@firestartr/cli 2.10.0 → 2.11.0-objects-in-patches-2

package/build/index.js

@@ -284613,6 +284613,17 @@ async function doPaginatedRequest(options) {
         'Cache-Control': 'no-cache',
     });
 }
+async function getOrgVariable(org, variableName, octokit) {
+    logger.info(`Getting org variable ${variableName} for org ${org}`);
+    if (!octokit) {
+        octokit = await getOctokitForOrg(org);
+    }
+    const response = await octokit.rest.actions.getOrgVariable({
+        org,
+        name: variableName,
+    });
+    return response.data;
+}
 /* harmony default export */ const organization = ({
     getRepositoryList,
     getTeamList,
@@ -284623,6 +284634,7 @@ async function doPaginatedRequest(options) {
     getOrgTeamsDirectAccess,
     getOrgPlanName,
     getWebhookList,
+    getOrgVariable,
 });
 
 // EXTERNAL MODULE: external "fs"
@@ -286115,6 +286127,10 @@ function createFacade(profileName) {
                 const octokit = await getOctokitForOrg(orgName);
                 return getOrgPlanName(orgName, octokit);
             },
+            getOrgVariable: async (orgName, variableName) => {
+                const octokit = await getOctokitForOrg(orgName);
+                return getOrgVariable(orgName, variableName, octokit);
+            },
         },
         repo: {
             addStatusCheck: async (output, isFailure, headSha, name, status, repoName, owner) => {
@@ -319522,9 +319538,14 @@ class UUIDInitializer extends InitializerPatches {
                 },
                 apply(cr) {
                     const ctx = helperCTX(this);
-                    const uuid = previousCR?.spec?.firestartr?.tfStateKey ||
-                        claim.providers?.[ctx.provider]?.tfStateKey ||
-                        (0,wrapper.v4)();
+                    const reusePrevious = previousCR && previousCR.kind === ctx.kind;
+                    const uuid = reusePrevious
+                        ? previousCR?.spec?.firestartr?.tfStateKey ||
+                            claim.providers?.[ctx.provider]?.tfStateKey ||
+                            (0,wrapper.v4)()
+                        : cr.spec?.firestartr?.tfStateKey ||
+                            claim.providers?.[ctx.provider]?.tfStateKey ||
+                            (0,wrapper.v4)();
                     if (!cr.spec)
                         cr.spec = {};
                     if (!cr.spec.firestartr)
@@ -320066,6 +320087,7 @@ const ONE_WAY_DEFINITIONS = [
     '/spec/vars',
     '/spec/actions/oidc',
     '/spec/repo/labels',
+    '/spec/actionsVariables',
 ];
 function applyOneWayDefs(crSpecs) {
     const crSpecsClone = JSON.parse(JSON.stringify(crSpecs));
@@ -322064,6 +322086,25 @@ function extractAllRefs(claimData) {
             refs.push(...secretsRefs);
             break;
         }
+        case 'OrgSettingsClaim': {
+            const actionsVariables = parsedClaim.providers?.github?.actions_variables;
+            if (Array.isArray(actionsVariables)) {
+                for (const variable of actionsVariables) {
+                    if (variable.visibility !== 'selected')
+                        continue;
+                    const selectedRepos = variable.selected_repositories;
+                    if (!Array.isArray(selectedRepos))
+                        continue;
+                    for (const repoRef of selectedRepos) {
+                        const match = repoRef.match(/^component:(.+)$/);
+                        if (match) {
+                            refs.push(`ComponentClaim-${match[1]}`);
+                        }
+                    }
+                }
+            }
+            break;
+        }
     }
     logger.info(`Refs for ${parsedClaim.kind}-${parsedClaim.name}: ${[...new Set(refs)].join(',')}`);
     return [...new Set(refs)];
@@ -323190,6 +323231,49 @@ const organizationSettingsProperties = {
     secret_scanning_push_protection_enabled_for_new_repositories: {
         type: 'boolean',
     },
+    actions_variables: {
+        type: 'array',
+        items: {
+            type: 'object',
+            properties: {
+                name: {
+                    type: 'string',
+                    pattern: '^[A-Za-z0-9_]+$',
+                },
+                value: {
+                    type: 'string',
+                },
+                visibility: {
+                    type: 'string',
+                    enum: ['all', 'private', 'selected'],
+                },
+                selected_repositories: {
+                    type: 'array',
+                    items: {
+                        $ref: 'firestartr.dev://common/FirestartrComponentRef',
+                    },
+                },
+            },
+            required: ['name', 'value', 'visibility'],
+            additionalProperties: false,
+            allOf: [
+                {
+                    if: {
+                        properties: {
+                            visibility: { const: 'selected' },
+                        },
+                        required: ['visibility'],
+                    },
+                    then: {},
+                    else: {
+                        properties: {
+                            selected_repositories: { type: 'array', maxItems: 0 },
+                        },
+                    },
+                },
+            ],
+        },
+    },
 };
 /* harmony default export */ const github_orgsettings_schema = ({
     $schema: SCHEMA,
@@ -324874,6 +324958,9 @@ var ajv_default = /*#__PURE__*/__nccwpck_require__.n(dist_ajv);
                 $arg: {
                     type: 'string',
                 },
+                $format: {
+                    type: 'string',
+                },
                 $template: {
                     type: 'string',
                 },
@@ -324922,7 +325009,7 @@ var ajv_default = /*#__PURE__*/__nccwpck_require__.n(dist_ajv);
                     type: 'string',
                 },
                 value: {
-                    type: 'string',
+                    type: ['string', 'object', 'array', 'number', 'boolean', 'null'],
                 },
             },
             required: ['name', 'op', 'path'],
@@ -325803,6 +325890,268 @@ function addTraceabilityStamp(context, content) {
     }
 }
 
+// EXTERNAL MODULE: external "node:path"
+var external_node_path_ = __nccwpck_require__(49411);
+// EXTERNAL MODULE: external "node:fs"
+var external_node_fs_ = __nccwpck_require__(87561);
+;// CONCATENATED MODULE: external "node:os"
+const external_node_os_namespaceObject = __WEBPACK_EXTERNAL_createRequire(import.meta.url)("node:os");
+;// CONCATENATED MODULE: ../features_renderer/src/auxiliar.ts
+// src/auxiliar.ts
+
+
+
+
+
+
+
+const renderTestsSchema = {
+    $schema: 'http://json-schema.org/draft-07/schema#',
+    type: 'object',
+    additionalProperties: false,
+    required: ['tests'],
+    properties: {
+        tests: {
+            type: 'array',
+            minItems: 1,
+            items: {
+                type: 'object',
+                additionalProperties: false,
+                required: ['name', 'cr'],
+                properties: {
+                    name: { type: 'string', minLength: 1 },
+                    cr: { type: 'string', minLength: 1 },
+                    args: { type: 'object' },
+                },
+            },
+        },
+    },
+};
+const YAML_FILE_REGEX = /\.[yY]a?ml$/;
+/* ---------- Core helpers ---------- */
+function formatAjvErrors(errors) {
+    if (!errors || errors.length === 0)
+        return 'Unknown schema error';
+    return errors
+        .map((e) => {
+        const where = e.instancePath && e.instancePath.length ? e.instancePath : '/';
+        const msg = e.message ?? 'validation error';
+        return `- ${where} ${msg}`;
+    })
+        .join('\n');
+}
+function ensureUniqueTestNames(doc) {
+    const seen = new Set();
+    for (const t of doc.tests) {
+        if (seen.has(t.name)) {
+            throw new Error(`Duplicate test name "${t.name}" in render_tests.yaml`);
+        }
+        seen.add(t.name);
+    }
+}
+function loadAndValidateRenderTests(featurePath) {
+    const file = external_node_path_.join(featurePath, 'render_tests.yaml');
+    if (!external_node_fs_.existsSync(file)) {
+        throw new Error(`render_tests.yaml is required but not found at ${file}`);
+    }
+    const raw = loadYaml(file);
+    const ajv = new (ajv_default())({ allErrors: true, strict: true, allowUnionTypes: true });
+    const validate = ajv.compile(renderTestsSchema);
+    const ok = validate(raw);
+    if (!ok) {
+        throw new Error(`render_tests.yaml schema validation failed:\n${formatAjvErrors(validate.errors ?? [])}`);
+    }
+    const doc = raw;
+    ensureUniqueTestNames(doc);
+    return doc;
+}
+function resolveCrPath(featurePath, crRelPath) {
+    if (external_node_path_.isAbsolute(crRelPath)) {
+        throw new Error(`CR path must be relative to the feature root, got absolute: ${crRelPath}`);
+    }
+    const resolved = external_node_path_.resolve(featurePath, crRelPath);
+    if (!external_node_fs_.existsSync(resolved)) {
+        throw new Error(`CR file not found (resolved from "${crRelPath}"): ${resolved}`);
+    }
+    return resolved;
+}
+function listYamlFiles(dir) {
+    if (!fs.existsSync(dir))
+        return [];
+    let entries;
+    try {
+        entries = fs.readdirSync(dir, { withFileTypes: true });
+    }
+    catch (e) {
+        const msg = e instanceof Error ? e.message : String(e);
+        throw new Error(`Failed to read directory "${dir}": ${msg}`);
+    }
+    return entries
+        .filter((e) => e.isFile() && YAML_FILE_REGEX.test(e.name))
+        .map((e) => path.join(dir, e.name));
+}
+function loadYaml(file) {
+    try {
+        const configDataRaw = common_slurpFile(external_node_path_.join(file));
+        return catalog_common/* default.io.fromYaml */.Z.io.fromYaml(configDataRaw);
+    }
+    catch (e) {
+        const msg = e instanceof Error ? e.message : String(e);
+        throw new Error(`Failed to parse YAML "${file}": ${msg}`);
+    }
+}
+function ensureSafeTmpNames(name) {
+    if (typeof name !== 'string' || !name.trim()) {
+        throw new Error('Test "name" must be a non-empty string');
+    }
+    if (name.length > 128) {
+        throw new Error('Test "name" is too long (max 128 characters)');
+    }
+    if (external_node_path_.isAbsolute(name)) {
+        throw new Error(`Test "name" must be relative, got absolute: "${name}"`);
+    }
+    if (name.includes('..')) {
+        throw new Error('Test "name" must not contain ".."');
+    }
+    if (!/^[A-Za-z0-9._-]+$/.test(name)) {
+        throw new Error('Test "name" may only contain letters, numbers, ".", "_", or "-"');
+    }
+}
+async function mkNamedTmp(...names) {
+    for (const name of names) {
+        ensureSafeTmpNames(name);
+    }
+    const dir = external_node_path_.join(external_node_os_namespaceObject.tmpdir(), ...names);
+    await promises_.rm(dir, { recursive: true, force: true });
+    await promises_.mkdir(dir, { recursive: true });
+    return dir;
+}
+async function mkTmp(prefix = 'feature-render-') {
+    return await fsp.mkdtemp(path.join(os.tmpdir(), prefix));
+}
+function buildExpectedOutput(config, renderDir) {
+    const files = (config.files || []).map((f) => ({
+        localPath: external_node_path_.join(renderDir, f.dest),
+        repoPath: f.dest,
+        userManaged: f.user_managed ?? f.upgradable ?? false,
+        targetBranch: f.target_branch ?? '',
+    }));
+    return {
+        files,
+        patches: config.patches || [],
+    };
+}
+/* ---------- Context-style API for a render temp dir ---------- */
+async function createRenderContext(prefix = 'feature-render-') {
+    const dir = await mkTmp(prefix);
+    const join = (...p) => path.join(dir, ...p);
+    return {
+        getContextPath: () => dir,
+        join,
+        getFile: async (relPath, { yaml: asYaml = false, json: asJson = false, } = {}) => {
+            const data = await fsp.readFile(join(relPath), 'utf8');
+            if (asYaml)
+                return common.io.fromYaml(data);
+            if (asJson)
+                return JSON.parse(data);
+            return data;
+        },
+        getFilePath: (relPath) => join(relPath),
+        setFile: async (relPath, contents) => {
+            await fsp.mkdir(path.dirname(join(relPath)), { recursive: true });
+            await fsp.writeFile(join(relPath), contents);
+        },
+        exists: async (relPath) => {
+            try {
+                await fsp.access(join(relPath));
+                return true;
+            }
+            catch {
+                return false;
+            }
+        },
+        getOutputJson: async () => {
+            const p = join('output.json');
+            const raw = await fsp.readFile(p, 'utf8');
+            return JSON.parse(raw);
+        },
+        list: async (relPath = '.') => {
+            const entries = await fsp.readdir(join(relPath), {
+                withFileTypes: true,
+            });
+            return entries.map((e) => ({ name: e.name, isDir: e.isDirectory() }));
+        },
+        remove: async () => {
+            await fsp.rm(dir, { recursive: true, force: true });
+        },
+    };
+}
+/* harmony default export */ const auxiliar = ({
+    mkNamedTmp,
+    loadYaml,
+    buildExpectedOutput,
+    loadAndValidateRenderTests,
+    resolveCrPath,
+});
+
+;// CONCATENATED MODULE: ../features_renderer/src/featureArgsValidation.ts
+
+
+
+
+
+/**
+ * Validates user-supplied feature args against the feature's on-disk
+ * `schema.json` (generated by prefapp/features from the feature's config.yaml).
+ *
+ * The downloader-injected `traceability` key is stripped before validation so it
+ * never trips the unknown-key check. `additionalProperties: false` is injected
+ * into a shallow copy of the schema before compiling; the on-disk file is never
+ * mutated. A feature that ships no schema skips validation with a warning so
+ * legacy, `ref`-fetched, and template features keep rendering.
+ *
+ * @param featurePath - Absolute path to the extracted feature.
+ * @param featureArgs - The raw user-supplied feature args.
+ */
+function validateFeatureArgs(featurePath, featureArgs) {
+    const schemaPath = external_node_path_.join(featurePath, 'schema.json');
+    if (!isFile(schemaPath)) {
+        src_logger.warn(`Feature ${featurePath} has no schema.json; skipping feature args validation`);
+        return;
+    }
+    let schema;
+    try {
+        schema = JSON.parse(common_slurpFile(schemaPath));
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        throw new Error(`Feature: loading schema.json at "${schemaPath}": ${message}`);
+    }
+    const argsToValidate = { ...featureArgs };
+    delete argsToValidate['traceability'];
+    const ajv = new (ajv_default())({ allErrors: true, strictSchema: false });
+    const validate = ajv.compile({ ...schema, additionalProperties: false });
+    if (validate(argsToValidate)) {
+        return;
+    }
+    const lines = (validate.errors ?? []).map((error) => {
+        const key = resolveOffendingKey(error);
+        const where = key ? `/${key}` : '/';
+        const value = key ? argsToValidate[key] : argsToValidate;
+        return `${formatAjvErrors([{ ...error, instancePath: where }])} (got ${JSON.stringify(value)})`;
+    });
+    throw new Error(`Feature args invalid for "${featurePath}":\n${lines.join('\n')}`);
+}
+function resolveOffendingKey(error) {
+    if (typeof error.params?.additionalProperty === 'string') {
+        return error.params.additionalProperty;
+    }
+    if (error.instancePath) {
+        return error.instancePath.replace(/^\//, '');
+    }
+    return undefined;
+}
+
 ;// CONCATENATED MODULE: ../features_renderer/src/render.ts
 
 
@@ -325812,8 +326161,10 @@ function addTraceabilityStamp(context, content) {
 
 
 
+
 function render(featurePath, featureRenderPath, entity, firestartrConfig = {}, featureArgs = {}) {
     const configData = validate(featurePath);
+    validateFeatureArgs(featurePath, featureArgs);
     const context = buildContext(entity, configData.args, firestartrConfig, featureArgs);
     context.config = JSON.parse(renderContent(JSON.stringify(configData), context));
     if ('filesTemplates' in context.config) {
@@ -325993,210 +326344,6 @@ function allowsNonAnchoredPaths(configData) {
     return configData?.meta?.allow_non_anchored_paths === true;
 }
 
-// EXTERNAL MODULE: external "node:fs"
-var external_node_fs_ = __nccwpck_require__(87561);
-// EXTERNAL MODULE: external "node:path"
-var external_node_path_ = __nccwpck_require__(49411);
-;// CONCATENATED MODULE: external "node:os"
-const external_node_os_namespaceObject = __WEBPACK_EXTERNAL_createRequire(import.meta.url)("node:os");
-;// CONCATENATED MODULE: ../features_renderer/src/auxiliar.ts
-// src/auxiliar.ts
-
-
-
-
-
-
-
-const renderTestsSchema = {
-    $schema: 'http://json-schema.org/draft-07/schema#',
-    type: 'object',
-    additionalProperties: false,
-    required: ['tests'],
-    properties: {
-        tests: {
-            type: 'array',
-            minItems: 1,
-            items: {
-                type: 'object',
-                additionalProperties: false,
-                required: ['name', 'cr'],
-                properties: {
-                    name: { type: 'string', minLength: 1 },
-                    cr: { type: 'string', minLength: 1 },
-                    args: { type: 'object' },
-                },
-            },
-        },
-    },
-};
-const YAML_FILE_REGEX = /\.[yY]a?ml$/;
-/* ---------- Core helpers ---------- */
-function formatAjvErrors(errors) {
-    if (!errors || errors.length === 0)
-        return 'Unknown schema error';
-    return errors
-        .map((e) => {
-        const where = e.instancePath && e.instancePath.length ? e.instancePath : '/';
-        const msg = e.message ?? 'validation error';
-        return `- ${where} ${msg}`;
-    })
-        .join('\n');
-}
-function ensureUniqueTestNames(doc) {
-    const seen = new Set();
-    for (const t of doc.tests) {
-        if (seen.has(t.name)) {
-            throw new Error(`Duplicate test name "${t.name}" in render_tests.yaml`);
-        }
-        seen.add(t.name);
-    }
-}
-function loadAndValidateRenderTests(featurePath) {
-    const file = external_node_path_.join(featurePath, 'render_tests.yaml');
-    if (!external_node_fs_.existsSync(file)) {
-        throw new Error(`render_tests.yaml is required but not found at ${file}`);
-    }
-    const raw = loadYaml(file);
-    const ajv = new (ajv_default())({ allErrors: true, strict: true, allowUnionTypes: true });
-    const validate = ajv.compile(renderTestsSchema);
-    const ok = validate(raw);
-    if (!ok) {
-        throw new Error(`render_tests.yaml schema validation failed:\n${formatAjvErrors(validate.errors ?? [])}`);
-    }
-    const doc = raw;
-    ensureUniqueTestNames(doc);
-    return doc;
-}
-function resolveCrPath(featurePath, crRelPath) {
-    if (external_node_path_.isAbsolute(crRelPath)) {
-        throw new Error(`CR path must be relative to the feature root, got absolute: ${crRelPath}`);
-    }
-    const resolved = external_node_path_.resolve(featurePath, crRelPath);
-    if (!external_node_fs_.existsSync(resolved)) {
-        throw new Error(`CR file not found (resolved from "${crRelPath}"): ${resolved}`);
-    }
-    return resolved;
-}
-function listYamlFiles(dir) {
-    if (!fs.existsSync(dir))
-        return [];
-    let entries;
-    try {
-        entries = fs.readdirSync(dir, { withFileTypes: true });
-    }
-    catch (e) {
-        const msg = e instanceof Error ? e.message : String(e);
-        throw new Error(`Failed to read directory "${dir}": ${msg}`);
-    }
-    return entries
-        .filter((e) => e.isFile() && YAML_FILE_REGEX.test(e.name))
-        .map((e) => path.join(dir, e.name));
-}
-function loadYaml(file) {
-    try {
-        const configDataRaw = common_slurpFile(external_node_path_.join(file));
-        return catalog_common/* default.io.fromYaml */.Z.io.fromYaml(configDataRaw);
-    }
-    catch (e) {
-        const msg = e instanceof Error ? e.message : String(e);
-        throw new Error(`Failed to parse YAML "${file}": ${msg}`);
-    }
-}
-function ensureSafeTmpNames(name) {
-    if (typeof name !== 'string' || !name.trim()) {
-        throw new Error('Test "name" must be a non-empty string');
-    }
-    if (name.length > 128) {
-        throw new Error('Test "name" is too long (max 128 characters)');
-    }
-    if (external_node_path_.isAbsolute(name)) {
-        throw new Error(`Test "name" must be relative, got absolute: "${name}"`);
-    }
-    if (name.includes('..')) {
-        throw new Error('Test "name" must not contain ".."');
-    }
-    if (!/^[A-Za-z0-9._-]+$/.test(name)) {
-        throw new Error('Test "name" may only contain letters, numbers, ".", "_", or "-"');
-    }
-}
-async function mkNamedTmp(...names) {
-    for (const name of names) {
-        ensureSafeTmpNames(name);
-    }
-    const dir = external_node_path_.join(external_node_os_namespaceObject.tmpdir(), ...names);
-    await promises_.rm(dir, { recursive: true, force: true });
-    await promises_.mkdir(dir, { recursive: true });
-    return dir;
-}
-async function mkTmp(prefix = 'feature-render-') {
-    return await fsp.mkdtemp(path.join(os.tmpdir(), prefix));
-}
-function buildExpectedOutput(config, renderDir) {
-    const files = (config.files || []).map((f) => ({
-        localPath: external_node_path_.join(renderDir, f.dest),
-        repoPath: f.dest,
-        userManaged: f.user_managed ?? f.upgradable ?? false,
-        targetBranch: f.target_branch ?? '',
-    }));
-    return {
-        files,
-        patches: config.patches || [],
-    };
-}
-/* ---------- Context-style API for a render temp dir ---------- */
-async function createRenderContext(prefix = 'feature-render-') {
-    const dir = await mkTmp(prefix);
-    const join = (...p) => path.join(dir, ...p);
-    return {
-        getContextPath: () => dir,
-        join,
-        getFile: async (relPath, { yaml: asYaml = false, json: asJson = false, } = {}) => {
-            const data = await fsp.readFile(join(relPath), 'utf8');
-            if (asYaml)
-                return common.io.fromYaml(data);
-            if (asJson)
-                return JSON.parse(data);
-            return data;
-        },
-        getFilePath: (relPath) => join(relPath),
-        setFile: async (relPath, contents) => {
-            await fsp.mkdir(path.dirname(join(relPath)), { recursive: true });
-            await fsp.writeFile(join(relPath), contents);
-        },
-        exists: async (relPath) => {
-            try {
-                await fsp.access(join(relPath));
-                return true;
-            }
-            catch {
-                return false;
-            }
-        },
-        getOutputJson: async () => {
-            const p = join('output.json');
-            const raw = await fsp.readFile(p, 'utf8');
-            return JSON.parse(raw);
-        },
-        list: async (relPath = '.') => {
-            const entries = await fsp.readdir(join(relPath), {
-                withFileTypes: true,
-            });
-            return entries.map((e) => ({ name: e.name, isDir: e.isDirectory() }));
-        },
-        remove: async () => {
-            await fsp.rm(dir, { recursive: true, force: true });
-        },
-    };
-}
-/* harmony default export */ const auxiliar = ({
-    mkNamedTmp,
-    loadYaml,
-    buildExpectedOutput,
-    loadAndValidateRenderTests,
-    resolveCrPath,
-});
-
 ;// CONCATENATED MODULE: ../features_renderer/src/update_file.ts
 
 
@@ -326209,6 +326356,7 @@ function updateFileContent(featureRenderPath, filePath, content) {
 
 
 
+
 /* harmony default export */ const features_renderer = ({
     validate: validate,
     render: render,
@@ -326217,6 +326365,7 @@ function updateFileContent(featureRenderPath, filePath, content) {
     buildContext: buildContext,
     renderContent: renderContent,
     expandFiles: expandFiles,
+    validateFeatureArgs: validateFeatureArgs,
 });
 
 ;// CONCATENATED MODULE: ../features_preparer/src/logger.ts
@@ -326574,7 +326723,7 @@ const VARIANT_OF_ANNOTATION = 'firestartr.dev/variant-of';
 function isVariantCR(cr) {
     return cr.metadata?.annotations?.[VARIANT_OF_ANNOTATION] !== undefined;
 }
-function getPreviousCRfromClaim(claim, previousCRs) {
+function getPreviousCRfromClaim(claim, previousCRs, expectedKind) {
     const previousCRsKeys = Object.keys(previousCRs);
     const isVariantClaim = !!claim._parentClaimName;
     for (const previousCRKey of previousCRsKeys) {
@@ -326583,6 +326732,8 @@ function getPreviousCRfromClaim(claim, previousCRs) {
             continue;
         if (isExcludedFromPreviousCR(previousCR.kind))
             continue;
+        if (expectedKind && previousCR.kind !== expectedKind)
+            continue;
         const crVariant = isVariantCR(previousCR);
         if (isVariantClaim && !crVariant)
             continue;
@@ -327597,6 +327748,254 @@ var FirestartrGithubOrganizationSettingsSpecContextProviderRefKind;
     /** FirestartrProviderConfig */
     FirestartrGithubOrganizationSettingsSpecContextProviderRefKind["FIRESTARTR_PROVIDER_CONFIG"] = "FirestartrProviderConfig";
 })(FirestartrGithubOrganizationSettingsSpecContextProviderRefKind || (FirestartrGithubOrganizationSettingsSpecContextProviderRefKind = {}));
+/**
+ * A resource to handle GitHub Organization Actions Variables.
+ *
+ * @schema FirestartrGithubOrganizationVariableSection
+ */
+class FirestartrGithubOrganizationVariableSection extends lib.ApiObject {
+    /**
+     * Renders a Kubernetes manifest for "FirestartrGithubOrganizationVariableSection".
+     *
+     * This can be used to inline resource manifests inside other objects (e.g. as templates).
+     *
+     * @param props initialization props
+     */
+    static manifest(props) {
+        return {
+            ...FirestartrGithubOrganizationVariableSection.GVK,
+            ...toJson_FirestartrGithubOrganizationVariableSectionProps(props),
+        };
+    }
+    /**
+     * Defines a "FirestartrGithubOrganizationVariableSection" API object
+     * @param scope the scope in which to define this object
+     * @param id a scope-local name for the object
+     * @param props initialization props
+     */
+    constructor(scope, id, props) {
+        super(scope, id, {
+            ...FirestartrGithubOrganizationVariableSection.GVK,
+            ...props,
+        });
+    }
+    /**
+     * Renders the object to Kubernetes JSON.
+     */
+    toJson() {
+        const resolved = super.toJson();
+        return {
+            ...FirestartrGithubOrganizationVariableSection.GVK,
+            ...toJson_FirestartrGithubOrganizationVariableSectionProps(resolved),
+        };
+    }
+}
+/**
+ * Returns the apiVersion and kind for "FirestartrGithubOrganizationVariableSection"
+ */
+FirestartrGithubOrganizationVariableSection.GVK = {
+    apiVersion: 'firestartr.dev/v1',
+    kind: 'FirestartrGithubOrganizationVariableSection',
+};
+
+/**
+ * Converts an object of type 'FirestartrGithubOrganizationVariableSectionProps' to JSON representation.
+ */
+/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
+function toJson_FirestartrGithubOrganizationVariableSectionProps(obj) {
+    if (obj === undefined) {
+        return undefined;
+    }
+    const result = {
+        'metadata': obj.metadata,
+        'spec': toJson_FirestartrGithubOrganizationVariableSectionSpec(obj.spec),
+    };
+    // filter undefined values
+    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
+}
+/**
+ * Converts an object of type 'FirestartrGithubOrganizationVariableSectionSpec' to JSON representation.
+ */
+/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
+function toJson_FirestartrGithubOrganizationVariableSectionSpec(obj) {
+    if (obj === undefined) {
+        return undefined;
+    }
+    const result = {
+        'org': obj.org,
+        'actionsVariables': obj.actionsVariables?.map(y => toJson_FirestartrGithubOrganizationVariableSectionSpecActionsVariables(y)),
+        'context': toJson_FirestartrGithubOrganizationVariableSectionSpecContext(obj.context),
+        'firestartr': toJson_FirestartrGithubOrganizationVariableSectionSpecFirestartr(obj.firestartr),
+        'writeConnectionSecretToRef': toJson_FirestartrGithubOrganizationVariableSectionSpecWriteConnectionSecretToRef(obj.writeConnectionSecretToRef),
+    };
+    // filter undefined values
+    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
+}
+/**
+ * Converts an object of type 'FirestartrGithubOrganizationVariableSectionSpecActionsVariables' to JSON representation.
+ */
+/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
+function toJson_FirestartrGithubOrganizationVariableSectionSpecActionsVariables(obj) {
+    if (obj === undefined) {
+        return undefined;
+    }
+    const result = {
+        'name': obj.name,
+        'value': obj.value,
+        'visibility': obj.visibility,
+        'selectedRepositories': obj.selectedRepositories?.map(y => y),
+    };
+    // filter undefined values
+    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
+}
+/**
+ * Converts an object of type 'FirestartrGithubOrganizationVariableSectionSpecContext' to JSON representation.
+ */
+/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
+function toJson_FirestartrGithubOrganizationVariableSectionSpecContext(obj) {
+    if (obj === undefined) {
+        return undefined;
+    }
+    const result = {
+        'backend': toJson_FirestartrGithubOrganizationVariableSectionSpecContextBackend(obj.backend),
+        'provider': toJson_FirestartrGithubOrganizationVariableSectionSpecContextProvider(obj.provider),
+    };
+    // filter undefined values
+    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
+}
+/**
+ * Converts an object of type 'FirestartrGithubOrganizationVariableSectionSpecFirestartr' to JSON representation.
+ */
+/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
+function toJson_FirestartrGithubOrganizationVariableSectionSpecFirestartr(obj) {
+    if (obj === undefined) {
+        return undefined;
+    }
+    const result = {
+        'tfStateKey': obj.tfStateKey,
+    };
+    // filter undefined values
+    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
+}
+/**
+ * Converts an object of type 'FirestartrGithubOrganizationVariableSectionSpecWriteConnectionSecretToRef' to JSON representation.
+ */
+/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
+function toJson_FirestartrGithubOrganizationVariableSectionSpecWriteConnectionSecretToRef(obj) {
+    if (obj === undefined) {
+        return undefined;
+    }
+    const result = {
+        'name': obj.name,
+        'outputs': obj.outputs?.map(y => toJson_FirestartrGithubOrganizationVariableSectionSpecWriteConnectionSecretToRefOutputs(y)),
+    };
+    // filter undefined values
+    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
+}
+/* eslint-enable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
+/**
+ * Visibility of the variable
+ *
+ * @schema FirestartrGithubOrganizationVariableSectionSpecActionsVariablesVisibility
+ */
+var FirestartrGithubOrganizationVariableSectionSpecActionsVariablesVisibility;
+(function (FirestartrGithubOrganizationVariableSectionSpecActionsVariablesVisibility) {
+    /** all */
+    FirestartrGithubOrganizationVariableSectionSpecActionsVariablesVisibility["ALL"] = "all";
+    /** private */
+    FirestartrGithubOrganizationVariableSectionSpecActionsVariablesVisibility["PRIVATE"] = "private";
+    /** selected */
+    FirestartrGithubOrganizationVariableSectionSpecActionsVariablesVisibility["SELECTED"] = "selected";
+})(FirestartrGithubOrganizationVariableSectionSpecActionsVariablesVisibility || (FirestartrGithubOrganizationVariableSectionSpecActionsVariablesVisibility = {}));
+/**
+ * Converts an object of type 'FirestartrGithubOrganizationVariableSectionSpecContextBackend' to JSON representation.
+ */
+/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
+function toJson_FirestartrGithubOrganizationVariableSectionSpecContextBackend(obj) {
+    if (obj === undefined) {
+        return undefined;
+    }
+    const result = {
+        'ref': toJson_FirestartrGithubOrganizationVariableSectionSpecContextBackendRef(obj.ref),
+    };
+    // filter undefined values
+    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
+}
+/**
+ * Converts an object of type 'FirestartrGithubOrganizationVariableSectionSpecContextProvider' to JSON representation.
+ */
+/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
+function toJson_FirestartrGithubOrganizationVariableSectionSpecContextProvider(obj) {
+    if (obj === undefined) {
+        return undefined;
+    }
+    const result = {
+        'ref': toJson_FirestartrGithubOrganizationVariableSectionSpecContextProviderRef(obj.ref),
+    };
+    // filter undefined values
+    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
+}
+/**
+ * Converts an object of type 'FirestartrGithubOrganizationVariableSectionSpecWriteConnectionSecretToRefOutputs' to JSON representation.
+ */
+/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
+function toJson_FirestartrGithubOrganizationVariableSectionSpecWriteConnectionSecretToRefOutputs(obj) {
+    if (obj === undefined) {
+        return undefined;
+    }
+    const result = {
+        'key': obj.key,
+    };
+    // filter undefined values
+    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
+}
+/**
+ * Converts an object of type 'FirestartrGithubOrganizationVariableSectionSpecContextBackendRef' to JSON representation.
+ */
+/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
+function toJson_FirestartrGithubOrganizationVariableSectionSpecContextBackendRef(obj) {
+    if (obj === undefined) {
+        return undefined;
+    }
+    const result = {
+        'kind': obj.kind,
+        'name': obj.name,
+    };
+    // filter undefined values
+    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
+}
+/**
+ * Converts an object of type 'FirestartrGithubOrganizationVariableSectionSpecContextProviderRef' to JSON representation.
+ */
+/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
+function toJson_FirestartrGithubOrganizationVariableSectionSpecContextProviderRef(obj) {
+    if (obj === undefined) {
+        return undefined;
+    }
+    const result = {
+        'kind': obj.kind,
+        'name': obj.name,
+    };
+    // filter undefined values
+    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
+}
+/* eslint-enable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
+/**
+ * @schema FirestartrGithubOrganizationVariableSectionSpecContextBackendRefKind
+ */
+var FirestartrGithubOrganizationVariableSectionSpecContextBackendRefKind;
+(function (FirestartrGithubOrganizationVariableSectionSpecContextBackendRefKind) {
+    /** FirestartrProviderConfig */
+    FirestartrGithubOrganizationVariableSectionSpecContextBackendRefKind["FIRESTARTR_PROVIDER_CONFIG"] = "FirestartrProviderConfig";
+})(FirestartrGithubOrganizationVariableSectionSpecContextBackendRefKind || (FirestartrGithubOrganizationVariableSectionSpecContextBackendRefKind = {}));
+/**
+ * @schema FirestartrGithubOrganizationVariableSectionSpecContextProviderRefKind
+ */
+var FirestartrGithubOrganizationVariableSectionSpecContextProviderRefKind;
+(function (FirestartrGithubOrganizationVariableSectionSpecContextProviderRefKind) {
+    /** FirestartrProviderConfig */
+    FirestartrGithubOrganizationVariableSectionSpecContextProviderRefKind["FIRESTARTR_PROVIDER_CONFIG"] = "FirestartrProviderConfig";
+})(FirestartrGithubOrganizationVariableSectionSpecContextProviderRefKind || (FirestartrGithubOrganizationVariableSectionSpecContextProviderRefKind = {}));
 /**
  * A resource to handle GitHub Organization Webhooks
  *
@@ -329851,8 +330250,12 @@ class BaseChart extends lib.Chart {
             template = await patch.apply(template, this.ctx());
             patch.validate(template);
         }
+        template = await this.postRenderTransform(template);
         return this.instanceApiObject(template);
     }
+    async postRenderTransform(template) {
+        return template;
+    }
     ctx() {
         return new ChartContext(this);
     }
@@ -330161,6 +330564,7 @@ class RepoSecretsSectionChart extends BaseGithubChart {
 
 
 
+
 class GithubRepositoryChart extends BaseGithubChart {
     template() {
         const claim = this.get('claim');
@@ -330234,6 +330638,26 @@ class GithubRepositoryChart extends BaseGithubChart {
         await this.postRenderSecretsSection(this.get('rendered-cr'));
         return this;
     }
+    async postRenderTransform(template) {
+        const labels = template?.spec?.repo?.labels;
+        if (Array.isArray(labels)) {
+            const seen = new Map();
+            const deduped = [];
+            for (const label of labels) {
+                const key = String(label.name).trim();
+                if (seen.has(key)) {
+                    logger.warn(`[cdk8s-renderer] ${template.metadata?.name ?? ''} duplicate label '${key}' dropped; the first (Claim/CR) declaration wins`);
+                    continue;
+                }
+                seen.set(key, true);
+                deduped.push(label);
+            }
+            if (deduped.length !== labels.length) {
+                template.spec.repo.labels = deduped;
+            }
+        }
+        return template;
+    }
     gvk() {
         return FirestartrGithubRepository.GVK;
     }
@@ -330446,6 +330870,65 @@ class GithubOrgSettingsChart extends BaseGithubChart {
     }
 }
 
+;// CONCATENATED MODULE: ../cdk8s_renderer/src/charts/github/orgVariableSectionChart.ts
+
+
+
+class GithubOrgVariableSectionChart extends BaseGithubChart {
+    template() {
+        const claim = this.get('claim');
+        const firestartrId = this.get('firestartrId');
+        const githubProvider = claim.providers.github;
+        const actionsVariables = (githubProvider.actions_variables || []).map((v) => {
+            const entry = {
+                name: v.name,
+                value: v.value,
+                visibility: v.visibility,
+            };
+            if (v.selected_repositories && v.selected_repositories.length > 0) {
+                entry.selectedRepositories = v.selected_repositories.map((ref) => {
+                    const match = ref.match(/^component:(.+)$/);
+                    if (!match) {
+                        throw new ChartRenderError('OrgSettingsClaim', claim.name, `Invalid component ref "${ref}" in selected_repositories. Expected format: component:<name>`);
+                    }
+                    const componentName = match[1];
+                    const resolvedCr = this.refResolver('ComponentClaim', componentName);
+                    const org = resolvedCr?.spec?.org;
+                    const repoName = resolvedCr?.metadata?.annotations?.['firestartr.dev/external-name'] || resolvedCr?.metadata?.name?.replace(/-[0-9a-f-]{36}$/, '');
+                    if (!org || !repoName) {
+                        throw new ChartRenderError('OrgSettingsClaim', claim.name, `Referenced component "${componentName}" has no GitHub provider configured`);
+                    }
+                    return `${org}/${repoName}`;
+                });
+            }
+            return entry;
+        });
+        const template = {
+            metadata: {
+                name: githubProvider.name,
+            },
+            spec: {
+                org: githubProvider.org,
+                actionsVariables,
+                firestartr: {
+                    tfStateKey: firestartrId,
+                },
+                writeConnectionSecretToRef: {
+                    name: `firestartrgithuborganizationvariablesection-${githubProvider.name}-outputs`.toLowerCase(),
+                    outputs: [{ key: 'managed_variables' }, { key: 'variable_ids' }],
+                },
+            },
+        };
+        return JSON.parse(JSON.stringify(template));
+    }
+    gvk() {
+        return FirestartrGithubOrganizationVariableSection.GVK;
+    }
+    instanceApiObject(template) {
+        return new FirestartrGithubOrganizationVariableSection(this, template.metadata.name, template);
+    }
+}
+
 ;// CONCATENATED MODULE: ../cdk8s_renderer/src/charts/github/index.ts
 
 
@@ -330453,6 +330936,7 @@ class GithubOrgSettingsChart extends BaseGithubChart {
 
 
 
+
 ;// CONCATENATED MODULE: ../cdk8s_renderer/src/charts/catalog/base.ts
 
 class BaseCatalogChart extends BaseChart {
@@ -331200,6 +331684,7 @@ class SecretsChart extends BaseSecretsChart {
     SecretsChart: SecretsChart,
     GithubOrgWebhookChart: GithubOrgWebhookChart,
     GithubOrgSettingsChart: GithubOrgSettingsChart,
+    GithubOrgVariableSectionChart: GithubOrgVariableSectionChart,
 });
 
 ;// CONCATENATED MODULE: ../cdk8s_renderer/src/renderer/claims-render.ts
@@ -331244,13 +331729,23 @@ async function renderClaims(catalogScope, firestartrScope, data) {
             if (configuredProvider !== AllowedProviders.all.toString()) {
                 providers = providers.filter((provider) => provider === configuredProvider);
             }
-            const previousCR = getPreviousCRfromClaim(claim, crs);
+            const expectedKind = claim.kind === 'OrgSettingsClaim'
+                ? 'FirestartrGithubOrganizationSettings'
+                : undefined;
+            const previousCR = getPreviousCRfromClaim(claim, crs, expectedKind);
+            const variableSectionPreviousCR = claim.kind === 'OrgSettingsClaim'
+                ? getPreviousCRfromClaim({ kind: claim.kind, name: `${claim.name}-variable-section` }, crs, 'FirestartrGithubOrganizationVariableSection')
+                : false;
             const patches = await extractPatches(renderClaims[claimKey], previousCR);
+            let variableSectionPatches = undefined;
+            if (claim.kind === 'OrgSettingsClaim') {
+                variableSectionPatches = await extractPatches(renderClaims[claimKey], variableSectionPreviousCR);
+            }
             if (!previousCR) {
                 logger.debug(`No CR found for claim ${claimKey}, it will be rendered from scratch`);
             }
             const claimPath = renderClaims[claimKey].claimPath;
-            const { firestartrEntity, extraCharts, catalogEntity } = await renderClaim(catalogScope, firestartrScope, claim, patches, previousCR, claimPath);
+            const { firestartrEntity, extraCharts, catalogEntity } = await renderClaim(catalogScope, firestartrScope, claim, patches, previousCR, claimPath, variableSectionPreviousCR, variableSectionPatches);
             if (catalogEntity) {
                 result[`${catalogEntity.kind}-${catalogEntity.metadata.name}`] =
                     catalogEntity.toJson();
@@ -331279,7 +331774,7 @@ async function renderClaims(catalogScope, firestartrScope, data) {
     }
     return result;
 }
-async function renderClaim(catalogScope, firestartrScope, claim, patches, previousCR = null, claimPath) {
+async function renderClaim(catalogScope, firestartrScope, claim, patches, previousCR = null, claimPath, variableSectionPreviousCR = false, variableSectionPatches) {
     let catalogEntity = undefined;
     let firestartrEntity = undefined;
     const extraCharts = [];
@@ -331427,6 +331922,27 @@ async function renderClaim(catalogScope, firestartrScope, claim, patches, previo
         case 'OrgSettingsClaim':
             if (loadGithub) {
                 firestartrEntity = new charts.GithubOrgSettingsChart(firestartrScope, `github-${chartId}`, firestartrId, claim, renderPatches);
+                const variableSectionFirestartrId = variableSectionPreviousCR
+                    ? variableSectionPreviousCR.spec?.firestartr?.tfStateKey
+                    : firestartrId
+                        ? `${firestartrId}-variables`
+                        : null;
+                const vsRenderPatches = variableSectionPatches
+                    ? variableSectionPatches.filter((patch) => !patch.isPostPatch)
+                    : renderPatches;
+                const vsPostPatches = variableSectionPatches
+                    ? variableSectionPatches.filter((patch) => patch.isPostPatch)
+                    : postPatches;
+                const variableSectionChart = new charts.GithubOrgVariableSectionChart(firestartrScope, `github-variables-${chartId}`, variableSectionFirestartrId, claim, vsRenderPatches);
+                await variableSectionChart.render();
+                const variableSectionObject = await variableSectionChart.postRenderer(vsPostPatches);
+                extraCharts.push({
+                    claim: {
+                        kind: claim.kind,
+                        name: `${claim.name}-variable-section`,
+                    },
+                    chart: variableSectionObject,
+                });
             }
             break;
         default:
@@ -331486,12 +332002,16 @@ function renameVariantCrFiles(outputDir, renderedMap) {
 
 const IS_COMPONENT_CLAIM_REF = new RegExp(/^ComponentClaim-/);
 const IS_TF_WORKSPACE = new RegExp(/^TFWorkspaceClaim-/);
+const IS_ORG_SETTINGS_CLAIM = new RegExp(/^OrgSettingsClaim-/);
+const COMPONENT_REF_PATTERN = /^component:(.+)$/;
 function validateSubReferences(renderClaims) {
     for (const ref of Object.keys(renderClaims)) {
         if (IS_COMPONENT_CLAIM_REF.test(ref))
             validateClaimsSecretsRefs(ref, renderClaims);
         else if (IS_TF_WORKSPACE.test(ref))
             validateTFClaimsSecretsRefs(ref, renderClaims);
+        else if (IS_ORG_SETTINGS_CLAIM.test(ref))
+            validateOrgSettingsComponentRefs(ref, renderClaims);
     }
 }
 function validateTFClaimsSecretsRefs(ref, renderClaims) {
@@ -331543,6 +332063,32 @@ function searchSecretKey(secretClaim, key) {
     }
     return found;
 }
+function validateOrgSettingsComponentRefs(ref, renderClaims) {
+    const claim = renderClaims[ref].claim;
+    validateActionsVariablesSelectedRepositories(claim, renderClaims);
+}
+function validateActionsVariablesSelectedRepositories(claim, renderClaims) {
+    const actionsVariables = claim?.providers?.github?.actions_variables;
+    if (!Array.isArray(actionsVariables))
+        return;
+    for (const variable of actionsVariables) {
+        if (variable.visibility !== 'selected')
+            continue;
+        const selectedRepos = variable.selected_repositories;
+        if (!Array.isArray(selectedRepos) || selectedRepos.length === 0)
+            continue;
+        for (const ref of selectedRepos) {
+            const match = ref.match(COMPONENT_REF_PATTERN);
+            if (!match)
+                continue;
+            const componentName = match[1];
+            const expectedKey = `ComponentClaim-${componentName}`;
+            if (!renderClaims[expectedKey]) {
+                throw new Error(`CrossReference error: OrgSettingsClaim/${claim.name} references a non-existent component "${componentName}" in actions_variables.${variable.name}.selected_repositories`);
+            }
+        }
+    }
+}
 
 ;// CONCATENATED MODULE: ../cdk8s_renderer/src/validations/componentPagesPath.ts
 /**
@@ -331591,6 +332137,66 @@ function validateGithubOrgSettingsSingleton(crs) {
     }
 }
 
+;// CONCATENATED MODULE: ../cdk8s_renderer/src/validations/githubOrgVariableSection.ts
+const GITHUB_ORG_VARIABLE_SECTION_KIND = 'FirestartrGithubOrganizationVariableSection';
+const githubOrgVariableSection_FIRESTARTR_CLAIM_REF_ANNOTATION = 'firestartr.dev/claim-ref';
+const githubOrgVariableSection_CLAIM_REF_LABEL = 'claim-ref';
+function githubOrgVariableSection_formatResourceRef(name, claimRef) {
+    return claimRef ? `${name} (claim: ${claimRef})` : name;
+}
+function validateGithubOrgVariableSectionSingleton(crs) {
+    const refsByOrg = new Map();
+    const seenClaimRefs = new Map();
+    for (const crKey of Object.keys(crs)) {
+        const cr = crs[crKey];
+        if (cr.kind !== GITHUB_ORG_VARIABLE_SECTION_KIND)
+            continue;
+        const org = cr.spec?.org;
+        if (typeof org !== 'string' || !org)
+            continue;
+        const name = cr.metadata?.name || crKey;
+        const claimRef = cr.metadata?.annotations?.[githubOrgVariableSection_FIRESTARTR_CLAIM_REF_ANNOTATION] ||
+            cr.metadata?.labels?.[githubOrgVariableSection_CLAIM_REF_LABEL];
+        const normalizedOrg = org.toLowerCase();
+        if (claimRef) {
+            const seen = seenClaimRefs.get(normalizedOrg) || new Set();
+            if (seen.has(claimRef))
+                continue;
+            seen.add(claimRef);
+            seenClaimRefs.set(normalizedOrg, seen);
+        }
+        const refs = refsByOrg.get(normalizedOrg) || [];
+        refs.push(githubOrgVariableSection_formatResourceRef(name, claimRef));
+        refsByOrg.set(normalizedOrg, refs);
+    }
+    for (const [org, refs] of refsByOrg.entries()) {
+        if (refs.length < 2)
+            continue;
+        throw new Error(`Duplicate ${GITHUB_ORG_VARIABLE_SECTION_KIND} resources found for GitHub organization "${org}": ${refs.join(', ')}`);
+    }
+}
+function validateActionsVariablesUniqueness(crs) {
+    for (const crKey of Object.keys(crs)) {
+        const cr = crs[crKey];
+        if (cr.kind !== GITHUB_ORG_VARIABLE_SECTION_KIND)
+            continue;
+        const actionsVariables = cr.spec?.actionsVariables;
+        if (!Array.isArray(actionsVariables))
+            continue;
+        const names = new Set();
+        for (const variable of actionsVariables) {
+            const varName = variable?.name;
+            if (!varName)
+                continue;
+            if (names.has(varName)) {
+                const org = cr.spec?.org || 'unknown';
+                throw new Error(`Duplicate action variable name "${varName}" found in ${GITHUB_ORG_VARIABLE_SECTION_KIND} for organization "${org}"`);
+            }
+            names.add(varName);
+        }
+    }
+}
+
 ;// CONCATENATED MODULE: ../cdk8s_renderer/src/renderer/renderer.ts
 
 
@@ -331601,6 +332207,7 @@ function validateGithubOrgSettingsSingleton(crs) {
 
 
 
+
 /*
  * Function called when rendering but not importing
  *
@@ -331624,6 +332231,8 @@ async function renderer_render(catalogScope, firestartrScope, claimList) {
         validateComponentPagesPath(data.renderClaims);
         validateTfStateKeyUniqueness(result);
         validateGithubOrgSettingsSingleton(fullCrSet);
+        validateGithubOrgVariableSectionSingleton(fullCrSet);
+        validateActionsVariablesUniqueness(result);
         validateCrSizes(result);
         validatePermissionsUniqueness(result);
     }
@@ -333955,6 +334564,7 @@ const kindPluralMap = {
     terraformmodules: 'FirestartrTerraformModule',
     githuborgwebhooks: 'FirestartrGithubOrgWebhook',
     githuborganizationsettings: 'FirestartrGithubOrganizationSettings',
+    githuborganizationvariablesections: 'FirestartrGithubOrganizationVariableSection',
     terraformworkspaces: 'FirestartrTerraformWorkspace',
     terraformworkspaceplans: 'FirestartrTerraformWorkspacePlan',
     providerconfigs: 'FirestartrProviderConfig',
@@ -335932,6 +336542,7 @@ const kindsWithFinalizer = [
     'FirestartrGithubRepositoryFeature',
     'FirestartrGithubOrgWebhook',
     'FirestartrGithubOrganizationSettings',
+    'FirestartrGithubOrganizationVariableSection',
     'FirestartrGithubRepositorySecretsSection',
 ];
 const kindsWithDependants = [
@@ -342473,6 +343084,11 @@ const MODULES = {
         // github-org-settings-v0.1.0
         ref: 'c30c5dfdaddf2bca9e966a726d45970c98576e9e',
     },
+    FirestartrGithubOrganizationVariableSection: {
+        module: 'git::https://github.com/prefapp/tfm.git//modules/github-org-variables-section',
+        // github-org-variables-section-v0.1.0
+        ref: 'fb9c01d0a1e03e5134479da13d0faf55891dfedf',
+    },
 };
 function getFirestartrDefaultTFM(kind) {
     if (kind in MODULES) {
@@ -344275,6 +344891,94 @@ class EntityGHOrgSettings extends base_Entity {
     }
 }
 
+;// CONCATENATED MODULE: ../gh_provisioner/src/entities/ghorgvarsection/index.ts
+
+
+
+class EntityGHOrgVarsSection extends base_Entity {
+    constructor(artifact) {
+        super(artifact, {
+            config: {
+                variables: {},
+            },
+        });
+    }
+    async loadResources(tfOp) {
+        gh_provisioner_src_logger.info(`[gh-provisioner] running ${tfOp} on ${this.k8sId}`);
+        try {
+            const cr = this.cr;
+            const actionsVariables = cr.spec.actionsVariables || [];
+            const variables = {};
+            for (const v of actionsVariables) {
+                const entry = {
+                    value: v.value,
+                    visibility: v.visibility,
+                };
+                if (v.visibility === 'selected' && v.selectedRepositories) {
+                    entry.selectedRepositoryIds = v.selectedRepositories;
+                }
+                variables[v.name] = entry;
+            }
+            this.patchData({
+                op: PatchOperations.replace,
+                path: '/config/variables',
+                value: variables,
+            });
+            if (tfOp === 'apply') {
+                await this.adoptVariablesIfNeeded(actionsVariables);
+            }
+            gh_provisioner_src_logger.debug(`[gh-provisioner] ${this.k8sId} loaded its data`);
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            gh_provisioner_src_logger.error(`[gh-provisioner] ${this.k8sId} error loading resources: ${message}`);
+            throw new Error(`[gh-provisioner] ${this.k8sId} error loading resources: ${message}`);
+        }
+    }
+    async adoptVariablesIfNeeded(declaredVars) {
+        const cr = this.cr;
+        const managedVariables = this.cr.fResolveSelfOutputs('managed_variables') || [];
+        const declaredNames = declaredVars.map((v) => v.name);
+        const newToModule = declaredNames.filter((name) => !managedVariables.includes(name));
+        if (newToModule.length === 0) {
+            gh_provisioner_src_logger.debug(`[gh-provisioner] ${this.k8sId} all declared variables are already managed, no adoption needed`);
+            return;
+        }
+        if (managedVariables.length === 0) {
+            gh_provisioner_src_logger.info(`[gh-provisioner] ${this.k8sId} no managed_variables output — first reconciliation, treating all ${newToModule.length} declared variable(s) as new to module`);
+        }
+        for (const varName of newToModule) {
+            try {
+                await this.runWithGithubProvider(async () => {
+                    await github["default"].org.getOrgVariable(cr.spec.org, varName);
+                });
+                gh_provisioner_src_logger.info(`[gh-provisioner] ${this.k8sId} adopting pre-existing variable '${varName}' on GitHub org '${cr.spec.org}'`);
+                this.patchImportData({
+                    op: PatchOperations.add,
+                    path: '/imports/-',
+                    value: {
+                        to: `github_actions_organization_variable.this["${varName}"]`,
+                        id: varName,
+                    },
+                });
+            }
+            catch (err) {
+                if (err && err.status === 404) {
+                    gh_provisioner_src_logger.info(`[gh-provisioner] ${this.k8sId} variable '${varName}' not found on GitHub org '${cr.spec.org}' — will be created by TFM`);
+                }
+                else if (err && (err.status === 401 || err.status === 403)) {
+                    gh_provisioner_src_logger.warn(`[gh-provisioner] ${this.k8sId} token lacks scope to check variable '${varName}' on org '${cr.spec.org}' — skipping adoption gracefully`);
+                }
+                else {
+                    gh_provisioner_src_logger.error(`[gh-provisioner] ${this.k8sId} unexpected error checking variable '${varName}' on org '${cr.spec.org}': ${err instanceof Error ? err.message : String(err)}`);
+                }
+            }
+        }
+    }
+    async postProvision(tfOp) { }
+    async loadAddressesToImport() { }
+}
+
 ;// CONCATENATED MODULE: ../gh_provisioner/src/entities/ghorgwebhook/index.ts
 
 
@@ -344351,6 +345055,7 @@ class EntityGHOrgWebHook extends base_Entity {
 
 
 
+
 function entities_getEntity(cr) {
     const entityClass = getEntityClass(cr.kind);
     return new entityClass(cr);
@@ -344371,6 +345076,8 @@ function getEntityClass(kind) {
             return EntityGHOrgWebHook;
         case 'FirestartrGithubOrganizationSettings':
             return EntityGHOrgSettings;
+        case 'FirestartrGithubOrganizationVariableSection':
+            return EntityGHOrgVarsSection;
         default:
             throw new Error(`kind ${kind} has no entity associated`);
     }
@@ -344784,6 +345491,7 @@ const GITHUB_RESOURCE_KINDS = [
     'FirestartrGithubRepositorySecretsSection',
     'FirestartrGithubOrgWebhook',
     'FirestartrGithubOrganizationSettings',
+    'FirestartrGithubOrganizationVariableSection',
 ];
 const GITHUB_REPOSITORY_DEPENDENT_KINDS = [
     'FirestartrGithubRepositoryFeature',
@@ -346042,6 +346750,9 @@ function isObserveModeActive() {
 function runOperator(opts) {
     const { ignoreLease, dummyExec, namespace, kindList, importMode, importModeSkipPlan, observeMode, withMetrics, } = opts;
     const implementedKinds = filterImplementedKinds(kindList);
+    operator_src_logger.info(`operator kindList: ${JSON.stringify(kindList)}`);
+    operator_src_logger.info(`operator implementedKinds: ${JSON.stringify(implementedKinds)}`);
+    operator_src_logger.info(`operator ignoring kinds: ${JSON.stringify(kindList.filter((k) => !implementedKinds.includes(k)))}`);
     if (observeMode)
         observeModeActive = true;
     if (withMetrics)
@@ -346115,6 +346826,7 @@ const provisionImplementations = {
     githubmemberships: process_operation_processOperation,
     githuborgwebhooks: process_operation_processOperation,
     githuborganizationsettings: process_operation_processOperation,
+    githuborganizationvariablesections: process_operation_processOperation,
     fsdummiesa: processFirestartrDummies,
     fsdummiesb: processFirestartrDummies,
     fsdummiesc: processFirestartrDummies,
@@ -524933,7 +525645,7 @@ const crsStatusSubcommand = {
 };
 
 ;// CONCATENATED MODULE: ./package.json
-const package_namespaceObject = {"i8":"2.10.0"};
+const package_namespaceObject = JSON.parse('{"i8":" v2.11.0-objects-in-patches-2"}');
 ;// CONCATENATED MODULE: ../../package.json
 const package_namespaceObject_1 = {"i8":"2.10.0"};
 // EXTERNAL MODULE: ../../node_modules/semver/index.js