@firestartr/cli 2.9.0-snapshot-01 → 2.9.0-snapshot-org-variables-section-1

package/build/index.js

@@ -282079,8 +282079,34 @@ async function getRepoIssuesLabels(owner, repo) {
         description: label.description || '',
         color: label.color,
     }));
+    logger.info(`Got ${metadataLabels.length} labels for ${owner}/${repo}`);
     return metadataLabels;
 }
+async function createRepoLabel(owner, repo, name, color, description) {
+    logger.info(`Creating label '${name}' in ${owner}/${repo}`);
+    const octokit = await getOctokitForOrg(owner);
+    const res = await octokit.issues.createLabel({
+        owner,
+        repo,
+        name,
+        color,
+        description,
+    });
+    return res.data;
+}
+async function updateRepoLabel(owner, repo, name, color, description) {
+    logger.info(`Updating label '${name}' in ${owner}/${repo} color=${color} description=${description}`);
+    const octokit = await getOctokitForOrg(owner);
+    const res = await octokit.issues.updateLabel({
+        owner,
+        repo,
+        name,
+        color,
+        description,
+    });
+    logger.info(`Updated label '${name}' in ${owner}/${repo} — GitHub response: color=${res.data.color} description=${res.data.description}`);
+    return res.data;
+}
 async function isEmptyRepo(owner, name) {
     logger.info(`Checking if repo is empty: ${owner}/${name}`);
     const octokit = await getOctokitForOrg(owner);
@@ -282109,6 +282135,8 @@ async function isEmptyRepo(owner, name) {
     addStatusCheck,
     addCommitStatus,
     getRepoIssuesLabels,
+    createRepoLabel,
+    updateRepoLabel,
     isEmptyRepo,
 });
 
@@ -316730,9 +316758,12 @@ class UUIDInitializer extends InitializerPatches {
                 },
                 apply(cr) {
                     const ctx = helperCTX(this);
-                    const uuid = previousCR?.spec?.firestartr?.tfStateKey ||
-                        claim.providers?.[ctx.provider]?.tfStateKey ||
-                        (0,wrapper.v4)();
+                    const reusePrevious = previousCR && previousCR.kind === ctx.kind;
+                    const uuid = reusePrevious
+                        ? previousCR?.spec?.firestartr?.tfStateKey ||
+                            claim.providers?.[ctx.provider]?.tfStateKey ||
+                            (0,wrapper.v4)()
+                        : claim.providers?.[ctx.provider]?.tfStateKey || (0,wrapper.v4)();
                     if (!cr.spec)
                         cr.spec = {};
                     if (!cr.spec.firestartr)
@@ -320395,6 +320426,49 @@ const organizationSettingsProperties = {
     secret_scanning_push_protection_enabled_for_new_repositories: {
         type: 'boolean',
     },
+    actions_variables: {
+        type: 'array',
+        items: {
+            type: 'object',
+            properties: {
+                name: {
+                    type: 'string',
+                    pattern: '^[A-Za-z0-9_]+$',
+                },
+                value: {
+                    type: 'string',
+                },
+                visibility: {
+                    type: 'string',
+                    enum: ['all', 'private', 'selected'],
+                },
+                selected_repositories: {
+                    type: 'array',
+                    items: {
+                        $ref: 'firestartr.dev://common/FirestartrComponentRef',
+                    },
+                },
+            },
+            required: ['name', 'value', 'visibility'],
+            additionalProperties: false,
+            allOf: [
+                {
+                    if: {
+                        properties: {
+                            visibility: { const: 'selected' },
+                        },
+                        required: ['visibility'],
+                    },
+                    then: {},
+                    else: {
+                        properties: {
+                            selected_repositories: { type: 'array', maxItems: 0 },
+                        },
+                    },
+                },
+            ],
+        },
+    },
 };
 /* harmony default export */ const github_orgsettings_schema = ({
     $schema: SCHEMA,
@@ -323746,7 +323820,7 @@ const VARIANT_OF_ANNOTATION = 'firestartr.dev/variant-of';
 function isVariantCR(cr) {
     return cr.metadata?.annotations?.[VARIANT_OF_ANNOTATION] !== undefined;
 }
-function getPreviousCRfromClaim(claim, previousCRs) {
+function getPreviousCRfromClaim(claim, previousCRs, expectedKind) {
     const previousCRsKeys = Object.keys(previousCRs);
     const isVariantClaim = !!claim._parentClaimName;
     for (const previousCRKey of previousCRsKeys) {
@@ -323755,6 +323829,8 @@ function getPreviousCRfromClaim(claim, previousCRs) {
             continue;
         if (isExcludedFromPreviousCR(previousCR.kind))
             continue;
+        if (expectedKind && previousCR.kind !== expectedKind)
+            continue;
         const crVariant = isVariantCR(previousCR);
         if (isVariantClaim && !crVariant)
             continue;
@@ -324769,6 +324845,254 @@ var FirestartrGithubOrganizationSettingsSpecContextProviderRefKind;
     /** FirestartrProviderConfig */
     FirestartrGithubOrganizationSettingsSpecContextProviderRefKind["FIRESTARTR_PROVIDER_CONFIG"] = "FirestartrProviderConfig";
 })(FirestartrGithubOrganizationSettingsSpecContextProviderRefKind || (FirestartrGithubOrganizationSettingsSpecContextProviderRefKind = {}));
+/**
+ * A resource to handle GitHub Organization Actions Variables.
+ *
+ * @schema FirestartrGithubOrganizationVariableSection
+ */
+class FirestartrGithubOrganizationVariableSection extends lib.ApiObject {
+    /**
+     * Renders a Kubernetes manifest for "FirestartrGithubOrganizationVariableSection".
+     *
+     * This can be used to inline resource manifests inside other objects (e.g. as templates).
+     *
+     * @param props initialization props
+     */
+    static manifest(props) {
+        return {
+            ...FirestartrGithubOrganizationVariableSection.GVK,
+            ...toJson_FirestartrGithubOrganizationVariableSectionProps(props),
+        };
+    }
+    /**
+     * Defines a "FirestartrGithubOrganizationVariableSection" API object
+     * @param scope the scope in which to define this object
+     * @param id a scope-local name for the object
+     * @param props initialization props
+     */
+    constructor(scope, id, props) {
+        super(scope, id, {
+            ...FirestartrGithubOrganizationVariableSection.GVK,
+            ...props,
+        });
+    }
+    /**
+     * Renders the object to Kubernetes JSON.
+     */
+    toJson() {
+        const resolved = super.toJson();
+        return {
+            ...FirestartrGithubOrganizationVariableSection.GVK,
+            ...toJson_FirestartrGithubOrganizationVariableSectionProps(resolved),
+        };
+    }
+}
+/**
+ * Returns the apiVersion and kind for "FirestartrGithubOrganizationVariableSection"
+ */
+FirestartrGithubOrganizationVariableSection.GVK = {
+    apiVersion: 'firestartr.dev/v1',
+    kind: 'FirestartrGithubOrganizationVariableSection',
+};
+
+/**
+ * Converts an object of type 'FirestartrGithubOrganizationVariableSectionProps' to JSON representation.
+ */
+/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
+function toJson_FirestartrGithubOrganizationVariableSectionProps(obj) {
+    if (obj === undefined) {
+        return undefined;
+    }
+    const result = {
+        'metadata': obj.metadata,
+        'spec': toJson_FirestartrGithubOrganizationVariableSectionSpec(obj.spec),
+    };
+    // filter undefined values
+    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
+}
+/**
+ * Converts an object of type 'FirestartrGithubOrganizationVariableSectionSpec' to JSON representation.
+ */
+/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
+function toJson_FirestartrGithubOrganizationVariableSectionSpec(obj) {
+    if (obj === undefined) {
+        return undefined;
+    }
+    const result = {
+        'org': obj.org,
+        'actionsVariables': obj.actionsVariables?.map(y => toJson_FirestartrGithubOrganizationVariableSectionSpecActionsVariables(y)),
+        'context': toJson_FirestartrGithubOrganizationVariableSectionSpecContext(obj.context),
+        'firestartr': toJson_FirestartrGithubOrganizationVariableSectionSpecFirestartr(obj.firestartr),
+        'writeConnectionSecretToRef': toJson_FirestartrGithubOrganizationVariableSectionSpecWriteConnectionSecretToRef(obj.writeConnectionSecretToRef),
+    };
+    // filter undefined values
+    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
+}
+/**
+ * Converts an object of type 'FirestartrGithubOrganizationVariableSectionSpecActionsVariables' to JSON representation.
+ */
+/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
+function toJson_FirestartrGithubOrganizationVariableSectionSpecActionsVariables(obj) {
+    if (obj === undefined) {
+        return undefined;
+    }
+    const result = {
+        'name': obj.name,
+        'value': obj.value,
+        'visibility': obj.visibility,
+        'selectedRepositories': obj.selectedRepositories?.map(y => y),
+    };
+    // filter undefined values
+    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
+}
+/**
+ * Converts an object of type 'FirestartrGithubOrganizationVariableSectionSpecContext' to JSON representation.
+ */
+/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
+function toJson_FirestartrGithubOrganizationVariableSectionSpecContext(obj) {
+    if (obj === undefined) {
+        return undefined;
+    }
+    const result = {
+        'backend': toJson_FirestartrGithubOrganizationVariableSectionSpecContextBackend(obj.backend),
+        'provider': toJson_FirestartrGithubOrganizationVariableSectionSpecContextProvider(obj.provider),
+    };
+    // filter undefined values
+    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
+}
+/**
+ * Converts an object of type 'FirestartrGithubOrganizationVariableSectionSpecFirestartr' to JSON representation.
+ */
+/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
+function toJson_FirestartrGithubOrganizationVariableSectionSpecFirestartr(obj) {
+    if (obj === undefined) {
+        return undefined;
+    }
+    const result = {
+        'tfStateKey': obj.tfStateKey,
+    };
+    // filter undefined values
+    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
+}
+/**
+ * Converts an object of type 'FirestartrGithubOrganizationVariableSectionSpecWriteConnectionSecretToRef' to JSON representation.
+ */
+/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
+function toJson_FirestartrGithubOrganizationVariableSectionSpecWriteConnectionSecretToRef(obj) {
+    if (obj === undefined) {
+        return undefined;
+    }
+    const result = {
+        'name': obj.name,
+        'outputs': obj.outputs?.map(y => toJson_FirestartrGithubOrganizationVariableSectionSpecWriteConnectionSecretToRefOutputs(y)),
+    };
+    // filter undefined values
+    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
+}
+/* eslint-enable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
+/**
+ * Visibility of the variable
+ *
+ * @schema FirestartrGithubOrganizationVariableSectionSpecActionsVariablesVisibility
+ */
+var FirestartrGithubOrganizationVariableSectionSpecActionsVariablesVisibility;
+(function (FirestartrGithubOrganizationVariableSectionSpecActionsVariablesVisibility) {
+    /** all */
+    FirestartrGithubOrganizationVariableSectionSpecActionsVariablesVisibility["ALL"] = "all";
+    /** private */
+    FirestartrGithubOrganizationVariableSectionSpecActionsVariablesVisibility["PRIVATE"] = "private";
+    /** selected */
+    FirestartrGithubOrganizationVariableSectionSpecActionsVariablesVisibility["SELECTED"] = "selected";
+})(FirestartrGithubOrganizationVariableSectionSpecActionsVariablesVisibility || (FirestartrGithubOrganizationVariableSectionSpecActionsVariablesVisibility = {}));
+/**
+ * Converts an object of type 'FirestartrGithubOrganizationVariableSectionSpecContextBackend' to JSON representation.
+ */
+/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
+function toJson_FirestartrGithubOrganizationVariableSectionSpecContextBackend(obj) {
+    if (obj === undefined) {
+        return undefined;
+    }
+    const result = {
+        'ref': toJson_FirestartrGithubOrganizationVariableSectionSpecContextBackendRef(obj.ref),
+    };
+    // filter undefined values
+    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
+}
+/**
+ * Converts an object of type 'FirestartrGithubOrganizationVariableSectionSpecContextProvider' to JSON representation.
+ */
+/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
+function toJson_FirestartrGithubOrganizationVariableSectionSpecContextProvider(obj) {
+    if (obj === undefined) {
+        return undefined;
+    }
+    const result = {
+        'ref': toJson_FirestartrGithubOrganizationVariableSectionSpecContextProviderRef(obj.ref),
+    };
+    // filter undefined values
+    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
+}
+/**
+ * Converts an object of type 'FirestartrGithubOrganizationVariableSectionSpecWriteConnectionSecretToRefOutputs' to JSON representation.
+ */
+/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
+function toJson_FirestartrGithubOrganizationVariableSectionSpecWriteConnectionSecretToRefOutputs(obj) {
+    if (obj === undefined) {
+        return undefined;
+    }
+    const result = {
+        'key': obj.key,
+    };
+    // filter undefined values
+    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
+}
+/**
+ * Converts an object of type 'FirestartrGithubOrganizationVariableSectionSpecContextBackendRef' to JSON representation.
+ */
+/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
+function toJson_FirestartrGithubOrganizationVariableSectionSpecContextBackendRef(obj) {
+    if (obj === undefined) {
+        return undefined;
+    }
+    const result = {
+        'kind': obj.kind,
+        'name': obj.name,
+    };
+    // filter undefined values
+    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
+}
+/**
+ * Converts an object of type 'FirestartrGithubOrganizationVariableSectionSpecContextProviderRef' to JSON representation.
+ */
+/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
+function toJson_FirestartrGithubOrganizationVariableSectionSpecContextProviderRef(obj) {
+    if (obj === undefined) {
+        return undefined;
+    }
+    const result = {
+        'kind': obj.kind,
+        'name': obj.name,
+    };
+    // filter undefined values
+    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
+}
+/* eslint-enable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
+/**
+ * @schema FirestartrGithubOrganizationVariableSectionSpecContextBackendRefKind
+ */
+var FirestartrGithubOrganizationVariableSectionSpecContextBackendRefKind;
+(function (FirestartrGithubOrganizationVariableSectionSpecContextBackendRefKind) {
+    /** FirestartrProviderConfig */
+    FirestartrGithubOrganizationVariableSectionSpecContextBackendRefKind["FIRESTARTR_PROVIDER_CONFIG"] = "FirestartrProviderConfig";
+})(FirestartrGithubOrganizationVariableSectionSpecContextBackendRefKind || (FirestartrGithubOrganizationVariableSectionSpecContextBackendRefKind = {}));
+/**
+ * @schema FirestartrGithubOrganizationVariableSectionSpecContextProviderRefKind
+ */
+var FirestartrGithubOrganizationVariableSectionSpecContextProviderRefKind;
+(function (FirestartrGithubOrganizationVariableSectionSpecContextProviderRefKind) {
+    /** FirestartrProviderConfig */
+    FirestartrGithubOrganizationVariableSectionSpecContextProviderRefKind["FIRESTARTR_PROVIDER_CONFIG"] = "FirestartrProviderConfig";
+})(FirestartrGithubOrganizationVariableSectionSpecContextProviderRefKind || (FirestartrGithubOrganizationVariableSectionSpecContextProviderRefKind = {}));
 /**
  * A resource to handle GitHub Organization Webhooks
  *
@@ -327618,6 +327942,65 @@ class GithubOrgSettingsChart extends BaseGithubChart {
     }
 }
 
+;// CONCATENATED MODULE: ../cdk8s_renderer/src/charts/github/orgVariableSectionChart.ts
+
+
+
+class GithubOrgVariableSectionChart extends BaseGithubChart {
+    template() {
+        const claim = this.get('claim');
+        const firestartrId = this.get('firestartrId');
+        const githubProvider = claim.providers.github;
+        const actionsVariables = (githubProvider.actions_variables || []).map((v) => {
+            const entry = {
+                name: v.name,
+                value: v.value,
+                visibility: v.visibility,
+            };
+            if (v.selected_repositories && v.selected_repositories.length > 0) {
+                entry.selectedRepositories = v.selected_repositories.map((ref) => {
+                    const match = ref.match(/^component:(.+)$/);
+                    if (!match) {
+                        throw new ChartRenderError('OrgSettingsClaim', claim.name, `Invalid component ref "${ref}" in selected_repositories. Expected format: component:<name>`);
+                    }
+                    const componentName = match[1];
+                    const resolvedCr = this.refResolver('ComponentClaim', componentName);
+                    const org = resolvedCr?.spec?.org;
+                    const repoName = resolvedCr?.metadata?.annotations?.['firestartr.dev/external-name'] || resolvedCr?.metadata?.name?.replace(/-[0-9a-f-]{36}$/, '');
+                    if (!org || !repoName) {
+                        throw new ChartRenderError('OrgSettingsClaim', claim.name, `Referenced component "${componentName}" has no GitHub provider configured`);
+                    }
+                    return `${org}/${repoName}`;
+                });
+            }
+            return entry;
+        });
+        const template = {
+            metadata: {
+                name: githubProvider.name,
+            },
+            spec: {
+                org: githubProvider.org,
+                actionsVariables,
+                firestartr: {
+                    tfStateKey: firestartrId,
+                },
+                writeConnectionSecretToRef: {
+                    name: `firestartrgithuborganizationvariablesection-${githubProvider.name}-outputs`.toLowerCase(),
+                    outputs: [{ key: 'managed_variables' }, { key: 'variable_ids' }],
+                },
+            },
+        };
+        return JSON.parse(JSON.stringify(template));
+    }
+    gvk() {
+        return FirestartrGithubOrganizationVariableSection.GVK;
+    }
+    instanceApiObject(template) {
+        return new FirestartrGithubOrganizationVariableSection(this, template.metadata.name, template);
+    }
+}
+
 ;// CONCATENATED MODULE: ../cdk8s_renderer/src/charts/github/index.ts
 
 
@@ -327625,6 +328008,7 @@ class GithubOrgSettingsChart extends BaseGithubChart {
 
 
 
+
 ;// CONCATENATED MODULE: ../cdk8s_renderer/src/charts/catalog/base.ts
 
 class BaseCatalogChart extends BaseChart {
@@ -328372,6 +328756,7 @@ class SecretsChart extends BaseSecretsChart {
     SecretsChart: SecretsChart,
     GithubOrgWebhookChart: GithubOrgWebhookChart,
     GithubOrgSettingsChart: GithubOrgSettingsChart,
+    GithubOrgVariableSectionChart: GithubOrgVariableSectionChart,
 });
 
 ;// CONCATENATED MODULE: ../cdk8s_renderer/src/renderer/claims-render.ts
@@ -328416,7 +328801,10 @@ async function renderClaims(catalogScope, firestartrScope, data) {
             if (configuredProvider !== AllowedProviders.all.toString()) {
                 providers = providers.filter((provider) => provider === configuredProvider);
             }
-            const previousCR = getPreviousCRfromClaim(claim, crs);
+            const expectedKind = claim.kind === 'OrgSettingsClaim'
+                ? 'FirestartrGithubOrganizationSettings'
+                : undefined;
+            const previousCR = getPreviousCRfromClaim(claim, crs, expectedKind);
             const patches = await extractPatches(renderClaims[claimKey], previousCR);
             if (!previousCR) {
                 logger.debug(`No CR found for claim ${claimKey}, it will be rendered from scratch`);
@@ -328599,6 +328987,19 @@ async function renderClaim(catalogScope, firestartrScope, claim, patches, previo
         case 'OrgSettingsClaim':
             if (loadGithub) {
                 firestartrEntity = new charts.GithubOrgSettingsChart(firestartrScope, `github-${chartId}`, firestartrId, claim, renderPatches);
+                const variableSectionFirestartrId = firestartrId
+                    ? `${firestartrId}-variables`
+                    : null;
+                const variableSectionChart = new charts.GithubOrgVariableSectionChart(firestartrScope, `github-variables-${chartId}`, variableSectionFirestartrId, claim, renderPatches);
+                await variableSectionChart.render();
+                const variableSectionObject = await variableSectionChart.postRenderer(postPatches);
+                extraCharts.push({
+                    claim: {
+                        kind: claim.kind,
+                        name: `${claim.name}-variable-section`,
+                    },
+                    chart: variableSectionObject,
+                });
             }
             break;
         default:
@@ -328763,6 +329164,58 @@ function validateGithubOrgSettingsSingleton(crs) {
     }
 }
 
+;// CONCATENATED MODULE: ../cdk8s_renderer/src/validations/githubOrgVariableSection.ts
+const GITHUB_ORG_VARIABLE_SECTION_KIND = 'FirestartrGithubOrganizationVariableSection';
+const githubOrgVariableSection_FIRESTARTR_CLAIM_REF_ANNOTATION = 'firestartr.dev/claim-ref';
+const githubOrgVariableSection_CLAIM_REF_LABEL = 'claim-ref';
+function githubOrgVariableSection_formatResourceRef(name, claimRef) {
+    return claimRef ? `${name} (claim: ${claimRef})` : name;
+}
+function validateGithubOrgVariableSectionSingleton(crs) {
+    const refsByOrg = new Map();
+    for (const crKey of Object.keys(crs)) {
+        const cr = crs[crKey];
+        if (cr.kind !== GITHUB_ORG_VARIABLE_SECTION_KIND)
+            continue;
+        const org = cr.spec?.org;
+        if (typeof org !== 'string' || !org)
+            continue;
+        const name = cr.metadata?.name || crKey;
+        const claimRef = cr.metadata?.annotations?.[githubOrgVariableSection_FIRESTARTR_CLAIM_REF_ANNOTATION] ||
+            cr.metadata?.labels?.[githubOrgVariableSection_CLAIM_REF_LABEL];
+        const normalizedOrg = org.toLowerCase();
+        const refs = refsByOrg.get(normalizedOrg) || [];
+        refs.push(githubOrgVariableSection_formatResourceRef(name, claimRef));
+        refsByOrg.set(normalizedOrg, refs);
+    }
+    for (const [org, refs] of refsByOrg.entries()) {
+        if (refs.length < 2)
+            continue;
+        throw new Error(`Duplicate ${GITHUB_ORG_VARIABLE_SECTION_KIND} resources found for GitHub organization "${org}": ${refs.join(', ')}`);
+    }
+}
+function validateActionsVariablesUniqueness(crs) {
+    for (const crKey of Object.keys(crs)) {
+        const cr = crs[crKey];
+        if (cr.kind !== GITHUB_ORG_VARIABLE_SECTION_KIND)
+            continue;
+        const actionsVariables = cr.spec?.actionsVariables;
+        if (!Array.isArray(actionsVariables))
+            continue;
+        const names = new Set();
+        for (const variable of actionsVariables) {
+            const varName = variable?.name;
+            if (!varName)
+                continue;
+            if (names.has(varName)) {
+                const org = cr.spec?.org || 'unknown';
+                throw new Error(`Duplicate action variable name "${varName}" found in ${GITHUB_ORG_VARIABLE_SECTION_KIND} for organization "${org}"`);
+            }
+            names.add(varName);
+        }
+    }
+}
+
 ;// CONCATENATED MODULE: ../cdk8s_renderer/src/renderer/renderer.ts
 
 
@@ -328773,6 +329226,7 @@ function validateGithubOrgSettingsSingleton(crs) {
 
 
 
+
 /*
  * Function called when rendering but not importing
  *
@@ -328796,6 +329250,8 @@ async function renderer_render(catalogScope, firestartrScope, claimList) {
         validateComponentPagesPath(data.renderClaims);
         validateTfStateKeyUniqueness(result);
         validateGithubOrgSettingsSingleton(fullCrSet);
+        validateGithubOrgVariableSectionSingleton(result);
+        validateActionsVariablesUniqueness(result);
         validateCrSizes(result);
         validatePermissionsUniqueness(result);
     }
@@ -339622,8 +340078,8 @@ const MODULES = {
     },
     FirestartrGithubRepository: {
         module: 'git::https://github.com/prefapp/tfm.git//modules/github-repo',
-        // github-repo-v0.8.0
-        ref: 'c51e2fe8c4f99aa34577b6a5f721a382ff217771',
+        // github-repo-v0.9.0
+        ref: '76074c2817032b199962c380481617d99f78d9d7',
     },
     FirestartrGithubRepositoryFeature: {
         module: 'git::https://github.com/prefapp/tfm.git//modules/github-files-set',
@@ -340289,11 +340745,6 @@ function provisionPermissions(fsGithubRepository) {
 }
 
 ;// CONCATENATED MODULE: ../gh_provisioner/src/entities/ghrepo/helpers/labels.ts
-// if we are to provision labels using tofu and the label already
-// exists, we should not attempt to re-create it. This function checks
-// if the label exists and if so, imports it into Terraform state. This is needed because
-// tofu does not have an "upsert" operation for labels, so we need to check
-// if the label exists before trying to create it, otherwise we will get an error.
 
 
 
@@ -340305,7 +340756,7 @@ async function provisionLabels(fsGithubRepository, repoAlreadyExists) {
             return;
         }
         if (repoAlreadyExists) {
-            await importLabelsIfNeeded(fsGithubRepository);
+            await importLabelsIfNeeded(fsGithubRepository, labels);
         }
         for (const label of labels) {
             gh_provisioner_src_logger.debug(`[gh-provisioner] ${fsGithubRepository.k8sId} provisioning label ${label.name}`);
@@ -340325,20 +340776,27 @@ async function provisionLabels(fsGithubRepository, repoAlreadyExists) {
         throw new Error(`Error on provisionLabels: ${err}`);
     }
 }
-async function importLabelsIfNeeded(fsGithubRepository) {
+async function importLabelsIfNeeded(fsGithubRepository, declaredLabels) {
     const cr = fsGithubRepository.cr;
     try {
-        const labels = cr.spec.repo.labels;
-        gh_provisioner_src_logger.info(`[gh-provisioner] ${fsGithubRepository.k8sId} checking if labels need to be imported`);
+        gh_provisioner_src_logger.info(`[gh-provisioner] ${fsGithubRepository.k8sId} checking if labels need to be imported (${declaredLabels.length} declared)`);
         const repoIssuesList = await fsGithubRepository.runWithGithubProvider(async () => {
             return await github["default"].repo.getRepoIssuesLabels(cr.spec.org, cr.name);
         });
-        // labels that already exist in GitHub must be imported into Terraform state
-        // so that Terraform manages them rather than trying to create them (which would fail)
-        for (const label of labels) {
-            if (!checkIfLabelExists(label.name, repoIssuesList)) {
+        for (const label of declaredLabels) {
+            const existing = findExistingLabel(label.name, repoIssuesList);
+            if (!existing) {
+                gh_provisioner_src_logger.info(`[gh-provisioner] ${fsGithubRepository.k8sId} label '${label.name}' not found on GitHub — will be created by TFM`);
                 continue;
             }
+            gh_provisioner_src_logger.info(`[gh-provisioner] ${fsGithubRepository.k8sId} label '${label.name}' on GitHub: color="${existing.color}" desc="${existing.description}" | CR declares: color="${label.color}" desc="${label.description}"`);
+            if (existing.color !== label.color ||
+                (label.description && existing.description !== label.description)) {
+                gh_provisioner_src_logger.info(`[gh-provisioner] ${fsGithubRepository.k8sId} updating pre-existing label '${label.name}' via GitHub API to match CR values`);
+                await fsGithubRepository.runWithGithubProvider(async () => {
+                    await github["default"].repo.updateRepoLabel(cr.spec.org, cr.name, label.name, label.color, label.description);
+                });
+            }
             fsGithubRepository.patchImportData({
                 op: PatchOperations.add,
                 path: '/imports/-',
@@ -340354,8 +340812,8 @@ async function importLabelsIfNeeded(fsGithubRepository) {
         throw new Error(`Error on importLabelsIfNeeded: ${err}`);
     }
 }
-function checkIfLabelExists(labelName, repoIssuesList) {
-    return repoIssuesList.some((label) => label.name === labelName);
+function findExistingLabel(labelName, repoIssuesList) {
+    return repoIssuesList.find((label) => label.name === labelName);
 }
 
 ;// CONCATENATED MODULE: ../gh_provisioner/src/entities/ghrepo/helpers/branch_protections.ts
@@ -341000,6 +341458,19 @@ async function runOnTerraform(entity, command, customArgs, opts = {}) {
         const importCommands = ['import-with-reimport', 'custom-import', 'import'];
         const isImportLike = importCommands.includes(command);
         // Always force importMode=true for all import-like commands.
+        // Apply-time adoption: when an apply runs and the entity has pending import
+        // entries (e.g. labels that already exist on GitHub), the bridge runs the
+        // regular apply with importMode=true. Import blocks are evaluated and
+        // consumed by the same single apply, importing pre-existing resources into
+        // state and reconciling them in one step.
+        //
+        // See ADR 0006: Apply-time adoption of existing GitHub resources via import blocks.
+        const importDoc = entity.importDocument;
+        if (command === 'apply' && importDoc.imports.length > 0) {
+            const importResult = await runTerraformProvisioner(tp_bridge_buildContext(entity, reuseExistingProject, true), 'apply', streaming, importDoc, opts.ctl);
+            entity.__ghProvisionerSessionWorkspaceInitialized = true;
+            return importResult;
+        }
         const result = await runTerraformProvisioner(tp_bridge_buildContext(entity, reuseExistingProject, isImportLike ? true : false), command, streaming, customArgs, opts.ctl);
         if (!entity.__ghProvisionerSessionWorkspaceInitialized &&
             isWorkspaceInitializingCommand) {
@@ -342956,7 +343427,20 @@ var external_util_ = __nccwpck_require__(73837);
 
 const deploymentName = catalog_common/* default.environment.getFromEnvironment */.Z.environment.getFromEnvironment(catalog_common/* default.types.envVars.operatorDeploymentName */.Z.types.envVars.operatorDeploymentName) || 'firestartr-firestartr-controller';
 const DEFAULT_OPERATOR_DEPLOY = (/* unused pure expression or super */ null && (deploymentName));
-async function tfPlanner(claimFilePath, claim, namespace, debug, jobTtl = 300, cmd = 'plan', callbackApi = function (ctl) { }) {
+function withToolImageTag(image, toolImageTag) {
+    if (!image || !toolImageTag)
+        return image;
+    const digestIndex = image.indexOf('@');
+    const imageWithoutDigest = digestIndex >= 0 ? image.slice(0, digestIndex) : image;
+    const digestSuffix = digestIndex >= 0 ? image.slice(digestIndex) : '';
+    const lastSlashIndex = imageWithoutDigest.lastIndexOf('/');
+    const lastColonIndex = imageWithoutDigest.lastIndexOf(':');
+    if (lastColonIndex > lastSlashIndex) {
+        return `${imageWithoutDigest.slice(0, lastColonIndex)}:${toolImageTag}${digestSuffix}`;
+    }
+    return `${imageWithoutDigest}:${toolImageTag}${digestSuffix}`;
+}
+async function tfPlanner(claimFilePath, claim, namespace, debug, jobTtl = 300, cmd = 'plan', toolImageTag, callbackApi = function (ctl) { }) {
     const { kc } = await getConnection();
     const k8sApi = kc.makeApiClient(client.AppsV1Api);
     const batchV1Api = kc.makeApiClient(client.BatchV1Api);
@@ -342979,6 +343463,7 @@ async function tfPlanner(claimFilePath, claim, namespace, debug, jobTtl = 300, c
     job.spec.ttlSecondsAfterFinished = jobTtl;
     job.spec.template = controllerDeploy.body.spec
         .template;
+    job.spec.template.spec.containers[0].image = withToolImageTag(job.spec.template.spec.containers[0].image, toolImageTag);
     // set activeDeadlineSeconds to force terminate jobs that exceed this time
     // see https://kubernetes.io/docs/concepts/workloads/controllers/job/#job-termination-and-cleanup
     job.spec.activeDeadlineSeconds = 3600;
@@ -522076,7 +522561,7 @@ const crsStatusSubcommand = {
 };
 
 ;// CONCATENATED MODULE: ./package.json
-const package_namespaceObject = JSON.parse('{"i8":"2.9.0-snapshot-01"}');
+const package_namespaceObject = JSON.parse('{"i8":"2.9.0-snapshot-org-variables-section-1"}');
 ;// CONCATENATED MODULE: ../../package.json
 const package_namespaceObject_1 = {"i8":"2.8.0"};
 ;// CONCATENATED MODULE: ./src/subcommands/index.ts

package/build/packages/cdk8s_renderer/imports/firestartr.dev.d.ts

@@ -903,6 +903,268 @@ export declare enum FirestartrGithubOrganizationSettingsSpecContextProviderRefKi
     /** FirestartrProviderConfig */
     FIRESTARTR_PROVIDER_CONFIG = "FirestartrProviderConfig"
 }
+/**
+ * A resource to handle GitHub Organization Actions Variables.
+ *
+ * @schema FirestartrGithubOrganizationVariableSection
+ */
+export declare class FirestartrGithubOrganizationVariableSection extends ApiObject {
+    /**
+     * Returns the apiVersion and kind for "FirestartrGithubOrganizationVariableSection"
+     */
+    static readonly GVK: GroupVersionKind;
+    /**
+     * Renders a Kubernetes manifest for "FirestartrGithubOrganizationVariableSection".
+     *
+     * This can be used to inline resource manifests inside other objects (e.g. as templates).
+     *
+     * @param props initialization props
+     */
+    static manifest(props: FirestartrGithubOrganizationVariableSectionProps): any;
+    /**
+     * Defines a "FirestartrGithubOrganizationVariableSection" API object
+     * @param scope the scope in which to define this object
+     * @param id a scope-local name for the object
+     * @param props initialization props
+     */
+    constructor(scope: Construct, id: string, props: FirestartrGithubOrganizationVariableSectionProps);
+    /**
+     * Renders the object to Kubernetes JSON.
+     */
+    toJson(): any;
+}
+/**
+ * A resource to handle GitHub Organization Actions Variables.
+ *
+ * @schema FirestartrGithubOrganizationVariableSection
+ */
+export interface FirestartrGithubOrganizationVariableSectionProps {
+    /**
+     * @schema FirestartrGithubOrganizationVariableSection#metadata
+     */
+    readonly metadata: ApiObjectMetadata;
+    /**
+     * @schema FirestartrGithubOrganizationVariableSection#spec
+     */
+    readonly spec: FirestartrGithubOrganizationVariableSectionSpec;
+}
+/**
+ * Converts an object of type 'FirestartrGithubOrganizationVariableSectionProps' to JSON representation.
+ */
+export declare function toJson_FirestartrGithubOrganizationVariableSectionProps(obj: FirestartrGithubOrganizationVariableSectionProps | undefined): Record<string, any> | undefined;
+/**
+ * @schema FirestartrGithubOrganizationVariableSectionSpec
+ */
+export interface FirestartrGithubOrganizationVariableSectionSpec {
+    /**
+     * GitHub organization targeted by this resource
+     *
+     * @schema FirestartrGithubOrganizationVariableSectionSpec#org
+     */
+    readonly org: string;
+    /**
+     * GitHub Actions organization-level variables
+     *
+     * @schema FirestartrGithubOrganizationVariableSectionSpec#actionsVariables
+     */
+    readonly actionsVariables?: FirestartrGithubOrganizationVariableSectionSpecActionsVariables[];
+    /**
+     * @schema FirestartrGithubOrganizationVariableSectionSpec#context
+     */
+    readonly context: FirestartrGithubOrganizationVariableSectionSpecContext;
+    /**
+     * @schema FirestartrGithubOrganizationVariableSectionSpec#firestartr
+     */
+    readonly firestartr: FirestartrGithubOrganizationVariableSectionSpecFirestartr;
+    /**
+     * @schema FirestartrGithubOrganizationVariableSectionSpec#writeConnectionSecretToRef
+     */
+    readonly writeConnectionSecretToRef: FirestartrGithubOrganizationVariableSectionSpecWriteConnectionSecretToRef;
+}
+/**
+ * Converts an object of type 'FirestartrGithubOrganizationVariableSectionSpec' to JSON representation.
+ */
+export declare function toJson_FirestartrGithubOrganizationVariableSectionSpec(obj: FirestartrGithubOrganizationVariableSectionSpec | undefined): Record<string, any> | undefined;
+/**
+ * @schema FirestartrGithubOrganizationVariableSectionSpecActionsVariables
+ */
+export interface FirestartrGithubOrganizationVariableSectionSpecActionsVariables {
+    /**
+     * Variable name matching GitHub Actions naming rules
+     *
+     * @schema FirestartrGithubOrganizationVariableSectionSpecActionsVariables#name
+     */
+    readonly name: string;
+    /**
+     * Variable value
+     *
+     * @schema FirestartrGithubOrganizationVariableSectionSpecActionsVariables#value
+     */
+    readonly value: string;
+    /**
+     * Visibility of the variable
+     *
+     * @schema FirestartrGithubOrganizationVariableSectionSpecActionsVariables#visibility
+     */
+    readonly visibility: FirestartrGithubOrganizationVariableSectionSpecActionsVariablesVisibility;
+    /**
+     * Repository names in org/repo format
+     *
+     * @schema FirestartrGithubOrganizationVariableSectionSpecActionsVariables#selectedRepositories
+     */
+    readonly selectedRepositories?: string[];
+}
+/**
+ * Converts an object of type 'FirestartrGithubOrganizationVariableSectionSpecActionsVariables' to JSON representation.
+ */
+export declare function toJson_FirestartrGithubOrganizationVariableSectionSpecActionsVariables(obj: FirestartrGithubOrganizationVariableSectionSpecActionsVariables | undefined): Record<string, any> | undefined;
+/**
+ * @schema FirestartrGithubOrganizationVariableSectionSpecContext
+ */
+export interface FirestartrGithubOrganizationVariableSectionSpecContext {
+    /**
+     * @schema FirestartrGithubOrganizationVariableSectionSpecContext#backend
+     */
+    readonly backend: FirestartrGithubOrganizationVariableSectionSpecContextBackend;
+    /**
+     * @schema FirestartrGithubOrganizationVariableSectionSpecContext#provider
+     */
+    readonly provider: FirestartrGithubOrganizationVariableSectionSpecContextProvider;
+}
+/**
+ * Converts an object of type 'FirestartrGithubOrganizationVariableSectionSpecContext' to JSON representation.
+ */
+export declare function toJson_FirestartrGithubOrganizationVariableSectionSpecContext(obj: FirestartrGithubOrganizationVariableSectionSpecContext | undefined): Record<string, any> | undefined;
+/**
+ * @schema FirestartrGithubOrganizationVariableSectionSpecFirestartr
+ */
+export interface FirestartrGithubOrganizationVariableSectionSpecFirestartr {
+    /**
+     * @schema FirestartrGithubOrganizationVariableSectionSpecFirestartr#tfStateKey
+     */
+    readonly tfStateKey: string;
+}
+/**
+ * Converts an object of type 'FirestartrGithubOrganizationVariableSectionSpecFirestartr' to JSON representation.
+ */
+export declare function toJson_FirestartrGithubOrganizationVariableSectionSpecFirestartr(obj: FirestartrGithubOrganizationVariableSectionSpecFirestartr | undefined): Record<string, any> | undefined;
+/**
+ * @schema FirestartrGithubOrganizationVariableSectionSpecWriteConnectionSecretToRef
+ */
+export interface FirestartrGithubOrganizationVariableSectionSpecWriteConnectionSecretToRef {
+    /**
+     * @schema FirestartrGithubOrganizationVariableSectionSpecWriteConnectionSecretToRef#name
+     */
+    readonly name: string;
+    /**
+     * @schema FirestartrGithubOrganizationVariableSectionSpecWriteConnectionSecretToRef#outputs
+     */
+    readonly outputs: FirestartrGithubOrganizationVariableSectionSpecWriteConnectionSecretToRefOutputs[];
+}
+/**
+ * Converts an object of type 'FirestartrGithubOrganizationVariableSectionSpecWriteConnectionSecretToRef' to JSON representation.
+ */
+export declare function toJson_FirestartrGithubOrganizationVariableSectionSpecWriteConnectionSecretToRef(obj: FirestartrGithubOrganizationVariableSectionSpecWriteConnectionSecretToRef | undefined): Record<string, any> | undefined;
+/**
+ * Visibility of the variable
+ *
+ * @schema FirestartrGithubOrganizationVariableSectionSpecActionsVariablesVisibility
+ */
+export declare enum FirestartrGithubOrganizationVariableSectionSpecActionsVariablesVisibility {
+    /** all */
+    ALL = "all",
+    /** private */
+    PRIVATE = "private",
+    /** selected */
+    SELECTED = "selected"
+}
+/**
+ * @schema FirestartrGithubOrganizationVariableSectionSpecContextBackend
+ */
+export interface FirestartrGithubOrganizationVariableSectionSpecContextBackend {
+    /**
+     * @schema FirestartrGithubOrganizationVariableSectionSpecContextBackend#ref
+     */
+    readonly ref: FirestartrGithubOrganizationVariableSectionSpecContextBackendRef;
+}
+/**
+ * Converts an object of type 'FirestartrGithubOrganizationVariableSectionSpecContextBackend' to JSON representation.
+ */
+export declare function toJson_FirestartrGithubOrganizationVariableSectionSpecContextBackend(obj: FirestartrGithubOrganizationVariableSectionSpecContextBackend | undefined): Record<string, any> | undefined;
+/**
+ * @schema FirestartrGithubOrganizationVariableSectionSpecContextProvider
+ */
+export interface FirestartrGithubOrganizationVariableSectionSpecContextProvider {
+    /**
+     * @schema FirestartrGithubOrganizationVariableSectionSpecContextProvider#ref
+     */
+    readonly ref: FirestartrGithubOrganizationVariableSectionSpecContextProviderRef;
+}
+/**
+ * Converts an object of type 'FirestartrGithubOrganizationVariableSectionSpecContextProvider' to JSON representation.
+ */
+export declare function toJson_FirestartrGithubOrganizationVariableSectionSpecContextProvider(obj: FirestartrGithubOrganizationVariableSectionSpecContextProvider | undefined): Record<string, any> | undefined;
+/**
+ * @schema FirestartrGithubOrganizationVariableSectionSpecWriteConnectionSecretToRefOutputs
+ */
+export interface FirestartrGithubOrganizationVariableSectionSpecWriteConnectionSecretToRefOutputs {
+    /**
+     * @schema FirestartrGithubOrganizationVariableSectionSpecWriteConnectionSecretToRefOutputs#key
+     */
+    readonly key: string;
+}
+/**
+ * Converts an object of type 'FirestartrGithubOrganizationVariableSectionSpecWriteConnectionSecretToRefOutputs' to JSON representation.
+ */
+export declare function toJson_FirestartrGithubOrganizationVariableSectionSpecWriteConnectionSecretToRefOutputs(obj: FirestartrGithubOrganizationVariableSectionSpecWriteConnectionSecretToRefOutputs | undefined): Record<string, any> | undefined;
+/**
+ * @schema FirestartrGithubOrganizationVariableSectionSpecContextBackendRef
+ */
+export interface FirestartrGithubOrganizationVariableSectionSpecContextBackendRef {
+    /**
+     * @schema FirestartrGithubOrganizationVariableSectionSpecContextBackendRef#kind
+     */
+    readonly kind: FirestartrGithubOrganizationVariableSectionSpecContextBackendRefKind;
+    /**
+     * @schema FirestartrGithubOrganizationVariableSectionSpecContextBackendRef#name
+     */
+    readonly name: string;
+}
+/**
+ * Converts an object of type 'FirestartrGithubOrganizationVariableSectionSpecContextBackendRef' to JSON representation.
+ */
+export declare function toJson_FirestartrGithubOrganizationVariableSectionSpecContextBackendRef(obj: FirestartrGithubOrganizationVariableSectionSpecContextBackendRef | undefined): Record<string, any> | undefined;
+/**
+ * @schema FirestartrGithubOrganizationVariableSectionSpecContextProviderRef
+ */
+export interface FirestartrGithubOrganizationVariableSectionSpecContextProviderRef {
+    /**
+     * @schema FirestartrGithubOrganizationVariableSectionSpecContextProviderRef#kind
+     */
+    readonly kind: FirestartrGithubOrganizationVariableSectionSpecContextProviderRefKind;
+    /**
+     * @schema FirestartrGithubOrganizationVariableSectionSpecContextProviderRef#name
+     */
+    readonly name: string;
+}
+/**
+ * Converts an object of type 'FirestartrGithubOrganizationVariableSectionSpecContextProviderRef' to JSON representation.
+ */
+export declare function toJson_FirestartrGithubOrganizationVariableSectionSpecContextProviderRef(obj: FirestartrGithubOrganizationVariableSectionSpecContextProviderRef | undefined): Record<string, any> | undefined;
+/**
+ * @schema FirestartrGithubOrganizationVariableSectionSpecContextBackendRefKind
+ */
+export declare enum FirestartrGithubOrganizationVariableSectionSpecContextBackendRefKind {
+    /** FirestartrProviderConfig */
+    FIRESTARTR_PROVIDER_CONFIG = "FirestartrProviderConfig"
+}
+/**
+ * @schema FirestartrGithubOrganizationVariableSectionSpecContextProviderRefKind
+ */
+export declare enum FirestartrGithubOrganizationVariableSectionSpecContextProviderRefKind {
+    /** FirestartrProviderConfig */
+    FIRESTARTR_PROVIDER_CONFIG = "FirestartrProviderConfig"
+}
 /**
  * A resource to handle GitHub Organization Webhooks
  *

package/build/packages/cdk8s_renderer/src/charts/github/index.d.ts

@@ -3,3 +3,4 @@ export { GithubMembershipChart } from './membershipChart';
 export { GithubRepositoryChart } from './repositoryChart';
 export { GithubOrgWebhookChart } from './orgWebhookChart';
 export { GithubOrgSettingsChart } from './orgSettingsChart';
+export { GithubOrgVariableSectionChart } from './orgVariableSectionChart';

package/build/packages/cdk8s_renderer/src/charts/github/orgVariableSectionChart.d.ts

@@ -0,0 +1,8 @@
+import { FirestartrGithubOrganizationVariableSection, FirestartrGithubOrganizationVariableSectionProps } from '../../../imports/firestartr.dev';
+import { IUnitializedStateKey } from '../../claims/base';
+import { BaseGithubChart } from './base';
+export declare class GithubOrgVariableSectionChart extends BaseGithubChart {
+    template(): FirestartrGithubOrganizationVariableSectionProps | IUnitializedStateKey;
+    gvk(): import("cdk8s").GroupVersionKind;
+    instanceApiObject(template: any): FirestartrGithubOrganizationVariableSection;
+}

package/build/packages/cdk8s_renderer/src/charts/index.d.ts

@@ -1,4 +1,4 @@
-import { GithubGroupChart, GithubMembershipChart, GithubRepositoryChart, GithubOrgWebhookChart, GithubOrgSettingsChart } from './github';
+import { GithubGroupChart, GithubMembershipChart, GithubRepositoryChart, GithubOrgWebhookChart, GithubOrgSettingsChart, GithubOrgVariableSectionChart } from './github';
 import { CatalogComponentChart, CatalogDomainChart, CatalogGroupChart, CatalogSystemChart, CatalogUserChart, CatalogTFWorkspaceChart, CatalogArgoDeployChart, CatalogSecretsChart, CatalogOrgWebhookChart, CatalogApiChart } from './catalog';
 import { TFWorkspaceChart } from './workspaces/tfworkspaceChart';
 import { ArgoDeployChart } from './argocd/argodeployChart';
@@ -22,5 +22,6 @@ declare const _default: {
     SecretsChart: typeof SecretsChart;
     GithubOrgWebhookChart: typeof GithubOrgWebhookChart;
     GithubOrgSettingsChart: typeof GithubOrgSettingsChart;
+    GithubOrgVariableSectionChart: typeof GithubOrgVariableSectionChart;
 };
 export default _default;

package/build/packages/cdk8s_renderer/src/claims/base/schemas/index.d.ts

@@ -974,6 +974,52 @@ declare const schemas: {
                         secret_scanning_push_protection_enabled_for_new_repositories: {
                             type: string;
                         };
+                        actions_variables: {
+                            type: string;
+                            items: {
+                                type: string;
+                                properties: {
+                                    name: {
+                                        type: string;
+                                        pattern: string;
+                                    };
+                                    value: {
+                                        type: string;
+                                    };
+                                    visibility: {
+                                        type: string;
+                                        enum: string[];
+                                    };
+                                    selected_repositories: {
+                                        type: string;
+                                        items: {
+                                            $ref: string;
+                                        };
+                                    };
+                                };
+                                required: string[];
+                                additionalProperties: boolean;
+                                allOf: {
+                                    if: {
+                                        properties: {
+                                            visibility: {
+                                                const: string;
+                                            };
+                                        };
+                                        required: string[];
+                                    };
+                                    then: {};
+                                    else: {
+                                        properties: {
+                                            selected_repositories: {
+                                                type: string;
+                                                maxItems: number;
+                                            };
+                                        };
+                                    };
+                                }[];
+                            };
+                        };
                     };
                     additionalProperties: boolean;
                     required: string[];

package/build/packages/cdk8s_renderer/src/claims/github/index.d.ts

@@ -505,6 +505,52 @@ export declare const GithubSchemas: ({
                     secret_scanning_push_protection_enabled_for_new_repositories: {
                         type: string;
                     };
+                    actions_variables: {
+                        type: string;
+                        items: {
+                            type: string;
+                            properties: {
+                                name: {
+                                    type: string;
+                                    pattern: string;
+                                };
+                                value: {
+                                    type: string;
+                                };
+                                visibility: {
+                                    type: string;
+                                    enum: string[];
+                                };
+                                selected_repositories: {
+                                    type: string;
+                                    items: {
+                                        $ref: string;
+                                    };
+                                };
+                            };
+                            required: string[];
+                            additionalProperties: boolean;
+                            allOf: {
+                                if: {
+                                    properties: {
+                                        visibility: {
+                                            const: string;
+                                        };
+                                    };
+                                    required: string[];
+                                };
+                                then: {};
+                                else: {
+                                    properties: {
+                                        selected_repositories: {
+                                            type: string;
+                                            maxItems: number;
+                                        };
+                                    };
+                                };
+                            }[];
+                        };
+                    };
                 };
                 additionalProperties: boolean;
                 required: string[];

package/build/packages/cdk8s_renderer/src/claims/github/orgSettings.d.ts

@@ -29,6 +29,12 @@ export interface IGithubOrgSettingsClaim extends IOrgSettingsClaim {
             dependency_graph_enabled_for_new_repositories?: boolean;
             secret_scanning_enabled_for_new_repositories?: boolean;
             secret_scanning_push_protection_enabled_for_new_repositories?: boolean;
+            actions_variables?: {
+                name: string;
+                value: string;
+                visibility: 'all' | 'private' | 'selected';
+                selected_repositories?: string[];
+            }[];
         };
     };
 }

package/build/packages/cdk8s_renderer/src/claims/github/orgsettings.schema.d.ts

@@ -100,6 +100,52 @@ declare const _default: {
                     secret_scanning_push_protection_enabled_for_new_repositories: {
                         type: string;
                     };
+                    actions_variables: {
+                        type: string;
+                        items: {
+                            type: string;
+                            properties: {
+                                name: {
+                                    type: string;
+                                    pattern: string;
+                                };
+                                value: {
+                                    type: string;
+                                };
+                                visibility: {
+                                    type: string;
+                                    enum: string[];
+                                };
+                                selected_repositories: {
+                                    type: string;
+                                    items: {
+                                        $ref: string;
+                                    };
+                                };
+                            };
+                            required: string[];
+                            additionalProperties: boolean;
+                            allOf: {
+                                if: {
+                                    properties: {
+                                        visibility: {
+                                            const: string;
+                                        };
+                                    };
+                                    required: string[];
+                                };
+                                then: {};
+                                else: {
+                                    properties: {
+                                        selected_repositories: {
+                                            type: string;
+                                            maxItems: number;
+                                        };
+                                    };
+                                };
+                            }[];
+                        };
+                    };
                 };
                 additionalProperties: boolean;
                 required: string[];

package/build/packages/cdk8s_renderer/src/renderer/previous-crs-extractor.d.ts

@@ -1 +1 @@
-export declare function getPreviousCRfromClaim(claim: any, previousCRs: any): any;
+export declare function getPreviousCRfromClaim(claim: any, previousCRs: any, expectedKind?: string): any;

package/build/packages/cdk8s_renderer/src/validations/githubOrgVariableSection.d.ts

@@ -0,0 +1,3 @@
+import { RenderedCrMap } from '../renderer/types';
+export declare function validateGithubOrgVariableSectionSingleton(crs: RenderedCrMap): void;
+export declare function validateActionsVariablesUniqueness(crs: RenderedCrMap): void;

package/build/packages/github/index.d.ts

@@ -36,6 +36,8 @@ declare const _default: {
         addStatusCheck: typeof import("./src/repository").addStatusCheck;
         addCommitStatus: typeof import("./src/repository").addCommitStatus;
         getRepoIssuesLabels: typeof import("./src/repository").getRepoIssuesLabels;
+        createRepoLabel: typeof import("./src/repository").createRepoLabel;
+        updateRepoLabel: typeof import("./src/repository").updateRepoLabel;
         isEmptyRepo: typeof import("./src/repository").isEmptyRepo;
     };
     team: {

package/build/packages/github/src/repository.d.ts

@@ -1332,6 +1332,24 @@ export declare function getRepoIssuesLabels(owner: string, repo: string): Promis
     description: string;
     color: string;
 }[]>;
+export declare function createRepoLabel(owner: string, repo: string, name: string, color: string, description?: string): Promise<{
+    id: number;
+    node_id: string;
+    url: string;
+    name: string;
+    description: string;
+    color: string;
+    default: boolean;
+}>;
+export declare function updateRepoLabel(owner: string, repo: string, name: string, color: string, description?: string): Promise<{
+    id: number;
+    node_id: string;
+    url: string;
+    name: string;
+    description: string;
+    color: string;
+    default: boolean;
+}>;
 export declare function isEmptyRepo(owner: string, name: string): Promise<boolean>;
 declare const _default: {
     listReleases: typeof listReleases;
@@ -1351,6 +1369,8 @@ declare const _default: {
     addStatusCheck: typeof addStatusCheck;
     addCommitStatus: typeof addCommitStatus;
     getRepoIssuesLabels: typeof getRepoIssuesLabels;
+    createRepoLabel: typeof createRepoLabel;
+    updateRepoLabel: typeof updateRepoLabel;
     isEmptyRepo: typeof isEmptyRepo;
 };
 export default _default;

package/build/packages/operator/src/cmd/tf_planner.d.ts

@@ -1,2 +1,3 @@
-export declare function tfPlanner(claimFilePath: string, claim: any, namespace: string, debug: boolean, jobTtl?: number, cmd?: string, callbackApi?: (ctl: any) => void): Promise<void>;
+export declare function withToolImageTag(image: string | undefined, toolImageTag?: string): string;
+export declare function tfPlanner(claimFilePath: string, claim: any, namespace: string, debug: boolean, jobTtl?: number, cmd?: string, toolImageTag?: string, callbackApi?: (ctl: any) => void): Promise<void>;
 export declare function kubectlCp(sourcePath: string, namespace: string, podName: string, podFilePath?: string): void;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@firestartr/cli",
-  "version": "2.9.0-snapshot-01",
+  "version": "2.9.0-snapshot-org-variables-section-1",
   "private": false,
   "description": "Commandline tool",
   "main": "build/main.js",