@treeseed/sdk 0.12.23 → 0.12.25

package/dist/operations/services/github-api.d.ts

@@ -170,6 +170,12 @@ export declare function listGitHubEnvironmentVariableNames(repository: string |
 }, environmentName: string, { client }?: {
     client?: GitHubApiClient;
 }): Promise<Set<string>>;
+export declare function listGitHubEnvironmentVariables(repository: string | {
+    owner: string;
+    name: string;
+}, environmentName: string, { client }?: {
+    client?: GitHubApiClient;
+}): Promise<Map<string, string>>;
 export declare function upsertGitHubRepositorySecret(repository: string | {
     owner: string;
     name: string;

package/dist/operations/services/github-api.js

@@ -344,6 +344,19 @@ async function listGitHubEnvironmentVariableNames(repository, environmentName, {
     throw normalizeGitHubApiError(error, `Unable to list GitHub environment variables for ${owner}/${name}:${environmentName}`);
   }
 }
+async function listGitHubEnvironmentVariables(repository, environmentName, { client = createGitHubApiClient() } = {}) {
+  const { owner, name } = typeof repository === "string" ? parseGitHubRepositorySlug(repository) : repository;
+  try {
+    const paginate = client.paginate;
+    const variables = await withGitHubApiRetries(() => paginate(
+      "GET /repos/{owner}/{repo}/environments/{environment_name}/variables",
+      { owner, repo: name, environment_name: environmentName, per_page: 100 }
+    ));
+    return new Map(variables.map((entry) => [String(entry.name ?? "").trim(), String(entry.value ?? "")]).filter(([variableName]) => variableName.length > 0));
+  } catch (error) {
+    throw normalizeGitHubApiError(error, `Unable to list GitHub environment variables for ${owner}/${name}:${environmentName}`);
+  }
+}
 async function encryptGitHubSecret(secret, key) {
   await sodium.ready;
   const messageBytes = Buffer.from(secret);
@@ -927,6 +940,7 @@ export {
   getLatestGitHubWorkflowRun,
   listGitHubEnvironmentSecretNames,
   listGitHubEnvironmentVariableNames,
+  listGitHubEnvironmentVariables,
   listGitHubRepositorySecretNames,
   listGitHubRepositoryVariableNames,
   maybeGetGitHubRepository,

package/dist/reconcile/builtin-adapters.js

@@ -446,11 +446,12 @@ function buildGitHubBindingAdapter(unitType) {
       const observed = await observeGitHubEnvironment(repository, environment, buildGitHubEnv(input));
       const names = unitType === "github-secret-binding" ? observed.secretNames : observed.variableNames;
       const exists = observed.exists && names.includes(name);
+      const value = unitType === "github-variable-binding" ? String(observed.variableValues?.[name] ?? "") : null;
       const warnings = observed.authAvailable === false ? [String(observed.error ?? "GitHub authentication is unavailable")] : observed.exists ? [] : [`GitHub environment ${environment} is missing`];
       return {
         ...genericObservedState(input, exists, warnings),
         status: exists ? "ready" : "pending",
-        live: { repository, environment, name, exists, observed }
+        live: { repository, environment, name, exists, value, observed }
       };
     },
     diff(input) {
@@ -458,13 +459,24 @@ function buildGitHubBindingAdapter(unitType) {
       if (input.observed.live?.observed?.authAvailable === false) {
         return { action: "blocked", reasons: input.observed.warnings, before: input.observed.live, after: input.unit.spec };
       }
-      if (input.observed.exists) {
-        return noopDiff();
-      }
       const value = buildGitHubEnv(input)[name];
       if (!value) {
         return { action: "blocked", reasons: [`Missing local value for ${name}`], before: input.observed.live, after: input.unit.spec };
       }
+      if (input.observed.exists) {
+        if (unitType === "github-variable-binding") {
+          const observedValue = String(input.observed.live.value ?? "");
+          if (observedValue !== value) {
+            return {
+              action: "update",
+              reasons: [`GitHub variable ${name} value drifted`],
+              before: input.observed.live,
+              after: input.unit.spec
+            };
+          }
+        }
+        return noopDiff();
+      }
       return { action: "update", reasons: [`GitHub ${unitType === "github-secret-binding" ? "secret" : "variable"} ${name} is missing`], before: input.observed.live, after: input.unit.spec };
     },
     async apply(input) {

package/dist/reconcile/providers/github-private.d.ts

@@ -11,6 +11,9 @@ export declare function observeGitHubEnvironment(repository: string, environment
     environment: string;
     secretNames: string[];
     variableNames: string[];
+    variableValues: {
+        [k: string]: string;
+    };
     authAvailable?: undefined;
     error?: undefined;
 } | {
@@ -20,6 +23,7 @@ export declare function observeGitHubEnvironment(repository: string, environment
     environment: string;
     secretNames: never[];
     variableNames: never[];
+    variableValues: {};
     error: string;
 }>;
 export declare function ensureReconcileGitHubEnvironment(repository: string, environment: string, branchName: string | null, env: NodeJS.ProcessEnv | Record<string, string | undefined>): Promise<{

package/dist/reconcile/providers/github-private.js

@@ -6,6 +6,7 @@ import {
   getLatestGitHubWorkflowRun,
   listGitHubEnvironmentSecretNames,
   listGitHubEnvironmentVariableNames,
+  listGitHubEnvironmentVariables,
   upsertGitHubEnvironmentSecret,
   upsertGitHubEnvironmentVariable,
   waitForGitHubWorkflowRunCompletion
@@ -19,16 +20,18 @@ function isGitHubAuthError(message) {
 async function observeGitHubEnvironment(repository, environment, env) {
   const client = createReconcileGitHubClient(env);
   try {
-    const [secretNames, variableNames] = await Promise.all([
+    const [secretNames, variableNames, variableValues] = await Promise.all([
       listGitHubEnvironmentSecretNames(repository, environment, { client }),
-      listGitHubEnvironmentVariableNames(repository, environment, { client })
+      listGitHubEnvironmentVariableNames(repository, environment, { client }),
+      listGitHubEnvironmentVariables(repository, environment, { client })
     ]);
     return {
       exists: true,
       repository,
       environment,
       secretNames: [...secretNames].sort(),
-      variableNames: [...variableNames].sort()
+      variableNames: [...variableNames].sort(),
+      variableValues: Object.fromEntries([...variableValues.entries()].sort(([left], [right]) => left.localeCompare(right)))
     };
   } catch (error) {
     const message = error instanceof Error ? error.message : String(error);
@@ -40,6 +43,7 @@ async function observeGitHubEnvironment(repository, environment, env) {
         environment,
         secretNames: [],
         variableNames: [],
+        variableValues: {},
         error: message
       };
     }
@@ -51,6 +55,7 @@ async function observeGitHubEnvironment(repository, environment, env) {
         environment,
         secretNames: [],
         variableNames: [],
+        variableValues: {},
         error: message
       };
     }

package/dist/workflow/operations.d.ts

@@ -1,4 +1,4 @@
-import { planTreeseedReconciliation, reconcileTreeseedTarget, type TreeseedReconcileTarget } from '../reconcile/index.js';
+import { planTreeseedReconciliation, reconcileTreeseedTarget, type TreeseedDesiredUnit, type TreeseedReconcileTarget } from '../reconcile/index.js';
 import { STAGING_BRANCH } from '../operations/services/git-workflow.js';
 import type { TreeseedProofDriver } from '../operations/services/release-proof.js';
 import { type TreeseedWorkflowTiming } from '../operations/services/workflow-timing.js';
@@ -927,7 +927,7 @@ export declare function workflowRelease(helpers: WorkflowOperationHelpers, input
     }[];
     reconcile: {
         target: TreeseedReconcileTarget;
-        units: import("../reconcile/contracts.js").TreeseedDesiredUnit[];
+        units: TreeseedDesiredUnit[];
         plans: import("../reconcile/contracts.js").TreeseedReconcilePlan[];
         results: TreeseedReconcileResult[];
         state: import("../reconcile/contracts.js").TreeseedReconcileStateRecord;
@@ -1149,7 +1149,7 @@ export declare function workflowRelease(helpers: WorkflowOperationHelpers, input
         }[];
         reconcile: {
             target: TreeseedReconcileTarget;
-            units: import("../reconcile/contracts.js").TreeseedDesiredUnit[];
+            units: TreeseedDesiredUnit[];
             plans: import("../reconcile/contracts.js").TreeseedReconcilePlan[];
             results: TreeseedReconcileResult[];
             state: import("../reconcile/contracts.js").TreeseedReconcileStateRecord;

package/dist/workflow/operations.js

@@ -5387,8 +5387,9 @@ async function runReleaseGateReconcileFacade(operation, helpers, root, target, i
   };
   const desiredGraph = compileTreeseedDesiredResourceGraph({ tenantRoot: root, target });
   const rawUnits = compileTreeseedDesiredUnitsFromGraph(desiredGraph).filter((unit) => unit.provider === "treeseed" && (unit.unitType === "package-manifest" || unit.unitType.startsWith("release-gate:")) && unit.unitType !== "release-gate:npm-publish" && unit.unitType !== "release-gate:image-publish" && (includeHostedReleaseGates || unit.unitType !== "release-gate:hosted-reconcile" && unit.unitType !== "release-gate:live-verify") || unit.provider === "github" && (unit.unitType === "github-environment" || unit.unitType === "github-secret-binding" || unit.unitType === "github-variable-binding"));
-  const rawUnitIds = new Set(rawUnits.map((unit) => unit.unitId));
-  const units = rawUnits.map((unit) => ({
+  const unitsWithReleaseImageRefs = appendReleaseImageRefGitHubVariableBindings(rawUnits, input.releaseImageRefs ?? {});
+  const rawUnitIds = new Set(unitsWithReleaseImageRefs.map((unit) => unit.unitId));
+  const units = unitsWithReleaseImageRefs.map((unit) => ({
     ...unit,
     dependencies: unit.dependencies.filter((dependency) => rawUnitIds.has(dependency))
   }));
@@ -5461,6 +5462,38 @@ ${blockers.join("\n")}`, {
     ])
   });
 }
+function appendReleaseImageRefGitHubVariableBindings(units, releaseImageRefs) {
+  const entries = Object.entries(releaseImageRefs).map(([name, value]) => [name.trim(), value.trim()]).filter(([name, value]) => name.length > 0 && value.length > 0);
+  if (entries.length === 0) return units;
+  const apiProductionEnvironment = units.find((unit) => unit.provider === "github" && unit.unitType === "github-environment" && unit.unitId === "github-environment:@treeseed/api:production");
+  if (!apiProductionEnvironment) return units;
+  const existingUnitIds = new Set(units.map((unit) => unit.unitId));
+  const additions = entries.map(([variableName]) => {
+    const unitId = `github-variable-binding:@treeseed/api:production:${variableName}`;
+    if (existingUnitIds.has(unitId)) return null;
+    return {
+      ...apiProductionEnvironment,
+      unitId,
+      unitType: "github-variable-binding",
+      logicalName: `@treeseed/api production ${variableName}`,
+      dependencies: [apiProductionEnvironment.unitId],
+      spec: {
+        packageId: "@treeseed/api",
+        packageRoot: apiProductionEnvironment.spec.packageRoot,
+        repository: apiProductionEnvironment.spec.repository,
+        environment: "production",
+        variableName,
+        envName: variableName
+      },
+      secrets: {},
+      metadata: {
+        ...apiProductionEnvironment.metadata,
+        releaseImageRef: true
+      }
+    };
+  }).filter((unit) => Boolean(unit));
+  return additions.length > 0 ? [...units, ...additions] : units;
+}
 async function workflowRelease(helpers, input) {
   try {
     return await withContextEnv(helpers.context.env, async () => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@treeseed/sdk",
-  "version": "0.12.23",
+  "version": "0.12.25",
   "description": "Shared Treeseed SDK for content-backed and D1-backed object models.",
   "license": "AGPL-3.0-only",
   "repository": {