@theholocron/holocron-plugin-github 5.0.0-alpha.19 → 5.0.0-alpha.191

package/dist/index.d.mts

@@ -1,11 +1,12 @@
 import { GitHubClient, GitHubClientOptions, createGitHubClient } from "@theholocron/github-client";
-import { Auth, AuthError, Ci, CiRun, CiRunFilter, Environment, Environments, Issue, IssueSearchFilter, Issues, LabelDef, LifecycleResult, LifecycleSlot, PagesConfig, PullRequest, RepoRef, RepoSettings, ResolveTokenInput, Ruleset, SecretScope, Secrets, Source, TeamEntry, TeamEntry as TeamEntry$1, TeamPermission, TrackerDoctorReport, TrackerUser, createFeatureResolver } from "@theholocron/cli";
+import { Auth, AuthError, Ci, CiRun, CiRunFilter, Environment, Environments, Issue, IssueSearchFilter, Issues, LabelDef, LifecycleResult, LifecycleSlot, PagesConfig, PullRequest, RepoRef, RepoSettings, ResolveTokenInput, Ruleset, SecretScope, Secrets, Source, TeamEntry, TeamEntry as TeamEntry$1, TeamPermission, TrackerDoctorReport, TrackerUser, VerifyTokenFailure, VerifyTokenResult, VerifyTokenResult as VerifyTokenResult$1, VerifyTokenSuccess, createFeatureResolver } from "@theholocron/cli";
 //#region src/auth.d.ts
 declare const resolveReadToken: (input?: ResolveTokenInput) => string;
 declare const resolveIssuesToken: (input?: ResolveTokenInput) => string;
 declare const resolveSyncToken: (input?: ResolveTokenInput) => string;
 declare const resolveReleaseToken: (input?: ResolveTokenInput) => string;
 declare const resolveAdminToken: (input?: ResolveTokenInput) => string;
+declare const resolveSecretsToken: (input?: ResolveTokenInput) => string;
 declare const resolveDeployToken: (input?: ResolveTokenInput) => string;
 declare const resolveOrgToken: (input?: ResolveTokenInput) => string;
 //#endregion
@@ -106,9 +107,16 @@ interface SecretsOptions {
 declare class GitHubSecrets implements Secrets {
   private readonly client;
   private readonly opts;
+  private readonly orgClient?;
   readonly key: "secrets";
   readonly providerName = "github";
-  constructor(client: GitHubClient, opts: SecretsOptions);
+  /**
+   * `client` handles repo and environment scopes; `orgClient`, when given, handles
+   * the organization scope. They differ when a dedicated org-only token exists:
+   * it can write org secrets but not repo ones, and `github.admin` is the reverse.
+   */
+  constructor(client: GitHubClient, opts: SecretsOptions, orgClient?: GitHubClient | undefined);
+  private clientFor;
   listSecrets(scope: SecretScope): Promise<string[]>;
   setSecret(scope: SecretScope, name: string, value: string): Promise<void>;
   deleteSecret(scope: SecretScope, name: string): Promise<void>;
@@ -184,30 +192,11 @@ declare function syncTeams(client: GitHubClient, repo: string, teams: TeamEntry[
 declare function encryptSecret(publicKeyBase64: string, value: string): Promise<string>;
 //#endregion
 //#region src/verify-token.d.ts
-/**
- * `verifyToken` — plugin-level export used by `holocron auth set` +
- * `holocron auth check`. Hits `GET /user` and translates the response
- * into the normalized `VerifyTokenResult` shape.
- *
- * Kept as a standalone function (not a capability method) so the auth
- * command can call it without initializing the full plugin — plugin
- * construction requires an already-resolved token, which is exactly
- * what we don't have yet at bootstrap time.
- */
-interface VerifyTokenSuccess {
-  ok: true;
-  subject: string;
-}
-interface VerifyTokenFailure {
-  ok: false;
-  message: string;
-}
-type VerifyTokenResult = VerifyTokenSuccess | VerifyTokenFailure;
 interface VerifyTokenOptions {
   baseUrl?: string;
   fetch?: typeof fetch;
 }
-declare function verifyToken(token: string, opts?: VerifyTokenOptions): Promise<VerifyTokenResult>;
+declare function verifyToken(token: string, opts?: VerifyTokenOptions): Promise<VerifyTokenResult$1>;
 //#endregion
 //#region src/index.d.ts
 interface GitHubPluginOptions extends ResolveTokenInput {
@@ -233,7 +222,7 @@ interface PluginContext {
   repoRoot: string;
 }
 declare function source(ctx: PluginContext, orgClient?: GitHubClient): Source;
-declare function secrets(ctx: PluginContext): Secrets;
+declare function secrets(ctx: PluginContext, orgClient?: GitHubClient): Secrets;
 declare function environments(ctx: PluginContext): Environments;
 declare function ci(ctx: PluginContext): Ci;
 declare function issues(ctx: PluginContext): Issues;
@@ -253,4 +242,4 @@ declare function createPlugin(options: GitHubPluginOptions): {
  */
 declare const AUTH_HINT: string;
 //#endregion
-export { AUTH_HINT, type Auth, AuthError, type CanonicalLabel, GitHubCi, type GitHubClientOptions, GitHubEnvironments, GitHubIssues, GitHubPluginOptions, GitHubSecrets, GitHubSource, type NormalizedTeamEntry, PluginContext, type ResolveTokenInput, type TeamEntry, type TeamPermission, type VerifyTokenFailure, type VerifyTokenResult, type VerifyTokenSuccess, ci, createFeatureResolver, createGitHubClient, createPlugin, encryptSecret, environments, issues, normalizeTeamEntry, resolveAdminToken, resolveDeployToken, resolveIssuesToken, resolveOrgToken, resolveReadToken, resolveReleaseToken, resolveSyncToken, secrets, source, syncLabels, syncTeams, verifyToken };
+export { AUTH_HINT, type Auth, AuthError, type CanonicalLabel, GitHubCi, type GitHubClientOptions, GitHubEnvironments, GitHubIssues, GitHubPluginOptions, GitHubSecrets, GitHubSource, type NormalizedTeamEntry, PluginContext, type ResolveTokenInput, type TeamEntry, type TeamPermission, type VerifyTokenFailure, type VerifyTokenResult, type VerifyTokenSuccess, ci, createFeatureResolver, createGitHubClient, createPlugin, encryptSecret, environments, issues, normalizeTeamEntry, resolveAdminToken, resolveDeployToken, resolveIssuesToken, resolveOrgToken, resolveReadToken, resolveReleaseToken, resolveSecretsToken, resolveSyncToken, secrets, source, syncLabels, syncTeams, verifyToken };

package/dist/index.mjs

@@ -3,6 +3,8 @@ import { createGitHubClient, createGitHubClient as createGitHubClient$1 } from "
 import { AuthError, createFeatureResolver } from "@theholocron/cli";
 import { mkdir, readFile, readdir, rm, stat, writeFile } from "node:fs/promises";
 import { dirname, join } from "node:path";
+import { findRootSync } from "@theholocron/fs-utils";
+import { errorMessage } from "@theholocron/misc-utils";
 //#region src/auth.ts
 const resolveReadToken = createFeatureResolver({
 	envName: "HOLOCRON_READ_TOKEN",
@@ -24,6 +26,10 @@ const resolveAdminToken = createFeatureResolver({
 	envName: "HOLOCRON_ADMIN_TOKEN",
 	keyringKey: "github.admin"
 });
+const resolveSecretsToken = createFeatureResolver({
+	envName: "HOLOCRON_SECRETS_TOKEN",
+	keyringKey: "github.secrets"
+});
 const resolveDeployToken = createFeatureResolver({
 	envName: "HOLOCRON_DEPLOY_TOKEN",
 	keyringKey: "github.deploy"
@@ -374,27 +380,38 @@ async function encryptSecret(publicKeyBase64, value) {
 var GitHubSecrets = class {
 	client;
 	opts;
+	orgClient;
 	key = "secrets";
 	providerName = "github";
-	constructor(client, opts) {
+	/**
+	* `client` handles repo and environment scopes; `orgClient`, when given, handles
+	* the organization scope. They differ when a dedicated org-only token exists:
+	* it can write org secrets but not repo ones, and `github.admin` is the reverse.
+	*/
+	constructor(client, opts, orgClient) {
 		this.client = client;
 		this.opts = opts;
+		this.orgClient = orgClient;
+	}
+	clientFor(scope) {
+		return scope.kind === "organization" ? this.orgClient ?? this.client : this.client;
 	}
 	async listSecrets(scope) {
-		return this.client.secrets.listSecrets(this.opts.repo, toGHScope(scope));
+		return this.clientFor(scope).secrets.listSecrets(this.opts.repo, toGHScope(scope));
 	}
 	async setSecret(scope, name, value) {
 		const ghScope = toGHScope(scope);
-		const pk = await this.client.secrets.getPublicKey(this.opts.repo, ghScope);
+		const client = this.clientFor(scope);
+		const pk = await client.secrets.getPublicKey(this.opts.repo, ghScope);
 		const body = {
 			encrypted_value: await encryptSecret(pk.key, value),
 			key_id: pk.key_id
 		};
 		if (scope.kind === "organization") body.visibility = "all";
-		await this.client.secrets.putSecret(this.opts.repo, ghScope, name, body);
+		await client.secrets.putSecret(this.opts.repo, ghScope, name, body);
 	}
 	async deleteSecret(scope, name) {
-		await this.client.secrets.deleteSecret(this.opts.repo, toGHScope(scope), name);
+		await this.clientFor(scope).secrets.deleteSecret(this.opts.repo, toGHScope(scope), name);
 	}
 };
 function toGHScope(scope) {
@@ -496,8 +513,11 @@ var GitHubSource = class {
 		this.owner = owner;
 		this.name = name;
 		this.repo = opts.repo;
-		this.repoRoot = opts.repoRoot;
-		this.workflowDir = join(opts.repoRoot, ".github", "workflows");
+		this.repoRoot = findRootSync(opts.repoRoot, ".git", {
+			fallback: "start",
+			realpath: true
+		});
+		this.workflowDir = join(this.repoRoot, ".github", "workflows");
 		this.orgClient = opts.orgClient;
 		this.baseUrl = opts.baseUrl;
 		this.fetchImpl = opts.fetch;
@@ -652,16 +672,6 @@ async function ensureDir(path) {
 }
 //#endregion
 //#region src/verify-token.ts
-/**
-* `verifyToken` — plugin-level export used by `holocron auth set` +
-* `holocron auth check`. Hits `GET /user` and translates the response
-* into the normalized `VerifyTokenResult` shape.
-*
-* Kept as a standalone function (not a capability method) so the auth
-* command can call it without initializing the full plugin — plugin
-* construction requires an already-resolved token, which is exactly
-* what we don't have yet at bootstrap time.
-*/
 async function verifyToken(token, opts = {}) {
 	const client = createGitHubClient({
 		token,
@@ -677,7 +687,7 @@ async function verifyToken(token, opts = {}) {
 	} catch (err) {
 		return {
 			ok: false,
-			message: err instanceof Error ? err.message : String(err)
+			message: errorMessage(err)
 		};
 	}
 }
@@ -692,8 +702,8 @@ function source(ctx, orgClient) {
 		fetch: ctx.options.fetch
 	});
 }
-function secrets(ctx) {
-	return new GitHubSecrets(ctx.client, { repo: ctx.repo });
+function secrets(ctx, orgClient) {
+	return new GitHubSecrets(ctx.client, { repo: ctx.repo }, orgClient);
 }
 function environments(ctx) {
 	return new GitHubEnvironments(ctx.client, { repo: ctx.repo });
@@ -708,10 +718,11 @@ function issues(ctx) {
 }
 function createPlugin(options) {
 	function makeCtx(resolver) {
+		const token = resolver(options);
 		return {
 			options,
 			client: createGitHubClient$1({
-				token: resolver(options),
+				token,
 				baseUrl: options.baseUrl,
 				fetch: options.fetch
 			}),
@@ -719,10 +730,45 @@ function createPlugin(options) {
 			repoRoot: options.repoRoot ?? process.cwd()
 		};
 	}
+	/** A token, or undefined when that feature token is simply not configured. */
+	function tryResolve(resolver) {
+		try {
+			return resolver(options);
+		} catch (err) {
+			if (err instanceof AuthError) return void 0;
+			throw err;
+		}
+	}
+	/**
+	* Organization secrets need an org-resource-owner token (`github.secrets`);
+	* repo and environment secrets need `github.admin`. Each scope prefers its own
+	* token and falls back to the other, so a setup with only one of them keeps
+	* working, and an explicit `--token` serves both. With neither configured this
+	* fails exactly as the admin-token capabilities do.
+	*/
+	function makeSecrets() {
+		const secretsToken = tryResolve(resolveSecretsToken);
+		const adminToken = tryResolve(resolveAdminToken);
+		if (!secretsToken && !adminToken) resolveAdminToken(options);
+		const clientFor = (token) => createGitHubClient$1({
+			token,
+			baseUrl: options.baseUrl,
+			fetch: options.fetch
+		});
+		const repoClient = clientFor(adminToken ?? secretsToken);
+		const orgClient = clientFor(secretsToken ?? adminToken);
+		return secrets({
+			options,
+			client: repoClient,
+			repo: options.repo,
+			repoRoot: options.repoRoot ?? process.cwd()
+		}, orgClient);
+	}
 	function makeOrgClient() {
 		try {
+			const token = resolveOrgToken(options);
 			return createGitHubClient$1({
-				token: resolveOrgToken(options),
+				token,
 				baseUrl: options.baseUrl,
 				fetch: options.fetch
 			});
@@ -735,7 +781,7 @@ function createPlugin(options) {
 		capabilities: {
 			source: () => source(makeCtx(resolveAdminToken), makeOrgClient()),
 			ci: () => ci(makeCtx(resolveReadToken)),
-			secrets: () => secrets(makeCtx(resolveAdminToken)),
+			secrets: () => makeSecrets(),
 			environments: () => environments(makeCtx(resolveAdminToken)),
 			issues: () => issues(makeCtx(resolveIssuesToken))
 		}
@@ -747,4 +793,4 @@ function createPlugin(options) {
 */
 const AUTH_HINT = "generate fine-grained Personal Access Tokens at https://github.com/settings/tokens (one per feature — see docs/tokens.md for required scopes per operation), then run: holocron auth set github.<feature> <PAT>";
 //#endregion
-export { AUTH_HINT, AuthError, GitHubCi, GitHubEnvironments, GitHubIssues, GitHubSecrets, GitHubSource, ci, createFeatureResolver, createGitHubClient, createPlugin, encryptSecret, environments, issues, normalizeTeamEntry, resolveAdminToken, resolveDeployToken, resolveIssuesToken, resolveOrgToken, resolveReadToken, resolveReleaseToken, resolveSyncToken, secrets, source, syncLabels, syncTeams, verifyToken };
+export { AUTH_HINT, AuthError, GitHubCi, GitHubEnvironments, GitHubIssues, GitHubSecrets, GitHubSource, ci, createFeatureResolver, createGitHubClient, createPlugin, encryptSecret, environments, issues, normalizeTeamEntry, resolveAdminToken, resolveDeployToken, resolveIssuesToken, resolveOrgToken, resolveReadToken, resolveReleaseToken, resolveSecretsToken, resolveSyncToken, secrets, source, syncLabels, syncTeams, verifyToken };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@theholocron/holocron-plugin-github",
-  "version": "5.0.0-alpha.19",
+  "version": "5.0.0-alpha.191",
   "description": "Holocron plugin for GitHub. Implements source, ci, secrets, environments, and issues capabilities against the GitHub REST API.",
   "keywords": [
     "ci",
@@ -9,12 +9,12 @@
     "plugin",
     "source"
   ],
-  "homepage": "https://github.com/theholocron/holocron/tree/main/packages/holocron-plugin-github#readme",
+  "homepage": "https://github.com/theholocron/holocron/tree/main/plugins/holocron-plugin-github#readme",
   "bugs": "https://github.com/theholocron/holocron/issues",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/theholocron/holocron.git",
-    "directory": "packages/holocron-plugin-github"
+    "directory": "plugins/holocron-plugin-github"
   },
   "license": "MIT",
   "author": "Newton Koumantzelis",
@@ -34,12 +34,14 @@
     "libsodium-wrappers": "^0.8.4"
   },
   "devDependencies": {
-    "@theholocron/eslint-config": "^8.0.0",
-    "@theholocron/github-client": "^1.19.0",
-    "@theholocron/http-client": "^1.19.0",
-    "@theholocron/tsconfig": "^8.0.0",
-    "@theholocron/tsdown-config": "^8.0.0",
-    "@theholocron/vitest-config": "^8.0.0",
+    "@theholocron/eslint-config": "^8.8.2",
+    "@theholocron/fs-utils": "^1.16.0",
+    "@theholocron/github-client": "^1.43.1",
+    "@theholocron/http-client": "^1.43.1",
+    "@theholocron/misc-utils": "^1.16.0",
+    "@theholocron/tsconfig": "^8.8.2",
+    "@theholocron/tsdown-config": "^8.8.2",
+    "@theholocron/vitest-config": "^8.8.2",
     "@types/node": "^26",
     "@vitest/coverage-v8": "^4.1.11",
     "@vitest/eslint-plugin": "^1.6.27",
@@ -47,14 +49,16 @@
     "eslint-plugin-n": "^18.3.0",
     "globals": "^17.11.0",
     "tsdown": "^0.22.14",
-    "tsx": "4.23.12",
+    "tsx": "4.23.15",
     "typescript": "^5.9.3",
     "vitest": "^4.1.11",
-    "@theholocron/cli": "5.0.0-alpha.19"
+    "@theholocron/cli": "5.0.0-alpha.191"
   },
   "peerDependencies": {
-    "@theholocron/github-client": "^1.19.0",
-    "@theholocron/cli": "5.0.0-alpha.19"
+    "@theholocron/fs-utils": "^1.16.0",
+    "@theholocron/github-client": "^1.43.1",
+    "@theholocron/misc-utils": "^1.16.0",
+    "@theholocron/cli": "5.0.0-alpha.191"
   },
   "engines": {
     "node": ">=22"