@firestartr/cli 2.10.0-snapshot-org-secrets-ref-fix-1 → 2.10.0-snapshot-org-secrets-fix-1

package/build/index.js

@@ -280314,7 +280314,7 @@ function getCronNextInterval(cronLine, tz) {
 
 /***/ }),
 
-/***/ 99029:
+/***/ 3342:
 /***/ ((__unused_webpack_module, __webpack_exports__, __nccwpck_require__) => {
 
 // ESM COMPAT FLAG
@@ -285979,6 +285979,66 @@ async function encryptRepoSecret(owner, repo, section, plaintextValue, octokit)
     }
 }
 
+;// CONCATENATED MODULE: ../github/src/orgSecrets.ts
+
+
+
+async function getOrgPublicKey(org, section, octokit) {
+    logger.info(`Retrieving org public key for ${org} (${section})`);
+    try {
+        if (!octokit) {
+            octokit = await getOctokitForOrg(org);
+        }
+        const { data } = await octokit.rest[`${section}`].getOrgPublicKey({
+            org,
+        });
+        return data;
+    }
+    catch (error) {
+        logger.error(`Error retrieving org public key (${section}) for ${org}: ${error}`);
+        throw error;
+    }
+}
+async function encryptOrgSecret(org, section, plaintextValue, preFetchedKey, octokit) {
+    try {
+        const { key_id, key } = preFetchedKey
+            ? preFetchedKey
+            : await getOrgPublicKey(org, section, octokit);
+        await libsodium_wrappers.ready;
+        const publicKey = libsodium_wrappers.from_base64(key, libsodium_wrappers.base64_variants.ORIGINAL);
+        const secretBytes = libsodium_wrappers.from_string(plaintextValue);
+        const encryptedBytes = libsodium_wrappers.crypto_box_seal(secretBytes, publicKey);
+        const encryptedValue = libsodium_wrappers.to_base64(encryptedBytes, libsodium_wrappers.base64_variants.ORIGINAL);
+        return {
+            key_id,
+            encrypted_value: encryptedValue,
+        };
+    }
+    catch (err) {
+        logger.error(`Error encrypting org secret (${section}) for ${org}: ${err}`);
+        throw err;
+    }
+}
+async function getOrgSecret(org, section, name, octokit) {
+    logger.info(`Checking org secret ${name} (${section}) for ${org}`);
+    try {
+        if (!octokit) {
+            octokit = await getOctokitForOrg(org);
+        }
+        const response = await octokit.rest[`${section}`].getOrgSecret({
+            org,
+            secret_name: name,
+        });
+        return response.data;
+    }
+    catch (err) {
+        if (err && err.status === 404) {
+            return null;
+        }
+        throw err;
+    }
+}
+
 ;// CONCATENATED MODULE: ../github/src/profile.ts
 // Profile definitions and store for github package (immutable and ambient profiles)
 const profileStore = new Map();
@@ -286412,6 +286472,7 @@ function withProfile(profileName) {
 
 
 
+
 /* harmony default export */ const github = ({
     org: organization,
     repo: repository,
@@ -286434,6 +286495,9 @@ function withProfile(profileName) {
     encryption: {
         encryptRepoSecret: encryptRepoSecret,
         getRepoPublicKey: getRepoPublicKey,
+        getOrgPublicKey: getOrgPublicKey,
+        encryptOrgSecret: encryptOrgSecret,
+        getOrgSecret: getOrgSecret,
     },
     withProfile: withProfile,
     createProfile: createProfile,
@@ -319334,8 +319398,8 @@ var dist = __nccwpck_require__(44516);
 var dist_default = /*#__PURE__*/__nccwpck_require__.n(dist);
 // EXTERNAL MODULE: ../catalog_common/index.ts + 44 modules
 var catalog_common = __nccwpck_require__(78542);
-// EXTERNAL MODULE: ../github/index.ts + 37 modules
-var github = __nccwpck_require__(99029);
+// EXTERNAL MODULE: ../github/index.ts + 38 modules
+var github = __nccwpck_require__(3342);
 ;// CONCATENATED MODULE: ../cdk8s_renderer/src/patches/base.ts
 class BasePatches {
     constructor() { }
@@ -327587,7 +327651,6 @@ function toJson_FirestartrGithubOrganizationSecretSectionSpec(obj) {
         'secrets': toJson_FirestartrGithubOrganizationSecretSectionSpecSecrets(obj.secrets),
         'context': toJson_FirestartrGithubOrganizationSecretSectionSpecContext(obj.context),
         'firestartr': toJson_FirestartrGithubOrganizationSecretSectionSpecFirestartr(obj.firestartr),
-        'writeConnectionSecretToRef': toJson_FirestartrGithubOrganizationSecretSectionSpecWriteConnectionSecretToRef(obj.writeConnectionSecretToRef),
     };
     // filter undefined values
     return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
@@ -327637,21 +327700,6 @@ function toJson_FirestartrGithubOrganizationSecretSectionSpecFirestartr(obj) {
     // filter undefined values
     return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
 }
-/**
- * Converts an object of type 'FirestartrGithubOrganizationSecretSectionSpecWriteConnectionSecretToRef' to JSON representation.
- */
-/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
-function toJson_FirestartrGithubOrganizationSecretSectionSpecWriteConnectionSecretToRef(obj) {
-    if (obj === undefined) {
-        return undefined;
-    }
-    const result = {
-        'name': obj.name,
-        'outputs': obj.outputs?.map(y => toJson_FirestartrGithubOrganizationSecretSectionSpecWriteConnectionSecretToRefOutputs(y)),
-    };
-    // filter undefined values
-    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
-}
 /**
  * Converts an object of type 'FirestartrGithubOrganizationSecretSectionSpecSecretsActions' to JSON representation.
  */
@@ -327731,20 +327779,6 @@ function toJson_FirestartrGithubOrganizationSecretSectionSpecContextProvider(obj
     // filter undefined values
     return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
 }
-/**
- * Converts an object of type 'FirestartrGithubOrganizationSecretSectionSpecWriteConnectionSecretToRefOutputs' to JSON representation.
- */
-/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
-function toJson_FirestartrGithubOrganizationSecretSectionSpecWriteConnectionSecretToRefOutputs(obj) {
-    if (obj === undefined) {
-        return undefined;
-    }
-    const result = {
-        'key': obj.key,
-    };
-    // filter undefined values
-    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
-}
 /**
  * Converts an object of type 'FirestartrGithubOrganizationSecretSectionSpecSecretsActionsRef' to JSON representation.
  */
@@ -331332,6 +331366,7 @@ class GithubOrgVariableSectionChart extends BaseGithubChart {
 ;// CONCATENATED MODULE: ../cdk8s_renderer/src/charts/github/orgSecretSectionChart.ts
 
 
+
 class GithubOrgSecretSectionChart extends BaseGithubChart {
     template() {
         const claim = this.get('claim');
@@ -331344,6 +331379,20 @@ class GithubOrgSecretSectionChart extends BaseGithubChart {
                 return [];
             return secrets.map((secret) => {
                 const parts = secret.value.split(':');
+                const selectedRepositories = (secret.selected_repositories || []).map((ref) => {
+                    const match = ref.match(/^component:(.+)$/);
+                    if (!match) {
+                        throw new ChartRenderError('OrgSettingsClaim', claim.name, `Invalid component ref "${ref}" in selected_repositories. Expected format: component:<name>`);
+                    }
+                    const componentName = match[1];
+                    const resolvedCr = this.refResolver('ComponentClaim', componentName);
+                    const org = resolvedCr?.spec?.org;
+                    const repoName = resolvedCr?.metadata?.annotations?.['firestartr.dev/external-name'] || resolvedCr?.metadata?.name?.replace(/-[0-9a-f-]{36}$/, '');
+                    if (!org || !repoName) {
+                        throw new ChartRenderError('OrgSettingsClaim', claim.name, `Referenced component "${componentName}" has no GitHub provider configured`);
+                    }
+                    return `${org}/${repoName}`;
+                });
                 return {
                     name: secret.name,
                     ref: {
@@ -331352,7 +331401,7 @@ class GithubOrgSecretSectionChart extends BaseGithubChart {
                         key: parts[3],
                     },
                     visibility: secret.visibility || 'all',
-                    selectedRepositories: secret.selected_repositories || [],
+                    selectedRepositories,
                 };
             });
         };
@@ -331371,7 +331420,7 @@ class GithubOrgSecretSectionChart extends BaseGithubChart {
                     tfStateKey: firestartrId ? `${firestartrId}-secrets` : firestartrId,
                 },
                 writeConnectionSecretToRef: {
-                    name: `firestartrgithuborganizationsecretsection-${githubProvider.name}-outputs`.toLowerCase(),
+                    name: `firestartrgithuborganizationsecretsection-${githubProvider.name}-secrets-outputs`.toLowerCase(),
                     outputs: [{ key: 'managed_secrets' }, { key: 'secret_ids' }],
                 },
             },
@@ -335189,6 +335238,7 @@ const kindPluralMap = {
     githuborgwebhooks: 'FirestartrGithubOrgWebhook',
     githuborganizationsettings: 'FirestartrGithubOrganizationSettings',
     githuborganizationvariablesections: 'FirestartrGithubOrganizationVariableSection',
+    githuborganizationsecretsections: 'FirestartrGithubOrganizationSecretSection',
     terraformworkspaces: 'FirestartrTerraformWorkspace',
     terraformworkspaceplans: 'FirestartrTerraformWorkspacePlan',
     providerconfigs: 'FirestartrProviderConfig',
@@ -337167,6 +337217,7 @@ const kindsWithFinalizer = [
     'FirestartrGithubOrgWebhook',
     'FirestartrGithubOrganizationSettings',
     'FirestartrGithubOrganizationVariableSection',
+    'FirestartrGithubOrganizationSecretSection',
     'FirestartrGithubRepositorySecretsSection',
 ];
 const kindsWithDependants = [
@@ -340116,7 +340167,7 @@ async function configGit() {
     }
     // Import github dynamically to avoid Jest ESM issues when not specifically running this function
     // (see CONSTITUTION and RULES: must not change test machinery)
-    const githubModule = await Promise.resolve(/* import() */).then(__nccwpck_require__.bind(__nccwpck_require__, 99029));
+    const githubModule = await Promise.resolve(/* import() */).then(__nccwpck_require__.bind(__nccwpck_require__, 3342));
     const github = githubModule.default || githubModule;
     if (external_fs_.existsSync(gitconfigPath)) {
         external_fs_.rmSync(gitconfigPath);
@@ -343712,6 +343763,11 @@ const MODULES = {
         module: 'git::https://github.com/prefapp/tfm.git//modules/github-org-variables-section',
         ref: '79c1407',
     },
+    FirestartrGithubOrganizationSecretSection: {
+        module: 'git::https://github.com/prefapp/tfm.git//modules/github-org-secrets-section',
+        // feat/1364-feat-add-github-org-secrets-section-module
+        ref: '4380434b158bb38d0b831b0f3d1fc51e7bd509a4',
+    },
 };
 function getFirestartrDefaultTFM(kind) {
     if (kind in MODULES) {
@@ -345602,6 +345658,206 @@ class EntityGHOrgVarsSection extends base_Entity {
     async loadAddressesToImport() { }
 }
 
+;// CONCATENATED MODULE: ../gh_provisioner/src/entities/ghorgsecretsection/secrets.ts
+
+
+
+
+const secrets_SECTIONS = ['actions', 'codespaces', 'dependabot'];
+
+async function provisionOrgSecrets(entity, secrets) {
+    gh_provisioner_src_logger.info(`[gh-provisioner] ${entity.k8sId} provisioning org secrets`);
+    for (const section of secrets_SECTIONS) {
+        const sectionSecrets = secrets[section] || [];
+        if (sectionSecrets.length === 0)
+            continue;
+        let preFetchedKey;
+        try {
+            preFetchedKey = await fetchOrgPublicKey(entity, section);
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            throw new Error(`[gh-provisioner] ${entity.k8sId} failed to fetch ${section} org public key: ${message}`);
+        }
+        for (const secret of sectionSecrets) {
+            await provisionOrgSecret(entity, section, secret, preFetchedKey);
+        }
+    }
+}
+async function fetchOrgPublicKey(entity, section) {
+    return (await entity.runWithGithubProvider(async () => {
+        return await github["default"].encryption.getOrgPublicKey(entity.cr.spec.org, section);
+    }));
+}
+async function provisionOrgSecret(entity, section, secret, preFetchedKey) {
+    gh_provisioner_src_logger.info(`[gh-provisioner] provisioning org secret ${entity.k8sId}/${section}/${secret.name}`);
+    if (process.env['AVOID_PROVIDER_SECRET_ENCRYPTION']) {
+        await secrets_createUnencryptedSecret(entity, section, secret);
+    }
+    else {
+        await secrets_createEncryptedSecret(entity, section, secret, preFetchedKey);
+    }
+    gh_provisioner_src_logger.info(`[gh-provisioner] org secret provisioned ${section}/${secret.name}`);
+}
+async function secrets_createEncryptedSecret(entity, section, secret, preFetchedKey) {
+    const plainSecret = base_Entity.refResolver(secret.ref);
+    const plainTextSecret = plainSecret.getOutput(secret.ref.key);
+    const plaintextSha256 = external_crypto_default().createHash('sha256')
+        .update(plainTextSecret)
+        .digest('hex');
+    const { encrypted_value } = (await entity.runWithGithubProvider(async () => {
+        return await github["default"].encryption.encryptOrgSecret(entity.cr.spec.org, section, plainTextSecret, preFetchedKey);
+    }));
+    entity.patchData({
+        op: PatchOperations.add,
+        path: `/config/${section}/${secret.name}`,
+        value: {
+            value: encrypted_value,
+            visibility: secret.visibility || 'all',
+            ...(secret.selectedRepositories && secret.selectedRepositories.length > 0
+                ? { selectedRepositories: secret.selectedRepositories }
+                : {}),
+        },
+    });
+    entity.patchData({
+        op: PatchOperations.add,
+        path: `/config/${section}_sha256/${secret.name}`,
+        value: plaintextSha256,
+    });
+}
+async function secrets_createUnencryptedSecret(entity, section, secret) {
+    const plainSecret = base_Entity.refResolver(secret.ref);
+    const plainTextSecret = plainSecret.getOutput(secret.ref.key);
+    const plaintextSha256 = external_crypto_default().createHash('sha256')
+        .update(plainTextSecret)
+        .digest('hex');
+    entity.patchData({
+        op: PatchOperations.add,
+        path: `/config/${section}/${secret.name}`,
+        value: {
+            value: plainTextSecret,
+            visibility: secret.visibility || 'all',
+            ...(secret.selectedRepositories && secret.selectedRepositories.length > 0
+                ? { selectedRepositories: secret.selectedRepositories }
+                : {}),
+        },
+    });
+    entity.patchData({
+        op: PatchOperations.add,
+        path: `/config/${section}_sha256/${secret.name}`,
+        value: plaintextSha256,
+    });
+}
+async function adoptSecretsIfNeeded(entity, secrets) {
+    const managedSecrets = entity.cr.fResolveSelfOutputs('managed_secrets') || [];
+    for (const section of secrets_SECTIONS) {
+        const sectionSecrets = secrets[section] || [];
+        if (sectionSecrets.length === 0)
+            continue;
+        const declaredNames = sectionSecrets.map((s) => s.name);
+        const newToModule = declaredNames.filter((name) => !managedSecrets.includes(name));
+        if (newToModule.length === 0) {
+            gh_provisioner_src_logger.debug(`[gh-provisioner] ${entity.k8sId} all declared ${section} secrets are already managed`);
+            continue;
+        }
+        if (managedSecrets.length === 0) {
+            gh_provisioner_src_logger.info(`[gh-provisioner] ${entity.k8sId} no managed_secrets output — first reconciliation, treating all ${newToModule.length} ${section} secret(s) as new to module`);
+        }
+        for (const secretName of newToModule) {
+            try {
+                const existing = (await entity.runWithGithubProvider(async () => {
+                    return await github["default"].encryption.getOrgSecret(entity.cr.spec.org, section, secretName);
+                }));
+                if (existing) {
+                    gh_provisioner_src_logger.info(`[gh-provisioner] ${entity.k8sId} adopting pre-existing ${section} secret '${secretName}' on GitHub org '${entity.cr.spec.org}'`);
+                    const resourceType = `github_${section}_organization_secret`;
+                    entity.patchImportData({
+                        op: PatchOperations.add,
+                        path: '/imports/-',
+                        value: {
+                            to: `${resourceType}.this["${secretName}"]`,
+                            id: secretName,
+                        },
+                    });
+                    const secretEntry = sectionSecrets.find((s) => s.name === secretName);
+                    if (secretEntry &&
+                        secretEntry.visibility === 'selected' &&
+                        (section === 'actions' || section === 'dependabot')) {
+                        const bindingType = `github_${section}_organization_secret_repositories`;
+                        entity.patchImportData({
+                            op: PatchOperations.add,
+                            path: '/imports/-',
+                            value: {
+                                to: `${bindingType}.this["${secretName}"]`,
+                                id: secretName,
+                            },
+                        });
+                    }
+                }
+            }
+            catch (err) {
+                if (err && err.status === 404) {
+                    gh_provisioner_src_logger.info(`[gh-provisioner] ${entity.k8sId} ${section} secret '${secretName}' not found on GitHub org '${entity.cr.spec.org}' — will be created by TFM`);
+                }
+                else if (err && (err.status === 401 || err.status === 403)) {
+                    gh_provisioner_src_logger.warn(`[gh-provisioner] ${entity.k8sId} token lacks scope to check ${section} secret '${secretName}' on org '${entity.cr.spec.org}' — skipping adoption gracefully`);
+                }
+                else {
+                    gh_provisioner_src_logger.warn(`[gh-provisioner] ${entity.k8sId} unexpected error checking ${section} secret '${secretName}' on org '${entity.cr.spec.org}': ${err instanceof Error ? err.message : String(err)}`);
+                }
+            }
+        }
+    }
+}
+
+;// CONCATENATED MODULE: ../gh_provisioner/src/entities/ghorgsecretsection/index.ts
+
+
+
+class EntityGHOrgSecretSection extends base_Entity {
+    constructor(artifact) {
+        super(artifact, {
+            config: {
+                org: '',
+                actions: {},
+                codespaces: {},
+                dependabot: {},
+                actions_sha256: {},
+                codespaces_sha256: {},
+                dependabot_sha256: {},
+            },
+        });
+    }
+    async loadResources(tfOp) {
+        gh_provisioner_src_logger.info(`[gh-provisioner] running ${tfOp} on ${this.k8sId}`);
+        try {
+            const cr = this.cr;
+            const org = cr.spec.org;
+            const secrets = cr.spec.secrets || {};
+            this.patchData({
+                op: PatchOperations.replace,
+                path: '/config/org',
+                value: org,
+            });
+            await provisionOrgSecrets(this, secrets);
+            const redactedDoc = JSON.parse(JSON.stringify(this._document, (key, value) => typeof value === 'string' && value.length > 50 ? '[REDACTED]' : value));
+            this.synthMessage(`[gh-provisioner] ${this.k8sId} config:\n${JSON.stringify(redactedDoc, null, 2)}`);
+            this.synthEnd(`[gh-provisioner] ${this.k8sId} loaded its data`);
+            if (tfOp === 'apply') {
+                await adoptSecretsIfNeeded(this, secrets);
+            }
+            gh_provisioner_src_logger.debug(`[gh-provisioner] ${this.k8sId} loaded its data`);
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            gh_provisioner_src_logger.error(`[gh-provisioner] ${this.k8sId} error loading resources: ${message}`);
+            throw new Error(`[gh-provisioner] ${this.k8sId} error loading resources: ${message}`);
+        }
+    }
+    async postProvision(_tfOp) { }
+    async loadAddressesToImport() { }
+}
+
 ;// CONCATENATED MODULE: ../gh_provisioner/src/entities/ghorgwebhook/index.ts
 
 
@@ -345679,6 +345935,7 @@ class EntityGHOrgWebHook extends base_Entity {
 
 
 
+
 function entities_getEntity(cr) {
     const entityClass = getEntityClass(cr.kind);
     return new entityClass(cr);
@@ -345701,6 +345958,8 @@ function getEntityClass(kind) {
             return EntityGHOrgSettings;
         case 'FirestartrGithubOrganizationVariableSection':
             return EntityGHOrgVarsSection;
+        case 'FirestartrGithubOrganizationSecretSection':
+            return EntityGHOrgSecretSection;
         default:
             throw new Error(`kind ${kind} has no entity associated`);
     }
@@ -347450,6 +347709,7 @@ const provisionImplementations = {
     githuborgwebhooks: process_operation_processOperation,
     githuborganizationsettings: process_operation_processOperation,
     githuborganizationvariablesections: process_operation_processOperation,
+    githuborganizationsecretsections: process_operation_processOperation,
     fsdummiesa: processFirestartrDummies,
     fsdummiesb: processFirestartrDummies,
     fsdummiesc: processFirestartrDummies,
@@ -526268,7 +526528,7 @@ const crsStatusSubcommand = {
 };
 
 ;// CONCATENATED MODULE: ./package.json
-const package_namespaceObject = JSON.parse('{"i8":"2.10.0-snapshot-org-secrets-ref-fix-1"}');
+const package_namespaceObject = JSON.parse('{"i8":"2.10.0-snapshot-org-secrets-fix-1"}');
 ;// CONCATENATED MODULE: ../../package.json
 const package_namespaceObject_1 = {"i8":"2.9.0"};
 // EXTERNAL MODULE: ../../node_modules/semver/index.js

package/build/packages/cdk8s_renderer/imports/firestartr.dev.d.ts

@@ -595,10 +595,6 @@ export interface FirestartrGithubOrganizationSecretSectionSpec {
      * @schema FirestartrGithubOrganizationSecretSectionSpec#firestartr
      */
     readonly firestartr: FirestartrGithubOrganizationSecretSectionSpecFirestartr;
-    /**
-     * @schema FirestartrGithubOrganizationSecretSectionSpec#writeConnectionSecretToRef
-     */
-    readonly writeConnectionSecretToRef: FirestartrGithubOrganizationSecretSectionSpecWriteConnectionSecretToRef;
 }
 /**
  * Converts an object of type 'FirestartrGithubOrganizationSecretSectionSpec' to JSON representation.
@@ -657,23 +653,6 @@ export interface FirestartrGithubOrganizationSecretSectionSpecFirestartr {
  * Converts an object of type 'FirestartrGithubOrganizationSecretSectionSpecFirestartr' to JSON representation.
  */
 export declare function toJson_FirestartrGithubOrganizationSecretSectionSpecFirestartr(obj: FirestartrGithubOrganizationSecretSectionSpecFirestartr | undefined): Record<string, any> | undefined;
-/**
- * @schema FirestartrGithubOrganizationSecretSectionSpecWriteConnectionSecretToRef
- */
-export interface FirestartrGithubOrganizationSecretSectionSpecWriteConnectionSecretToRef {
-    /**
-     * @schema FirestartrGithubOrganizationSecretSectionSpecWriteConnectionSecretToRef#name
-     */
-    readonly name: string;
-    /**
-     * @schema FirestartrGithubOrganizationSecretSectionSpecWriteConnectionSecretToRef#outputs
-     */
-    readonly outputs: FirestartrGithubOrganizationSecretSectionSpecWriteConnectionSecretToRefOutputs[];
-}
-/**
- * Converts an object of type 'FirestartrGithubOrganizationSecretSectionSpecWriteConnectionSecretToRef' to JSON representation.
- */
-export declare function toJson_FirestartrGithubOrganizationSecretSectionSpecWriteConnectionSecretToRef(obj: FirestartrGithubOrganizationSecretSectionSpecWriteConnectionSecretToRef | undefined): Record<string, any> | undefined;
 /**
  * @schema FirestartrGithubOrganizationSecretSectionSpecSecretsActions
  */
@@ -799,19 +778,6 @@ export interface FirestartrGithubOrganizationSecretSectionSpecContextProvider {
  * Converts an object of type 'FirestartrGithubOrganizationSecretSectionSpecContextProvider' to JSON representation.
  */
 export declare function toJson_FirestartrGithubOrganizationSecretSectionSpecContextProvider(obj: FirestartrGithubOrganizationSecretSectionSpecContextProvider | undefined): Record<string, any> | undefined;
-/**
- * @schema FirestartrGithubOrganizationSecretSectionSpecWriteConnectionSecretToRefOutputs
- */
-export interface FirestartrGithubOrganizationSecretSectionSpecWriteConnectionSecretToRefOutputs {
-    /**
-     * @schema FirestartrGithubOrganizationSecretSectionSpecWriteConnectionSecretToRefOutputs#key
-     */
-    readonly key: string;
-}
-/**
- * Converts an object of type 'FirestartrGithubOrganizationSecretSectionSpecWriteConnectionSecretToRefOutputs' to JSON representation.
- */
-export declare function toJson_FirestartrGithubOrganizationSecretSectionSpecWriteConnectionSecretToRefOutputs(obj: FirestartrGithubOrganizationSecretSectionSpecWriteConnectionSecretToRefOutputs | undefined): Record<string, any> | undefined;
 /**
  * A reference to the Kubernetes Secret resource that contains the value.
  *

package/build/packages/gh_provisioner/src/entities/ghorgsecretsection/index.d.ts

@@ -0,0 +1,7 @@
+import { Entity } from '../base';
+export declare class EntityGHOrgSecretSection extends Entity {
+    constructor(artifact: any);
+    loadResources(tfOp: string): Promise<void>;
+    postProvision(_tfOp: string): Promise<void>;
+    loadAddressesToImport(): Promise<void>;
+}

package/build/packages/gh_provisioner/src/entities/ghorgsecretsection/secrets.d.ts

@@ -0,0 +1,16 @@
+import type { EntityGHOrgSecretSection } from '.';
+import { type OrgSecretsSection } from 'github';
+export type SecretEntry = {
+    name: string;
+    ref: {
+        kind: string;
+        name: string;
+        key: string;
+    };
+    visibility: string;
+    selectedRepositories?: string[];
+};
+declare const SECTIONS: OrgSecretsSection[];
+export { SECTIONS };
+export declare function provisionOrgSecrets(entity: EntityGHOrgSecretSection, secrets: Record<string, SecretEntry[]>): Promise<void>;
+export declare function adoptSecretsIfNeeded(entity: EntityGHOrgSecretSection, secrets: Record<string, SecretEntry[]>): Promise<void>;

package/build/packages/github/index.d.ts

@@ -2,7 +2,9 @@ import { createCheckRun } from './src/check_run';
 import { upsertMultiPartStickyComments } from './src/sticky_comment';
 import { getOctokitForOrg, getGithubAppToken, getOctokitFromPat } from './src/auth';
 import { encryptRepoSecret, getRepoPublicKey } from './src/encrypt';
+import { getOrgPublicKey, encryptOrgSecret, getOrgSecret } from './src/orgSecrets';
 import type { RepoSecretsSection } from './src/encrypt';
+import type { OrgSecretsSection } from './src/orgSecrets';
 import type { WorkflowCompletionResult, WorkflowDispatchInputs, WorkflowRunConclusion, WorkflowRunStatus, WorkflowRunStatusFilter, WorkflowRunSummary } from './src/workflow';
 import { withProfile } from './src/with_profile';
 import { createProfile } from './src/profile';
@@ -103,10 +105,14 @@ declare const _default: {
     encryption: {
         encryptRepoSecret: typeof encryptRepoSecret;
         getRepoPublicKey: typeof getRepoPublicKey;
+        getOrgPublicKey: typeof getOrgPublicKey;
+        encryptOrgSecret: typeof encryptOrgSecret;
+        getOrgSecret: typeof getOrgSecret;
     };
     withProfile: typeof withProfile;
     createProfile: typeof createProfile;
 };
 export default _default;
-export { RepoSecretsSection, createProfile };
+export { createProfile };
+export type { RepoSecretsSection, OrgSecretsSection };
 export type { WorkflowCompletionResult, WorkflowDispatchInputs, WorkflowRunConclusion, WorkflowRunStatus, WorkflowRunStatusFilter, WorkflowRunSummary, };

package/build/packages/github/src/orgSecrets.d.ts

@@ -0,0 +1,10 @@
+export type OrgSecretsSection = 'actions' | 'dependabot' | 'codespaces';
+export declare function getOrgPublicKey(org: string, section: OrgSecretsSection, octokit?: any): Promise<any>;
+export declare function encryptOrgSecret(org: string, section: OrgSecretsSection, plaintextValue: string, preFetchedKey?: {
+    key_id: string;
+    key: string;
+}, octokit?: any): Promise<{
+    key_id: any;
+    encrypted_value: string;
+}>;
+export declare function getOrgSecret(org: string, section: OrgSecretsSection, name: string, octokit?: any): Promise<any>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@firestartr/cli",
-  "version": "2.10.0-snapshot-org-secrets-ref-fix-1",
+  "version": "2.10.0-snapshot-org-secrets-fix-1",
   "private": false,
   "description": "Commandline tool",
   "main": "build/main.js",