@theholocron/holocron-plugin-github 5.0.0-alpha.418 → 5.0.0-alpha.419

package/dist/index.d.mts

@@ -1,4 +1,4 @@
-import { AddedItem, Auth, AuthError, BoardItem, BoardItemInput, BoardState, BoardSummary, BoardTemplate, Ci, CiRun, CiRunFilter, EnsureReport, Environment, Environments, ExportInfo, ImportOptions, ImportResult, Issue, IssueRecord, IssueSearchFilter, IssueSelector, Issues, LabelDef, LifecycleResult, LifecycleSlot, MoveReport, PagesConfig, PluginToken, Projects, PullRequest, RepoRef, RepoSettings, ResolveTokenInput, Ruleset, SecretScope, Secrets, Source, SourceBranch, SourceFile, SourceRepoInfo, SourceRulesetDetail, SourceSecurity, SourceTeamMember, SyncResult, TeamEntry, TeamEntry as TeamEntry$1, TeamPermission, TeamPermission as TeamPermission$1, TrackerDoctorReport, TrackerUser, VerifyTokenFailure, VerifyTokenResult, VerifyTokenResult as VerifyTokenResult$1, VerifyTokenSuccess, createFeatureResolver } from "@theholocron/cli";
+import { AddedItem, Auth, AuthError, BoardItem, BoardItemInput, BoardState, BoardSummary, BoardTemplate, Ci, CiRun, CiRunFilter, EnsureReport, Environment, Environments, ExportInfo, ImportOptions, ImportResult, Issue, IssueRecord, IssueSearchFilter, IssueSelector, Issues, LabelDef, LifecycleResult, LifecycleSlot, MoveReport, PagesConfig, PluginToken, Projects, PullRequest, RepoRef, RepoSettings, ResolveTokenInput, Ruleset, SecretAccess, SecretScope, Secrets, Source, SourceBranch, SourceFile, SourceRepoInfo, SourceRulesetDetail, SourceSecurity, SourceTeamMember, SyncResult, TeamEntry, TeamEntry as TeamEntry$1, TeamPermission, TeamPermission as TeamPermission$1, TrackerDoctorReport, TrackerUser, VerifyTokenFailure, VerifyTokenResult, VerifyTokenResult as VerifyTokenResult$1, VerifyTokenSuccess, createFeatureResolver } from "@theholocron/cli";
 import { GitHubClient, GitHubClientOptions, GraphQLClient, createGitHubClient } from "@theholocron/github-client";
 /** Resolves the token for read-only GitHub access (`HOLOCRON_READ_TOKEN`, keyring key `github.read`). */
 export declare const resolveReadToken: import("@theholocron/cli").FeatureResolver;
@@ -232,9 +232,19 @@ export declare class GitHubSecrets implements Secrets {
    * it can write org secrets but not repo ones, and `github.admin` is the reverse.
    */
   constructor(client: GitHubClient, opts: SecretsOptions, orgClient?: GitHubClient | undefined);
+  /** Repository name to numeric id, so one run asks GitHub once per repository however many secrets name it. */
+  private readonly repoIds;
   private clientFor;
   listSecrets(scope: SecretScope): Promise<string[]>;
   setSecret(scope: SecretScope, name: string, value: string): Promise<void>;
+  /**
+   * Who can read each organization secret, by name (never a value): `selected` ones come with the names of their
+   * repositories. Any other scope has no visibility and gives `{}`.
+   */
+  listSecretAccess(scope: SecretScope): Promise<Record<string, SecretAccess>>;
+  /** The `visibility` (and repository ids) of an organization write. No `visibility` keeps the older default, `all`. */
+  private readers;
+  private repoId;
   /** Deletes the named secret in the given scope. */
   deleteSecret(scope: SecretScope, name: string): Promise<void>;
 }

package/dist/index.mjs

@@ -1387,6 +1387,8 @@ var GitHubSecrets = class {
 		this.opts = opts;
 		this.orgClient = orgClient;
 	}
+	/** Repository name to numeric id, so one run asks GitHub once per repository however many secrets name it. */
+	repoIds = /* @__PURE__ */ new Map();
 	clientFor(scope) {
 		return scope.kind === "organization" ? this.orgClient ?? this.client : this.client;
 	}
@@ -1396,14 +1398,52 @@ var GitHubSecrets = class {
 	async setSecret(scope, name, value) {
 		const ghScope = toGHScope(scope);
 		const client = this.clientFor(scope);
+		const readers = scope.kind === "organization" ? await this.readers(scope) : {};
 		const pk = await client.secrets.getPublicKey(this.opts.repo, ghScope);
 		const body = {
 			encrypted_value: await encryptSecret(pk.key, value),
 			key_id: pk.key_id
 		};
-		if (scope.kind === "organization") body.visibility = "all";
+		Object.assign(body, readers);
 		await client.secrets.putSecret(this.opts.repo, ghScope, name, body);
 	}
+	/**
+	* Who can read each organization secret, by name (never a value): `selected` ones come with the names of their
+	* repositories. Any other scope has no visibility and gives `{}`.
+	*/
+	async listSecretAccess(scope) {
+		if (scope.kind !== "organization") return {};
+		const client = this.clientFor(scope);
+		const found = {};
+		for (const info of await client.secrets.listOrgSecretInfo(scope.name)) found[info.name] = info.visibility === "selected" ? {
+			visibility: "selected",
+			repos: await client.secrets.listSelectedRepositories(scope.name, info.name)
+		} : { visibility: info.visibility };
+		return found;
+	}
+	/** The `visibility` (and repository ids) of an organization write. No `visibility` keeps the older default, `all`. */
+	async readers(scope) {
+		const visibility = scope.visibility ?? "all";
+		if (visibility !== "selected") return { visibility };
+		if (!scope.repos?.length) throw new Error(`organization secret with visibility "selected" needs a non-empty repos list`);
+		const ids = [];
+		for (const name of scope.repos) ids.push(await this.repoId(scope.name, name));
+		return {
+			visibility,
+			selected_repository_ids: ids
+		};
+	}
+	repoId(org, name) {
+		const full = `${org}/${name}`;
+		let id = this.repoIds.get(full);
+		if (!id) {
+			id = this.client.repos.getRepo(full).then((repo) => repo.id, (err) => {
+				throw new Error(`could not resolve repository ${full}: ${err instanceof Error ? err.message : String(err)}`);
+			});
+			this.repoIds.set(full, id);
+		}
+		return id;
+	}
 	/** Deletes the named secret in the given scope. */
 	async deleteSecret(scope, name) {
 		await this.clientFor(scope).secrets.deleteSecret(this.opts.repo, toGHScope(scope), name);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@theholocron/holocron-plugin-github",
-  "version": "5.0.0-alpha.418",
+  "version": "5.0.0-alpha.419",
   "description": "Holocron plugin for GitHub. Implements source, ci, secrets, environments, and issues capabilities against the GitHub REST API.",
   "keywords": [
     "ci",
@@ -44,21 +44,21 @@
     "tsx": "4.23.15",
     "typescript": "^5.9.3",
     "vitest": "^5.1.0",
-    "@theholocron/fs-utils": "^1.17.0-alpha.4",
     "@theholocron/eslint-config": "^8.9.0-alpha.16",
-    "@theholocron/cli": "5.0.0-alpha.418",
-    "@theholocron/http-client": "^1.58.0-alpha.27",
-    "@theholocron/github-client": "^1.58.0-alpha.27",
-    "@theholocron/misc-utils": "^1.17.0-alpha.4",
+    "@theholocron/github-client": "^1.58.0-alpha.28",
+    "@theholocron/http-client": "^1.58.0-alpha.28",
+    "@theholocron/fs-utils": "^1.17.0-alpha.4",
+    "@theholocron/cli": "5.0.0-alpha.419",
     "@theholocron/tsdown-config": "^8.9.0-alpha.16",
+    "@theholocron/tsconfig": "^8.9.0-alpha.16",
     "@theholocron/vitest-config": "^8.9.0-alpha.16",
-    "@theholocron/tsconfig": "^8.9.0-alpha.16"
+    "@theholocron/misc-utils": "^1.17.0-alpha.4"
   },
   "peerDependencies": {
     "@theholocron/fs-utils": "^1.16.0",
     "@theholocron/github-client": "^1.58.0",
     "@theholocron/misc-utils": "^1.16.0",
-    "@theholocron/cli": "5.0.0-alpha.418"
+    "@theholocron/cli": "5.0.0-alpha.419"
   },
   "engines": {
     "node": ">=22"