output means the sync can never drift from what the workflows expect.
+ *
+ * Environment secrets are the answer to github's cap of 100 secrets
+ * per REPO (a multi-env project easily exceeds it): the cap applies
+ * per environment instead.
+ */
+const collectSecretTargets = async (config) => {
+    var _a;
+    const workflows = await new pipeline_1.GithubBackend().createWorkflows(config);
+    const targets = new Map();
+    for (const workflow of Object.values(workflows)) {
+        for (const job of Object.values(workflow.jobs)) {
+            const environment = typeof job.environment === "object"
+                ? job.environment.name
+                : job.environment;
+            for (const value of Object.values((_a = job.env) !== null && _a !== void 0 ? _a : {})) {
+                if (typeof value !== "string")
+                    continue;
+                for (const match of value.matchAll(/\$\{\{\s*(?:secrets|vars)\.([A-Za-z0-9_]+)\s*\}\}/g)) {
+                    const name = match[1];
+                    if (!targets.has(name)) {
+                        targets.set(name, new Set());
+                    }
+                    targets.get(name).add(environment !== null && environment !== void 0 ? environment : REPO_LEVEL);
+                }
+            }
+        }
+    }
+    return targets;
+};
+exports.collectSecretTargets = collectSecretTargets;
+/**
+ * pushes vault values to github via the gh cli: sensitive ones as
+ * secrets (masked), "variable"-kind ones as variables (plain) — each
+ * into the environment(s) whose jobs reference them
+ */
+const pushSecretsToGithub = async (io, repo, secrets, targets) => {
+    const environments = [
+        ...new Set([...targets.values()].flatMap((envs) => [...envs].filter((env) => env !== REPO_LEVEL))),
+    ];
+    for (const environment of environments) {
+        await (0, github_1.ensureGithubEnvironment)(repo, environment);
+        io.log(`🌍 environment ${environment}`);
+    }
+    for (const { name, value, kind } of secrets) {
+        const envs = targets.get(name);
+        if (!envs) {
+            io.log(`⏭️ ${name} (not referenced by any generated workflow)`);
+            continue;
+        }
+        for (const environment of envs) {
+            const suffix = environment === REPO_LEVEL ? "" : ` → ${environment}`;
+            if (kind === "variable") {
+                await (0, github_1.setGithubVariable)(repo, name, value, environment || undefined);
+                io.log(`📖 ${name} (variable)${suffix}`);
+            }
+            else {
+                await (0, github_1.setGithubSecret)(repo, name, value, environment || undefined);
+                io.log(`✅ ${name}${suffix}`);
+            }
+        }
+    }
+};
+exports.pushSecretsToGithub = pushSecretsToGithub;
+/**
+ * resolves the github repository from the configured git remote
+ * (`pipelines.github.gitRemote`, defaults to origin)
+ */
+const getConfiguredGithubRepo = async () => {
+    const config = await (0, getProjectConfig_1.getProjectConfig)();
+    if (!config) {
+        return undefined;
+    }
+    return (0, github_1.getGithubRepoFromRemote)((0, pipeline_1.getPipelineGitRemote)(config, "github"));
+};
+exports.getConfiguredGithubRepo = getConfiguredGithubRepo;
+//# sourceMappingURL=github.js.map

package/dist/apps/cli/src/secrets/github.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"github.js","sourceRoot":"","sources":["../../../../../src/secrets/github.ts"],"names":[],"mappings":";;;AACA,kDAI6B;AAC7B,iEAIoC;AAEpC,4CAKyB;AAEzB;;;GAGG;AACI,MAAM,uBAAuB,GAAG,KAAK,EAAE,EAAM,EAAE,SAAoB,EAAE,EAAE;IAC5E,MAAM,gBAAgB,GAAG,MAAM,IAAA,0DAAuC,GAAE,CAAC;IAEzE,MAAM,KAAK,GAAG,IAAI,GAAG,EAAiC,CAAC;IACvD,KAAK,MAAM,CAAC,aAAa,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACrE,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,SAAS,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC1C,SAAS;YACX,CAAC;YACD,MAAM,EAAE,gBAAgB,EAAE,WAAW,EAAE,GAAG,MAAM,IAAA,iCAAc,EAC5D,GAAG,EACH,aAAa,CACd,CAAC;YACF,MAAM,IAAI,GAAG;gBACX,GAAG,gBAAgB;gBACnB,GAAG,WAAW,CAAC,KAAK,CAAC,gBAAgB;gBACrC,GAAG,WAAW,CAAC,MAAM,CAAC,gBAAgB;aACvC,CAAC;YACF,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,CAC7B,KAAK,CAAC,GAAG,CAAC,IAAA,2BAAgB,EAAC,GAAG,EAAE,aAAa,EAAE,GAAG,CAAC,EAAE,IAAI,aAAJ,IAAI,cAAJ,IAAI,GAAI,QAAQ,CAAC,CACvE,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAG,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IAChC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,eAAe,EAAE,CAAC,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACzE,MAAM,OAAO,GAAG,KAAK;SAClB,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC;SAC5C,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;;QAAC,OAAA,CAAC;YACd,IAAI;YACJ,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC;YACnB,IAAI,EAAE,MAAA,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,mCAAK,QAAkB;SAC7C,CAAC,CAAA;KAAA,CAAC,CAAC;IACN,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC,CAAC;IACnE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAC9B,CAAC,CAAC;AAnCW,QAAA,uBAAuB,2BAmClC;AAEF,uDAAuD;AACvD,MAAM,UAAU,GAAG,EAAE,CAAC;AAEtB;;;;;;;;;;GAUG;AACI,MAAM,oBAAoB,GAAG,KAAK,EACvC,MAAc,EACqB,EAAE;;IACrC,MAAM,SAAS,GAAG,MAAM,IAAI,wBAAa,EAAE,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;IACpE,MAAM,OAAO,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC/C,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;QAChD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/C,MAAM,WAAW,GACf,OAAO,GAAG,CAAC,WAAW,KAAK,QAAQ;gBACjC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI;gBACtB,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC;YACtB,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,MAAA,GAAG,CAAC,GAAG,mCAAI,EAAE,CAAC,EAAE,CAAC;gBACjD,IAAI,OAAO,KAAK,KAAK,QAAQ;oBAAE,SAAS;gBACxC,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,QAAQ,CAChC,oDAAoD,CACrD,EAAE,CAAC;oBACF,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;oBACtB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;wBACvB,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC;oBAC/B,CAAC;oBACD,OAAO,CAAC,GAAG,CAAC,IAAI,CAAE,CAAC,GAAG,CAAC,WAAW,aAAX,WAAW,cAAX,WAAW,GAAI,UAAU,CAAC,CAAC;gBACpD,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC,CAAC;AA1BW,QAAA,oBAAoB,wBA0B/B;AAEF;;;;GAIG;AACI,MAAM,mBAAmB,GAAG,KAAK,EACtC,EAAM,EACN,IAAY,EACZ,OAAuE,EACvE,OAAiC,EACjC,EAAE;IACF,MAAM,YAAY,GAAG;QACnB,GAAG,IAAI,GAAG,CACR,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CACrC,CAAC,GAAG,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,UAAU,CAAC,CAC9C,CACF;KACF,CAAC;IACF,KAAK,MAAM,WAAW,IAAI,YAAY,EAAE,CAAC;QACvC,MAAM,IAAA,gCAAuB,EAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QACjD,EAAE,CAAC,GAAG,CAAC,kBAAkB,WAAW,EAAE,CAAC,CAAC;IAC1C,CAAC;IAED,KAAK,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,OAAO,EAAE,CAAC;QAC5C,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,EAAE,CAAC,GAAG,CAAC,MAAM,IAAI,6CAA6C,CAAC,CAAC;YAChE,SAAS;QACX,CAAC;QACD,KAAK,MAAM,WAAW,IAAI,IAAI,EAAE,CAAC;YAC/B,MAAM,MAAM,GAAG,WAAW,KAAK,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,WAAW,EAAE,CAAC;YACrE,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;gBACxB,MAAM,IAAA,0BAAiB,EAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,IAAI,SAAS,CAAC,CAAC;gBACrE,EAAE,CAAC,GAAG,CAAC,MAAM,IAAI,cAAc,MAAM,EAAE,CAAC,CAAC;YAC3C,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAA,wBAAe,EAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,IAAI,SAAS,CAAC,CAAC;gBACnE,EAAE,CAAC,GAAG,CAAC,KAAK,IAAI,GAAG,MAAM,EAAE,CAAC,CAAC;YAC/B,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC,CAAC;AAnCW,QAAA,mBAAmB,uBAmC9B;AAEF;;;GAGG;AACI,MAAM,uBAAuB,GAAG,KAAK,IAE1C,EAAE;IACF,MAAM,MAAM,GAAG,MAAM,IAAA,mCAAgB,GAAE,CAAC;IACxC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,IAAA,gCAAuB,EAAC,IAAA,+BAAoB,EAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;AACzE,CAAC,CAAC;AARW,QAAA,uBAAuB,2BAQlC"}

package/dist/apps/cli/src/secrets/index.d.ts

@@ -0,0 +1,2 @@
+export * from "./github";
+export * from "./writeSecrets";