@postman-cs/onboarding-repo-sync 2.10.9 → 2.11.1

package/README.md

@@ -69,6 +69,15 @@ The example permissions let `GITHUB_TOKEN` commit generated artifacts and update
 
 `postman-access-token` is required: every asset operation (environment create/get/update, collection read, mock, monitor) plus workspace-to-repository linking and system environment association runs through the access-token gateway. Use `postman-resolve-service-token-action` to mint it at runtime from a [Postman service account](https://learning.postman.com/docs/administration/service-accounts/) PMAK. Without it the action fails fast — the PMAK is not an asset-routing fallback; it only mints/re-mints the access token, powers the generated CI workflow's `postman login --with-api-key`, and mints the CI `POSTMAN_API_KEY` secret. See [docs/credentials.md](docs/credentials.md).
 
+To manage the complete values for an environment, use a rich entry in the same input. String entries remain backward-compatible and receive generated values; rich entries replace the environment values exactly as supplied (plus the action's branch-ownership marker when applicable).
+
+```yaml
+environments-json: >-
+  [{"slug":"dev","values":[{"key":"baseUrl","value":"https://dev.example.com"},{"key":"jwtToken","value":"","type":"secret"}]}]
+```
+
+Secret-typed values must be empty. Supply the real secret as a masked runtime variable from the customer's vault when running the collection; repo-sync neither reads nor persists that value. `value`, `type`, and `enabled` default to `""`, `"default"`, and `true`. `env-runtime-urls-json` and generated credential slots apply only to string entries because a rich entry is the complete desired definition.
+
 ### Disable CI workflow generation
 
 For existing repositories that already own their CI workflow, disable workflow generation:
@@ -178,7 +187,7 @@ with:
 | `mock-visibility` | Required mock access policy. Public is anonymous; private requires a runtime x-api-key supplied by the caller and is never persisted by repo-sync. | no | `private` |
 | `mock-environment-enabled` | Create or update a dedicated manual-validation environment whose baseUrl is the validated mock URL. This environment is excluded from runtime CI selection and never contains a mock credential. | no | `false` |
 | `monitor-cron` | Cron expression for monitor scheduling (e.g. '0 */6 * * *'). When empty, the monitor is created disabled and triggered to run once per workflow invocation (and once on every subsequent run). | no | `""` |
-| `environments-json` | JSON array of environment slugs to create or update. | no | `["prod"]` |
+| `environments-json` | JSON array of environment slugs or full definitions ({slug, values}) to create or replace. Secret-typed values must be empty runtime slots. | no | `["prod"]` |
 | `git-provider` | Git provider override ('github', 'gitlab', 'bitbucket', 'azure-devops'). Auto-detected from environment when omitted. | no |  |
 | `ado-token` | Azure DevOps personal access token or system token used to push commits in Azure Pipelines. Defaults to SYSTEM_ACCESSTOKEN when available. | no |  |
 | `repo-url` | Explicit repository URL (GitHub, GitLab, or Azure DevOps). Defaults to the URL inferred from runner environment when omitted. For commit-and-push it must identify the checked-out origin. | no |  |

package/action.yml

@@ -76,7 +76,7 @@ inputs:
     required: false
     default: ""
   environments-json:
-    description: JSON array of environment slugs to create or update.
+    description: JSON array of environment slugs or full definitions ({slug, values}) to create or replace. Secret-typed values must be empty runtime slots.
     required: false
     default: '["prod"]'
   git-provider:

package/dist/action.cjs

@@ -118094,6 +118094,8 @@ function buildCiWorkflowLines(installUrl, postmanRegion, privateMockAuth) {
     "jobs:",
     "  test:",
     "    runs-on: ubuntu-latest",
+    "    env:",
+    "      HAS_SSL_CERT: ${{ secrets.POSTMAN_SSL_CLIENT_CERT_B64 != '' }}",
     "    steps:",
     "      - uses: actions/checkout@v5",
     "      - name: Install Postman CLI",
@@ -118127,7 +118129,7 @@ function buildCiWorkflowLines(installUrl, postmanRegion, privateMockAuth) {
     "          end",
     "          RUBY",
     "      - name: Decode SSL certificates",
-    "        if: ${{ secrets.POSTMAN_SSL_CLIENT_CERT_B64 != '' }}",
+    "        if: ${{ env.HAS_SSL_CERT == 'true' }}",
     "        env:",
     "          POSTMAN_SSL_CLIENT_CERT_B64: ${{ secrets.POSTMAN_SSL_CLIENT_CERT_B64 }}",
     "          POSTMAN_SSL_CLIENT_KEY_B64: ${{ secrets.POSTMAN_SSL_CLIENT_KEY_B64 }}",
@@ -118452,8 +118454,11 @@ function renderGcWorkflowTemplate() {
   return [
     "name: Postman Preview GC",
     "on:",
+    // The delete event takes no branches/tags filter (GitHub only allows one on
+    // merge_group, push, pull_request, pull_request_target, and workflow_run).
+    // The previous ["**"] was a match-everything wildcard, so dropping it leaves
+    // the trigger behaviour unchanged.
     "  delete:",
-    '    branches: ["**"]',
     "  pull_request:",
     "    types: [closed]",
     "  schedule:",
@@ -121357,7 +121362,7 @@ var postmanRepoSyncActionContract = {
       default: ""
     },
     "environments-json": {
-      description: "JSON array of environment slugs to create or update.",
+      description: "JSON array of environment slugs or full definitions ({slug, values}) to create or replace. Secret-typed values must be empty runtime slots.",
       required: false,
       default: '["prod"]'
     },
@@ -129598,13 +129603,117 @@ function parseJsonMap(raw) {
     ])
   );
 }
-function parseJsonArray(raw) {
-  if (!raw.trim()) return [];
-  const parsed = JSON.parse(raw);
+function parseEnvironmentInputs(raw) {
+  if (!raw.trim()) return { environments: [], definitions: /* @__PURE__ */ Object.create(null) };
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    throw new Error("environments-json must contain valid JSON");
+  }
   if (!Array.isArray(parsed)) {
-    throw new Error("Expected JSON array");
+    throw new Error("environments-json must be a JSON array");
+  }
+  const environments = [];
+  const definitions = /* @__PURE__ */ Object.create(null);
+  const seen = /* @__PURE__ */ new Map();
+  parsed.forEach((entry, environmentIndex) => {
+    const label = `environments-json[${environmentIndex}]`;
+    let slug;
+    let rich = false;
+    if (typeof entry === "string") {
+      slug = entry;
+    } else {
+      if (!isPlainObject2(entry)) {
+        throw new Error(`${label} must be a slug string or an environment definition`);
+      }
+      const unknownFields = Object.keys(entry).filter((key) => key !== "slug" && key !== "values");
+      if (unknownFields.length > 0) {
+        throw new Error(`${label} contains unsupported field "${unknownFields[0]}"`);
+      }
+      if (typeof entry.slug !== "string" || !Array.isArray(entry.values)) {
+        throw new Error(`${label} must contain a string slug and a values array`);
+      }
+      slug = entry.slug;
+      rich = true;
+      const keys = /* @__PURE__ */ new Set();
+      definitions[slug] = entry.values.map((value, valueIndex) => {
+        const valueLabel = `${label}.values[${valueIndex}]`;
+        if (!isPlainObject2(value)) {
+          throw new Error(`${valueLabel} must be an object`);
+        }
+        const unknownValueFields = Object.keys(value).filter(
+          (key) => !["key", "value", "type", "enabled"].includes(key)
+        );
+        if (unknownValueFields.length > 0) {
+          throw new Error(`${valueLabel} contains unsupported field "${unknownValueFields[0]}"`);
+        }
+        if (typeof value.key !== "string" || !value.key.trim() || value.key !== value.key.trim()) {
+          throw new Error(`${valueLabel}.key must be a non-empty string without surrounding whitespace`);
+        }
+        if (value.key === "x-pm-onboarding") {
+          throw new Error(`${valueLabel}.key is reserved by repo-sync`);
+        }
+        if (keys.has(value.key)) {
+          throw new Error(`${label} contains duplicate variable key "${value.key}"`);
+        }
+        keys.add(value.key);
+        if (value.value !== void 0 && typeof value.value !== "string") {
+          throw new Error(`${valueLabel}.value must be a string when provided`);
+        }
+        if (value.type !== void 0 && value.type !== "default" && value.type !== "secret") {
+          throw new Error(`${valueLabel}.type must be "default" or "secret"`);
+        }
+        if (value.enabled !== void 0 && typeof value.enabled !== "boolean") {
+          throw new Error(`${valueLabel}.enabled must be a boolean when provided`);
+        }
+        const type = value.type ?? "default";
+        const normalizedValue = value.value ?? "";
+        if (type === "secret" && normalizedValue) {
+          throw new Error(`${valueLabel} cannot contain a populated secret value; inject it at runtime`);
+        }
+        return { key: value.key, value: normalizedValue, type, enabled: value.enabled ?? true };
+      });
+    }
+    if (rich && !/^[A-Za-z0-9]+(?:[._-][A-Za-z0-9]+)*$/.test(slug)) {
+      throw new Error(`${label} rich slug must use only letters, numbers, dots, hyphens, or underscores`);
+    }
+    if (rich && Object.prototype.hasOwnProperty.call(Object.prototype, slug)) {
+      throw new Error(`${label} rich slug conflicts with a reserved object property`);
+    }
+    if (rich && /^(?:con|prn|aux|nul|com[1-9]|lpt[1-9])(?:\.|$)/i.test(slug)) {
+      throw new Error(`${label} rich slug conflicts with a Windows device name`);
+    }
+    if (!rich && !slug.trim()) {
+      throw new Error(`${label} slug must be a non-empty string`);
+    }
+    const priorWasRich = seen.get(slug);
+    if (priorWasRich !== void 0 && (rich || priorWasRich)) {
+      throw new Error(`environments-json contains duplicate slug "${slug}"`);
+    }
+    if (priorWasRich === void 0) seen.set(slug, rich);
+    environments.push(slug);
+  });
+  return { environments, definitions };
+}
+function normalizeProgrammaticEnvironmentDefinitions(inputs) {
+  const definitions = inputs.environmentDefinitions;
+  if (!definitions) return inputs;
+  const prototype = Object.getPrototypeOf(definitions);
+  if (prototype !== Object.prototype && prototype !== null) {
+    throw new Error("environmentDefinitions must be a plain object");
+  }
+  const entries = inputs.environments.map(
+    (slug) => Object.prototype.hasOwnProperty.call(definitions, slug) ? { slug, values: definitions[slug] } : slug
+  );
+  let raw;
+  try {
+    raw = JSON.stringify(entries);
+  } catch {
+    throw new Error("environmentDefinitions must contain JSON-serializable values");
   }
-  return parsed.map((entry) => String(entry));
+  const parsed = parseEnvironmentInputs(raw);
+  return { ...inputs, environments: parsed.environments, environmentDefinitions: parsed.definitions };
 }
 function readInput(actionCore, name, required = false) {
   return actionCore.getInput(name, { required }).trim();
@@ -129701,7 +129810,7 @@ function resolveInputs(env = process.env) {
     },
     env
   );
-  const environments = parseJsonArray(getInput2("environments-json", env) || '["prod"]');
+  const parsedEnvironments = parseEnvironmentInputs(getInput2("environments-json", env) || '["prod"]');
   const secretsResolverProvider = parseSecretsResolverProvider(getInput2("secrets-resolver", env));
   const systemEnvMap = parseJsonMap(getInput2("system-env-map-json", env) || "{}");
   const environmentUids = parseJsonMap(getInput2("environment-uids-json", env) || "{}");
@@ -129739,7 +129848,8 @@ function resolveInputs(env = process.env) {
     secretsResolverProvider,
     specSyncMode: normalizeSpecSyncMode(getInput2("spec-sync-mode", env) || "update"),
     releaseLabel: normalizeReleaseLabel(getInput2("release-label", env)) || void 0,
-    environments: environments.length > 0 ? environments : ["prod"],
+    environments: parsedEnvironments.environments.length > 0 ? parsedEnvironments.environments : ["prod"],
+    environmentDefinitions: parsedEnvironments.definitions,
     repoUrl: repoContext.repoUrl || "",
     integrationBackend: getInput2("integration-backend", env) || "bifrost",
     workspaceLinkEnabled: parseBooleanInput(getInput2("workspace-link-enabled", env), true),
@@ -130407,7 +130517,8 @@ async function upsertEnvironments(inputs, dependencies, resourcesState, assetMar
         }
       } catch {
       }
-      const values2 = buildEnvironmentValues(envName, runtimeUrl, {
+      const definedValues2 = inputs.environmentDefinitions?.[envName];
+      const values2 = definedValues2 ? definedValues2.map((value) => ({ ...value })) : buildEnvironmentValues(envName, runtimeUrl, {
         secretsResolverProvider: inputs.secretsResolverProvider,
         preservedCredentialValues: priorValues
       });
@@ -130430,7 +130541,8 @@ async function upsertEnvironments(inputs, dependencies, resourcesState, assetMar
       dependencies.core.setOutput("environment-uids-json", JSON.stringify(envUids));
       continue;
     }
-    const values = buildEnvironmentValues(envName, runtimeUrl, {
+    const definedValues = inputs.environmentDefinitions?.[envName];
+    const values = definedValues ? definedValues.map((value) => ({ ...value })) : buildEnvironmentValues(envName, runtimeUrl, {
       secretsResolverProvider: inputs.secretsResolverProvider
     });
     if (assetMarker) values.push({ key: "x-pm-onboarding", value: JSON.stringify(assetMarker), type: "default" });
@@ -131621,6 +131733,7 @@ async function commitAndPushGeneratedFiles(inputs, dependencies, privateMockAuth
   };
 }
 async function runRepoSync(inputs, dependencies, executionContext) {
+  inputs = normalizeProgrammaticEnvironmentDefinitions(inputs);
   const telemetry = createTelemetryContext({ action: "postman-repo-sync-action", actionVersion: resolveActionVersion2(), logger: dependencies.core });
   telemetry.setTeamId(dependencies.teamId);
   const logger = resolveRepoSyncLogger(dependencies);

package/dist/cli.cjs

@@ -116199,6 +116199,8 @@ function buildCiWorkflowLines(installUrl, postmanRegion, privateMockAuth) {
     "jobs:",
     "  test:",
     "    runs-on: ubuntu-latest",
+    "    env:",
+    "      HAS_SSL_CERT: ${{ secrets.POSTMAN_SSL_CLIENT_CERT_B64 != '' }}",
     "    steps:",
     "      - uses: actions/checkout@v5",
     "      - name: Install Postman CLI",
@@ -116232,7 +116234,7 @@ function buildCiWorkflowLines(installUrl, postmanRegion, privateMockAuth) {
     "          end",
     "          RUBY",
     "      - name: Decode SSL certificates",
-    "        if: ${{ secrets.POSTMAN_SSL_CLIENT_CERT_B64 != '' }}",
+    "        if: ${{ env.HAS_SSL_CERT == 'true' }}",
     "        env:",
     "          POSTMAN_SSL_CLIENT_CERT_B64: ${{ secrets.POSTMAN_SSL_CLIENT_CERT_B64 }}",
     "          POSTMAN_SSL_CLIENT_KEY_B64: ${{ secrets.POSTMAN_SSL_CLIENT_KEY_B64 }}",
@@ -116557,8 +116559,11 @@ function renderGcWorkflowTemplate() {
   return [
     "name: Postman Preview GC",
     "on:",
+    // The delete event takes no branches/tags filter (GitHub only allows one on
+    // merge_group, push, pull_request, pull_request_target, and workflow_run).
+    // The previous ["**"] was a match-everything wildcard, so dropping it leaves
+    // the trigger behaviour unchanged.
     "  delete:",
-    '    branches: ["**"]',
     "  pull_request:",
     "    types: [closed]",
     "  schedule:",
@@ -119462,7 +119467,7 @@ var postmanRepoSyncActionContract = {
       default: ""
     },
     "environments-json": {
-      description: "JSON array of environment slugs to create or update.",
+      description: "JSON array of environment slugs or full definitions ({slug, values}) to create or replace. Secret-typed values must be empty runtime slots.",
       required: false,
       default: '["prod"]'
     },
@@ -127651,13 +127656,117 @@ function parseJsonMap(raw) {
     ])
   );
 }
-function parseJsonArray(raw) {
-  if (!raw.trim()) return [];
-  const parsed = JSON.parse(raw);
+function parseEnvironmentInputs(raw) {
+  if (!raw.trim()) return { environments: [], definitions: /* @__PURE__ */ Object.create(null) };
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    throw new Error("environments-json must contain valid JSON");
+  }
   if (!Array.isArray(parsed)) {
-    throw new Error("Expected JSON array");
+    throw new Error("environments-json must be a JSON array");
+  }
+  const environments = [];
+  const definitions = /* @__PURE__ */ Object.create(null);
+  const seen = /* @__PURE__ */ new Map();
+  parsed.forEach((entry, environmentIndex) => {
+    const label = `environments-json[${environmentIndex}]`;
+    let slug;
+    let rich = false;
+    if (typeof entry === "string") {
+      slug = entry;
+    } else {
+      if (!isPlainObject2(entry)) {
+        throw new Error(`${label} must be a slug string or an environment definition`);
+      }
+      const unknownFields = Object.keys(entry).filter((key) => key !== "slug" && key !== "values");
+      if (unknownFields.length > 0) {
+        throw new Error(`${label} contains unsupported field "${unknownFields[0]}"`);
+      }
+      if (typeof entry.slug !== "string" || !Array.isArray(entry.values)) {
+        throw new Error(`${label} must contain a string slug and a values array`);
+      }
+      slug = entry.slug;
+      rich = true;
+      const keys = /* @__PURE__ */ new Set();
+      definitions[slug] = entry.values.map((value, valueIndex) => {
+        const valueLabel = `${label}.values[${valueIndex}]`;
+        if (!isPlainObject2(value)) {
+          throw new Error(`${valueLabel} must be an object`);
+        }
+        const unknownValueFields = Object.keys(value).filter(
+          (key) => !["key", "value", "type", "enabled"].includes(key)
+        );
+        if (unknownValueFields.length > 0) {
+          throw new Error(`${valueLabel} contains unsupported field "${unknownValueFields[0]}"`);
+        }
+        if (typeof value.key !== "string" || !value.key.trim() || value.key !== value.key.trim()) {
+          throw new Error(`${valueLabel}.key must be a non-empty string without surrounding whitespace`);
+        }
+        if (value.key === "x-pm-onboarding") {
+          throw new Error(`${valueLabel}.key is reserved by repo-sync`);
+        }
+        if (keys.has(value.key)) {
+          throw new Error(`${label} contains duplicate variable key "${value.key}"`);
+        }
+        keys.add(value.key);
+        if (value.value !== void 0 && typeof value.value !== "string") {
+          throw new Error(`${valueLabel}.value must be a string when provided`);
+        }
+        if (value.type !== void 0 && value.type !== "default" && value.type !== "secret") {
+          throw new Error(`${valueLabel}.type must be "default" or "secret"`);
+        }
+        if (value.enabled !== void 0 && typeof value.enabled !== "boolean") {
+          throw new Error(`${valueLabel}.enabled must be a boolean when provided`);
+        }
+        const type = value.type ?? "default";
+        const normalizedValue = value.value ?? "";
+        if (type === "secret" && normalizedValue) {
+          throw new Error(`${valueLabel} cannot contain a populated secret value; inject it at runtime`);
+        }
+        return { key: value.key, value: normalizedValue, type, enabled: value.enabled ?? true };
+      });
+    }
+    if (rich && !/^[A-Za-z0-9]+(?:[._-][A-Za-z0-9]+)*$/.test(slug)) {
+      throw new Error(`${label} rich slug must use only letters, numbers, dots, hyphens, or underscores`);
+    }
+    if (rich && Object.prototype.hasOwnProperty.call(Object.prototype, slug)) {
+      throw new Error(`${label} rich slug conflicts with a reserved object property`);
+    }
+    if (rich && /^(?:con|prn|aux|nul|com[1-9]|lpt[1-9])(?:\.|$)/i.test(slug)) {
+      throw new Error(`${label} rich slug conflicts with a Windows device name`);
+    }
+    if (!rich && !slug.trim()) {
+      throw new Error(`${label} slug must be a non-empty string`);
+    }
+    const priorWasRich = seen.get(slug);
+    if (priorWasRich !== void 0 && (rich || priorWasRich)) {
+      throw new Error(`environments-json contains duplicate slug "${slug}"`);
+    }
+    if (priorWasRich === void 0) seen.set(slug, rich);
+    environments.push(slug);
+  });
+  return { environments, definitions };
+}
+function normalizeProgrammaticEnvironmentDefinitions(inputs) {
+  const definitions = inputs.environmentDefinitions;
+  if (!definitions) return inputs;
+  const prototype = Object.getPrototypeOf(definitions);
+  if (prototype !== Object.prototype && prototype !== null) {
+    throw new Error("environmentDefinitions must be a plain object");
+  }
+  const entries = inputs.environments.map(
+    (slug) => Object.prototype.hasOwnProperty.call(definitions, slug) ? { slug, values: definitions[slug] } : slug
+  );
+  let raw;
+  try {
+    raw = JSON.stringify(entries);
+  } catch {
+    throw new Error("environmentDefinitions must contain JSON-serializable values");
   }
-  return parsed.map((entry) => String(entry));
+  const parsed = parseEnvironmentInputs(raw);
+  return { ...inputs, environments: parsed.environments, environmentDefinitions: parsed.definitions };
 }
 function normalizeRepoWriteMode(value) {
   if (value === "none" || value === "commit-only" || value === "commit-and-push") {
@@ -127751,7 +127860,7 @@ function resolveInputs(env = process.env) {
     },
     env
   );
-  const environments = parseJsonArray(getInput("environments-json", env) || '["prod"]');
+  const parsedEnvironments = parseEnvironmentInputs(getInput("environments-json", env) || '["prod"]');
   const secretsResolverProvider = parseSecretsResolverProvider(getInput("secrets-resolver", env));
   const systemEnvMap = parseJsonMap(getInput("system-env-map-json", env) || "{}");
   const environmentUids = parseJsonMap(getInput("environment-uids-json", env) || "{}");
@@ -127789,7 +127898,8 @@ function resolveInputs(env = process.env) {
     secretsResolverProvider,
     specSyncMode: normalizeSpecSyncMode(getInput("spec-sync-mode", env) || "update"),
     releaseLabel: normalizeReleaseLabel(getInput("release-label", env)) || void 0,
-    environments: environments.length > 0 ? environments : ["prod"],
+    environments: parsedEnvironments.environments.length > 0 ? parsedEnvironments.environments : ["prod"],
+    environmentDefinitions: parsedEnvironments.definitions,
     repoUrl: repoContext.repoUrl || "",
     integrationBackend: getInput("integration-backend", env) || "bifrost",
     workspaceLinkEnabled: parseBooleanInput(getInput("workspace-link-enabled", env), true),
@@ -128316,7 +128426,8 @@ async function upsertEnvironments(inputs, dependencies, resourcesState, assetMar
         }
       } catch {
       }
-      const values2 = buildEnvironmentValues(envName, runtimeUrl, {
+      const definedValues2 = inputs.environmentDefinitions?.[envName];
+      const values2 = definedValues2 ? definedValues2.map((value) => ({ ...value })) : buildEnvironmentValues(envName, runtimeUrl, {
         secretsResolverProvider: inputs.secretsResolverProvider,
         preservedCredentialValues: priorValues
       });
@@ -128339,7 +128450,8 @@ async function upsertEnvironments(inputs, dependencies, resourcesState, assetMar
       dependencies.core.setOutput("environment-uids-json", JSON.stringify(envUids));
       continue;
     }
-    const values = buildEnvironmentValues(envName, runtimeUrl, {
+    const definedValues = inputs.environmentDefinitions?.[envName];
+    const values = definedValues ? definedValues.map((value) => ({ ...value })) : buildEnvironmentValues(envName, runtimeUrl, {
       secretsResolverProvider: inputs.secretsResolverProvider
     });
     if (assetMarker) values.push({ key: "x-pm-onboarding", value: JSON.stringify(assetMarker), type: "default" });
@@ -129530,6 +129642,7 @@ async function commitAndPushGeneratedFiles(inputs, dependencies, privateMockAuth
   };
 }
 async function runRepoSync(inputs, dependencies, executionContext) {
+  inputs = normalizeProgrammaticEnvironmentDefinitions(inputs);
   const telemetry = createTelemetryContext({ action: "postman-repo-sync-action", actionVersion: resolveActionVersion2(), logger: dependencies.core });
   telemetry.setTeamId(dependencies.teamId);
   const logger = resolveRepoSyncLogger(dependencies);

package/dist/index.cjs

@@ -118120,6 +118120,8 @@ function buildCiWorkflowLines(installUrl, postmanRegion, privateMockAuth) {
     "jobs:",
     "  test:",
     "    runs-on: ubuntu-latest",
+    "    env:",
+    "      HAS_SSL_CERT: ${{ secrets.POSTMAN_SSL_CLIENT_CERT_B64 != '' }}",
     "    steps:",
     "      - uses: actions/checkout@v5",
     "      - name: Install Postman CLI",
@@ -118153,7 +118155,7 @@ function buildCiWorkflowLines(installUrl, postmanRegion, privateMockAuth) {
     "          end",
     "          RUBY",
     "      - name: Decode SSL certificates",
-    "        if: ${{ secrets.POSTMAN_SSL_CLIENT_CERT_B64 != '' }}",
+    "        if: ${{ env.HAS_SSL_CERT == 'true' }}",
     "        env:",
     "          POSTMAN_SSL_CLIENT_CERT_B64: ${{ secrets.POSTMAN_SSL_CLIENT_CERT_B64 }}",
     "          POSTMAN_SSL_CLIENT_KEY_B64: ${{ secrets.POSTMAN_SSL_CLIENT_KEY_B64 }}",
@@ -118478,8 +118480,11 @@ function renderGcWorkflowTemplate() {
   return [
     "name: Postman Preview GC",
     "on:",
+    // The delete event takes no branches/tags filter (GitHub only allows one on
+    // merge_group, push, pull_request, pull_request_target, and workflow_run).
+    // The previous ["**"] was a match-everything wildcard, so dropping it leaves
+    // the trigger behaviour unchanged.
     "  delete:",
-    '    branches: ["**"]',
     "  pull_request:",
     "    types: [closed]",
     "  schedule:",
@@ -121383,7 +121388,7 @@ var postmanRepoSyncActionContract = {
       default: ""
     },
     "environments-json": {
-      description: "JSON array of environment slugs to create or update.",
+      description: "JSON array of environment slugs or full definitions ({slug, values}) to create or replace. Secret-typed values must be empty runtime slots.",
       required: false,
       default: '["prod"]'
     },
@@ -129624,13 +129629,117 @@ function parseJsonMap(raw) {
     ])
   );
 }
-function parseJsonArray(raw) {
-  if (!raw.trim()) return [];
-  const parsed = JSON.parse(raw);
+function parseEnvironmentInputs(raw) {
+  if (!raw.trim()) return { environments: [], definitions: /* @__PURE__ */ Object.create(null) };
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    throw new Error("environments-json must contain valid JSON");
+  }
   if (!Array.isArray(parsed)) {
-    throw new Error("Expected JSON array");
+    throw new Error("environments-json must be a JSON array");
+  }
+  const environments = [];
+  const definitions = /* @__PURE__ */ Object.create(null);
+  const seen = /* @__PURE__ */ new Map();
+  parsed.forEach((entry, environmentIndex) => {
+    const label = `environments-json[${environmentIndex}]`;
+    let slug;
+    let rich = false;
+    if (typeof entry === "string") {
+      slug = entry;
+    } else {
+      if (!isPlainObject2(entry)) {
+        throw new Error(`${label} must be a slug string or an environment definition`);
+      }
+      const unknownFields = Object.keys(entry).filter((key) => key !== "slug" && key !== "values");
+      if (unknownFields.length > 0) {
+        throw new Error(`${label} contains unsupported field "${unknownFields[0]}"`);
+      }
+      if (typeof entry.slug !== "string" || !Array.isArray(entry.values)) {
+        throw new Error(`${label} must contain a string slug and a values array`);
+      }
+      slug = entry.slug;
+      rich = true;
+      const keys = /* @__PURE__ */ new Set();
+      definitions[slug] = entry.values.map((value, valueIndex) => {
+        const valueLabel = `${label}.values[${valueIndex}]`;
+        if (!isPlainObject2(value)) {
+          throw new Error(`${valueLabel} must be an object`);
+        }
+        const unknownValueFields = Object.keys(value).filter(
+          (key) => !["key", "value", "type", "enabled"].includes(key)
+        );
+        if (unknownValueFields.length > 0) {
+          throw new Error(`${valueLabel} contains unsupported field "${unknownValueFields[0]}"`);
+        }
+        if (typeof value.key !== "string" || !value.key.trim() || value.key !== value.key.trim()) {
+          throw new Error(`${valueLabel}.key must be a non-empty string without surrounding whitespace`);
+        }
+        if (value.key === "x-pm-onboarding") {
+          throw new Error(`${valueLabel}.key is reserved by repo-sync`);
+        }
+        if (keys.has(value.key)) {
+          throw new Error(`${label} contains duplicate variable key "${value.key}"`);
+        }
+        keys.add(value.key);
+        if (value.value !== void 0 && typeof value.value !== "string") {
+          throw new Error(`${valueLabel}.value must be a string when provided`);
+        }
+        if (value.type !== void 0 && value.type !== "default" && value.type !== "secret") {
+          throw new Error(`${valueLabel}.type must be "default" or "secret"`);
+        }
+        if (value.enabled !== void 0 && typeof value.enabled !== "boolean") {
+          throw new Error(`${valueLabel}.enabled must be a boolean when provided`);
+        }
+        const type = value.type ?? "default";
+        const normalizedValue = value.value ?? "";
+        if (type === "secret" && normalizedValue) {
+          throw new Error(`${valueLabel} cannot contain a populated secret value; inject it at runtime`);
+        }
+        return { key: value.key, value: normalizedValue, type, enabled: value.enabled ?? true };
+      });
+    }
+    if (rich && !/^[A-Za-z0-9]+(?:[._-][A-Za-z0-9]+)*$/.test(slug)) {
+      throw new Error(`${label} rich slug must use only letters, numbers, dots, hyphens, or underscores`);
+    }
+    if (rich && Object.prototype.hasOwnProperty.call(Object.prototype, slug)) {
+      throw new Error(`${label} rich slug conflicts with a reserved object property`);
+    }
+    if (rich && /^(?:con|prn|aux|nul|com[1-9]|lpt[1-9])(?:\.|$)/i.test(slug)) {
+      throw new Error(`${label} rich slug conflicts with a Windows device name`);
+    }
+    if (!rich && !slug.trim()) {
+      throw new Error(`${label} slug must be a non-empty string`);
+    }
+    const priorWasRich = seen.get(slug);
+    if (priorWasRich !== void 0 && (rich || priorWasRich)) {
+      throw new Error(`environments-json contains duplicate slug "${slug}"`);
+    }
+    if (priorWasRich === void 0) seen.set(slug, rich);
+    environments.push(slug);
+  });
+  return { environments, definitions };
+}
+function normalizeProgrammaticEnvironmentDefinitions(inputs) {
+  const definitions = inputs.environmentDefinitions;
+  if (!definitions) return inputs;
+  const prototype = Object.getPrototypeOf(definitions);
+  if (prototype !== Object.prototype && prototype !== null) {
+    throw new Error("environmentDefinitions must be a plain object");
+  }
+  const entries = inputs.environments.map(
+    (slug) => Object.prototype.hasOwnProperty.call(definitions, slug) ? { slug, values: definitions[slug] } : slug
+  );
+  let raw;
+  try {
+    raw = JSON.stringify(entries);
+  } catch {
+    throw new Error("environmentDefinitions must contain JSON-serializable values");
   }
-  return parsed.map((entry) => String(entry));
+  const parsed = parseEnvironmentInputs(raw);
+  return { ...inputs, environments: parsed.environments, environmentDefinitions: parsed.definitions };
 }
 function readInput(actionCore, name, required = false) {
   return actionCore.getInput(name, { required }).trim();
@@ -129727,7 +129836,7 @@ function resolveInputs(env = process.env) {
     },
     env
   );
-  const environments = parseJsonArray(getInput2("environments-json", env) || '["prod"]');
+  const parsedEnvironments = parseEnvironmentInputs(getInput2("environments-json", env) || '["prod"]');
   const secretsResolverProvider = parseSecretsResolverProvider(getInput2("secrets-resolver", env));
   const systemEnvMap = parseJsonMap(getInput2("system-env-map-json", env) || "{}");
   const environmentUids = parseJsonMap(getInput2("environment-uids-json", env) || "{}");
@@ -129765,7 +129874,8 @@ function resolveInputs(env = process.env) {
     secretsResolverProvider,
     specSyncMode: normalizeSpecSyncMode(getInput2("spec-sync-mode", env) || "update"),
     releaseLabel: normalizeReleaseLabel(getInput2("release-label", env)) || void 0,
-    environments: environments.length > 0 ? environments : ["prod"],
+    environments: parsedEnvironments.environments.length > 0 ? parsedEnvironments.environments : ["prod"],
+    environmentDefinitions: parsedEnvironments.definitions,
     repoUrl: repoContext.repoUrl || "",
     integrationBackend: getInput2("integration-backend", env) || "bifrost",
     workspaceLinkEnabled: parseBooleanInput(getInput2("workspace-link-enabled", env), true),
@@ -130433,7 +130543,8 @@ async function upsertEnvironments(inputs, dependencies, resourcesState, assetMar
         }
       } catch {
       }
-      const values2 = buildEnvironmentValues(envName, runtimeUrl, {
+      const definedValues2 = inputs.environmentDefinitions?.[envName];
+      const values2 = definedValues2 ? definedValues2.map((value) => ({ ...value })) : buildEnvironmentValues(envName, runtimeUrl, {
         secretsResolverProvider: inputs.secretsResolverProvider,
         preservedCredentialValues: priorValues
       });
@@ -130456,7 +130567,8 @@ async function upsertEnvironments(inputs, dependencies, resourcesState, assetMar
       dependencies.core.setOutput("environment-uids-json", JSON.stringify(envUids));
       continue;
     }
-    const values = buildEnvironmentValues(envName, runtimeUrl, {
+    const definedValues = inputs.environmentDefinitions?.[envName];
+    const values = definedValues ? definedValues.map((value) => ({ ...value })) : buildEnvironmentValues(envName, runtimeUrl, {
       secretsResolverProvider: inputs.secretsResolverProvider
     });
     if (assetMarker) values.push({ key: "x-pm-onboarding", value: JSON.stringify(assetMarker), type: "default" });
@@ -131647,6 +131759,7 @@ async function commitAndPushGeneratedFiles(inputs, dependencies, privateMockAuth
   };
 }
 async function runRepoSync(inputs, dependencies, executionContext) {
+  inputs = normalizeProgrammaticEnvironmentDefinitions(inputs);
   const telemetry = createTelemetryContext({ action: "postman-repo-sync-action", actionVersion: resolveActionVersion2(), logger: dependencies.core });
   telemetry.setTeamId(dependencies.teamId);
   const logger = resolveRepoSyncLogger(dependencies);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@postman-cs/onboarding-repo-sync",
-  "version": "2.10.9",
+  "version": "2.11.1",
   "description": "Postman repo sync GitHub Action.",
   "type": "module",
   "main": "dist/index.cjs",
@@ -25,6 +25,7 @@
     "verify:dist:assert": "npm run verify:dist:shape && npm run verify:dist:parity",
     "verify:dist": "npm run build && npm run verify:dist:assert",
     "docs:tables": "node scripts/render-action-tables.mjs",
+    "docs:pins": "node scripts/check-doc-pins.mjs",
     "lint": "eslint .",
     "lint:fix": "eslint . --fix",
     "test": "vitest run --exclude tests/ci-workflow-template.test.ts && vitest run tests/ci-workflow-template.test.ts && node --test .github/scripts/dispatch-e2e-monitor.test.mjs .github/scripts/prefetch-vendored-deps.test.mjs .github/scripts/verify-e2e-release.test.mjs",