alchemy 0.9.2 → 0.10.1

package/lib/github/secret.js

@@ -2,7 +2,7 @@ import sodium from "libsodium-wrappers";
 import { Resource } from "../resource";
 import { createGitHubClient, verifyGitHubAuth } from "./client";
 /**
- * Resource for managing GitHub repository secrets
+ * Resource for managing GitHub repository and environment secrets
  *
  * Authentication is handled in the following order:
  * 1. `token` parameter in the resource props (if provided)
@@ -13,7 +13,7 @@ import { createGitHubClient, verifyGitHubAuth } from "./client";
  * - 'public_repo' scope for public repositories
  *
  * @example
- * // Create a secret using GITHUB_TOKEN environment variable:
+ * // Create a repository secret using GITHUB_TOKEN environment variable:
  * const secret = await GitHubSecret("my-secret", {
  *   owner: "my-github-username",
  *   repository: "my-repo",
@@ -22,6 +22,16 @@ import { createGitHubClient, verifyGitHubAuth } from "./client";
  * });
  *
  * @example
+ * // Create an environment secret:
+ * const secret = await GitHubSecret("my-env-secret", {
+ *   owner: "my-github-username",
+ *   repository: "my-repo",
+ *   environmentName: "production",
+ *   name: "DEPLOY_KEY",
+ *   value: alchemy.secret("my-secret-deploy-key")
+ * });
+ *
+ * @example
  * // Create a secret with a custom GitHub token:
  * const secret = await GitHubSecret("my-secret", {
  *   owner: "my-github-username",
@@ -72,15 +82,27 @@ export const GitHubSecret = Resource("github::Secret", async function (id, props
     if (!this.quiet) {
         await verifyGitHubAuth(octokit, props.owner, props.repository);
     }
+    // Determine if we're working with an environment secret or repository secret
+    const isEnvironmentSecret = !!props.environment;
     if (this.phase === "delete") {
         if (this.output?.id) {
             try {
                 // Delete the secret
-                await octokit.rest.actions.deleteRepoSecret({
-                    owner: props.owner,
-                    repo: props.repository,
-                    secret_name: props.name,
-                });
+                if (isEnvironmentSecret) {
+                    await octokit.rest.actions.deleteEnvironmentSecret({
+                        owner: props.owner,
+                        repo: props.repository,
+                        environment_name: props.environment,
+                        secret_name: props.name,
+                    });
+                }
+                else {
+                    await octokit.rest.actions.deleteRepoSecret({
+                        owner: props.owner,
+                        repo: props.repository,
+                        secret_name: props.name,
+                    });
+                }
             }
             catch (error) {
                 // Ignore 404 errors (secret already deleted)
@@ -97,27 +119,96 @@ export const GitHubSecret = Resource("github::Secret", async function (id, props
     }
     else {
         try {
-            // Get the repository's public key for encrypting secrets
-            const { data: publicKey } = await octokit.rest.actions.getRepoPublicKey({
-                owner: props.owner,
-                repo: props.repository,
-            });
+            // Check if we're transitioning between secret types (repo <-> environment)
+            if (this.phase === "update") {
+                const wasEnvironmentSecret = !!this.output.environment;
+                const secretTypeChanged = isEnvironmentSecret !== wasEnvironmentSecret;
+                // If secret type changed, we need to delete the old one first
+                if (secretTypeChanged) {
+                    console.log(`Secret type changed from ${wasEnvironmentSecret ? "environment" : "repository"} to ${isEnvironmentSecret ? "environment" : "repository"} secret. Deleting the old secret first.`);
+                    try {
+                        if (wasEnvironmentSecret) {
+                            // Delete the old environment secret
+                            await octokit.rest.actions.deleteEnvironmentSecret({
+                                owner: this.output.owner,
+                                repo: this.output.repository,
+                                environment_name: this.output.environment,
+                                secret_name: this.output.name,
+                            });
+                        }
+                        else {
+                            // Delete the old repository secret
+                            await octokit.rest.actions.deleteRepoSecret({
+                                owner: this.output.owner,
+                                repo: this.output.repository,
+                                secret_name: this.output.name,
+                            });
+                        }
+                    }
+                    catch (error) {
+                        // Log but don't fail if the old secret doesn't exist or can't be deleted
+                        if (error.status === 404) {
+                            console.log("Old secret not found, continuing with creation of new secret");
+                        }
+                        else {
+                            throw error;
+                        }
+                    }
+                }
+            }
+            let publicKey;
+            // Get the appropriate public key for encrypting secrets
+            if (isEnvironmentSecret) {
+                // Get the environment's public key
+                const { data } = await octokit.rest.actions.getEnvironmentPublicKey({
+                    owner: props.owner,
+                    repo: props.repository,
+                    environment_name: props.environment,
+                });
+                publicKey = data;
+            }
+            else {
+                // Get the repository's public key
+                const { data } = await octokit.rest.actions.getRepoPublicKey({
+                    owner: props.owner,
+                    repo: props.repository,
+                });
+                publicKey = data;
+            }
             // Encrypt the secret value using libsodium
             const encryptedValue = await encryptString(props.value.unencrypted, publicKey.key);
             // Create or update the secret with the encrypted value and key_id
-            await octokit.rest.actions.createOrUpdateRepoSecret({
-                owner: props.owner,
-                repo: props.repository,
-                secret_name: props.name,
-                encrypted_value: encryptedValue,
-                key_id: publicKey.key_id,
-            });
+            if (isEnvironmentSecret) {
+                await octokit.rest.actions.createOrUpdateEnvironmentSecret({
+                    owner: props.owner,
+                    repo: props.repository,
+                    environment_name: props.environment,
+                    secret_name: props.name,
+                    encrypted_value: encryptedValue,
+                    key_id: publicKey.key_id,
+                });
+            }
+            else {
+                await octokit.rest.actions.createOrUpdateRepoSecret({
+                    owner: props.owner,
+                    repo: props.repository,
+                    secret_name: props.name,
+                    encrypted_value: encryptedValue,
+                    key_id: publicKey.key_id,
+                });
+            }
             // GitHub doesn't return the secret details on create/update, so we need to construct it
+            const idParts = [props.owner, props.repository];
+            if (isEnvironmentSecret) {
+                idParts.push(props.environment);
+            }
+            idParts.push(props.name);
             return this({
-                id: `${props.owner}/${props.repository}/${props.name}`,
+                id: idParts.join("/"),
                 owner: props.owner,
                 repository: props.repository,
                 name: props.name,
+                environment: props.environment,
                 token: props.token,
                 updatedAt: new Date().toISOString(),
             });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "alchemy",
-  "version": "0.9.2",
+  "version": "0.10.1",
   "type": "module",
   "module": "./lib/index.js",
   "scripts": {

package/src/esbuild/bundle.ts

@@ -119,22 +119,54 @@ export const Bundle = Resource(
     props: BundleProps
   ): Promise<Bundle> {
     // Determine output path
-    const outputPath = getOutputPath(props);
+    const outDirPath =
+      props.outfile != null ? path.dirname(props.outfile) : props.outdir;
 
-    // Ensure output directory exists
-    await fs.promises.mkdir(path.dirname(outputPath), { recursive: true });
+    if (outDirPath == null) {
+      throw new Error(
+        `You need to specify either outfile or outdir in your bundle configuration ${JSON.stringify(props)}`
+      );
+    }
 
+    // Ensure output directory exists
+    await fs.promises.mkdir(path.dirname(outDirPath), { recursive: true });
     if (this.phase === "delete") {
-      await fs.promises.unlink(outputPath).catch(() => {});
-      // Also clean up sourcemap if it exists
-      await fs.promises.unlink(outputPath + ".map").catch(() => {});
-      return this.destroy();
+      await fs.promises.rm(outDirPath, { recursive: true });
     }
 
     const result = await bundle(props);
+    // Check that bundle created output an file for the given entrypoint
+    // Use bundle metada data to retrieve its content
+    const bundleOutputPath = Object.entries(result.metafile.outputs).find(
+      ([file, output]) => {
+        if (output.entryPoint === undefined) {
+          return false;
+        }
+        // resolve to absolute and then relative to ensure consistent result (e.g. ./src/handler.ts instead of src/handler.ts)
+        const relativeOutput = path.relative(
+          process.cwd(),
+          path.resolve(output.entryPoint)
+        );
+        return (
+          relativeOutput ===
+          path.relative(
+            process.cwd(),
+            path.resolve(process.cwd(), props.entryPoint)
+          )
+        );
+      }
+    )?.[0];
+
+    if (!bundleOutputPath) {
+      throw new Error(`Unable to find a compiled file`);
+    }
+
     // Calculate hash of the output
-    const contents = await fs.promises.readFile(outputPath);
-    const hash = crypto.createHash("sha256").update(contents).digest("hex");
+    const bundleOutputContent = await fs.promises.readFile(bundleOutputPath);
+    const hash = crypto
+      .createHash("sha256")
+      .update(bundleOutputContent)
+      .digest("hex");
 
     // Store metadata in context
     await this.set("metafile", result.metafile);
@@ -142,18 +174,18 @@ export const Bundle = Resource(
 
     // Return output info
     return this({
-      path: outputPath,
+      path: bundleOutputPath,
       hash,
     });
   }
 );
 
 export async function bundle(props: BundleProps) {
-  const outputPath = getOutputPath(props);
   return await esbuild.build({
     ...props.options,
     entryPoints: [props.entryPoint],
-    outfile: outputPath,
+    outdir: props.outdir,
+    outfile: props.outfile,
     bundle: true,
     format: props.format,
     target: props.target,
@@ -169,13 +201,3 @@ export async function bundle(props: BundleProps) {
     write: true,
   });
 }
-
-function getOutputPath(props: BundleProps) {
-  return (
-    props.outfile ||
-    path.join(
-      props.outdir || "dist",
-      path.basename(props.entryPoint, path.extname(props.entryPoint)) + ".js"
-    )
-  );
-}

package/src/github/index.ts

@@ -1 +1,2 @@
+export * from "./repository-environment";
 export * from "./secret";