@firestartr/cli 3.2.0-snapshot-01 → 3.2.0-snapshot-02

package/build/index.js

@@ -120985,7 +120985,7 @@ function getCronNextInterval(cronLine, tz) {
 
 /***/ }),
 
-/***/ 44912:
+/***/ 37524:
 /***/ ((__unused_webpack_module, __webpack_exports__, __nccwpck_require__) => {
 
 // ESM COMPAT FLAG
@@ -126680,6 +126680,66 @@ async function encryptRepoSecret(owner, repo, section, plaintextValue, octokit)
     }
 }
 
+;// CONCATENATED MODULE: ../github/src/orgSecrets.ts
+
+
+
+async function getOrgPublicKey(org, section, octokit) {
+    logger.info(`Retrieving org public key for ${org} (${section})`);
+    try {
+        if (!octokit) {
+            octokit = await getOctokitForOrg(org);
+        }
+        const { data } = await octokit.rest[`${section}`].getOrgPublicKey({
+            org,
+        });
+        return data;
+    }
+    catch (error) {
+        logger.error(`Error retrieving org public key (${section}) for ${org}: ${error}`);
+        throw error;
+    }
+}
+async function encryptOrgSecret(org, section, plaintextValue, preFetchedKey, octokit) {
+    try {
+        const { key_id, key } = preFetchedKey
+            ? preFetchedKey
+            : await getOrgPublicKey(org, section, octokit);
+        await libsodium_wrappers.ready;
+        const publicKey = libsodium_wrappers.from_base64(key, libsodium_wrappers.base64_variants.ORIGINAL);
+        const secretBytes = libsodium_wrappers.from_string(plaintextValue);
+        const encryptedBytes = libsodium_wrappers.crypto_box_seal(secretBytes, publicKey);
+        const encryptedValue = libsodium_wrappers.to_base64(encryptedBytes, libsodium_wrappers.base64_variants.ORIGINAL);
+        return {
+            key_id,
+            encrypted_value: encryptedValue,
+        };
+    }
+    catch (err) {
+        logger.error(`Error encrypting org secret (${section}) for ${org}: ${err}`);
+        throw err;
+    }
+}
+async function getOrgSecret(org, section, name, octokit) {
+    logger.info(`Checking org secret ${name} (${section}) for ${org}`);
+    try {
+        if (!octokit) {
+            octokit = await getOctokitForOrg(org);
+        }
+        const response = await octokit.rest[`${section}`].getOrgSecret({
+            org,
+            secret_name: name,
+        });
+        return response.data;
+    }
+    catch (err) {
+        if (err && err.status === 404) {
+            return null;
+        }
+        throw err;
+    }
+}
+
 ;// CONCATENATED MODULE: ../github/src/profile.ts
 // Profile definitions and store for github package (immutable and ambient profiles)
 const profileStore = new Map();
@@ -127114,6 +127174,7 @@ function withProfile(profileName) {
 
 
 
+
 /* harmony default export */ const github = ({
     org: organization,
     repo: repository,
@@ -127136,6 +127197,9 @@ function withProfile(profileName) {
     encryption: {
         encryptRepoSecret: encryptRepoSecret,
         getRepoPublicKey: getRepoPublicKey,
+        getOrgPublicKey: getOrgPublicKey,
+        encryptOrgSecret: encryptOrgSecret,
+        getOrgSecret: getOrgSecret,
     },
     withProfile: withProfile,
     createProfile: createProfile,
@@ -154116,8 +154180,8 @@ var dist = __nccwpck_require__(84553);
 var dist_default = /*#__PURE__*/__nccwpck_require__.n(dist);
 // EXTERNAL MODULE: ../catalog_common/index.ts + 44 modules
 var catalog_common = __nccwpck_require__(56618);
-// EXTERNAL MODULE: ../github/index.ts + 37 modules
-var github = __nccwpck_require__(44912);
+// EXTERNAL MODULE: ../github/index.ts + 38 modules
+var github = __nccwpck_require__(37524);
 ;// CONCATENATED MODULE: ../cdk8s_renderer/src/patches/base.ts
 class BasePatches {
     constructor() { }
@@ -157020,6 +157084,31 @@ function extractAllRefs(claimData) {
                     }
                 }
             }
+            const orgSecrets = parsedClaim.providers?.github?.org_secrets;
+            if (orgSecrets && typeof orgSecrets === 'object') {
+                const secretRefRegex = /^ref:secretsclaim:([a-zA-Z0-9_-]+):([a-zA-Z0-9_-]+)$/;
+                for (const section of ['actions', 'codespaces', 'dependabot']) {
+                    const secrets = orgSecrets[section];
+                    if (!Array.isArray(secrets))
+                        continue;
+                    for (const secret of secrets) {
+                        if (secret.value) {
+                            const match = secret.value.match(secretRefRegex);
+                            if (match) {
+                                refs.push(`SecretsClaim-${match[1]}`);
+                            }
+                        }
+                        if (Array.isArray(secret.selected_repositories)) {
+                            for (const repoRef of secret.selected_repositories) {
+                                const compMatch = repoRef.match(/^component:(.+)$/);
+                                if (compMatch) {
+                                    refs.push(`ComponentClaim-${compMatch[1]}`);
+                                }
+                            }
+                        }
+                    }
+                }
+            }
             break;
         }
     }
@@ -158178,6 +158267,30 @@ const organizationSettingsProperties = {
             ],
         },
     },
+    org_secrets: {
+        type: 'object',
+        properties: {
+            actions: {
+                type: 'array',
+                items: {
+                    $ref: 'firestartr.dev://github/GithubOrgClaimSecret',
+                },
+            },
+            codespaces: {
+                type: 'array',
+                items: {
+                    $ref: 'firestartr.dev://github/GithubOrgClaimSecret',
+                },
+            },
+            dependabot: {
+                type: 'array',
+                items: {
+                    $ref: 'firestartr.dev://github/GithubOrgClaimSecret',
+                },
+            },
+        },
+        additionalProperties: false,
+    },
 };
 /* harmony default export */ const github_orgsettings_schema = ({
     $schema: SCHEMA,
@@ -158402,6 +158515,97 @@ const organizationSettingsProperties = {
     },
 });
 
+;// CONCATENATED MODULE: ../cdk8s_renderer/src/claims/github/orgSecrets.schema.ts
+
+/* harmony default export */ const orgSecrets_schema = ({
+    $schema: SCHEMA,
+    $id: 'GithubOrgClaimSecrets',
+    definitions: {
+        GithubOrgClaimSecrets: {
+            $id: 'firestartr.dev://github/GithubOrgClaimSecrets',
+            type: 'object',
+            description: 'Organization-level GitHub Actions secrets',
+            properties: {
+                actions: {
+                    type: 'array',
+                    items: {
+                        $ref: 'firestartr.dev://github/GithubOrgClaimSecret',
+                    },
+                },
+                codespaces: {
+                    type: 'array',
+                    items: {
+                        $ref: 'firestartr.dev://github/GithubOrgClaimSecret',
+                    },
+                },
+                dependabot: {
+                    type: 'array',
+                    items: {
+                        $ref: 'firestartr.dev://github/GithubOrgClaimSecret',
+                    },
+                },
+            },
+            additionalProperties: false,
+        },
+        GithubOrgClaimSecretRef: {
+            $id: 'firestartr.dev://github/GithubOrgClaimSecretRef',
+            type: 'string',
+            description: 'the reference of the secret',
+            pattern: '^ref:secretsclaim:([a-zA-Z0-9_-]+):([a-zA-Z0-9_-]+)$',
+        },
+        GithubOrgClaimSecret: {
+            $id: 'firestartr.dev://github/GithubOrgClaimSecret',
+            type: 'object',
+            description: 'An organization-level secret for GitHub Actions',
+            properties: {
+                name: {
+                    type: 'string',
+                    description: 'the name of the secret',
+                    pattern: '^[A-Za-z0-9_]+$',
+                },
+                value: {
+                    $ref: 'firestartr.dev://github/GithubOrgClaimSecretRef',
+                },
+                visibility: {
+                    type: 'string',
+                    enum: ['all', 'selected', 'private'],
+                    description: 'which repositories can access the secret',
+                },
+                selected_repositories: {
+                    type: 'array',
+                    items: {
+                        $ref: 'firestartr.dev://common/FirestartrComponentRef',
+                    },
+                    description: 'list of repository refs when visibility is selected',
+                },
+            },
+            required: ['name', 'value'],
+            additionalProperties: false,
+            allOf: [
+                {
+                    if: {
+                        properties: {
+                            visibility: { const: 'selected' },
+                        },
+                        required: ['visibility'],
+                    },
+                    then: {
+                        required: ['selected_repositories'],
+                        properties: {
+                            selected_repositories: { type: 'array', minItems: 1 },
+                        },
+                    },
+                    else: {
+                        properties: {
+                            selected_repositories: { type: 'array', maxItems: 0 },
+                        },
+                    },
+                },
+            ],
+        },
+    },
+});
+
 ;// CONCATENATED MODULE: ../cdk8s_renderer/src/claims/github/index.ts
 
 
@@ -158412,6 +158616,7 @@ const organizationSettingsProperties = {
 
 
 
+
 const GithubSchemas = [
     github_group_schema,
     github_user_schema,
@@ -158422,6 +158627,7 @@ const GithubSchemas = [
     component_secrets_vars_schema,
     component_labels_schema,
     pages_schema,
+    orgSecrets_schema,
 ];
 
 ;// CONCATENATED MODULE: ../cdk8s_renderer/src/claims/tfworkspaces/terraform.schema.ts
@@ -163274,6 +163480,412 @@ var FirestartrGithubMembershipSpecContextProviderRefKind;
     /** FirestartrProviderConfig */
     FirestartrGithubMembershipSpecContextProviderRefKind["FIRESTARTR_PROVIDER_CONFIG"] = "FirestartrProviderConfig";
 })(FirestartrGithubMembershipSpecContextProviderRefKind || (FirestartrGithubMembershipSpecContextProviderRefKind = {}));
+/**
+ * A resource to handle GitHub Organization Actions Secrets.
+ *
+ * @schema FirestartrGithubOrganizationSecretSection
+ */
+class FirestartrGithubOrganizationSecretSection extends lib.ApiObject {
+    /**
+     * Renders a Kubernetes manifest for "FirestartrGithubOrganizationSecretSection".
+     *
+     * This can be used to inline resource manifests inside other objects (e.g. as templates).
+     *
+     * @param props initialization props
+     */
+    static manifest(props) {
+        return {
+            ...FirestartrGithubOrganizationSecretSection.GVK,
+            ...toJson_FirestartrGithubOrganizationSecretSectionProps(props),
+        };
+    }
+    /**
+     * Defines a "FirestartrGithubOrganizationSecretSection" API object
+     * @param scope the scope in which to define this object
+     * @param id a scope-local name for the object
+     * @param props initialization props
+     */
+    constructor(scope, id, props) {
+        super(scope, id, {
+            ...FirestartrGithubOrganizationSecretSection.GVK,
+            ...props,
+        });
+    }
+    /**
+     * Renders the object to Kubernetes JSON.
+     */
+    toJson() {
+        const resolved = super.toJson();
+        return {
+            ...FirestartrGithubOrganizationSecretSection.GVK,
+            ...toJson_FirestartrGithubOrganizationSecretSectionProps(resolved),
+        };
+    }
+}
+/**
+ * Returns the apiVersion and kind for "FirestartrGithubOrganizationSecretSection"
+ */
+FirestartrGithubOrganizationSecretSection.GVK = {
+    apiVersion: 'firestartr.dev/v1',
+    kind: 'FirestartrGithubOrganizationSecretSection',
+};
+
+/**
+ * Converts an object of type 'FirestartrGithubOrganizationSecretSectionProps' to JSON representation.
+ */
+/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
+function toJson_FirestartrGithubOrganizationSecretSectionProps(obj) {
+    if (obj === undefined) {
+        return undefined;
+    }
+    const result = {
+        'metadata': obj.metadata,
+        'spec': toJson_FirestartrGithubOrganizationSecretSectionSpec(obj.spec),
+    };
+    // filter undefined values
+    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
+}
+/**
+ * Converts an object of type 'FirestartrGithubOrganizationSecretSectionSpec' to JSON representation.
+ */
+/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
+function toJson_FirestartrGithubOrganizationSecretSectionSpec(obj) {
+    if (obj === undefined) {
+        return undefined;
+    }
+    const result = {
+        'org': obj.org,
+        'secrets': toJson_FirestartrGithubOrganizationSecretSectionSpecSecrets(obj.secrets),
+        'context': toJson_FirestartrGithubOrganizationSecretSectionSpecContext(obj.context),
+        'firestartr': toJson_FirestartrGithubOrganizationSecretSectionSpecFirestartr(obj.firestartr),
+        'writeConnectionSecretToRef': toJson_FirestartrGithubOrganizationSecretSectionSpecWriteConnectionSecretToRef(obj.writeConnectionSecretToRef),
+    };
+    // filter undefined values
+    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
+}
+/**
+ * Converts an object of type 'FirestartrGithubOrganizationSecretSectionSpecSecrets' to JSON representation.
+ */
+/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
+function toJson_FirestartrGithubOrganizationSecretSectionSpecSecrets(obj) {
+    if (obj === undefined) {
+        return undefined;
+    }
+    const result = {
+        'actions': obj.actions?.map(y => toJson_FirestartrGithubOrganizationSecretSectionSpecSecretsActions(y)),
+        'codespaces': obj.codespaces?.map(y => toJson_FirestartrGithubOrganizationSecretSectionSpecSecretsCodespaces(y)),
+        'dependabot': obj.dependabot?.map(y => toJson_FirestartrGithubOrganizationSecretSectionSpecSecretsDependabot(y)),
+    };
+    // filter undefined values
+    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
+}
+/**
+ * Converts an object of type 'FirestartrGithubOrganizationSecretSectionSpecContext' to JSON representation.
+ */
+/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
+function toJson_FirestartrGithubOrganizationSecretSectionSpecContext(obj) {
+    if (obj === undefined) {
+        return undefined;
+    }
+    const result = {
+        'backend': toJson_FirestartrGithubOrganizationSecretSectionSpecContextBackend(obj.backend),
+        'provider': toJson_FirestartrGithubOrganizationSecretSectionSpecContextProvider(obj.provider),
+    };
+    // filter undefined values
+    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
+}
+/**
+ * Converts an object of type 'FirestartrGithubOrganizationSecretSectionSpecFirestartr' to JSON representation.
+ */
+/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
+function toJson_FirestartrGithubOrganizationSecretSectionSpecFirestartr(obj) {
+    if (obj === undefined) {
+        return undefined;
+    }
+    const result = {
+        'tfStateKey': obj.tfStateKey,
+    };
+    // filter undefined values
+    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
+}
+/**
+ * Converts an object of type 'FirestartrGithubOrganizationSecretSectionSpecWriteConnectionSecretToRef' to JSON representation.
+ */
+/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
+function toJson_FirestartrGithubOrganizationSecretSectionSpecWriteConnectionSecretToRef(obj) {
+    if (obj === undefined) {
+        return undefined;
+    }
+    const result = {
+        'name': obj.name,
+        'outputs': obj.outputs?.map(y => toJson_FirestartrGithubOrganizationSecretSectionSpecWriteConnectionSecretToRefOutputs(y)),
+    };
+    // filter undefined values
+    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
+}
+/**
+ * Converts an object of type 'FirestartrGithubOrganizationSecretSectionSpecSecretsActions' to JSON representation.
+ */
+/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
+function toJson_FirestartrGithubOrganizationSecretSectionSpecSecretsActions(obj) {
+    if (obj === undefined) {
+        return undefined;
+    }
+    const result = {
+        'name': obj.name,
+        'ref': toJson_FirestartrGithubOrganizationSecretSectionSpecSecretsActionsRef(obj.ref),
+        'visibility': obj.visibility,
+        'selectedRepositories': obj.selectedRepositories?.map(y => y),
+    };
+    // filter undefined values
+    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
+}
+/**
+ * Converts an object of type 'FirestartrGithubOrganizationSecretSectionSpecSecretsCodespaces' to JSON representation.
+ */
+/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
+function toJson_FirestartrGithubOrganizationSecretSectionSpecSecretsCodespaces(obj) {
+    if (obj === undefined) {
+        return undefined;
+    }
+    const result = {
+        'name': obj.name,
+        'ref': toJson_FirestartrGithubOrganizationSecretSectionSpecSecretsCodespacesRef(obj.ref),
+        'visibility': obj.visibility,
+        'selectedRepositories': obj.selectedRepositories?.map(y => y),
+    };
+    // filter undefined values
+    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
+}
+/**
+ * Converts an object of type 'FirestartrGithubOrganizationSecretSectionSpecSecretsDependabot' to JSON representation.
+ */
+/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
+function toJson_FirestartrGithubOrganizationSecretSectionSpecSecretsDependabot(obj) {
+    if (obj === undefined) {
+        return undefined;
+    }
+    const result = {
+        'name': obj.name,
+        'ref': toJson_FirestartrGithubOrganizationSecretSectionSpecSecretsDependabotRef(obj.ref),
+        'visibility': obj.visibility,
+        'selectedRepositories': obj.selectedRepositories?.map(y => y),
+    };
+    // filter undefined values
+    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
+}
+/**
+ * Converts an object of type 'FirestartrGithubOrganizationSecretSectionSpecContextBackend' to JSON representation.
+ */
+/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
+function toJson_FirestartrGithubOrganizationSecretSectionSpecContextBackend(obj) {
+    if (obj === undefined) {
+        return undefined;
+    }
+    const result = {
+        'ref': toJson_FirestartrGithubOrganizationSecretSectionSpecContextBackendRef(obj.ref),
+    };
+    // filter undefined values
+    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
+}
+/**
+ * Converts an object of type 'FirestartrGithubOrganizationSecretSectionSpecContextProvider' to JSON representation.
+ */
+/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
+function toJson_FirestartrGithubOrganizationSecretSectionSpecContextProvider(obj) {
+    if (obj === undefined) {
+        return undefined;
+    }
+    const result = {
+        'ref': toJson_FirestartrGithubOrganizationSecretSectionSpecContextProviderRef(obj.ref),
+    };
+    // filter undefined values
+    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
+}
+/**
+ * Converts an object of type 'FirestartrGithubOrganizationSecretSectionSpecWriteConnectionSecretToRefOutputs' to JSON representation.
+ */
+/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
+function toJson_FirestartrGithubOrganizationSecretSectionSpecWriteConnectionSecretToRefOutputs(obj) {
+    if (obj === undefined) {
+        return undefined;
+    }
+    const result = {
+        'key': obj.key,
+    };
+    // filter undefined values
+    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
+}
+/**
+ * Converts an object of type 'FirestartrGithubOrganizationSecretSectionSpecSecretsActionsRef' to JSON representation.
+ */
+/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
+function toJson_FirestartrGithubOrganizationSecretSectionSpecSecretsActionsRef(obj) {
+    if (obj === undefined) {
+        return undefined;
+    }
+    const result = {
+        'kind': obj.kind,
+        'name': obj.name,
+        'key': obj.key,
+    };
+    // filter undefined values
+    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
+}
+/* eslint-enable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
+/**
+ * Which repositories can access the secret.
+ *
+ * @schema FirestartrGithubOrganizationSecretSectionSpecSecretsActionsVisibility
+ */
+var FirestartrGithubOrganizationSecretSectionSpecSecretsActionsVisibility;
+(function (FirestartrGithubOrganizationSecretSectionSpecSecretsActionsVisibility) {
+    /** all */
+    FirestartrGithubOrganizationSecretSectionSpecSecretsActionsVisibility["ALL"] = "all";
+    /** selected */
+    FirestartrGithubOrganizationSecretSectionSpecSecretsActionsVisibility["SELECTED"] = "selected";
+    /** private */
+    FirestartrGithubOrganizationSecretSectionSpecSecretsActionsVisibility["PRIVATE"] = "private";
+})(FirestartrGithubOrganizationSecretSectionSpecSecretsActionsVisibility || (FirestartrGithubOrganizationSecretSectionSpecSecretsActionsVisibility = {}));
+/**
+ * Converts an object of type 'FirestartrGithubOrganizationSecretSectionSpecSecretsCodespacesRef' to JSON representation.
+ */
+/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
+function toJson_FirestartrGithubOrganizationSecretSectionSpecSecretsCodespacesRef(obj) {
+    if (obj === undefined) {
+        return undefined;
+    }
+    const result = {
+        'kind': obj.kind,
+        'name': obj.name,
+        'key': obj.key,
+    };
+    // filter undefined values
+    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
+}
+/* eslint-enable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
+/**
+ * Which repositories can access the secret.
+ *
+ * @schema FirestartrGithubOrganizationSecretSectionSpecSecretsCodespacesVisibility
+ */
+var FirestartrGithubOrganizationSecretSectionSpecSecretsCodespacesVisibility;
+(function (FirestartrGithubOrganizationSecretSectionSpecSecretsCodespacesVisibility) {
+    /** all */
+    FirestartrGithubOrganizationSecretSectionSpecSecretsCodespacesVisibility["ALL"] = "all";
+    /** selected */
+    FirestartrGithubOrganizationSecretSectionSpecSecretsCodespacesVisibility["SELECTED"] = "selected";
+    /** private */
+    FirestartrGithubOrganizationSecretSectionSpecSecretsCodespacesVisibility["PRIVATE"] = "private";
+})(FirestartrGithubOrganizationSecretSectionSpecSecretsCodespacesVisibility || (FirestartrGithubOrganizationSecretSectionSpecSecretsCodespacesVisibility = {}));
+/**
+ * Converts an object of type 'FirestartrGithubOrganizationSecretSectionSpecSecretsDependabotRef' to JSON representation.
+ */
+/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
+function toJson_FirestartrGithubOrganizationSecretSectionSpecSecretsDependabotRef(obj) {
+    if (obj === undefined) {
+        return undefined;
+    }
+    const result = {
+        'kind': obj.kind,
+        'name': obj.name,
+        'key': obj.key,
+    };
+    // filter undefined values
+    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
+}
+/* eslint-enable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
+/**
+ * Which repositories can access the secret.
+ *
+ * @schema FirestartrGithubOrganizationSecretSectionSpecSecretsDependabotVisibility
+ */
+var FirestartrGithubOrganizationSecretSectionSpecSecretsDependabotVisibility;
+(function (FirestartrGithubOrganizationSecretSectionSpecSecretsDependabotVisibility) {
+    /** all */
+    FirestartrGithubOrganizationSecretSectionSpecSecretsDependabotVisibility["ALL"] = "all";
+    /** selected */
+    FirestartrGithubOrganizationSecretSectionSpecSecretsDependabotVisibility["SELECTED"] = "selected";
+    /** private */
+    FirestartrGithubOrganizationSecretSectionSpecSecretsDependabotVisibility["PRIVATE"] = "private";
+})(FirestartrGithubOrganizationSecretSectionSpecSecretsDependabotVisibility || (FirestartrGithubOrganizationSecretSectionSpecSecretsDependabotVisibility = {}));
+/**
+ * Converts an object of type 'FirestartrGithubOrganizationSecretSectionSpecContextBackendRef' to JSON representation.
+ */
+/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
+function toJson_FirestartrGithubOrganizationSecretSectionSpecContextBackendRef(obj) {
+    if (obj === undefined) {
+        return undefined;
+    }
+    const result = {
+        'kind': obj.kind,
+        'name': obj.name,
+    };
+    // filter undefined values
+    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
+}
+/**
+ * Converts an object of type 'FirestartrGithubOrganizationSecretSectionSpecContextProviderRef' to JSON representation.
+ */
+/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
+function toJson_FirestartrGithubOrganizationSecretSectionSpecContextProviderRef(obj) {
+    if (obj === undefined) {
+        return undefined;
+    }
+    const result = {
+        'kind': obj.kind,
+        'name': obj.name,
+    };
+    // filter undefined values
+    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
+}
+/* eslint-enable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
+/**
+ * The type of Kubernetes resource to reference.
+ *
+ * @schema FirestartrGithubOrganizationSecretSectionSpecSecretsActionsRefKind
+ */
+var FirestartrGithubOrganizationSecretSectionSpecSecretsActionsRefKind;
+(function (FirestartrGithubOrganizationSecretSectionSpecSecretsActionsRefKind) {
+    /** Secret */
+    FirestartrGithubOrganizationSecretSectionSpecSecretsActionsRefKind["SECRET"] = "Secret";
+})(FirestartrGithubOrganizationSecretSectionSpecSecretsActionsRefKind || (FirestartrGithubOrganizationSecretSectionSpecSecretsActionsRefKind = {}));
+/**
+ * The type of Kubernetes resource to reference.
+ *
+ * @schema FirestartrGithubOrganizationSecretSectionSpecSecretsCodespacesRefKind
+ */
+var FirestartrGithubOrganizationSecretSectionSpecSecretsCodespacesRefKind;
+(function (FirestartrGithubOrganizationSecretSectionSpecSecretsCodespacesRefKind) {
+    /** Secret */
+    FirestartrGithubOrganizationSecretSectionSpecSecretsCodespacesRefKind["SECRET"] = "Secret";
+})(FirestartrGithubOrganizationSecretSectionSpecSecretsCodespacesRefKind || (FirestartrGithubOrganizationSecretSectionSpecSecretsCodespacesRefKind = {}));
+/**
+ * The type of Kubernetes resource to reference.
+ *
+ * @schema FirestartrGithubOrganizationSecretSectionSpecSecretsDependabotRefKind
+ */
+var FirestartrGithubOrganizationSecretSectionSpecSecretsDependabotRefKind;
+(function (FirestartrGithubOrganizationSecretSectionSpecSecretsDependabotRefKind) {
+    /** Secret */
+    FirestartrGithubOrganizationSecretSectionSpecSecretsDependabotRefKind["SECRET"] = "Secret";
+})(FirestartrGithubOrganizationSecretSectionSpecSecretsDependabotRefKind || (FirestartrGithubOrganizationSecretSectionSpecSecretsDependabotRefKind = {}));
+/**
+ * @schema FirestartrGithubOrganizationSecretSectionSpecContextBackendRefKind
+ */
+var FirestartrGithubOrganizationSecretSectionSpecContextBackendRefKind;
+(function (FirestartrGithubOrganizationSecretSectionSpecContextBackendRefKind) {
+    /** FirestartrProviderConfig */
+    FirestartrGithubOrganizationSecretSectionSpecContextBackendRefKind["FIRESTARTR_PROVIDER_CONFIG"] = "FirestartrProviderConfig";
+})(FirestartrGithubOrganizationSecretSectionSpecContextBackendRefKind || (FirestartrGithubOrganizationSecretSectionSpecContextBackendRefKind = {}));
+/**
+ * @schema FirestartrGithubOrganizationSecretSectionSpecContextProviderRefKind
+ */
+var FirestartrGithubOrganizationSecretSectionSpecContextProviderRefKind;
+(function (FirestartrGithubOrganizationSecretSectionSpecContextProviderRefKind) {
+    /** FirestartrProviderConfig */
+    FirestartrGithubOrganizationSecretSectionSpecContextProviderRefKind["FIRESTARTR_PROVIDER_CONFIG"] = "FirestartrProviderConfig";
+})(FirestartrGithubOrganizationSecretSectionSpecContextProviderRefKind || (FirestartrGithubOrganizationSecretSectionSpecContextProviderRefKind = {}));
 /**
  * A resource to handle GitHub Organization Settings.
  *
@@ -166459,6 +167071,83 @@ class GithubOrgVariableSectionChart extends BaseGithubChart {
     }
 }
 
+;// CONCATENATED MODULE: ../cdk8s_renderer/src/charts/github/orgSecretSectionChart.ts
+
+
+
+
+class GithubOrgSecretSectionChart extends BaseGithubChart {
+    template() {
+        const claim = this.get('claim');
+        const firestartrId = this.get('firestartrId');
+        const githubProvider = claim.providers.github;
+        const orgSecrets = githubProvider.org_secrets || {};
+        const renderSecrets = (section) => {
+            const secrets = orgSecrets[section];
+            if (!Array.isArray(secrets))
+                return [];
+            return secrets.map((secret) => {
+                const parts = secret.value.split(':');
+                const selectedRepositories = (secret.selected_repositories || []).map((ref) => {
+                    const match = ref.match(/^component:(.+)$/);
+                    if (!match) {
+                        throw new ChartRenderError('OrgSettingsClaim', claim.name, `Invalid component ref "${ref}" in selected_repositories. Expected format: component:<name>`);
+                    }
+                    const componentName = match[1];
+                    const resolvedCr = this.refResolver('ComponentClaim', componentName);
+                    const org = resolvedCr?.spec?.org;
+                    const repoName = resolvedCr?.metadata?.annotations?.['firestartr.dev/external-name'] || resolvedCr?.metadata?.name?.replace(/-[0-9a-f-]{36}$/, '');
+                    if (!org || !repoName) {
+                        throw new ChartRenderError('OrgSettingsClaim', claim.name, `Referenced component "${componentName}" has no GitHub provider configured`);
+                    }
+                    return `${org}/${repoName}`;
+                });
+                return {
+                    name: secret.name,
+                    ref: {
+                        kind: 'Secret',
+                        name: catalog_common/* default */.A.generic.normalizeName(parts[2]),
+                        key: parts[3],
+                    },
+                    visibility: secret.visibility || 'all',
+                    selectedRepositories,
+                };
+            });
+        };
+        const template = {
+            metadata: {
+                name: githubProvider.name,
+            },
+            spec: {
+                org: githubProvider.org,
+                secrets: {
+                    actions: renderSecrets('actions'),
+                    codespaces: renderSecrets('codespaces'),
+                    dependabot: renderSecrets('dependabot'),
+                },
+                firestartr: {
+                    tfStateKey: firestartrId,
+                },
+                writeConnectionSecretToRef: {
+                    name: `firestartrgithuborganizationsecretsection-${githubProvider.name}-secrets-outputs`.toLowerCase(),
+                    outputs: [
+                        { key: 'actions_secret_names' },
+                        { key: 'codespaces_secret_names' },
+                        { key: 'dependabot_secret_names' },
+                    ],
+                },
+            },
+        };
+        return JSON.parse(JSON.stringify(template));
+    }
+    gvk() {
+        return FirestartrGithubOrganizationSecretSection.GVK;
+    }
+    instanceApiObject(template) {
+        return new FirestartrGithubOrganizationSecretSection(this, template.metadata.name, template);
+    }
+}
+
 ;// CONCATENATED MODULE: ../cdk8s_renderer/src/charts/github/index.ts
 
 
@@ -166467,6 +167156,7 @@ class GithubOrgVariableSectionChart extends BaseGithubChart {
 
 
 
+
 ;// CONCATENATED MODULE: ../cdk8s_renderer/src/charts/catalog/base.ts
 
 class BaseCatalogChart extends BaseChart {
@@ -167229,6 +167919,7 @@ class SecretsChart extends BaseSecretsChart {
     GithubOrgWebhookChart: GithubOrgWebhookChart,
     GithubOrgSettingsChart: GithubOrgSettingsChart,
     GithubOrgVariableSectionChart: GithubOrgVariableSectionChart,
+    GithubOrgSecretSectionChart: GithubOrgSecretSectionChart,
 });
 
 ;// CONCATENATED MODULE: ../cdk8s_renderer/src/renderer/claims-render.ts
@@ -167280,16 +167971,21 @@ async function renderClaims(catalogScope, firestartrScope, data) {
             const variableSectionPreviousCR = claim.kind === 'OrgSettingsClaim'
                 ? getPreviousCRfromClaim(claim, crs, 'FirestartrGithubOrganizationVariableSection')
                 : false;
+            const secretSectionPreviousCR = claim.kind === 'OrgSettingsClaim'
+                ? getPreviousCRfromClaim(claim, crs, 'FirestartrGithubOrganizationSecretSection')
+                : false;
             const patches = await extractPatches(renderClaims[claimKey], previousCR, crs);
             let variableSectionPatches = undefined;
+            let secretSectionPatches = undefined;
             if (claim.kind === 'OrgSettingsClaim') {
                 variableSectionPatches = await extractPatches(renderClaims[claimKey], variableSectionPreviousCR, crs);
+                secretSectionPatches = await extractPatches(renderClaims[claimKey], secretSectionPreviousCR);
             }
             if (!previousCR) {
                 logger.debug(`No CR found for claim ${claimKey}, it will be rendered from scratch`);
             }
             const claimPath = renderClaims[claimKey].claimPath;
-            const { firestartrEntity, extraCharts, catalogEntity } = await renderClaim(catalogScope, firestartrScope, claim, patches, previousCR, claimPath, variableSectionPreviousCR, variableSectionPatches, crs);
+            const { firestartrEntity, extraCharts, catalogEntity } = await renderClaim(catalogScope, firestartrScope, claim, patches, previousCR, claimPath, variableSectionPreviousCR, variableSectionPatches, crs, secretSectionPreviousCR, secretSectionPatches);
             if (catalogEntity) {
                 result[`${catalogEntity.kind}-${catalogEntity.metadata.name}`] =
                     catalogEntity.toJson();
@@ -167318,7 +168014,7 @@ async function renderClaims(catalogScope, firestartrScope, data) {
     }
     return result;
 }
-async function renderClaim(catalogScope, firestartrScope, claim, patches, previousCR = null, claimPath, variableSectionPreviousCR = false, variableSectionPatches, crs) {
+async function renderClaim(catalogScope, firestartrScope, claim, patches, previousCR = null, claimPath, variableSectionPreviousCR = false, variableSectionPatches, crs, secretSectionPreviousCR = false, secretSectionPatches) {
     let catalogEntity = undefined;
     let firestartrEntity = undefined;
     const extraCharts = [];
@@ -167488,6 +168184,27 @@ async function renderClaim(catalogScope, firestartrScope, claim, patches, previo
                     },
                     chart: variableSectionObject,
                 });
+                const secretSectionFirestartrId = secretSectionPreviousCR
+                    ? secretSectionPreviousCR.spec?.firestartr?.tfStateKey
+                    : firestartrId
+                        ? `${firestartrId}-secrets`
+                        : null;
+                const ssRenderPatches = secretSectionPatches
+                    ? secretSectionPatches.filter((patch) => !patch.isPostPatch)
+                    : renderPatches;
+                const ssPostPatches = secretSectionPatches
+                    ? secretSectionPatches.filter((patch) => patch.isPostPatch)
+                    : postPatches;
+                const secretSectionChart = new charts.GithubOrgSecretSectionChart(firestartrScope, `github-secrets-${chartId}`, secretSectionFirestartrId, claim, ssRenderPatches);
+                await secretSectionChart.render();
+                const secretSectionObject = await secretSectionChart.postRenderer(ssPostPatches);
+                extraCharts.push({
+                    claim: {
+                        kind: claim.kind,
+                        name: `${claim.name}-secret-section`,
+                    },
+                    chart: secretSectionObject,
+                });
             }
             break;
         default:
@@ -167610,8 +168327,33 @@ function searchSecretKey(secretClaim, key) {
 }
 function validateOrgSettingsComponentRefs(ref, renderClaims) {
     const claim = renderClaims[ref].claim;
+    validateOrgSecretsSelectedRepositories(claim, renderClaims);
     validateActionsVariablesSelectedRepositories(claim, renderClaims);
 }
+function validateOrgSecretsSelectedRepositories(claim, renderClaims) {
+    const orgSecrets = claim?.providers?.github?.org_secrets;
+    if (!orgSecrets || typeof orgSecrets !== 'object')
+        return;
+    for (const section of ['actions', 'codespaces', 'dependabot']) {
+        const secrets = orgSecrets[section];
+        if (!Array.isArray(secrets))
+            continue;
+        for (const secret of secrets) {
+            if (!secret.selected_repositories)
+                continue;
+            for (const repoRef of secret.selected_repositories) {
+                const match = repoRef.match(COMPONENT_REF_PATTERN);
+                if (!match)
+                    continue;
+                const [, componentName] = match;
+                const expectedKey = `ComponentClaim-${componentName}`;
+                if (!renderClaims[expectedKey]) {
+                    throw new Error(`CrossReference error: OrgSettingsClaim/${claim.name} references a non-existent component "${componentName}" in org_secrets.${section}.${secret.name}.selected_repositories`);
+                }
+            }
+        }
+    }
+}
 function validateActionsVariablesSelectedRepositories(claim, renderClaims) {
     const actionsVariables = claim?.providers?.github?.actions_variables;
     if (!Array.isArray(actionsVariables))
@@ -167742,6 +168484,108 @@ function validateActionsVariablesUniqueness(crs) {
     }
 }
 
+;// CONCATENATED MODULE: ../cdk8s_renderer/src/validations/githubOrgSecretSection.ts
+const GITHUB_ORG_SECRET_SECTION_KIND = 'FirestartrGithubOrganizationSecretSection';
+const githubOrgSecretSection_FIRESTARTR_CLAIM_REF_ANNOTATION = 'firestartr.dev/claim-ref';
+const githubOrgSecretSection_CLAIM_REF_LABEL = 'claim-ref';
+const SECRETS_CLAIM_REF_PATTERN = /^ref:secretsclaim:([a-zA-Z0-9_-]+):([a-zA-Z0-9_-]+)$/;
+function githubOrgSecretSection_formatResourceRef(name, claimRef) {
+    return claimRef ? `${name} (claim: ${claimRef})` : name;
+}
+function validateGithubOrgSecretSectionSingleton(crs) {
+    const refsByOrg = new Map();
+    const seenClaimRefs = new Map();
+    for (const crKey of Object.keys(crs)) {
+        const cr = crs[crKey];
+        if (cr.kind !== GITHUB_ORG_SECRET_SECTION_KIND)
+            continue;
+        const org = cr.spec?.org;
+        if (typeof org !== 'string' || !org)
+            continue;
+        const name = cr.metadata?.name || crKey;
+        const claimRef = cr.metadata?.annotations?.[githubOrgSecretSection_FIRESTARTR_CLAIM_REF_ANNOTATION] ||
+            cr.metadata?.labels?.[githubOrgSecretSection_CLAIM_REF_LABEL];
+        const normalizedOrg = org.toLowerCase();
+        if (claimRef) {
+            const seen = seenClaimRefs.get(normalizedOrg) || new Set();
+            if (seen.has(claimRef))
+                continue;
+            seen.add(claimRef);
+            seenClaimRefs.set(normalizedOrg, seen);
+        }
+        const refs = refsByOrg.get(normalizedOrg) || [];
+        refs.push(githubOrgSecretSection_formatResourceRef(name, claimRef));
+        refsByOrg.set(normalizedOrg, refs);
+    }
+    for (const [org, refs] of refsByOrg.entries()) {
+        if (refs.length < 2)
+            continue;
+        throw new Error(`Duplicate ${GITHUB_ORG_SECRET_SECTION_KIND} resources found for GitHub organization "${org}": ${refs.join(', ')}`);
+    }
+}
+function validateSecretNamesUniqueness(crs) {
+    for (const crKey of Object.keys(crs)) {
+        const cr = crs[crKey];
+        if (cr.kind !== GITHUB_ORG_SECRET_SECTION_KIND)
+            continue;
+        const secrets = cr.spec?.secrets;
+        if (!secrets || typeof secrets !== 'object')
+            continue;
+        for (const section of ['actions', 'codespaces', 'dependabot']) {
+            const sectionSecrets = secrets[section];
+            if (!Array.isArray(sectionSecrets))
+                continue;
+            const names = new Map();
+            for (const secret of sectionSecrets) {
+                const secretName = secret?.name;
+                if (!secretName)
+                    continue;
+                const normalizedName = secretName.toLowerCase();
+                const previousName = names.get(normalizedName);
+                if (previousName !== undefined) {
+                    const org = cr.spec?.org || 'unknown';
+                    throw new Error(`Duplicate secret name "${secretName}" found in ${section} section of ${GITHUB_ORG_SECRET_SECTION_KIND} for organization "${org}"`);
+                }
+                names.set(normalizedName, secretName);
+            }
+        }
+    }
+}
+function validateOrgSecretsCrossReferences(renderClaims) {
+    for (const claimKey of Object.keys(renderClaims)) {
+        if (!claimKey.startsWith('OrgSettingsClaim-'))
+            continue;
+        const claimData = renderClaims[claimKey];
+        const claim = claimData?.claim;
+        const orgSecrets = claim?.providers?.github?.org_secrets;
+        if (!orgSecrets || typeof orgSecrets !== 'object')
+            continue;
+        for (const section of ['actions', 'codespaces', 'dependabot']) {
+            const secrets = orgSecrets[section];
+            if (!Array.isArray(secrets))
+                continue;
+            for (const secret of secrets) {
+                if (!secret.value)
+                    continue;
+                const match = secret.value.match(SECRETS_CLAIM_REF_PATTERN);
+                if (!match)
+                    continue;
+                const [, secretClaimName, secretKey] = match;
+                const expectedKey = `SecretsClaim-${secretClaimName}`;
+                if (!renderClaims[expectedKey])
+                    continue;
+                const secretClaim = renderClaims[expectedKey]?.claim;
+                const externalSecrets = secretClaim?.providers?.external_secrets?.externalSecrets?.secrets;
+                const keyFound = Array.isArray(externalSecrets) &&
+                    externalSecrets.some((s) => s.secretName === secretKey);
+                if (!keyFound) {
+                    throw new Error(`CrossReference error: OrgSettingsClaim/${claim.name} references a non-existent secret key "${secretKey}" in SecretsClaim/${secretClaimName} via org_secrets.${section}.${secret.name}`);
+                }
+            }
+        }
+    }
+}
+
 ;// CONCATENATED MODULE: ../cdk8s_renderer/src/renderer/renderer.ts
 
 
@@ -167754,6 +168598,7 @@ function validateActionsVariablesUniqueness(crs) {
 
 
 
+
 /*
  * Function called when rendering but not importing
  *
@@ -167777,9 +168622,12 @@ async function renderer_render(catalogScope, firestartrScope, claimList) {
         validateComponentPagesPath(data.renderClaims);
         validateClaimRefOwnership(data.fullCrs, result);
         validateTfStateKeyUniqueness(fullCrSet);
+        validateOrgSecretsCrossReferences(data.renderClaims);
         validateGithubOrgSettingsSingleton(fullCrSet);
         validateGithubOrgVariableSectionSingleton(fullCrSet);
         validateActionsVariablesUniqueness(result);
+        validateGithubOrgSecretSectionSingleton(fullCrSet);
+        validateSecretNamesUniqueness(result);
         validateCrSizes(result);
         validatePermissionsUniqueness(result);
         validateNoBackstageAnnotationsInK8sCrs(result);
@@ -351271,6 +352119,7 @@ const kindPluralMap = {
     githuborgwebhooks: 'FirestartrGithubOrgWebhook',
     githuborganizationsettings: 'FirestartrGithubOrganizationSettings',
     githuborganizationvariablesections: 'FirestartrGithubOrganizationVariableSection',
+    githuborganizationsecretsections: 'FirestartrGithubOrganizationSecretSection',
     terraformworkspaces: 'FirestartrTerraformWorkspace',
     providerconfigs: 'FirestartrProviderConfig',
     externalsecrets: 'ExternalSecret',
@@ -353731,6 +354580,7 @@ const kindsWithFinalizer = [
     'FirestartrGithubOrgWebhook',
     'FirestartrGithubOrganizationSettings',
     'FirestartrGithubOrganizationVariableSection',
+    'FirestartrGithubOrganizationSecretSection',
     'FirestartrGithubRepositorySecretsSection',
 ];
 const kindsWithDependants = [
@@ -356074,6 +356924,9 @@ async function workItemGarbageCollector(queue, bookkeeper) {
 
 // EXTERNAL MODULE: external "child_process"
 var external_child_process_ = __nccwpck_require__(35317);
+// EXTERNAL MODULE: external "crypto"
+var external_crypto_ = __nccwpck_require__(76982);
+var external_crypto_default = /*#__PURE__*/__nccwpck_require__.n(external_crypto_);
 ;// CONCATENATED MODULE: ../terraform_provisioner/src/tf/analyzer.ts
 
 function planLoader(planPath) {
@@ -356468,6 +357321,7 @@ ${providersString}
 
 
 
+
 const TOFU_LOCK_TIMEOUT = '-lock-timeout=60s';
 const MAX_APPLY_ATTEMPTS = 3;
 const TRANSIENT_APPLY_RETRY_DELAY_MS = 1000;
@@ -356840,9 +357694,8 @@ async function configGit() {
     }
     // Import github dynamically to avoid Jest ESM issues when not specifically running this function
     // (see CONSTITUTION and RULES: must not change test machinery)
-    const githubModule = await Promise.resolve(/* import() */).then(__nccwpck_require__.bind(__nccwpck_require__, 44912));
+    const githubModule = await Promise.resolve(/* import() */).then(__nccwpck_require__.bind(__nccwpck_require__, 37524));
     const github = githubModule.default || githubModule;
-    removeGitConfig();
     const org = catalog_common/* default */.A.environment.getFromEnvironment(catalog_common/* default */.A.types.envVars.org);
     // Provided in your code logic, but may wrap for null fallback if required
     // Here, github.getGithubAppToken is async as used elsewhere
@@ -356854,7 +357707,22 @@ async function configGit() {
     // and the resulting URL stays valid. Mode 0600 because the file holds a bearer token.
     // Residual: the token lives in the rewritten URL. If git prints that URL in an
     // error and it reaches logs, it leaks another way (SC-01), out of scope here.
-    external_fs_.writeFileSync(GITCONFIG_PATH, `[url "https://firestartr:${ghToken}@github.com/"]\ninsteadOf = https://github.com/\n`, { mode: 0o600 });
+    // Keep the previous credentials available until a complete 0600 file can be
+    // atomically renamed over it. A same-directory temp keeps rename on one filesystem.
+    const tempPath = `${GITCONFIG_PATH}.${process.pid}.${(0,external_crypto_.randomUUID)()}.tmp`;
+    try {
+        external_fs_.writeFileSync(tempPath, `[url "https://firestartr:${ghToken}@github.com/"]\ninsteadOf = https://github.com/\n`, { mode: 0o600, flag: 'wx' });
+        external_fs_.renameSync(tempPath, GITCONFIG_PATH);
+    }
+    catch (error) {
+        try {
+            external_fs_.rmSync(tempPath, { force: true });
+        }
+        catch {
+            // Best-effort cleanup must not mask the original write or rename error.
+        }
+        throw error;
+    }
     ensureGitConfigExitCleanup();
 }
 
@@ -360375,6 +361243,11 @@ const MODULES = {
         // github-org-variables-section-v0.1.0
         ref: 'fb9c01d0a1e03e5134479da13d0faf55891dfedf',
     },
+    FirestartrGithubOrganizationSecretSection: {
+        module: 'git::https://github.com/prefapp/tfm.git//modules/github-org-secrets-section',
+        // github-org-secrets-section feat/1364-feat-add-github-org-secrets-section-module
+        ref: '170e6cf3d60508ff0566dffb7630e826b50d424a',
+    },
 };
 function getFirestartrDefaultTFM(kind) {
     if (kind in MODULES) {
@@ -360678,9 +361551,6 @@ class EntityGroup extends Entity {
     }
 }
 
-// EXTERNAL MODULE: external "crypto"
-var external_crypto_ = __nccwpck_require__(76982);
-var external_crypto_default = /*#__PURE__*/__nccwpck_require__.n(external_crypto_);
 ;// CONCATENATED MODULE: ../gh_provisioner/src/entities/ghrepositorysecretssection/secrets.ts
 
 
@@ -362289,6 +363159,183 @@ class EntityGHOrgVarsSection extends Entity {
     async loadAddressesToImport() { }
 }
 
+;// CONCATENATED MODULE: ../gh_provisioner/src/entities/ghorgsecretsection/secrets.ts
+
+
+
+
+const secrets_SECTIONS = ['actions', 'codespaces', 'dependabot'];
+
+async function provisionOrgSecrets(entity, secrets) {
+    gh_provisioner_src_logger.info(`[gh-provisioner] ${entity.k8sId} provisioning org secrets`);
+    const declared = secrets_SECTIONS.some((section) => (secrets[section] || []).length);
+    if (declared && process.env['AVOID_PROVIDER_SECRET_ENCRYPTION']) {
+        throw new Error(`[gh-provisioner] ${entity.k8sId} AVOID_PROVIDER_SECRET_ENCRYPTION is not supported for org secrets: the github-org-secrets-section module only accepts encrypted values`);
+    }
+    for (const section of secrets_SECTIONS) {
+        const sectionSecrets = secrets[section] || [];
+        if (sectionSecrets.length === 0)
+            continue;
+        let preFetchedKey;
+        try {
+            preFetchedKey = await fetchOrgPublicKey(entity, section);
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            throw new Error(`[gh-provisioner] ${entity.k8sId} failed to fetch ${section} org public key: ${message}`);
+        }
+        for (const secret of sectionSecrets) {
+            await provisionOrgSecret(entity, section, secret, preFetchedKey);
+        }
+    }
+}
+async function fetchOrgPublicKey(entity, section) {
+    return (await entity.runWithGithubProvider(async () => {
+        return await github["default"].encryption.getOrgPublicKey(entity.cr.spec.org, section);
+    }));
+}
+async function provisionOrgSecret(entity, section, secret, preFetchedKey) {
+    gh_provisioner_src_logger.info(`[gh-provisioner] provisioning org secret ${entity.k8sId}/${section}/${secret.name}`);
+    await secrets_createEncryptedSecret(entity, section, secret, preFetchedKey);
+    gh_provisioner_src_logger.info(`[gh-provisioner] org secret provisioned ${section}/${secret.name}`);
+}
+async function secrets_createEncryptedSecret(entity, section, secret, preFetchedKey) {
+    const resolved = entity.resolveRef(secret.ref);
+    if (!resolved) {
+        throw new Error(`[gh-provisioner] ${entity.k8sId} cannot resolve secret ref: ${secret.ref.kind}/${secret.ref.name}:${secret.ref.key} — ensure the referenced resource is available as a dependency`);
+    }
+    const plainTextSecret = resolved.getOutput(secret.ref.key);
+    const plaintextSha256 = external_crypto_default().createHash('sha256')
+        .update(plainTextSecret)
+        .digest('hex');
+    const { encrypted_value } = (await entity.runWithGithubProvider(async () => {
+        return await github["default"].encryption.encryptOrgSecret(entity.cr.spec.org, section, plainTextSecret, preFetchedKey);
+    }));
+    entity.patchData({
+        op: PatchOperations.add,
+        path: `/config/${section}/${secret.name}`,
+        value: {
+            value: encrypted_value,
+            visibility: secret.visibility || 'all',
+            ...(secret.selectedRepositories && secret.selectedRepositories.length > 0
+                ? { selected_repositories: secret.selectedRepositories }
+                : {}),
+        },
+    });
+    entity.patchData({
+        op: PatchOperations.add,
+        path: `/config/${section}_sha256/${secret.name}`,
+        value: plaintextSha256,
+    });
+}
+async function adoptSecretsIfNeeded(entity, secrets) {
+    for (const section of secrets_SECTIONS) {
+        const sectionSecrets = secrets[section] || [];
+        if (sectionSecrets.length === 0)
+            continue;
+        const managedSecrets = entity.cr.fResolveSelfOutputs(`${section}_secret_names`) || [];
+        const declaredNames = sectionSecrets.map((s) => s.name);
+        const newToModule = declaredNames.filter((name) => !managedSecrets.includes(name));
+        if (newToModule.length === 0) {
+            gh_provisioner_src_logger.debug(`[gh-provisioner] ${entity.k8sId} all declared ${section} secrets are already managed`);
+            continue;
+        }
+        if (managedSecrets.length === 0) {
+            gh_provisioner_src_logger.info(`[gh-provisioner] ${entity.k8sId} no ${section}_secret_names output — first reconciliation, treating all ${newToModule.length} ${section} secret(s) as new to module`);
+        }
+        for (const secretName of newToModule) {
+            try {
+                const existing = (await entity.runWithGithubProvider(async () => {
+                    return await github["default"].encryption.getOrgSecret(entity.cr.spec.org, section, secretName);
+                }));
+                if (existing) {
+                    gh_provisioner_src_logger.info(`[gh-provisioner] ${entity.k8sId} adopting pre-existing ${section} secret '${secretName}' on GitHub org '${entity.cr.spec.org}'`);
+                    entity.patchData({
+                        op: PatchOperations.remove,
+                        path: `/config/${section}_sha256/${secretName}`,
+                    });
+                    const resourceType = `github_${section}_organization_secret`;
+                    entity.patchImportData({
+                        op: PatchOperations.add,
+                        path: '/imports/-',
+                        value: {
+                            to: `${resourceType}.this["${secretName}"]`,
+                            id: secretName,
+                        },
+                    });
+                }
+            }
+            catch (err) {
+                if (err && err.status === 404) {
+                    gh_provisioner_src_logger.info(`[gh-provisioner] ${entity.k8sId} ${section} secret '${secretName}' not found on GitHub org '${entity.cr.spec.org}' — will be created by TFM`);
+                }
+                else if (err && (err.status === 401 || err.status === 403)) {
+                    gh_provisioner_src_logger.warn(`[gh-provisioner] ${entity.k8sId} token lacks scope to check ${section} secret '${secretName}' on org '${entity.cr.spec.org}' — skipping adoption gracefully`);
+                }
+                else {
+                    gh_provisioner_src_logger.warn(`[gh-provisioner] ${entity.k8sId} unexpected error checking ${section} secret '${secretName}' on org '${entity.cr.spec.org}': ${err instanceof Error ? err.message : String(err)}`);
+                }
+            }
+        }
+    }
+}
+
+;// CONCATENATED MODULE: ../gh_provisioner/src/entities/ghorgsecretsection/index.ts
+
+
+
+class EntityGHOrgSecretSection extends Entity {
+    constructor(artifact, deps) {
+        super(artifact, {
+            config: {
+                org: '',
+                actions: {},
+                codespaces: {},
+                dependabot: {},
+                actions_sha256: {},
+                codespaces_sha256: {},
+                dependabot_sha256: {},
+            },
+        }, deps);
+    }
+    async loadResources(tfOp) {
+        gh_provisioner_src_logger.info(`[gh-provisioner] running ${tfOp} on ${this.k8sId}`);
+        try {
+            const cr = this.cr;
+            const org = cr.spec.org;
+            const secrets = cr.spec.secrets || {};
+            this.patchData({
+                op: PatchOperations.replace,
+                path: '/config/org',
+                value: org,
+            });
+            if (tfOp !== 'destroy' && tfOp !== 'plan-destroy') {
+                await provisionOrgSecrets(this, secrets);
+            }
+            const redactedDoc = JSON.parse(JSON.stringify(this._document, (key, value) => {
+                if (key === 'value' && typeof value === 'string')
+                    return '[REDACTED]';
+                return typeof value === 'string' && value.length > 50
+                    ? '[REDACTED]'
+                    : value;
+            }));
+            this.synthMessage(`[gh-provisioner] ${this.k8sId} config:\n${JSON.stringify(redactedDoc, null, 2)}`);
+            this.synthEnd(`[gh-provisioner] ${this.k8sId} loaded its data`);
+            if (tfOp === 'apply') {
+                await adoptSecretsIfNeeded(this, secrets);
+            }
+            gh_provisioner_src_logger.debug(`[gh-provisioner] ${this.k8sId} loaded its data`);
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            gh_provisioner_src_logger.error(`[gh-provisioner] ${this.k8sId} error loading resources: ${message}`);
+            throw new Error(`[gh-provisioner] ${this.k8sId} error loading resources: ${message}`);
+        }
+    }
+    async postProvision(_tfOp) { }
+    async loadAddressesToImport() { }
+}
+
 ;// CONCATENATED MODULE: ../gh_provisioner/src/entities/ghorgwebhook/index.ts
 
 
@@ -362363,6 +363410,7 @@ class EntityGHOrgWebHook extends Entity {
 
 
 
+
 function entities_getEntity(cr, deps) {
     const entityClass = getEntityClass(cr.kind);
     return new entityClass(cr, deps);
@@ -362385,6 +363433,8 @@ function getEntityClass(kind) {
             return EntityGHOrgSettings;
         case 'FirestartrGithubOrganizationVariableSection':
             return EntityGHOrgVarsSection;
+        case 'FirestartrGithubOrganizationSecretSection':
+            return EntityGHOrgSecretSection;
         default:
             throw new Error(`kind ${kind} has no entity associated`);
     }
@@ -362638,6 +363688,7 @@ const GITHUB_RESOURCE_KINDS = [
     'FirestartrGithubOrgWebhook',
     'FirestartrGithubOrganizationSettings',
     'FirestartrGithubOrganizationVariableSection',
+    'FirestartrGithubOrganizationSecretSection',
 ];
 const GITHUB_REPOSITORY_DEPENDENT_KINDS = [
     'FirestartrGithubRepositoryFeature',
@@ -364046,6 +365097,7 @@ const provisionImplementations = {
     githuborgwebhooks: process_operation_processOperation,
     githuborganizationsettings: process_operation_processOperation,
     githuborganizationvariablesections: process_operation_processOperation,
+    githuborganizationsecretsections: process_operation_processOperation,
     fsdummiesa: processFirestartrDummies,
     fsdummiesb: processFirestartrDummies,
     fsdummiesc: processFirestartrDummies,
@@ -364952,7 +366004,7 @@ const crsStatusSubcommand = {
 };
 
 ;// CONCATENATED MODULE: ./package.json
-const package_namespaceObject = /*#__PURE__*/JSON.parse('{"rE":"3.2.0-snapshot-01"}');
+const package_namespaceObject = /*#__PURE__*/JSON.parse('{"rE":"3.2.0-snapshot-02"}');
 ;// CONCATENATED MODULE: ../../package.json
 const package_namespaceObject_1 = {"rE":"3.1.1"};
 // EXTERNAL MODULE: ../../node_modules/semver/index.js