@firestartr/cli 2.11.0-snapshot-objects-in-patches → 2.11.0-snapshot-orgsettings-nullguard-1

package/build/index.js

@@ -280314,7 +280314,7 @@ function getCronNextInterval(cronLine, tz) {
 
 /***/ }),
 
-/***/ 99029:
+/***/ 3342:
 /***/ ((__unused_webpack_module, __webpack_exports__, __nccwpck_require__) => {
 
 // ESM COMPAT FLAG
@@ -285979,6 +285979,66 @@ async function encryptRepoSecret(owner, repo, section, plaintextValue, octokit)
     }
 }
 
+;// CONCATENATED MODULE: ../github/src/orgSecrets.ts
+
+
+
+async function getOrgPublicKey(org, section, octokit) {
+    logger.info(`Retrieving org public key for ${org} (${section})`);
+    try {
+        if (!octokit) {
+            octokit = await getOctokitForOrg(org);
+        }
+        const { data } = await octokit.rest[`${section}`].getOrgPublicKey({
+            org,
+        });
+        return data;
+    }
+    catch (error) {
+        logger.error(`Error retrieving org public key (${section}) for ${org}: ${error}`);
+        throw error;
+    }
+}
+async function encryptOrgSecret(org, section, plaintextValue, preFetchedKey, octokit) {
+    try {
+        const { key_id, key } = preFetchedKey
+            ? preFetchedKey
+            : await getOrgPublicKey(org, section, octokit);
+        await libsodium_wrappers.ready;
+        const publicKey = libsodium_wrappers.from_base64(key, libsodium_wrappers.base64_variants.ORIGINAL);
+        const secretBytes = libsodium_wrappers.from_string(plaintextValue);
+        const encryptedBytes = libsodium_wrappers.crypto_box_seal(secretBytes, publicKey);
+        const encryptedValue = libsodium_wrappers.to_base64(encryptedBytes, libsodium_wrappers.base64_variants.ORIGINAL);
+        return {
+            key_id,
+            encrypted_value: encryptedValue,
+        };
+    }
+    catch (err) {
+        logger.error(`Error encrypting org secret (${section}) for ${org}: ${err}`);
+        throw err;
+    }
+}
+async function getOrgSecret(org, section, name, octokit) {
+    logger.info(`Checking org secret ${name} (${section}) for ${org}`);
+    try {
+        if (!octokit) {
+            octokit = await getOctokitForOrg(org);
+        }
+        const response = await octokit.rest[`${section}`].getOrgSecret({
+            org,
+            secret_name: name,
+        });
+        return response.data;
+    }
+    catch (err) {
+        if (err && err.status === 404) {
+            return null;
+        }
+        throw err;
+    }
+}
+
 ;// CONCATENATED MODULE: ../github/src/profile.ts
 // Profile definitions and store for github package (immutable and ambient profiles)
 const profileStore = new Map();
@@ -286412,6 +286472,7 @@ function withProfile(profileName) {
 
 
 
+
 /* harmony default export */ const github = ({
     org: organization,
     repo: repository,
@@ -286434,6 +286495,9 @@ function withProfile(profileName) {
     encryption: {
         encryptRepoSecret: encryptRepoSecret,
         getRepoPublicKey: getRepoPublicKey,
+        getOrgPublicKey: getOrgPublicKey,
+        encryptOrgSecret: encryptOrgSecret,
+        getOrgSecret: getOrgSecret,
     },
     withProfile: withProfile,
     createProfile: createProfile,
@@ -319334,8 +319398,8 @@ var dist = __nccwpck_require__(44516);
 var dist_default = /*#__PURE__*/__nccwpck_require__.n(dist);
 // EXTERNAL MODULE: ../catalog_common/index.ts + 44 modules
 var catalog_common = __nccwpck_require__(78542);
-// EXTERNAL MODULE: ../github/index.ts + 37 modules
-var github = __nccwpck_require__(99029);
+// EXTERNAL MODULE: ../github/index.ts + 38 modules
+var github = __nccwpck_require__(3342);
 ;// CONCATENATED MODULE: ../cdk8s_renderer/src/patches/base.ts
 class BasePatches {
     constructor() { }
@@ -322103,6 +322167,31 @@ function extractAllRefs(claimData) {
                     }
                 }
             }
+            const orgSecrets = parsedClaim.providers?.github?.org_secrets;
+            if (orgSecrets && typeof orgSecrets === 'object') {
+                const secretRefRegex = /^ref:secretsclaim:([a-zA-Z0-9_-]+):([a-zA-Z0-9_-]+)$/;
+                for (const section of ['actions', 'codespaces', 'dependabot']) {
+                    const secrets = orgSecrets[section];
+                    if (!Array.isArray(secrets))
+                        continue;
+                    for (const secret of secrets) {
+                        if (secret.value) {
+                            const match = secret.value.match(secretRefRegex);
+                            if (match) {
+                                refs.push(`SecretsClaim-${match[1]}`);
+                            }
+                        }
+                        if (Array.isArray(secret.selected_repositories)) {
+                            for (const repoRef of secret.selected_repositories) {
+                                const compMatch = repoRef.match(/^component:(.+)$/);
+                                if (compMatch) {
+                                    refs.push(`ComponentClaim-${compMatch[1]}`);
+                                }
+                            }
+                        }
+                    }
+                }
+            }
             break;
         }
     }
@@ -323274,6 +323363,30 @@ const organizationSettingsProperties = {
             ],
         },
     },
+    org_secrets: {
+        type: 'object',
+        properties: {
+            actions: {
+                type: 'array',
+                items: {
+                    $ref: 'firestartr.dev://github/GithubOrgClaimSecret',
+                },
+            },
+            codespaces: {
+                type: 'array',
+                items: {
+                    $ref: 'firestartr.dev://github/GithubOrgClaimSecret',
+                },
+            },
+            dependabot: {
+                type: 'array',
+                items: {
+                    $ref: 'firestartr.dev://github/GithubOrgClaimSecret',
+                },
+            },
+        },
+        additionalProperties: false,
+    },
 };
 /* harmony default export */ const github_orgsettings_schema = ({
     $schema: SCHEMA,
@@ -323461,6 +323574,75 @@ const organizationSettingsProperties = {
     },
 });
 
+;// CONCATENATED MODULE: ../cdk8s_renderer/src/claims/github/orgSecrets.schema.ts
+
+/* harmony default export */ const orgSecrets_schema = ({
+    $schema: SCHEMA,
+    $id: 'GithubOrgClaimSecrets',
+    definitions: {
+        GithubOrgClaimSecrets: {
+            $id: 'firestartr.dev://github/GithubOrgClaimSecrets',
+            type: 'object',
+            description: 'Organization-level GitHub Actions secrets',
+            properties: {
+                actions: {
+                    type: 'array',
+                    items: {
+                        $ref: 'firestartr.dev://github/GithubOrgClaimSecret',
+                    },
+                },
+                codespaces: {
+                    type: 'array',
+                    items: {
+                        $ref: 'firestartr.dev://github/GithubOrgClaimSecret',
+                    },
+                },
+                dependabot: {
+                    type: 'array',
+                    items: {
+                        $ref: 'firestartr.dev://github/GithubOrgClaimSecret',
+                    },
+                },
+            },
+            additionalProperties: false,
+        },
+        GithubOrgClaimSecretRef: {
+            $id: 'firestartr.dev://github/GithubOrgClaimSecretRef',
+            type: 'string',
+            description: 'the reference of the secret',
+            pattern: '^ref:secretsclaim:([a-zA-Z0-9_-]+):([a-zA-Z0-9_-]+)$',
+        },
+        GithubOrgClaimSecret: {
+            $id: 'firestartr.dev://github/GithubOrgClaimSecret',
+            type: 'object',
+            description: 'An organization-level secret for GitHub Actions',
+            properties: {
+                name: {
+                    type: 'string',
+                    description: 'the name of the secret',
+                },
+                value: {
+                    $ref: 'firestartr.dev://github/GithubOrgClaimSecretRef',
+                },
+                visibility: {
+                    type: 'string',
+                    enum: ['all', 'selected', 'private'],
+                    description: 'which repositories can access the secret',
+                },
+                selected_repositories: {
+                    type: 'array',
+                    items: {
+                        type: 'string',
+                    },
+                    description: 'list of repository refs when visibility is selected',
+                },
+            },
+            required: ['name', 'value'],
+            additionalProperties: false,
+        },
+    },
+});
+
 ;// CONCATENATED MODULE: ../cdk8s_renderer/src/claims/github/index.ts
 
 
@@ -323470,6 +323652,7 @@ const organizationSettingsProperties = {
 
 
 
+
 const GithubSchemas = [
     github_group_schema,
     github_user_schema,
@@ -323479,6 +323662,7 @@ const GithubSchemas = [
     github_orgsettings_schema,
     component_secrets_vars_schema,
     component_labels_schema,
+    orgSecrets_schema,
 ];
 
 ;// CONCATENATED MODULE: ../cdk8s_renderer/src/claims/tfworkspaces/terraform.schema.ts
@@ -327490,6 +327674,382 @@ var FirestartrGithubMembershipSpecContextProviderRefKind;
     /** FirestartrProviderConfig */
     FirestartrGithubMembershipSpecContextProviderRefKind["FIRESTARTR_PROVIDER_CONFIG"] = "FirestartrProviderConfig";
 })(FirestartrGithubMembershipSpecContextProviderRefKind || (FirestartrGithubMembershipSpecContextProviderRefKind = {}));
+/**
+ * A resource to handle GitHub Organization Actions Secrets.
+ *
+ * @schema FirestartrGithubOrganizationSecretSection
+ */
+class FirestartrGithubOrganizationSecretSection extends lib.ApiObject {
+    /**
+     * Renders a Kubernetes manifest for "FirestartrGithubOrganizationSecretSection".
+     *
+     * This can be used to inline resource manifests inside other objects (e.g. as templates).
+     *
+     * @param props initialization props
+     */
+    static manifest(props) {
+        return {
+            ...FirestartrGithubOrganizationSecretSection.GVK,
+            ...toJson_FirestartrGithubOrganizationSecretSectionProps(props),
+        };
+    }
+    /**
+     * Defines a "FirestartrGithubOrganizationSecretSection" API object
+     * @param scope the scope in which to define this object
+     * @param id a scope-local name for the object
+     * @param props initialization props
+     */
+    constructor(scope, id, props) {
+        super(scope, id, {
+            ...FirestartrGithubOrganizationSecretSection.GVK,
+            ...props,
+        });
+    }
+    /**
+     * Renders the object to Kubernetes JSON.
+     */
+    toJson() {
+        const resolved = super.toJson();
+        return {
+            ...FirestartrGithubOrganizationSecretSection.GVK,
+            ...toJson_FirestartrGithubOrganizationSecretSectionProps(resolved),
+        };
+    }
+}
+/**
+ * Returns the apiVersion and kind for "FirestartrGithubOrganizationSecretSection"
+ */
+FirestartrGithubOrganizationSecretSection.GVK = {
+    apiVersion: 'firestartr.dev/v1',
+    kind: 'FirestartrGithubOrganizationSecretSection',
+};
+
+/**
+ * Converts an object of type 'FirestartrGithubOrganizationSecretSectionProps' to JSON representation.
+ */
+/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
+function toJson_FirestartrGithubOrganizationSecretSectionProps(obj) {
+    if (obj === undefined) {
+        return undefined;
+    }
+    const result = {
+        'metadata': obj.metadata,
+        'spec': toJson_FirestartrGithubOrganizationSecretSectionSpec(obj.spec),
+    };
+    // filter undefined values
+    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
+}
+/**
+ * Converts an object of type 'FirestartrGithubOrganizationSecretSectionSpec' to JSON representation.
+ */
+/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
+function toJson_FirestartrGithubOrganizationSecretSectionSpec(obj) {
+    if (obj === undefined) {
+        return undefined;
+    }
+    const result = {
+        'org': obj.org,
+        'secrets': toJson_FirestartrGithubOrganizationSecretSectionSpecSecrets(obj.secrets),
+        'context': toJson_FirestartrGithubOrganizationSecretSectionSpecContext(obj.context),
+        'firestartr': toJson_FirestartrGithubOrganizationSecretSectionSpecFirestartr(obj.firestartr),
+    };
+    // filter undefined values
+    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
+}
+/**
+ * Converts an object of type 'FirestartrGithubOrganizationSecretSectionSpecSecrets' to JSON representation.
+ */
+/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
+function toJson_FirestartrGithubOrganizationSecretSectionSpecSecrets(obj) {
+    if (obj === undefined) {
+        return undefined;
+    }
+    const result = {
+        'actions': obj.actions?.map(y => toJson_FirestartrGithubOrganizationSecretSectionSpecSecretsActions(y)),
+        'codespaces': obj.codespaces?.map(y => toJson_FirestartrGithubOrganizationSecretSectionSpecSecretsCodespaces(y)),
+        'dependabot': obj.dependabot?.map(y => toJson_FirestartrGithubOrganizationSecretSectionSpecSecretsDependabot(y)),
+    };
+    // filter undefined values
+    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
+}
+/**
+ * Converts an object of type 'FirestartrGithubOrganizationSecretSectionSpecContext' to JSON representation.
+ */
+/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
+function toJson_FirestartrGithubOrganizationSecretSectionSpecContext(obj) {
+    if (obj === undefined) {
+        return undefined;
+    }
+    const result = {
+        'backend': toJson_FirestartrGithubOrganizationSecretSectionSpecContextBackend(obj.backend),
+        'provider': toJson_FirestartrGithubOrganizationSecretSectionSpecContextProvider(obj.provider),
+    };
+    // filter undefined values
+    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
+}
+/**
+ * Converts an object of type 'FirestartrGithubOrganizationSecretSectionSpecFirestartr' to JSON representation.
+ */
+/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
+function toJson_FirestartrGithubOrganizationSecretSectionSpecFirestartr(obj) {
+    if (obj === undefined) {
+        return undefined;
+    }
+    const result = {
+        'tfStateKey': obj.tfStateKey,
+    };
+    // filter undefined values
+    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
+}
+/**
+ * Converts an object of type 'FirestartrGithubOrganizationSecretSectionSpecSecretsActions' to JSON representation.
+ */
+/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
+function toJson_FirestartrGithubOrganizationSecretSectionSpecSecretsActions(obj) {
+    if (obj === undefined) {
+        return undefined;
+    }
+    const result = {
+        'name': obj.name,
+        'ref': toJson_FirestartrGithubOrganizationSecretSectionSpecSecretsActionsRef(obj.ref),
+        'visibility': obj.visibility,
+        'selectedRepositories': obj.selectedRepositories?.map(y => y),
+    };
+    // filter undefined values
+    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
+}
+/**
+ * Converts an object of type 'FirestartrGithubOrganizationSecretSectionSpecSecretsCodespaces' to JSON representation.
+ */
+/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
+function toJson_FirestartrGithubOrganizationSecretSectionSpecSecretsCodespaces(obj) {
+    if (obj === undefined) {
+        return undefined;
+    }
+    const result = {
+        'name': obj.name,
+        'ref': toJson_FirestartrGithubOrganizationSecretSectionSpecSecretsCodespacesRef(obj.ref),
+        'visibility': obj.visibility,
+        'selectedRepositories': obj.selectedRepositories?.map(y => y),
+    };
+    // filter undefined values
+    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
+}
+/**
+ * Converts an object of type 'FirestartrGithubOrganizationSecretSectionSpecSecretsDependabot' to JSON representation.
+ */
+/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
+function toJson_FirestartrGithubOrganizationSecretSectionSpecSecretsDependabot(obj) {
+    if (obj === undefined) {
+        return undefined;
+    }
+    const result = {
+        'name': obj.name,
+        'ref': toJson_FirestartrGithubOrganizationSecretSectionSpecSecretsDependabotRef(obj.ref),
+        'visibility': obj.visibility,
+        'selectedRepositories': obj.selectedRepositories?.map(y => y),
+    };
+    // filter undefined values
+    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
+}
+/**
+ * Converts an object of type 'FirestartrGithubOrganizationSecretSectionSpecContextBackend' to JSON representation.
+ */
+/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
+function toJson_FirestartrGithubOrganizationSecretSectionSpecContextBackend(obj) {
+    if (obj === undefined) {
+        return undefined;
+    }
+    const result = {
+        'ref': toJson_FirestartrGithubOrganizationSecretSectionSpecContextBackendRef(obj.ref),
+    };
+    // filter undefined values
+    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
+}
+/**
+ * Converts an object of type 'FirestartrGithubOrganizationSecretSectionSpecContextProvider' to JSON representation.
+ */
+/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
+function toJson_FirestartrGithubOrganizationSecretSectionSpecContextProvider(obj) {
+    if (obj === undefined) {
+        return undefined;
+    }
+    const result = {
+        'ref': toJson_FirestartrGithubOrganizationSecretSectionSpecContextProviderRef(obj.ref),
+    };
+    // filter undefined values
+    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
+}
+/**
+ * Converts an object of type 'FirestartrGithubOrganizationSecretSectionSpecSecretsActionsRef' to JSON representation.
+ */
+/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
+function toJson_FirestartrGithubOrganizationSecretSectionSpecSecretsActionsRef(obj) {
+    if (obj === undefined) {
+        return undefined;
+    }
+    const result = {
+        'kind': obj.kind,
+        'name': obj.name,
+        'key': obj.key,
+    };
+    // filter undefined values
+    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
+}
+/* eslint-enable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
+/**
+ * Which repositories can access the secret.
+ *
+ * @schema FirestartrGithubOrganizationSecretSectionSpecSecretsActionsVisibility
+ */
+var FirestartrGithubOrganizationSecretSectionSpecSecretsActionsVisibility;
+(function (FirestartrGithubOrganizationSecretSectionSpecSecretsActionsVisibility) {
+    /** all */
+    FirestartrGithubOrganizationSecretSectionSpecSecretsActionsVisibility["ALL"] = "all";
+    /** selected */
+    FirestartrGithubOrganizationSecretSectionSpecSecretsActionsVisibility["SELECTED"] = "selected";
+    /** private */
+    FirestartrGithubOrganizationSecretSectionSpecSecretsActionsVisibility["PRIVATE"] = "private";
+})(FirestartrGithubOrganizationSecretSectionSpecSecretsActionsVisibility || (FirestartrGithubOrganizationSecretSectionSpecSecretsActionsVisibility = {}));
+/**
+ * Converts an object of type 'FirestartrGithubOrganizationSecretSectionSpecSecretsCodespacesRef' to JSON representation.
+ */
+/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
+function toJson_FirestartrGithubOrganizationSecretSectionSpecSecretsCodespacesRef(obj) {
+    if (obj === undefined) {
+        return undefined;
+    }
+    const result = {
+        'kind': obj.kind,
+        'name': obj.name,
+        'key': obj.key,
+    };
+    // filter undefined values
+    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
+}
+/* eslint-enable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
+/**
+ * Which repositories can access the secret.
+ *
+ * @schema FirestartrGithubOrganizationSecretSectionSpecSecretsCodespacesVisibility
+ */
+var FirestartrGithubOrganizationSecretSectionSpecSecretsCodespacesVisibility;
+(function (FirestartrGithubOrganizationSecretSectionSpecSecretsCodespacesVisibility) {
+    /** all */
+    FirestartrGithubOrganizationSecretSectionSpecSecretsCodespacesVisibility["ALL"] = "all";
+    /** selected */
+    FirestartrGithubOrganizationSecretSectionSpecSecretsCodespacesVisibility["SELECTED"] = "selected";
+    /** private */
+    FirestartrGithubOrganizationSecretSectionSpecSecretsCodespacesVisibility["PRIVATE"] = "private";
+})(FirestartrGithubOrganizationSecretSectionSpecSecretsCodespacesVisibility || (FirestartrGithubOrganizationSecretSectionSpecSecretsCodespacesVisibility = {}));
+/**
+ * Converts an object of type 'FirestartrGithubOrganizationSecretSectionSpecSecretsDependabotRef' to JSON representation.
+ */
+/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
+function toJson_FirestartrGithubOrganizationSecretSectionSpecSecretsDependabotRef(obj) {
+    if (obj === undefined) {
+        return undefined;
+    }
+    const result = {
+        'kind': obj.kind,
+        'name': obj.name,
+        'key': obj.key,
+    };
+    // filter undefined values
+    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
+}
+/* eslint-enable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
+/**
+ * Which repositories can access the secret.
+ *
+ * @schema FirestartrGithubOrganizationSecretSectionSpecSecretsDependabotVisibility
+ */
+var FirestartrGithubOrganizationSecretSectionSpecSecretsDependabotVisibility;
+(function (FirestartrGithubOrganizationSecretSectionSpecSecretsDependabotVisibility) {
+    /** all */
+    FirestartrGithubOrganizationSecretSectionSpecSecretsDependabotVisibility["ALL"] = "all";
+    /** selected */
+    FirestartrGithubOrganizationSecretSectionSpecSecretsDependabotVisibility["SELECTED"] = "selected";
+    /** private */
+    FirestartrGithubOrganizationSecretSectionSpecSecretsDependabotVisibility["PRIVATE"] = "private";
+})(FirestartrGithubOrganizationSecretSectionSpecSecretsDependabotVisibility || (FirestartrGithubOrganizationSecretSectionSpecSecretsDependabotVisibility = {}));
+/**
+ * Converts an object of type 'FirestartrGithubOrganizationSecretSectionSpecContextBackendRef' to JSON representation.
+ */
+/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
+function toJson_FirestartrGithubOrganizationSecretSectionSpecContextBackendRef(obj) {
+    if (obj === undefined) {
+        return undefined;
+    }
+    const result = {
+        'kind': obj.kind,
+        'name': obj.name,
+    };
+    // filter undefined values
+    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
+}
+/**
+ * Converts an object of type 'FirestartrGithubOrganizationSecretSectionSpecContextProviderRef' to JSON representation.
+ */
+/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
+function toJson_FirestartrGithubOrganizationSecretSectionSpecContextProviderRef(obj) {
+    if (obj === undefined) {
+        return undefined;
+    }
+    const result = {
+        'kind': obj.kind,
+        'name': obj.name,
+    };
+    // filter undefined values
+    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
+}
+/* eslint-enable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
+/**
+ * The type of Kubernetes resource to reference.
+ *
+ * @schema FirestartrGithubOrganizationSecretSectionSpecSecretsActionsRefKind
+ */
+var FirestartrGithubOrganizationSecretSectionSpecSecretsActionsRefKind;
+(function (FirestartrGithubOrganizationSecretSectionSpecSecretsActionsRefKind) {
+    /** Secret */
+    FirestartrGithubOrganizationSecretSectionSpecSecretsActionsRefKind["SECRET"] = "Secret";
+})(FirestartrGithubOrganizationSecretSectionSpecSecretsActionsRefKind || (FirestartrGithubOrganizationSecretSectionSpecSecretsActionsRefKind = {}));
+/**
+ * The type of Kubernetes resource to reference.
+ *
+ * @schema FirestartrGithubOrganizationSecretSectionSpecSecretsCodespacesRefKind
+ */
+var FirestartrGithubOrganizationSecretSectionSpecSecretsCodespacesRefKind;
+(function (FirestartrGithubOrganizationSecretSectionSpecSecretsCodespacesRefKind) {
+    /** Secret */
+    FirestartrGithubOrganizationSecretSectionSpecSecretsCodespacesRefKind["SECRET"] = "Secret";
+})(FirestartrGithubOrganizationSecretSectionSpecSecretsCodespacesRefKind || (FirestartrGithubOrganizationSecretSectionSpecSecretsCodespacesRefKind = {}));
+/**
+ * The type of Kubernetes resource to reference.
+ *
+ * @schema FirestartrGithubOrganizationSecretSectionSpecSecretsDependabotRefKind
+ */
+var FirestartrGithubOrganizationSecretSectionSpecSecretsDependabotRefKind;
+(function (FirestartrGithubOrganizationSecretSectionSpecSecretsDependabotRefKind) {
+    /** Secret */
+    FirestartrGithubOrganizationSecretSectionSpecSecretsDependabotRefKind["SECRET"] = "Secret";
+})(FirestartrGithubOrganizationSecretSectionSpecSecretsDependabotRefKind || (FirestartrGithubOrganizationSecretSectionSpecSecretsDependabotRefKind = {}));
+/**
+ * @schema FirestartrGithubOrganizationSecretSectionSpecContextBackendRefKind
+ */
+var FirestartrGithubOrganizationSecretSectionSpecContextBackendRefKind;
+(function (FirestartrGithubOrganizationSecretSectionSpecContextBackendRefKind) {
+    /** FirestartrProviderConfig */
+    FirestartrGithubOrganizationSecretSectionSpecContextBackendRefKind["FIRESTARTR_PROVIDER_CONFIG"] = "FirestartrProviderConfig";
+})(FirestartrGithubOrganizationSecretSectionSpecContextBackendRefKind || (FirestartrGithubOrganizationSecretSectionSpecContextBackendRefKind = {}));
+/**
+ * @schema FirestartrGithubOrganizationSecretSectionSpecContextProviderRefKind
+ */
+var FirestartrGithubOrganizationSecretSectionSpecContextProviderRefKind;
+(function (FirestartrGithubOrganizationSecretSectionSpecContextProviderRefKind) {
+    /** FirestartrProviderConfig */
+    FirestartrGithubOrganizationSecretSectionSpecContextProviderRefKind["FIRESTARTR_PROVIDER_CONFIG"] = "FirestartrProviderConfig";
+})(FirestartrGithubOrganizationSecretSectionSpecContextProviderRefKind || (FirestartrGithubOrganizationSecretSectionSpecContextProviderRefKind = {}));
 /**
  * A resource to handle GitHub Organization Settings.
  *
@@ -330904,6 +331464,78 @@ class GithubOrgVariableSectionChart extends BaseGithubChart {
     }
 }
 
+;// CONCATENATED MODULE: ../cdk8s_renderer/src/charts/github/orgSecretSectionChart.ts
+
+
+
+class GithubOrgSecretSectionChart extends BaseGithubChart {
+    template() {
+        const claim = this.get('claim');
+        const firestartrId = this.get('firestartrId');
+        const githubProvider = claim.providers.github;
+        const orgSecrets = githubProvider.org_secrets || {};
+        const renderSecrets = (section) => {
+            const secrets = orgSecrets[section];
+            if (!Array.isArray(secrets))
+                return [];
+            return secrets.map((secret) => {
+                const parts = secret.value.split(':');
+                const selectedRepositories = (secret.selected_repositories || []).map((ref) => {
+                    const match = ref.match(/^component:(.+)$/);
+                    if (!match) {
+                        throw new ChartRenderError('OrgSettingsClaim', claim.name, `Invalid component ref "${ref}" in selected_repositories. Expected format: component:<name>`);
+                    }
+                    const componentName = match[1];
+                    const resolvedCr = this.refResolver('ComponentClaim', componentName);
+                    const org = resolvedCr?.spec?.org;
+                    const repoName = resolvedCr?.metadata?.annotations?.['firestartr.dev/external-name'] || resolvedCr?.metadata?.name?.replace(/-[0-9a-f-]{36}$/, '');
+                    if (!org || !repoName) {
+                        throw new ChartRenderError('OrgSettingsClaim', claim.name, `Referenced component "${componentName}" has no GitHub provider configured`);
+                    }
+                    return `${org}/${repoName}`;
+                });
+                return {
+                    name: secret.name,
+                    ref: {
+                        kind: 'Secret',
+                        name: parts[2],
+                        key: parts[3],
+                    },
+                    visibility: secret.visibility || 'all',
+                    selectedRepositories,
+                };
+            });
+        };
+        const template = {
+            metadata: {
+                name: `${githubProvider.name}-secrets`,
+            },
+            spec: {
+                org: githubProvider.org,
+                secrets: {
+                    actions: renderSecrets('actions'),
+                    codespaces: renderSecrets('codespaces'),
+                    dependabot: renderSecrets('dependabot'),
+                },
+                firestartr: {
+                    tfStateKey: firestartrId ? `${firestartrId}-secrets` : firestartrId,
+                },
+                writeConnectionSecretToRef: {
+                    name: `firestartrgithuborganizationsecretsection-${githubProvider.name}-secrets-outputs`.toLowerCase(),
+                    outputs: [{ key: 'managed_secrets' }, { key: 'secret_ids' }],
+                },
+            },
+        };
+        return JSON.parse(JSON.stringify(template));
+    }
+    gvk() {
+        return FirestartrGithubOrganizationSecretSection.GVK;
+    }
+    instanceApiObject(template) {
+        return new FirestartrGithubOrganizationSecretSection(this, template.metadata.name, template);
+    }
+}
+
 ;// CONCATENATED MODULE: ../cdk8s_renderer/src/charts/github/index.ts
 
 
@@ -330912,6 +331544,7 @@ class GithubOrgVariableSectionChart extends BaseGithubChart {
 
 
 
+
 ;// CONCATENATED MODULE: ../cdk8s_renderer/src/charts/catalog/base.ts
 
 class BaseCatalogChart extends BaseChart {
@@ -331660,6 +332293,7 @@ class SecretsChart extends BaseSecretsChart {
     GithubOrgWebhookChart: GithubOrgWebhookChart,
     GithubOrgSettingsChart: GithubOrgSettingsChart,
     GithubOrgVariableSectionChart: GithubOrgVariableSectionChart,
+    GithubOrgSecretSectionChart: GithubOrgSecretSectionChart,
 });
 
 ;// CONCATENATED MODULE: ../cdk8s_renderer/src/renderer/claims-render.ts
@@ -331711,16 +332345,21 @@ async function renderClaims(catalogScope, firestartrScope, data) {
             const variableSectionPreviousCR = claim.kind === 'OrgSettingsClaim'
                 ? getPreviousCRfromClaim({ kind: claim.kind, name: `${claim.name}-variable-section` }, crs, 'FirestartrGithubOrganizationVariableSection')
                 : false;
+            const secretSectionPreviousCR = claim.kind === 'OrgSettingsClaim'
+                ? getPreviousCRfromClaim({ kind: claim.kind, name: `${claim.name}-secret-section` }, crs, 'FirestartrGithubOrganizationSecretSection')
+                : false;
             const patches = await extractPatches(renderClaims[claimKey], previousCR);
             let variableSectionPatches = undefined;
+            let secretSectionPatches = undefined;
             if (claim.kind === 'OrgSettingsClaim') {
                 variableSectionPatches = await extractPatches(renderClaims[claimKey], variableSectionPreviousCR);
+                secretSectionPatches = await extractPatches(renderClaims[claimKey], secretSectionPreviousCR);
             }
             if (!previousCR) {
                 logger.debug(`No CR found for claim ${claimKey}, it will be rendered from scratch`);
             }
             const claimPath = renderClaims[claimKey].claimPath;
-            const { firestartrEntity, extraCharts, catalogEntity } = await renderClaim(catalogScope, firestartrScope, claim, patches, previousCR, claimPath, variableSectionPreviousCR, variableSectionPatches);
+            const { firestartrEntity, extraCharts, catalogEntity } = await renderClaim(catalogScope, firestartrScope, claim, patches, previousCR, claimPath, variableSectionPreviousCR, variableSectionPatches, secretSectionPreviousCR, secretSectionPatches);
             if (catalogEntity) {
                 result[`${catalogEntity.kind}-${catalogEntity.metadata.name}`] =
                     catalogEntity.toJson();
@@ -331749,7 +332388,7 @@ async function renderClaims(catalogScope, firestartrScope, data) {
     }
     return result;
 }
-async function renderClaim(catalogScope, firestartrScope, claim, patches, previousCR = null, claimPath, variableSectionPreviousCR = false, variableSectionPatches) {
+async function renderClaim(catalogScope, firestartrScope, claim, patches, previousCR = null, claimPath, variableSectionPreviousCR = false, variableSectionPatches, secretSectionPreviousCR = false, secretSectionPatches) {
     let catalogEntity = undefined;
     let firestartrEntity = undefined;
     const extraCharts = [];
@@ -331918,6 +332557,27 @@ async function renderClaim(catalogScope, firestartrScope, claim, patches, previo
                     },
                     chart: variableSectionObject,
                 });
+                const secretSectionFirestartrId = secretSectionPreviousCR
+                    ? secretSectionPreviousCR.spec?.firestartr?.tfStateKey
+                    : firestartrId
+                        ? `${firestartrId}-secrets`
+                        : null;
+                const ssRenderPatches = secretSectionPatches
+                    ? secretSectionPatches.filter((patch) => !patch.isPostPatch)
+                    : renderPatches;
+                const ssPostPatches = secretSectionPatches
+                    ? secretSectionPatches.filter((patch) => patch.isPostPatch)
+                    : postPatches;
+                const secretSectionChart = new charts.GithubOrgSecretSectionChart(firestartrScope, `github-secrets-${chartId}`, secretSectionFirestartrId, claim, ssRenderPatches);
+                await secretSectionChart.render();
+                const secretSectionObject = await secretSectionChart.postRenderer(ssPostPatches);
+                extraCharts.push({
+                    claim: {
+                        kind: claim.kind,
+                        name: `${claim.name}-secret-section`,
+                    },
+                    chart: secretSectionObject,
+                });
             }
             break;
         default:
@@ -332040,8 +332700,33 @@ function searchSecretKey(secretClaim, key) {
 }
 function validateOrgSettingsComponentRefs(ref, renderClaims) {
     const claim = renderClaims[ref].claim;
+    validateOrgSecretsSelectedRepositories(claim, renderClaims);
     validateActionsVariablesSelectedRepositories(claim, renderClaims);
 }
+function validateOrgSecretsSelectedRepositories(claim, renderClaims) {
+    const orgSecrets = claim?.providers?.github?.org_secrets;
+    if (!orgSecrets || typeof orgSecrets !== 'object')
+        return;
+    for (const section of ['actions', 'codespaces', 'dependabot']) {
+        const secrets = orgSecrets[section];
+        if (!Array.isArray(secrets))
+            continue;
+        for (const secret of secrets) {
+            if (!secret.selected_repositories)
+                continue;
+            for (const repoRef of secret.selected_repositories) {
+                const match = repoRef.match(COMPONENT_REF_PATTERN);
+                if (!match)
+                    continue;
+                const [, componentName] = match;
+                const expectedKey = `ComponentClaim-${componentName}`;
+                if (!renderClaims[expectedKey]) {
+                    throw new Error(`CrossReference error: OrgSettingsClaim/${claim.name} references a non-existent component "${componentName}" in org_secrets.${section}.${secret.name}.selected_repositories`);
+                }
+            }
+        }
+    }
+}
 function validateActionsVariablesSelectedRepositories(claim, renderClaims) {
     const actionsVariables = claim?.providers?.github?.actions_variables;
     if (!Array.isArray(actionsVariables))
@@ -332172,6 +332857,116 @@ function validateActionsVariablesUniqueness(crs) {
     }
 }
 
+;// CONCATENATED MODULE: ../cdk8s_renderer/src/validations/githubOrgSecretSection.ts
+const GITHUB_ORG_SECRET_SECTION_KIND = 'FirestartrGithubOrganizationSecretSection';
+const githubOrgSecretSection_FIRESTARTR_CLAIM_REF_ANNOTATION = 'firestartr.dev/claim-ref';
+const githubOrgSecretSection_CLAIM_REF_LABEL = 'claim-ref';
+const SECRETS_CLAIM_REF_PATTERN = /^ref:secretsclaim:([a-zA-Z0-9_-]+):([a-zA-Z0-9_-]+)$/;
+function githubOrgSecretSection_formatResourceRef(name, claimRef) {
+    return claimRef ? `${name} (claim: ${claimRef})` : name;
+}
+function validateGithubOrgSecretSectionSingleton(crs) {
+    const refsByOrg = new Map();
+    const seenClaimRefs = new Map();
+    for (const crKey of Object.keys(crs)) {
+        const cr = crs[crKey];
+        if (cr.kind !== GITHUB_ORG_SECRET_SECTION_KIND)
+            continue;
+        const org = cr.spec?.org;
+        if (typeof org !== 'string' || !org)
+            continue;
+        const name = cr.metadata?.name || crKey;
+        const claimRef = cr.metadata?.annotations?.[githubOrgSecretSection_FIRESTARTR_CLAIM_REF_ANNOTATION] ||
+            cr.metadata?.labels?.[githubOrgSecretSection_CLAIM_REF_LABEL];
+        const normalizedOrg = org.toLowerCase();
+        if (claimRef) {
+            const seen = seenClaimRefs.get(normalizedOrg) || new Set();
+            if (seen.has(claimRef))
+                continue;
+            seen.add(claimRef);
+            seenClaimRefs.set(normalizedOrg, seen);
+        }
+        const refs = refsByOrg.get(normalizedOrg) || [];
+        refs.push(githubOrgSecretSection_formatResourceRef(name, claimRef));
+        refsByOrg.set(normalizedOrg, refs);
+    }
+    for (const [org, refs] of refsByOrg.entries()) {
+        if (refs.length < 2)
+            continue;
+        throw new Error(`Duplicate ${GITHUB_ORG_SECRET_SECTION_KIND} resources found for GitHub organization "${org}": ${refs.join(', ')}`);
+    }
+}
+function validateSecretNamesUniqueness(crs) {
+    for (const crKey of Object.keys(crs)) {
+        const cr = crs[crKey];
+        if (cr.kind !== GITHUB_ORG_SECRET_SECTION_KIND)
+            continue;
+        const secrets = cr.spec?.secrets;
+        if (!secrets || typeof secrets !== 'object')
+            continue;
+        for (const section of ['actions', 'codespaces', 'dependabot']) {
+            const sectionSecrets = secrets[section];
+            if (!Array.isArray(sectionSecrets))
+                continue;
+            const names = new Set();
+            for (const secret of sectionSecrets) {
+                const secretName = secret?.name;
+                if (!secretName)
+                    continue;
+                if (names.has(secretName)) {
+                    const org = cr.spec?.org || 'unknown';
+                    throw new Error(`Duplicate secret name "${secretName}" found in ${section} section of ${GITHUB_ORG_SECRET_SECTION_KIND} for organization "${org}"`);
+                }
+                names.add(secretName);
+            }
+        }
+    }
+}
+function validateOrgSecretsCrossReferences(renderClaims) {
+    for (const claimKey of Object.keys(renderClaims)) {
+        if (!claimKey.startsWith('OrgSettingsClaim-'))
+            continue;
+        const claimData = renderClaims[claimKey];
+        const claim = claimData?.claim;
+        const orgSecrets = claim?.providers?.github?.org_secrets;
+        if (!orgSecrets || typeof orgSecrets !== 'object')
+            continue;
+        for (const section of ['actions', 'codespaces', 'dependabot']) {
+            const secrets = orgSecrets[section];
+            if (!Array.isArray(secrets))
+                continue;
+            for (const secret of secrets) {
+                if (!secret.value)
+                    continue;
+                const match = secret.value.match(SECRETS_CLAIM_REF_PATTERN);
+                if (!match)
+                    continue;
+                const [, secretClaimName, secretKey] = match;
+                const expectedKey = `SecretsClaim-${secretClaimName}`;
+                if (!renderClaims[expectedKey])
+                    continue;
+                const secretClaim = renderClaims[expectedKey]?.claim;
+                const externalSecrets = secretClaim?.providers?.external_secrets?.externalSecrets?.secrets;
+                const pushSecrets = secretClaim?.providers?.external_secrets?.pushSecrets;
+                let keyFound = false;
+                if (Array.isArray(pushSecrets)) {
+                    keyFound =
+                        pushSecrets.find((s) => s.secretName === secretKey) !==
+                            undefined;
+                }
+                if (!keyFound && Array.isArray(externalSecrets)) {
+                    keyFound =
+                        externalSecrets.find((s) => s.secretName === secretKey) !==
+                            undefined;
+                }
+                if (!keyFound) {
+                    throw new Error(`CrossReference error: OrgSettingsClaim/${claim.name} references a non-existent secret key "${secretKey}" in SecretsClaim/${secretClaimName} via org_secrets.${section}.${secret.name}`);
+                }
+            }
+        }
+    }
+}
+
 ;// CONCATENATED MODULE: ../cdk8s_renderer/src/renderer/renderer.ts
 
 
@@ -332183,6 +332978,7 @@ function validateActionsVariablesUniqueness(crs) {
 
 
 
+
 /*
  * Function called when rendering but not importing
  *
@@ -332204,10 +333000,13 @@ async function renderer_render(catalogScope, firestartrScope, claimList) {
     try {
         validateSubReferences(data.renderClaims);
         validateComponentPagesPath(data.renderClaims);
+        validateOrgSecretsCrossReferences(data.renderClaims);
         validateTfStateKeyUniqueness(result);
         validateGithubOrgSettingsSingleton(fullCrSet);
         validateGithubOrgVariableSectionSingleton(fullCrSet);
         validateActionsVariablesUniqueness(result);
+        validateGithubOrgSecretSectionSingleton(fullCrSet);
+        validateSecretNamesUniqueness(result);
         validateCrSizes(result);
         validatePermissionsUniqueness(result);
     }
@@ -334540,6 +335339,7 @@ const kindPluralMap = {
     githuborgwebhooks: 'FirestartrGithubOrgWebhook',
     githuborganizationsettings: 'FirestartrGithubOrganizationSettings',
     githuborganizationvariablesections: 'FirestartrGithubOrganizationVariableSection',
+    githuborganizationsecretsections: 'FirestartrGithubOrganizationSecretSection',
     terraformworkspaces: 'FirestartrTerraformWorkspace',
     terraformworkspaceplans: 'FirestartrTerraformWorkspacePlan',
     providerconfigs: 'FirestartrProviderConfig',
@@ -336518,6 +337318,7 @@ const kindsWithFinalizer = [
     'FirestartrGithubOrgWebhook',
     'FirestartrGithubOrganizationSettings',
     'FirestartrGithubOrganizationVariableSection',
+    'FirestartrGithubOrganizationSecretSection',
     'FirestartrGithubRepositorySecretsSection',
 ];
 const kindsWithDependants = [
@@ -339467,7 +340268,7 @@ async function configGit() {
     }
     // Import github dynamically to avoid Jest ESM issues when not specifically running this function
     // (see CONSTITUTION and RULES: must not change test machinery)
-    const githubModule = await Promise.resolve(/* import() */).then(__nccwpck_require__.bind(__nccwpck_require__, 99029));
+    const githubModule = await Promise.resolve(/* import() */).then(__nccwpck_require__.bind(__nccwpck_require__, 3342));
     const github = githubModule.default || githubModule;
     if (external_fs_.existsSync(gitconfigPath)) {
         external_fs_.rmSync(gitconfigPath);
@@ -343064,6 +343865,11 @@ const MODULES = {
         // github-org-variables-section-v0.1.0
         ref: 'fb9c01d0a1e03e5134479da13d0faf55891dfedf',
     },
+    FirestartrGithubOrganizationSecretSection: {
+        module: 'git::https://github.com/prefapp/tfm.git//modules/github-org-secrets-section',
+        // feat/1364-feat-add-github-org-secrets-section-module
+        ref: '170e6cf',
+    },
 };
 function getFirestartrDefaultTFM(kind) {
     if (kind in MODULES) {
@@ -344954,6 +345760,206 @@ class EntityGHOrgVarsSection extends base_Entity {
     async loadAddressesToImport() { }
 }
 
+;// CONCATENATED MODULE: ../gh_provisioner/src/entities/ghorgsecretsection/secrets.ts
+
+
+
+
+const secrets_SECTIONS = ['actions', 'codespaces', 'dependabot'];
+
+async function provisionOrgSecrets(entity, secrets) {
+    gh_provisioner_src_logger.info(`[gh-provisioner] ${entity.k8sId} provisioning org secrets`);
+    for (const section of secrets_SECTIONS) {
+        const sectionSecrets = secrets[section] || [];
+        if (sectionSecrets.length === 0)
+            continue;
+        let preFetchedKey;
+        try {
+            preFetchedKey = await fetchOrgPublicKey(entity, section);
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            throw new Error(`[gh-provisioner] ${entity.k8sId} failed to fetch ${section} org public key: ${message}`);
+        }
+        for (const secret of sectionSecrets) {
+            await provisionOrgSecret(entity, section, secret, preFetchedKey);
+        }
+    }
+}
+async function fetchOrgPublicKey(entity, section) {
+    return (await entity.runWithGithubProvider(async () => {
+        return await github["default"].encryption.getOrgPublicKey(entity.cr.spec.org, section);
+    }));
+}
+async function provisionOrgSecret(entity, section, secret, preFetchedKey) {
+    gh_provisioner_src_logger.info(`[gh-provisioner] provisioning org secret ${entity.k8sId}/${section}/${secret.name}`);
+    if (process.env['AVOID_PROVIDER_SECRET_ENCRYPTION']) {
+        await secrets_createUnencryptedSecret(entity, section, secret);
+    }
+    else {
+        await secrets_createEncryptedSecret(entity, section, secret, preFetchedKey);
+    }
+    gh_provisioner_src_logger.info(`[gh-provisioner] org secret provisioned ${section}/${secret.name}`);
+}
+async function secrets_createEncryptedSecret(entity, section, secret, preFetchedKey) {
+    const plainSecret = base_Entity.refResolver(secret.ref);
+    const plainTextSecret = plainSecret.getOutput(secret.ref.key);
+    const plaintextSha256 = external_crypto_default().createHash('sha256')
+        .update(plainTextSecret)
+        .digest('hex');
+    const { encrypted_value } = (await entity.runWithGithubProvider(async () => {
+        return await github["default"].encryption.encryptOrgSecret(entity.cr.spec.org, section, plainTextSecret, preFetchedKey);
+    }));
+    entity.patchData({
+        op: PatchOperations.add,
+        path: `/config/${section}/${secret.name}`,
+        value: {
+            value: encrypted_value,
+            visibility: secret.visibility || 'all',
+            ...(secret.selectedRepositories && secret.selectedRepositories.length > 0
+                ? { selected_repositories: secret.selectedRepositories }
+                : {}),
+        },
+    });
+    entity.patchData({
+        op: PatchOperations.add,
+        path: `/config/${section}_sha256/${secret.name}`,
+        value: plaintextSha256,
+    });
+}
+async function secrets_createUnencryptedSecret(entity, section, secret) {
+    const plainSecret = base_Entity.refResolver(secret.ref);
+    const plainTextSecret = plainSecret.getOutput(secret.ref.key);
+    const plaintextSha256 = external_crypto_default().createHash('sha256')
+        .update(plainTextSecret)
+        .digest('hex');
+    entity.patchData({
+        op: PatchOperations.add,
+        path: `/config/${section}/${secret.name}`,
+        value: {
+            value: plainTextSecret,
+            visibility: secret.visibility || 'all',
+            ...(secret.selectedRepositories && secret.selectedRepositories.length > 0
+                ? { selected_repositories: secret.selectedRepositories }
+                : {}),
+        },
+    });
+    entity.patchData({
+        op: PatchOperations.add,
+        path: `/config/${section}_sha256/${secret.name}`,
+        value: plaintextSha256,
+    });
+}
+async function adoptSecretsIfNeeded(entity, secrets) {
+    const managedSecrets = entity.cr.fResolveSelfOutputs('managed_secrets') || [];
+    for (const section of secrets_SECTIONS) {
+        const sectionSecrets = secrets[section] || [];
+        if (sectionSecrets.length === 0)
+            continue;
+        const declaredNames = sectionSecrets.map((s) => s.name);
+        const newToModule = declaredNames.filter((name) => !managedSecrets.includes(name));
+        if (newToModule.length === 0) {
+            gh_provisioner_src_logger.debug(`[gh-provisioner] ${entity.k8sId} all declared ${section} secrets are already managed`);
+            continue;
+        }
+        if (managedSecrets.length === 0) {
+            gh_provisioner_src_logger.info(`[gh-provisioner] ${entity.k8sId} no managed_secrets output — first reconciliation, treating all ${newToModule.length} ${section} secret(s) as new to module`);
+        }
+        for (const secretName of newToModule) {
+            try {
+                const existing = (await entity.runWithGithubProvider(async () => {
+                    return await github["default"].encryption.getOrgSecret(entity.cr.spec.org, section, secretName);
+                }));
+                if (existing) {
+                    gh_provisioner_src_logger.info(`[gh-provisioner] ${entity.k8sId} adopting pre-existing ${section} secret '${secretName}' on GitHub org '${entity.cr.spec.org}'`);
+                    const resourceType = `github_${section}_organization_secret`;
+                    entity.patchImportData({
+                        op: PatchOperations.add,
+                        path: '/imports/-',
+                        value: {
+                            to: `${resourceType}.this["${secretName}"]`,
+                            id: secretName,
+                        },
+                    });
+                    const secretEntry = sectionSecrets.find((s) => s.name === secretName);
+                    if (secretEntry &&
+                        secretEntry.visibility === 'selected' &&
+                        (section === 'actions' || section === 'dependabot')) {
+                        const bindingType = `github_${section}_organization_secret_repositories`;
+                        entity.patchImportData({
+                            op: PatchOperations.add,
+                            path: '/imports/-',
+                            value: {
+                                to: `${bindingType}.this["${secretName}"]`,
+                                id: secretName,
+                            },
+                        });
+                    }
+                }
+            }
+            catch (err) {
+                if (err && err.status === 404) {
+                    gh_provisioner_src_logger.info(`[gh-provisioner] ${entity.k8sId} ${section} secret '${secretName}' not found on GitHub org '${entity.cr.spec.org}' — will be created by TFM`);
+                }
+                else if (err && (err.status === 401 || err.status === 403)) {
+                    gh_provisioner_src_logger.warn(`[gh-provisioner] ${entity.k8sId} token lacks scope to check ${section} secret '${secretName}' on org '${entity.cr.spec.org}' — skipping adoption gracefully`);
+                }
+                else {
+                    gh_provisioner_src_logger.warn(`[gh-provisioner] ${entity.k8sId} unexpected error checking ${section} secret '${secretName}' on org '${entity.cr.spec.org}': ${err instanceof Error ? err.message : String(err)}`);
+                }
+            }
+        }
+    }
+}
+
+;// CONCATENATED MODULE: ../gh_provisioner/src/entities/ghorgsecretsection/index.ts
+
+
+
+class EntityGHOrgSecretSection extends base_Entity {
+    constructor(artifact) {
+        super(artifact, {
+            config: {
+                org: '',
+                actions: {},
+                codespaces: {},
+                dependabot: {},
+                actions_sha256: {},
+                codespaces_sha256: {},
+                dependabot_sha256: {},
+            },
+        });
+    }
+    async loadResources(tfOp) {
+        gh_provisioner_src_logger.info(`[gh-provisioner] running ${tfOp} on ${this.k8sId}`);
+        try {
+            const cr = this.cr;
+            const org = cr.spec.org;
+            const secrets = cr.spec.secrets || {};
+            this.patchData({
+                op: PatchOperations.replace,
+                path: '/config/org',
+                value: org,
+            });
+            await provisionOrgSecrets(this, secrets);
+            const redactedDoc = JSON.parse(JSON.stringify(this._document, (key, value) => typeof value === 'string' && value.length > 50 ? '[REDACTED]' : value));
+            this.synthMessage(`[gh-provisioner] ${this.k8sId} config:\n${JSON.stringify(redactedDoc, null, 2)}`);
+            this.synthEnd(`[gh-provisioner] ${this.k8sId} loaded its data`);
+            if (tfOp === 'apply') {
+                await adoptSecretsIfNeeded(this, secrets);
+            }
+            gh_provisioner_src_logger.debug(`[gh-provisioner] ${this.k8sId} loaded its data`);
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            gh_provisioner_src_logger.error(`[gh-provisioner] ${this.k8sId} error loading resources: ${message}`);
+            throw new Error(`[gh-provisioner] ${this.k8sId} error loading resources: ${message}`);
+        }
+    }
+    async postProvision(_tfOp) { }
+    async loadAddressesToImport() { }
+}
+
 ;// CONCATENATED MODULE: ../gh_provisioner/src/entities/ghorgwebhook/index.ts
 
 
@@ -345031,6 +346037,7 @@ class EntityGHOrgWebHook extends base_Entity {
 
 
 
+
 function entities_getEntity(cr) {
     const entityClass = getEntityClass(cr.kind);
     return new entityClass(cr);
@@ -345053,6 +346060,8 @@ function getEntityClass(kind) {
             return EntityGHOrgSettings;
         case 'FirestartrGithubOrganizationVariableSection':
             return EntityGHOrgVarsSection;
+        case 'FirestartrGithubOrganizationSecretSection':
+            return EntityGHOrgSecretSection;
         default:
             throw new Error(`kind ${kind} has no entity associated`);
     }
@@ -346802,6 +347811,7 @@ const provisionImplementations = {
     githuborgwebhooks: process_operation_processOperation,
     githuborganizationsettings: process_operation_processOperation,
     githuborganizationvariablesections: process_operation_processOperation,
+    githuborganizationsecretsections: process_operation_processOperation,
     fsdummiesa: processFirestartrDummies,
     fsdummiesb: processFirestartrDummies,
     fsdummiesc: processFirestartrDummies,
@@ -525620,7 +526630,7 @@ const crsStatusSubcommand = {
 };
 
 ;// CONCATENATED MODULE: ./package.json
-const package_namespaceObject = JSON.parse('{"i8":"2.11.0-snapshot-objects-in-patches"}');
+const package_namespaceObject = JSON.parse('{"i8":"2.11.0-snapshot-orgsettings-nullguard-1"}');
 ;// CONCATENATED MODULE: ../../package.json
 const package_namespaceObject_1 = {"i8":"2.10.0"};
 // EXTERNAL MODULE: ../../node_modules/semver/index.js