@firestartr/cli 2.8.0-snapshot-variant-cloning-2 → 2.8.0-snapshot-c392b2c

package/build/index.js

@@ -281913,6 +281913,16 @@ async function getRepoInfo(owner, name) {
     const res = await octokit.repos.get({ owner: owner, repo: name });
     return res['data'];
 }
+async function getRepoSecret(owner, repo, secretName) {
+    logger.info(`Getting repo secret ${owner}/${repo}/${secretName}`);
+    const octokit = await getOctokitForOrg(owner);
+    const response = await octokit.rest.actions.getRepoSecret({
+        owner,
+        repo,
+        secret_name: secretName,
+    });
+    return response.data;
+}
 async function repoExists(owner, name) {
     logger.info(`Checking if repo exists: ${owner}/${name}`);
     try {
@@ -282089,6 +282099,7 @@ async function isEmptyRepo(owner, name) {
     uploadFile,
     deleteFile,
     getRepoInfo,
+    getRepoSecret,
     repoExists,
     getPages,
     getBranchProtection,
@@ -283365,6 +283376,15 @@ function createFacade(profileName) {
                 const response = await octokit.rest.repos.get({ owner, repo: name });
                 return response.data;
             },
+            getRepoSecret: async (owner, repo, secretName) => {
+                const octokit = await getOctokitForOrg(owner);
+                const response = await octokit.rest.actions.getRepoSecret({
+                    owner,
+                    repo,
+                    secret_name: secretName,
+                });
+                return response.data;
+            },
             repoExists: async (owner, name) => {
                 try {
                     const octokit = await getOctokitForOrg(owner);
@@ -323642,18 +323662,41 @@ const CLAIM_REF_ANNOTATION = 'firestartr.dev/claim-ref';
 ;// CONCATENATED MODULE: ../cdk8s_renderer/src/renderer/previous-crs-extractor.ts
 
 
+const VARIANT_OF_ANNOTATION = 'firestartr.dev/variant-of';
+function isVariantCR(cr) {
+    return cr.metadata?.annotations?.[VARIANT_OF_ANNOTATION] !== undefined;
+}
 function getPreviousCRfromClaim(claim, previousCRs) {
     const previousCRsKeys = Object.keys(previousCRs);
+    const isVariantClaim = !!claim._parentClaimName;
     for (const previousCRKey of previousCRsKeys) {
         const previousCR = previousCRs[previousCRKey];
         if (isCatalogEntity(previousCR))
             continue;
         if (isExcludedFromPreviousCR(previousCR.kind))
             continue;
-        if (previousCR.metadata.annotations[CLAIM_REF_ANNOTATION] ===
-            `${claim.kind}/${claim.name}`) {
+        const crVariant = isVariantCR(previousCR);
+        if (isVariantClaim && !crVariant)
+            continue;
+        if (!isVariantClaim && crVariant)
+            continue;
+        const crClaimRef = previousCR.metadata.annotations[CLAIM_REF_ANNOTATION];
+        if (crClaimRef === `${claim.kind}/${claim.name}`) {
             return previousCR;
         }
+        // For variant claims, the claim-ref annotation uses the parent claim name
+        // (via _parentClaimName), but claim.name is the composed name.
+        // Match on parent claim-ref plus composed provider name as CR name prefix.
+        if (isVariantClaim &&
+            crClaimRef === `${claim.kind}/${claim._parentClaimName}`) {
+            for (const provider of Object.keys(claim.providers || {})) {
+                const providerName = claim.providers[provider]?.name;
+                if (providerName &&
+                    previousCR.metadata.name.startsWith(providerName + '-')) {
+                    return previousCR;
+                }
+            }
+        }
     }
     return false;
 }
@@ -325136,6 +325179,8 @@ function toJson_FirestartrGithubRepositorySpecBranchProtections(obj) {
         'enforceAdmins': obj.enforceAdmins,
         'requireSignedCommits': obj.requireSignedCommits,
         'requireConversationResolution': obj.requireConversationResolution,
+        'bypassPullRequestAllowances': toJson_FirestartrGithubRepositorySpecBranchProtectionsBypassPullRequestAllowances(obj.bypassPullRequestAllowances),
+        'pushAllowances': toJson_FirestartrGithubRepositorySpecBranchProtectionsPushAllowances(obj.pushAllowances),
     };
     // filter undefined values
     return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
@@ -325331,6 +325376,38 @@ function toJson_FirestartrGithubRepositorySpecVarsActions(obj) {
     // filter undefined values
     return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
 }
+/**
+ * Converts an object of type 'FirestartrGithubRepositorySpecBranchProtectionsBypassPullRequestAllowances' to JSON representation.
+ */
+/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
+function toJson_FirestartrGithubRepositorySpecBranchProtectionsBypassPullRequestAllowances(obj) {
+    if (obj === undefined) {
+        return undefined;
+    }
+    const result = {
+        'apps': obj.apps?.map(y => y),
+        'teams': obj.teams?.map(y => y),
+        'users': obj.users?.map(y => y),
+    };
+    // filter undefined values
+    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
+}
+/**
+ * Converts an object of type 'FirestartrGithubRepositorySpecBranchProtectionsPushAllowances' to JSON representation.
+ */
+/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
+function toJson_FirestartrGithubRepositorySpecBranchProtectionsPushAllowances(obj) {
+    if (obj === undefined) {
+        return undefined;
+    }
+    const result = {
+        'apps': obj.apps?.map(y => y),
+        'teams': obj.teams?.map(y => y),
+        'users': obj.users?.map(y => y),
+    };
+    // filter undefined values
+    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
+}
 /**
  * Converts an object of type 'FirestartrGithubRepositorySpecWriteConnectionSecretToRefOutputs' to JSON representation.
  */
@@ -337607,6 +337684,15 @@ const TF_CACHES_PATH = '/tmp/tfcaches';
 function generateSessionId() {
     return Math.random().toString(36).substring(2, 6).padEnd(4, '0');
 }
+async function tearUpSessionWorkspace(item, deps, sessionId, failureContext) {
+    try {
+        const context = buildProvisionerContext(item, deps, sessionId);
+        await runTerraformProvisioner(context, 'tear-up-project');
+    }
+    catch (error) {
+        operator_src_logger.warn(`Workspace cleanup failed${failureContext ? ` after ${failureContext}` : ''}: ${error}`);
+    }
+}
 function processOperation(item, op, handler) {
     try {
         const policy = getPolicy(item, 'firestartr.dev/policy');
@@ -337782,18 +337868,7 @@ async function* doPlanJSONFormat(item, op, handler, setResult = function (_r) {
         // Tear up the session workspace only if the project was created
         // (Terraform execution started), regardless of its success or failure.
         if (terraformExecutionStarted) {
-            try {
-                const tearContext = buildProvisionerContext(item, deps, sessionId);
-                await runTerraformProvisioner(tearContext, 'tear-up-project');
-            }
-            catch (tearErr) {
-                if (error) {
-                    operator_src_logger.warn(`Workspace cleanup failed after plan error: ${tearErr}`);
-                }
-                else {
-                    operator_src_logger.warn(`Workspace cleanup failed: ${tearErr}`);
-                }
-            }
+            await tearUpSessionWorkspace(item, deps, sessionId, error ? 'plan error' : undefined);
         }
         if (error) {
             if (op === OperationType.SYNC || op === OperationType.RETRY_SYNC) {
@@ -338112,18 +338187,7 @@ async function* process_operation_markedToDeletion(item, op, handler) {
         // Tear up the session workspace only if the project was created
         // (Terraform execution started), regardless of its success or failure.
         if (terraformExecutionStarted) {
-            try {
-                const tearContext = buildProvisionerContext(item, deps, sessionId);
-                await runTerraformProvisioner(tearContext, 'tear-up-project');
-            }
-            catch (tearErr) {
-                if (error) {
-                    operator_src_logger.warn(`Workspace cleanup failed after destroy error: ${tearErr}`);
-                }
-                else {
-                    operator_src_logger.warn(`Workspace cleanup failed: ${tearErr}`);
-                }
-            }
+            await tearUpSessionWorkspace(item, deps, sessionId, error ? 'destroy error' : undefined);
         }
         if (error) {
             yield {
@@ -338283,18 +338347,7 @@ async function* doApply(item, op, handler) {
         // Tear up the session workspace only if the project was created
         // (Terraform execution started), regardless of its success or failure.
         if (terraformExecutionStarted) {
-            try {
-                const tearContext = buildProvisionerContext(item, deps, sessionId);
-                await runTerraformProvisioner(tearContext, 'tear-up-project');
-            }
-            catch (tearErr) {
-                if (error) {
-                    operator_src_logger.warn(`Workspace cleanup failed after provisioning error: ${tearErr}`);
-                }
-                else {
-                    operator_src_logger.warn(`Workspace cleanup failed: ${tearErr}`);
-                }
-            }
+            await tearUpSessionWorkspace(item, deps, sessionId, error ? 'provisioning error' : undefined);
         }
         if (error) {
             yield {
@@ -339475,8 +339528,8 @@ const MODULES = {
     },
     FirestartrGithubRepository: {
         module: 'git::https://github.com/prefapp/tfm.git//modules/github-repo',
-        // github-repo-v0.7.0
-        ref: 'd919ffbff4349c453f75a3b7246b8306a45b12e3',
+        // github-repo-v0.8.0
+        ref: 'c51e2fe8c4f99aa34577b6a5f721a382ff217771',
     },
     FirestartrGithubRepositoryFeature: {
         module: 'git::https://github.com/prefapp/tfm.git//modules/github-files-set',
@@ -339495,8 +339548,8 @@ const MODULES = {
     },
     FirestartrGithubOrganizationSettings: {
         module: 'git::https://github.com/prefapp/tfm.git//modules/github-org-settings',
-        // org settings module merged to main (prefapp/tfm#1253)
-        ref: 'cf2e2ae487b6cc3f7b208f46a92f5b5f97f8fef2',
+        // github-org-settings-v0.1.0
+        ref: 'c30c5dfdaddf2bca9e966a726d45970c98576e9e',
     },
 };
 function getFirestartrDefaultTFM(kind) {
@@ -340225,9 +340278,7 @@ function provisionBranchProtections(entity) {
         return;
     }
     for (const protection of protections) {
-        // This shape should match the compatible Terraform contract
         const output = {};
-        // Only emit legacy fields in allowed order
         output.branch = protection.branch;
         output.statusChecks =
             'statusChecks' in protection ? (protection.statusChecks ?? []) : [];
@@ -340243,7 +340294,20 @@ function provisionBranchProtections(entity) {
         if ('requireConversationResolution' in protection)
             output.requireConversationResolution =
                 protection.requireConversationResolution;
-        // Only keep fields that are present, including explicit false/empty
+        if (protection.bypassPullRequestAllowances) {
+            output.bypassPullRequestAllowances = {
+                apps: protection.bypassPullRequestAllowances.apps || [],
+                teams: protection.bypassPullRequestAllowances.teams || [],
+                users: protection.bypassPullRequestAllowances.users || [],
+            };
+        }
+        if (protection.pushAllowances) {
+            output.pushAllowances = {
+                apps: protection.pushAllowances.apps || [],
+                teams: protection.pushAllowances.teams || [],
+                users: protection.pushAllowances.users || [],
+            };
+        }
         gh_provisioner_src_logger.debug(`[gh-provisioner] Adding branch protection config: ${JSON.stringify(output)}`);
         entity.patchData({
             op: PatchOperations.add,
@@ -340394,7 +340458,6 @@ class EntityGHRepo extends base_Entity {
             await provisionDefaultBranch(this);
             await provisionCodeowners(this);
             await provisionVariables(this);
-            // Add branch protections to config if defined
             provisionBranchProtections(this);
             await provisionOIDCSubjectClaim(this);
             await provisionPermissions(this);
@@ -521919,7 +521982,7 @@ const crsStatusSubcommand = {
 };
 
 ;// CONCATENATED MODULE: ./package.json
-const package_namespaceObject = JSON.parse('{"i8":"2.8.0-snapshot-variant-cloning-2"}');
+const package_namespaceObject = JSON.parse('{"i8":"2.8.0-snapshot-c392b2c"}');
 ;// CONCATENATED MODULE: ../../package.json
 const package_namespaceObject_1 = {"i8":"2.7.1"};
 ;// CONCATENATED MODULE: ./src/subcommands/index.ts

package/build/packages/cdk8s_renderer/imports/firestartr.dev.d.ts

@@ -1530,6 +1530,14 @@ export interface FirestartrGithubRepositorySpecBranchProtections {
      * @schema FirestartrGithubRepositorySpecBranchProtections#requireConversationResolution
      */
     readonly requireConversationResolution?: boolean;
+    /**
+     * @schema FirestartrGithubRepositorySpecBranchProtections#bypassPullRequestAllowances
+     */
+    readonly bypassPullRequestAllowances?: FirestartrGithubRepositorySpecBranchProtectionsBypassPullRequestAllowances;
+    /**
+     * @schema FirestartrGithubRepositorySpecBranchProtections#pushAllowances
+     */
+    readonly pushAllowances?: FirestartrGithubRepositorySpecBranchProtectionsPushAllowances;
 }
 /**
  * Converts an object of type 'FirestartrGithubRepositorySpecBranchProtections' to JSON representation.
@@ -1760,6 +1768,48 @@ export interface FirestartrGithubRepositorySpecVarsActions {
  * Converts an object of type 'FirestartrGithubRepositorySpecVarsActions' to JSON representation.
  */
 export declare function toJson_FirestartrGithubRepositorySpecVarsActions(obj: FirestartrGithubRepositorySpecVarsActions | undefined): Record<string, any> | undefined;
+/**
+ * @schema FirestartrGithubRepositorySpecBranchProtectionsBypassPullRequestAllowances
+ */
+export interface FirestartrGithubRepositorySpecBranchProtectionsBypassPullRequestAllowances {
+    /**
+     * @schema FirestartrGithubRepositorySpecBranchProtectionsBypassPullRequestAllowances#apps
+     */
+    readonly apps?: string[];
+    /**
+     * @schema FirestartrGithubRepositorySpecBranchProtectionsBypassPullRequestAllowances#teams
+     */
+    readonly teams?: string[];
+    /**
+     * @schema FirestartrGithubRepositorySpecBranchProtectionsBypassPullRequestAllowances#users
+     */
+    readonly users?: string[];
+}
+/**
+ * Converts an object of type 'FirestartrGithubRepositorySpecBranchProtectionsBypassPullRequestAllowances' to JSON representation.
+ */
+export declare function toJson_FirestartrGithubRepositorySpecBranchProtectionsBypassPullRequestAllowances(obj: FirestartrGithubRepositorySpecBranchProtectionsBypassPullRequestAllowances | undefined): Record<string, any> | undefined;
+/**
+ * @schema FirestartrGithubRepositorySpecBranchProtectionsPushAllowances
+ */
+export interface FirestartrGithubRepositorySpecBranchProtectionsPushAllowances {
+    /**
+     * @schema FirestartrGithubRepositorySpecBranchProtectionsPushAllowances#apps
+     */
+    readonly apps?: string[];
+    /**
+     * @schema FirestartrGithubRepositorySpecBranchProtectionsPushAllowances#teams
+     */
+    readonly teams?: string[];
+    /**
+     * @schema FirestartrGithubRepositorySpecBranchProtectionsPushAllowances#users
+     */
+    readonly users?: string[];
+}
+/**
+ * Converts an object of type 'FirestartrGithubRepositorySpecBranchProtectionsPushAllowances' to JSON representation.
+ */
+export declare function toJson_FirestartrGithubRepositorySpecBranchProtectionsPushAllowances(obj: FirestartrGithubRepositorySpecBranchProtectionsPushAllowances | undefined): Record<string, any> | undefined;
 /**
  * @schema FirestartrGithubRepositorySpecWriteConnectionSecretToRefOutputs
  */

package/build/packages/github/index.d.ts

@@ -26,6 +26,7 @@ declare const _default: {
         uploadFile: typeof import("./src/repository").uploadFile;
         deleteFile: typeof import("./src/repository").deleteFile;
         getRepoInfo: typeof import("./src/repository").getRepoInfo;
+        getRepoSecret: typeof import("./src/repository").getRepoSecret;
         repoExists: typeof import("./src/repository").repoExists;
         getPages: typeof import("./src/repository").getPages;
         getBranchProtection: typeof import("./src/repository").getBranchProtection;

package/build/packages/github/src/repository.d.ts

@@ -800,6 +800,11 @@ export declare function getRepoInfo(owner: string, name: string): Promise<{
         [key: string]: unknown;
     };
 }>;
+export declare function getRepoSecret(owner: string, repo: string, secretName: string): Promise<{
+    name: string;
+    created_at: string;
+    updated_at: string;
+}>;
 export declare function repoExists(owner: string, name: string): Promise<boolean>;
 export declare function getPages(owner: string, name: string): Promise<{
     url: string;
@@ -1336,6 +1341,7 @@ declare const _default: {
     uploadFile: typeof uploadFile;
     deleteFile: typeof deleteFile;
     getRepoInfo: typeof getRepoInfo;
+    getRepoSecret: typeof getRepoSecret;
     repoExists: typeof repoExists;
     getPages: typeof getPages;
     getBranchProtection: typeof getBranchProtection;

package/build/packages/github/src/with_profile.d.ts

@@ -824,6 +824,11 @@ export declare function withProfile(profileName: string): {
                 [key: string]: unknown;
             };
         }>;
+        getRepoSecret: (owner: string, repo: string, secretName: string) => Promise<{
+            name: string;
+            created_at: string;
+            updated_at: string;
+        }>;
         repoExists: (owner: string, name: string) => Promise<boolean>;
     };
     team: {

package/build/packages/operator/src/tfworkspaces/process-operation.d.ts

@@ -1,5 +1,4 @@
 import { OperationType } from '../informer';
-export declare function generateSessionId(): string;
 export declare function processOperation(item: any, op: OperationType, handler: any): AsyncGenerator<{
     item: any;
     reason: OperationType;
@@ -28,19 +27,6 @@ export declare function sync(item: any, op: OperationType, handler: any, syncPol
     status: string;
     message: any;
 }, void, unknown>;
-/**
- *
- * @param {any} item - CR to be applied
- * @param op - Operation type
- * @param handler -
- */
-export declare function doApply(item: any, op: OperationType, handler: any): AsyncGenerator<{
-    item: any;
-    reason: OperationType;
-    type: string;
-    status: string;
-    message: string;
-}, void, unknown>;
 /**
  * @description Adapts the CR to the format expected by the terraform provisioner
  * @param item  - CR to be applied

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@firestartr/cli",
-  "version": "2.8.0-snapshot-variant-cloning-2",
+  "version": "2.8.0-snapshot-c392b2c",
   "private": false,
   "description": "Commandline tool",
   "main": "build/main.js",