feat(cycle): secrets & variables reconcile cycle (#11) (#29)

Reconciles Actions secrets (PRESENCE only — never reads/writes values;
a missing declared secret is reported so the value is provisioned
out-of-band, extras removed only when ownership-gated) and variables
(full create/update/delete, values not being secret), at org + repo
scope. New SecretConfig/VariableConfig + Live types + four diff resource
types (org/repo × secret/variable). Environment scope noted as follow-up.

Registered, exported, action bundle rebuilt.

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Author: lex00

action/index.mjs

@@ -275,6 +275,8 @@ function diff(org, desired, live, opts = {}) {
   const entries = [];
   diffSettings(desired.settings, live.settings, entries);
   diffRulesets("", "org-ruleset", desired.rulesets, live.rulesets ?? [], opts, entries);
+  diffSecrets("", "org-secret", desired.secrets, live.secrets ?? [], opts, entries);
+  diffVariables("", "org-variable", desired.variables, live.variables ?? [], opts, entries);
   diffTeams(desired.teams, live.teams ?? {}, opts, entries);
   diffMembers(desired.members, live.members ?? [], opts, entries);
   diffRepos(desired.repos, live.repos ?? {}, opts, entries);
@@ -489,6 +491,8 @@ function diffRepos(desired, live, opts, out) {
     diffRulesets(`${name}/`, "repo-ruleset", dr.rulesets, lr.rulesets ?? [], opts, out);
     diffRepoSecurity(name, dr.security, lr.security, out);
     diffEnvironments(name, dr.environments, lr.environments ?? [], opts, out);
+    diffSecrets(`${name}/`, "repo-secret", dr.secrets, lr.secrets ?? [], opts, out);
+    diffVariables(`${name}/`, "repo-variable", dr.variables, lr.variables ?? [], opts, out);
   }
   for (const name of Object.keys(live)) {
     if (!Object.prototype.hasOwnProperty.call(desired, name)) {
@@ -633,6 +637,55 @@ function diffEnvironments(repoName, desired, live, opts, out) {
     }
   }
 }
+function diffSecrets(keyPrefix, resourceType, desired, live, opts, out) {
+  if (desired === void 0) return;
+  const desiredByName = new Map(desired.map((s) => [s.name, s]));
+  const liveByName = new Map(live.map((s) => [s.name, s]));
+  for (const [name, ds] of desiredByName) {
+    if (!liveByName.has(name)) {
+      out.push({ kind: "create", resourceType, key: `${keyPrefix}${name}`, after: ds });
+    }
+  }
+  for (const [name, ls] of liveByName) {
+    if (!desiredByName.has(name)) {
+      const key = `${keyPrefix}${name}`;
+      if (opts.isOwned?.(resourceType, key)) {
+        out.push({ kind: "delete", resourceType, key, before: ls });
+      }
+    }
+  }
+}
+function diffVariables(keyPrefix, resourceType, desired, live, opts, out) {
+  if (desired === void 0) return;
+  const desiredByName = new Map(desired.map((v) => [v.name, v]));
+  const liveByName = new Map(live.map((v) => [v.name, v]));
+  for (const [name, dv] of desiredByName) {
+    const lv = liveByName.get(name);
+    const key = `${keyPrefix}${name}`;
+    if (!lv) {
+      out.push({ kind: "create", resourceType, key, after: dv });
+      continue;
+    }
+    if (dv.value !== void 0 && dv.value !== lv.value) {
+      out.push({
+        kind: "update",
+        resourceType,
+        key,
+        before: lv,
+        after: dv,
+        fields: [{ field: "value", before: lv.value, after: dv.value }]
+      });
+    }
+  }
+  for (const [name, lv] of liveByName) {
+    if (!desiredByName.has(name)) {
+      const key = `${keyPrefix}${name}`;
+      if (opts.isOwned?.(resourceType, key)) {
+        out.push({ kind: "delete", resourceType, key, before: lv });
+      }
+    }
+  }
+}
 function diffObject(desired, live) {
   const fields = [];
   for (const key of Object.keys(desired)) {
@@ -703,6 +756,8 @@ var init_diff = __esm({
     RESOURCE_TYPE_ORDER = [
       "org-settings",
       "org-ruleset",
+      "org-secret",
+      "org-variable",
       "team",
       "team-member",
       "team-repo",
@@ -711,7 +766,9 @@ var init_diff = __esm({
       "repo-security",
       "environment",
       "branch-protection",
-      "repo-ruleset"
+      "repo-ruleset",
+      "repo-secret",
+      "repo-variable"
     ];
     RULESET_FIELDS = ["target", "enforcement", "bypassActors", "conditions", "rules"];
     ENVIRONMENT_FIELDS = [
@@ -230240,6 +230297,172 @@ var environmentsCycle = {
   }
 };
 
+// src/cycles/secrets-variables.ts
+var PER_PAGE4 = 100;
+async function listWrapped(client, makePath, field, budget) {
+  const out = [];
+  let page = 1;
+  for (; ; ) {
+    if (budget.exhausted) break;
+    budget.use(1);
+    const data = await client.request("GET", makePath(page));
+    const batch = data?.[field] ?? [];
+    if (!Array.isArray(batch) || batch.length === 0) break;
+    out.push(...batch);
+    if (batch.length < PER_PAGE4) break;
+    page++;
+  }
+  return out;
+}
+async function fetchSecrets(client, basePath, budget) {
+  try {
+    const raw = await listWrapped(
+      client,
+      (page) => `${basePath}?per_page=${PER_PAGE4}&page=${page}`,
+      "secrets",
+      budget
+    );
+    return raw.filter((s) => typeof s.name === "string").map((s) => ({ name: s.name }));
+  } catch (err) {
+    if (err instanceof Error && (err.message.includes("404") || err.message.includes("403"))) return [];
+    throw err;
+  }
+}
+async function fetchVariables(client, basePath, budget) {
+  try {
+    const raw = await listWrapped(
+      client,
+      (page) => `${basePath}?per_page=${PER_PAGE4}&page=${page}`,
+      "variables",
+      budget
+    );
+    return raw.filter((v) => typeof v.name === "string").map((v) => ({ name: v.name, value: v.value }));
+  } catch (err) {
+    if (err instanceof Error && (err.message.includes("404") || err.message.includes("403"))) return [];
+    throw err;
+  }
+}
+function splitRepoKey(key, resourceType) {
+  const idx = key.indexOf("/");
+  if (idx === -1) {
+    throw new Error(`secrets-variables: malformed ${resourceType} key "${key}" \u2014 expected "<repo>/<name>"`);
+  }
+  return [key.slice(0, idx), key.slice(idx + 1)];
+}
+async function applySecret(client, entry, org, budget) {
+  const isRepo = entry.resourceType === "repo-secret";
+  let basePath;
+  let name;
+  if (isRepo) {
+    const [repo, secretName] = splitRepoKey(entry.key, "repo-secret");
+    basePath = `/repos/${org}/${repo}/actions/secrets`;
+    name = secretName;
+  } else {
+    basePath = `/orgs/${org}/actions/secrets`;
+    name = entry.key;
+  }
+  if (entry.kind === "delete") {
+    budget.use(1);
+    await client.request("DELETE", `${basePath}/${encodeURIComponent(name)}`);
+    return;
+  }
+  throw new Error(
+    `secret "${name}" is declared but absent \u2014 provision its value out-of-band; warden never reads or writes secret values`
+  );
+}
+async function applyVariable(client, entry, org, budget) {
+  const isRepo = entry.resourceType === "repo-variable";
+  let basePath;
+  let name;
+  if (isRepo) {
+    const [repo, varName] = splitRepoKey(entry.key, "repo-variable");
+    basePath = `/repos/${org}/${repo}/actions/variables`;
+    name = varName;
+  } else {
+    basePath = `/orgs/${org}/actions/variables`;
+    name = entry.key;
+  }
+  if (entry.kind === "delete") {
+    budget.use(1);
+    await client.request("DELETE", `${basePath}/${encodeURIComponent(name)}`);
+    return;
+  }
+  const desired = entry.after;
+  if (entry.kind === "create") {
+    if (desired.value === void 0) {
+      throw new Error(`variable "${name}" is declared without a value \u2014 set a value to create it`);
+    }
+    const body = { name, value: desired.value };
+    if (!isRepo) body.visibility = desired.visibility ?? "all";
+    budget.use(1);
+    await client.request("POST", basePath, body);
+    return;
+  }
+  if (desired.value === void 0) return;
+  budget.use(1);
+  await client.request("PATCH", `${basePath}/${encodeURIComponent(name)}`, { value: desired.value });
+}
+var secretsVariablesCycle = {
+  name: "secrets-variables",
+  // ── Part 2: fetchLive ──────────────────────────────────────────────────────
+  async fetchLive(client, orgLogin, scope, budget) {
+    if (budget.exhausted) {
+      const { BudgetExhaustedError: BudgetExhaustedError2 } = await Promise.resolve().then(() => (init_runner(), runner_exports));
+      throw new BudgetExhaustedError2();
+    }
+    const secrets = await fetchSecrets(client, `/orgs/${orgLogin}/actions/secrets`, budget);
+    const variables = budget.exhausted ? [] : await fetchVariables(client, `/orgs/${orgLogin}/actions/variables`, budget);
+    const repos = {};
+    for (const [name, repoConfig] of Object.entries(scope?.repos ?? {})) {
+      const wantsSecrets = repoConfig.secrets !== void 0;
+      const wantsVariables = repoConfig.variables !== void 0;
+      if (!wantsSecrets && !wantsVariables) continue;
+      if (budget.exhausted) break;
+      const repoLive = {};
+      if (wantsSecrets) {
+        repoLive.secrets = await fetchSecrets(client, `/repos/${orgLogin}/${name}/actions/secrets`, budget);
+      }
+      if (wantsVariables && !budget.exhausted) {
+        repoLive.variables = await fetchVariables(client, `/repos/${orgLogin}/${name}/actions/variables`, budget);
+      }
+      repos[name] = repoLive;
+    }
+    return { secrets, variables, repos };
+  },
+  // ── Part 3: buildDesired ───────────────────────────────────────────────────
+  buildDesired(orgConfig, _orgLogin, _scope) {
+    const out = {};
+    if (orgConfig.secrets) out.secrets = orgConfig.secrets;
+    if (orgConfig.variables) out.variables = orgConfig.variables;
+    if (orgConfig.repos) {
+      const repos = {};
+      for (const [name, repoConfig] of Object.entries(orgConfig.repos)) {
+        const stripped = {};
+        if (repoConfig.secrets !== void 0) stripped.secrets = repoConfig.secrets;
+        if (repoConfig.variables !== void 0) stripped.variables = repoConfig.variables;
+        if (stripped.secrets !== void 0 || stripped.variables !== void 0) {
+          repos[name] = stripped;
+        }
+      }
+      out.repos = repos;
+    }
+    return out;
+  },
+  // ── Part 4: apply ──────────────────────────────────────────────────────────
+  async apply(client, entry, orgLogin, _scope, budget) {
+    switch (entry.resourceType) {
+      case "org-secret":
+      case "repo-secret":
+        return applySecret(client, entry, orgLogin, budget);
+      case "org-variable":
+      case "repo-variable":
+        return applyVariable(client, entry, orgLogin, budget);
+      default:
+        return;
+    }
+  }
+};
+
 // src/cli/registry.ts
 var CYCLE_REGISTRY = {
   [branchProtectionCycle.name]: branchProtectionCycle,
@@ -230249,7 +230472,8 @@ var CYCLE_REGISTRY = {
   [teamsCycle.name]: teamsCycle,
   [rulesetsCycle.name]: rulesetsCycle,
   [securityFeaturesCycle.name]: securityFeaturesCycle,
-  [environmentsCycle.name]: environmentsCycle
+  [environmentsCycle.name]: environmentsCycle,
+  [secretsVariablesCycle.name]: secretsVariablesCycle
 };
 
 // node_modules/@intentius/chant/src/audit/fetch.ts

src/cli/registry.ts

@@ -17,6 +17,7 @@ import { teamsCycle } from "../cycles/teams.js";
 import { rulesetsCycle } from "../cycles/rulesets.js";
 import { securityFeaturesCycle } from "../cycles/security-features.js";
 import { environmentsCycle } from "../cycles/environments.js";
+import { secretsVariablesCycle } from "../cycles/secrets-variables.js";
 
 /**
  * Registry of all available governance cycles, keyed by the name accepted by
@@ -34,4 +35,5 @@ export const CYCLE_REGISTRY: Record<string, Cycle> = {
   [rulesetsCycle.name]: rulesetsCycle,
   [securityFeaturesCycle.name]: securityFeaturesCycle,
   [environmentsCycle.name]: environmentsCycle,
+  [secretsVariablesCycle.name]: secretsVariablesCycle,
 };

src/config/types.ts

@@ -100,6 +100,42 @@ export interface MemberConfig {
   role?: OrgMemberRole;
 }
 
+// ---------------------------------------------------------------------------
+// Actions secrets & variables
+// ---------------------------------------------------------------------------
+
+/**
+ * An Actions secret declaration. warden manages a secret's PRESENCE only — it
+ * NEVER reads or writes secret values (those are provisioned out-of-band). A
+ * declared-but-missing secret is reported; its value must be supplied
+ * separately. An undeclared live secret is only removed when ownership-gated.
+ */
+export interface SecretConfig {
+  /** Secret name (the identity key within its scope). */
+  name: string;
+  /**
+   * Optional informational rotation pointer (e.g. a ticket or KMS key ref).
+   * Recorded for humans/automation; never sent to GitHub and never diffed.
+   */
+  rotationRef?: string;
+}
+
+/**
+ * An Actions variable declaration. Unlike secrets, variable values are NOT
+ * secret, so warden can reconcile them fully (create/update/delete).
+ */
+export interface VariableConfig {
+  /** Variable name (the identity key within its scope). */
+  name: string;
+  /** Variable value. Required to create or update; absent → presence-only. */
+  value?: string;
+  /**
+   * Visibility for ORG-level variables on create: "all" | "private" |
+   * "selected". Ignored for repo-level variables. Defaults to "all".
+   */
+  visibility?: "all" | "private" | "selected";
+}
+
 // ---------------------------------------------------------------------------
 // Deployment environments
 // ---------------------------------------------------------------------------
@@ -286,6 +322,16 @@ export interface RepoConfig {
    * Absent means environments are not managed by chant.
    */
   environments?: EnvironmentConfig[];
+  /**
+   * Repo-level Actions secrets (presence only — never values).
+   * Absent means secrets are not managed by chant.
+   */
+  secrets?: SecretConfig[];
+  /**
+   * Repo-level Actions variables.
+   * Absent means variables are not managed by chant.
+   */
+  variables?: VariableConfig[];
 }
 
 // ---------------------------------------------------------------------------
@@ -325,6 +371,16 @@ export interface OrgConfig {
    * Absent means org rulesets are not managed by chant.
    */
   rulesets?: RulesetConfig[];
+  /**
+   * Org-level Actions secrets (presence only — never values).
+   * Absent means secrets are not managed by chant.
+   */
+  secrets?: SecretConfig[];
+  /**
+   * Org-level Actions variables.
+   * Absent means variables are not managed by chant.
+   */
+  variables?: VariableConfig[];
 }
 
 /**