@theholocron/cli 5.0.0-alpha.63 → 5.0.0-alpha.65

package/dist/cli.mjs

@@ -3819,10 +3819,13 @@ async function runSecretsSync(input) {
 	const rows = [];
 	if (loader.has("secrets")) {
 		const secrets = loader.get("secrets");
-		print(style.step("secrets (repo scope)"));
+		const scope = input.githubSecretScope ?? { kind: "repo" };
+		const allowedKeys = input.githubSecretKeys ? new Set(input.githubSecretKeys) : void 0;
+		print(style.step("secrets"));
 		for (const key of keys) {
-			rows.push(await runRow(`secrets:${secrets.providerName}`, "scope=repo", key, dryRun, async () => {
-				await secrets.setSecret({ kind: "repo" }, key, envVars[key]);
+			if (allowedKeys && !allowedKeys.has(key)) continue;
+			rows.push(await runRow(`secrets:${secrets.providerName}`, scopeLabel(scope), key, dryRun, async () => {
+				await secrets.setSecret(scope, key, envVars[key]);
 			}));
 			print(formatRow(rows[rows.length - 1]));
 		}
@@ -3914,6 +3917,11 @@ function formatRow(row) {
 	if (row.status === "dry-run") return `    ${style.dim(`… ${label}`)}`;
 	return `    ${style.dim(`· ${label}`)}`;
 }
+function scopeLabel(scope) {
+	if (scope.kind === "repo") return "scope=repo";
+	if (scope.kind === "organization") return `scope=organization,org=${scope.name}`;
+	return `scope=environment,env=${scope.name}`;
+}
 function vaultProviderName(loader) {
 	if (!loader.has("vault")) return "<missing>";
 	return loader.get("vault").providerName;
@@ -8509,9 +8517,17 @@ try {
 		type: "array",
 		default: ["production", "preview"],
 		describe: "Deployment targets to sync to. Defaults to production + preview."
+	}).option("github-secret", {
+		type: "array",
+		describe: "Vault key(s) to push to GH Actions secrets (repeatable). Omit to push every key."
+	}).option("github-secret-scope", {
+		type: "string",
+		default: "repo",
+		describe: "Scope applied to every --github-secret key: \"repo\" (default), \"env=<name>\", or \"org=<name>\"."
 	}), async (argv) => {
 		const tokens = tokenContext(argv.token);
 		if (!tokens) return;
+		const githubSecretScope = parseScope(argv.githubSecretScope);
 		const [environmentId] = await promptForPositionals(getEntry("secrets sync"), argv);
 		const loaded = await loadConfig(argv.cwd);
 		applyResolvedConfig(argv, loaded.resolved);
@@ -8525,6 +8541,8 @@ try {
 			},
 			environmentId,
 			...argv.projectId ? { projectId: argv.projectId } : {},
+			...argv.githubSecret?.length ? { githubSecretKeys: argv.githubSecret } : {},
+			githubSecretScope,
 			targets: argv.target
 		})).summary.fail > 0) process.exitCode = 1;
 	}).command("deploy [branch]", "Trigger a deployment via the configured `deployment` capability", (y) => y.positional("branch", {