@firestartr/cli 2.9.0 → 2.10.0-snapshot-org-secrets-1

package/build/index.js

@@ -284613,6 +284613,17 @@ async function doPaginatedRequest(options) {
         'Cache-Control': 'no-cache',
     });
 }
+async function getOrgVariable(org, variableName, octokit) {
+    logger.info(`Getting org variable ${variableName} for org ${org}`);
+    if (!octokit) {
+        octokit = await getOctokitForOrg(org);
+    }
+    const response = await octokit.rest.actions.getOrgVariable({
+        org,
+        name: variableName,
+    });
+    return response.data;
+}
 /* harmony default export */ const organization = ({
     getRepositoryList,
     getTeamList,
@@ -284623,6 +284634,7 @@ async function doPaginatedRequest(options) {
     getOrgTeamsDirectAccess,
     getOrgPlanName,
     getWebhookList,
+    getOrgVariable,
 });
 
 // EXTERNAL MODULE: external "fs"
@@ -286115,6 +286127,10 @@ function createFacade(profileName) {
                 const octokit = await getOctokitForOrg(orgName);
                 return getOrgPlanName(orgName, octokit);
             },
+            getOrgVariable: async (orgName, variableName) => {
+                const octokit = await getOctokitForOrg(orgName);
+                return getOrgVariable(orgName, variableName, octokit);
+            },
         },
         repo: {
             addStatusCheck: async (output, isFailure, headSha, name, status, repoName, owner) => {
@@ -319522,9 +319538,14 @@ class UUIDInitializer extends InitializerPatches {
                 },
                 apply(cr) {
                     const ctx = helperCTX(this);
-                    const uuid = previousCR?.spec?.firestartr?.tfStateKey ||
-                        claim.providers?.[ctx.provider]?.tfStateKey ||
-                        (0,wrapper.v4)();
+                    const reusePrevious = previousCR && previousCR.kind === ctx.kind;
+                    const uuid = reusePrevious
+                        ? previousCR?.spec?.firestartr?.tfStateKey ||
+                            claim.providers?.[ctx.provider]?.tfStateKey ||
+                            (0,wrapper.v4)()
+                        : cr.spec?.firestartr?.tfStateKey ||
+                            claim.providers?.[ctx.provider]?.tfStateKey ||
+                            (0,wrapper.v4)();
                     if (!cr.spec)
                         cr.spec = {};
                     if (!cr.spec.firestartr)
@@ -320066,6 +320087,7 @@ const ONE_WAY_DEFINITIONS = [
     '/spec/vars',
     '/spec/actions/oidc',
     '/spec/repo/labels',
+    '/spec/actionsVariables',
 ];
 function applyOneWayDefs(crSpecs) {
     const crSpecsClone = JSON.parse(JSON.stringify(crSpecs));
@@ -322061,6 +322083,42 @@ function extractAllRefs(claimData) {
             refs.push(...secretsRefs);
             break;
         }
+        case 'OrgSettingsClaim': {
+            const actionsVariables = parsedClaim.providers?.github?.actions_variables;
+            if (Array.isArray(actionsVariables)) {
+                for (const variable of actionsVariables) {
+                    if (variable.visibility !== 'selected')
+                        continue;
+                    const selectedRepos = variable.selected_repositories;
+                    if (!Array.isArray(selectedRepos))
+                        continue;
+                    for (const repoRef of selectedRepos) {
+                        const match = repoRef.match(/^component:(.+)$/);
+                        if (match) {
+                            refs.push(`ComponentClaim-${match[1]}`);
+                        }
+                    }
+                }
+            }
+            const orgSecrets = parsedClaim.providers?.github?.org_secrets;
+            if (orgSecrets && typeof orgSecrets === 'object') {
+                const secretRefRegex = /^ref:secretsclaim:([a-zA-Z0-9_-]+):([a-zA-Z0-9_-]+)$/;
+                for (const section of ['actions', 'codespaces', 'dependabot']) {
+                    const secrets = orgSecrets[section];
+                    if (!Array.isArray(secrets))
+                        continue;
+                    for (const secret of secrets) {
+                        if (!secret.value)
+                            continue;
+                        const match = secret.value.match(secretRefRegex);
+                        if (match) {
+                            refs.push(`SecretsClaim-${match[1]}`);
+                        }
+                    }
+                }
+            }
+            break;
+        }
     }
     logger.info(`Refs for ${parsedClaim.kind}-${parsedClaim.name}: ${[...new Set(refs)].join(',')}`);
     return [...new Set(refs)];
@@ -323187,6 +323245,73 @@ const organizationSettingsProperties = {
     secret_scanning_push_protection_enabled_for_new_repositories: {
         type: 'boolean',
     },
+    actions_variables: {
+        type: 'array',
+        items: {
+            type: 'object',
+            properties: {
+                name: {
+                    type: 'string',
+                    pattern: '^[A-Za-z0-9_]+$',
+                },
+                value: {
+                    type: 'string',
+                },
+                visibility: {
+                    type: 'string',
+                    enum: ['all', 'private', 'selected'],
+                },
+                selected_repositories: {
+                    type: 'array',
+                    items: {
+                        $ref: 'firestartr.dev://common/FirestartrComponentRef',
+                    },
+                },
+            },
+            required: ['name', 'value', 'visibility'],
+            additionalProperties: false,
+            allOf: [
+                {
+                    if: {
+                        properties: {
+                            visibility: { const: 'selected' },
+                        },
+                        required: ['visibility'],
+                    },
+                    then: {},
+                    else: {
+                        properties: {
+                            selected_repositories: { type: 'array', maxItems: 0 },
+                        },
+                    },
+                },
+            ],
+        },
+    },
+    org_secrets: {
+        type: 'object',
+        properties: {
+            actions: {
+                type: 'array',
+                items: {
+                    $ref: 'firestartr.dev://github/GithubOrgClaimSecret',
+                },
+            },
+            codespaces: {
+                type: 'array',
+                items: {
+                    $ref: 'firestartr.dev://github/GithubOrgClaimSecret',
+                },
+            },
+            dependabot: {
+                type: 'array',
+                items: {
+                    $ref: 'firestartr.dev://github/GithubOrgClaimSecret',
+                },
+            },
+        },
+        additionalProperties: false,
+    },
 };
 /* harmony default export */ const github_orgsettings_schema = ({
     $schema: SCHEMA,
@@ -323374,6 +323499,63 @@ const organizationSettingsProperties = {
     },
 });
 
+;// CONCATENATED MODULE: ../cdk8s_renderer/src/claims/github/orgSecrets.schema.ts
+
+/* harmony default export */ const orgSecrets_schema = ({
+    $schema: SCHEMA,
+    $id: 'GithubOrgClaimSecrets',
+    definitions: {
+        GithubOrgClaimSecrets: {
+            $id: 'firestartr.dev://github/GithubOrgClaimSecrets',
+            type: 'object',
+            description: 'Organization-level GitHub Actions secrets',
+            properties: {
+                actions: {
+                    type: 'array',
+                    items: {
+                        $ref: 'firestartr.dev://github/GithubOrgClaimSecret',
+                    },
+                },
+                codespaces: {
+                    type: 'array',
+                    items: {
+                        $ref: 'firestartr.dev://github/GithubOrgClaimSecret',
+                    },
+                },
+                dependabot: {
+                    type: 'array',
+                    items: {
+                        $ref: 'firestartr.dev://github/GithubOrgClaimSecret',
+                    },
+                },
+            },
+            additionalProperties: false,
+        },
+        GithubOrgClaimSecretRef: {
+            $id: 'firestartr.dev://github/GithubOrgClaimSecretRef',
+            type: 'string',
+            description: 'the reference of the secret',
+            pattern: '^ref:secretsclaim:([a-zA-Z0-9_-]+):([a-zA-Z0-9_-]+)$',
+        },
+        GithubOrgClaimSecret: {
+            $id: 'firestartr.dev://github/GithubOrgClaimSecret',
+            type: 'object',
+            description: 'An organization-level secret for GitHub Actions',
+            properties: {
+                name: {
+                    type: 'string',
+                    description: 'the name of the secret',
+                },
+                value: {
+                    $ref: 'firestartr.dev://github/GithubOrgClaimSecretRef',
+                },
+            },
+            required: ['name', 'value'],
+            additionalProperties: false,
+        },
+    },
+});
+
 ;// CONCATENATED MODULE: ../cdk8s_renderer/src/claims/github/index.ts
 
 
@@ -323383,6 +323565,7 @@ const organizationSettingsProperties = {
 
 
 
+
 const GithubSchemas = [
     github_group_schema,
     github_user_schema,
@@ -323392,6 +323575,7 @@ const GithubSchemas = [
     github_orgsettings_schema,
     component_secrets_vars_schema,
     component_labels_schema,
+    orgSecrets_schema,
 ];
 
 ;// CONCATENATED MODULE: ../cdk8s_renderer/src/claims/tfworkspaces/terraform.schema.ts
@@ -326538,7 +326722,7 @@ const VARIANT_OF_ANNOTATION = 'firestartr.dev/variant-of';
 function isVariantCR(cr) {
     return cr.metadata?.annotations?.[VARIANT_OF_ANNOTATION] !== undefined;
 }
-function getPreviousCRfromClaim(claim, previousCRs) {
+function getPreviousCRfromClaim(claim, previousCRs, expectedKind) {
     const previousCRsKeys = Object.keys(previousCRs);
     const isVariantClaim = !!claim._parentClaimName;
     for (const previousCRKey of previousCRsKeys) {
@@ -326547,6 +326731,8 @@ function getPreviousCRfromClaim(claim, previousCRs) {
             continue;
         if (isExcludedFromPreviousCR(previousCR.kind))
             continue;
+        if (expectedKind && previousCR.kind !== expectedKind)
+            continue;
         const crVariant = isVariantCR(previousCR);
         if (isVariantClaim && !crVariant)
             continue;
@@ -327303,6 +327489,361 @@ var FirestartrGithubMembershipSpecContextProviderRefKind;
     /** FirestartrProviderConfig */
     FirestartrGithubMembershipSpecContextProviderRefKind["FIRESTARTR_PROVIDER_CONFIG"] = "FirestartrProviderConfig";
 })(FirestartrGithubMembershipSpecContextProviderRefKind || (FirestartrGithubMembershipSpecContextProviderRefKind = {}));
+/**
+ * A resource to handle GitHub Organization Actions Secrets.
+ *
+ * @schema FirestartrGithubOrganizationSecretSection
+ */
+class FirestartrGithubOrganizationSecretSection extends lib.ApiObject {
+    /**
+     * Renders a Kubernetes manifest for "FirestartrGithubOrganizationSecretSection".
+     *
+     * This can be used to inline resource manifests inside other objects (e.g. as templates).
+     *
+     * @param props initialization props
+     */
+    static manifest(props) {
+        return {
+            ...FirestartrGithubOrganizationSecretSection.GVK,
+            ...toJson_FirestartrGithubOrganizationSecretSectionProps(props),
+        };
+    }
+    /**
+     * Defines a "FirestartrGithubOrganizationSecretSection" API object
+     * @param scope the scope in which to define this object
+     * @param id a scope-local name for the object
+     * @param props initialization props
+     */
+    constructor(scope, id, props) {
+        super(scope, id, {
+            ...FirestartrGithubOrganizationSecretSection.GVK,
+            ...props,
+        });
+    }
+    /**
+     * Renders the object to Kubernetes JSON.
+     */
+    toJson() {
+        const resolved = super.toJson();
+        return {
+            ...FirestartrGithubOrganizationSecretSection.GVK,
+            ...toJson_FirestartrGithubOrganizationSecretSectionProps(resolved),
+        };
+    }
+}
+/**
+ * Returns the apiVersion and kind for "FirestartrGithubOrganizationSecretSection"
+ */
+FirestartrGithubOrganizationSecretSection.GVK = {
+    apiVersion: 'firestartr.dev/v1',
+    kind: 'FirestartrGithubOrganizationSecretSection',
+};
+
+/**
+ * Converts an object of type 'FirestartrGithubOrganizationSecretSectionProps' to JSON representation.
+ */
+/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
+function toJson_FirestartrGithubOrganizationSecretSectionProps(obj) {
+    if (obj === undefined) {
+        return undefined;
+    }
+    const result = {
+        'metadata': obj.metadata,
+        'spec': toJson_FirestartrGithubOrganizationSecretSectionSpec(obj.spec),
+    };
+    // filter undefined values
+    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
+}
+/**
+ * Converts an object of type 'FirestartrGithubOrganizationSecretSectionSpec' to JSON representation.
+ */
+/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
+function toJson_FirestartrGithubOrganizationSecretSectionSpec(obj) {
+    if (obj === undefined) {
+        return undefined;
+    }
+    const result = {
+        'org': obj.org,
+        'secrets': toJson_FirestartrGithubOrganizationSecretSectionSpecSecrets(obj.secrets),
+        'context': toJson_FirestartrGithubOrganizationSecretSectionSpecContext(obj.context),
+        'firestartr': toJson_FirestartrGithubOrganizationSecretSectionSpecFirestartr(obj.firestartr),
+        'writeConnectionSecretToRef': toJson_FirestartrGithubOrganizationSecretSectionSpecWriteConnectionSecretToRef(obj.writeConnectionSecretToRef),
+    };
+    // filter undefined values
+    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
+}
+/**
+ * Converts an object of type 'FirestartrGithubOrganizationSecretSectionSpecSecrets' to JSON representation.
+ */
+/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
+function toJson_FirestartrGithubOrganizationSecretSectionSpecSecrets(obj) {
+    if (obj === undefined) {
+        return undefined;
+    }
+    const result = {
+        'actions': obj.actions?.map(y => toJson_FirestartrGithubOrganizationSecretSectionSpecSecretsActions(y)),
+        'codespaces': obj.codespaces?.map(y => toJson_FirestartrGithubOrganizationSecretSectionSpecSecretsCodespaces(y)),
+        'dependabot': obj.dependabot?.map(y => toJson_FirestartrGithubOrganizationSecretSectionSpecSecretsDependabot(y)),
+    };
+    // filter undefined values
+    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
+}
+/**
+ * Converts an object of type 'FirestartrGithubOrganizationSecretSectionSpecContext' to JSON representation.
+ */
+/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
+function toJson_FirestartrGithubOrganizationSecretSectionSpecContext(obj) {
+    if (obj === undefined) {
+        return undefined;
+    }
+    const result = {
+        'backend': toJson_FirestartrGithubOrganizationSecretSectionSpecContextBackend(obj.backend),
+        'provider': toJson_FirestartrGithubOrganizationSecretSectionSpecContextProvider(obj.provider),
+    };
+    // filter undefined values
+    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
+}
+/**
+ * Converts an object of type 'FirestartrGithubOrganizationSecretSectionSpecFirestartr' to JSON representation.
+ */
+/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
+function toJson_FirestartrGithubOrganizationSecretSectionSpecFirestartr(obj) {
+    if (obj === undefined) {
+        return undefined;
+    }
+    const result = {
+        'tfStateKey': obj.tfStateKey,
+    };
+    // filter undefined values
+    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
+}
+/**
+ * Converts an object of type 'FirestartrGithubOrganizationSecretSectionSpecWriteConnectionSecretToRef' to JSON representation.
+ */
+/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
+function toJson_FirestartrGithubOrganizationSecretSectionSpecWriteConnectionSecretToRef(obj) {
+    if (obj === undefined) {
+        return undefined;
+    }
+    const result = {
+        'name': obj.name,
+        'outputs': obj.outputs?.map(y => toJson_FirestartrGithubOrganizationSecretSectionSpecWriteConnectionSecretToRefOutputs(y)),
+    };
+    // filter undefined values
+    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
+}
+/**
+ * Converts an object of type 'FirestartrGithubOrganizationSecretSectionSpecSecretsActions' to JSON representation.
+ */
+/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
+function toJson_FirestartrGithubOrganizationSecretSectionSpecSecretsActions(obj) {
+    if (obj === undefined) {
+        return undefined;
+    }
+    const result = {
+        'name': obj.name,
+        'ref': toJson_FirestartrGithubOrganizationSecretSectionSpecSecretsActionsRef(obj.ref),
+    };
+    // filter undefined values
+    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
+}
+/**
+ * Converts an object of type 'FirestartrGithubOrganizationSecretSectionSpecSecretsCodespaces' to JSON representation.
+ */
+/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
+function toJson_FirestartrGithubOrganizationSecretSectionSpecSecretsCodespaces(obj) {
+    if (obj === undefined) {
+        return undefined;
+    }
+    const result = {
+        'name': obj.name,
+        'ref': toJson_FirestartrGithubOrganizationSecretSectionSpecSecretsCodespacesRef(obj.ref),
+    };
+    // filter undefined values
+    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
+}
+/**
+ * Converts an object of type 'FirestartrGithubOrganizationSecretSectionSpecSecretsDependabot' to JSON representation.
+ */
+/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
+function toJson_FirestartrGithubOrganizationSecretSectionSpecSecretsDependabot(obj) {
+    if (obj === undefined) {
+        return undefined;
+    }
+    const result = {
+        'name': obj.name,
+        'ref': toJson_FirestartrGithubOrganizationSecretSectionSpecSecretsDependabotRef(obj.ref),
+    };
+    // filter undefined values
+    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
+}
+/**
+ * Converts an object of type 'FirestartrGithubOrganizationSecretSectionSpecContextBackend' to JSON representation.
+ */
+/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
+function toJson_FirestartrGithubOrganizationSecretSectionSpecContextBackend(obj) {
+    if (obj === undefined) {
+        return undefined;
+    }
+    const result = {
+        'ref': toJson_FirestartrGithubOrganizationSecretSectionSpecContextBackendRef(obj.ref),
+    };
+    // filter undefined values
+    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
+}
+/**
+ * Converts an object of type 'FirestartrGithubOrganizationSecretSectionSpecContextProvider' to JSON representation.
+ */
+/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
+function toJson_FirestartrGithubOrganizationSecretSectionSpecContextProvider(obj) {
+    if (obj === undefined) {
+        return undefined;
+    }
+    const result = {
+        'ref': toJson_FirestartrGithubOrganizationSecretSectionSpecContextProviderRef(obj.ref),
+    };
+    // filter undefined values
+    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
+}
+/**
+ * Converts an object of type 'FirestartrGithubOrganizationSecretSectionSpecWriteConnectionSecretToRefOutputs' to JSON representation.
+ */
+/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
+function toJson_FirestartrGithubOrganizationSecretSectionSpecWriteConnectionSecretToRefOutputs(obj) {
+    if (obj === undefined) {
+        return undefined;
+    }
+    const result = {
+        'key': obj.key,
+    };
+    // filter undefined values
+    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
+}
+/**
+ * Converts an object of type 'FirestartrGithubOrganizationSecretSectionSpecSecretsActionsRef' to JSON representation.
+ */
+/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
+function toJson_FirestartrGithubOrganizationSecretSectionSpecSecretsActionsRef(obj) {
+    if (obj === undefined) {
+        return undefined;
+    }
+    const result = {
+        'kind': obj.kind,
+        'name': obj.name,
+        'key': obj.key,
+    };
+    // filter undefined values
+    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
+}
+/**
+ * Converts an object of type 'FirestartrGithubOrganizationSecretSectionSpecSecretsCodespacesRef' to JSON representation.
+ */
+/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
+function toJson_FirestartrGithubOrganizationSecretSectionSpecSecretsCodespacesRef(obj) {
+    if (obj === undefined) {
+        return undefined;
+    }
+    const result = {
+        'kind': obj.kind,
+        'name': obj.name,
+        'key': obj.key,
+    };
+    // filter undefined values
+    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
+}
+/**
+ * Converts an object of type 'FirestartrGithubOrganizationSecretSectionSpecSecretsDependabotRef' to JSON representation.
+ */
+/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
+function toJson_FirestartrGithubOrganizationSecretSectionSpecSecretsDependabotRef(obj) {
+    if (obj === undefined) {
+        return undefined;
+    }
+    const result = {
+        'kind': obj.kind,
+        'name': obj.name,
+        'key': obj.key,
+    };
+    // filter undefined values
+    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
+}
+/**
+ * Converts an object of type 'FirestartrGithubOrganizationSecretSectionSpecContextBackendRef' to JSON representation.
+ */
+/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
+function toJson_FirestartrGithubOrganizationSecretSectionSpecContextBackendRef(obj) {
+    if (obj === undefined) {
+        return undefined;
+    }
+    const result = {
+        'kind': obj.kind,
+        'name': obj.name,
+    };
+    // filter undefined values
+    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
+}
+/**
+ * Converts an object of type 'FirestartrGithubOrganizationSecretSectionSpecContextProviderRef' to JSON representation.
+ */
+/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
+function toJson_FirestartrGithubOrganizationSecretSectionSpecContextProviderRef(obj) {
+    if (obj === undefined) {
+        return undefined;
+    }
+    const result = {
+        'kind': obj.kind,
+        'name': obj.name,
+    };
+    // filter undefined values
+    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
+}
+/* eslint-enable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
+/**
+ * The type of Kubernetes resource to reference.
+ *
+ * @schema FirestartrGithubOrganizationSecretSectionSpecSecretsActionsRefKind
+ */
+var FirestartrGithubOrganizationSecretSectionSpecSecretsActionsRefKind;
+(function (FirestartrGithubOrganizationSecretSectionSpecSecretsActionsRefKind) {
+    /** Secret */
+    FirestartrGithubOrganizationSecretSectionSpecSecretsActionsRefKind["SECRET"] = "Secret";
+})(FirestartrGithubOrganizationSecretSectionSpecSecretsActionsRefKind || (FirestartrGithubOrganizationSecretSectionSpecSecretsActionsRefKind = {}));
+/**
+ * The type of Kubernetes resource to reference.
+ *
+ * @schema FirestartrGithubOrganizationSecretSectionSpecSecretsCodespacesRefKind
+ */
+var FirestartrGithubOrganizationSecretSectionSpecSecretsCodespacesRefKind;
+(function (FirestartrGithubOrganizationSecretSectionSpecSecretsCodespacesRefKind) {
+    /** Secret */
+    FirestartrGithubOrganizationSecretSectionSpecSecretsCodespacesRefKind["SECRET"] = "Secret";
+})(FirestartrGithubOrganizationSecretSectionSpecSecretsCodespacesRefKind || (FirestartrGithubOrganizationSecretSectionSpecSecretsCodespacesRefKind = {}));
+/**
+ * The type of Kubernetes resource to reference.
+ *
+ * @schema FirestartrGithubOrganizationSecretSectionSpecSecretsDependabotRefKind
+ */
+var FirestartrGithubOrganizationSecretSectionSpecSecretsDependabotRefKind;
+(function (FirestartrGithubOrganizationSecretSectionSpecSecretsDependabotRefKind) {
+    /** Secret */
+    FirestartrGithubOrganizationSecretSectionSpecSecretsDependabotRefKind["SECRET"] = "Secret";
+})(FirestartrGithubOrganizationSecretSectionSpecSecretsDependabotRefKind || (FirestartrGithubOrganizationSecretSectionSpecSecretsDependabotRefKind = {}));
+/**
+ * @schema FirestartrGithubOrganizationSecretSectionSpecContextBackendRefKind
+ */
+var FirestartrGithubOrganizationSecretSectionSpecContextBackendRefKind;
+(function (FirestartrGithubOrganizationSecretSectionSpecContextBackendRefKind) {
+    /** FirestartrProviderConfig */
+    FirestartrGithubOrganizationSecretSectionSpecContextBackendRefKind["FIRESTARTR_PROVIDER_CONFIG"] = "FirestartrProviderConfig";
+})(FirestartrGithubOrganizationSecretSectionSpecContextBackendRefKind || (FirestartrGithubOrganizationSecretSectionSpecContextBackendRefKind = {}));
+/**
+ * @schema FirestartrGithubOrganizationSecretSectionSpecContextProviderRefKind
+ */
+var FirestartrGithubOrganizationSecretSectionSpecContextProviderRefKind;
+(function (FirestartrGithubOrganizationSecretSectionSpecContextProviderRefKind) {
+    /** FirestartrProviderConfig */
+    FirestartrGithubOrganizationSecretSectionSpecContextProviderRefKind["FIRESTARTR_PROVIDER_CONFIG"] = "FirestartrProviderConfig";
+})(FirestartrGithubOrganizationSecretSectionSpecContextProviderRefKind || (FirestartrGithubOrganizationSecretSectionSpecContextProviderRefKind = {}));
 /**
  * A resource to handle GitHub Organization Settings.
  *
@@ -327561,6 +328102,254 @@ var FirestartrGithubOrganizationSettingsSpecContextProviderRefKind;
     /** FirestartrProviderConfig */
     FirestartrGithubOrganizationSettingsSpecContextProviderRefKind["FIRESTARTR_PROVIDER_CONFIG"] = "FirestartrProviderConfig";
 })(FirestartrGithubOrganizationSettingsSpecContextProviderRefKind || (FirestartrGithubOrganizationSettingsSpecContextProviderRefKind = {}));
+/**
+ * A resource to handle GitHub Organization Actions Variables.
+ *
+ * @schema FirestartrGithubOrganizationVariableSection
+ */
+class FirestartrGithubOrganizationVariableSection extends lib.ApiObject {
+    /**
+     * Renders a Kubernetes manifest for "FirestartrGithubOrganizationVariableSection".
+     *
+     * This can be used to inline resource manifests inside other objects (e.g. as templates).
+     *
+     * @param props initialization props
+     */
+    static manifest(props) {
+        return {
+            ...FirestartrGithubOrganizationVariableSection.GVK,
+            ...toJson_FirestartrGithubOrganizationVariableSectionProps(props),
+        };
+    }
+    /**
+     * Defines a "FirestartrGithubOrganizationVariableSection" API object
+     * @param scope the scope in which to define this object
+     * @param id a scope-local name for the object
+     * @param props initialization props
+     */
+    constructor(scope, id, props) {
+        super(scope, id, {
+            ...FirestartrGithubOrganizationVariableSection.GVK,
+            ...props,
+        });
+    }
+    /**
+     * Renders the object to Kubernetes JSON.
+     */
+    toJson() {
+        const resolved = super.toJson();
+        return {
+            ...FirestartrGithubOrganizationVariableSection.GVK,
+            ...toJson_FirestartrGithubOrganizationVariableSectionProps(resolved),
+        };
+    }
+}
+/**
+ * Returns the apiVersion and kind for "FirestartrGithubOrganizationVariableSection"
+ */
+FirestartrGithubOrganizationVariableSection.GVK = {
+    apiVersion: 'firestartr.dev/v1',
+    kind: 'FirestartrGithubOrganizationVariableSection',
+};
+
+/**
+ * Converts an object of type 'FirestartrGithubOrganizationVariableSectionProps' to JSON representation.
+ */
+/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
+function toJson_FirestartrGithubOrganizationVariableSectionProps(obj) {
+    if (obj === undefined) {
+        return undefined;
+    }
+    const result = {
+        'metadata': obj.metadata,
+        'spec': toJson_FirestartrGithubOrganizationVariableSectionSpec(obj.spec),
+    };
+    // filter undefined values
+    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
+}
+/**
+ * Converts an object of type 'FirestartrGithubOrganizationVariableSectionSpec' to JSON representation.
+ */
+/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
+function toJson_FirestartrGithubOrganizationVariableSectionSpec(obj) {
+    if (obj === undefined) {
+        return undefined;
+    }
+    const result = {
+        'org': obj.org,
+        'actionsVariables': obj.actionsVariables?.map(y => toJson_FirestartrGithubOrganizationVariableSectionSpecActionsVariables(y)),
+        'context': toJson_FirestartrGithubOrganizationVariableSectionSpecContext(obj.context),
+        'firestartr': toJson_FirestartrGithubOrganizationVariableSectionSpecFirestartr(obj.firestartr),
+        'writeConnectionSecretToRef': toJson_FirestartrGithubOrganizationVariableSectionSpecWriteConnectionSecretToRef(obj.writeConnectionSecretToRef),
+    };
+    // filter undefined values
+    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
+}
+/**
+ * Converts an object of type 'FirestartrGithubOrganizationVariableSectionSpecActionsVariables' to JSON representation.
+ */
+/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
+function toJson_FirestartrGithubOrganizationVariableSectionSpecActionsVariables(obj) {
+    if (obj === undefined) {
+        return undefined;
+    }
+    const result = {
+        'name': obj.name,
+        'value': obj.value,
+        'visibility': obj.visibility,
+        'selectedRepositories': obj.selectedRepositories?.map(y => y),
+    };
+    // filter undefined values
+    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
+}
+/**
+ * Converts an object of type 'FirestartrGithubOrganizationVariableSectionSpecContext' to JSON representation.
+ */
+/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
+function toJson_FirestartrGithubOrganizationVariableSectionSpecContext(obj) {
+    if (obj === undefined) {
+        return undefined;
+    }
+    const result = {
+        'backend': toJson_FirestartrGithubOrganizationVariableSectionSpecContextBackend(obj.backend),
+        'provider': toJson_FirestartrGithubOrganizationVariableSectionSpecContextProvider(obj.provider),
+    };
+    // filter undefined values
+    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
+}
+/**
+ * Converts an object of type 'FirestartrGithubOrganizationVariableSectionSpecFirestartr' to JSON representation.
+ */
+/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
+function toJson_FirestartrGithubOrganizationVariableSectionSpecFirestartr(obj) {
+    if (obj === undefined) {
+        return undefined;
+    }
+    const result = {
+        'tfStateKey': obj.tfStateKey,
+    };
+    // filter undefined values
+    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
+}
+/**
+ * Converts an object of type 'FirestartrGithubOrganizationVariableSectionSpecWriteConnectionSecretToRef' to JSON representation.
+ */
+/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
+function toJson_FirestartrGithubOrganizationVariableSectionSpecWriteConnectionSecretToRef(obj) {
+    if (obj === undefined) {
+        return undefined;
+    }
+    const result = {
+        'name': obj.name,
+        'outputs': obj.outputs?.map(y => toJson_FirestartrGithubOrganizationVariableSectionSpecWriteConnectionSecretToRefOutputs(y)),
+    };
+    // filter undefined values
+    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
+}
+/* eslint-enable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
+/**
+ * Visibility of the variable
+ *
+ * @schema FirestartrGithubOrganizationVariableSectionSpecActionsVariablesVisibility
+ */
+var FirestartrGithubOrganizationVariableSectionSpecActionsVariablesVisibility;
+(function (FirestartrGithubOrganizationVariableSectionSpecActionsVariablesVisibility) {
+    /** all */
+    FirestartrGithubOrganizationVariableSectionSpecActionsVariablesVisibility["ALL"] = "all";
+    /** private */
+    FirestartrGithubOrganizationVariableSectionSpecActionsVariablesVisibility["PRIVATE"] = "private";
+    /** selected */
+    FirestartrGithubOrganizationVariableSectionSpecActionsVariablesVisibility["SELECTED"] = "selected";
+})(FirestartrGithubOrganizationVariableSectionSpecActionsVariablesVisibility || (FirestartrGithubOrganizationVariableSectionSpecActionsVariablesVisibility = {}));
+/**
+ * Converts an object of type 'FirestartrGithubOrganizationVariableSectionSpecContextBackend' to JSON representation.
+ */
+/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
+function toJson_FirestartrGithubOrganizationVariableSectionSpecContextBackend(obj) {
+    if (obj === undefined) {
+        return undefined;
+    }
+    const result = {
+        'ref': toJson_FirestartrGithubOrganizationVariableSectionSpecContextBackendRef(obj.ref),
+    };
+    // filter undefined values
+    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
+}
+/**
+ * Converts an object of type 'FirestartrGithubOrganizationVariableSectionSpecContextProvider' to JSON representation.
+ */
+/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
+function toJson_FirestartrGithubOrganizationVariableSectionSpecContextProvider(obj) {
+    if (obj === undefined) {
+        return undefined;
+    }
+    const result = {
+        'ref': toJson_FirestartrGithubOrganizationVariableSectionSpecContextProviderRef(obj.ref),
+    };
+    // filter undefined values
+    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
+}
+/**
+ * Converts an object of type 'FirestartrGithubOrganizationVariableSectionSpecWriteConnectionSecretToRefOutputs' to JSON representation.
+ */
+/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
+function toJson_FirestartrGithubOrganizationVariableSectionSpecWriteConnectionSecretToRefOutputs(obj) {
+    if (obj === undefined) {
+        return undefined;
+    }
+    const result = {
+        'key': obj.key,
+    };
+    // filter undefined values
+    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
+}
+/**
+ * Converts an object of type 'FirestartrGithubOrganizationVariableSectionSpecContextBackendRef' to JSON representation.
+ */
+/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
+function toJson_FirestartrGithubOrganizationVariableSectionSpecContextBackendRef(obj) {
+    if (obj === undefined) {
+        return undefined;
+    }
+    const result = {
+        'kind': obj.kind,
+        'name': obj.name,
+    };
+    // filter undefined values
+    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
+}
+/**
+ * Converts an object of type 'FirestartrGithubOrganizationVariableSectionSpecContextProviderRef' to JSON representation.
+ */
+/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
+function toJson_FirestartrGithubOrganizationVariableSectionSpecContextProviderRef(obj) {
+    if (obj === undefined) {
+        return undefined;
+    }
+    const result = {
+        'kind': obj.kind,
+        'name': obj.name,
+    };
+    // filter undefined values
+    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
+}
+/* eslint-enable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
+/**
+ * @schema FirestartrGithubOrganizationVariableSectionSpecContextBackendRefKind
+ */
+var FirestartrGithubOrganizationVariableSectionSpecContextBackendRefKind;
+(function (FirestartrGithubOrganizationVariableSectionSpecContextBackendRefKind) {
+    /** FirestartrProviderConfig */
+    FirestartrGithubOrganizationVariableSectionSpecContextBackendRefKind["FIRESTARTR_PROVIDER_CONFIG"] = "FirestartrProviderConfig";
+})(FirestartrGithubOrganizationVariableSectionSpecContextBackendRefKind || (FirestartrGithubOrganizationVariableSectionSpecContextBackendRefKind = {}));
+/**
+ * @schema FirestartrGithubOrganizationVariableSectionSpecContextProviderRefKind
+ */
+var FirestartrGithubOrganizationVariableSectionSpecContextProviderRefKind;
+(function (FirestartrGithubOrganizationVariableSectionSpecContextProviderRefKind) {
+    /** FirestartrProviderConfig */
+    FirestartrGithubOrganizationVariableSectionSpecContextProviderRefKind["FIRESTARTR_PROVIDER_CONFIG"] = "FirestartrProviderConfig";
+})(FirestartrGithubOrganizationVariableSectionSpecContextProviderRefKind || (FirestartrGithubOrganizationVariableSectionSpecContextProviderRefKind = {}));
 /**
  * A resource to handle GitHub Organization Webhooks
  *
@@ -330410,6 +331199,120 @@ class GithubOrgSettingsChart extends BaseGithubChart {
     }
 }
 
+;// CONCATENATED MODULE: ../cdk8s_renderer/src/charts/github/orgVariableSectionChart.ts
+
+
+
+class GithubOrgVariableSectionChart extends BaseGithubChart {
+    template() {
+        const claim = this.get('claim');
+        const firestartrId = this.get('firestartrId');
+        const githubProvider = claim.providers.github;
+        const actionsVariables = (githubProvider.actions_variables || []).map((v) => {
+            const entry = {
+                name: v.name,
+                value: v.value,
+                visibility: v.visibility,
+            };
+            if (v.selected_repositories && v.selected_repositories.length > 0) {
+                entry.selectedRepositories = v.selected_repositories.map((ref) => {
+                    const match = ref.match(/^component:(.+)$/);
+                    if (!match) {
+                        throw new ChartRenderError('OrgSettingsClaim', claim.name, `Invalid component ref "${ref}" in selected_repositories. Expected format: component:<name>`);
+                    }
+                    const componentName = match[1];
+                    const resolvedCr = this.refResolver('ComponentClaim', componentName);
+                    const org = resolvedCr?.spec?.org;
+                    const repoName = resolvedCr?.metadata?.annotations?.['firestartr.dev/external-name'] || resolvedCr?.metadata?.name?.replace(/-[0-9a-f-]{36}$/, '');
+                    if (!org || !repoName) {
+                        throw new ChartRenderError('OrgSettingsClaim', claim.name, `Referenced component "${componentName}" has no GitHub provider configured`);
+                    }
+                    return `${org}/${repoName}`;
+                });
+            }
+            return entry;
+        });
+        const template = {
+            metadata: {
+                name: githubProvider.name,
+            },
+            spec: {
+                org: githubProvider.org,
+                actionsVariables,
+                firestartr: {
+                    tfStateKey: firestartrId,
+                },
+                writeConnectionSecretToRef: {
+                    name: `firestartrgithuborganizationvariablesection-${githubProvider.name}-outputs`.toLowerCase(),
+                    outputs: [{ key: 'managed_variables' }, { key: 'variable_ids' }],
+                },
+            },
+        };
+        return JSON.parse(JSON.stringify(template));
+    }
+    gvk() {
+        return FirestartrGithubOrganizationVariableSection.GVK;
+    }
+    instanceApiObject(template) {
+        return new FirestartrGithubOrganizationVariableSection(this, template.metadata.name, template);
+    }
+}
+
+;// CONCATENATED MODULE: ../cdk8s_renderer/src/charts/github/orgSecretSectionChart.ts
+
+
+class GithubOrgSecretSectionChart extends BaseGithubChart {
+    template() {
+        const claim = this.get('claim');
+        const firestartrId = this.get('firestartrId');
+        const githubProvider = claim.providers.github;
+        const orgSecrets = githubProvider.org_secrets || {};
+        const renderSecrets = (section) => {
+            const secrets = orgSecrets[section];
+            if (!Array.isArray(secrets))
+                return [];
+            return secrets.map((secret) => {
+                const parts = secret.value.split(':');
+                return {
+                    name: secret.name,
+                    ref: {
+                        kind: 'Secret',
+                        name: parts[2],
+                        key: parts[3],
+                    },
+                };
+            });
+        };
+        const template = {
+            metadata: {
+                name: `${githubProvider.name}-secrets`,
+            },
+            spec: {
+                org: githubProvider.org,
+                secrets: {
+                    actions: renderSecrets('actions'),
+                    codespaces: renderSecrets('codespaces'),
+                    dependabot: renderSecrets('dependabot'),
+                },
+                firestartr: {
+                    tfStateKey: firestartrId ? `${firestartrId}-secrets` : firestartrId,
+                },
+                writeConnectionSecretToRef: {
+                    name: `firestartrgithuborganizationsecretsection-${githubProvider.name}-outputs`.toLowerCase(),
+                    outputs: [{ key: 'managed_secrets' }, { key: 'secret_ids' }],
+                },
+            },
+        };
+        return JSON.parse(JSON.stringify(template));
+    }
+    gvk() {
+        return FirestartrGithubOrganizationSecretSection.GVK;
+    }
+    instanceApiObject(template) {
+        return new FirestartrGithubOrganizationSecretSection(this, template.metadata.name, template);
+    }
+}
+
 ;// CONCATENATED MODULE: ../cdk8s_renderer/src/charts/github/index.ts
 
 
@@ -330417,6 +331320,8 @@ class GithubOrgSettingsChart extends BaseGithubChart {
 
 
 
+
+
 ;// CONCATENATED MODULE: ../cdk8s_renderer/src/charts/catalog/base.ts
 
 class BaseCatalogChart extends BaseChart {
@@ -331164,6 +332069,8 @@ class SecretsChart extends BaseSecretsChart {
     SecretsChart: SecretsChart,
     GithubOrgWebhookChart: GithubOrgWebhookChart,
     GithubOrgSettingsChart: GithubOrgSettingsChart,
+    GithubOrgVariableSectionChart: GithubOrgVariableSectionChart,
+    GithubOrgSecretSectionChart: GithubOrgSecretSectionChart,
 });
 
 ;// CONCATENATED MODULE: ../cdk8s_renderer/src/renderer/claims-render.ts
@@ -331208,13 +332115,28 @@ async function renderClaims(catalogScope, firestartrScope, data) {
             if (configuredProvider !== AllowedProviders.all.toString()) {
                 providers = providers.filter((provider) => provider === configuredProvider);
             }
-            const previousCR = getPreviousCRfromClaim(claim, crs);
+            const expectedKind = claim.kind === 'OrgSettingsClaim'
+                ? 'FirestartrGithubOrganizationSettings'
+                : undefined;
+            const previousCR = getPreviousCRfromClaim(claim, crs, expectedKind);
+            const variableSectionPreviousCR = claim.kind === 'OrgSettingsClaim'
+                ? getPreviousCRfromClaim({ kind: claim.kind, name: `${claim.name}-variable-section` }, crs, 'FirestartrGithubOrganizationVariableSection')
+                : false;
+            const secretSectionPreviousCR = claim.kind === 'OrgSettingsClaim'
+                ? getPreviousCRfromClaim({ kind: claim.kind, name: `${claim.name}-secret-section` }, crs, 'FirestartrGithubOrganizationSecretSection')
+                : false;
             const patches = await extractPatches(renderClaims[claimKey], previousCR);
+            let variableSectionPatches = undefined;
+            let secretSectionPatches = undefined;
+            if (claim.kind === 'OrgSettingsClaim') {
+                variableSectionPatches = await extractPatches(renderClaims[claimKey], variableSectionPreviousCR);
+                secretSectionPatches = await extractPatches(renderClaims[claimKey], secretSectionPreviousCR);
+            }
             if (!previousCR) {
                 logger.debug(`No CR found for claim ${claimKey}, it will be rendered from scratch`);
             }
             const claimPath = renderClaims[claimKey].claimPath;
-            const { firestartrEntity, extraCharts, catalogEntity } = await renderClaim(catalogScope, firestartrScope, claim, patches, previousCR, claimPath);
+            const { firestartrEntity, extraCharts, catalogEntity } = await renderClaim(catalogScope, firestartrScope, claim, patches, previousCR, claimPath, variableSectionPreviousCR, variableSectionPatches, secretSectionPreviousCR, secretSectionPatches);
             if (catalogEntity) {
                 result[`${catalogEntity.kind}-${catalogEntity.metadata.name}`] =
                     catalogEntity.toJson();
@@ -331243,7 +332165,7 @@ async function renderClaims(catalogScope, firestartrScope, data) {
     }
     return result;
 }
-async function renderClaim(catalogScope, firestartrScope, claim, patches, previousCR = null, claimPath) {
+async function renderClaim(catalogScope, firestartrScope, claim, patches, previousCR = null, claimPath, variableSectionPreviousCR = false, variableSectionPatches, secretSectionPreviousCR = false, secretSectionPatches) {
     let catalogEntity = undefined;
     let firestartrEntity = undefined;
     const extraCharts = [];
@@ -331391,6 +332313,48 @@ async function renderClaim(catalogScope, firestartrScope, claim, patches, previo
         case 'OrgSettingsClaim':
             if (loadGithub) {
                 firestartrEntity = new charts.GithubOrgSettingsChart(firestartrScope, `github-${chartId}`, firestartrId, claim, renderPatches);
+                const variableSectionFirestartrId = variableSectionPreviousCR
+                    ? variableSectionPreviousCR.spec?.firestartr?.tfStateKey
+                    : firestartrId
+                        ? `${firestartrId}-variables`
+                        : null;
+                const vsRenderPatches = variableSectionPatches
+                    ? variableSectionPatches.filter((patch) => !patch.isPostPatch)
+                    : renderPatches;
+                const vsPostPatches = variableSectionPatches
+                    ? variableSectionPatches.filter((patch) => patch.isPostPatch)
+                    : postPatches;
+                const variableSectionChart = new charts.GithubOrgVariableSectionChart(firestartrScope, `github-variables-${chartId}`, variableSectionFirestartrId, claim, vsRenderPatches);
+                await variableSectionChart.render();
+                const variableSectionObject = await variableSectionChart.postRenderer(vsPostPatches);
+                extraCharts.push({
+                    claim: {
+                        kind: claim.kind,
+                        name: `${claim.name}-variable-section`,
+                    },
+                    chart: variableSectionObject,
+                });
+                const secretSectionFirestartrId = secretSectionPreviousCR
+                    ? secretSectionPreviousCR.spec?.firestartr?.tfStateKey
+                    : firestartrId
+                        ? `${firestartrId}-secrets`
+                        : null;
+                const ssRenderPatches = secretSectionPatches
+                    ? secretSectionPatches.filter((patch) => !patch.isPostPatch)
+                    : renderPatches;
+                const ssPostPatches = secretSectionPatches
+                    ? secretSectionPatches.filter((patch) => patch.isPostPatch)
+                    : postPatches;
+                const secretSectionChart = new charts.GithubOrgSecretSectionChart(firestartrScope, `github-secrets-${chartId}`, secretSectionFirestartrId, claim, ssRenderPatches);
+                await secretSectionChart.render();
+                const secretSectionObject = await secretSectionChart.postRenderer(ssPostPatches);
+                extraCharts.push({
+                    claim: {
+                        kind: claim.kind,
+                        name: `${claim.name}-secret-section`,
+                    },
+                    chart: secretSectionObject,
+                });
             }
             break;
         default:
@@ -331555,6 +332519,205 @@ function validateGithubOrgSettingsSingleton(crs) {
     }
 }
 
+;// CONCATENATED MODULE: ../cdk8s_renderer/src/validations/githubOrgVariableSection.ts
+const GITHUB_ORG_VARIABLE_SECTION_KIND = 'FirestartrGithubOrganizationVariableSection';
+const githubOrgVariableSection_FIRESTARTR_CLAIM_REF_ANNOTATION = 'firestartr.dev/claim-ref';
+const githubOrgVariableSection_CLAIM_REF_LABEL = 'claim-ref';
+const COMPONENT_REF_PATTERN = /^component:(.+)$/;
+function githubOrgVariableSection_formatResourceRef(name, claimRef) {
+    return claimRef ? `${name} (claim: ${claimRef})` : name;
+}
+function validateGithubOrgVariableSectionSingleton(crs) {
+    const refsByOrg = new Map();
+    const seenClaimRefs = new Map();
+    for (const crKey of Object.keys(crs)) {
+        const cr = crs[crKey];
+        if (cr.kind !== GITHUB_ORG_VARIABLE_SECTION_KIND)
+            continue;
+        const org = cr.spec?.org;
+        if (typeof org !== 'string' || !org)
+            continue;
+        const name = cr.metadata?.name || crKey;
+        const claimRef = cr.metadata?.annotations?.[githubOrgVariableSection_FIRESTARTR_CLAIM_REF_ANNOTATION] ||
+            cr.metadata?.labels?.[githubOrgVariableSection_CLAIM_REF_LABEL];
+        const normalizedOrg = org.toLowerCase();
+        if (claimRef) {
+            const seen = seenClaimRefs.get(normalizedOrg) || new Set();
+            if (seen.has(claimRef))
+                continue;
+            seen.add(claimRef);
+            seenClaimRefs.set(normalizedOrg, seen);
+        }
+        const refs = refsByOrg.get(normalizedOrg) || [];
+        refs.push(githubOrgVariableSection_formatResourceRef(name, claimRef));
+        refsByOrg.set(normalizedOrg, refs);
+    }
+    for (const [org, refs] of refsByOrg.entries()) {
+        if (refs.length < 2)
+            continue;
+        throw new Error(`Duplicate ${GITHUB_ORG_VARIABLE_SECTION_KIND} resources found for GitHub organization "${org}": ${refs.join(', ')}`);
+    }
+}
+function validateActionsVariablesUniqueness(crs) {
+    for (const crKey of Object.keys(crs)) {
+        const cr = crs[crKey];
+        if (cr.kind !== GITHUB_ORG_VARIABLE_SECTION_KIND)
+            continue;
+        const actionsVariables = cr.spec?.actionsVariables;
+        if (!Array.isArray(actionsVariables))
+            continue;
+        const names = new Set();
+        for (const variable of actionsVariables) {
+            const varName = variable?.name;
+            if (!varName)
+                continue;
+            if (names.has(varName)) {
+                const org = cr.spec?.org || 'unknown';
+                throw new Error(`Duplicate action variable name "${varName}" found in ${GITHUB_ORG_VARIABLE_SECTION_KIND} for organization "${org}"`);
+            }
+            names.add(varName);
+        }
+    }
+}
+function validateActionsVariablesSelectedRepositories(renderClaims) {
+    for (const claimKey of Object.keys(renderClaims)) {
+        if (!claimKey.startsWith('OrgSettingsClaim-'))
+            continue;
+        const claimData = renderClaims[claimKey];
+        const claim = claimData?.claim;
+        const actionsVariables = claim?.providers?.github?.actions_variables;
+        if (!Array.isArray(actionsVariables))
+            continue;
+        for (const variable of actionsVariables) {
+            if (variable.visibility !== 'selected')
+                continue;
+            const selectedRepos = variable.selected_repositories;
+            if (!Array.isArray(selectedRepos) || selectedRepos.length === 0)
+                continue;
+            for (const ref of selectedRepos) {
+                const match = ref.match(COMPONENT_REF_PATTERN);
+                if (!match)
+                    continue;
+                const componentName = match[1];
+                const expectedKey = `ComponentClaim-${componentName}`;
+                if (!renderClaims[expectedKey]) {
+                    throw new Error(`CrossReference error: OrgSettingsClaim/${claim.name} references a non-existent component "${componentName}" in actions_variables.${variable.name}.selected_repositories`);
+                }
+            }
+        }
+    }
+}
+
+;// CONCATENATED MODULE: ../cdk8s_renderer/src/validations/githubOrgSecretSection.ts
+const GITHUB_ORG_SECRET_SECTION_KIND = 'FirestartrGithubOrganizationSecretSection';
+const githubOrgSecretSection_FIRESTARTR_CLAIM_REF_ANNOTATION = 'firestartr.dev/claim-ref';
+const githubOrgSecretSection_CLAIM_REF_LABEL = 'claim-ref';
+const SECRETS_CLAIM_REF_PATTERN = /^ref:secretsclaim:([a-zA-Z0-9_-]+):([a-zA-Z0-9_-]+)$/;
+function githubOrgSecretSection_formatResourceRef(name, claimRef) {
+    return claimRef ? `${name} (claim: ${claimRef})` : name;
+}
+function validateGithubOrgSecretSectionSingleton(crs) {
+    const refsByOrg = new Map();
+    const seenClaimRefs = new Map();
+    for (const crKey of Object.keys(crs)) {
+        const cr = crs[crKey];
+        if (cr.kind !== GITHUB_ORG_SECRET_SECTION_KIND)
+            continue;
+        const org = cr.spec?.org;
+        if (typeof org !== 'string' || !org)
+            continue;
+        const name = cr.metadata?.name || crKey;
+        const claimRef = cr.metadata?.annotations?.[githubOrgSecretSection_FIRESTARTR_CLAIM_REF_ANNOTATION] ||
+            cr.metadata?.labels?.[githubOrgSecretSection_CLAIM_REF_LABEL];
+        const normalizedOrg = org.toLowerCase();
+        if (claimRef) {
+            const seen = seenClaimRefs.get(normalizedOrg) || new Set();
+            if (seen.has(claimRef))
+                continue;
+            seen.add(claimRef);
+            seenClaimRefs.set(normalizedOrg, seen);
+        }
+        const refs = refsByOrg.get(normalizedOrg) || [];
+        refs.push(githubOrgSecretSection_formatResourceRef(name, claimRef));
+        refsByOrg.set(normalizedOrg, refs);
+    }
+    for (const [org, refs] of refsByOrg.entries()) {
+        if (refs.length < 2)
+            continue;
+        throw new Error(`Duplicate ${GITHUB_ORG_SECRET_SECTION_KIND} resources found for GitHub organization "${org}": ${refs.join(', ')}`);
+    }
+}
+function validateSecretNamesUniqueness(crs) {
+    for (const crKey of Object.keys(crs)) {
+        const cr = crs[crKey];
+        if (cr.kind !== GITHUB_ORG_SECRET_SECTION_KIND)
+            continue;
+        const secrets = cr.spec?.secrets;
+        if (!secrets || typeof secrets !== 'object')
+            continue;
+        for (const section of ['actions', 'codespaces', 'dependabot']) {
+            const sectionSecrets = secrets[section];
+            if (!Array.isArray(sectionSecrets))
+                continue;
+            const names = new Set();
+            for (const secret of sectionSecrets) {
+                const secretName = secret?.name;
+                if (!secretName)
+                    continue;
+                if (names.has(secretName)) {
+                    const org = cr.spec?.org || 'unknown';
+                    throw new Error(`Duplicate secret name "${secretName}" found in ${section} section of ${GITHUB_ORG_SECRET_SECTION_KIND} for organization "${org}"`);
+                }
+                names.add(secretName);
+            }
+        }
+    }
+}
+function validateOrgSecretsCrossReferences(renderClaims) {
+    for (const claimKey of Object.keys(renderClaims)) {
+        if (!claimKey.startsWith('OrgSettingsClaim-'))
+            continue;
+        const claimData = renderClaims[claimKey];
+        const claim = claimData?.claim;
+        const orgSecrets = claim?.providers?.github?.org_secrets;
+        if (!orgSecrets || typeof orgSecrets !== 'object')
+            continue;
+        for (const section of ['actions', 'codespaces', 'dependabot']) {
+            const secrets = orgSecrets[section];
+            if (!Array.isArray(secrets))
+                continue;
+            for (const secret of secrets) {
+                if (!secret.value)
+                    continue;
+                const match = secret.value.match(SECRETS_CLAIM_REF_PATTERN);
+                if (!match)
+                    continue;
+                const [, secretClaimName, secretKey] = match;
+                const expectedKey = `SecretsClaim-${secretClaimName}`;
+                if (!renderClaims[expectedKey])
+                    continue;
+                const secretClaim = renderClaims[expectedKey]?.claim;
+                const externalSecrets = secretClaim?.providers?.external_secrets?.externalSecrets?.secrets;
+                const pushSecrets = secretClaim?.providers?.external_secrets?.pushSecrets;
+                let keyFound = false;
+                if (Array.isArray(pushSecrets)) {
+                    keyFound =
+                        pushSecrets.find((s) => s.secretName === secretKey) !==
+                            undefined;
+                }
+                if (!keyFound && Array.isArray(externalSecrets)) {
+                    keyFound =
+                        externalSecrets.find((s) => s.secretName === secretKey) !==
+                            undefined;
+                }
+                if (!keyFound) {
+                    throw new Error(`CrossReference error: OrgSettingsClaim/${claim.name} references a non-existent secret key "${secretKey}" in SecretsClaim/${secretClaimName} via org_secrets.${section}.${secret.name}`);
+                }
+            }
+        }
+    }
+}
+
 ;// CONCATENATED MODULE: ../cdk8s_renderer/src/renderer/renderer.ts
 
 
@@ -331565,6 +332728,8 @@ function validateGithubOrgSettingsSingleton(crs) {
 
 
 
+
+
 /*
  * Function called when rendering but not importing
  *
@@ -331586,8 +332751,14 @@ async function renderer_render(catalogScope, firestartrScope, claimList) {
     try {
         validateSubReferences(data.renderClaims);
         validateComponentPagesPath(data.renderClaims);
+        validateActionsVariablesSelectedRepositories(data.renderClaims);
+        validateOrgSecretsCrossReferences(data.renderClaims);
         validateTfStateKeyUniqueness(result);
         validateGithubOrgSettingsSingleton(fullCrSet);
+        validateGithubOrgVariableSectionSingleton(fullCrSet);
+        validateActionsVariablesUniqueness(result);
+        validateGithubOrgSecretSectionSingleton(fullCrSet);
+        validateSecretNamesUniqueness(result);
         validateCrSizes(result);
         validatePermissionsUniqueness(result);
     }
@@ -333919,6 +335090,7 @@ const kindPluralMap = {
     terraformmodules: 'FirestartrTerraformModule',
     githuborgwebhooks: 'FirestartrGithubOrgWebhook',
     githuborganizationsettings: 'FirestartrGithubOrganizationSettings',
+    githuborganizationvariablesections: 'FirestartrGithubOrganizationVariableSection',
     terraformworkspaces: 'FirestartrTerraformWorkspace',
     terraformworkspaceplans: 'FirestartrTerraformWorkspacePlan',
     providerconfigs: 'FirestartrProviderConfig',
@@ -335896,6 +337068,7 @@ const kindsWithFinalizer = [
     'FirestartrGithubRepositoryFeature',
     'FirestartrGithubOrgWebhook',
     'FirestartrGithubOrganizationSettings',
+    'FirestartrGithubOrganizationVariableSection',
     'FirestartrGithubRepositorySecretsSection',
 ];
 const kindsWithDependants = [
@@ -342437,6 +343610,10 @@ const MODULES = {
         // github-org-settings-v0.1.0
         ref: 'c30c5dfdaddf2bca9e966a726d45970c98576e9e',
     },
+    FirestartrGithubOrganizationVariableSection: {
+        module: 'git::https://github.com/prefapp/tfm.git//modules/github-org-variables-section',
+        ref: '79c1407',
+    },
 };
 function getFirestartrDefaultTFM(kind) {
     if (kind in MODULES) {
@@ -344239,6 +345416,94 @@ class EntityGHOrgSettings extends base_Entity {
     }
 }
 
+;// CONCATENATED MODULE: ../gh_provisioner/src/entities/ghorgvarsection/index.ts
+
+
+
+class EntityGHOrgVarsSection extends base_Entity {
+    constructor(artifact) {
+        super(artifact, {
+            config: {
+                variables: {},
+            },
+        });
+    }
+    async loadResources(tfOp) {
+        gh_provisioner_src_logger.info(`[gh-provisioner] running ${tfOp} on ${this.k8sId}`);
+        try {
+            const cr = this.cr;
+            const actionsVariables = cr.spec.actionsVariables || [];
+            const variables = {};
+            for (const v of actionsVariables) {
+                const entry = {
+                    value: v.value,
+                    visibility: v.visibility,
+                };
+                if (v.visibility === 'selected' && v.selectedRepositories) {
+                    entry.selectedRepositoryIds = v.selectedRepositories;
+                }
+                variables[v.name] = entry;
+            }
+            this.patchData({
+                op: PatchOperations.replace,
+                path: '/config/variables',
+                value: variables,
+            });
+            if (tfOp === 'apply') {
+                await this.adoptVariablesIfNeeded(actionsVariables);
+            }
+            gh_provisioner_src_logger.debug(`[gh-provisioner] ${this.k8sId} loaded its data`);
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            gh_provisioner_src_logger.error(`[gh-provisioner] ${this.k8sId} error loading resources: ${message}`);
+            throw new Error(`[gh-provisioner] ${this.k8sId} error loading resources: ${message}`);
+        }
+    }
+    async adoptVariablesIfNeeded(declaredVars) {
+        const cr = this.cr;
+        const managedVariables = this.cr.fResolveSelfOutputs('managed_variables') || [];
+        const declaredNames = declaredVars.map((v) => v.name);
+        const newToModule = declaredNames.filter((name) => !managedVariables.includes(name));
+        if (newToModule.length === 0) {
+            gh_provisioner_src_logger.debug(`[gh-provisioner] ${this.k8sId} all declared variables are already managed, no adoption needed`);
+            return;
+        }
+        if (managedVariables.length === 0) {
+            gh_provisioner_src_logger.info(`[gh-provisioner] ${this.k8sId} no managed_variables output — first reconciliation, treating all ${newToModule.length} declared variable(s) as new to module`);
+        }
+        for (const varName of newToModule) {
+            try {
+                await this.runWithGithubProvider(async () => {
+                    await github["default"].org.getOrgVariable(cr.spec.org, varName);
+                });
+                gh_provisioner_src_logger.info(`[gh-provisioner] ${this.k8sId} adopting pre-existing variable '${varName}' on GitHub org '${cr.spec.org}'`);
+                this.patchImportData({
+                    op: PatchOperations.add,
+                    path: '/imports/-',
+                    value: {
+                        to: `github_actions_organization_variable.this["${varName}"]`,
+                        id: varName,
+                    },
+                });
+            }
+            catch (err) {
+                if (err && err.status === 404) {
+                    gh_provisioner_src_logger.info(`[gh-provisioner] ${this.k8sId} variable '${varName}' not found on GitHub org '${cr.spec.org}' — will be created by TFM`);
+                }
+                else if (err && (err.status === 401 || err.status === 403)) {
+                    gh_provisioner_src_logger.warn(`[gh-provisioner] ${this.k8sId} token lacks scope to check variable '${varName}' on org '${cr.spec.org}' — skipping adoption gracefully`);
+                }
+                else {
+                    gh_provisioner_src_logger.error(`[gh-provisioner] ${this.k8sId} unexpected error checking variable '${varName}' on org '${cr.spec.org}': ${err instanceof Error ? err.message : String(err)}`);
+                }
+            }
+        }
+    }
+    async postProvision(tfOp) { }
+    async loadAddressesToImport() { }
+}
+
 ;// CONCATENATED MODULE: ../gh_provisioner/src/entities/ghorgwebhook/index.ts
 
 
@@ -344315,6 +345580,7 @@ class EntityGHOrgWebHook extends base_Entity {
 
 
 
+
 function entities_getEntity(cr) {
     const entityClass = getEntityClass(cr.kind);
     return new entityClass(cr);
@@ -344335,6 +345601,8 @@ function getEntityClass(kind) {
             return EntityGHOrgWebHook;
         case 'FirestartrGithubOrganizationSettings':
             return EntityGHOrgSettings;
+        case 'FirestartrGithubOrganizationVariableSection':
+            return EntityGHOrgVarsSection;
         default:
             throw new Error(`kind ${kind} has no entity associated`);
     }
@@ -344748,6 +346016,7 @@ const GITHUB_RESOURCE_KINDS = [
     'FirestartrGithubRepositorySecretsSection',
     'FirestartrGithubOrgWebhook',
     'FirestartrGithubOrganizationSettings',
+    'FirestartrGithubOrganizationVariableSection',
 ];
 const GITHUB_REPOSITORY_DEPENDENT_KINDS = [
     'FirestartrGithubRepositoryFeature',
@@ -346006,6 +347275,9 @@ function isObserveModeActive() {
 function runOperator(opts) {
     const { ignoreLease, dummyExec, namespace, kindList, importMode, importModeSkipPlan, observeMode, withMetrics, } = opts;
     const implementedKinds = filterImplementedKinds(kindList);
+    operator_src_logger.info(`operator kindList: ${JSON.stringify(kindList)}`);
+    operator_src_logger.info(`operator implementedKinds: ${JSON.stringify(implementedKinds)}`);
+    operator_src_logger.info(`operator ignoring kinds: ${JSON.stringify(kindList.filter((k) => !implementedKinds.includes(k)))}`);
     if (observeMode)
         observeModeActive = true;
     if (withMetrics)
@@ -346079,6 +347351,7 @@ const provisionImplementations = {
     githubmemberships: process_operation_processOperation,
     githuborgwebhooks: process_operation_processOperation,
     githuborganizationsettings: process_operation_processOperation,
+    githuborganizationvariablesections: process_operation_processOperation,
     fsdummiesa: processFirestartrDummies,
     fsdummiesb: processFirestartrDummies,
     fsdummiesc: processFirestartrDummies,
@@ -524897,7 +526170,7 @@ const crsStatusSubcommand = {
 };
 
 ;// CONCATENATED MODULE: ./package.json
-const package_namespaceObject = {"i8":"2.9.0"};
+const package_namespaceObject = JSON.parse('{"i8":"2.10.0-snapshot-org-secrets-1"}');
 ;// CONCATENATED MODULE: ../../package.json
 const package_namespaceObject_1 = {"i8":"2.9.0"};
 // EXTERNAL MODULE: ../../node_modules/semver/index.js