@firestartr/cli 2.10.0-snapshot-org-secrets-fix-1 → 2.10.0-snapshot-fix-renderer-1

package/build/index.js

@@ -280314,7 +280314,7 @@ function getCronNextInterval(cronLine, tz) {
 
 /***/ }),
 
-/***/ 3342:
+/***/ 99029:
 /***/ ((__unused_webpack_module, __webpack_exports__, __nccwpck_require__) => {
 
 // ESM COMPAT FLAG
@@ -284613,17 +284613,6 @@ async function doPaginatedRequest(options) {
         'Cache-Control': 'no-cache',
     });
 }
-async function getOrgVariable(org, variableName, octokit) {
-    logger.info(`Getting org variable ${variableName} for org ${org}`);
-    if (!octokit) {
-        octokit = await getOctokitForOrg(org);
-    }
-    const response = await octokit.rest.actions.getOrgVariable({
-        org,
-        name: variableName,
-    });
-    return response.data;
-}
 /* harmony default export */ const organization = ({
     getRepositoryList,
     getTeamList,
@@ -284634,7 +284623,6 @@ async function getOrgVariable(org, variableName, octokit) {
     getOrgTeamsDirectAccess,
     getOrgPlanName,
     getWebhookList,
-    getOrgVariable,
 });
 
 // EXTERNAL MODULE: external "fs"
@@ -285979,66 +285967,6 @@ async function encryptRepoSecret(owner, repo, section, plaintextValue, octokit)
     }
 }
 
-;// CONCATENATED MODULE: ../github/src/orgSecrets.ts
-
-
-
-async function getOrgPublicKey(org, section, octokit) {
-    logger.info(`Retrieving org public key for ${org} (${section})`);
-    try {
-        if (!octokit) {
-            octokit = await getOctokitForOrg(org);
-        }
-        const { data } = await octokit.rest[`${section}`].getOrgPublicKey({
-            org,
-        });
-        return data;
-    }
-    catch (error) {
-        logger.error(`Error retrieving org public key (${section}) for ${org}: ${error}`);
-        throw error;
-    }
-}
-async function encryptOrgSecret(org, section, plaintextValue, preFetchedKey, octokit) {
-    try {
-        const { key_id, key } = preFetchedKey
-            ? preFetchedKey
-            : await getOrgPublicKey(org, section, octokit);
-        await libsodium_wrappers.ready;
-        const publicKey = libsodium_wrappers.from_base64(key, libsodium_wrappers.base64_variants.ORIGINAL);
-        const secretBytes = libsodium_wrappers.from_string(plaintextValue);
-        const encryptedBytes = libsodium_wrappers.crypto_box_seal(secretBytes, publicKey);
-        const encryptedValue = libsodium_wrappers.to_base64(encryptedBytes, libsodium_wrappers.base64_variants.ORIGINAL);
-        return {
-            key_id,
-            encrypted_value: encryptedValue,
-        };
-    }
-    catch (err) {
-        logger.error(`Error encrypting org secret (${section}) for ${org}: ${err}`);
-        throw err;
-    }
-}
-async function getOrgSecret(org, section, name, octokit) {
-    logger.info(`Checking org secret ${name} (${section}) for ${org}`);
-    try {
-        if (!octokit) {
-            octokit = await getOctokitForOrg(org);
-        }
-        const response = await octokit.rest[`${section}`].getOrgSecret({
-            org,
-            secret_name: name,
-        });
-        return response.data;
-    }
-    catch (err) {
-        if (err && err.status === 404) {
-            return null;
-        }
-        throw err;
-    }
-}
-
 ;// CONCATENATED MODULE: ../github/src/profile.ts
 // Profile definitions and store for github package (immutable and ambient profiles)
 const profileStore = new Map();
@@ -286187,10 +286115,6 @@ function createFacade(profileName) {
                 const octokit = await getOctokitForOrg(orgName);
                 return getOrgPlanName(orgName, octokit);
             },
-            getOrgVariable: async (orgName, variableName) => {
-                const octokit = await getOctokitForOrg(orgName);
-                return getOrgVariable(orgName, variableName, octokit);
-            },
         },
         repo: {
             addStatusCheck: async (output, isFailure, headSha, name, status, repoName, owner) => {
@@ -286472,7 +286396,6 @@ function withProfile(profileName) {
 
 
 
-
 /* harmony default export */ const github = ({
     org: organization,
     repo: repository,
@@ -286495,9 +286418,6 @@ function withProfile(profileName) {
     encryption: {
         encryptRepoSecret: encryptRepoSecret,
         getRepoPublicKey: getRepoPublicKey,
-        getOrgPublicKey: getOrgPublicKey,
-        encryptOrgSecret: encryptOrgSecret,
-        getOrgSecret: getOrgSecret,
     },
     withProfile: withProfile,
     createProfile: createProfile,
@@ -319398,8 +319318,8 @@ var dist = __nccwpck_require__(44516);
 var dist_default = /*#__PURE__*/__nccwpck_require__.n(dist);
 // EXTERNAL MODULE: ../catalog_common/index.ts + 44 modules
 var catalog_common = __nccwpck_require__(78542);
-// EXTERNAL MODULE: ../github/index.ts + 38 modules
-var github = __nccwpck_require__(3342);
+// EXTERNAL MODULE: ../github/index.ts + 37 modules
+var github = __nccwpck_require__(99029);
 ;// CONCATENATED MODULE: ../cdk8s_renderer/src/patches/base.ts
 class BasePatches {
     constructor() { }
@@ -319602,14 +319522,9 @@ class UUIDInitializer extends InitializerPatches {
                 },
                 apply(cr) {
                     const ctx = helperCTX(this);
-                    const reusePrevious = previousCR && previousCR.kind === ctx.kind;
-                    const uuid = reusePrevious
-                        ? previousCR?.spec?.firestartr?.tfStateKey ||
-                            claim.providers?.[ctx.provider]?.tfStateKey ||
-                            (0,wrapper.v4)()
-                        : cr.spec?.firestartr?.tfStateKey ||
-                            claim.providers?.[ctx.provider]?.tfStateKey ||
-                            (0,wrapper.v4)();
+                    const uuid = previousCR?.spec?.firestartr?.tfStateKey ||
+                        claim.providers?.[ctx.provider]?.tfStateKey ||
+                        (0,wrapper.v4)();
                     if (!cr.spec)
                         cr.spec = {};
                     if (!cr.spec.firestartr)
@@ -319985,23 +319900,25 @@ class DefaultSection extends BasePatches {
         return [
             {
                 async apply(cr) {
+                    let currentPatchData = patchData;
                     // Merge object arrays
-                    const mergeResult = await __self._mergeObjectArrays(cr, patchData, mergeFilterFn, arrayPaths);
+                    const mergeResult = await __self._mergeObjectArrays(cr, currentPatchData, mergeFilterFn, arrayPaths);
                     cr = mergeResult.cr;
-                    patchData = mergeResult.patchData;
+                    currentPatchData = mergeResult.patchData;
                     // Get the patch list
-                    const patchList = getPatchesFn(cr, patchData);
+                    const patchList = getPatchesFn(cr, currentPatchData);
                     // We apply the patches, update the cr.spec field and return the CR
                     cr.spec = fast_json_patch_default().applyPatch(cr.spec, patchList).newDocument;
                     return cr;
                 },
                 async validate(cr) {
+                    let currentPatchData = patchData;
                     // Merge object arrays
-                    const mergeResult = await __self._mergeObjectArrays(cr, patchData, mergeFilterFn, arrayPaths);
+                    const mergeResult = await __self._mergeObjectArrays(cr, currentPatchData, mergeFilterFn, arrayPaths);
                     cr = mergeResult.cr;
-                    patchData = mergeResult.patchData;
+                    currentPatchData = mergeResult.patchData;
                     // Get the patch list
-                    const patchList = getPatchesFn(cr, patchData);
+                    const patchList = getPatchesFn(cr, currentPatchData);
                     // If the patchList array has length greater than 0,
                     // that must mean some operation was either overriden or not
                     // done at all. That would make our CR invalid
@@ -320151,7 +320068,6 @@ const ONE_WAY_DEFINITIONS = [
     '/spec/vars',
     '/spec/actions/oidc',
     '/spec/repo/labels',
-    '/spec/actionsVariables',
 ];
 function applyOneWayDefs(crSpecs) {
     const crSpecsClone = JSON.parse(JSON.stringify(crSpecs));
@@ -322147,50 +322063,6 @@ function extractAllRefs(claimData) {
             refs.push(...secretsRefs);
             break;
         }
-        case 'OrgSettingsClaim': {
-            const actionsVariables = parsedClaim.providers?.github?.actions_variables;
-            if (Array.isArray(actionsVariables)) {
-                for (const variable of actionsVariables) {
-                    if (variable.visibility !== 'selected')
-                        continue;
-                    const selectedRepos = variable.selected_repositories;
-                    if (!Array.isArray(selectedRepos))
-                        continue;
-                    for (const repoRef of selectedRepos) {
-                        const match = repoRef.match(/^component:(.+)$/);
-                        if (match) {
-                            refs.push(`ComponentClaim-${match[1]}`);
-                        }
-                    }
-                }
-            }
-            const orgSecrets = parsedClaim.providers?.github?.org_secrets;
-            if (orgSecrets && typeof orgSecrets === 'object') {
-                const secretRefRegex = /^ref:secretsclaim:([a-zA-Z0-9_-]+):([a-zA-Z0-9_-]+)$/;
-                for (const section of ['actions', 'codespaces', 'dependabot']) {
-                    const secrets = orgSecrets[section];
-                    if (!Array.isArray(secrets))
-                        continue;
-                    for (const secret of secrets) {
-                        if (secret.value) {
-                            const match = secret.value.match(secretRefRegex);
-                            if (match) {
-                                refs.push(`SecretsClaim-${match[1]}`);
-                            }
-                        }
-                        if (Array.isArray(secret.selected_repositories)) {
-                            for (const repoRef of secret.selected_repositories) {
-                                const compMatch = repoRef.match(/^component:(.+)$/);
-                                if (compMatch) {
-                                    refs.push(`ComponentClaim-${compMatch[1]}`);
-                                }
-                            }
-                        }
-                    }
-                }
-            }
-            break;
-        }
     }
     logger.info(`Refs for ${parsedClaim.kind}-${parsedClaim.name}: ${[...new Set(refs)].join(',')}`);
     return [...new Set(refs)];
@@ -323317,73 +323189,6 @@ const organizationSettingsProperties = {
     secret_scanning_push_protection_enabled_for_new_repositories: {
         type: 'boolean',
     },
-    actions_variables: {
-        type: 'array',
-        items: {
-            type: 'object',
-            properties: {
-                name: {
-                    type: 'string',
-                    pattern: '^[A-Za-z0-9_]+$',
-                },
-                value: {
-                    type: 'string',
-                },
-                visibility: {
-                    type: 'string',
-                    enum: ['all', 'private', 'selected'],
-                },
-                selected_repositories: {
-                    type: 'array',
-                    items: {
-                        $ref: 'firestartr.dev://common/FirestartrComponentRef',
-                    },
-                },
-            },
-            required: ['name', 'value', 'visibility'],
-            additionalProperties: false,
-            allOf: [
-                {
-                    if: {
-                        properties: {
-                            visibility: { const: 'selected' },
-                        },
-                        required: ['visibility'],
-                    },
-                    then: {},
-                    else: {
-                        properties: {
-                            selected_repositories: { type: 'array', maxItems: 0 },
-                        },
-                    },
-                },
-            ],
-        },
-    },
-    org_secrets: {
-        type: 'object',
-        properties: {
-            actions: {
-                type: 'array',
-                items: {
-                    $ref: 'firestartr.dev://github/GithubOrgClaimSecret',
-                },
-            },
-            codespaces: {
-                type: 'array',
-                items: {
-                    $ref: 'firestartr.dev://github/GithubOrgClaimSecret',
-                },
-            },
-            dependabot: {
-                type: 'array',
-                items: {
-                    $ref: 'firestartr.dev://github/GithubOrgClaimSecret',
-                },
-            },
-        },
-        additionalProperties: false,
-    },
 };
 /* harmony default export */ const github_orgsettings_schema = ({
     $schema: SCHEMA,
@@ -323571,75 +323376,6 @@ const organizationSettingsProperties = {
     },
 });
 
-;// CONCATENATED MODULE: ../cdk8s_renderer/src/claims/github/orgSecrets.schema.ts
-
-/* harmony default export */ const orgSecrets_schema = ({
-    $schema: SCHEMA,
-    $id: 'GithubOrgClaimSecrets',
-    definitions: {
-        GithubOrgClaimSecrets: {
-            $id: 'firestartr.dev://github/GithubOrgClaimSecrets',
-            type: 'object',
-            description: 'Organization-level GitHub Actions secrets',
-            properties: {
-                actions: {
-                    type: 'array',
-                    items: {
-                        $ref: 'firestartr.dev://github/GithubOrgClaimSecret',
-                    },
-                },
-                codespaces: {
-                    type: 'array',
-                    items: {
-                        $ref: 'firestartr.dev://github/GithubOrgClaimSecret',
-                    },
-                },
-                dependabot: {
-                    type: 'array',
-                    items: {
-                        $ref: 'firestartr.dev://github/GithubOrgClaimSecret',
-                    },
-                },
-            },
-            additionalProperties: false,
-        },
-        GithubOrgClaimSecretRef: {
-            $id: 'firestartr.dev://github/GithubOrgClaimSecretRef',
-            type: 'string',
-            description: 'the reference of the secret',
-            pattern: '^ref:secretsclaim:([a-zA-Z0-9_-]+):([a-zA-Z0-9_-]+)$',
-        },
-        GithubOrgClaimSecret: {
-            $id: 'firestartr.dev://github/GithubOrgClaimSecret',
-            type: 'object',
-            description: 'An organization-level secret for GitHub Actions',
-            properties: {
-                name: {
-                    type: 'string',
-                    description: 'the name of the secret',
-                },
-                value: {
-                    $ref: 'firestartr.dev://github/GithubOrgClaimSecretRef',
-                },
-                visibility: {
-                    type: 'string',
-                    enum: ['all', 'selected', 'private'],
-                    description: 'which repositories can access the secret',
-                },
-                selected_repositories: {
-                    type: 'array',
-                    items: {
-                        type: 'string',
-                    },
-                    description: 'list of repository refs when visibility is selected',
-                },
-            },
-            required: ['name', 'value'],
-            additionalProperties: false,
-        },
-    },
-});
-
 ;// CONCATENATED MODULE: ../cdk8s_renderer/src/claims/github/index.ts
 
 
@@ -323649,7 +323385,6 @@ const organizationSettingsProperties = {
 
 
 
-
 const GithubSchemas = [
     github_group_schema,
     github_user_schema,
@@ -323659,7 +323394,6 @@ const GithubSchemas = [
     github_orgsettings_schema,
     component_secrets_vars_schema,
     component_labels_schema,
-    orgSecrets_schema,
 ];
 
 ;// CONCATENATED MODULE: ../cdk8s_renderer/src/claims/tfworkspaces/terraform.schema.ts
@@ -326806,7 +326540,7 @@ const VARIANT_OF_ANNOTATION = 'firestartr.dev/variant-of';
 function isVariantCR(cr) {
     return cr.metadata?.annotations?.[VARIANT_OF_ANNOTATION] !== undefined;
 }
-function getPreviousCRfromClaim(claim, previousCRs, expectedKind) {
+function getPreviousCRfromClaim(claim, previousCRs) {
     const previousCRsKeys = Object.keys(previousCRs);
     const isVariantClaim = !!claim._parentClaimName;
     for (const previousCRKey of previousCRsKeys) {
@@ -326815,8 +326549,6 @@ function getPreviousCRfromClaim(claim, previousCRs, expectedKind) {
             continue;
         if (isExcludedFromPreviousCR(previousCR.kind))
             continue;
-        if (expectedKind && previousCR.kind !== expectedKind)
-            continue;
         const crVariant = isVariantCR(previousCR);
         if (isVariantClaim && !crVariant)
             continue;
@@ -327573,382 +327305,6 @@ var FirestartrGithubMembershipSpecContextProviderRefKind;
     /** FirestartrProviderConfig */
     FirestartrGithubMembershipSpecContextProviderRefKind["FIRESTARTR_PROVIDER_CONFIG"] = "FirestartrProviderConfig";
 })(FirestartrGithubMembershipSpecContextProviderRefKind || (FirestartrGithubMembershipSpecContextProviderRefKind = {}));
-/**
- * A resource to handle GitHub Organization Actions Secrets.
- *
- * @schema FirestartrGithubOrganizationSecretSection
- */
-class FirestartrGithubOrganizationSecretSection extends lib.ApiObject {
-    /**
-     * Renders a Kubernetes manifest for "FirestartrGithubOrganizationSecretSection".
-     *
-     * This can be used to inline resource manifests inside other objects (e.g. as templates).
-     *
-     * @param props initialization props
-     */
-    static manifest(props) {
-        return {
-            ...FirestartrGithubOrganizationSecretSection.GVK,
-            ...toJson_FirestartrGithubOrganizationSecretSectionProps(props),
-        };
-    }
-    /**
-     * Defines a "FirestartrGithubOrganizationSecretSection" API object
-     * @param scope the scope in which to define this object
-     * @param id a scope-local name for the object
-     * @param props initialization props
-     */
-    constructor(scope, id, props) {
-        super(scope, id, {
-            ...FirestartrGithubOrganizationSecretSection.GVK,
-            ...props,
-        });
-    }
-    /**
-     * Renders the object to Kubernetes JSON.
-     */
-    toJson() {
-        const resolved = super.toJson();
-        return {
-            ...FirestartrGithubOrganizationSecretSection.GVK,
-            ...toJson_FirestartrGithubOrganizationSecretSectionProps(resolved),
-        };
-    }
-}
-/**
- * Returns the apiVersion and kind for "FirestartrGithubOrganizationSecretSection"
- */
-FirestartrGithubOrganizationSecretSection.GVK = {
-    apiVersion: 'firestartr.dev/v1',
-    kind: 'FirestartrGithubOrganizationSecretSection',
-};
-
-/**
- * Converts an object of type 'FirestartrGithubOrganizationSecretSectionProps' to JSON representation.
- */
-/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
-function toJson_FirestartrGithubOrganizationSecretSectionProps(obj) {
-    if (obj === undefined) {
-        return undefined;
-    }
-    const result = {
-        'metadata': obj.metadata,
-        'spec': toJson_FirestartrGithubOrganizationSecretSectionSpec(obj.spec),
-    };
-    // filter undefined values
-    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
-}
-/**
- * Converts an object of type 'FirestartrGithubOrganizationSecretSectionSpec' to JSON representation.
- */
-/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
-function toJson_FirestartrGithubOrganizationSecretSectionSpec(obj) {
-    if (obj === undefined) {
-        return undefined;
-    }
-    const result = {
-        'org': obj.org,
-        'secrets': toJson_FirestartrGithubOrganizationSecretSectionSpecSecrets(obj.secrets),
-        'context': toJson_FirestartrGithubOrganizationSecretSectionSpecContext(obj.context),
-        'firestartr': toJson_FirestartrGithubOrganizationSecretSectionSpecFirestartr(obj.firestartr),
-    };
-    // filter undefined values
-    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
-}
-/**
- * Converts an object of type 'FirestartrGithubOrganizationSecretSectionSpecSecrets' to JSON representation.
- */
-/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
-function toJson_FirestartrGithubOrganizationSecretSectionSpecSecrets(obj) {
-    if (obj === undefined) {
-        return undefined;
-    }
-    const result = {
-        'actions': obj.actions?.map(y => toJson_FirestartrGithubOrganizationSecretSectionSpecSecretsActions(y)),
-        'codespaces': obj.codespaces?.map(y => toJson_FirestartrGithubOrganizationSecretSectionSpecSecretsCodespaces(y)),
-        'dependabot': obj.dependabot?.map(y => toJson_FirestartrGithubOrganizationSecretSectionSpecSecretsDependabot(y)),
-    };
-    // filter undefined values
-    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
-}
-/**
- * Converts an object of type 'FirestartrGithubOrganizationSecretSectionSpecContext' to JSON representation.
- */
-/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
-function toJson_FirestartrGithubOrganizationSecretSectionSpecContext(obj) {
-    if (obj === undefined) {
-        return undefined;
-    }
-    const result = {
-        'backend': toJson_FirestartrGithubOrganizationSecretSectionSpecContextBackend(obj.backend),
-        'provider': toJson_FirestartrGithubOrganizationSecretSectionSpecContextProvider(obj.provider),
-    };
-    // filter undefined values
-    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
-}
-/**
- * Converts an object of type 'FirestartrGithubOrganizationSecretSectionSpecFirestartr' to JSON representation.
- */
-/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
-function toJson_FirestartrGithubOrganizationSecretSectionSpecFirestartr(obj) {
-    if (obj === undefined) {
-        return undefined;
-    }
-    const result = {
-        'tfStateKey': obj.tfStateKey,
-    };
-    // filter undefined values
-    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
-}
-/**
- * Converts an object of type 'FirestartrGithubOrganizationSecretSectionSpecSecretsActions' to JSON representation.
- */
-/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
-function toJson_FirestartrGithubOrganizationSecretSectionSpecSecretsActions(obj) {
-    if (obj === undefined) {
-        return undefined;
-    }
-    const result = {
-        'name': obj.name,
-        'ref': toJson_FirestartrGithubOrganizationSecretSectionSpecSecretsActionsRef(obj.ref),
-        'visibility': obj.visibility,
-        'selectedRepositories': obj.selectedRepositories?.map(y => y),
-    };
-    // filter undefined values
-    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
-}
-/**
- * Converts an object of type 'FirestartrGithubOrganizationSecretSectionSpecSecretsCodespaces' to JSON representation.
- */
-/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
-function toJson_FirestartrGithubOrganizationSecretSectionSpecSecretsCodespaces(obj) {
-    if (obj === undefined) {
-        return undefined;
-    }
-    const result = {
-        'name': obj.name,
-        'ref': toJson_FirestartrGithubOrganizationSecretSectionSpecSecretsCodespacesRef(obj.ref),
-        'visibility': obj.visibility,
-        'selectedRepositories': obj.selectedRepositories?.map(y => y),
-    };
-    // filter undefined values
-    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
-}
-/**
- * Converts an object of type 'FirestartrGithubOrganizationSecretSectionSpecSecretsDependabot' to JSON representation.
- */
-/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
-function toJson_FirestartrGithubOrganizationSecretSectionSpecSecretsDependabot(obj) {
-    if (obj === undefined) {
-        return undefined;
-    }
-    const result = {
-        'name': obj.name,
-        'ref': toJson_FirestartrGithubOrganizationSecretSectionSpecSecretsDependabotRef(obj.ref),
-        'visibility': obj.visibility,
-        'selectedRepositories': obj.selectedRepositories?.map(y => y),
-    };
-    // filter undefined values
-    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
-}
-/**
- * Converts an object of type 'FirestartrGithubOrganizationSecretSectionSpecContextBackend' to JSON representation.
- */
-/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
-function toJson_FirestartrGithubOrganizationSecretSectionSpecContextBackend(obj) {
-    if (obj === undefined) {
-        return undefined;
-    }
-    const result = {
-        'ref': toJson_FirestartrGithubOrganizationSecretSectionSpecContextBackendRef(obj.ref),
-    };
-    // filter undefined values
-    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
-}
-/**
- * Converts an object of type 'FirestartrGithubOrganizationSecretSectionSpecContextProvider' to JSON representation.
- */
-/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
-function toJson_FirestartrGithubOrganizationSecretSectionSpecContextProvider(obj) {
-    if (obj === undefined) {
-        return undefined;
-    }
-    const result = {
-        'ref': toJson_FirestartrGithubOrganizationSecretSectionSpecContextProviderRef(obj.ref),
-    };
-    // filter undefined values
-    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
-}
-/**
- * Converts an object of type 'FirestartrGithubOrganizationSecretSectionSpecSecretsActionsRef' to JSON representation.
- */
-/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
-function toJson_FirestartrGithubOrganizationSecretSectionSpecSecretsActionsRef(obj) {
-    if (obj === undefined) {
-        return undefined;
-    }
-    const result = {
-        'kind': obj.kind,
-        'name': obj.name,
-        'key': obj.key,
-    };
-    // filter undefined values
-    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
-}
-/* eslint-enable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
-/**
- * Which repositories can access the secret.
- *
- * @schema FirestartrGithubOrganizationSecretSectionSpecSecretsActionsVisibility
- */
-var FirestartrGithubOrganizationSecretSectionSpecSecretsActionsVisibility;
-(function (FirestartrGithubOrganizationSecretSectionSpecSecretsActionsVisibility) {
-    /** all */
-    FirestartrGithubOrganizationSecretSectionSpecSecretsActionsVisibility["ALL"] = "all";
-    /** selected */
-    FirestartrGithubOrganizationSecretSectionSpecSecretsActionsVisibility["SELECTED"] = "selected";
-    /** private */
-    FirestartrGithubOrganizationSecretSectionSpecSecretsActionsVisibility["PRIVATE"] = "private";
-})(FirestartrGithubOrganizationSecretSectionSpecSecretsActionsVisibility || (FirestartrGithubOrganizationSecretSectionSpecSecretsActionsVisibility = {}));
-/**
- * Converts an object of type 'FirestartrGithubOrganizationSecretSectionSpecSecretsCodespacesRef' to JSON representation.
- */
-/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
-function toJson_FirestartrGithubOrganizationSecretSectionSpecSecretsCodespacesRef(obj) {
-    if (obj === undefined) {
-        return undefined;
-    }
-    const result = {
-        'kind': obj.kind,
-        'name': obj.name,
-        'key': obj.key,
-    };
-    // filter undefined values
-    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
-}
-/* eslint-enable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
-/**
- * Which repositories can access the secret.
- *
- * @schema FirestartrGithubOrganizationSecretSectionSpecSecretsCodespacesVisibility
- */
-var FirestartrGithubOrganizationSecretSectionSpecSecretsCodespacesVisibility;
-(function (FirestartrGithubOrganizationSecretSectionSpecSecretsCodespacesVisibility) {
-    /** all */
-    FirestartrGithubOrganizationSecretSectionSpecSecretsCodespacesVisibility["ALL"] = "all";
-    /** selected */
-    FirestartrGithubOrganizationSecretSectionSpecSecretsCodespacesVisibility["SELECTED"] = "selected";
-    /** private */
-    FirestartrGithubOrganizationSecretSectionSpecSecretsCodespacesVisibility["PRIVATE"] = "private";
-})(FirestartrGithubOrganizationSecretSectionSpecSecretsCodespacesVisibility || (FirestartrGithubOrganizationSecretSectionSpecSecretsCodespacesVisibility = {}));
-/**
- * Converts an object of type 'FirestartrGithubOrganizationSecretSectionSpecSecretsDependabotRef' to JSON representation.
- */
-/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
-function toJson_FirestartrGithubOrganizationSecretSectionSpecSecretsDependabotRef(obj) {
-    if (obj === undefined) {
-        return undefined;
-    }
-    const result = {
-        'kind': obj.kind,
-        'name': obj.name,
-        'key': obj.key,
-    };
-    // filter undefined values
-    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
-}
-/* eslint-enable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
-/**
- * Which repositories can access the secret.
- *
- * @schema FirestartrGithubOrganizationSecretSectionSpecSecretsDependabotVisibility
- */
-var FirestartrGithubOrganizationSecretSectionSpecSecretsDependabotVisibility;
-(function (FirestartrGithubOrganizationSecretSectionSpecSecretsDependabotVisibility) {
-    /** all */
-    FirestartrGithubOrganizationSecretSectionSpecSecretsDependabotVisibility["ALL"] = "all";
-    /** selected */
-    FirestartrGithubOrganizationSecretSectionSpecSecretsDependabotVisibility["SELECTED"] = "selected";
-    /** private */
-    FirestartrGithubOrganizationSecretSectionSpecSecretsDependabotVisibility["PRIVATE"] = "private";
-})(FirestartrGithubOrganizationSecretSectionSpecSecretsDependabotVisibility || (FirestartrGithubOrganizationSecretSectionSpecSecretsDependabotVisibility = {}));
-/**
- * Converts an object of type 'FirestartrGithubOrganizationSecretSectionSpecContextBackendRef' to JSON representation.
- */
-/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
-function toJson_FirestartrGithubOrganizationSecretSectionSpecContextBackendRef(obj) {
-    if (obj === undefined) {
-        return undefined;
-    }
-    const result = {
-        'kind': obj.kind,
-        'name': obj.name,
-    };
-    // filter undefined values
-    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
-}
-/**
- * Converts an object of type 'FirestartrGithubOrganizationSecretSectionSpecContextProviderRef' to JSON representation.
- */
-/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
-function toJson_FirestartrGithubOrganizationSecretSectionSpecContextProviderRef(obj) {
-    if (obj === undefined) {
-        return undefined;
-    }
-    const result = {
-        'kind': obj.kind,
-        'name': obj.name,
-    };
-    // filter undefined values
-    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
-}
-/* eslint-enable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
-/**
- * The type of Kubernetes resource to reference.
- *
- * @schema FirestartrGithubOrganizationSecretSectionSpecSecretsActionsRefKind
- */
-var FirestartrGithubOrganizationSecretSectionSpecSecretsActionsRefKind;
-(function (FirestartrGithubOrganizationSecretSectionSpecSecretsActionsRefKind) {
-    /** Secret */
-    FirestartrGithubOrganizationSecretSectionSpecSecretsActionsRefKind["SECRET"] = "Secret";
-})(FirestartrGithubOrganizationSecretSectionSpecSecretsActionsRefKind || (FirestartrGithubOrganizationSecretSectionSpecSecretsActionsRefKind = {}));
-/**
- * The type of Kubernetes resource to reference.
- *
- * @schema FirestartrGithubOrganizationSecretSectionSpecSecretsCodespacesRefKind
- */
-var FirestartrGithubOrganizationSecretSectionSpecSecretsCodespacesRefKind;
-(function (FirestartrGithubOrganizationSecretSectionSpecSecretsCodespacesRefKind) {
-    /** Secret */
-    FirestartrGithubOrganizationSecretSectionSpecSecretsCodespacesRefKind["SECRET"] = "Secret";
-})(FirestartrGithubOrganizationSecretSectionSpecSecretsCodespacesRefKind || (FirestartrGithubOrganizationSecretSectionSpecSecretsCodespacesRefKind = {}));
-/**
- * The type of Kubernetes resource to reference.
- *
- * @schema FirestartrGithubOrganizationSecretSectionSpecSecretsDependabotRefKind
- */
-var FirestartrGithubOrganizationSecretSectionSpecSecretsDependabotRefKind;
-(function (FirestartrGithubOrganizationSecretSectionSpecSecretsDependabotRefKind) {
-    /** Secret */
-    FirestartrGithubOrganizationSecretSectionSpecSecretsDependabotRefKind["SECRET"] = "Secret";
-})(FirestartrGithubOrganizationSecretSectionSpecSecretsDependabotRefKind || (FirestartrGithubOrganizationSecretSectionSpecSecretsDependabotRefKind = {}));
-/**
- * @schema FirestartrGithubOrganizationSecretSectionSpecContextBackendRefKind
- */
-var FirestartrGithubOrganizationSecretSectionSpecContextBackendRefKind;
-(function (FirestartrGithubOrganizationSecretSectionSpecContextBackendRefKind) {
-    /** FirestartrProviderConfig */
-    FirestartrGithubOrganizationSecretSectionSpecContextBackendRefKind["FIRESTARTR_PROVIDER_CONFIG"] = "FirestartrProviderConfig";
-})(FirestartrGithubOrganizationSecretSectionSpecContextBackendRefKind || (FirestartrGithubOrganizationSecretSectionSpecContextBackendRefKind = {}));
-/**
- * @schema FirestartrGithubOrganizationSecretSectionSpecContextProviderRefKind
- */
-var FirestartrGithubOrganizationSecretSectionSpecContextProviderRefKind;
-(function (FirestartrGithubOrganizationSecretSectionSpecContextProviderRefKind) {
-    /** FirestartrProviderConfig */
-    FirestartrGithubOrganizationSecretSectionSpecContextProviderRefKind["FIRESTARTR_PROVIDER_CONFIG"] = "FirestartrProviderConfig";
-})(FirestartrGithubOrganizationSecretSectionSpecContextProviderRefKind || (FirestartrGithubOrganizationSecretSectionSpecContextProviderRefKind = {}));
 /**
  * A resource to handle GitHub Organization Settings.
  *
@@ -328207,254 +327563,6 @@ var FirestartrGithubOrganizationSettingsSpecContextProviderRefKind;
     /** FirestartrProviderConfig */
     FirestartrGithubOrganizationSettingsSpecContextProviderRefKind["FIRESTARTR_PROVIDER_CONFIG"] = "FirestartrProviderConfig";
 })(FirestartrGithubOrganizationSettingsSpecContextProviderRefKind || (FirestartrGithubOrganizationSettingsSpecContextProviderRefKind = {}));
-/**
- * A resource to handle GitHub Organization Actions Variables.
- *
- * @schema FirestartrGithubOrganizationVariableSection
- */
-class FirestartrGithubOrganizationVariableSection extends lib.ApiObject {
-    /**
-     * Renders a Kubernetes manifest for "FirestartrGithubOrganizationVariableSection".
-     *
-     * This can be used to inline resource manifests inside other objects (e.g. as templates).
-     *
-     * @param props initialization props
-     */
-    static manifest(props) {
-        return {
-            ...FirestartrGithubOrganizationVariableSection.GVK,
-            ...toJson_FirestartrGithubOrganizationVariableSectionProps(props),
-        };
-    }
-    /**
-     * Defines a "FirestartrGithubOrganizationVariableSection" API object
-     * @param scope the scope in which to define this object
-     * @param id a scope-local name for the object
-     * @param props initialization props
-     */
-    constructor(scope, id, props) {
-        super(scope, id, {
-            ...FirestartrGithubOrganizationVariableSection.GVK,
-            ...props,
-        });
-    }
-    /**
-     * Renders the object to Kubernetes JSON.
-     */
-    toJson() {
-        const resolved = super.toJson();
-        return {
-            ...FirestartrGithubOrganizationVariableSection.GVK,
-            ...toJson_FirestartrGithubOrganizationVariableSectionProps(resolved),
-        };
-    }
-}
-/**
- * Returns the apiVersion and kind for "FirestartrGithubOrganizationVariableSection"
- */
-FirestartrGithubOrganizationVariableSection.GVK = {
-    apiVersion: 'firestartr.dev/v1',
-    kind: 'FirestartrGithubOrganizationVariableSection',
-};
-
-/**
- * Converts an object of type 'FirestartrGithubOrganizationVariableSectionProps' to JSON representation.
- */
-/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
-function toJson_FirestartrGithubOrganizationVariableSectionProps(obj) {
-    if (obj === undefined) {
-        return undefined;
-    }
-    const result = {
-        'metadata': obj.metadata,
-        'spec': toJson_FirestartrGithubOrganizationVariableSectionSpec(obj.spec),
-    };
-    // filter undefined values
-    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
-}
-/**
- * Converts an object of type 'FirestartrGithubOrganizationVariableSectionSpec' to JSON representation.
- */
-/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
-function toJson_FirestartrGithubOrganizationVariableSectionSpec(obj) {
-    if (obj === undefined) {
-        return undefined;
-    }
-    const result = {
-        'org': obj.org,
-        'actionsVariables': obj.actionsVariables?.map(y => toJson_FirestartrGithubOrganizationVariableSectionSpecActionsVariables(y)),
-        'context': toJson_FirestartrGithubOrganizationVariableSectionSpecContext(obj.context),
-        'firestartr': toJson_FirestartrGithubOrganizationVariableSectionSpecFirestartr(obj.firestartr),
-        'writeConnectionSecretToRef': toJson_FirestartrGithubOrganizationVariableSectionSpecWriteConnectionSecretToRef(obj.writeConnectionSecretToRef),
-    };
-    // filter undefined values
-    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
-}
-/**
- * Converts an object of type 'FirestartrGithubOrganizationVariableSectionSpecActionsVariables' to JSON representation.
- */
-/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
-function toJson_FirestartrGithubOrganizationVariableSectionSpecActionsVariables(obj) {
-    if (obj === undefined) {
-        return undefined;
-    }
-    const result = {
-        'name': obj.name,
-        'value': obj.value,
-        'visibility': obj.visibility,
-        'selectedRepositories': obj.selectedRepositories?.map(y => y),
-    };
-    // filter undefined values
-    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
-}
-/**
- * Converts an object of type 'FirestartrGithubOrganizationVariableSectionSpecContext' to JSON representation.
- */
-/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
-function toJson_FirestartrGithubOrganizationVariableSectionSpecContext(obj) {
-    if (obj === undefined) {
-        return undefined;
-    }
-    const result = {
-        'backend': toJson_FirestartrGithubOrganizationVariableSectionSpecContextBackend(obj.backend),
-        'provider': toJson_FirestartrGithubOrganizationVariableSectionSpecContextProvider(obj.provider),
-    };
-    // filter undefined values
-    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
-}
-/**
- * Converts an object of type 'FirestartrGithubOrganizationVariableSectionSpecFirestartr' to JSON representation.
- */
-/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
-function toJson_FirestartrGithubOrganizationVariableSectionSpecFirestartr(obj) {
-    if (obj === undefined) {
-        return undefined;
-    }
-    const result = {
-        'tfStateKey': obj.tfStateKey,
-    };
-    // filter undefined values
-    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
-}
-/**
- * Converts an object of type 'FirestartrGithubOrganizationVariableSectionSpecWriteConnectionSecretToRef' to JSON representation.
- */
-/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
-function toJson_FirestartrGithubOrganizationVariableSectionSpecWriteConnectionSecretToRef(obj) {
-    if (obj === undefined) {
-        return undefined;
-    }
-    const result = {
-        'name': obj.name,
-        'outputs': obj.outputs?.map(y => toJson_FirestartrGithubOrganizationVariableSectionSpecWriteConnectionSecretToRefOutputs(y)),
-    };
-    // filter undefined values
-    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
-}
-/* eslint-enable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
-/**
- * Visibility of the variable
- *
- * @schema FirestartrGithubOrganizationVariableSectionSpecActionsVariablesVisibility
- */
-var FirestartrGithubOrganizationVariableSectionSpecActionsVariablesVisibility;
-(function (FirestartrGithubOrganizationVariableSectionSpecActionsVariablesVisibility) {
-    /** all */
-    FirestartrGithubOrganizationVariableSectionSpecActionsVariablesVisibility["ALL"] = "all";
-    /** private */
-    FirestartrGithubOrganizationVariableSectionSpecActionsVariablesVisibility["PRIVATE"] = "private";
-    /** selected */
-    FirestartrGithubOrganizationVariableSectionSpecActionsVariablesVisibility["SELECTED"] = "selected";
-})(FirestartrGithubOrganizationVariableSectionSpecActionsVariablesVisibility || (FirestartrGithubOrganizationVariableSectionSpecActionsVariablesVisibility = {}));
-/**
- * Converts an object of type 'FirestartrGithubOrganizationVariableSectionSpecContextBackend' to JSON representation.
- */
-/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
-function toJson_FirestartrGithubOrganizationVariableSectionSpecContextBackend(obj) {
-    if (obj === undefined) {
-        return undefined;
-    }
-    const result = {
-        'ref': toJson_FirestartrGithubOrganizationVariableSectionSpecContextBackendRef(obj.ref),
-    };
-    // filter undefined values
-    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
-}
-/**
- * Converts an object of type 'FirestartrGithubOrganizationVariableSectionSpecContextProvider' to JSON representation.
- */
-/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
-function toJson_FirestartrGithubOrganizationVariableSectionSpecContextProvider(obj) {
-    if (obj === undefined) {
-        return undefined;
-    }
-    const result = {
-        'ref': toJson_FirestartrGithubOrganizationVariableSectionSpecContextProviderRef(obj.ref),
-    };
-    // filter undefined values
-    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
-}
-/**
- * Converts an object of type 'FirestartrGithubOrganizationVariableSectionSpecWriteConnectionSecretToRefOutputs' to JSON representation.
- */
-/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
-function toJson_FirestartrGithubOrganizationVariableSectionSpecWriteConnectionSecretToRefOutputs(obj) {
-    if (obj === undefined) {
-        return undefined;
-    }
-    const result = {
-        'key': obj.key,
-    };
-    // filter undefined values
-    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
-}
-/**
- * Converts an object of type 'FirestartrGithubOrganizationVariableSectionSpecContextBackendRef' to JSON representation.
- */
-/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
-function toJson_FirestartrGithubOrganizationVariableSectionSpecContextBackendRef(obj) {
-    if (obj === undefined) {
-        return undefined;
-    }
-    const result = {
-        'kind': obj.kind,
-        'name': obj.name,
-    };
-    // filter undefined values
-    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
-}
-/**
- * Converts an object of type 'FirestartrGithubOrganizationVariableSectionSpecContextProviderRef' to JSON representation.
- */
-/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
-function toJson_FirestartrGithubOrganizationVariableSectionSpecContextProviderRef(obj) {
-    if (obj === undefined) {
-        return undefined;
-    }
-    const result = {
-        'kind': obj.kind,
-        'name': obj.name,
-    };
-    // filter undefined values
-    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
-}
-/* eslint-enable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
-/**
- * @schema FirestartrGithubOrganizationVariableSectionSpecContextBackendRefKind
- */
-var FirestartrGithubOrganizationVariableSectionSpecContextBackendRefKind;
-(function (FirestartrGithubOrganizationVariableSectionSpecContextBackendRefKind) {
-    /** FirestartrProviderConfig */
-    FirestartrGithubOrganizationVariableSectionSpecContextBackendRefKind["FIRESTARTR_PROVIDER_CONFIG"] = "FirestartrProviderConfig";
-})(FirestartrGithubOrganizationVariableSectionSpecContextBackendRefKind || (FirestartrGithubOrganizationVariableSectionSpecContextBackendRefKind = {}));
-/**
- * @schema FirestartrGithubOrganizationVariableSectionSpecContextProviderRefKind
- */
-var FirestartrGithubOrganizationVariableSectionSpecContextProviderRefKind;
-(function (FirestartrGithubOrganizationVariableSectionSpecContextProviderRefKind) {
-    /** FirestartrProviderConfig */
-    FirestartrGithubOrganizationVariableSectionSpecContextProviderRefKind["FIRESTARTR_PROVIDER_CONFIG"] = "FirestartrProviderConfig";
-})(FirestartrGithubOrganizationVariableSectionSpecContextProviderRefKind || (FirestartrGithubOrganizationVariableSectionSpecContextProviderRefKind = {}));
 /**
  * A resource to handle GitHub Organization Webhooks
  *
@@ -331304,137 +330412,6 @@ class GithubOrgSettingsChart extends BaseGithubChart {
     }
 }
 
-;// CONCATENATED MODULE: ../cdk8s_renderer/src/charts/github/orgVariableSectionChart.ts
-
-
-
-class GithubOrgVariableSectionChart extends BaseGithubChart {
-    template() {
-        const claim = this.get('claim');
-        const firestartrId = this.get('firestartrId');
-        const githubProvider = claim.providers.github;
-        const actionsVariables = (githubProvider.actions_variables || []).map((v) => {
-            const entry = {
-                name: v.name,
-                value: v.value,
-                visibility: v.visibility,
-            };
-            if (v.selected_repositories && v.selected_repositories.length > 0) {
-                entry.selectedRepositories = v.selected_repositories.map((ref) => {
-                    const match = ref.match(/^component:(.+)$/);
-                    if (!match) {
-                        throw new ChartRenderError('OrgSettingsClaim', claim.name, `Invalid component ref "${ref}" in selected_repositories. Expected format: component:<name>`);
-                    }
-                    const componentName = match[1];
-                    const resolvedCr = this.refResolver('ComponentClaim', componentName);
-                    const org = resolvedCr?.spec?.org;
-                    const repoName = resolvedCr?.metadata?.annotations?.['firestartr.dev/external-name'] || resolvedCr?.metadata?.name?.replace(/-[0-9a-f-]{36}$/, '');
-                    if (!org || !repoName) {
-                        throw new ChartRenderError('OrgSettingsClaim', claim.name, `Referenced component "${componentName}" has no GitHub provider configured`);
-                    }
-                    return `${org}/${repoName}`;
-                });
-            }
-            return entry;
-        });
-        const template = {
-            metadata: {
-                name: githubProvider.name,
-            },
-            spec: {
-                org: githubProvider.org,
-                actionsVariables,
-                firestartr: {
-                    tfStateKey: firestartrId,
-                },
-                writeConnectionSecretToRef: {
-                    name: `firestartrgithuborganizationvariablesection-${githubProvider.name}-outputs`.toLowerCase(),
-                    outputs: [{ key: 'managed_variables' }, { key: 'variable_ids' }],
-                },
-            },
-        };
-        return JSON.parse(JSON.stringify(template));
-    }
-    gvk() {
-        return FirestartrGithubOrganizationVariableSection.GVK;
-    }
-    instanceApiObject(template) {
-        return new FirestartrGithubOrganizationVariableSection(this, template.metadata.name, template);
-    }
-}
-
-;// CONCATENATED MODULE: ../cdk8s_renderer/src/charts/github/orgSecretSectionChart.ts
-
-
-
-class GithubOrgSecretSectionChart extends BaseGithubChart {
-    template() {
-        const claim = this.get('claim');
-        const firestartrId = this.get('firestartrId');
-        const githubProvider = claim.providers.github;
-        const orgSecrets = githubProvider.org_secrets || {};
-        const renderSecrets = (section) => {
-            const secrets = orgSecrets[section];
-            if (!Array.isArray(secrets))
-                return [];
-            return secrets.map((secret) => {
-                const parts = secret.value.split(':');
-                const selectedRepositories = (secret.selected_repositories || []).map((ref) => {
-                    const match = ref.match(/^component:(.+)$/);
-                    if (!match) {
-                        throw new ChartRenderError('OrgSettingsClaim', claim.name, `Invalid component ref "${ref}" in selected_repositories. Expected format: component:<name>`);
-                    }
-                    const componentName = match[1];
-                    const resolvedCr = this.refResolver('ComponentClaim', componentName);
-                    const org = resolvedCr?.spec?.org;
-                    const repoName = resolvedCr?.metadata?.annotations?.['firestartr.dev/external-name'] || resolvedCr?.metadata?.name?.replace(/-[0-9a-f-]{36}$/, '');
-                    if (!org || !repoName) {
-                        throw new ChartRenderError('OrgSettingsClaim', claim.name, `Referenced component "${componentName}" has no GitHub provider configured`);
-                    }
-                    return `${org}/${repoName}`;
-                });
-                return {
-                    name: secret.name,
-                    ref: {
-                        kind: 'Secret',
-                        name: parts[2],
-                        key: parts[3],
-                    },
-                    visibility: secret.visibility || 'all',
-                    selectedRepositories,
-                };
-            });
-        };
-        const template = {
-            metadata: {
-                name: `${githubProvider.name}-secrets`,
-            },
-            spec: {
-                org: githubProvider.org,
-                secrets: {
-                    actions: renderSecrets('actions'),
-                    codespaces: renderSecrets('codespaces'),
-                    dependabot: renderSecrets('dependabot'),
-                },
-                firestartr: {
-                    tfStateKey: firestartrId ? `${firestartrId}-secrets` : firestartrId,
-                },
-                writeConnectionSecretToRef: {
-                    name: `firestartrgithuborganizationsecretsection-${githubProvider.name}-secrets-outputs`.toLowerCase(),
-                    outputs: [{ key: 'managed_secrets' }, { key: 'secret_ids' }],
-                },
-            },
-        };
-        return JSON.parse(JSON.stringify(template));
-    }
-    gvk() {
-        return FirestartrGithubOrganizationSecretSection.GVK;
-    }
-    instanceApiObject(template) {
-        return new FirestartrGithubOrganizationSecretSection(this, template.metadata.name, template);
-    }
-}
-
 ;// CONCATENATED MODULE: ../cdk8s_renderer/src/charts/github/index.ts
 
 
@@ -331442,8 +330419,6 @@ class GithubOrgSecretSectionChart extends BaseGithubChart {
 
 
 
-
-
 ;// CONCATENATED MODULE: ../cdk8s_renderer/src/charts/catalog/base.ts
 
 class BaseCatalogChart extends BaseChart {
@@ -332191,8 +331166,6 @@ class SecretsChart extends BaseSecretsChart {
     SecretsChart: SecretsChart,
     GithubOrgWebhookChart: GithubOrgWebhookChart,
     GithubOrgSettingsChart: GithubOrgSettingsChart,
-    GithubOrgVariableSectionChart: GithubOrgVariableSectionChart,
-    GithubOrgSecretSectionChart: GithubOrgSecretSectionChart,
 });
 
 ;// CONCATENATED MODULE: ../cdk8s_renderer/src/renderer/claims-render.ts
@@ -332237,28 +331210,13 @@ async function renderClaims(catalogScope, firestartrScope, data) {
             if (configuredProvider !== AllowedProviders.all.toString()) {
                 providers = providers.filter((provider) => provider === configuredProvider);
             }
-            const expectedKind = claim.kind === 'OrgSettingsClaim'
-                ? 'FirestartrGithubOrganizationSettings'
-                : undefined;
-            const previousCR = getPreviousCRfromClaim(claim, crs, expectedKind);
-            const variableSectionPreviousCR = claim.kind === 'OrgSettingsClaim'
-                ? getPreviousCRfromClaim({ kind: claim.kind, name: `${claim.name}-variable-section` }, crs, 'FirestartrGithubOrganizationVariableSection')
-                : false;
-            const secretSectionPreviousCR = claim.kind === 'OrgSettingsClaim'
-                ? getPreviousCRfromClaim({ kind: claim.kind, name: `${claim.name}-secret-section` }, crs, 'FirestartrGithubOrganizationSecretSection')
-                : false;
+            const previousCR = getPreviousCRfromClaim(claim, crs);
             const patches = await extractPatches(renderClaims[claimKey], previousCR);
-            let variableSectionPatches = undefined;
-            let secretSectionPatches = undefined;
-            if (claim.kind === 'OrgSettingsClaim') {
-                variableSectionPatches = await extractPatches(renderClaims[claimKey], variableSectionPreviousCR);
-                secretSectionPatches = await extractPatches(renderClaims[claimKey], secretSectionPreviousCR);
-            }
             if (!previousCR) {
                 logger.debug(`No CR found for claim ${claimKey}, it will be rendered from scratch`);
             }
             const claimPath = renderClaims[claimKey].claimPath;
-            const { firestartrEntity, extraCharts, catalogEntity } = await renderClaim(catalogScope, firestartrScope, claim, patches, previousCR, claimPath, variableSectionPreviousCR, variableSectionPatches, secretSectionPreviousCR, secretSectionPatches);
+            const { firestartrEntity, extraCharts, catalogEntity } = await renderClaim(catalogScope, firestartrScope, claim, patches, previousCR, claimPath);
             if (catalogEntity) {
                 result[`${catalogEntity.kind}-${catalogEntity.metadata.name}`] =
                     catalogEntity.toJson();
@@ -332287,7 +331245,7 @@ async function renderClaims(catalogScope, firestartrScope, data) {
     }
     return result;
 }
-async function renderClaim(catalogScope, firestartrScope, claim, patches, previousCR = null, claimPath, variableSectionPreviousCR = false, variableSectionPatches, secretSectionPreviousCR = false, secretSectionPatches) {
+async function renderClaim(catalogScope, firestartrScope, claim, patches, previousCR = null, claimPath) {
     let catalogEntity = undefined;
     let firestartrEntity = undefined;
     const extraCharts = [];
@@ -332435,48 +331393,6 @@ async function renderClaim(catalogScope, firestartrScope, claim, patches, previo
         case 'OrgSettingsClaim':
             if (loadGithub) {
                 firestartrEntity = new charts.GithubOrgSettingsChart(firestartrScope, `github-${chartId}`, firestartrId, claim, renderPatches);
-                const variableSectionFirestartrId = variableSectionPreviousCR
-                    ? variableSectionPreviousCR.spec?.firestartr?.tfStateKey
-                    : firestartrId
-                        ? `${firestartrId}-variables`
-                        : null;
-                const vsRenderPatches = variableSectionPatches
-                    ? variableSectionPatches.filter((patch) => !patch.isPostPatch)
-                    : renderPatches;
-                const vsPostPatches = variableSectionPatches
-                    ? variableSectionPatches.filter((patch) => patch.isPostPatch)
-                    : postPatches;
-                const variableSectionChart = new charts.GithubOrgVariableSectionChart(firestartrScope, `github-variables-${chartId}`, variableSectionFirestartrId, claim, vsRenderPatches);
-                await variableSectionChart.render();
-                const variableSectionObject = await variableSectionChart.postRenderer(vsPostPatches);
-                extraCharts.push({
-                    claim: {
-                        kind: claim.kind,
-                        name: `${claim.name}-variable-section`,
-                    },
-                    chart: variableSectionObject,
-                });
-                const secretSectionFirestartrId = secretSectionPreviousCR
-                    ? secretSectionPreviousCR.spec?.firestartr?.tfStateKey
-                    : firestartrId
-                        ? `${firestartrId}-secrets`
-                        : null;
-                const ssRenderPatches = secretSectionPatches
-                    ? secretSectionPatches.filter((patch) => !patch.isPostPatch)
-                    : renderPatches;
-                const ssPostPatches = secretSectionPatches
-                    ? secretSectionPatches.filter((patch) => patch.isPostPatch)
-                    : postPatches;
-                const secretSectionChart = new charts.GithubOrgSecretSectionChart(firestartrScope, `github-secrets-${chartId}`, secretSectionFirestartrId, claim, ssRenderPatches);
-                await secretSectionChart.render();
-                const secretSectionObject = await secretSectionChart.postRenderer(ssPostPatches);
-                extraCharts.push({
-                    claim: {
-                        kind: claim.kind,
-                        name: `${claim.name}-secret-section`,
-                    },
-                    chart: secretSectionObject,
-                });
             }
             break;
         default:
@@ -332536,16 +331452,12 @@ function renameVariantCrFiles(outputDir, renderedMap) {
 
 const IS_COMPONENT_CLAIM_REF = new RegExp(/^ComponentClaim-/);
 const IS_TF_WORKSPACE = new RegExp(/^TFWorkspaceClaim-/);
-const IS_ORG_SETTINGS_CLAIM = new RegExp(/^OrgSettingsClaim-/);
-const COMPONENT_REF_PATTERN = /^component:(.+)$/;
 function validateSubReferences(renderClaims) {
     for (const ref of Object.keys(renderClaims)) {
         if (IS_COMPONENT_CLAIM_REF.test(ref))
             validateClaimsSecretsRefs(ref, renderClaims);
         else if (IS_TF_WORKSPACE.test(ref))
             validateTFClaimsSecretsRefs(ref, renderClaims);
-        else if (IS_ORG_SETTINGS_CLAIM.test(ref))
-            validateOrgSettingsComponentRefs(ref, renderClaims);
     }
 }
 function validateTFClaimsSecretsRefs(ref, renderClaims) {
@@ -332597,57 +331509,6 @@ function searchSecretKey(secretClaim, key) {
     }
     return found;
 }
-function validateOrgSettingsComponentRefs(ref, renderClaims) {
-    const claim = renderClaims[ref].claim;
-    validateOrgSecretsSelectedRepositories(claim, renderClaims);
-    validateActionsVariablesSelectedRepositories(claim, renderClaims);
-}
-function validateOrgSecretsSelectedRepositories(claim, renderClaims) {
-    const orgSecrets = claim?.providers?.github?.org_secrets;
-    if (!orgSecrets || typeof orgSecrets !== 'object')
-        return;
-    for (const section of ['actions', 'codespaces', 'dependabot']) {
-        const secrets = orgSecrets[section];
-        if (!Array.isArray(secrets))
-            continue;
-        for (const secret of secrets) {
-            if (!secret.selected_repositories)
-                continue;
-            for (const repoRef of secret.selected_repositories) {
-                const match = repoRef.match(COMPONENT_REF_PATTERN);
-                if (!match)
-                    continue;
-                const [, componentName] = match;
-                const expectedKey = `ComponentClaim-${componentName}`;
-                if (!renderClaims[expectedKey]) {
-                    throw new Error(`CrossReference error: OrgSettingsClaim/${claim.name} references a non-existent component "${componentName}" in org_secrets.${section}.${secret.name}.selected_repositories`);
-                }
-            }
-        }
-    }
-}
-function validateActionsVariablesSelectedRepositories(claim, renderClaims) {
-    const actionsVariables = claim?.providers?.github?.actions_variables;
-    if (!Array.isArray(actionsVariables))
-        return;
-    for (const variable of actionsVariables) {
-        if (variable.visibility !== 'selected')
-            continue;
-        const selectedRepos = variable.selected_repositories;
-        if (!Array.isArray(selectedRepos) || selectedRepos.length === 0)
-            continue;
-        for (const ref of selectedRepos) {
-            const match = ref.match(COMPONENT_REF_PATTERN);
-            if (!match)
-                continue;
-            const componentName = match[1];
-            const expectedKey = `ComponentClaim-${componentName}`;
-            if (!renderClaims[expectedKey]) {
-                throw new Error(`CrossReference error: OrgSettingsClaim/${claim.name} references a non-existent component "${componentName}" in actions_variables.${variable.name}.selected_repositories`);
-            }
-        }
-    }
-}
 
 ;// CONCATENATED MODULE: ../cdk8s_renderer/src/validations/componentPagesPath.ts
 /**
@@ -332696,176 +331557,6 @@ function validateGithubOrgSettingsSingleton(crs) {
     }
 }
 
-;// CONCATENATED MODULE: ../cdk8s_renderer/src/validations/githubOrgVariableSection.ts
-const GITHUB_ORG_VARIABLE_SECTION_KIND = 'FirestartrGithubOrganizationVariableSection';
-const githubOrgVariableSection_FIRESTARTR_CLAIM_REF_ANNOTATION = 'firestartr.dev/claim-ref';
-const githubOrgVariableSection_CLAIM_REF_LABEL = 'claim-ref';
-function githubOrgVariableSection_formatResourceRef(name, claimRef) {
-    return claimRef ? `${name} (claim: ${claimRef})` : name;
-}
-function validateGithubOrgVariableSectionSingleton(crs) {
-    const refsByOrg = new Map();
-    const seenClaimRefs = new Map();
-    for (const crKey of Object.keys(crs)) {
-        const cr = crs[crKey];
-        if (cr.kind !== GITHUB_ORG_VARIABLE_SECTION_KIND)
-            continue;
-        const org = cr.spec?.org;
-        if (typeof org !== 'string' || !org)
-            continue;
-        const name = cr.metadata?.name || crKey;
-        const claimRef = cr.metadata?.annotations?.[githubOrgVariableSection_FIRESTARTR_CLAIM_REF_ANNOTATION] ||
-            cr.metadata?.labels?.[githubOrgVariableSection_CLAIM_REF_LABEL];
-        const normalizedOrg = org.toLowerCase();
-        if (claimRef) {
-            const seen = seenClaimRefs.get(normalizedOrg) || new Set();
-            if (seen.has(claimRef))
-                continue;
-            seen.add(claimRef);
-            seenClaimRefs.set(normalizedOrg, seen);
-        }
-        const refs = refsByOrg.get(normalizedOrg) || [];
-        refs.push(githubOrgVariableSection_formatResourceRef(name, claimRef));
-        refsByOrg.set(normalizedOrg, refs);
-    }
-    for (const [org, refs] of refsByOrg.entries()) {
-        if (refs.length < 2)
-            continue;
-        throw new Error(`Duplicate ${GITHUB_ORG_VARIABLE_SECTION_KIND} resources found for GitHub organization "${org}": ${refs.join(', ')}`);
-    }
-}
-function validateActionsVariablesUniqueness(crs) {
-    for (const crKey of Object.keys(crs)) {
-        const cr = crs[crKey];
-        if (cr.kind !== GITHUB_ORG_VARIABLE_SECTION_KIND)
-            continue;
-        const actionsVariables = cr.spec?.actionsVariables;
-        if (!Array.isArray(actionsVariables))
-            continue;
-        const names = new Set();
-        for (const variable of actionsVariables) {
-            const varName = variable?.name;
-            if (!varName)
-                continue;
-            if (names.has(varName)) {
-                const org = cr.spec?.org || 'unknown';
-                throw new Error(`Duplicate action variable name "${varName}" found in ${GITHUB_ORG_VARIABLE_SECTION_KIND} for organization "${org}"`);
-            }
-            names.add(varName);
-        }
-    }
-}
-
-;// CONCATENATED MODULE: ../cdk8s_renderer/src/validations/githubOrgSecretSection.ts
-const GITHUB_ORG_SECRET_SECTION_KIND = 'FirestartrGithubOrganizationSecretSection';
-const githubOrgSecretSection_FIRESTARTR_CLAIM_REF_ANNOTATION = 'firestartr.dev/claim-ref';
-const githubOrgSecretSection_CLAIM_REF_LABEL = 'claim-ref';
-const SECRETS_CLAIM_REF_PATTERN = /^ref:secretsclaim:([a-zA-Z0-9_-]+):([a-zA-Z0-9_-]+)$/;
-function githubOrgSecretSection_formatResourceRef(name, claimRef) {
-    return claimRef ? `${name} (claim: ${claimRef})` : name;
-}
-function validateGithubOrgSecretSectionSingleton(crs) {
-    const refsByOrg = new Map();
-    const seenClaimRefs = new Map();
-    for (const crKey of Object.keys(crs)) {
-        const cr = crs[crKey];
-        if (cr.kind !== GITHUB_ORG_SECRET_SECTION_KIND)
-            continue;
-        const org = cr.spec?.org;
-        if (typeof org !== 'string' || !org)
-            continue;
-        const name = cr.metadata?.name || crKey;
-        const claimRef = cr.metadata?.annotations?.[githubOrgSecretSection_FIRESTARTR_CLAIM_REF_ANNOTATION] ||
-            cr.metadata?.labels?.[githubOrgSecretSection_CLAIM_REF_LABEL];
-        const normalizedOrg = org.toLowerCase();
-        if (claimRef) {
-            const seen = seenClaimRefs.get(normalizedOrg) || new Set();
-            if (seen.has(claimRef))
-                continue;
-            seen.add(claimRef);
-            seenClaimRefs.set(normalizedOrg, seen);
-        }
-        const refs = refsByOrg.get(normalizedOrg) || [];
-        refs.push(githubOrgSecretSection_formatResourceRef(name, claimRef));
-        refsByOrg.set(normalizedOrg, refs);
-    }
-    for (const [org, refs] of refsByOrg.entries()) {
-        if (refs.length < 2)
-            continue;
-        throw new Error(`Duplicate ${GITHUB_ORG_SECRET_SECTION_KIND} resources found for GitHub organization "${org}": ${refs.join(', ')}`);
-    }
-}
-function validateSecretNamesUniqueness(crs) {
-    for (const crKey of Object.keys(crs)) {
-        const cr = crs[crKey];
-        if (cr.kind !== GITHUB_ORG_SECRET_SECTION_KIND)
-            continue;
-        const secrets = cr.spec?.secrets;
-        if (!secrets || typeof secrets !== 'object')
-            continue;
-        for (const section of ['actions', 'codespaces', 'dependabot']) {
-            const sectionSecrets = secrets[section];
-            if (!Array.isArray(sectionSecrets))
-                continue;
-            const names = new Set();
-            for (const secret of sectionSecrets) {
-                const secretName = secret?.name;
-                if (!secretName)
-                    continue;
-                if (names.has(secretName)) {
-                    const org = cr.spec?.org || 'unknown';
-                    throw new Error(`Duplicate secret name "${secretName}" found in ${section} section of ${GITHUB_ORG_SECRET_SECTION_KIND} for organization "${org}"`);
-                }
-                names.add(secretName);
-            }
-        }
-    }
-}
-function validateOrgSecretsCrossReferences(renderClaims) {
-    for (const claimKey of Object.keys(renderClaims)) {
-        if (!claimKey.startsWith('OrgSettingsClaim-'))
-            continue;
-        const claimData = renderClaims[claimKey];
-        const claim = claimData?.claim;
-        const orgSecrets = claim?.providers?.github?.org_secrets;
-        if (!orgSecrets || typeof orgSecrets !== 'object')
-            continue;
-        for (const section of ['actions', 'codespaces', 'dependabot']) {
-            const secrets = orgSecrets[section];
-            if (!Array.isArray(secrets))
-                continue;
-            for (const secret of secrets) {
-                if (!secret.value)
-                    continue;
-                const match = secret.value.match(SECRETS_CLAIM_REF_PATTERN);
-                if (!match)
-                    continue;
-                const [, secretClaimName, secretKey] = match;
-                const expectedKey = `SecretsClaim-${secretClaimName}`;
-                if (!renderClaims[expectedKey])
-                    continue;
-                const secretClaim = renderClaims[expectedKey]?.claim;
-                const externalSecrets = secretClaim?.providers?.external_secrets?.externalSecrets?.secrets;
-                const pushSecrets = secretClaim?.providers?.external_secrets?.pushSecrets;
-                let keyFound = false;
-                if (Array.isArray(pushSecrets)) {
-                    keyFound =
-                        pushSecrets.find((s) => s.secretName === secretKey) !==
-                            undefined;
-                }
-                if (!keyFound && Array.isArray(externalSecrets)) {
-                    keyFound =
-                        externalSecrets.find((s) => s.secretName === secretKey) !==
-                            undefined;
-                }
-                if (!keyFound) {
-                    throw new Error(`CrossReference error: OrgSettingsClaim/${claim.name} references a non-existent secret key "${secretKey}" in SecretsClaim/${secretClaimName} via org_secrets.${section}.${secret.name}`);
-                }
-            }
-        }
-    }
-}
-
 ;// CONCATENATED MODULE: ../cdk8s_renderer/src/renderer/renderer.ts
 
 
@@ -332876,8 +331567,6 @@ function validateOrgSecretsCrossReferences(renderClaims) {
 
 
 
-
-
 /*
  * Function called when rendering but not importing
  *
@@ -332899,13 +331588,8 @@ async function renderer_render(catalogScope, firestartrScope, claimList) {
     try {
         validateSubReferences(data.renderClaims);
         validateComponentPagesPath(data.renderClaims);
-        validateOrgSecretsCrossReferences(data.renderClaims);
         validateTfStateKeyUniqueness(result);
         validateGithubOrgSettingsSingleton(fullCrSet);
-        validateGithubOrgVariableSectionSingleton(fullCrSet);
-        validateActionsVariablesUniqueness(result);
-        validateGithubOrgSecretSectionSingleton(fullCrSet);
-        validateSecretNamesUniqueness(result);
         validateCrSizes(result);
         validatePermissionsUniqueness(result);
     }
@@ -335237,8 +333921,6 @@ const kindPluralMap = {
     terraformmodules: 'FirestartrTerraformModule',
     githuborgwebhooks: 'FirestartrGithubOrgWebhook',
     githuborganizationsettings: 'FirestartrGithubOrganizationSettings',
-    githuborganizationvariablesections: 'FirestartrGithubOrganizationVariableSection',
-    githuborganizationsecretsections: 'FirestartrGithubOrganizationSecretSection',
     terraformworkspaces: 'FirestartrTerraformWorkspace',
     terraformworkspaceplans: 'FirestartrTerraformWorkspacePlan',
     providerconfigs: 'FirestartrProviderConfig',
@@ -337216,8 +335898,6 @@ const kindsWithFinalizer = [
     'FirestartrGithubRepositoryFeature',
     'FirestartrGithubOrgWebhook',
     'FirestartrGithubOrganizationSettings',
-    'FirestartrGithubOrganizationVariableSection',
-    'FirestartrGithubOrganizationSecretSection',
     'FirestartrGithubRepositorySecretsSection',
 ];
 const kindsWithDependants = [
@@ -340167,7 +338847,7 @@ async function configGit() {
     }
     // Import github dynamically to avoid Jest ESM issues when not specifically running this function
     // (see CONSTITUTION and RULES: must not change test machinery)
-    const githubModule = await Promise.resolve(/* import() */).then(__nccwpck_require__.bind(__nccwpck_require__, 3342));
+    const githubModule = await Promise.resolve(/* import() */).then(__nccwpck_require__.bind(__nccwpck_require__, 99029));
     const github = githubModule.default || githubModule;
     if (external_fs_.existsSync(gitconfigPath)) {
         external_fs_.rmSync(gitconfigPath);
@@ -343759,15 +342439,6 @@ const MODULES = {
         // github-org-settings-v0.1.0
         ref: 'c30c5dfdaddf2bca9e966a726d45970c98576e9e',
     },
-    FirestartrGithubOrganizationVariableSection: {
-        module: 'git::https://github.com/prefapp/tfm.git//modules/github-org-variables-section',
-        ref: '79c1407',
-    },
-    FirestartrGithubOrganizationSecretSection: {
-        module: 'git::https://github.com/prefapp/tfm.git//modules/github-org-secrets-section',
-        // feat/1364-feat-add-github-org-secrets-section-module
-        ref: '4380434b158bb38d0b831b0f3d1fc51e7bd509a4',
-    },
 };
 function getFirestartrDefaultTFM(kind) {
     if (kind in MODULES) {
@@ -345570,294 +344241,6 @@ class EntityGHOrgSettings extends base_Entity {
     }
 }
 
-;// CONCATENATED MODULE: ../gh_provisioner/src/entities/ghorgvarsection/index.ts
-
-
-
-class EntityGHOrgVarsSection extends base_Entity {
-    constructor(artifact) {
-        super(artifact, {
-            config: {
-                variables: {},
-            },
-        });
-    }
-    async loadResources(tfOp) {
-        gh_provisioner_src_logger.info(`[gh-provisioner] running ${tfOp} on ${this.k8sId}`);
-        try {
-            const cr = this.cr;
-            const actionsVariables = cr.spec.actionsVariables || [];
-            const variables = {};
-            for (const v of actionsVariables) {
-                const entry = {
-                    value: v.value,
-                    visibility: v.visibility,
-                };
-                if (v.visibility === 'selected' && v.selectedRepositories) {
-                    entry.selectedRepositoryIds = v.selectedRepositories;
-                }
-                variables[v.name] = entry;
-            }
-            this.patchData({
-                op: PatchOperations.replace,
-                path: '/config/variables',
-                value: variables,
-            });
-            if (tfOp === 'apply') {
-                await this.adoptVariablesIfNeeded(actionsVariables);
-            }
-            gh_provisioner_src_logger.debug(`[gh-provisioner] ${this.k8sId} loaded its data`);
-        }
-        catch (err) {
-            const message = err instanceof Error ? err.message : String(err);
-            gh_provisioner_src_logger.error(`[gh-provisioner] ${this.k8sId} error loading resources: ${message}`);
-            throw new Error(`[gh-provisioner] ${this.k8sId} error loading resources: ${message}`);
-        }
-    }
-    async adoptVariablesIfNeeded(declaredVars) {
-        const cr = this.cr;
-        const managedVariables = this.cr.fResolveSelfOutputs('managed_variables') || [];
-        const declaredNames = declaredVars.map((v) => v.name);
-        const newToModule = declaredNames.filter((name) => !managedVariables.includes(name));
-        if (newToModule.length === 0) {
-            gh_provisioner_src_logger.debug(`[gh-provisioner] ${this.k8sId} all declared variables are already managed, no adoption needed`);
-            return;
-        }
-        if (managedVariables.length === 0) {
-            gh_provisioner_src_logger.info(`[gh-provisioner] ${this.k8sId} no managed_variables output — first reconciliation, treating all ${newToModule.length} declared variable(s) as new to module`);
-        }
-        for (const varName of newToModule) {
-            try {
-                await this.runWithGithubProvider(async () => {
-                    await github["default"].org.getOrgVariable(cr.spec.org, varName);
-                });
-                gh_provisioner_src_logger.info(`[gh-provisioner] ${this.k8sId} adopting pre-existing variable '${varName}' on GitHub org '${cr.spec.org}'`);
-                this.patchImportData({
-                    op: PatchOperations.add,
-                    path: '/imports/-',
-                    value: {
-                        to: `github_actions_organization_variable.this["${varName}"]`,
-                        id: varName,
-                    },
-                });
-            }
-            catch (err) {
-                if (err && err.status === 404) {
-                    gh_provisioner_src_logger.info(`[gh-provisioner] ${this.k8sId} variable '${varName}' not found on GitHub org '${cr.spec.org}' — will be created by TFM`);
-                }
-                else if (err && (err.status === 401 || err.status === 403)) {
-                    gh_provisioner_src_logger.warn(`[gh-provisioner] ${this.k8sId} token lacks scope to check variable '${varName}' on org '${cr.spec.org}' — skipping adoption gracefully`);
-                }
-                else {
-                    gh_provisioner_src_logger.error(`[gh-provisioner] ${this.k8sId} unexpected error checking variable '${varName}' on org '${cr.spec.org}': ${err instanceof Error ? err.message : String(err)}`);
-                }
-            }
-        }
-    }
-    async postProvision(tfOp) { }
-    async loadAddressesToImport() { }
-}
-
-;// CONCATENATED MODULE: ../gh_provisioner/src/entities/ghorgsecretsection/secrets.ts
-
-
-
-
-const secrets_SECTIONS = ['actions', 'codespaces', 'dependabot'];
-
-async function provisionOrgSecrets(entity, secrets) {
-    gh_provisioner_src_logger.info(`[gh-provisioner] ${entity.k8sId} provisioning org secrets`);
-    for (const section of secrets_SECTIONS) {
-        const sectionSecrets = secrets[section] || [];
-        if (sectionSecrets.length === 0)
-            continue;
-        let preFetchedKey;
-        try {
-            preFetchedKey = await fetchOrgPublicKey(entity, section);
-        }
-        catch (err) {
-            const message = err instanceof Error ? err.message : String(err);
-            throw new Error(`[gh-provisioner] ${entity.k8sId} failed to fetch ${section} org public key: ${message}`);
-        }
-        for (const secret of sectionSecrets) {
-            await provisionOrgSecret(entity, section, secret, preFetchedKey);
-        }
-    }
-}
-async function fetchOrgPublicKey(entity, section) {
-    return (await entity.runWithGithubProvider(async () => {
-        return await github["default"].encryption.getOrgPublicKey(entity.cr.spec.org, section);
-    }));
-}
-async function provisionOrgSecret(entity, section, secret, preFetchedKey) {
-    gh_provisioner_src_logger.info(`[gh-provisioner] provisioning org secret ${entity.k8sId}/${section}/${secret.name}`);
-    if (process.env['AVOID_PROVIDER_SECRET_ENCRYPTION']) {
-        await secrets_createUnencryptedSecret(entity, section, secret);
-    }
-    else {
-        await secrets_createEncryptedSecret(entity, section, secret, preFetchedKey);
-    }
-    gh_provisioner_src_logger.info(`[gh-provisioner] org secret provisioned ${section}/${secret.name}`);
-}
-async function secrets_createEncryptedSecret(entity, section, secret, preFetchedKey) {
-    const plainSecret = base_Entity.refResolver(secret.ref);
-    const plainTextSecret = plainSecret.getOutput(secret.ref.key);
-    const plaintextSha256 = external_crypto_default().createHash('sha256')
-        .update(plainTextSecret)
-        .digest('hex');
-    const { encrypted_value } = (await entity.runWithGithubProvider(async () => {
-        return await github["default"].encryption.encryptOrgSecret(entity.cr.spec.org, section, plainTextSecret, preFetchedKey);
-    }));
-    entity.patchData({
-        op: PatchOperations.add,
-        path: `/config/${section}/${secret.name}`,
-        value: {
-            value: encrypted_value,
-            visibility: secret.visibility || 'all',
-            ...(secret.selectedRepositories && secret.selectedRepositories.length > 0
-                ? { selectedRepositories: secret.selectedRepositories }
-                : {}),
-        },
-    });
-    entity.patchData({
-        op: PatchOperations.add,
-        path: `/config/${section}_sha256/${secret.name}`,
-        value: plaintextSha256,
-    });
-}
-async function secrets_createUnencryptedSecret(entity, section, secret) {
-    const plainSecret = base_Entity.refResolver(secret.ref);
-    const plainTextSecret = plainSecret.getOutput(secret.ref.key);
-    const plaintextSha256 = external_crypto_default().createHash('sha256')
-        .update(plainTextSecret)
-        .digest('hex');
-    entity.patchData({
-        op: PatchOperations.add,
-        path: `/config/${section}/${secret.name}`,
-        value: {
-            value: plainTextSecret,
-            visibility: secret.visibility || 'all',
-            ...(secret.selectedRepositories && secret.selectedRepositories.length > 0
-                ? { selectedRepositories: secret.selectedRepositories }
-                : {}),
-        },
-    });
-    entity.patchData({
-        op: PatchOperations.add,
-        path: `/config/${section}_sha256/${secret.name}`,
-        value: plaintextSha256,
-    });
-}
-async function adoptSecretsIfNeeded(entity, secrets) {
-    const managedSecrets = entity.cr.fResolveSelfOutputs('managed_secrets') || [];
-    for (const section of secrets_SECTIONS) {
-        const sectionSecrets = secrets[section] || [];
-        if (sectionSecrets.length === 0)
-            continue;
-        const declaredNames = sectionSecrets.map((s) => s.name);
-        const newToModule = declaredNames.filter((name) => !managedSecrets.includes(name));
-        if (newToModule.length === 0) {
-            gh_provisioner_src_logger.debug(`[gh-provisioner] ${entity.k8sId} all declared ${section} secrets are already managed`);
-            continue;
-        }
-        if (managedSecrets.length === 0) {
-            gh_provisioner_src_logger.info(`[gh-provisioner] ${entity.k8sId} no managed_secrets output — first reconciliation, treating all ${newToModule.length} ${section} secret(s) as new to module`);
-        }
-        for (const secretName of newToModule) {
-            try {
-                const existing = (await entity.runWithGithubProvider(async () => {
-                    return await github["default"].encryption.getOrgSecret(entity.cr.spec.org, section, secretName);
-                }));
-                if (existing) {
-                    gh_provisioner_src_logger.info(`[gh-provisioner] ${entity.k8sId} adopting pre-existing ${section} secret '${secretName}' on GitHub org '${entity.cr.spec.org}'`);
-                    const resourceType = `github_${section}_organization_secret`;
-                    entity.patchImportData({
-                        op: PatchOperations.add,
-                        path: '/imports/-',
-                        value: {
-                            to: `${resourceType}.this["${secretName}"]`,
-                            id: secretName,
-                        },
-                    });
-                    const secretEntry = sectionSecrets.find((s) => s.name === secretName);
-                    if (secretEntry &&
-                        secretEntry.visibility === 'selected' &&
-                        (section === 'actions' || section === 'dependabot')) {
-                        const bindingType = `github_${section}_organization_secret_repositories`;
-                        entity.patchImportData({
-                            op: PatchOperations.add,
-                            path: '/imports/-',
-                            value: {
-                                to: `${bindingType}.this["${secretName}"]`,
-                                id: secretName,
-                            },
-                        });
-                    }
-                }
-            }
-            catch (err) {
-                if (err && err.status === 404) {
-                    gh_provisioner_src_logger.info(`[gh-provisioner] ${entity.k8sId} ${section} secret '${secretName}' not found on GitHub org '${entity.cr.spec.org}' — will be created by TFM`);
-                }
-                else if (err && (err.status === 401 || err.status === 403)) {
-                    gh_provisioner_src_logger.warn(`[gh-provisioner] ${entity.k8sId} token lacks scope to check ${section} secret '${secretName}' on org '${entity.cr.spec.org}' — skipping adoption gracefully`);
-                }
-                else {
-                    gh_provisioner_src_logger.warn(`[gh-provisioner] ${entity.k8sId} unexpected error checking ${section} secret '${secretName}' on org '${entity.cr.spec.org}': ${err instanceof Error ? err.message : String(err)}`);
-                }
-            }
-        }
-    }
-}
-
-;// CONCATENATED MODULE: ../gh_provisioner/src/entities/ghorgsecretsection/index.ts
-
-
-
-class EntityGHOrgSecretSection extends base_Entity {
-    constructor(artifact) {
-        super(artifact, {
-            config: {
-                org: '',
-                actions: {},
-                codespaces: {},
-                dependabot: {},
-                actions_sha256: {},
-                codespaces_sha256: {},
-                dependabot_sha256: {},
-            },
-        });
-    }
-    async loadResources(tfOp) {
-        gh_provisioner_src_logger.info(`[gh-provisioner] running ${tfOp} on ${this.k8sId}`);
-        try {
-            const cr = this.cr;
-            const org = cr.spec.org;
-            const secrets = cr.spec.secrets || {};
-            this.patchData({
-                op: PatchOperations.replace,
-                path: '/config/org',
-                value: org,
-            });
-            await provisionOrgSecrets(this, secrets);
-            const redactedDoc = JSON.parse(JSON.stringify(this._document, (key, value) => typeof value === 'string' && value.length > 50 ? '[REDACTED]' : value));
-            this.synthMessage(`[gh-provisioner] ${this.k8sId} config:\n${JSON.stringify(redactedDoc, null, 2)}`);
-            this.synthEnd(`[gh-provisioner] ${this.k8sId} loaded its data`);
-            if (tfOp === 'apply') {
-                await adoptSecretsIfNeeded(this, secrets);
-            }
-            gh_provisioner_src_logger.debug(`[gh-provisioner] ${this.k8sId} loaded its data`);
-        }
-        catch (err) {
-            const message = err instanceof Error ? err.message : String(err);
-            gh_provisioner_src_logger.error(`[gh-provisioner] ${this.k8sId} error loading resources: ${message}`);
-            throw new Error(`[gh-provisioner] ${this.k8sId} error loading resources: ${message}`);
-        }
-    }
-    async postProvision(_tfOp) { }
-    async loadAddressesToImport() { }
-}
-
 ;// CONCATENATED MODULE: ../gh_provisioner/src/entities/ghorgwebhook/index.ts
 
 
@@ -345934,8 +344317,6 @@ class EntityGHOrgWebHook extends base_Entity {
 
 
 
-
-
 function entities_getEntity(cr) {
     const entityClass = getEntityClass(cr.kind);
     return new entityClass(cr);
@@ -345956,10 +344337,6 @@ function getEntityClass(kind) {
             return EntityGHOrgWebHook;
         case 'FirestartrGithubOrganizationSettings':
             return EntityGHOrgSettings;
-        case 'FirestartrGithubOrganizationVariableSection':
-            return EntityGHOrgVarsSection;
-        case 'FirestartrGithubOrganizationSecretSection':
-            return EntityGHOrgSecretSection;
         default:
             throw new Error(`kind ${kind} has no entity associated`);
     }
@@ -346373,7 +344750,6 @@ const GITHUB_RESOURCE_KINDS = [
     'FirestartrGithubRepositorySecretsSection',
     'FirestartrGithubOrgWebhook',
     'FirestartrGithubOrganizationSettings',
-    'FirestartrGithubOrganizationVariableSection',
 ];
 const GITHUB_REPOSITORY_DEPENDENT_KINDS = [
     'FirestartrGithubRepositoryFeature',
@@ -347632,9 +346008,6 @@ function isObserveModeActive() {
 function runOperator(opts) {
     const { ignoreLease, dummyExec, namespace, kindList, importMode, importModeSkipPlan, observeMode, withMetrics, } = opts;
     const implementedKinds = filterImplementedKinds(kindList);
-    operator_src_logger.info(`operator kindList: ${JSON.stringify(kindList)}`);
-    operator_src_logger.info(`operator implementedKinds: ${JSON.stringify(implementedKinds)}`);
-    operator_src_logger.info(`operator ignoring kinds: ${JSON.stringify(kindList.filter((k) => !implementedKinds.includes(k)))}`);
     if (observeMode)
         observeModeActive = true;
     if (withMetrics)
@@ -347708,8 +346081,6 @@ const provisionImplementations = {
     githubmemberships: process_operation_processOperation,
     githuborgwebhooks: process_operation_processOperation,
     githuborganizationsettings: process_operation_processOperation,
-    githuborganizationvariablesections: process_operation_processOperation,
-    githuborganizationsecretsections: process_operation_processOperation,
     fsdummiesa: processFirestartrDummies,
     fsdummiesb: processFirestartrDummies,
     fsdummiesc: processFirestartrDummies,
@@ -526528,7 +524899,7 @@ const crsStatusSubcommand = {
 };
 
 ;// CONCATENATED MODULE: ./package.json
-const package_namespaceObject = JSON.parse('{"i8":"2.10.0-snapshot-org-secrets-fix-1"}');
+const package_namespaceObject = JSON.parse('{"i8":"2.10.0-snapshot-fix-renderer-1"}');
 ;// CONCATENATED MODULE: ../../package.json
 const package_namespaceObject_1 = {"i8":"2.9.0"};
 // EXTERNAL MODULE: ../../node_modules/semver/index.js