@firestartr/cli 1.48.1-snapshot-test → 1.49.0-snapshot-1

package/build/index.js

@@ -290567,6 +290567,7 @@ var envVars;
     envVars["githubAppInstallationIdPrefapp"] = "GITHUB_APP_INSTALLATION_ID_PREFAPP";
     envVars["githubAppPemFile"] = "GITHUB_APP_PEM_FILE";
     // ---- PREFAPP BOT VARIABLES -----------------------------------------------
+    envVars["avoidPAT"] = "AVOID_PAT";
     envVars["githubAppPatPrefapp"] = "PREFAPP_BOT_PAT";
     // ---- GENERAL CLI VARIABLES -----------------------------------------------
     envVars["firestartrImageKind"] = "FIRESTARTR_IMAGE_KIND";
@@ -297423,12 +297424,17 @@ async function checkIfInstalledForOrg(org = 'default') {
     return installation !== undefined;
 }
 
+;// CONCATENATED MODULE: ../github/src/logger.ts
+
+/* harmony default export */ const github_src_logger = (catalog_common.logger);
+
 ;// CONCATENATED MODULE: ../github/src/auth.ts
 
 
 
 
 
+
 const generateGithubAppToken = async (config) => {
     try {
         const { appId, privateKey, installationOrgId } = config;
@@ -297462,8 +297468,11 @@ async function getOctokitForOrg(org, paginated = false, genGithubAppToken = gene
     if (org === '') {
         throw 'getOctokitForOrg: "org" has to be passed';
     }
-    if (org === 'prefapp')
+    if (org === 'prefapp' && !process.env[catalog_common.types.envVars.avoidPAT]) {
+        github_src_logger.info("Using Prefapp's PAT token");
         return getOctokitFromPat(catalog_common.types.envVars.githubAppPatPrefapp);
+    }
+    github_src_logger.info('Using GitHub App token');
     const auth = await genGithubAppToken({
         appId: catalog_common.environment.getFromEnvironment(catalog_common.types.envVars.githubAppId),
         privateKey: catalog_common.environment.getFromEnvironment(catalog_common.types.envVars.githubAppPemFile),
@@ -297482,10 +297491,6 @@ async function getOctokitFromPat(envVar) {
 }
 /* harmony default export */ const src_auth = ({ getOctokitForOrg });
 
-;// CONCATENATED MODULE: ../github/src/logger.ts
-
-/* harmony default export */ const github_src_logger = (catalog_common.logger);
-
 ;// CONCATENATED MODULE: ../github/src/organization.ts
 
 
@@ -298311,7 +298316,9 @@ function truncateRight(s, max) {
 async function createCheckRunForOrg(org, owner, repo, name, opts) {
     const octokit = await getOctokitForOrg(org);
     let headSHA = opts?.headSHA;
-    if (!headSHA && typeof opts?.pullNumber === 'number') {
+    const pr = opts?.pullNumber;
+    const hasValidPrNumber = typeof pr === 'number' && Number.isInteger(pr) && pr > 0;
+    if (!headSHA && hasValidPrNumber) {
         headSHA = await getPrMergeCommitSHA(opts.pullNumber, repo, owner);
     }
     if (!headSHA) {
@@ -300657,11 +300664,14 @@ const NORMALIZERS = [
     RevisionNormalizer,
 ];
 
+;// CONCATENATED MODULE: ../cdk8s_renderer/src/logger.ts
+
+/* harmony default export */ const cdk8s_renderer_src_logger = (catalog_common.logger);
+
 ;// CONCATENATED MODULE: ../cdk8s_renderer/src/refsSorter/refsExtractor.ts
 
 
 
-const refsExtractor_log = src_default()('firestartr:renderer:refsextractor');
 const kindMap = {
     user: 'UserClaim',
     group: 'GroupClaim',
@@ -300716,7 +300726,7 @@ function extractAllRefs(claimData) {
             break;
         }
     }
-    refsExtractor_log(`Refs for ${parsedClaim.kind}-${parsedClaim.name}: ${[...new Set(refs)].join(',')}`);
+    cdk8s_renderer_src_logger.info(`Refs for ${parsedClaim.kind}-${parsedClaim.name}: ${[...new Set(refs)].join(',')}`);
     return [...new Set(refs)];
 }
 function extractVirtualRefs(parsedClaim) {
@@ -300725,7 +300735,7 @@ function extractVirtualRefs(parsedClaim) {
         case 'ComponentClaim': {
             if (parsedClaim.providers.github.orgPermissions === 'view' ||
                 parsedClaim.providers.github.orgPermissions === 'contribute') {
-                refsExtractor_log(`Adding virtual reference for ${parsedClaim.providers.github.org}-all`);
+                cdk8s_renderer_src_logger.info(`Adding virtual reference for ${parsedClaim.providers.github.org}-all`);
                 virtualRefs.push(`GroupClaim-${parsedClaim.providers.github.org}-all`);
             }
             break;
@@ -300738,7 +300748,7 @@ function getGroupParentRef(parent, references = []) {
         return [];
     const regex = catalog_common.types.regex.GroupRefRegex;
     for (const match of parent.matchAll(regex)) {
-        refsExtractor_log(match);
+        cdk8s_renderer_src_logger.debug(`getGroupParentRef: a match has been found for ${parent}: ${match}`);
         const [_, claimName] = match;
         references.push(claimName);
     }
@@ -301976,7 +301986,6 @@ const base_secrets_schema = 'firestartr.dev://common/SecretsClaim';
 
 
 
-const lazy_loader_log = src_default()('firestartr:renderer:lazy_loader');
 // We need to ensure the grep command is a gnu version
 let IS_GNU_GREP = false;
 let GREP_ON_CHECK = false;
@@ -301996,13 +302005,13 @@ function checkGrep() {
         // a check is already running no new checks
         if (GREP_ON_CHECK)
             return waitForCheck();
-        lazy_loader_log('Checking the grep command');
+        cdk8s_renderer_src_logger.info('Checking the grep command');
         GREP_ON_CHECK = true;
         const handler = (0,external_node_child_process_namespaceObject.spawn)('grep', ['--version']);
         handler.on('close', (code) => {
             GREP_ON_CHECK = false;
             if (code === 0) {
-                lazy_loader_log('Grep is a gnu grep');
+                cdk8s_renderer_src_logger.debug('Grep is a gnu grep');
                 IS_GNU_GREP = true;
                 ok();
             }
@@ -302015,9 +302024,9 @@ function checkGrep() {
 async function loadClaim(claimRef, org, defaults = loadClaimDefaults(), patchClaim = loader_patchClaim, loadInitializers, loadGlobals, loadOverrides, loadNormalizers, cwd, existingRefs = {}) {
     await checkGrep();
     let result = existingRefs;
-    lazy_loader_log(`Load reference ${claimRef}`);
+    cdk8s_renderer_src_logger.info(`Load reference ${claimRef}`);
     initVirtualClaims(org);
-    lazy_loader_log(`Load reference (parts) ${claimRef.split(/-/)[0]} ${claimRef.replace(/^[^-]+-/, '')}`);
+    cdk8s_renderer_src_logger.info(`Load reference (parts) ${claimRef.split(/-/)[0]} ${claimRef.replace(/^[^-]+-/, '')}`);
     // cargas datos con grep
     try {
         const claimData = await lazyGetClaim(claimRef.split(/-/)[0], claimRef.replace(/^[^-]+-/, ''), org, cwd);
@@ -302067,7 +302076,7 @@ function resetLazyLoader() {
 }
 async function lazyGetClaim(kind, name, org, cwd) {
     const indice = `${kind}-${name}`;
-    lazy_loader_log(`Lazy loading ${kind}-${name} with index ${indice}`);
+    cdk8s_renderer_src_logger.info(`Lazy loading ${kind}-${name} with index ${indice}`);
     if (indice in LoadedClaims)
         return LoadedClaims[indice];
     if (isVirtualClaim(kind, name)) {
@@ -302088,7 +302097,7 @@ async function getClaimsByName(name, cwd = '.') {
         const handler = (0,external_node_child_process_namespaceObject.spawn)('grep', ['-r', '-l', '--include=*', '-E', `name: "?${name}"?`, '.'], {
             cwd: cwd,
         });
-        lazy_loader_log(`Running ${['grep', '-r', '-l', '--include', '-E', 'name: "' + name + '"?', '.'].join(' ')}`);
+        cdk8s_renderer_src_logger.info(`Running ${['grep', '-r', '-l', '--include', '-E', 'name: "' + name + '"?', '.'].join(' ')}`);
         const entradas = [];
         const chunks = [];
         handler.stdout.on('data', (data) => {
@@ -302127,7 +302136,7 @@ async function loadRawClaim(entry) {
                 return ko(`Reading ${entry}: ${error}`);
             const claim = catalog_common.io.fromYaml(data);
             if (!('kind' in claim && 'name' in claim)) {
-                lazy_loader_log(`Invalid claim file ${entry}`);
+                cdk8s_renderer_src_logger.warn(`Invalid claim file ${entry}`);
             }
             else {
                 const claimKey = `${claim.kind}-${claim.name}`;
@@ -302165,7 +302174,7 @@ async function setNonVirtualClaimAdditionalData(renderedData, claim, claimRef, l
 async function loadVirtualClaim(kind, name, org) {
     const virtualClaim = getVirtualClaim(kind, name);
     const expandedClaim = await virtualClaim.expand({ org });
-    lazy_loader_log(`Loading virtual claim ${kind} ${name} ${org}`);
+    cdk8s_renderer_src_logger.info(`Loading virtual claim ${kind} ${name} ${org}`);
     LoadedClaims[`${kind}-${name}`] = catalog_common.io.toYaml(expandedClaim);
     VisitedClaims[`${kind}-${name}`] = 'virtual';
 }
@@ -302186,7 +302195,6 @@ async function loadVirtualClaim(kind, name, org) {
 
 
 
-const loader_log = src_default()('firestartr:renderer:loader');
 const isYamlFile = new RegExp(/\.(yaml|yml)$/);
 /**
  *
@@ -302220,11 +302228,11 @@ async function loadGlobals(claim) {
                 result.push(section);
             }
             else {
-                loader_log('Skipping global %s because it is not applicable to %s', name, claim.kind);
+                cdk8s_renderer_src_logger.debug(`Skipping global ${name} because it is not applicable to ${claim.kind}`);
             }
         }
     });
-    loader_log('Loaded globals %O', result);
+    cdk8s_renderer_src_logger.info(`Loaded globals ${result}`);
     return result;
 }
 /*
@@ -302286,7 +302294,7 @@ async function loadInitializers(claim, initializersPath = config_getPath('initia
                 result.push(initializerBfN);
             }
             else {
-                loader_log('Skipping initializer %s because it is not applicable to %s', name, claim.kind);
+                cdk8s_renderer_src_logger.debug(`Skipping initializer ${name} because it is not applicable to ${claim.kind}`);
             }
         }
     });
@@ -302295,7 +302303,7 @@ async function loadInitializers(claim, initializersPath = config_getPath('initia
             result.push(new initializer());
         }
     }
-    loader_log('Loaded initializers %O', result);
+    cdk8s_renderer_src_logger.info(`Loaded initializers ${JSON.stringify(result)}`);
     loadedInitializers = result;
     return loadedInitializers;
 }
@@ -302340,11 +302348,11 @@ async function loadCRs(crsPath = config_getPath('crs'), excludedPaths = [config_
     }, async (entry, data) => {
         const yamlData = stripKnownRelations(catalog_common.io.fromYaml(data));
         if (!('kind' in yamlData && 'name' in yamlData.metadata)) {
-            loader_log(`Invalid claim file ${entry}`);
+            cdk8s_renderer_src_logger.warn(`Invalid claim file ${entry}`);
         }
         else {
             if (result[`${yamlData.kind}-${yamlData.metadata.name}`]) {
-                loader_log(`Duplicate CR ${yamlData.kind}-${yamlData.metadata.name}`);
+                cdk8s_renderer_src_logger.error(`Duplicate CR ${yamlData.kind}-${yamlData.metadata.name}`);
             }
             if (allowedClaimReferences.length === 0 ||
                 allowedClaimReferences.includes(yamlData.metadata?.annotations?.[catalog_common.generic.getFirestartrAnnotation('claim-ref')])) {
@@ -302478,6 +302486,30 @@ function validateCrSizes(crs) {
     }
 }
 
+;// CONCATENATED MODULE: ../cdk8s_renderer/src/validations/permissions.ts
+
+function validatePermissionsUniqueness(crs) {
+    for (const crkey in crs) {
+        const cr = crs[crkey];
+        if (cr.kind === 'FirestartrGithubRepository') {
+            const permissions = cr.spec.permissions;
+            cdk8s_renderer_src_logger.debug(`Validating Permissions Uniqueness of ${crkey}`);
+            if (permissions) {
+                const seen = new Set();
+                for (const perm of permissions) {
+                    const identifier = perm.collaborator
+                        ? perm.collaborator
+                        : `ref:${perm.ref.kind}:${perm.ref.name}`;
+                    if (seen.has(identifier)) {
+                        throw new Error(`Duplicate permission reference found in FirestartrGithubRepository ${crkey}: ${identifier}\nFull CR: ${JSON.stringify(cr, null, 2)}`);
+                    }
+                    seen.add(identifier);
+                }
+            }
+        }
+    }
+}
+
 ;// CONCATENATED MODULE: ../cdk8s_renderer/src/refsSorter/refsSorter.ts
 
 /**
@@ -303493,6 +303525,10 @@ mustache.Writer = Writer;
 
 /* harmony default export */ const mustache_mustache = (mustache);
 
+;// CONCATENATED MODULE: ../features_renderer/src/logger.ts
+
+/* harmony default export */ const features_renderer_src_logger = (catalog_common.logger);
+
 ;// CONCATENATED MODULE: ../features_renderer/src/traceability.ts
 const IS_WORKFLOW_REGEXP = new RegExp(/\.github\/workflows\/.+\.(yaml|yml)$/);
 function addTraceability(context, src, content) {
@@ -303538,7 +303574,6 @@ function addTraceabilityStamp(context, content) {
 
 
 
-const messageLog = src_default()('firestartr:features_renderer');
 function render(featurePath, featureRenderPath, entity, firestartrConfig = {}, featureArgs = {}) {
     const configData = validate_validate(featurePath);
     const context = buildContext(entity, configData.args, firestartrConfig, featureArgs);
@@ -303549,7 +303584,7 @@ function render(featurePath, featureRenderPath, entity, firestartrConfig = {}, f
         // For now let's keep upgradeable flag for backward compatibility
         // by default it's false
         const userManaged = file.user_managed ?? file.upgradeable ?? false;
-        messageLog(`Rendering ${src} to ${dest}`);
+        features_renderer_src_logger.debug(`Rendering ${src} to ${dest}`);
         // render the content of the file
         const content = addTraceability(context, src, renderContent(external_fs_default().readFileSync(external_path_default().join(featurePath, 'templates', src)).toString(), context));
         const destFilePath = external_path_default().join(`${featureRenderPath}`, dest);
@@ -304177,7 +304212,6 @@ const KINDS_CR_MAP = {
 
 
 
-const claimUtils_log = src_default()('firestartr:utils:path-resolver');
 function resolveStringReference(reference) {
     const referenceElements = reference.split(':');
     const actualKind = KINDS_CR_MAP[referenceElements[0]];
@@ -304220,7 +304254,7 @@ function resolveClaimFilesList(claimRefsList) {
 // under the form: for await (const claimRef of resolveClaimRefsGenerator){}
 // If dirs are passed, it resolves them recursively
 async function* resolveClaimEntries(claimRefsList) {
-    claimUtils_log(`Resolving ${claimRefsList.join(',')}`);
+    cdk8s_renderer_src_logger.info(`Resolving ${claimRefsList.join(',')}`);
     for (const claimEntry of claimRefsList) {
         try {
             const claimEntryStats = await (0,promises_namespaceObject.stat)(claimEntry);
@@ -304228,7 +304262,7 @@ async function* resolveClaimEntries(claimRefsList) {
                 yield* resolveDirEntries(claimEntry);
             }
             else if (claimEntryStats.isFile()) {
-                claimUtils_log(`Sending entry ${resolveClaimFileRef(claimEntry)} (${claimEntry})`);
+                cdk8s_renderer_src_logger.debug(`Sending entry ${resolveClaimFileRef(claimEntry)} (${claimEntry})`);
                 yield resolveClaimFileRef(claimEntry);
             }
         }
@@ -304254,7 +304288,7 @@ async function* resolveDirEntries(dir) {
         }
         else if (entry.isFile() && entry.name.match(/\.yaml$|\.yml$/)) {
             const claimRef = await resolveClaimFileRef(fullPath);
-            claimUtils_log(`Sending entry ${claimRef} (${fullPath})`);
+            cdk8s_renderer_src_logger.debug(`Sending entry ${claimRef} (${fullPath})`);
             yield claimRef;
         }
     }
@@ -307644,7 +307678,6 @@ class SecretsChart extends BaseSecretsChart {
 
 
 
-const claims_render_log = src_default()('firestartr:renderer:claims-render');
 async function renderClaims(catalogScope, firestartrScope, data) {
     const result = {};
     const { renderClaims, crs } = data;
@@ -307670,7 +307703,7 @@ async function renderClaims(catalogScope, firestartrScope, data) {
             const previousCR = getPreviousCRfromClaim(claim, crs);
             const patches = await extractPatches(renderClaims[claimKey], previousCR);
             if (!previousCR) {
-                claims_render_log(`No CR found for claim ${claimKey}, it will be rendered from scratch`);
+                cdk8s_renderer_src_logger.debug(`No CR found for claim ${claimKey}, it will be rendered from scratch`);
             }
             const { firestartrEntity, extraCharts, catalogEntity } = await renderClaim(catalogScope, firestartrScope, claim, patches, previousCR);
             if (catalogEntity) {
@@ -307831,6 +307864,7 @@ async function renderClaim(catalogScope, firestartrScope, claim, patches, previo
 
 
 
+
 /*
  * Function called when rendering but not importing
  *
@@ -307842,11 +307876,12 @@ async function renderClaim(catalogScope, firestartrScope, claim, patches, previo
  *   rendered firestartr-all group
  *
  */
-async function renderer_render(catalogScope, firestartrScope, activateReferentialIntegrityValidation = true, claimList) {
+async function renderer_render(catalogScope, firestartrScope, claimList) {
     const data = await loadClaimsList(claimList);
     const result = await renderClaims(catalogScope, firestartrScope, data);
     validateTfStateKeyUniqueness(result);
     validateCrSizes(result);
+    validatePermissionsUniqueness(result);
     return result;
 }
 
@@ -307909,7 +307944,7 @@ async function getAffectedRepositories(claimPathFromMain, claimPathFromPR, wetRe
         yamlOutputType: lib.YamlOutputType.FILE_PER_RESOURCE,
     });
     // Render the main branch
-    const renderFromMainBranch = await renderer_render(mainBranchCatalogApp, mainBranchFirestartrApp, true, await resolveClaimEntries([claimPathFromMain]));
+    const renderFromMainBranch = await renderer_render(mainBranchCatalogApp, mainBranchFirestartrApp, resolveClaimEntries([claimPathFromMain]));
     mainBranchFirestartrApp.synth();
     emptyRenderedClaims();
     resetLazyLoader();
@@ -307921,7 +307956,7 @@ async function getAffectedRepositories(claimPathFromMain, claimPathFromPR, wetRe
         yamlOutputType: lib.YamlOutputType.FILE_PER_RESOURCE,
     });
     // Render the PR branch
-    const renderFromPRBranch = await renderer_render(new lib.App(), app2, true, await resolveClaimEntries([claimPathFromPR]));
+    const renderFromPRBranch = await renderer_render(new lib.App(), app2, resolveClaimEntries([claimPathFromPR]));
     app2.synth();
     // Iterate over the resources from the main branch
     for (const key of Object.keys(renderFromMainBranch)) {
@@ -308019,16 +308054,15 @@ async function runComparer(claimPathFromMain, claimPathFromPR, claimsDefaultsPat
 
 
 
-const renderer_log = src_default()('firestartr:operator:cmd:tfworkspaces-renderer');
 async function renderTfWorkspace(claim, firestartrId, resolveRef, namespace) {
     const app = new lib.App();
     const initializers = [new UUIDInitializer(), new InitializerClaimRef()];
     const previousCR = await resolveRef('TFWorkspace', claim.name, namespace);
     if (previousCR) {
-        renderer_log(`💊 Previous CR found for ${claim.name} in ${namespace} with tfStateKey ${previousCR.spec.firestartr.tfStateKey}`);
+        cdk8s_renderer_src_logger.info(`💊 Previous CR found for ${claim.name} in ${namespace} with tfStateKey ${previousCR.spec.firestartr.tfStateKey}`);
     }
     else {
-        renderer_log(`💊 No previous CR found for ${claim.name} in ${namespace}, it will be rendered from scratch`);
+        cdk8s_renderer_src_logger.info(`💊 No previous CR found for ${claim.name} in ${namespace}, it will be rendered from scratch`);
     }
     const refValuesNormalizer = new RefValuesNormalizer();
     refValuesNormalizer.rsClaimRef = (kind, name) => resolveRef(kind, name, namespace);
@@ -308046,7 +308080,7 @@ async function renderTfWorkspace(claim, firestartrId, resolveRef, namespace) {
     await tfWkChart.render();
     const apiObject = await tfWkChart.postRenderer([]);
     const jsonObject = await apiObject.toJson();
-    renderer_log('📦 CR rendered O%', jsonObject);
+    cdk8s_renderer_src_logger.info(`📦 CR rendered \n ${jsonObject}`);
     return jsonObject;
 }
 
@@ -308191,7 +308225,7 @@ async function runRenderer(globalsPath, initializersPath, claimsPath, crsPath, c
         claimRefsList = await resolveClaimEntries([claimsPath]);
     }
     try {
-        await renderer_render(catalogApp, firestartrApp, validateReferentialIntegrity === 'enabled' ? true : false, claimRefsList);
+        await renderer_render(catalogApp, firestartrApp, claimRefsList);
     }
     catch (error) {
         console.log(`Rendering the system: \n ${error}`);
@@ -309002,6 +309036,10 @@ RepoCollectionGithubDecanter.collectionKind = 'gh-repo';
 applyCollectionMixins(RepoCollectionGithubDecanter);
 /* harmony default export */ const github_repo_collection = (RepoCollectionGithubDecanter);
 
+;// CONCATENATED MODULE: ../importer/src/logger.ts
+
+/* harmony default export */ const importer_src_logger = (catalog_common.logger);
+
 ;// CONCATENATED MODULE: ../importer/src/decanter/index.ts
 
 
@@ -309011,7 +309049,6 @@ applyCollectionMixins(RepoCollectionGithubDecanter);
 
 
 
-const decanter_log = src_default()('firestartr:importer');
 let previousCRs = {};
 const collections = {
     GroupCollectionGithubDecanter: github_group_collection,
@@ -309041,7 +309078,7 @@ async function importGithubGitopsRepository(org, skipPlan, claimsPath, resources
     await setPreviousCRs(resourcesPath);
     configurePaths(randomFolder, '/tmp/tmp-resources', // Not used, but required by renderer
     configPath);
-    decanter_log('Importing gitops repository for organization: ', org);
+    importer_src_logger.info(`Importing gitops repository for organization: ${org}`);
     const data = await getDataFromKinds(org, filters);
     data.crs = {};
     for (const k of Object.keys(previousCRs)) {
@@ -309057,19 +309094,19 @@ async function moveCRsAndClaims(crs, org, claimsPath, resourcesPath) {
     for (const k of Object.keys(crs)) {
         if (crs[k].kind === 'FirestartrGithubGroup' &&
             crs[k].metadata.name === `${org}-all`) {
-            decanter_log(`⚡ SKIP IMPORT: CR is the all group, skipping import with kind: ${crs[k].kind} and name: ${crs[k].metadata.name}`);
+            importer_src_logger.info(`⚡ SKIP IMPORT: CR is the all group, skipping import with kind: ${crs[k].kind} and name: ${crs[k].metadata.name}`);
             continue;
         }
         else if (cdk8s_renderer.isCatalogEntity(crs[k])) {
-            decanter_log(`⚡ SKIP IMPORT: CR is a catalog entity, skipping import with kind: ${crs[k].kind} and name: ${crs[k].metadata.name}`);
+            importer_src_logger.info(`⚡ SKIP IMPORT: CR is a catalog entity, skipping import with kind: ${crs[k].kind} and name: ${crs[k].metadata.name}`);
             continue;
         }
         else if (previousCRs[`${crs[k].kind}-${crs[k].metadata.annotations[catalog_common.generic.getFirestartrAnnotation('external-name')]}`]) {
-            decanter_log(`⚡ SKIP IMPORT: CR already exists on disk, skipping import with kind: ${crs[k].kind} and name: ${crs[k].metadata.name}`);
+            importer_src_logger.info(`⚡ SKIP IMPORT: CR already exists on disk, skipping import with kind: ${crs[k].kind} and name: ${crs[k].metadata.name}`);
             continue;
         }
         try {
-            decanter_log(`📝 Moving: CR with kind: ${crs[k].kind} and name: ${crs[k].metadata.name} to wet repository`);
+            importer_src_logger.info(`📝 Moving: CR with kind: ${crs[k].kind} and name: ${crs[k].metadata.name} to wet repository`);
             importedResources.push(`${crs[k].kind} ${crs[k].metadata.name}`);
             catalog_common.io.moveFile(getCrPath(tmpRenderedCrsPath, crs[k]), getCrPath(resourcesPath, crs[k]));
             catalog_common.io.moveFile(getClaimPathFromCR(randomFolder, crs[k]), getClaimPathFromCR(claimsPath, crs[k]));
@@ -309375,12 +309412,15 @@ const importSubcommand = {
     },
 };
 
+;// CONCATENATED MODULE: ../scaffolder/src/logger.ts
+
+/* harmony default export */ const scaffolder_src_logger = (catalog_common.logger);
+
 ;// CONCATENATED MODULE: ../scaffolder/src/scaffolder.ts
 
 
 
 
-const scaffolder_messageLog = src_default()('firestartr:scaffolder:scaffolder');
 class Scaffolder {
     constructor(org) {
         this.octokit = github_0.getOctokitForOrg(org);
@@ -309423,7 +309463,7 @@ class Scaffolder {
                 pushedSkeletons.push(skeletonPath);
             }
             catch (e) {
-                scaffolder_messageLog(e);
+                scaffolder_src_logger.error(`pushPendingSkeletons: ${e}`);
             }
         }
         return pushedSkeletons;
@@ -309448,10 +309488,10 @@ class Scaffolder {
         try {
             if (!external_fs_.existsSync(directoryPath) ||
                 !external_fs_.lstatSync(directoryPath).isDirectory()) {
-                scaffolder_messageLog(`Directory ${directoryPath} does not exist or is not a directory`);
+                scaffolder_src_logger.error(`Directory ${directoryPath} does not exist or is not a directory`);
                 throw `${directoryPath} does not exist or is not a directory`;
             }
-            scaffolder_messageLog(`Pushing skeleton ${directoryPath} to ${owner}/${repo} at ${destinationPath}`);
+            scaffolder_src_logger.info(`Pushing skeleton ${directoryPath} to ${owner}/${repo} at ${destinationPath}`);
             const files = this.getFilesInDirectory(directoryPath);
             const tree = this.createTree(files, destinationPath);
             // Get the default branch name
@@ -309494,10 +309534,10 @@ class Scaffolder {
                 ref: `heads/${defaultBranch}`,
                 sha: newCommit.data.sha,
             });
-            scaffolder_messageLog(`Pushed skeleton ${directoryPath} to ${owner}/${repo} at ${destinationPath}`);
+            scaffolder_src_logger.info(`Pushed skeleton ${directoryPath} to ${owner}/${repo} at ${destinationPath}`);
         }
         catch (e) {
-            scaffolder_messageLog(`Error pushing skeleton ${directoryPath} to ${owner}/${repo} at ${destinationPath}: ${e.message}`);
+            scaffolder_src_logger.error(`Error pushing skeleton ${directoryPath} to ${owner}/${repo} at ${destinationPath}: ${e.message}`);
             throw e;
         }
     }
@@ -310063,19 +310103,28 @@ async function addCommitStatusToPrMergeCommit(prAnnotationValue, state, targetUR
 }
 async function getLastStatePrInfo(cr) {
     try {
-        const prInfo = cr.metadata.annotations['firestartr.dev/last-state-pr'];
-        const owner = prInfo.split('#')[0].split('/')[0];
-        const repo = prInfo.split('#')[0].split('/')[1];
+        const annKey = 'firestartr.dev/last-state-pr';
+        const prInfo = cr?.metadata?.annotations?.[annKey];
+        if (!prInfo || typeof prInfo !== 'string')
+            return '';
+        // Expect "owner/repo#<num>" or "owner/repo"
+        const [orgRepo] = prInfo.split('#');
+        const [owner, repo] = (orgRepo || '').split('/');
+        if (!owner || !repo)
+            return '';
         const prData = await github_0.pulls.filterPrBy({
-            title: `hydrate: ${cr.metadata.name}`,
+            title: `hydrate: ${cr?.metadata?.name ?? ''}`,
             state: 'closed',
             repo,
             owner,
             userType: 'Bot',
         }, { maxRetries: 3 });
-        return `${owner}/${repo}#${prData.number}`;
+        const prNumber = prData?.number;
+        if (typeof prNumber !== 'number')
+            return '';
+        return `${owner}/${repo}#${prNumber}`;
     }
-    catch (e) {
+    catch {
         return '';
     }
 }
@@ -310887,9 +310936,8 @@ async function informer_loop() {
 ;// CONCATENATED MODULE: ../operator/dummy.ts
 
 
-const dummy_log = src_default()('firestartr:operator:dummy');
 async function* dummy(item, op, handler) {
-    dummy_log(`Running ${op}`);
+    operator_src_logger.info(`Running ${op}`);
     const type = op === 'MARKED_TO_DELETION' ? 'DELETING' : 'PROVISIONING';
     const deps = await handler.resolveReferences();
     yield {
@@ -310935,16 +310983,16 @@ async function* dummy(item, op, handler) {
         message: 'DUMMY PROVISIONING',
     };
     if (op === 'MARKED_TO_DELETION') {
-        dummy_log(`Deleting ${item.kind}/${item.metadata.name}`);
+        operator_src_logger.info(`Deleting ${item.kind}/${item.metadata.name}`);
         await handler.finalize('githubgroups', item.metadata.namespace, item, catalog_common.types.controller.FirestartrFinalizer);
-        dummy_log(`Writting Output in TFResult ${op}`);
+        operator_src_logger.debug(`Writting Output in TFResult ${op}`);
         await handler.writeTerraformOutputInTfResult(item, 'DUMMY DELETED OUPUT');
     }
     else if (op === 'UPDATED') {
-        dummy_log(`Updating ${item.kind}/${item.metadata.name}`);
-        dummy_log(`Writting Connection Secret ${op}`);
+        operator_src_logger.info(`Updating ${item.kind}/${item.metadata.name}`);
+        operator_src_logger.debug(`Writting Connection Secret ${op}`);
         await handler.writeConnectionSecret(item, { dummy: { value: 'dummy' } });
-        dummy_log(`Writting Output in TFResult ${op}`);
+        operator_src_logger.debug(`Writting Output in TFResult ${op}`);
         await handler.writeTerraformOutputInTfResult(item, 'DUMMY UPDATED OUPUT');
         yield {
             itemPath: handler.itemPath,
@@ -310967,10 +311015,10 @@ async function* dummy(item, op, handler) {
         };
     }
     else if (op === 'CREATED' || op === 'RENAMED') {
-        dummy_log(`Creating ${item.kind}/${item.metadata.name}`);
-        dummy_log(`Writting Connection Secret ${op}`);
+        operator_src_logger.info(`Creating ${item.kind}/${item.metadata.name}`);
+        operator_src_logger.debug(`Writting Connection Secret ${op}`);
         await handler.writeConnectionSecret(item, { dummy: { value: 'dummy' } });
-        dummy_log(`Writting Output in TFResult ${op}`);
+        operator_src_logger.debug(`Writting Output in TFResult ${op}`);
         await handler.writeTerraformOutputInTfResult(item, 'DUMMY CREATED OUPUT');
         yield {
             itemPath: handler.itemPath,
@@ -310980,7 +311028,7 @@ async function* dummy(item, op, handler) {
             message: 'DUMMY',
         };
     }
-    dummy_log(`Finished ${op}`);
+    operator_src_logger.info(`Finished ${op}`);
 }
 function dummy_fWait(ms) {
     return new Promise((resolve, reject) => {
@@ -312120,10 +312168,6 @@ async function runCDKTF(entityPath, action, depsPath, stream) {
                 PATH: process.env.PATH,
                 FIRESTARTR_CDKTF_ENTITY_PATH: entityPath,
                 FIRESTARTR_CDKTF_DEPS_PATH: depsPath ? depsPath : '',
-                GITHUB_APP_ID: catalog_common.environment.getFromEnvironment(catalog_common.types.envVars.githubAppId),
-                GITHUB_APP_INSTALLATION_ID: catalog_common.environment.getFromEnvironment(catalog_common.types.envVars.githubAppInstallationId),
-                GITHUB_APP_INSTALLATION_ID_PREFAPP: catalog_common.environment.getFromEnvironment(catalog_common.types.envVars.githubAppInstallationIdPrefapp),
-                GITHUB_APP_PEM_FILE: catalog_common.environment.getFromEnvironment(catalog_common.types.envVars.githubAppPemFile),
                 ORG: catalog_common.environment.getFromEnvironment(catalog_common.types.envVars.org),
                 KUBERNETES_SERVICE_HOST: catalog_common.environment.getFromEnvironment(catalog_common.types.envVars.kubernetesServiceHost),
                 KUBERNETES_SERVICE_PORT: catalog_common.environment.getFromEnvironment(catalog_common.types.envVars.kubernetesServicePort),
@@ -312288,9 +312332,6 @@ async function runTerraform(entity, command, stream) {
             cwd: workDir,
             env: {
                 PATH: process.env.PATH,
-                GITHUB_APP_ID: catalog_common.environment.getFromEnvironment(catalog_common.types.envVars.githubAppId),
-                GITHUB_APP_INSTALLATION_ID: catalog_common.environment.getFromEnvironment(catalog_common.types.envVars.githubAppInstallationId),
-                GITHUB_APP_PEM_FILE: catalog_common.environment.getFromEnvironment(catalog_common.types.envVars.githubAppPemFile),
                 ORG: catalog_common.environment.getFromEnvironment(catalog_common.types.envVars.org),
                 TOKEN: catalog_common.environment.getFromEnvironment(catalog_common.types.envVars.token),
                 KUBERNETES_SERVICE_HOST: catalog_common.environment.getFromEnvironment(catalog_common.types.envVars.kubernetesServiceHost),
@@ -313630,12 +313671,6 @@ async function output(path, secrets) {
     return await tfExec(path, ['output', '-json'], secrets, []);
 }
 async function tfExec(path, args, secrets, extraArgs = ['-input=false'], stream) {
-    // Format to TF_VAR variables -> https://developer.hashicorp.com/terraform/cli/config/environment-variables#tf_var_name
-    for (const secret of secrets) {
-        process.env[`${secret.key}`] = secret.value;
-    }
-    terraform_provisioner_src_logger.info(`Spawning terraform process ['terraform ${args.concat(extraArgs).join(' ')}'] in path '${path}'`);
-    process.env['TF_PLUGIN_CACHE_DIR'] = '/home/terraform-plugins-cache';
     return new Promise((ok, ko) => {
         const tfProcess = (0,external_child_process_.spawn)('terraform', args.concat(extraArgs), {
             cwd: path,
@@ -315242,8 +315277,6 @@ var external_os_ = __nccwpck_require__(22037);
 ;// CONCATENATED MODULE: ../operator/src/leader_election.ts
 
 
-const fDebug = src_default()('firestartr:controller:leader_election');
-
 async function getCurrentPod(namespace = 'default') {
     const { kc } = await ctl_getConnection();
     const k8sApi = kc.makeApiClient(client_node_dist.CoreV1Api);
@@ -316041,7 +316074,7 @@ var FileStatus;
     FileStatus["ADDED"] = "added";
     FileStatus["MODIFIED"] = "modified";
 })(FileStatus || (FileStatus = {}));
-function tfworkspaceplans_fDebug(message, level = 'info') {
+function fDebug(message, level = 'info') {
     console.log(JSON.stringify({ message, level }));
 }
 async function tfWorkspacePlan(opts) {
@@ -316049,9 +316082,9 @@ async function tfWorkspacePlan(opts) {
     const pull = `${owner}/${repo}#${prNumber}`;
     let cr = null;
     try {
-        tfworkspaceplans_fDebug(`Starting plan for ${pull}`, 'info');
+        fDebug(`Starting plan for ${pull}`, 'info');
         await addPlanStatusCheck(pull, 'Terraform plan in progress...');
-        tfworkspaceplans_fDebug(`Getting PR ${prNumber} in ${repo}`, 'info');
+        fDebug(`Getting PR ${prNumber} in ${repo}`, 'info');
         const resp = await github_0.pulls.getPrFiles(prNumber, repo, owner);
         const { data } = resp;
         if (data.length !== 1) {
@@ -316063,7 +316096,7 @@ async function tfWorkspacePlan(opts) {
         }
         const { filename, status } = file;
         let content = '';
-        tfworkspaceplans_fDebug(`Getting content for ${filename} in ${repo}`);
+        fDebug(`Getting content for ${filename} in ${repo}`);
         if (status === FileStatus.DELETED) {
             content = await github_0.repo.getContent(filename, repo, owner);
         }
@@ -316077,16 +316110,16 @@ async function tfWorkspacePlan(opts) {
         if (cr.kind !== 'FirestartrTerraformWorkspace') {
             throw new Error(`No FirestartrTerraformWorkspace found in PR ${opts.prNumber} in ${opts.repo}`);
         }
-        tfworkspaceplans_fDebug('Resolving references');
+        fDebug('Resolving references');
         const deps = await resolve(cr, getItemByItemPath, getSecret, namespace);
-        tfworkspaceplans_fDebug('Building context');
+        fDebug('Building context');
         const ctx = await buildProvisionerContext(cr, deps);
-        tfworkspaceplans_fDebug('Context built');
+        fDebug('Context built');
         const command = getCommandByStatus(status);
-        tfworkspaceplans_fDebug('Running terraform provisioner');
+        fDebug('Running terraform provisioner');
         const tfOutput = await runTerraformProvisioner(ctx, command);
-        tfworkspaceplans_fDebug('Terraform provisioner finished');
-        tfworkspaceplans_fDebug('Publishing plan');
+        fDebug('Terraform provisioner finished');
+        fDebug('Publishing plan');
         await publishPlan(cr, tfOutput, prNumber, repo, owner);
         await addPlanStatusCheck(pull, tfOutput, 'completed');
     }
@@ -316102,9 +316135,9 @@ async function tfWorkspacePlan(opts) {
         else {
             message = 'An unknown error occurred';
         }
-        tfworkspaceplans_fDebug(`Error: ${message}`, 'error');
+        fDebug(`Error: ${message}`, 'error');
         await addPlanStatusCheck(pull, message, 'completed', true);
-        tfworkspaceplans_fDebug('Publishing plan');
+        fDebug('Publishing plan');
         await publishPlan(cr, message, prNumber, repo, owner);
     }
 }
@@ -317109,15 +317142,18 @@ class CommandLine {
 }
 /* harmony default export */ const command_line = (CommandLine);
 
+;// CONCATENATED MODULE: ./src/logger.ts
+
+/* harmony default export */ const src_logger_0 = (catalog_common.logger);
+
 ;// CONCATENATED MODULE: ./main.ts
 
 
-const main_messageLog = src_default()('firestartr:cli:main');
 const commandLineArgs = new command_line();
 commandLineArgs
     .run()
     .then((res) => {
-    main_messageLog('Done:', res);
+    src_logger_0.info(`Command done: ${res}`);
 })
     .catch((err) => {
     throw err;

package/build/packages/catalog_common/src/types/envvars.d.ts

@@ -34,6 +34,7 @@ export declare enum envVars {
     githubAppInstallationId = "GITHUB_APP_INSTALLATION_ID",
     githubAppInstallationIdPrefapp = "GITHUB_APP_INSTALLATION_ID_PREFAPP",
     githubAppPemFile = "GITHUB_APP_PEM_FILE",
+    avoidPAT = "AVOID_PAT",
     githubAppPatPrefapp = "PREFAPP_BOT_PAT",
     firestartrImageKind = "FIRESTARTR_IMAGE_KIND",
     operatorNamespace = "OPERATOR_NAMESPACE",

package/build/packages/cdk8s_renderer/src/logger.d.ts

@@ -0,0 +1,9 @@
+declare const _default: {
+    error: (...args: any) => void;
+    warn: (...args: any) => void;
+    info: (...args: any) => void;
+    debug: (...args: any) => void;
+    verbose: (...args: any) => void;
+    silly: (...args: any) => void;
+};
+export default _default;

package/build/packages/cdk8s_renderer/src/renderer/renderer.d.ts

@@ -1,3 +1,3 @@
 import { Construct } from 'constructs';
 import { RenderedCrMap } from './types';
-export declare function render(catalogScope: Construct, firestartrScope: Construct, activateReferentialIntegrityValidation: boolean, claimList: AsyncGenerator<string, void, unknown>): Promise<RenderedCrMap>;
+export declare function render(catalogScope: Construct, firestartrScope: Construct, claimList: AsyncGenerator<string, void, unknown>): Promise<RenderedCrMap>;

package/build/packages/cdk8s_renderer/src/validations/permissions.d.ts

@@ -0,0 +1,2 @@
+import { RenderedCrMap } from '../renderer/types';
+export declare function validatePermissionsUniqueness(crs: RenderedCrMap): void;

package/build/packages/cli/src/logger.d.ts

@@ -0,0 +1,9 @@
+declare const _default: {
+    error: (...args: any) => void;
+    warn: (...args: any) => void;
+    info: (...args: any) => void;
+    debug: (...args: any) => void;
+    verbose: (...args: any) => void;
+    silly: (...args: any) => void;
+};
+export default _default;

package/build/packages/features_renderer/src/logger.d.ts

@@ -0,0 +1,9 @@
+declare const _default: {
+    error: (...args: any) => void;
+    warn: (...args: any) => void;
+    info: (...args: any) => void;
+    debug: (...args: any) => void;
+    verbose: (...args: any) => void;
+    silly: (...args: any) => void;
+};
+export default _default;

package/build/packages/importer/src/logger.d.ts

@@ -0,0 +1,9 @@
+declare const _default: {
+    error: (...args: any) => void;
+    warn: (...args: any) => void;
+    info: (...args: any) => void;
+    debug: (...args: any) => void;
+    verbose: (...args: any) => void;
+    silly: (...args: any) => void;
+};
+export default _default;

package/build/packages/scaffolder/src/logger.d.ts

@@ -0,0 +1,9 @@
+declare const _default: {
+    error: (...args: any) => void;
+    warn: (...args: any) => void;
+    info: (...args: any) => void;
+    debug: (...args: any) => void;
+    verbose: (...args: any) => void;
+    silly: (...args: any) => void;
+};
+export default _default;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@firestartr/cli",
-  "version": "1.48.1-snapshot-test",
+  "version": "1.49.0-snapshot-1",
   "private": false,
   "description": "Commandline tool",
   "main": "build/main.js",
@@ -27,12 +27,11 @@
     "catalog_common": "file:../catalog_common",
     "cdk8s_renderer": "file:../cdk8s_renderer",
     "command-line-args": "^5.2.1",
+    "crs_analyzer": "file:../crs_analyzer",
     "importer": "file:../importer",
     "operator": "file:../operator",
     "provisioner": "file:../provisioner",
-    "scaffolder": "file:../scaffolder",
-    "crs_analyzer": "file:../crs_analyzer",
-    "debug": "^4.3.4"
+    "scaffolder": "file:../scaffolder"
   },
   "engines": {
     "node": ">=10.0.0"