@firestartr/cli 1.59.3 → 1.60.0

package/build/index.js

@@ -346942,6 +346942,69 @@ function policiesAreCompatible(syncPolicy, generalPolicy) {
     FIRESTARTR_POLICIES: FIRESTARTR_POLICIES,
 });
 
+;// CONCATENATED MODULE: ../catalog_common/src/tokenizer/index.ts
+class SimpleTokenizer {
+    /**
+     * Pass the regex here (it automatically makes it global so it finds ALL matches)
+     */
+    constructor(regex) {
+        const flags = regex.flags.includes('g') ? regex.flags : regex.flags + 'g';
+        this.regex = new RegExp(regex.source, flags);
+    }
+    /**
+     * Turn the whole string into a list of tokens:
+     * - 'text'  = normal text between matches
+     * - 'match' = whatever your regex found
+     */
+    tokenize(input) {
+        this.regex.lastIndex = 0;
+        const tokens = [];
+        let lastIndex = 0;
+        let match;
+        while ((match = this.regex.exec(input)) !== null) {
+            // Text before this match
+            if (match.index > lastIndex) {
+                tokens.push({
+                    type: 'text',
+                    value: input.slice(lastIndex, match.index),
+                    index: lastIndex,
+                });
+            }
+            // The matched part
+            tokens.push({
+                type: 'match',
+                value: match[0],
+                index: match.index,
+                groups: match.slice(1), // any capture groups you defined
+            });
+            if (match[0].length === 0) {
+                this.regex.lastIndex += 1;
+            }
+            lastIndex = this.regex.lastIndex;
+        }
+        // Remaining text after the last match
+        if (lastIndex < input.length) {
+            tokens.push({
+                type: 'text',
+                value: input.slice(lastIndex),
+                index: lastIndex,
+            });
+        }
+        return tokens;
+    }
+    /**
+     * Replace only the matched tokens by calling the function.
+     */
+    replace(input, replacer) {
+        return this.tokenize(input)
+            .map((token) => (token.type === 'match' ? replacer(token) : token.value))
+            .join('');
+    }
+}
+/* harmony default export */ const tokenizer = ({
+    SimpleTokenizer,
+});
+
 // EXTERNAL MODULE: ../../node_modules/cron-parser/dist/index.js
 var cron_parser_dist = __nccwpck_require__(98370);
 ;// CONCATENATED MODULE: ../catalog_common/src/cron.ts
@@ -346984,6 +347047,7 @@ function getCronNextInterval(cronLine, tz) {
 
 
 
+
 /* harmony default export */ const catalog_common = ({
     io: io,
     generic: generic,
@@ -346993,6 +347057,7 @@ function getCronNextInterval(cronLine, tz) {
     features: features,
     policies: policies,
     logger: logger_logger,
+    tokenizer: tokenizer,
     cron: {
         validateCron: validateCron,
         isValidCron: isValidCron,
@@ -353830,6 +353895,7 @@ async function getOrgTeamsDirectAccess(org) {
           nodes {
             id
             name
+            slug
             repositories {
               edges {
                 permission
@@ -353859,7 +353925,7 @@ function transformGraphQLResponse(response) {
     teams.forEach((team) => {
         const teamName = team.name;
         const teamId = team.id;
-        result.teams[teamName] = { id: teamId };
+        result.teams[teamName] = { id: teamId, slug: team.slug };
         const repositories = team.repositories.edges;
         repositories.forEach((repoEdge) => {
             const repoName = repoEdge.node.name;
@@ -353867,7 +353933,10 @@ function transformGraphQLResponse(response) {
             if (!result.repositories[repoName]) {
                 result.repositories[repoName] = {};
             }
-            result.repositories[repoName][teamName] = permission;
+            result.repositories[repoName][teamName] = {
+                permission,
+                slug: team.slug,
+            };
         });
     });
     return result;
@@ -355229,6 +355298,7 @@ class BranchStrategiesInitializer extends InitializerPatches {
                         cr.spec.repo.defaultBranch = claim.providers.github.defaultBranch;
                         cr.spec.branchProtections = [];
                     }
+                    cr.spec.branchProtections = cr.spec?.branchProtections ?? [];
                     delete cr.metadata.annotations[catalog_common.generic.getFirestartrAnnotation('branchStrategy')];
                     return cr;
                 },
@@ -356599,6 +356669,8 @@ class BranchStrategiesExpander extends GlobalSection {
                             claim.providers.github.branchStrategy.defaultBranch;
                         cr.spec.branchProtections = previousCR.spec.branchProtections;
                     }
+                    // fallback to empty array
+                    cr.spec.branchProtections = cr.spec?.branchProtections ?? [];
                     delete cr.metadata.annotations[catalog_common.generic.getFirestartrAnnotation('branchStrategy')];
                     return cr;
                 },
@@ -357922,6 +357994,42 @@ const external_node_child_process_namespaceObject = __WEBPACK_EXTERNAL_createReq
             },
             additionalProperties: false,
         },
+        GithubRules: {
+            $id: 'firestartr.dev://common/FirestartrGithubRules',
+            type: 'object',
+            properties: {
+                path: { type: 'string' },
+                owners: {
+                    type: 'array',
+                    items: {
+                        $ref: 'firestartr.dev://common/FirestartrOwnerRef',
+                    },
+                },
+            },
+            required: ['path', 'owners'],
+            additionalProperties: false,
+        },
+        GithubSync: {
+            $id: 'firestartr.dev://common/FirestartrGithubSync',
+            type: 'object',
+            properties: {
+                enabled: { type: 'boolean' },
+                period: {
+                    type: 'string',
+                    pattern: '^[0-9]+[smhd]$',
+                },
+                policy: { type: 'string' },
+                schedule: { type: 'string' },
+                schedule_timezone: { type: 'string' },
+            },
+            additionalProperties: false,
+            required: ['enabled'],
+        },
+        TfStateKey: {
+            $id: 'firestartr.dev://common/TerraformStateKey',
+            type: 'string',
+            pattern: '^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-4[0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12,}$',
+        },
     },
 });
 
@@ -357957,6 +358065,7 @@ const external_node_child_process_namespaceObject = __WEBPACK_EXTERNAL_createReq
                                     $ref: 'firestartr.dev://github/GithubTeamClaim',
                                 },
                             },
+                            additionalProperties: false,
                         },
                     },
                 },
@@ -357988,6 +358097,7 @@ const external_node_child_process_namespaceObject = __WEBPACK_EXTERNAL_createReq
                                     $ref: 'firestartr.dev://github/GithubUserClaim',
                                 },
                             },
+                            additionalProperties: false,
                         },
                     },
                 },
@@ -358033,6 +358143,7 @@ const external_node_child_process_namespaceObject = __WEBPACK_EXTERNAL_createReq
                                     $ref: 'firestartr.dev://github/GithubComponentClaim',
                                 },
                             },
+                            additionalProperties: false,
                         },
                     },
                     required: ['owner'],
@@ -358122,6 +358233,7 @@ const external_node_child_process_namespaceObject = __WEBPACK_EXTERNAL_createReq
                                     $ref: 'firestartr.dev://terraform/TerraformProvider',
                                 },
                             },
+                            additionalProperties: false,
                             required: ['terraform'],
                         },
                     },
@@ -358159,6 +358271,7 @@ const external_node_child_process_namespaceObject = __WEBPACK_EXTERNAL_createReq
                                     $ref: 'firestartr.dev://argocd/ArgoCDProvider',
                                 },
                             },
+                            additionalProperties: false,
                             required: ['argocd'],
                         },
                     },
@@ -358195,6 +358308,7 @@ const external_node_child_process_namespaceObject = __WEBPACK_EXTERNAL_createReq
                                     $ref: 'firestartr.dev://secrets/ExternalSecretsProvider',
                                 },
                             },
+                            additionalProperties: false,
                             required: ['external_secrets'],
                         },
                     },
@@ -358234,6 +358348,7 @@ const external_node_child_process_namespaceObject = __WEBPACK_EXTERNAL_createReq
                                     $ref: 'firestartr.dev://github/GithubOrgWebhookClaim',
                                 },
                             },
+                            additionalProperties: false,
                         },
                     },
                     required: ['owner'],
@@ -358258,6 +358373,15 @@ const external_node_child_process_namespaceObject = __WEBPACK_EXTERNAL_createReq
                 {
                     type: 'object',
                     properties: {
+                        name: {
+                            type: 'string',
+                        },
+                        tfStateKey: {
+                            $ref: 'firestartr.dev://common/TerraformStateKey',
+                        },
+                        sync: {
+                            $ref: 'firestartr.dev://common/FirestartrGithubSync',
+                        },
                         privacy: {
                             type: 'string',
                             enum: ['closed', 'secret'],
@@ -358269,6 +358393,7 @@ const external_node_child_process_namespaceObject = __WEBPACK_EXTERNAL_createReq
                             $ref: 'firestartr.dev://common/ClaimName',
                         },
                     },
+                    additionalProperties: false,
                     required: ['org', 'privacy'],
                 },
             ],
@@ -358293,6 +358418,15 @@ const external_node_child_process_namespaceObject = __WEBPACK_EXTERNAL_createReq
                 {
                     type: 'object',
                     properties: {
+                        name: {
+                            type: 'string',
+                        },
+                        tfStateKey: {
+                            $ref: 'firestartr.dev://common/TerraformStateKey',
+                        },
+                        sync: {
+                            $ref: 'firestartr.dev://common/FirestartrGithubSync',
+                        },
                         role: {
                             type: 'string',
                             enum: ['admin', 'member'],
@@ -358301,6 +358435,7 @@ const external_node_child_process_namespaceObject = __WEBPACK_EXTERNAL_createReq
                             $ref: 'firestartr.dev://common/ClaimName',
                         },
                     },
+                    additionalProperties: false,
                     required: ['org', 'role'],
                 },
             ],
@@ -358331,14 +358466,125 @@ const external_node_child_process_namespaceObject = __WEBPACK_EXTERNAL_createReq
                             type: 'string',
                             description: 'The github repo name',
                         },
+                        tfStateKey: {
+                            $ref: 'firestartr.dev://common/TerraformStateKey',
+                        },
                         orgPermissions: {
                             type: 'string',
                             description: 'The level of org Permission',
                         },
+                        sync: {
+                            $ref: 'firestartr.dev://common/FirestartrGithubSync',
+                        },
+                        technology: {
+                            type: 'object',
+                            properties: {
+                                stack: { type: 'string' },
+                                version: { type: 'string' },
+                            },
+                            additionalProperties: false,
+                            required: ['stack', 'version'],
+                        },
+                        defaultBranch: {
+                            type: 'string',
+                        },
+                        branchStrategy: {
+                            type: 'object',
+                            description: 'A branch strategy for a claim',
+                            properties: {
+                                name: {
+                                    type: 'string',
+                                },
+                                defaultBranch: {
+                                    type: 'string',
+                                },
+                            },
+                            additionalProperties: false,
+                            required: ['name'],
+                        },
+                        additionalBranches: {
+                            type: 'array',
+                            items: {
+                                type: 'object',
+                                properties: {
+                                    name: { type: 'string' },
+                                    orphan: { type: 'boolean' },
+                                },
+                                additionalProperties: false,
+                                required: ['name', 'orphan'],
+                            },
+                        },
+                        actions: {
+                            type: 'object',
+                            description: 'Actions configuration',
+                            properties: {
+                                oidc: {
+                                    type: 'object',
+                                    properties: {
+                                        useDefault: { type: 'boolean' },
+                                        includeClaimKeys: {
+                                            type: 'array',
+                                            items: { type: 'string' },
+                                        },
+                                    },
+                                    additionalProperties: false,
+                                },
+                            },
+                            additionalProperties: false,
+                            required: ['oidc'],
+                        },
                         archiveOnDestroy: {
                             type: 'boolean',
                             description: 'whether this repo should be archived when the claim is deleted',
                         },
+                        allowMergeCommit: {
+                            type: 'boolean',
+                        },
+                        allowSquashMerge: {
+                            type: 'boolean',
+                        },
+                        allowRebaseMerge: {
+                            type: 'boolean',
+                        },
+                        allowAutoMerge: {
+                            type: 'boolean',
+                        },
+                        deleteBranchOnMerge: {
+                            type: 'boolean',
+                        },
+                        autoInit: {
+                            type: 'boolean',
+                        },
+                        allowUpdateBranch: {
+                            type: 'boolean',
+                        },
+                        hasIssues: {
+                            type: 'boolean',
+                        },
+                        hasWiki: {
+                            type: 'boolean',
+                        },
+                        pages: {
+                            type: 'object',
+                            properties: {
+                                cname: { type: 'string' },
+                                source: {
+                                    type: 'object',
+                                    properties: {
+                                        branch: { type: 'string' },
+                                        path: { type: 'string' },
+                                    },
+                                    additionalProperties: false,
+                                },
+                            },
+                            additionalProperties: false,
+                        },
+                        additionalRules: {
+                            type: 'array',
+                            items: {
+                                $ref: 'firestartr.dev://common/FirestartrGithubRules',
+                            },
+                        },
                         visibility: {
                             type: 'string',
                             enum: ['private', 'public', 'internal'],
@@ -358367,8 +358613,14 @@ const external_node_child_process_namespaceObject = __WEBPACK_EXTERNAL_createReq
                                 pattern: '^[a-z0-9][a-z0-9-]*$',
                             },
                         },
+                        overrides: {
+                            type: 'object',
+                            properties: {},
+                            additionalProperties: true,
+                        },
                     },
-                    required: ['visibility', 'org'],
+                    additionalProperties: false,
+                    required: ['visibility', 'org', 'branchStrategy'],
                 },
             ],
         },
@@ -358390,6 +358642,12 @@ const external_node_child_process_namespaceObject = __WEBPACK_EXTERNAL_createReq
                 {
                     type: 'object',
                     properties: {
+                        name: {
+                            type: 'string',
+                        },
+                        tfStateKey: {
+                            $ref: 'firestartr.dev://common/TerraformStateKey',
+                        },
                         orgName: {
                             $ref: 'firestartr.dev://common/ClaimName',
                         },
@@ -358420,9 +358678,11 @@ const external_node_child_process_namespaceObject = __WEBPACK_EXTERNAL_createReq
                                     },
                                 },
                             },
+                            additionalProperties: false,
                             required: ['url', 'contentType', 'events', 'secretRef'],
                         },
                     },
+                    additionalProperties: false,
                     required: ['orgName', 'webhook'],
                 },
             ],
@@ -358626,6 +358886,9 @@ const GithubSchemas = [
                         name: {
                             type: 'string',
                         },
+                        tfStateKey: {
+                            $ref: 'firestartr.dev://common/TerraformStateKey',
+                        },
                         source: {
                             type: 'string',
                             enum: ['remote', 'inline', 'Remote', 'Inline'],
@@ -358717,6 +358980,7 @@ const GithubSchemas = [
                             additionalProperties: false,
                         },
                     },
+                    additionalProperties: false,
                     required: ['values', 'context', 'source', 'name'],
                 },
             ],
@@ -358849,6 +359113,7 @@ const ArgoCDSchemas = [argocd_schema];
                     enum: ['SecretStore', 'ClusterSecretStore'],
                 },
             },
+            additionalProperties: false,
             required: ['name'],
         },
         ExternalSecretsSection: {
@@ -358884,6 +359149,9 @@ const ArgoCDSchemas = [argocd_schema];
                     template: { type: 'object' },
                     secretName: { type: 'string' },
                     refreshInterval: { type: 'string' },
+                    updatePolicy: { type: 'string' },
+                    deletionPolicy: { type: 'string' },
+                    conversionStrategy: { type: 'string' },
                     generator: {
                         type: 'object',
                         properties: {
@@ -358906,19 +359174,15 @@ const ArgoCDSchemas = [argocd_schema];
                                     'Grafana',
                                 ],
                             },
-                            apiVersion: {
-                                type: 'string',
-                            },
-                            conversionStrategy: {
-                                type: 'string',
-                            },
-                            outputKey: {
-                                type: 'string',
-                            },
+                            apiVersion: { type: 'string' },
+                            conversionStrategy: { type: 'string' },
+                            outputKey: { type: 'string' },
                         },
+                        additionalProperties: false,
                         required: ['name'],
                     },
                 },
+                additionalProperties: false,
                 required: ['secretName', 'generator'],
             },
         },
@@ -366185,6 +366449,8 @@ function walkArray(arr, symbolsToResolve, renderClaim) {
 
 
 
+
+
 /*
  * Function called when rendering from the importer class.
  *
@@ -366198,6 +366464,14 @@ function walkArray(arr, symbolsToResolve, renderClaim) {
  *
  */
 async function renderFromImports(rClaims, crs = {}, catalogOutputDir = '/tmp/.catalog', crOutputDir = '/tmp/.resources') {
+    // Apply claim defaults (same as runRenderer path does via loadClaim/patchClaim)
+    let defaults;
+    try {
+        defaults = loadClaimDefaults();
+    }
+    catch (e) {
+        cdk8s_renderer_src_logger.warn(`Could not load claim defaults: ${e.message}`);
+    }
     // type: is the kind of the claim
     // value: is the imported-ref (the name in Github, can be with special characters, spaces, etc)
     const fSolver = (type, value) => {
@@ -366214,6 +366488,13 @@ async function renderFromImports(rClaims, crs = {}, catalogOutputDir = '/tmp/.ca
         cdk8s_renderer_src_logger.error(`Error while resolving imported-refs: ${e.message}`);
         throw new Error(`Error while resolving imported-refs: ${e.message}`);
     }
+    // after resolving the imported-refs, we need to validate the claims again, and apply the defaults if needed
+    for (const renderClaim of Object.values(rClaims)) {
+        if (defaults) {
+            renderClaim.claim = loader_patchClaim(renderClaim.claim, defaults);
+        }
+        validateClaim(renderClaim.claim, `firestartr.dev://common/${renderClaim.claim.kind}`);
+    }
     const catalogScope = new lib.App({
         outdir: catalogOutputDir,
         outputFileExtension: '.yaml',
@@ -366839,10 +367120,61 @@ MemberCollectionGithubDecanter.collectionKind = 'gh-members';
 applyCollectionMixins(MemberCollectionGithubDecanter);
 /* harmony default export */ const github_member_collection = (MemberCollectionGithubDecanter);
 
+;// CONCATENATED MODULE: ../importer/src/utils/codeowner.ts
+function extractFromCodeOwners(codeOwnersContent) {
+    if (!codeOwnersContent) {
+        return [];
+    }
+    return codeOwnersContent.split(/\r?\n/).flatMap((line) => {
+        const trimmedLine = line.trim();
+        // skip blank lines and full-line comments
+        if (!trimmedLine || trimmedLine.startsWith('#')) {
+            return [];
+        }
+        // strip inline comments before parsing owners
+        const lineWithoutInlineComment = line.replace(/\s*#.*$/, '').trim();
+        if (!lineWithoutInlineComment) {
+            return [];
+        }
+        // CODEOWNERS format: <pattern> <owner1> [<owner2> ...]
+        // first field is the path pattern; owners start from the second field
+        const parts = lineWithoutInlineComment.split(/\s+/);
+        if (parts.length < 2) {
+            return [];
+        }
+        return parts
+            .slice(1)
+            .filter((part) => part.startsWith('@'))
+            .map((owner) => ({
+            full: owner,
+            isTeam: owner.includes('/'),
+            name: owner,
+        }));
+    });
+}
+
+;// CONCATENATED MODULE: ../importer/src/utils/nomicon.ts
+function transformRepoName(repoName) {
+    // Convert to lowercase
+    let transformedName = repoName.toLowerCase();
+    const specialCharsRegex = /[._]/g;
+    if (specialCharsRegex.test(transformedName)) {
+        transformedName = transformedName.replace(/[._]/g, '');
+        // we add a random 2 letter suffix
+        return (transformedName + '-imp-' + Math.random().toString(36).substring(2, 4));
+    }
+    else {
+        return transformedName;
+    }
+}
+
 ;// CONCATENATED MODULE: ../importer/src/decanter/gh/github_repo.ts
 
 
 
+
+
+
 const TYPE_MAP = {
     User: 'user',
     Team: 'group',
@@ -366860,7 +367192,7 @@ class RepoGithubDecanter extends GithubDecanter {
             version: this.VERSION(),
             type: 'service',
             lifecycle: 'production',
-            name: this.data.repoDetails.name,
+            name: transformRepoName(this.data.repoDetails.name),
         };
     }
     __decantProviders() {
@@ -366913,6 +367245,52 @@ class RepoGithubDecanter extends GithubDecanter {
             });
         }
     }
+    // only for validation
+    __decantValidateCodeowners() {
+        if (this.data.codeowners) {
+            const owners = extractFromCodeOwners(this.data.codeowners);
+            const normalizeTeamIdentifier = (value) => {
+                const normalizedValue = (value.startsWith('@') ? value.slice(1) : value).toLowerCase();
+                if (!normalizedValue.includes('/')) {
+                    return normalizedValue;
+                }
+                const [org, slug, ...rest] = normalizedValue.split('/');
+                if (!org || !slug || rest.length > 0) {
+                    return null;
+                }
+                return org === this.org.toLowerCase() ? slug : null;
+            };
+            const isInTeams = (teamSlugInCodeowners) => {
+                const normalizedTeamSlug = normalizeTeamIdentifier(teamSlugInCodeowners);
+                if (!normalizedTeamSlug) {
+                    return false;
+                }
+                return this.data.teamsAndMembers.teams.some((team) => {
+                    return team.slug?.toLowerCase() === normalizedTeamSlug;
+                });
+            };
+            const isInUsers = (userName) => {
+                // strip the leading '@' for users (CODEOWNERS format: @username)
+                // and normalize to lowercase for case-insensitive comparison
+                const normalizedUserName = (userName.startsWith('@') ? userName.slice(1) : userName).toLowerCase();
+                return (this.data.teamsAndMembers.directMembers.some((member) => member.name?.toLowerCase() === normalizedUserName) ||
+                    this.data.teamsAndMembers.outsideMembers.some((member) => member.name?.toLowerCase() === normalizedUserName));
+            };
+            // let's validate that every element in the
+            // CODEOWNERS file is either a team or a user in the repository,
+            // otherwise we will have dangling references in the claim which will cause issues down the line
+            for (const owner of owners) {
+                if (owner.isTeam && !isInTeams(owner.name)) {
+                    importer_src_logger.error(`[${this.org}/${this.data.repoDetails.name}] CODEOWNERS file references team ${owner.name} which is not present in the repository's teams.`);
+                    throw new Error(`[${this.org}/${this.data.repoDetails.name}] CODEOWNERS file references team ${owner.name} which is not present in the repository's teams.`);
+                }
+                else if (!owner.isTeam && !isInUsers(owner.name)) {
+                    importer_src_logger.error(`[${this.org}/${this.data.repoDetails.name}] CODEOWNERS file references user ${owner.name} which is not present in the repository's collaborators.`);
+                    throw new Error(`[${this.org}/${this.data.repoDetails.name}] CODEOWNERS file references user ${owner.name} which is not present in the repository's collaborators.`);
+                }
+            }
+        }
+    }
     __decantRelations() {
         const directMaintainers = this.data.teamsAndMembers.directMembers
             .filter((member) => member.role === 'maintain')
@@ -366922,7 +367300,7 @@ class RepoGithubDecanter extends GithubDecanter {
         const outsideMaintainers = this.data.teamsAndMembers.outsideMembers
             .filter((member) => member.role === 'maintain')
             .map((member) => {
-            return `collaborator:${member.name}`;
+            return `collaborator:${member.name.toLowerCase()}`;
         });
         const teamMaintainers = this.data.teamsAndMembers.teams
             .filter((team) => team.role === 'maintain')
@@ -366947,7 +367325,7 @@ class RepoGithubDecanter extends GithubDecanter {
         const outsideAdmins = this.data.teamsAndMembers.outsideMembers
             .filter((member) => member.role === 'admin')
             .map((member) => {
-            return `collaborator:${member.name}`;
+            return `collaborator:${member.name.toLowerCase()}`;
         });
         const teamAdmins = this.data.teamsAndMembers.teams
             .filter((team) => team.role === 'admin')
@@ -366956,13 +367334,6 @@ class RepoGithubDecanter extends GithubDecanter {
         });
         const admins = directAdmins.concat(outsideAdmins).concat(teamAdmins);
         const overrides = {};
-        if (admins && admins.length > 0) {
-            this.__patchClaim({
-                op: 'add',
-                value: admins[0],
-                path: '/owner',
-            });
-        }
         if (admins && admins.length > 1) {
             overrides['additionalAdmins'] = [];
             for (let i = 1; i < admins.length; i++) {
@@ -366982,7 +367353,7 @@ class RepoGithubDecanter extends GithubDecanter {
         const outsideWriters = this.data.teamsAndMembers.outsideMembers
             .filter((member) => member.role === 'push')
             .map((member) => {
-            return `collaborator:${member.name}`;
+            return `collaborator:${member.name.toLowerCase()}`;
         });
         const teamWriters = this.data.teamsAndMembers.teams
             .filter((team) => ['push', 'write'].includes(team.role))
@@ -367006,7 +367377,7 @@ class RepoGithubDecanter extends GithubDecanter {
         const outsideReaders = this.data.teamsAndMembers.outsideMembers
             .filter((member) => member.role === 'pull')
             .map((member) => {
-            return `collaborator:${member.name}`;
+            return `collaborator:${member.name.toLowerCase()}`;
         });
         const teamReaders = this.data.teamsAndMembers.teams
             .filter((team) => ['pull', 'read'].includes(team.role))
@@ -367034,7 +367405,8 @@ class RepoGithubDecanter extends GithubDecanter {
         const teams = Object.keys(this.githubTeams).map((teamName) => {
             return {
                 name: teamName,
-                role: this.githubTeams[teamName].toLowerCase(),
+                role: this.githubTeams[teamName].permission.toLowerCase(),
+                slug: this.githubTeams[teamName].slug,
             };
         });
         this.data['teamsAndMembers']['teams'] = teams;
@@ -367062,6 +367434,28 @@ class RepoGithubDecanter extends GithubDecanter {
         }
         this.data['branchStrategy'] = { kind: value, data: bpInfo };
     }
+    async __gatherCodeowners() {
+        const codeownersPaths = [
+            '.github/CODEOWNERS',
+            'CODEOWNERS',
+            'docs/CODEOWNERS',
+        ];
+        for (const codeownersPath of codeownersPaths) {
+            try {
+                const codeowners = await github_0.repo.getContent(codeownersPath, this.data.repoDetails.name, this.org);
+                this.data['codeowners'] = codeowners;
+                return;
+            }
+            catch (e) {
+                const status = e?.status ?? e?.response?.status;
+                if (status === 404) {
+                    continue;
+                }
+                throw e;
+            }
+        }
+        importer_src_logger.info(`No CODEOWNERS file found for ${this.data.repoDetails.name}, skipping.`);
+    }
     async __adaptInitializerBranchStrategies(_claim) {
         const bpData = this.data.branchStrategy.data;
         if (this.data.branchStrategy.kind === 'custom') {
@@ -367128,7 +367522,8 @@ class RepoCollectionGithubDecanter extends GithubDecanter {
         const filteredRepos = await this.filter(RepoCollectionGithubDecanter.collectionKind, filters, repoList.map((repo) => repo.name));
         for (const repoName of filteredRepos) {
             const repoInfo = await this.github.repo.getRepoInfo(this.org, repoName);
-            repos.push(new RepoGithubDecanter({ repoDetails: repoInfo }, this.org, directAccessRepos?.[repoName]));
+            const repoDecanter = new RepoGithubDecanter({ repoDetails: repoInfo }, this.org, directAccessRepos?.[repoName]);
+            repos.push(repoDecanter);
         }
         this.data['collection'] = repos;
         return repos;
@@ -367147,6 +367542,13 @@ applyCollectionMixins(RepoCollectionGithubDecanter);
 
 
 
+// A single claim can render multiple CRs.
+// Some of those rendered kinds are derived/child resources whose parent is the
+// main CR for the claim, so they do not correspond to claim files that should be moved.
+const CHILD_CR_KINDS = [
+    'FirestartrGithubRepositorySecretsSection',
+    'FirestartrGithubRepositoryFeature',
+];
 let previousCRs = {};
 const collections = {
     GroupCollectionGithubDecanter: github_group_collection,
@@ -367217,7 +367619,10 @@ async function moveCRsAndClaims(crs, org, claimsPath, resourcesPath) {
             importer_src_logger.info(`📝 Moving: CR with kind: ${crs[k].kind} and name: ${crs[k].metadata.name} to wet repository`);
             importedResources.push(`${crs[k].kind} ${crs[k].metadata.name}`);
             catalog_common.io.moveFile(getCrPath(tmpRenderedCrsPath, crs[k]), getCrPath(resourcesPath, crs[k]));
-            catalog_common.io.moveFile(getClaimPathFromCR(randomFolder, crs[k]), getClaimPathFromCR(claimsPath, crs[k]));
+            // We only want to execute the move on claims based on parent CRs, so we're omitting child CRs
+            if (!CHILD_CR_KINDS.includes(crs[k].kind)) {
+                catalog_common.io.moveFile(getClaimPathFromCR(randomFolder, crs[k]), getClaimPathFromCR(claimsPath, crs[k]));
+            }
         }
         catch (e) {
             console.error(e);
@@ -367689,6 +368094,25 @@ function definitions_getPluralFromKind(kind) {
     const plural = Object.keys(kindPluralMap).find((key) => kindPluralMap[key] === kind);
     return plural;
 }
+const DAY_SECONDS = 24 * 60 * 60;
+const TIMEOUTS = {
+    // expressed in seconds
+    RENAMED: DAY_SECONDS,
+    UPDATED: DAY_SECONDS,
+    CREATED: DAY_SECONDS,
+    RETRY: 120 * 60,
+    MARKED_TO_DELETION: DAY_SECONDS,
+    SYNC: DAY_SECONDS,
+    NOTHING: 10,
+};
+function getTimeoutForOperation(operation) {
+    if (operation in TIMEOUTS) {
+        return TIMEOUTS[operation];
+    }
+    else {
+        throw new Error(`getTimeoutForOperation: Unknown operation: ${operation}`);
+    }
+}
 
 ;// CONCATENATED MODULE: ../operator/src/pr-annotation.ts
 
@@ -369200,6 +369624,19 @@ function enqueue(pluralKind, workItem, queue, compute, syncCtl, retryCtl) {
         itemPath: () => informer_itemPath(pluralKind, workItem.item),
         error: () => retryCtl.errorReconciling(informer_itemPath(pluralKind, workItem.item)),
         success: () => retryCtl.successReconciling(informer_itemPath(pluralKind, workItem.item)),
+        recommendedTimeout: () => {
+            const customTimeoutAnnotation = catalog_common.generic.getFirestartrAnnotation('test-custom-timeout');
+            let customTimeout = null;
+            if ('annotations' in workItem.item.metadata &&
+                customTimeoutAnnotation in workItem.item.metadata.annotations &&
+                !isNaN(parseInt(workItem.item.metadata.annotations[customTimeoutAnnotation]))) {
+                customTimeout = parseInt(workItem.item.metadata.annotations[customTimeoutAnnotation]);
+            }
+            else {
+                customTimeout = getTimeoutForOperation(workItem.operation);
+            }
+            return customTimeout;
+        },
         needsBlocking: (item, operation) => {
             if (kindsWithDependants.indexOf(item.kind) === -1) {
                 return false;
@@ -370052,16 +370489,6 @@ function getQueueMetrics() {
 //   "FirestartrGithubRepositoryFeature": 1,
 //   "FirestartrTerraformWorkspacePlan": 1,
 // }
-const TIMEOUTS = {
-    // expressed in seconds
-    RENAMED: 30 * 60,
-    UPDATED: 60 * 60,
-    CREATED: 60 * 60,
-    RETRY: 60 * 60,
-    MARKED_TO_DELETION: 60 * 60,
-    SYNC: 60 * 60,
-    NOTHING: 10,
-};
 let INIT = false;
 /**
  * Pushes a WorkItem to the queue
@@ -370099,27 +370526,12 @@ async function processItem_loop() {
         if (w) {
             const logMessage = `${new Date().toISOString()} : Processing OPERATION: ${w.operation} ITEM: ${w.item.kind}/${w.item.metadata.name}`;
             catalog_common.io.writeLogFile('process_item', logMessage);
-            const timeout = createTimeout(w);
             operator_src_logger.info(`The processor is currently handling a '${w.operation}' operation for item '${w.item.kind}/${w.item.metadata.name}' in namespace '${w.item.metadata.namespace}'. The current work status is '${w.workStatus}'.`);
             await runWorkItem(w);
-            clearTimeout(timeout);
         }
         await processItem_wait();
     }
 }
-/**
- * Creates a timeout for a workItem
- *
- *
- **/
-function createTimeout(w) {
-    return setTimeout(() => {
-        //throw new Error('Timeout on workitem ' + w);
-        console.error('Timeout on workitem %O', w);
-        operator_src_logger.error(`The processor timed out while handling a '${w.operation}' operation for item '${w.item.kind}/${w.item.metadata.name}' in namespace '${w.item.metadata.namespace}'. The current work status is '${w.workStatus}'.`);
-        process.exit(1);
-    }, TIMEOUTS[w.operation] * 1000);
-}
 /**
  * Sorts the queue based on the operation type
  * @param {WorkItem[]} queue - store of WorkItems
@@ -373108,11 +373520,82 @@ class TFPlanItemVersion extends TFPlanItem {
 
 /* harmony default export */ const terraform_provisioner_src_logger = (catalog_common.logger);
 
+;// CONCATENATED MODULE: ../terraform_provisioner/src/process_handler.ts
+
+const GRACE_PERIOD = 60 * 2; // 2 min
+const HARD_RESET_PERIOD = 10; // 10 sec
+function processHandler(processToHandle, ctl, onTimedOut) {
+    let gracefulResetId;
+    let hardResetId;
+    let callerNotified = false;
+    let timedOut = false;
+    const safeKill = (signal) => {
+        try {
+            const sent = processToHandle.kill(signal);
+            if (!sent) {
+                throw new Error(`Failed to send signal ${signal} to the process`);
+            }
+        }
+        catch (error) {
+            terraform_provisioner_src_logger.error(`FATAL: timeout signal ${signal} could not be delivered to the process: ${error}`);
+            if (!callerNotified) {
+                ctl.processKilled(false);
+                callerNotified = true;
+            }
+        }
+    };
+    const terminateId = setTimeout(() => {
+        // we take control of the process
+        onTimedOut();
+        timedOut = true;
+        // send sigInt
+        terraform_provisioner_src_logger.error(`Terraform process has not exited after initial timeout of ${ctl.hardTimeout} seconds, sending SIGINT...`);
+        safeKill('SIGINT');
+        // grace period
+        gracefulResetId = setTimeout(() => {
+            terraform_provisioner_src_logger.error(`Terraform process has not exited after SIGINT grace period of ${GRACE_PERIOD} seconds (total elapsed ~${ctl.hardTimeout + GRACE_PERIOD} seconds), sending SIGTERM...`);
+            safeKill('SIGTERM');
+            // hard reset period
+            hardResetId = setTimeout(() => {
+                terraform_provisioner_src_logger.error(`Terraform process has not exited after SIGTERM hard reset period of ${HARD_RESET_PERIOD} seconds (total elapsed ~${ctl.hardTimeout + GRACE_PERIOD + HARD_RESET_PERIOD} seconds), sending SIGKILL...`);
+                safeKill('SIGKILL');
+                setTimeout(() => {
+                    // we send if the process was killed or not to the caller
+                    if (!callerNotified) {
+                        ctl.processKilled(processToHandle.killed);
+                        callerNotified = true;
+                    }
+                }, 10 * 1000);
+            }, HARD_RESET_PERIOD * 1000);
+        }, GRACE_PERIOD * 1000);
+    }, ctl.hardTimeout * 1000);
+    processToHandle.on('exit', () => {
+        // the process has exited
+        // let's clear all the timeouts
+        if (terminateId) {
+            clearTimeout(terminateId);
+        }
+        if (gracefulResetId) {
+            clearTimeout(gracefulResetId);
+        }
+        if (hardResetId) {
+            clearTimeout(hardResetId);
+        }
+        // we inform the caller
+        // if the process exited and the timeout control has kicked-off
+        if (!callerNotified && timedOut) {
+            ctl.processKilled(true);
+            callerNotified = true;
+        }
+    });
+}
+
 ;// CONCATENATED MODULE: ../terraform_provisioner/src/utils.ts
 
 
 
 
+
 async function utils_validate(path, secrets) {
     return await tfExec(path, ['validate'], secrets);
 }
@@ -373122,28 +373605,28 @@ async function init(path, secrets, stream) {
 async function initFromModule(path, source, secrets, stream) {
     return tfExec(path, ['init', `-from-module=${source}`], secrets, [], stream);
 }
-async function plan(path, secrets, format, args = ['plan'], stream) {
+async function plan(path, secrets, format, args = ['plan'], stream, ctl) {
     terraform_provisioner_src_logger.info(`Running terraform plan with ${format} in path ${path}`);
-    const plan = await tfExec(path, args.concat(format === 'json' ? ['-json'] : []), secrets, ['-input=false'], stream);
+    const plan = await tfExec(path, args.concat(format === 'json' ? ['-json'] : []), secrets, ['-input=false'], stream, ctl);
     if (format === 'json') {
         const tfPlan = planGet(plan);
         return tfPlan;
     }
     return plan;
 }
-async function apply(path, secrets, stream) {
+async function apply(path, secrets, stream, ctl) {
     terraform_provisioner_src_logger.debug(`Running terraform apply in path ${path}`);
-    return await tfExec(path, ['apply', '-auto-approve'], secrets, ['-input=false'], stream);
+    return await tfExec(path, ['apply', '-auto-approve'], secrets, ['-input=false'], stream, ctl);
 }
-async function destroy(path, secrets, stream) {
+async function destroy(path, secrets, stream, ctl) {
     terraform_provisioner_src_logger.debug(`Running terraform destroy in path ${path}`);
-    return await tfExec(path, ['destroy', '-auto-approve'], secrets, ['-input=false'], stream);
+    return await tfExec(path, ['destroy', '-auto-approve'], secrets, ['-input=false'], stream, ctl);
 }
 async function output(path, secrets) {
     terraform_provisioner_src_logger.debug(`Running terraform output in path ${path}`);
     return await tfExec(path, ['output', '-json'], secrets, []);
 }
-async function tfExec(path, args, secrets, extraArgs = ['-input=false'], stream) {
+async function tfExec(path, args, secrets, extraArgs = ['-input=false'], stream, ctl) {
     return new Promise((ok, ko) => {
         const tfProcess = (0,external_child_process_.spawn)('tofu', args.concat(extraArgs), {
             cwd: path,
@@ -373153,6 +373636,7 @@ async function tfExec(path, args, secrets, extraArgs = ['-input=false'], stream)
         let flagStdoutEnd = false;
         let flagStderrEnd = false;
         let outputErrors = '';
+        let processTimeout = false;
         tfProcess.stdout.on('data', (log) => {
             const line = catalog_common.io.stripAnsi(log.toString());
             output += line;
@@ -373173,12 +373657,21 @@ async function tfExec(path, args, secrets, extraArgs = ['-input=false'], stream)
         });
         tfProcess.on('exit', async (code) => {
             let retryCount = 0;
-            while ((!flagStdoutEnd && !flagStderrEnd) || retryCount < 10) {
+            while (!flagStdoutEnd && !flagStderrEnd && retryCount < 10) {
                 retryCount++;
                 await catalog_common.generic.sleep(500);
             }
+            // this process has been killed/terminated
+            // by timeout (not in our control)
+            if (processTimeout) {
+                terraform_provisioner_src_logger.error(`Terraform output ${path}: ${[output, outputErrors].join('')}`);
+                ko(catalog_common.generic.buildCommandExecutionError([output, outputErrors, '\n<PROCESS TIMEOUT>'].join(''), catalog_common.generic.normalizeExitCode(code), args.concat(extraArgs), {
+                    errorName: 'TerraformCommandError',
+                    label: 'Terraform command',
+                }));
+                return;
+            }
             if (code !== 0) {
-                terraform_provisioner_src_logger.error(`Terraform output ${path}: ${output + outputErrors}`);
                 terraform_provisioner_src_logger.error(`Terraform output ${path}: ${[output, outputErrors].join('')}`);
                 ko(catalog_common.generic.buildCommandExecutionError([output, outputErrors].join(''), catalog_common.generic.normalizeExitCode(code), args.concat(extraArgs), {
                     errorName: 'TerraformCommandError',
@@ -373190,6 +373683,13 @@ async function tfExec(path, args, secrets, extraArgs = ['-input=false'], stream)
                 ok(output);
             }
         });
+        if (ctl) {
+            void processHandler(tfProcess, ctl, () => {
+                // callback to be called by the process handler
+                // we set on our flag to avoid sending our own messages
+                processTimeout = true;
+            });
+        }
     });
 }
 async function configureGit(ghToken) {
@@ -373678,6 +374178,15 @@ class project_tf_TFProjectManager {
         }
         this.secrets = ctx.secrets;
     }
+    set ctl(ctl) {
+        this._ctl = ctl;
+    }
+    get ctl() {
+        return this._ctl;
+    }
+    getOutput() {
+        return this.tfOutput;
+    }
     setStreamCallbacks(fnData, fnEnd, reopen = true) {
         if (reopen || !this.stream)
             this.stream = new external_stream_.PassThrough();
@@ -373686,9 +374195,6 @@ class project_tf_TFProjectManager {
         });
         this.stream.on('end', fnEnd);
     }
-    getOutput() {
-        return this.tfOutput;
-    }
     async build() {
         await this.mainTfWriter.render();
         this.mainTfWriter.writeToTerraformProject(external_path_.join(this.projectPath, 'firestartr-main.tf'));
@@ -373715,7 +374221,7 @@ class project_tf_TFProjectManager {
         await this.__init();
         if (format === 'json')
             this.tfOutput = null;
-        this.tfOutput = await plan(this.projectPath, this.secrets, format, ['plan'], this.stream);
+        this.tfOutput = await plan(this.projectPath, this.secrets, format, ['plan'], this.stream, this.ctl);
         if (this.stream)
             this.stream.end();
     }
@@ -373723,17 +374229,17 @@ class project_tf_TFProjectManager {
         await this.__init();
         if (format === 'json')
             this.tfOutput = null;
-        this.tfOutput = await plan(this.projectPath, this.secrets, format, ['plan', '-destroy'], this.stream);
+        this.tfOutput = await plan(this.projectPath, this.secrets, format, ['plan', '-destroy'], this.stream, this.ctl);
     }
     async apply() {
         await this.__init();
-        this.tfOutput += await apply(this.projectPath, this.secrets, this.stream);
+        this.tfOutput += await apply(this.projectPath, this.secrets, this.stream, this.ctl);
         if (this.stream)
             this.stream.end();
     }
     async destroy() {
         await this.__init();
-        this.tfOutput += await destroy(this.projectPath, this.secrets, this.stream);
+        this.tfOutput += await destroy(this.projectPath, this.secrets, this.stream, this.ctl);
         if (this.stream)
             this.stream.end();
     }
@@ -373845,6 +374351,12 @@ class TFProjectManagerRemote {
         }
         this.tfVarsJsonWriter = new WriterTfVarsJson(ctx.values, ctx.references);
     }
+    set ctl(ctl) {
+        this._ctl = ctl;
+    }
+    get ctl() {
+        return this._ctl;
+    }
     getOutput() {
         return this.tfOutput;
     }
@@ -373893,23 +374405,23 @@ insteadOf = https://github.com`);
     async plan(format) {
         await this.__init();
         if (format === 'json') {
-            this.tfOutput = await plan(this.projectPath, this.secrets, format, ['plan'], this.stream);
+            this.tfOutput = await plan(this.projectPath, this.secrets, format, ['plan'], this.stream, this.ctl);
         }
         else {
-            this.tfOutput += await plan(this.projectPath, this.secrets, format, ['plan'], this.stream);
+            this.tfOutput += await plan(this.projectPath, this.secrets, format, ['plan'], this.stream, this.ctl);
         }
         if (this.stream)
             this.stream.end();
     }
     async apply() {
         await this.__init();
-        this.tfOutput += await apply(this.projectPath, this.secrets, this.stream);
+        this.tfOutput += await apply(this.projectPath, this.secrets, this.stream, this.ctl);
         if (this.stream)
             this.stream.end();
     }
     async destroy() {
         await this.__init();
-        this.tfOutput += await destroy(this.projectPath, this.secrets, this.stream);
+        this.tfOutput += await destroy(this.projectPath, this.secrets, this.stream, this.ctl);
         if (this.stream)
             this.stream.end();
     }
@@ -373958,7 +374470,7 @@ async function run() {
     await execCommand(command, tfProject);
 }
 // Programatic API
-async function runTerraformProvisioner(context, command = 'init', streaming) {
+async function runTerraformProvisioner(context, command = 'init', streaming, ctl) {
     terraform_provisioner_src_logger.info(`Running command ${command} on a ${context.type} project`);
     validateContext(context);
     let tfProject = {};
@@ -373971,6 +374483,9 @@ async function runTerraformProvisioner(context, command = 'init', streaming) {
     if (streaming) {
         tfProject.setStreamCallbacks(streaming.fnData, streaming.fnEnd);
     }
+    if (ctl) {
+        tfProject.ctl = ctl;
+    }
     const output = await execCommand(command, tfProject);
     return output;
 }
@@ -374215,7 +374730,17 @@ async function* doPlanJSONFormat(item, op, handler, setResult = function (_r) {
         if (item.metadata.annotations['firestartr.dev/last-state-pr'] || false) {
             await addPlanStatusCheck(item.metadata.annotations['firestartr.dev/last-state-pr'], 'Terraform plan in progress...');
         }
-        const tfPlan = await runTerraformProvisioner(context, planType);
+        const tfPlan = await runTerraformProvisioner(context, planType, null, {
+            hardTimeout: handler.recommendedTimeout(),
+            processKilled: (killed) => {
+                if (killed) {
+                    operator_src_logger.error(`The Terraform process for item '${item.kind}/${item.metadata.name}' was killed due to a timeout.`);
+                }
+                else {
+                    operator_src_logger.error(`PANIC!!: The Terraform process for item '${item.kind}/${item.metadata.name}' could not be killed`);
+                }
+            },
+        });
         if (tfPlan.summary.hasChanges()) {
             yield {
                 item,
@@ -374502,7 +375027,17 @@ async function* process_operation_markedToDeletion(item, op, handler) {
         }
         const deps = await handler.resolveReferences();
         const context = buildProvisionerContext(item, deps);
-        const destroyOutput = await runTerraformProvisioner(context, 'destroy');
+        const destroyOutput = await runTerraformProvisioner(context, 'destroy', null, {
+            hardTimeout: handler.recommendedTimeout(),
+            processKilled: (killed) => {
+                if (killed) {
+                    operator_src_logger.error(`The Terraform process for item '${item.kind}/${item.metadata.name}' was killed due to a timeout.`);
+                }
+                else {
+                    operator_src_logger.error(`PANIC!!: The Terraform process for item '${item.kind}/${item.metadata.name}' could not be killed`);
+                }
+            },
+        });
         yield {
             item,
             reason: op,
@@ -374613,7 +375148,17 @@ async function* process_operation_doApply(item, op, handler) {
         const deps = await handler.resolveReferences();
         operator_src_logger.info(`The Terraform processor is applying and assessing dependencies for item '${item.kind}/${item.metadata.name}' with dependencies: '${deps}'.`);
         const context = buildProvisionerContext(item, deps);
-        const applyOutput = await runTerraformProvisioner(context, 'apply', checkRunCtl);
+        const applyOutput = await runTerraformProvisioner(context, 'apply', checkRunCtl, {
+            hardTimeout: handler.recommendedTimeout(),
+            processKilled: (killed) => {
+                if (killed) {
+                    operator_src_logger.error(`The Terraform process for item '${item.kind}/${item.metadata.name}' was killed due to a timeout.`);
+                }
+                else {
+                    operator_src_logger.error(`PANIC!!: The Terraform process for item '${item.kind}/${item.metadata.name}' could not be killed`);
+                }
+            },
+        });
         const terraformOutputJson = await runTerraformProvisioner(context, 'output');
         if (!terraformOutputJson) {
             throw new Error(`Terraform output is empty for ${item.kind}/${item.metadata.name}`);
@@ -376752,9 +377297,9 @@ const crs_analyzerSubcommand = {
 };
 
 ;// CONCATENATED MODULE: ./package.json
-const package_namespaceObject = {"i8":"1.59.3"};
+const package_namespaceObject = {"i8":"1.60.0"};
 ;// CONCATENATED MODULE: ../../package.json
-const package_namespaceObject_1 = {"i8":"1.59.3"};
+const package_namespaceObject_1 = {"i8":"1.60.0"};
 ;// CONCATENATED MODULE: ./src/subcommands/index.ts