@postman-cse/onboarding-repo-sync 1.0.4 → 2.0.0

package/README.md

@@ -31,12 +31,12 @@ jobs:
       - uses: actions/checkout@v5
 
       - id: postman-auth
-        uses: postman-cs/postman-resolve-service-token-action@v1
+        uses: postman-cs/postman-resolve-service-token-action@v2
         with:
           postman-region: us
           postman-api-key: ${{ secrets.POSTMAN_API_KEY }}
 
-      - uses: postman-cs/postman-repo-sync-action@v1
+      - uses: postman-cs/postman-repo-sync-action@v2
         with:
           project-name: core-payments
           postman-region: us
@@ -57,7 +57,7 @@ The example permissions let `GITHUB_TOKEN` commit generated artifacts and update
 ### Full sync with workspace assets
 
 ```yaml
-- uses: postman-cs/postman-repo-sync-action@v1
+- uses: postman-cs/postman-repo-sync-action@v2
   with:
     project-name: core-payments
     workspace-id: ws-123
@@ -73,7 +73,7 @@ The example permissions let `GITHUB_TOKEN` commit generated artifacts and update
     github-token: ${{ secrets.GITHUB_TOKEN }}
 ```
 
-`postman-access-token` is required for workspace-to-repository linking, system environment association, and API key generation. Use `postman-resolve-service-token-action` to mint it at runtime from a [Postman service account](https://learning.postman.com/docs/administration/service-accounts/) PMAK. If it is omitted, those integration steps are skipped and the remaining artifact sync can still run with `postman-api-key`. See [docs/credentials.md](docs/credentials.md).
+`postman-access-token` is required: every asset operation (environment create/get/update, collection read, mock, monitor) plus workspace-to-repository linking and system environment association runs through the access-token gateway. Use `postman-resolve-service-token-action` to mint it at runtime from a [Postman service account](https://learning.postman.com/docs/administration/service-accounts/) PMAK. Without it the action fails fast — the PMAK is not an asset-routing fallback; it only mints/re-mints the access token, powers the generated CI workflow's `postman login --with-api-key`, and mints the CI `POSTMAN_API_KEY` secret. See [docs/credentials.md](docs/credentials.md).
 
 ### Disable CI workflow generation
 
@@ -137,7 +137,7 @@ with:
 | Name | Description | Required | Default |
 | --- | --- | --- | --- |
 | `generate-ci-workflow` | Whether to generate the CI workflow file | no | `true` |
-| `ci-workflow-path` | Path to write the generated CI workflow file | no | `.github/workflows/ci.yml` |
+| `ci-workflow-path` | Path to write the generated CI workflow file. Defaults to azure-pipelines.yml for Azure DevOps, .github/workflows/ci.yml otherwise. | no |  |
 | `project-name` | Service project name used for environment, mock, and monitor naming. | yes |  |
 | `workspace-id` | Postman workspace ID used for workspace-link and export metadata. | no |  |
 | `baseline-collection-id` | Baseline collection ID used for exported artifacts and mock server creation. | no |  |
@@ -151,7 +151,9 @@ with:
 | `mock-url` | Existing mock server URL. When set, the action validates and reuses this mock instead of creating a new one. | no |  |
 | `monitor-cron` | Cron expression for monitor scheduling (e.g. '0 */6 * * *'). When empty, the monitor is created disabled and triggered to run once per workflow invocation (and once on every subsequent run). | no | `""` |
 | `environments-json` | JSON array of environment slugs to create or update. | no | `["prod"]` |
-| `repo-url` | Explicit repository URL (GitHub or GitLab). Defaults to https://github.com/$GITHUB_REPOSITORY on GitHub Actions, or $CI_PROJECT_URL on GitLab CI, when omitted. | no |  |
+| `git-provider` | Git provider override ('github', 'gitlab', 'bitbucket', 'azure-devops'). Auto-detected from environment when omitted. | no |  |
+| `ado-token` | Azure DevOps personal access token or system token used to push commits in Azure Pipelines. Defaults to SYSTEM_ACCESSTOKEN when available. | no |  |
+| `repo-url` | Explicit repository URL (GitHub, GitLab, or Azure DevOps). Defaults to the URL inferred from runner environment when omitted. | no |  |
 | `workspace-link-enabled` | Enable workspace linking. | no | `true` |
 | `environment-sync-enabled` | Enable association of Postman environments to system environments. | no | `true` |
 | `system-env-map-json` | JSON map of environment slug to system environment id. | no | `{}` |
@@ -162,9 +164,9 @@ with:
 | `current-ref` | Explicit ref override for push-changes when the checkout is detached. | no |  |
 | `committer-name` | Git committer name for sync commits. | no | `Postman` |
 | `committer-email` | Git committer email for sync commits. | no | `support@postman.com` |
-| `postman-api-key` | Postman API key used for environment, mock, and monitor operations. | no |  |
-| `postman-access-token` | Postman access token used for workspace linking, system environment association, and generated API-key creation. | no |  |
-| `team-id` | Postman team ID resolved by postman-resolve-service-token-action for org-mode integration calls. Falls back to POSTMAN_TEAM_ID when omitted. | no | `""` |
+| `postman-api-key` | Postman API key (PMAK). Used only to mint/re-mint the access token (via postman-resolve-service-token-action) and for the Postman CLI spec-lint login. Asset operations (environments, collections, mocks, monitors) run on the access-token gateway and do not use the PMAK. Optional when a valid postman-access-token is supplied; required only for the CLI lint path. | no |  |
+| `postman-access-token` | Postman access token minted by postman-resolve-service-token-action. Required for all asset operations (environment create/get/update, collection read, mock, monitor) which run through the access-token gateway. Also used for workspace linking, system environment association, and generated API-key creation. Without it the action fails fast — PMAK is not an asset-routing fallback. | yes |  |
+| `team-id` | Postman team ID resolved by postman-resolve-service-token-action. Primary team scope for all downstream actions; included as x-entity-team-id in org-mode Bifrost calls. Falls back to POSTMAN_TEAM_ID when omitted. Set explicitly for org-mode teams. | no | `""` |
 | `credential-preflight` | Credential identity preflight policy. warn (default) logs a note and continues when postman-api-key and postman-access-token resolve to different parent orgs; enforce fails the run on that condition before any workspace is created. Both modes warn when postman-access-token is not a service-account token. | no | `warn` |
 | `github-token` | GitHub token used for repo variable persistence and commits. | no |  |
 | `gh-fallback-token` | Fallback token for repository variable APIs and workflow-file pushes. | no |  |

package/action.yml

@@ -11,9 +11,8 @@ inputs:
     required: false
     default: "true"
   ci-workflow-path:
-    description: Path to write the generated CI workflow file
+    description: Path to write the generated CI workflow file. Defaults to azure-pipelines.yml for Azure DevOps, .github/workflows/ci.yml otherwise.
     required: false
-    default: .github/workflows/ci.yml
   project-name:
     description: Service project name used for environment, mock, and monitor naming.
     required: true
@@ -58,8 +57,14 @@ inputs:
     description: JSON array of environment slugs to create or update.
     required: false
     default: '["prod"]'
+  git-provider:
+    description: Git provider override ('github', 'gitlab', 'bitbucket', 'azure-devops'). Auto-detected from environment when omitted.
+    required: false
+  ado-token:
+    description: Azure DevOps personal access token or system token used to push commits in Azure Pipelines. Defaults to SYSTEM_ACCESSTOKEN when available.
+    required: false
   repo-url:
-    description: 'Explicit repository URL (GitHub or GitLab). Defaults to https://github.com/$GITHUB_REPOSITORY on GitHub Actions, or $CI_PROJECT_URL on GitLab CI, when omitted.'
+    description: 'Explicit repository URL (GitHub, GitLab, or Azure DevOps). Defaults to the URL inferred from runner environment when omitted.'
     required: false
   integration-backend:
     description: Advanced/internal. Integration backend for managed workspace linking and environment sync; leave unset to use the default.
@@ -104,13 +109,13 @@ inputs:
     required: false
     default: support@postman.com
   postman-api-key:
-    description: Postman API key used for environment, mock, and monitor operations.
+    description: Postman API key (PMAK). Used only to mint/re-mint the access token (via postman-resolve-service-token-action) and for the Postman CLI spec-lint login. Asset operations (environments, collections, mocks, monitors) run on the access-token gateway and do not use the PMAK. Optional when a valid postman-access-token is supplied; required only for the CLI lint path.
     required: false
   postman-access-token:
-    description: Postman access token used for workspace linking, system environment association, and generated API-key creation.
-    required: false
+    description: Postman access token minted by postman-resolve-service-token-action. Required for all asset operations (environment create/get/update, collection read, mock, monitor) which run through the access-token gateway. Also used for workspace linking, system environment association, and generated API-key creation. Without it the action fails fast — PMAK is not an asset-routing fallback.
+    required: true
   team-id:
-    description: Postman team ID resolved by postman-resolve-service-token-action for org-mode integration calls. Falls back to POSTMAN_TEAM_ID when omitted.
+    description: Postman team ID resolved by postman-resolve-service-token-action. Primary team scope for all downstream actions; included as x-entity-team-id in org-mode Bifrost calls. Falls back to POSTMAN_TEAM_ID when omitted. Set explicitly for org-mode teams.
     required: false
     default: ""
   credential-preflight: