@firestartr/cli 2.7.0-snapshot-17 → 2.7.0-snapshot-19

package/build/index.js

@@ -290172,7 +290172,7 @@ async function renderClaim(catalogScope, firestartrScope, claim, patches, previo
                             .map((segment) => encodeURIComponent(segment))
                             .join('/');
                         apiAnnotations['backstage.io/edit-url'] =
-                            `${repoUrl}/blob/${defaultBranch}/${relativePath}`;
+                            `${repoUrl}/blob/${getDefaultBranch()}/${relativePath}`;
                     }
                     const apiChart = new charts.CatalogApiChart(catalogScope, `${chartId}-api-${sanitizedApiName}`, firestartrId, {
                         name: sanitizedApiName,
@@ -298747,16 +298747,16 @@ async function TFCheckRun(cmd, item) {
         checkRun.mdOptionsDetails({
             quotes: 'terraform',
         });
-        checkRun.update('Initiating', 'queued');
+        void checkRun.update('Initiating', 'queued');
         return {
             fnData: (d) => {
-                checkRun.update(d.toString(), 'in_progress');
+                void checkRun.update(d.toString(), 'in_progress');
             },
             fnEnd: () => {
-                checkRun.close('OK', true);
+                void checkRun.close('OK', true);
             },
             fnOnError: (_) => {
-                checkRun.close('KO', false);
+                void checkRun.close('KO', false);
             },
         };
     }
@@ -300635,8 +300635,8 @@ const MODULES = {
     },
     FirestartrGithubRepositorySecretsSection: {
         module: 'git::https://github.com/prefapp/tfm.git//modules/github-repo-secrets-section',
-        // github-repo-secrets-section-v0.1.1
-        ref: '7753571515c6bd7311a7957b4b172d2787f1512d',
+        // github-repo-secrets-section-v0.1.2
+        ref: 'c2e983dc57d8f879fd8ec4df048fbb604e4f04b2',
     },
     FirestartrGithubRepository: {
         module: 'git::https://github.com/prefapp/tfm.git//modules/github-repo',
@@ -300645,8 +300645,8 @@ const MODULES = {
     },
     FirestartrGithubRepositoryFeature: {
         module: 'git::https://github.com/prefapp/tfm.git//modules/github-files-set',
-        // github-files-set-v0.1.0
-        ref: '2c4f39e995d165297550675b594c6b57812b3847',
+        // fix/provision-once-then-untrack
+        ref: 'fix/provision-once-then-untrack',
     },
     FirestartrGithubMembership: {
         module: 'git::https://github.com/prefapp/tfm.git//modules/github-membership',
@@ -300946,10 +300946,14 @@ class EntityGroup extends base_Entity {
     }
 }
 
+// EXTERNAL MODULE: external "crypto"
+var external_crypto_ = __nccwpck_require__(6113);
+var external_crypto_default = /*#__PURE__*/__nccwpck_require__.n(external_crypto_);
 ;// CONCATENATED MODULE: ../gh_provisioner/src/entities/ghrepositorysecretssection/secrets.ts
 
 
 
+
 async function provisionRepositorySecrets(grss, repo) {
     gh_provisioner_src_logger.info(`[gh-provisioner] ${grss.k8sId} provisioning secrets`);
     const sections = [
@@ -300990,14 +300994,21 @@ async function provisionRepositorySecret(grss, section, repoSecretName, secretRe
 }
 async function createEncryptedSecret(grss, secretRef, secretPatcherFunction, section, repoSecretName, repo) {
     gh_provisioner_src_logger.info(`[gh-provisioner] generating encrypted secret ${grss.k8sId}/${section}/${repoSecretName}`);
-    const { key_id, encrypted_value } = await encryptSecret(grss, secretRef, section, repo);
+    const plainSecret = base_Entity.refResolver(secretRef);
+    const plainTextSecret = plainSecret.getOutput(secretRef.key);
+    const plaintextSha256 = external_crypto_default().createHash('sha256')
+        .update(plainTextSecret)
+        .digest('hex');
+    const { key_id, encrypted_value } = await encryptSecret(grss, plainTextSecret, section, repo);
     secretPatcherFunction({
         secretName: repoSecretName,
         repository: repo.getDepName(),
         encryptedValue: encrypted_value,
-        lifecycle: {
-            ignoreChanges: ['encrypted_value'],
-        },
+    });
+    grss.patchData({
+        path: `/config/${section}_sha256/${repoSecretName}`,
+        op: PatchOperations.add,
+        value: plaintextSha256,
     });
 }
 async function createUnencryptedSecret(grss, secretRef, secretPatcherFunction, section, repoSecretName, repo) {
@@ -301010,9 +301021,7 @@ async function createUnencryptedSecret(grss, secretRef, secretPatcherFunction, s
         plaintextValue: plainTextSecret,
     });
 }
-async function encryptSecret(grss, secretRef, section, repo) {
-    const plainSecret = base_Entity.refResolver(secretRef);
-    const plainTextSecret = plainSecret.getOutput(secretRef.key);
+async function encryptSecret(grss, plainTextSecret, section, repo) {
     const v = await grss.runWithGithubProvider(async () => {
         return await github["default"].encryption.encryptRepoSecret(repo.cr.spec.org, repo.getDepName(), section, plainTextSecret);
     });
@@ -301030,6 +301039,9 @@ class EntityGHRepositorySecretsSection extends base_Entity {
                 actions: {},
                 codespaces: {},
                 dependabot: {},
+                actions_sha256: {},
+                codespaces_sha256: {},
+                dependabot_sha256: {},
             },
         });
     }
@@ -301711,27 +301723,83 @@ class EntityGHRepo extends base_Entity {
 ;// CONCATENATED MODULE: ../gh_provisioner/src/entities/ghfeature/helpers/managed_files.ts
 
 
+/**
+ * Migration reimport path for `import-with-reimport` operations.
+ *
+ * Populates `config.files` with ONLY non-user-managed files so the subsequent
+ * `loadAddressesToImport` can generate correct import blocks for them.
+ * Seeds `installed_managed_files` from ALL `userManaged: true` addresses in the
+ * current CR spec so the TFM input is ready for the next regular apply cycle.
+ */
+async function seedForMigrationReiimport(ghFeature) {
+    const cr = ghFeature.cr;
+    const repoInfo = cr.spec.repositoryTarget;
+    // Only non-user-managed files go into TF config during migration reimport.
+    // User-managed files receive no import block (see ADR 0005).
+    for (const file of cr.spec.files) {
+        if (!file.userManaged) {
+            createFileProvision(ghFeature, file);
+        }
+    }
+    // Seed installed_managed_files from ALL userManaged:true addresses in spec.
+    // This ensures the TFM input is populated so the output is computable on the
+    // operator's next regular apply (second cycle of the two-cycle migration).
+    const allUserManagedAddresses = cr.spec.files
+        .filter((f) => f.userManaged)
+        .map((f) => `${f.path}/${f.targetBranch || repoInfo.branch}`);
+    ghFeature.patchData({
+        op: PatchOperations.replace,
+        path: '/installed_managed_files',
+        value: allUserManagedAddresses,
+    });
+}
 async function provisionManagedFiles(ghFeature) {
     const cr = ghFeature.cr;
     const repoInfo = cr.spec.repositoryTarget;
     const repoRef = base_Entity.refResolver(cr.spec.repositoryTarget.ref);
+    // Read the accumulated list of previously provisioned user-managed file addresses
+    // from the entity's output secrets. Defaults to [] on first apply.
+    const selfOutputs = base_Entity.refResolver({ kind: 'self', name: 'outputs' });
+    const rawInstalledFiles = selfOutputs?.getOutput('installed_managed_files');
+    const installedManagedFiles = Array.isArray(rawInstalledFiles)
+        ? rawInstalledFiles
+        : [];
+    const newlyProvisionedAddresses = [];
     for (const file of cr.spec.files) {
+        const branch = file.targetBranch || repoInfo.branch;
+        const address = `${file.path}/${branch}`;
         if (file.userManaged) {
+            if (installedManagedFiles.includes(address)) {
+                // Already provisioned — skip from TF config entirely so Terraform
+                // never overwrites or deletes user edits.
+                continue;
+            }
+            // New user-managed file — provision once. Fetch existing content from
+            // the repo if available so the seed commit preserves the current state.
+            newlyProvisionedAddresses.push(address);
             try {
                 const content = await ghFeature.getFileContentFromProvider(cr.spec.org, `/${cr.spec.org}/${repoRef.getDepName()}/${repoInfo.branch}/${file.path}`);
-                const newContent = Buffer.from(content, 'binary').toString('base64');
-                file.content = newContent;
+                file.content = Buffer.from(content, 'binary').toString('base64');
             }
             catch (e) {
-                gh_provisioner_src_logger.error(`File ${file.path} not found in repo ${repoInfo.ref.name} on branch ${repoInfo.branch}. File content not updated`);
+                gh_provisioner_src_logger.error(`File ${file.path} not found in repo ${repoInfo.ref?.name} on branch ${repoInfo.branch}. File content not updated`);
             }
+            createFileProvision(ghFeature, file);
+        }
+        else {
+            // Non-user-managed — add to TF config normally (Terraform manages content).
+            createFileProvision(ghFeature, file);
         }
     }
-    // now we have everything in place
-    // let's create the provision itself
-    for (const file of cr.spec.files) {
-        createFileProvision(ghFeature, file);
-    }
+    // Write the updated accumulated address list back into the document as a
+    // top-level TFM input. The TFM output will grow this list monotonically
+    // and subtract any files that transition away from userManaged.
+    ghFeature.patchData({
+        op: PatchOperations.replace,
+        path: '/installed_managed_files',
+        value: [...installedManagedFiles, ...newlyProvisionedAddresses],
+    });
+    return { newlyProvisionedAddresses, installedManagedFiles };
 }
 function createFileProvision(ghFeature, file) {
     const cr = ghFeature.cr;
@@ -302005,7 +302073,9 @@ class EntityGHFeature extends base_Entity {
             config: {
                 files: [],
             },
+            installed_managed_files: [],
         });
+        this._newlyProvisionedAddresses = [];
     }
     async loadResources(tfOp) {
         gh_provisioner_src_logger.info(`[gh-provisioner] running ${tfOp} on ${this.k8sId}`);
@@ -302016,9 +302086,22 @@ class EntityGHFeature extends base_Entity {
             value: `${repoRef.cr.spec.org}/${repoRef.getDepName()}`,
         });
         try {
-            await provisionManagedFiles(this);
-            if (tfOp === 'destroy') {
-                await this.keepUntrackedFiles(tfOp);
+            if (tfOp === 'import-with-reimport') {
+                // Migration reimport path: only non-user-managed files go into config;
+                // installed_managed_files is seeded from all userManaged:true addresses.
+                // preApplyStateRm and keepUntrackedFiles are both skipped — the
+                // destroy-state-only step inside runOnTerraform handles legacy state cleanup.
+                await seedForMigrationReiimport(this);
+            }
+            else {
+                const { newlyProvisionedAddresses, installedManagedFiles } = await provisionManagedFiles(this);
+                this._newlyProvisionedAddresses = newlyProvisionedAddresses;
+                if (tfOp === 'apply') {
+                    await this.preApplyStateRm(installedManagedFiles);
+                }
+                if (tfOp === 'destroy') {
+                    await this.keepUntrackedFiles(tfOp);
+                }
             }
             gh_provisioner_src_logger.debug(`[gh-provisioner] ${this.k8sId} loaded its data`);
             this.synthMessage('Synth finished');
@@ -302029,31 +302112,107 @@ class EntityGHFeature extends base_Entity {
             throw `[gh-provisioner] ${this.k8sId} error loading resources: ${err}`;
         }
     }
-    async postProvision(tfOp) { }
-    async loadAddressesToImport() { }
-    async keepUntrackedFiles(tfOp) {
+    async postProvision(tfOp) {
+        if (tfOp !== 'apply' || this._newlyProvisionedAddresses.length === 0) {
+            return;
+        }
+        const addresses = this._newlyProvisionedAddresses.map((addr) => `github_repository_file.user_managed["${addr}"]`);
+        gh_provisioner_src_logger.info(`[gh-provisioner] ${this.k8sId} post-apply state rm for newly provisioned user-managed files: [${addresses.join(', ')}]`);
+        await runOnTerraform(this, 'custom-command', ['state', 'rm'].concat(addresses));
+    }
+    /**
+     * Called by `runOnTerraform` during `import-with-reimport` after
+     * `loadResources('import-with-reimport')` has already seeded `config.files`
+     * with only non-user-managed files.
+     *
+     * Emits one import block per file:
+     *   to:  github_repository_file.managed["<file>/<branch>"]
+     *   id:  <repoName>:<file>:<branch>
+     *
+     * User-managed files are intentionally excluded (see ADR 0005).
+     */
+    async loadAddressesToImport() {
+        const repoRef = base_Entity.refResolver(this.cr.spec.repositoryTarget.ref);
+        const repoName = repoRef.getDepName();
+        for (const file of this.document.config.files) {
+            this.patchImportData({
+                op: PatchOperations.add,
+                path: '/imports/-',
+                value: {
+                    to: `github_repository_file.managed["${file.file}/${file.branch}"]`,
+                    id: `${repoName}:${file.file}:${file.branch}`,
+                },
+            });
+        }
+    }
+    /**
+     * Pre-apply state rm — runs inside loadResources before the main TF operation.
+     *
+     * Fetches the current TF state list, then removes any user-managed resource
+     * addresses that are in installedManagedFiles AND are not currently
+     * transitioning from userManaged:true to userManaged:false. This prevents
+     * Terraform from planning a destroy for files that were dropped from the
+     * feature definition or are still under user control from a previous apply.
+     */
+    async preApplyStateRm(installedManagedFiles) {
+        if (installedManagedFiles.length === 0)
+            return;
         try {
-            gh_provisioner_src_logger.debug(`[gh-provisioner] ${this.k8sId} loaded untrack files ${this.k8sId}`);
-            const untrackedFilesListForSynth = [];
-            const untrackedFiles = this.document.config.files
-                .filter((file) => file.userManaged)
-                .map((file) => {
-                // for information
-                untrackedFilesListForSynth.push(file);
-                const address = `${file.file}/${file.branch}`;
-                return 'github_repository_file.user_managed["' + address + '"]';
+            const stateListOutput = await runOnTerraform(this, 'custom-command', [
+                'state',
+                'list',
+            ]);
+            const stateAddresses = parseStateList(stateListOutput);
+            // Files that are transitioning from userManaged:true → false must NOT be
+            // state-rm'd because Terraform needs them in state to manage them going forward.
+            const transitioningToManaged = new Set((this.cr.spec.files ?? [])
+                .filter((f) => !f.userManaged)
+                .map((f) => `${f.path}/${f.targetBranch || this.cr.spec.repositoryTarget.branch}`));
+            const addressesToRemove = stateAddresses.filter((addr) => {
+                const match = addr.match(/^github_repository_file\.user_managed\["(.+)"\]$/);
+                if (!match)
+                    return false;
+                const fileAddress = match[1];
+                return (installedManagedFiles.includes(fileAddress) &&
+                    !transitioningToManaged.has(fileAddress));
             });
-            gh_provisioner_src_logger.info(`[gh-provisioner] ${this.k8sId} keeping the following files [${untrackedFiles.join(',')}]`);
+            if (addressesToRemove.length > 0) {
+                gh_provisioner_src_logger.info(`[gh-provisioner] ${this.k8sId} pre-apply state rm: [${addressesToRemove.join(', ')}]`);
+                await runOnTerraform(this, 'custom-command', ['state', 'rm'].concat(addressesToRemove));
+            }
+        }
+        catch (err) {
+            throw new Error(`[gh-provisioner] ${this.k8sId} pre-apply state rm failed: ${err}`);
+        }
+    }
+    /**
+     * Destroy path — removes user-managed file resources from TF state before
+     * the destroy operation so Terraform does not delete them from GitHub.
+     *
+     * Uses `terraform state list` to discover what is actually in state rather
+     * than reading config.files, making this robust whether the entity was last
+     * provisioned with old or new code.
+     */
+    async keepUntrackedFiles(_tfOp) {
+        try {
+            gh_provisioner_src_logger.debug(`[gh-provisioner] ${this.k8sId} loaded untrack files ${this.k8sId}`);
+            // Propagate session fields from parent if present
+            if (this.parent) {
+                this.sessionId = this.parent.sessionId;
+                this.sessionProjectPath = this.parent.sessionProjectPath;
+                this.__ghProvisionerSessionWorkspaceInitialized =
+                    this.parent.__ghProvisionerSessionWorkspaceInitialized;
+            }
+            const stateListOutput = await runOnTerraform(this, 'custom-command', [
+                'state',
+                'list',
+            ]);
+            const stateAddresses = parseStateList(stateListOutput);
+            const untrackedFiles = stateAddresses.filter((addr) => /^github_repository_file\.user_managed\[".+"\]$/.test(addr));
+            gh_provisioner_src_logger.info(`[gh-provisioner] ${this.k8sId} keeping the following files [${untrackedFiles.join(', ')}]`);
             if (untrackedFiles.length > 0) {
-                // Propagate session fields from parent if present
-                if (this.parent) {
-                    this.sessionId = this.parent.sessionId;
-                    this.sessionProjectPath = this.parent.sessionProjectPath;
-                    this.__ghProvisionerSessionWorkspaceInitialized =
-                        this.parent.__ghProvisionerSessionWorkspaceInitialized;
-                }
                 const operationOutputs = await runOnTerraform(this, 'custom-command', ['state', 'rm'].concat(untrackedFiles));
-                this.synthMessage(`\nkeeping files after feature uninstalled: \n ${untrackedFilesListForSynth.map((f) => f.file + '/' + f.branch).join('\n - ')}`);
+                this.synthMessage(`\nkeeping files after feature uninstalled: \n - ${untrackedFiles.join('\n - ')}`);
                 gh_provisioner_src_logger.debug(`[gh-provisioner] ${this.k8sId} state rm output ${operationOutputs}`);
             }
         }
@@ -302072,6 +302231,14 @@ class EntityGHFeature extends base_Entity {
         return v;
     }
 }
+function parseStateList(output) {
+    if (!output || typeof output !== 'string')
+        return [];
+    return output
+        .split('\n')
+        .map((line) => line.trim())
+        .filter(Boolean);
+}
 
 ;// CONCATENATED MODULE: ../gh_provisioner/src/entities/ghmembership/helpers/index.ts
 
@@ -303364,16 +303531,16 @@ async function GHCheckRun(cmd, item) {
     checkRun.mdOptionsDetails({
         quotes: 'terraform',
     });
-    checkRun.update('Initiating', 'queued');
+    void checkRun.update('Initiating', 'queued');
     return {
         fnData: (d) => {
-            checkRun.update(d.toString(), 'in_progress');
+            void checkRun.update(d.toString(), 'in_progress');
         },
         fnEnd: () => {
-            checkRun.close('OK', true);
+            void checkRun.close('OK', true);
         },
         fnOnError: (err) => {
-            checkRun.close('KO', false);
+            void checkRun.close('KO', false);
         },
     };
 }
@@ -304517,7 +304684,7 @@ const crs_analyzerSubcommand = {
 };
 
 ;// CONCATENATED MODULE: ./package.json
-const package_namespaceObject = JSON.parse('{"i8":"2.7.0-snapshot-17"}');
+const package_namespaceObject = JSON.parse('{"i8":"2.7.0-snapshot-19"}');
 ;// CONCATENATED MODULE: ../../package.json
 const package_namespaceObject_1 = {"i8":"2.6.4"};
 ;// CONCATENATED MODULE: ./src/subcommands/index.ts

package/build/packages/gh_provisioner/src/entities/ghfeature/helpers/index.d.ts

@@ -1 +1,2 @@
-export { provisionManagedFiles } from './managed_files';
+export { provisionManagedFiles, seedForMigrationReiimport, } from './managed_files';
+export type { ManagedFilesResult } from './managed_files';

package/build/packages/gh_provisioner/src/entities/ghfeature/helpers/managed_files.d.ts

@@ -1,2 +1,15 @@
 import { EntityGHFeature } from '../';
-export declare function provisionManagedFiles(ghFeature: EntityGHFeature): Promise<void>;
+export interface ManagedFilesResult {
+    newlyProvisionedAddresses: string[];
+    installedManagedFiles: string[];
+}
+/**
+ * Migration reimport path for `import-with-reimport` operations.
+ *
+ * Populates `config.files` with ONLY non-user-managed files so the subsequent
+ * `loadAddressesToImport` can generate correct import blocks for them.
+ * Seeds `installed_managed_files` from ALL `userManaged: true` addresses in the
+ * current CR spec so the TFM input is ready for the next regular apply cycle.
+ */
+export declare function seedForMigrationReiimport(ghFeature: EntityGHFeature): Promise<void>;
+export declare function provisionManagedFiles(ghFeature: EntityGHFeature): Promise<ManagedFilesResult>;

package/build/packages/gh_provisioner/src/entities/ghfeature/index.d.ts

@@ -1,9 +1,39 @@
 import { Entity } from '../base';
 export declare class EntityGHFeature extends Entity {
+    _newlyProvisionedAddresses: string[];
     constructor(artifact: any);
     loadResources(tfOp: string): Promise<void>;
     postProvision(tfOp: string): Promise<void>;
+    /**
+     * Called by `runOnTerraform` during `import-with-reimport` after
+     * `loadResources('import-with-reimport')` has already seeded `config.files`
+     * with only non-user-managed files.
+     *
+     * Emits one import block per file:
+     *   to:  github_repository_file.managed["<file>/<branch>"]
+     *   id:  <repoName>:<file>:<branch>
+     *
+     * User-managed files are intentionally excluded (see ADR 0005).
+     */
     loadAddressesToImport(): Promise<void>;
-    keepUntrackedFiles(tfOp: string): Promise<void>;
+    /**
+     * Pre-apply state rm — runs inside loadResources before the main TF operation.
+     *
+     * Fetches the current TF state list, then removes any user-managed resource
+     * addresses that are in installedManagedFiles AND are not currently
+     * transitioning from userManaged:true to userManaged:false. This prevents
+     * Terraform from planning a destroy for files that were dropped from the
+     * feature definition or are still under user control from a previous apply.
+     */
+    preApplyStateRm(installedManagedFiles: string[]): Promise<void>;
+    /**
+     * Destroy path — removes user-managed file resources from TF state before
+     * the destroy operation so Terraform does not delete them from GitHub.
+     *
+     * Uses `terraform state list` to discover what is actually in state rather
+     * than reading config.files, making this robust whether the entity was last
+     * provisioned with old or new code.
+     */
+    keepUntrackedFiles(_tfOp: string): Promise<void>;
     getFileContentFromProvider(org: string, url: string): Promise<string>;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@firestartr/cli",
-  "version": "2.7.0-snapshot-17",
+  "version": "2.7.0-snapshot-19",
   "private": false,
   "description": "Commandline tool",
   "main": "build/main.js",