@postman-cse/onboarding-repo-sync 2.5.0 → 2.6.1

package/README.md

@@ -185,6 +185,7 @@ with:
 | `postman-api-key` | Postman API key (PMAK). Used only to mint/re-mint the access token (via postman-resolve-service-token-action) and for the Postman CLI spec-lint login. Asset operations (environments, collections, mocks, monitors) run on the access-token gateway and do not use the PMAK. Optional when a valid postman-access-token is supplied; required only for the CLI lint path. | no |  |
 | `postman-access-token` | Postman access token minted by postman-resolve-service-token-action. Required for all asset operations (environment create/get/update, collection read, mock, monitor) which run through the access-token gateway. Also used for workspace linking, system environment association, and generated API-key creation. When omitted, the action mints one from postman-api-key (service-account PMAK); if that mint also fails the action fails fast — PMAK is never an asset-routing fallback. | no |  |
 | `team-id` | Postman team ID resolved by postman-resolve-service-token-action. Primary team scope for all downstream actions; included as x-entity-team-id in org-mode Bifrost calls. Falls back to POSTMAN_TEAM_ID when omitted. Set explicitly for org-mode teams. | no | `""` |
+| `secrets-resolver` | Cloud secret store the generated environments seed credential slots for: none (default, no secret-store variables are added), aws (AWS Secrets Manager), azure (Azure Key Vault), or gcp (Google Secret Manager). Must match the secrets-resolver value passed to the bootstrap and smoke-flow actions. | no | `none` |
 | `credential-preflight` | Credential identity preflight policy. warn (default) logs a note and continues when postman-api-key and postman-access-token resolve to different parent orgs; enforce fails the run on that condition before any workspace is created. Both modes warn when postman-access-token is not a service-account token. | no | `warn` |
 | `branch-strategy` | Branch-aware sync strategy. legacy (default) keeps branch-blind behavior; publish-gate restricts canonical writes to the canonical branch and skips repo-sync on other branches; preview additionally maintains suffixed per-branch preview asset sets. | no | `legacy` |
 | `canonical-branch` | Explicit canonical branch (the sole writer of canonical assets and tracked state). Defaults to the provider-resolved default branch; required on providers without a default-branch variable (Bitbucket, Azure DevOps) when branch-strategy is not legacy. | no |  |

package/action.yml

@@ -134,6 +134,10 @@ inputs:
     description: Postman team ID resolved by postman-resolve-service-token-action. Primary team scope for all downstream actions; included as x-entity-team-id in org-mode Bifrost calls. Falls back to POSTMAN_TEAM_ID when omitted. Set explicitly for org-mode teams.
     required: false
     default: ""
+  secrets-resolver:
+    description: 'Cloud secret store the generated environments seed credential slots for: none (default, no secret-store variables are added), aws (AWS Secrets Manager), azure (Azure Key Vault), or gcp (Google Secret Manager). Must match the secrets-resolver value passed to the bootstrap and smoke-flow actions.'
+    required: false
+    default: "none"
   credential-preflight:
     description: 'Credential identity preflight policy. warn (default) logs a note and continues when postman-api-key and postman-access-token resolve to different parent orgs; enforce fails the run on that condition before any workspace is created. Both modes warn when postman-access-token is not a service-account token.'
     required: false

package/dist/action.cjs

@@ -135759,6 +135759,49 @@ function createLogger(options) {
   return root;
 }
 
+// node_modules/@postman-cse/automation-core/dist/secrets-resolver.js
+var SECRETS_RESOLVER_PROVIDERS = ["none", "aws", "azure", "gcp"];
+var DEFAULT_SECRETS_RESOLVER_PROVIDER = "none";
+function parseSecretsResolverProvider(value, fallback = DEFAULT_SECRETS_RESOLVER_PROVIDER) {
+  const raw = String(value ?? "").trim().toLowerCase();
+  if (!raw)
+    return fallback;
+  if (raw === "true")
+    return "aws";
+  if (raw === "false" || raw === "off")
+    return "none";
+  if (SECRETS_RESOLVER_PROVIDERS.includes(raw)) {
+    return raw;
+  }
+  throw new Error(`SECRETS_RESOLVER_PROVIDER_INVALID: expected one of ${SECRETS_RESOLVER_PROVIDERS.join(", ")} (or legacy true/false), received "${value}"`);
+}
+function secretsResolverEnvironmentKeys(provider) {
+  switch (provider) {
+    case "aws":
+      return [
+        { key: "AWS_ACCESS_KEY_ID", secret: true },
+        { key: "AWS_SECRET_ACCESS_KEY", secret: true },
+        { key: "AWS_REGION", secret: false },
+        { key: "AWS_SECRET_NAME", secret: false }
+      ];
+    case "azure":
+      return [
+        { key: "AZURE_KEY_VAULT_NAME", secret: false },
+        { key: "AZURE_SECRET_NAME", secret: false },
+        { key: "AZURE_ACCESS_TOKEN", secret: true }
+      ];
+    case "gcp":
+      return [
+        { key: "GCP_PROJECT_ID", secret: false },
+        { key: "GCP_SECRET_NAME", secret: false },
+        { key: "GCP_ACCESS_TOKEN", secret: true }
+      ];
+    case "none":
+    default:
+      return [];
+  }
+}
+
 // src/action-version.ts
 var import_node_fs3 = require("node:fs");
 var import_node_path2 = require("node:path");
@@ -136962,6 +137005,12 @@ var postmanRepoSyncActionContract = {
       required: false,
       default: ""
     },
+    "secrets-resolver": {
+      description: "Cloud secret store the generated environments seed credential slots for (none, aws, azure, gcp). Must match the value passed to bootstrap and smoke-flow.",
+      required: false,
+      default: "none",
+      allowedValues: ["none", "aws", "azure", "gcp"]
+    },
     "credential-preflight": {
       description: "Credential identity preflight policy. warn (default) logs a note and continues when postman-api-key and postman-access-token resolve to different parent orgs; enforce fails the run on that condition before any workspace is created. Both modes warn when postman-access-token is not a service-account token.",
       required: false,
@@ -137519,6 +137568,12 @@ var MockContractError = class extends Error {
     this.name = "MockContractError";
   }
 };
+var AmbiguousMonitorRebindError = class extends Error {
+  constructor(message, options) {
+    super(message, options);
+    this.name = "AmbiguousMonitorRebindError";
+  }
+};
 function requireMockVisibility(mock, requested) {
   if (mock.visibility === "unknown") {
     throw new MockContractError(
@@ -138355,6 +138410,73 @@ var PostmanGatewayAssetsClient = class {
     );
     return match?.uid ? { uid: match.uid, name: match.name } : null;
   }
+  pickRebindMonitorCandidates(monitors, monitorName, environment) {
+    const nameOnly = monitors.filter((monitor) => monitor.name === monitorName);
+    const nameOnlyEnvironments = [
+      ...new Set(nameOnly.map((monitor) => monitor.environmentUid || "(none)"))
+    ];
+    const candidates = nameOnly.filter((monitor) => monitor.environmentUid === environment);
+    return { candidates, nameOnlyMatchCount: nameOnly.length, nameOnlyEnvironments };
+  }
+  /**
+   * Rebind the sole same-name monitor in this workspace onto the current
+   * collection UID.
+   *
+   * The canonical Smoke collection can legitimately change UID (a bootstrap
+   * re-import after a marker/stranger miss, or an operator rebuild). The
+   * monitor still points at the previous UID, so `findMonitorByCollection`
+   * (which requires the full collection+environment+name triple) misses and a
+   * second monitor with the same name would be created on every run, orphaning
+   * the old one. Name plus environment is the stable identity across a
+   * collection re-import, so recover it here instead.
+   *
+   * Returns null when nothing needs rebinding (no same-name monitor, or it is
+   * already bound to this collection). Refuses to guess when several same-name
+   * monitors match, matching `selectExactMatch` semantics elsewhere.
+   */
+  async rebindMonitorByName(name, collectionUid, environmentUid) {
+    const monitorName = String(name ?? "").trim();
+    const collection = String(collectionUid ?? "").trim();
+    const environment = String(environmentUid ?? "").trim();
+    if (!monitorName || !collection) {
+      return null;
+    }
+    const monitors = await this.listMonitors();
+    const { candidates, nameOnlyMatchCount, nameOnlyEnvironments } = this.pickRebindMonitorCandidates(
+      monitors,
+      monitorName,
+      environment
+    );
+    let match;
+    try {
+      match = this.selectExactMatch(
+        "monitor",
+        `workspace ${this.workspaceId}, name "${monitorName}", and environment ${environment || "(none)"}`,
+        candidates
+      );
+    } catch (error2) {
+      const message = error2 instanceof Error && nameOnlyMatchCount > 0 ? `${error2.message} Same-name monitor(s) also exist on environment(s): ${nameOnlyEnvironments.join(", ")}.` : error2 instanceof Error ? error2.message : String(error2);
+      throw new AmbiguousMonitorRebindError(message, { cause: error2 });
+    }
+    if (!match?.uid) {
+      if (nameOnlyMatchCount > 0) {
+      }
+      return null;
+    }
+    if (match.collectionUid === collection) {
+      return null;
+    }
+    await this.gateway.requestJson(
+      {
+        service: "monitors",
+        method: "put",
+        path: `/jobTemplates/${this.toModelId(match.uid)}?_etc=true`,
+        body: { collection }
+      },
+      { retryTransient: false }
+    );
+    return { uid: match.uid, previousCollectionUid: match.collectionUid };
+  }
   async runMonitor(uid) {
     await this.gateway.requestJson(
       {
@@ -139527,6 +139649,7 @@ function resolveInputs(env = process.env) {
     env
   );
   const environments = parseJsonArray(getInput2("environments-json", env) || '["prod"]');
+  const secretsResolverProvider = parseSecretsResolverProvider(getInput2("secrets-resolver", env));
   const systemEnvMap = parseJsonMap(getInput2("system-env-map-json", env) || "{}");
   const environmentUids = parseJsonMap(getInput2("environment-uids-json", env) || "{}");
   const envRuntimeUrls = parseJsonMap(getInput2("env-runtime-urls-json", env) || "{}");
@@ -139544,6 +139667,7 @@ function resolveInputs(env = process.env) {
     specContentChanged: parseBooleanInput(getInput2("spec-content-changed", env), true),
     specPath: getInput2("spec-path", env),
     collectionSyncMode: normalizeCollectionSyncMode(getInput2("collection-sync-mode", env) || "refresh"),
+    secretsResolverProvider,
     specSyncMode: normalizeSpecSyncMode(getInput2("spec-sync-mode", env) || "update"),
     releaseLabel: normalizeReleaseLabel(getInput2("release-label", env)) || void 0,
     environments: environments.length > 0 ? environments : ["prod"],
@@ -139633,7 +139757,20 @@ function assertBranchAssetIds(inputs, decision, branchOwnedIds = process.env.POS
     );
   }
 }
+var CREDENTIAL_SLOT_PREFIXES = ["AWS_", "AZURE_", "GCP_"];
+function isCredentialSlotKey(key) {
+  return typeof key === "string" && CREDENTIAL_SLOT_PREFIXES.some((prefix) => key.startsWith(prefix));
+}
 function buildEnvironmentValues(envName, baseUrl, options = {}) {
+  const seeded = secretsResolverEnvironmentKeys(options.secretsResolverProvider ?? "none").map((entry) => ({
+    key: entry.key,
+    value: entry.key.endsWith("_SECRET_NAME") && !entry.secret ? `api-credentials-${envName}` : entry.defaultValue ?? "",
+    type: entry.secret ? "secret" : "default"
+  }));
+  const seededKeys = new Set(seeded.map((entry) => entry.key));
+  const preserved = (options.preservedCredentialValues ?? []).filter(
+    (entry) => isCredentialSlotKey(entry.key) && !seededKeys.has(entry.key)
+  );
   return [
     { key: "baseUrl", value: baseUrl, type: "default" },
     // A private mock refuses anonymous calls, so the manual-validation environment
@@ -139642,10 +139779,11 @@ function buildEnvironmentValues(envName, baseUrl, options = {}) {
     ...options.privateMockAuth ? [{ key: PRIVATE_MOCK_AUTH_VARIABLE2, value: "", type: "secret" }] : [],
     { key: "CI", value: "false", type: "default" },
     { key: "RESPONSE_TIME_THRESHOLD", value: "2000", type: "default" },
-    { key: "AWS_ACCESS_KEY_ID", value: "", type: "secret" },
-    { key: "AWS_SECRET_ACCESS_KEY", value: "", type: "secret" },
-    { key: "AWS_REGION", value: "eu-west-2", type: "default" },
-    { key: "AWS_SECRET_NAME", value: `api-credentials-${envName}`, type: "default" }
+    // Provider-scoped credential slots. `none` (the default) seeds nothing, so a
+    // consumer that does not use a cloud secret store gets a clean environment
+    // instead of four dead AWS variables.
+    ...seeded,
+    ...preserved
   ];
 }
 var LEGACY_BASELINE_COLLECTION_PREFIX = "[Baseline]";
@@ -140131,19 +140269,28 @@ async function upsertEnvironments(inputs, dependencies, resourcesState, assetMar
     }
     if (existingUid) {
       let marker = assetMarker;
-      if (marker) {
-        try {
-          const existing = await dependencies.postman.getEnvironment(existingUid);
-          const values3 = existing.data?.values ?? existing.values ?? [];
-          const prior = values3.find((value) => value.key === "x-pm-onboarding")?.value;
+      let priorValues = [];
+      try {
+        const existing = await dependencies.postman.getEnvironment(existingUid);
+        const values3 = existing?.data?.values ?? existing?.values ?? [];
+        priorValues = values3.filter((value) => typeof value?.key === "string").map((value) => ({
+          key: value.key,
+          value: typeof value.value === "string" ? value.value : "",
+          type: value.type === "secret" ? "secret" : "default"
+        }));
+        if (marker) {
+          const prior = priorValues.find((value) => value.key === "x-pm-onboarding")?.value;
           const priorMarker = parseAssetMarker(prior ? `x-pm-onboarding: ${prior}` : void 0);
           if (priorMarker?.repo === marker.repo && priorMarker.rawBranch === marker.rawBranch) {
             marker = { ...marker, createdAt: priorMarker.createdAt };
           }
-        } catch {
         }
+      } catch {
       }
-      const values2 = buildEnvironmentValues(envName, runtimeUrl);
+      const values2 = buildEnvironmentValues(envName, runtimeUrl, {
+        secretsResolverProvider: inputs.secretsResolverProvider,
+        preservedCredentialValues: priorValues
+      });
       if (marker) values2.push({ key: "x-pm-onboarding", value: JSON.stringify(marker), type: "default" });
       try {
         await dependencies.postman.updateEnvironment(existingUid, displayName, values2);
@@ -140163,7 +140310,9 @@ async function upsertEnvironments(inputs, dependencies, resourcesState, assetMar
       dependencies.core.setOutput("environment-uids-json", JSON.stringify(envUids));
       continue;
     }
-    const values = buildEnvironmentValues(envName, runtimeUrl);
+    const values = buildEnvironmentValues(envName, runtimeUrl, {
+      secretsResolverProvider: inputs.secretsResolverProvider
+    });
     if (assetMarker) values.push({ key: "x-pm-onboarding", value: JSON.stringify(assetMarker), type: "default" });
     try {
       envUids[envName] = await dependencies.postman.createEnvironment(
@@ -140192,7 +140341,10 @@ async function upsertMockEnvironment(inputs, dependencies, assetProjectName, moc
     return "";
   }
   const displayName = `${assetProjectName} - Mock`;
-  const values = buildEnvironmentValues("mock", mockUrl, { privateMockAuth });
+  const values = buildEnvironmentValues("mock", mockUrl, {
+    privateMockAuth,
+    secretsResolverProvider: inputs.secretsResolverProvider
+  });
   const mask = resolveRepoSyncMasker(dependencies);
   try {
     const discovered = await dependencies.postman.findEnvironmentByName(
@@ -141463,6 +141615,43 @@ async function runRepoSyncInner(inputs, dependencies) {
           );
         }
       }
+      if (!resolvedMonitorId && inputs.smokeCollectionId && dependencies.postman.rebindMonitorByName) {
+        try {
+          const rebound = await dependencies.postman.rebindMonitorByName(
+            monitorName,
+            inputs.smokeCollectionId,
+            monitorEnvUid
+          );
+          if (rebound) {
+            resolvedMonitorId = rebound.uid;
+            dependencies.core.info(
+              `Rebound existing monitor ${rebound.uid} ("${monitorName}") from collection ${rebound.previousCollectionUid} to ${inputs.smokeCollectionId}`
+            );
+          }
+        } catch (error2) {
+          if (error2 instanceof AmbiguousMonitorRebindError) {
+            throw new Error(
+              formatOrchestrationIssue({
+                operation: "Monitor rebind",
+                entity: `monitor "${monitorName}" workspace ${inputs.workspaceId} collection ${inputs.smokeCollectionId} environment ${monitorEnvUid}`,
+                cause: error2,
+                remediation: monitorRemediation,
+                mask
+              }),
+              { cause: error2 }
+            );
+          }
+          dependencies.core.warning(
+            formatOrchestrationIssue({
+              operation: "Monitor rebind",
+              entity: `monitor "${monitorName}" workspace ${inputs.workspaceId} collection ${inputs.smokeCollectionId} environment ${monitorEnvUid}`,
+              cause: error2,
+              remediation: monitorRemediation,
+              mask
+            })
+          );
+        }
+      }
       if (!resolvedMonitorId) {
         try {
           resolvedMonitorId = await dependencies.postman.createMonitor(
@@ -141884,6 +142073,7 @@ function createRepoSyncDependencies(inputs, resolved, factories, options = {}) {
     listMonitors: gatewayAssets.listMonitors.bind(gatewayAssets),
     monitorExists: gatewayAssets.monitorExists.bind(gatewayAssets),
     findMonitorByCollection: gatewayAssets.findMonitorByCollection.bind(gatewayAssets),
+    rebindMonitorByName: gatewayAssets.rebindMonitorByName.bind(gatewayAssets),
     runMonitor: gatewayAssets.runMonitor.bind(gatewayAssets),
     listEnvironments: gatewayAssets.listEnvironments.bind(gatewayAssets),
     // GC path (preview/channel retention machine — lib/repo/preview-gc.ts).

package/dist/cli.cjs

@@ -133864,6 +133864,49 @@ function createLogger(options) {
   return root;
 }
 
+// node_modules/@postman-cse/automation-core/dist/secrets-resolver.js
+var SECRETS_RESOLVER_PROVIDERS = ["none", "aws", "azure", "gcp"];
+var DEFAULT_SECRETS_RESOLVER_PROVIDER = "none";
+function parseSecretsResolverProvider(value, fallback = DEFAULT_SECRETS_RESOLVER_PROVIDER) {
+  const raw = String(value ?? "").trim().toLowerCase();
+  if (!raw)
+    return fallback;
+  if (raw === "true")
+    return "aws";
+  if (raw === "false" || raw === "off")
+    return "none";
+  if (SECRETS_RESOLVER_PROVIDERS.includes(raw)) {
+    return raw;
+  }
+  throw new Error(`SECRETS_RESOLVER_PROVIDER_INVALID: expected one of ${SECRETS_RESOLVER_PROVIDERS.join(", ")} (or legacy true/false), received "${value}"`);
+}
+function secretsResolverEnvironmentKeys(provider) {
+  switch (provider) {
+    case "aws":
+      return [
+        { key: "AWS_ACCESS_KEY_ID", secret: true },
+        { key: "AWS_SECRET_ACCESS_KEY", secret: true },
+        { key: "AWS_REGION", secret: false },
+        { key: "AWS_SECRET_NAME", secret: false }
+      ];
+    case "azure":
+      return [
+        { key: "AZURE_KEY_VAULT_NAME", secret: false },
+        { key: "AZURE_SECRET_NAME", secret: false },
+        { key: "AZURE_ACCESS_TOKEN", secret: true }
+      ];
+    case "gcp":
+      return [
+        { key: "GCP_PROJECT_ID", secret: false },
+        { key: "GCP_SECRET_NAME", secret: false },
+        { key: "GCP_ACCESS_TOKEN", secret: true }
+      ];
+    case "none":
+    default:
+      return [];
+  }
+}
+
 // src/action-version.ts
 var import_node_fs3 = require("node:fs");
 var import_node_path2 = require("node:path");
@@ -135067,6 +135110,12 @@ var postmanRepoSyncActionContract = {
       required: false,
       default: ""
     },
+    "secrets-resolver": {
+      description: "Cloud secret store the generated environments seed credential slots for (none, aws, azure, gcp). Must match the value passed to bootstrap and smoke-flow.",
+      required: false,
+      default: "none",
+      allowedValues: ["none", "aws", "azure", "gcp"]
+    },
     "credential-preflight": {
       description: "Credential identity preflight policy. warn (default) logs a note and continues when postman-api-key and postman-access-token resolve to different parent orgs; enforce fails the run on that condition before any workspace is created. Both modes warn when postman-access-token is not a service-account token.",
       required: false,
@@ -135624,6 +135673,12 @@ var MockContractError = class extends Error {
     this.name = "MockContractError";
   }
 };
+var AmbiguousMonitorRebindError = class extends Error {
+  constructor(message, options) {
+    super(message, options);
+    this.name = "AmbiguousMonitorRebindError";
+  }
+};
 function requireMockVisibility(mock, requested) {
   if (mock.visibility === "unknown") {
     throw new MockContractError(
@@ -136460,6 +136515,73 @@ var PostmanGatewayAssetsClient = class {
     );
     return match?.uid ? { uid: match.uid, name: match.name } : null;
   }
+  pickRebindMonitorCandidates(monitors, monitorName, environment) {
+    const nameOnly = monitors.filter((monitor) => monitor.name === monitorName);
+    const nameOnlyEnvironments = [
+      ...new Set(nameOnly.map((monitor) => monitor.environmentUid || "(none)"))
+    ];
+    const candidates = nameOnly.filter((monitor) => monitor.environmentUid === environment);
+    return { candidates, nameOnlyMatchCount: nameOnly.length, nameOnlyEnvironments };
+  }
+  /**
+   * Rebind the sole same-name monitor in this workspace onto the current
+   * collection UID.
+   *
+   * The canonical Smoke collection can legitimately change UID (a bootstrap
+   * re-import after a marker/stranger miss, or an operator rebuild). The
+   * monitor still points at the previous UID, so `findMonitorByCollection`
+   * (which requires the full collection+environment+name triple) misses and a
+   * second monitor with the same name would be created on every run, orphaning
+   * the old one. Name plus environment is the stable identity across a
+   * collection re-import, so recover it here instead.
+   *
+   * Returns null when nothing needs rebinding (no same-name monitor, or it is
+   * already bound to this collection). Refuses to guess when several same-name
+   * monitors match, matching `selectExactMatch` semantics elsewhere.
+   */
+  async rebindMonitorByName(name, collectionUid, environmentUid) {
+    const monitorName = String(name ?? "").trim();
+    const collection = String(collectionUid ?? "").trim();
+    const environment = String(environmentUid ?? "").trim();
+    if (!monitorName || !collection) {
+      return null;
+    }
+    const monitors = await this.listMonitors();
+    const { candidates, nameOnlyMatchCount, nameOnlyEnvironments } = this.pickRebindMonitorCandidates(
+      monitors,
+      monitorName,
+      environment
+    );
+    let match;
+    try {
+      match = this.selectExactMatch(
+        "monitor",
+        `workspace ${this.workspaceId}, name "${monitorName}", and environment ${environment || "(none)"}`,
+        candidates
+      );
+    } catch (error) {
+      const message = error instanceof Error && nameOnlyMatchCount > 0 ? `${error.message} Same-name monitor(s) also exist on environment(s): ${nameOnlyEnvironments.join(", ")}.` : error instanceof Error ? error.message : String(error);
+      throw new AmbiguousMonitorRebindError(message, { cause: error });
+    }
+    if (!match?.uid) {
+      if (nameOnlyMatchCount > 0) {
+      }
+      return null;
+    }
+    if (match.collectionUid === collection) {
+      return null;
+    }
+    await this.gateway.requestJson(
+      {
+        service: "monitors",
+        method: "put",
+        path: `/jobTemplates/${this.toModelId(match.uid)}?_etc=true`,
+        body: { collection }
+      },
+      { retryTransient: false }
+    );
+    return { uid: match.uid, previousCollectionUid: match.collectionUid };
+  }
   async runMonitor(uid) {
     await this.gateway.requestJson(
       {
@@ -137577,6 +137699,7 @@ function resolveInputs(env = process.env) {
     env
   );
   const environments = parseJsonArray(getInput("environments-json", env) || '["prod"]');
+  const secretsResolverProvider = parseSecretsResolverProvider(getInput("secrets-resolver", env));
   const systemEnvMap = parseJsonMap(getInput("system-env-map-json", env) || "{}");
   const environmentUids = parseJsonMap(getInput("environment-uids-json", env) || "{}");
   const envRuntimeUrls = parseJsonMap(getInput("env-runtime-urls-json", env) || "{}");
@@ -137594,6 +137717,7 @@ function resolveInputs(env = process.env) {
     specContentChanged: parseBooleanInput(getInput("spec-content-changed", env), true),
     specPath: getInput("spec-path", env),
     collectionSyncMode: normalizeCollectionSyncMode(getInput("collection-sync-mode", env) || "refresh"),
+    secretsResolverProvider,
     specSyncMode: normalizeSpecSyncMode(getInput("spec-sync-mode", env) || "update"),
     releaseLabel: normalizeReleaseLabel(getInput("release-label", env)) || void 0,
     environments: environments.length > 0 ? environments : ["prod"],
@@ -137683,7 +137807,20 @@ function assertBranchAssetIds(inputs, decision, branchOwnedIds = process.env.POS
     );
   }
 }
+var CREDENTIAL_SLOT_PREFIXES = ["AWS_", "AZURE_", "GCP_"];
+function isCredentialSlotKey(key) {
+  return typeof key === "string" && CREDENTIAL_SLOT_PREFIXES.some((prefix) => key.startsWith(prefix));
+}
 function buildEnvironmentValues(envName, baseUrl, options = {}) {
+  const seeded = secretsResolverEnvironmentKeys(options.secretsResolverProvider ?? "none").map((entry) => ({
+    key: entry.key,
+    value: entry.key.endsWith("_SECRET_NAME") && !entry.secret ? `api-credentials-${envName}` : entry.defaultValue ?? "",
+    type: entry.secret ? "secret" : "default"
+  }));
+  const seededKeys = new Set(seeded.map((entry) => entry.key));
+  const preserved = (options.preservedCredentialValues ?? []).filter(
+    (entry) => isCredentialSlotKey(entry.key) && !seededKeys.has(entry.key)
+  );
   return [
     { key: "baseUrl", value: baseUrl, type: "default" },
     // A private mock refuses anonymous calls, so the manual-validation environment
@@ -137692,10 +137829,11 @@ function buildEnvironmentValues(envName, baseUrl, options = {}) {
     ...options.privateMockAuth ? [{ key: PRIVATE_MOCK_AUTH_VARIABLE2, value: "", type: "secret" }] : [],
     { key: "CI", value: "false", type: "default" },
     { key: "RESPONSE_TIME_THRESHOLD", value: "2000", type: "default" },
-    { key: "AWS_ACCESS_KEY_ID", value: "", type: "secret" },
-    { key: "AWS_SECRET_ACCESS_KEY", value: "", type: "secret" },
-    { key: "AWS_REGION", value: "eu-west-2", type: "default" },
-    { key: "AWS_SECRET_NAME", value: `api-credentials-${envName}`, type: "default" }
+    // Provider-scoped credential slots. `none` (the default) seeds nothing, so a
+    // consumer that does not use a cloud secret store gets a clean environment
+    // instead of four dead AWS variables.
+    ...seeded,
+    ...preserved
   ];
 }
 var LEGACY_BASELINE_COLLECTION_PREFIX = "[Baseline]";
@@ -138039,19 +138177,28 @@ async function upsertEnvironments(inputs, dependencies, resourcesState, assetMar
     }
     if (existingUid) {
       let marker = assetMarker;
-      if (marker) {
-        try {
-          const existing = await dependencies.postman.getEnvironment(existingUid);
-          const values3 = existing.data?.values ?? existing.values ?? [];
-          const prior = values3.find((value) => value.key === "x-pm-onboarding")?.value;
+      let priorValues = [];
+      try {
+        const existing = await dependencies.postman.getEnvironment(existingUid);
+        const values3 = existing?.data?.values ?? existing?.values ?? [];
+        priorValues = values3.filter((value) => typeof value?.key === "string").map((value) => ({
+          key: value.key,
+          value: typeof value.value === "string" ? value.value : "",
+          type: value.type === "secret" ? "secret" : "default"
+        }));
+        if (marker) {
+          const prior = priorValues.find((value) => value.key === "x-pm-onboarding")?.value;
           const priorMarker = parseAssetMarker(prior ? `x-pm-onboarding: ${prior}` : void 0);
           if (priorMarker?.repo === marker.repo && priorMarker.rawBranch === marker.rawBranch) {
             marker = { ...marker, createdAt: priorMarker.createdAt };
           }
-        } catch {
         }
+      } catch {
       }
-      const values2 = buildEnvironmentValues(envName, runtimeUrl);
+      const values2 = buildEnvironmentValues(envName, runtimeUrl, {
+        secretsResolverProvider: inputs.secretsResolverProvider,
+        preservedCredentialValues: priorValues
+      });
       if (marker) values2.push({ key: "x-pm-onboarding", value: JSON.stringify(marker), type: "default" });
       try {
         await dependencies.postman.updateEnvironment(existingUid, displayName, values2);
@@ -138071,7 +138218,9 @@ async function upsertEnvironments(inputs, dependencies, resourcesState, assetMar
       dependencies.core.setOutput("environment-uids-json", JSON.stringify(envUids));
       continue;
     }
-    const values = buildEnvironmentValues(envName, runtimeUrl);
+    const values = buildEnvironmentValues(envName, runtimeUrl, {
+      secretsResolverProvider: inputs.secretsResolverProvider
+    });
     if (assetMarker) values.push({ key: "x-pm-onboarding", value: JSON.stringify(assetMarker), type: "default" });
     try {
       envUids[envName] = await dependencies.postman.createEnvironment(
@@ -138100,7 +138249,10 @@ async function upsertMockEnvironment(inputs, dependencies, assetProjectName, moc
     return "";
   }
   const displayName = `${assetProjectName} - Mock`;
-  const values = buildEnvironmentValues("mock", mockUrl, { privateMockAuth });
+  const values = buildEnvironmentValues("mock", mockUrl, {
+    privateMockAuth,
+    secretsResolverProvider: inputs.secretsResolverProvider
+  });
   const mask = resolveRepoSyncMasker(dependencies);
   try {
     const discovered = await dependencies.postman.findEnvironmentByName(
@@ -139371,6 +139523,43 @@ async function runRepoSyncInner(inputs, dependencies) {
           );
         }
       }
+      if (!resolvedMonitorId && inputs.smokeCollectionId && dependencies.postman.rebindMonitorByName) {
+        try {
+          const rebound = await dependencies.postman.rebindMonitorByName(
+            monitorName,
+            inputs.smokeCollectionId,
+            monitorEnvUid
+          );
+          if (rebound) {
+            resolvedMonitorId = rebound.uid;
+            dependencies.core.info(
+              `Rebound existing monitor ${rebound.uid} ("${monitorName}") from collection ${rebound.previousCollectionUid} to ${inputs.smokeCollectionId}`
+            );
+          }
+        } catch (error) {
+          if (error instanceof AmbiguousMonitorRebindError) {
+            throw new Error(
+              formatOrchestrationIssue({
+                operation: "Monitor rebind",
+                entity: `monitor "${monitorName}" workspace ${inputs.workspaceId} collection ${inputs.smokeCollectionId} environment ${monitorEnvUid}`,
+                cause: error,
+                remediation: monitorRemediation,
+                mask
+              }),
+              { cause: error }
+            );
+          }
+          dependencies.core.warning(
+            formatOrchestrationIssue({
+              operation: "Monitor rebind",
+              entity: `monitor "${monitorName}" workspace ${inputs.workspaceId} collection ${inputs.smokeCollectionId} environment ${monitorEnvUid}`,
+              cause: error,
+              remediation: monitorRemediation,
+              mask
+            })
+          );
+        }
+      }
       if (!resolvedMonitorId) {
         try {
           resolvedMonitorId = await dependencies.postman.createMonitor(
@@ -139792,6 +139981,7 @@ function createRepoSyncDependencies(inputs, resolved, factories, options = {}) {
     listMonitors: gatewayAssets.listMonitors.bind(gatewayAssets),
     monitorExists: gatewayAssets.monitorExists.bind(gatewayAssets),
     findMonitorByCollection: gatewayAssets.findMonitorByCollection.bind(gatewayAssets),
+    rebindMonitorByName: gatewayAssets.rebindMonitorByName.bind(gatewayAssets),
     runMonitor: gatewayAssets.runMonitor.bind(gatewayAssets),
     listEnvironments: gatewayAssets.listEnvironments.bind(gatewayAssets),
     // GC path (preview/channel retention machine — lib/repo/preview-gc.ts).
@@ -140292,6 +140482,7 @@ var CLI_INPUT_NAMES = [
   "spec-content-changed",
   "spec-path",
   "team-id",
+  "secrets-resolver",
   "postman-region",
   "postman-stack",
   "branch-strategy",

package/dist/index.cjs

@@ -135782,6 +135782,49 @@ function createLogger(options) {
   return root;
 }
 
+// node_modules/@postman-cse/automation-core/dist/secrets-resolver.js
+var SECRETS_RESOLVER_PROVIDERS = ["none", "aws", "azure", "gcp"];
+var DEFAULT_SECRETS_RESOLVER_PROVIDER = "none";
+function parseSecretsResolverProvider(value, fallback = DEFAULT_SECRETS_RESOLVER_PROVIDER) {
+  const raw = String(value ?? "").trim().toLowerCase();
+  if (!raw)
+    return fallback;
+  if (raw === "true")
+    return "aws";
+  if (raw === "false" || raw === "off")
+    return "none";
+  if (SECRETS_RESOLVER_PROVIDERS.includes(raw)) {
+    return raw;
+  }
+  throw new Error(`SECRETS_RESOLVER_PROVIDER_INVALID: expected one of ${SECRETS_RESOLVER_PROVIDERS.join(", ")} (or legacy true/false), received "${value}"`);
+}
+function secretsResolverEnvironmentKeys(provider) {
+  switch (provider) {
+    case "aws":
+      return [
+        { key: "AWS_ACCESS_KEY_ID", secret: true },
+        { key: "AWS_SECRET_ACCESS_KEY", secret: true },
+        { key: "AWS_REGION", secret: false },
+        { key: "AWS_SECRET_NAME", secret: false }
+      ];
+    case "azure":
+      return [
+        { key: "AZURE_KEY_VAULT_NAME", secret: false },
+        { key: "AZURE_SECRET_NAME", secret: false },
+        { key: "AZURE_ACCESS_TOKEN", secret: true }
+      ];
+    case "gcp":
+      return [
+        { key: "GCP_PROJECT_ID", secret: false },
+        { key: "GCP_SECRET_NAME", secret: false },
+        { key: "GCP_ACCESS_TOKEN", secret: true }
+      ];
+    case "none":
+    default:
+      return [];
+  }
+}
+
 // src/action-version.ts
 var import_node_fs3 = require("node:fs");
 var import_node_path2 = require("node:path");
@@ -136985,6 +137028,12 @@ var postmanRepoSyncActionContract = {
       required: false,
       default: ""
     },
+    "secrets-resolver": {
+      description: "Cloud secret store the generated environments seed credential slots for (none, aws, azure, gcp). Must match the value passed to bootstrap and smoke-flow.",
+      required: false,
+      default: "none",
+      allowedValues: ["none", "aws", "azure", "gcp"]
+    },
     "credential-preflight": {
       description: "Credential identity preflight policy. warn (default) logs a note and continues when postman-api-key and postman-access-token resolve to different parent orgs; enforce fails the run on that condition before any workspace is created. Both modes warn when postman-access-token is not a service-account token.",
       required: false,
@@ -137542,6 +137591,12 @@ var MockContractError = class extends Error {
     this.name = "MockContractError";
   }
 };
+var AmbiguousMonitorRebindError = class extends Error {
+  constructor(message, options) {
+    super(message, options);
+    this.name = "AmbiguousMonitorRebindError";
+  }
+};
 function requireMockVisibility(mock, requested) {
   if (mock.visibility === "unknown") {
     throw new MockContractError(
@@ -138378,6 +138433,73 @@ var PostmanGatewayAssetsClient = class {
     );
     return match?.uid ? { uid: match.uid, name: match.name } : null;
   }
+  pickRebindMonitorCandidates(monitors, monitorName, environment) {
+    const nameOnly = monitors.filter((monitor) => monitor.name === monitorName);
+    const nameOnlyEnvironments = [
+      ...new Set(nameOnly.map((monitor) => monitor.environmentUid || "(none)"))
+    ];
+    const candidates = nameOnly.filter((monitor) => monitor.environmentUid === environment);
+    return { candidates, nameOnlyMatchCount: nameOnly.length, nameOnlyEnvironments };
+  }
+  /**
+   * Rebind the sole same-name monitor in this workspace onto the current
+   * collection UID.
+   *
+   * The canonical Smoke collection can legitimately change UID (a bootstrap
+   * re-import after a marker/stranger miss, or an operator rebuild). The
+   * monitor still points at the previous UID, so `findMonitorByCollection`
+   * (which requires the full collection+environment+name triple) misses and a
+   * second monitor with the same name would be created on every run, orphaning
+   * the old one. Name plus environment is the stable identity across a
+   * collection re-import, so recover it here instead.
+   *
+   * Returns null when nothing needs rebinding (no same-name monitor, or it is
+   * already bound to this collection). Refuses to guess when several same-name
+   * monitors match, matching `selectExactMatch` semantics elsewhere.
+   */
+  async rebindMonitorByName(name, collectionUid, environmentUid) {
+    const monitorName = String(name ?? "").trim();
+    const collection = String(collectionUid ?? "").trim();
+    const environment = String(environmentUid ?? "").trim();
+    if (!monitorName || !collection) {
+      return null;
+    }
+    const monitors = await this.listMonitors();
+    const { candidates, nameOnlyMatchCount, nameOnlyEnvironments } = this.pickRebindMonitorCandidates(
+      monitors,
+      monitorName,
+      environment
+    );
+    let match;
+    try {
+      match = this.selectExactMatch(
+        "monitor",
+        `workspace ${this.workspaceId}, name "${monitorName}", and environment ${environment || "(none)"}`,
+        candidates
+      );
+    } catch (error2) {
+      const message = error2 instanceof Error && nameOnlyMatchCount > 0 ? `${error2.message} Same-name monitor(s) also exist on environment(s): ${nameOnlyEnvironments.join(", ")}.` : error2 instanceof Error ? error2.message : String(error2);
+      throw new AmbiguousMonitorRebindError(message, { cause: error2 });
+    }
+    if (!match?.uid) {
+      if (nameOnlyMatchCount > 0) {
+      }
+      return null;
+    }
+    if (match.collectionUid === collection) {
+      return null;
+    }
+    await this.gateway.requestJson(
+      {
+        service: "monitors",
+        method: "put",
+        path: `/jobTemplates/${this.toModelId(match.uid)}?_etc=true`,
+        body: { collection }
+      },
+      { retryTransient: false }
+    );
+    return { uid: match.uid, previousCollectionUid: match.collectionUid };
+  }
   async runMonitor(uid) {
     await this.gateway.requestJson(
       {
@@ -139550,6 +139672,7 @@ function resolveInputs(env = process.env) {
     env
   );
   const environments = parseJsonArray(getInput2("environments-json", env) || '["prod"]');
+  const secretsResolverProvider = parseSecretsResolverProvider(getInput2("secrets-resolver", env));
   const systemEnvMap = parseJsonMap(getInput2("system-env-map-json", env) || "{}");
   const environmentUids = parseJsonMap(getInput2("environment-uids-json", env) || "{}");
   const envRuntimeUrls = parseJsonMap(getInput2("env-runtime-urls-json", env) || "{}");
@@ -139567,6 +139690,7 @@ function resolveInputs(env = process.env) {
     specContentChanged: parseBooleanInput(getInput2("spec-content-changed", env), true),
     specPath: getInput2("spec-path", env),
     collectionSyncMode: normalizeCollectionSyncMode(getInput2("collection-sync-mode", env) || "refresh"),
+    secretsResolverProvider,
     specSyncMode: normalizeSpecSyncMode(getInput2("spec-sync-mode", env) || "update"),
     releaseLabel: normalizeReleaseLabel(getInput2("release-label", env)) || void 0,
     environments: environments.length > 0 ? environments : ["prod"],
@@ -139656,7 +139780,20 @@ function assertBranchAssetIds(inputs, decision, branchOwnedIds = process.env.POS
     );
   }
 }
+var CREDENTIAL_SLOT_PREFIXES = ["AWS_", "AZURE_", "GCP_"];
+function isCredentialSlotKey(key) {
+  return typeof key === "string" && CREDENTIAL_SLOT_PREFIXES.some((prefix) => key.startsWith(prefix));
+}
 function buildEnvironmentValues(envName, baseUrl, options = {}) {
+  const seeded = secretsResolverEnvironmentKeys(options.secretsResolverProvider ?? "none").map((entry) => ({
+    key: entry.key,
+    value: entry.key.endsWith("_SECRET_NAME") && !entry.secret ? `api-credentials-${envName}` : entry.defaultValue ?? "",
+    type: entry.secret ? "secret" : "default"
+  }));
+  const seededKeys = new Set(seeded.map((entry) => entry.key));
+  const preserved = (options.preservedCredentialValues ?? []).filter(
+    (entry) => isCredentialSlotKey(entry.key) && !seededKeys.has(entry.key)
+  );
   return [
     { key: "baseUrl", value: baseUrl, type: "default" },
     // A private mock refuses anonymous calls, so the manual-validation environment
@@ -139665,10 +139802,11 @@ function buildEnvironmentValues(envName, baseUrl, options = {}) {
     ...options.privateMockAuth ? [{ key: PRIVATE_MOCK_AUTH_VARIABLE2, value: "", type: "secret" }] : [],
     { key: "CI", value: "false", type: "default" },
     { key: "RESPONSE_TIME_THRESHOLD", value: "2000", type: "default" },
-    { key: "AWS_ACCESS_KEY_ID", value: "", type: "secret" },
-    { key: "AWS_SECRET_ACCESS_KEY", value: "", type: "secret" },
-    { key: "AWS_REGION", value: "eu-west-2", type: "default" },
-    { key: "AWS_SECRET_NAME", value: `api-credentials-${envName}`, type: "default" }
+    // Provider-scoped credential slots. `none` (the default) seeds nothing, so a
+    // consumer that does not use a cloud secret store gets a clean environment
+    // instead of four dead AWS variables.
+    ...seeded,
+    ...preserved
   ];
 }
 var LEGACY_BASELINE_COLLECTION_PREFIX = "[Baseline]";
@@ -140154,19 +140292,28 @@ async function upsertEnvironments(inputs, dependencies, resourcesState, assetMar
     }
     if (existingUid) {
       let marker = assetMarker;
-      if (marker) {
-        try {
-          const existing = await dependencies.postman.getEnvironment(existingUid);
-          const values3 = existing.data?.values ?? existing.values ?? [];
-          const prior = values3.find((value) => value.key === "x-pm-onboarding")?.value;
+      let priorValues = [];
+      try {
+        const existing = await dependencies.postman.getEnvironment(existingUid);
+        const values3 = existing?.data?.values ?? existing?.values ?? [];
+        priorValues = values3.filter((value) => typeof value?.key === "string").map((value) => ({
+          key: value.key,
+          value: typeof value.value === "string" ? value.value : "",
+          type: value.type === "secret" ? "secret" : "default"
+        }));
+        if (marker) {
+          const prior = priorValues.find((value) => value.key === "x-pm-onboarding")?.value;
           const priorMarker = parseAssetMarker(prior ? `x-pm-onboarding: ${prior}` : void 0);
           if (priorMarker?.repo === marker.repo && priorMarker.rawBranch === marker.rawBranch) {
             marker = { ...marker, createdAt: priorMarker.createdAt };
           }
-        } catch {
         }
+      } catch {
       }
-      const values2 = buildEnvironmentValues(envName, runtimeUrl);
+      const values2 = buildEnvironmentValues(envName, runtimeUrl, {
+        secretsResolverProvider: inputs.secretsResolverProvider,
+        preservedCredentialValues: priorValues
+      });
       if (marker) values2.push({ key: "x-pm-onboarding", value: JSON.stringify(marker), type: "default" });
       try {
         await dependencies.postman.updateEnvironment(existingUid, displayName, values2);
@@ -140186,7 +140333,9 @@ async function upsertEnvironments(inputs, dependencies, resourcesState, assetMar
       dependencies.core.setOutput("environment-uids-json", JSON.stringify(envUids));
       continue;
     }
-    const values = buildEnvironmentValues(envName, runtimeUrl);
+    const values = buildEnvironmentValues(envName, runtimeUrl, {
+      secretsResolverProvider: inputs.secretsResolverProvider
+    });
     if (assetMarker) values.push({ key: "x-pm-onboarding", value: JSON.stringify(assetMarker), type: "default" });
     try {
       envUids[envName] = await dependencies.postman.createEnvironment(
@@ -140215,7 +140364,10 @@ async function upsertMockEnvironment(inputs, dependencies, assetProjectName, moc
     return "";
   }
   const displayName = `${assetProjectName} - Mock`;
-  const values = buildEnvironmentValues("mock", mockUrl, { privateMockAuth });
+  const values = buildEnvironmentValues("mock", mockUrl, {
+    privateMockAuth,
+    secretsResolverProvider: inputs.secretsResolverProvider
+  });
   const mask = resolveRepoSyncMasker(dependencies);
   try {
     const discovered = await dependencies.postman.findEnvironmentByName(
@@ -141486,6 +141638,43 @@ async function runRepoSyncInner(inputs, dependencies) {
           );
         }
       }
+      if (!resolvedMonitorId && inputs.smokeCollectionId && dependencies.postman.rebindMonitorByName) {
+        try {
+          const rebound = await dependencies.postman.rebindMonitorByName(
+            monitorName,
+            inputs.smokeCollectionId,
+            monitorEnvUid
+          );
+          if (rebound) {
+            resolvedMonitorId = rebound.uid;
+            dependencies.core.info(
+              `Rebound existing monitor ${rebound.uid} ("${monitorName}") from collection ${rebound.previousCollectionUid} to ${inputs.smokeCollectionId}`
+            );
+          }
+        } catch (error2) {
+          if (error2 instanceof AmbiguousMonitorRebindError) {
+            throw new Error(
+              formatOrchestrationIssue({
+                operation: "Monitor rebind",
+                entity: `monitor "${monitorName}" workspace ${inputs.workspaceId} collection ${inputs.smokeCollectionId} environment ${monitorEnvUid}`,
+                cause: error2,
+                remediation: monitorRemediation,
+                mask
+              }),
+              { cause: error2 }
+            );
+          }
+          dependencies.core.warning(
+            formatOrchestrationIssue({
+              operation: "Monitor rebind",
+              entity: `monitor "${monitorName}" workspace ${inputs.workspaceId} collection ${inputs.smokeCollectionId} environment ${monitorEnvUid}`,
+              cause: error2,
+              remediation: monitorRemediation,
+              mask
+            })
+          );
+        }
+      }
       if (!resolvedMonitorId) {
         try {
           resolvedMonitorId = await dependencies.postman.createMonitor(
@@ -141907,6 +142096,7 @@ function createRepoSyncDependencies(inputs, resolved, factories, options = {}) {
     listMonitors: gatewayAssets.listMonitors.bind(gatewayAssets),
     monitorExists: gatewayAssets.monitorExists.bind(gatewayAssets),
     findMonitorByCollection: gatewayAssets.findMonitorByCollection.bind(gatewayAssets),
+    rebindMonitorByName: gatewayAssets.rebindMonitorByName.bind(gatewayAssets),
     runMonitor: gatewayAssets.runMonitor.bind(gatewayAssets),
     listEnvironments: gatewayAssets.listEnvironments.bind(gatewayAssets),
     // GC path (preview/channel retention machine — lib/repo/preview-gc.ts).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@postman-cse/onboarding-repo-sync",
-  "version": "2.5.0",
+  "version": "2.6.1",
   "description": "Postman repo sync GitHub Action.",
   "type": "module",
   "main": "dist/index.cjs",
@@ -44,7 +44,7 @@
   "dependencies": {
     "@actions/core": "^3.0.1",
     "@actions/exec": "^3.0.0",
-    "@postman-cse/automation-core": "^1.1.0",
+    "@postman-cse/automation-core": "^1.2.1",
     "@postman/runtime.models": "^1.13.1",
     "@postman/v3.export": "0.2.28",
     "js-yaml": "^5.2.1",