import * as pulumi from "@pulumi/pulumi"; /** * This resource allows you to create and manage GitHub Actions secrets within your GitHub organization. * You must have write access to a repository to use this resource. * * Secret values are encrypted using the [Go '/crypto/box' module](https://godoc.org/golang.org/x/crypto/nacl/box) which is * interoperable with [libsodium](https://libsodium.gitbook.io/doc/). Libsodium is used by GitHub to decrypt secret values. * * For the purposes of security, the contents of the `value` field have been marked as `sensitive` to Terraform, * but it is important to note that **this does not hide it from state files**. You should treat state as sensitive always. * It is also advised that you do not store plaintext values in your code but rather populate the `valueEncrypted` * using fields from a resource, data source or variable as, while encrypted in state, these will be easily accessible * in your code. See below for an example of this abstraction. * * ## Example Usage * * ```typescript * import * as pulumi from "@pulumi/pulumi"; * import * as github from "@pulumi/github"; * * const examplePlaintext = new github.ActionsOrganizationSecret("example_plaintext", { * secretName: "example_secret_name", * visibility: "all", * value: someSecretString, * }); * const exampleEncrypted = new github.ActionsOrganizationSecret("example_encrypted", { * secretName: "example_secret_name", * visibility: "all", * valueEncrypted: someEncryptedSecretString, * }); * ``` * * ```typescript * import * as pulumi from "@pulumi/pulumi"; * import * as github from "@pulumi/github"; * * const repo = github.getRepository({ * fullName: "my-org/repo", * }); * const exampleEncrypted = new github.ActionsOrganizationSecret("example_encrypted", { * secretName: "example_secret_name", * visibility: "selected", * value: someSecretString, * selectedRepositoryIds: [repo.then(repo => repo.repoId)], * }); * const exampleSecret = new github.ActionsOrganizationSecret("example_secret", { * secretName: "example_secret_name", * visibility: "selected", * valueEncrypted: someEncryptedSecretString, * selectedRepositoryIds: [repo.then(repo => repo.repoId)], * }); * ``` * * ## Example Lifecycle Ignore Changes * * This resource supports using the `lifecycle` `ignoreChanges` block on `remoteUpdatedAt` to support use cases where a secret value is created using a placeholder value and then modified after creation outside the scope of Terraform. This approach ensures only the initial placeholder value is referenced in your code and in the resulting state file. * * ```typescript * import * as pulumi from "@pulumi/pulumi"; * import * as github from "@pulumi/github"; * * const exampleAllowDrift = new github.ActionsOrganizationSecret("example_allow_drift", { * secretName: "example_secret_name", * visibility: "all", * value: "placeholder", * }); * ``` * * ## Import * * This resource can be imported using the secret name as the ID. * * > **Note**: When importing secrets, the `value`, `valueEncrypted`, `encryptedValue`, or `plaintextValue` fields will not be populated in the state. You may need to ignore changes for these as a workaround if you're not planning on updating the secret through Terraform. * * ### Import Command * * The following command imports a GitHub actions organization secret named `mysecret` to a `github.ActionsOrganizationSecret` resource named `example`. * * ```sh * $ pulumi import github:index/actionsOrganizationSecret:ActionsOrganizationSecret example mysecret * ``` */ export declare class ActionsOrganizationSecret extends pulumi.CustomResource { /** * Get an existing ActionsOrganizationSecret resource's state with the given name, ID, and optional extra * properties used to qualify the lookup. * * @param name The _unique_ name of the resulting resource. * @param id The _unique_ provider ID of the resource to lookup. * @param state Any extra arguments used during the lookup. * @param opts Optional settings to control the behavior of the CustomResource. */ static get(name: string, id: pulumi.Input, state?: ActionsOrganizationSecretState, opts?: pulumi.CustomResourceOptions): ActionsOrganizationSecret; /** * Returns true if the given object is an instance of ActionsOrganizationSecret. This is designed to work even * when multiple copies of the Pulumi SDK have been loaded into the same process. */ static isInstance(obj: any): obj is ActionsOrganizationSecret; /** * Date the secret was created. */ readonly createdAt: pulumi.Output; /** * (Optional) This is ignored as drift detection is built into the resource. * * > **Note**: One of either `value`, `valueEncrypted`, `encryptedValue`, or `plaintextValue` must be specified. * * @deprecated This is no longer required and will be removed in a future release. Drift detection is now always performed, and external changes will result in the secret being updated to match the Terraform configuration. If you want to ignore external changes, you can use the `lifecycle` block with `ignoreChanges` on the `remoteUpdatedAt` field. */ readonly destroyOnDrift: pulumi.Output; /** * (Optional) Please use `valueEncrypted`. * * @deprecated Use valueEncrypted and key_id. */ readonly encryptedValue: pulumi.Output; /** * ID of the public key used to encrypt the secret, required when setting `encryptedValue`. */ readonly keyId: pulumi.Output; /** * (Optional) Please use `value`. * * @deprecated Use value. */ readonly plaintextValue: pulumi.Output; /** * Date the secret was last updated in GitHub. */ readonly remoteUpdatedAt: pulumi.Output; /** * Name of the secret. */ readonly secretName: pulumi.Output; /** * An array of repository IDs that can access the organization variable; this requires `visibility` to be set to `selected`. * * @deprecated This field is deprecated and will be removed in a future release. Please use the `github.ActionsOrganizationSecretRepositories` or `github.ActionsOrganizationSecretRepository` resources to manage repository access to organization secrets. */ readonly selectedRepositoryIds: pulumi.Output; /** * Date the secret was last updated by the provider. */ readonly updatedAt: pulumi.Output; /** * Plaintext value of the secret to be encrypted. This conflicts with `valueEncrypted`, `encryptedValue` & `plaintextValue`. */ readonly value: pulumi.Output; /** * Encrypted value of the secret using the GitHub public key in Base64 format, `keyId` is required with this value. This conflicts with `value`, `encryptedValue` & `plaintextValue`. */ readonly valueEncrypted: pulumi.Output; /** * Configures the access that repositories have to the organization secret; must be one of `all`, `private`, or `selected`. */ readonly visibility: pulumi.Output; /** * Create a ActionsOrganizationSecret resource with the given unique name, arguments, and options. * * @param name The _unique_ name of the resource. * @param args The arguments to use to populate this resource's properties. * @param opts A bag of options that control this resource's behavior. */ constructor(name: string, args: ActionsOrganizationSecretArgs, opts?: pulumi.CustomResourceOptions); } /** * Input properties used for looking up and filtering ActionsOrganizationSecret resources. */ export interface ActionsOrganizationSecretState { /** * Date the secret was created. */ createdAt?: pulumi.Input; /** * (Optional) This is ignored as drift detection is built into the resource. * * > **Note**: One of either `value`, `valueEncrypted`, `encryptedValue`, or `plaintextValue` must be specified. * * @deprecated This is no longer required and will be removed in a future release. Drift detection is now always performed, and external changes will result in the secret being updated to match the Terraform configuration. If you want to ignore external changes, you can use the `lifecycle` block with `ignoreChanges` on the `remoteUpdatedAt` field. */ destroyOnDrift?: pulumi.Input; /** * (Optional) Please use `valueEncrypted`. * * @deprecated Use valueEncrypted and key_id. */ encryptedValue?: pulumi.Input; /** * ID of the public key used to encrypt the secret, required when setting `encryptedValue`. */ keyId?: pulumi.Input; /** * (Optional) Please use `value`. * * @deprecated Use value. */ plaintextValue?: pulumi.Input; /** * Date the secret was last updated in GitHub. */ remoteUpdatedAt?: pulumi.Input; /** * Name of the secret. */ secretName?: pulumi.Input; /** * An array of repository IDs that can access the organization variable; this requires `visibility` to be set to `selected`. * * @deprecated This field is deprecated and will be removed in a future release. Please use the `github.ActionsOrganizationSecretRepositories` or `github.ActionsOrganizationSecretRepository` resources to manage repository access to organization secrets. */ selectedRepositoryIds?: pulumi.Input[] | undefined>; /** * Date the secret was last updated by the provider. */ updatedAt?: pulumi.Input; /** * Plaintext value of the secret to be encrypted. This conflicts with `valueEncrypted`, `encryptedValue` & `plaintextValue`. */ value?: pulumi.Input; /** * Encrypted value of the secret using the GitHub public key in Base64 format, `keyId` is required with this value. This conflicts with `value`, `encryptedValue` & `plaintextValue`. */ valueEncrypted?: pulumi.Input; /** * Configures the access that repositories have to the organization secret; must be one of `all`, `private`, or `selected`. */ visibility?: pulumi.Input; } /** * The set of arguments for constructing a ActionsOrganizationSecret resource. */ export interface ActionsOrganizationSecretArgs { /** * (Optional) This is ignored as drift detection is built into the resource. * * > **Note**: One of either `value`, `valueEncrypted`, `encryptedValue`, or `plaintextValue` must be specified. * * @deprecated This is no longer required and will be removed in a future release. Drift detection is now always performed, and external changes will result in the secret being updated to match the Terraform configuration. If you want to ignore external changes, you can use the `lifecycle` block with `ignoreChanges` on the `remoteUpdatedAt` field. */ destroyOnDrift?: pulumi.Input; /** * (Optional) Please use `valueEncrypted`. * * @deprecated Use valueEncrypted and key_id. */ encryptedValue?: pulumi.Input; /** * ID of the public key used to encrypt the secret, required when setting `encryptedValue`. */ keyId?: pulumi.Input; /** * (Optional) Please use `value`. * * @deprecated Use value. */ plaintextValue?: pulumi.Input; /** * Name of the secret. */ secretName: pulumi.Input; /** * An array of repository IDs that can access the organization variable; this requires `visibility` to be set to `selected`. * * @deprecated This field is deprecated and will be removed in a future release. Please use the `github.ActionsOrganizationSecretRepositories` or `github.ActionsOrganizationSecretRepository` resources to manage repository access to organization secrets. */ selectedRepositoryIds?: pulumi.Input[] | undefined>; /** * Plaintext value of the secret to be encrypted. This conflicts with `valueEncrypted`, `encryptedValue` & `plaintextValue`. */ value?: pulumi.Input; /** * Encrypted value of the secret using the GitHub public key in Base64 format, `keyId` is required with this value. This conflicts with `value`, `encryptedValue` & `plaintextValue`. */ valueEncrypted?: pulumi.Input; /** * Configures the access that repositories have to the organization secret; must be one of `all`, `private`, or `selected`. */ visibility: pulumi.Input; } //# sourceMappingURL=actionsOrganizationSecret.d.ts.map