Applying selected_repositories on newOrgSecret doesn't update the list.

[heurtematte]

The SCORE project references 15 selected projects for their QNX secrets.
https://github.com/eclipse-score/.eclipsefdn/blob/main/otterdog/eclipse-score.jsonnet#L80

However, applying Otterdog does not update the list for existing secrets and still shows only 13 selected projects in the UI.

To work around this and respond to the ticket, I updated the list manually. There is still one project missing.

You can test this with the missing project: rules_imagefs.

Original ticket:
https://gitlab.eclipse.org/eclipsefdn/helpdesk/-/issues/7249

[netomi]

Unfortunately, changing the selected repositories for an org secret requires you to pass the secret itself. This is currently not possible in the automatic processing of PRs as the app has no access to these secrets.

So in such cases, you need to manually apply the changes, hopefully this can be solved with vault support.

[heurtematte]

Thanks @netomi I missed this message.

Would it be possible to make it more specific? Correlating this issue with that message may be challenging for users who are not familiar with Otterdog.

[netomi]

yes I understand. The main audience for this message was security / releng team. When a PR can not be fully applied it is usually marked as not completed, so if you go over the PRs that are not fully applied you can then manually apply the remaining changes. Thats what I did regularily.

It would make sense to make that warning more descriptive and have a better notification for the security and releng teams to be able to react on that more quickly.

[heurtematte]

So in such cases, you need to manually apply the changes, hopefully this can be solved with vault support.

These are wildcard secrets. So not entirely.

At the very least, we should also have a warning showing the diff during apply. In this particular case, the project declares 15 repositories out of more than 75 existing ones, which makes verification particularly time-consuming when checking multiple secrets.

[netomi]

ah that makes things even more complex, let me think about how to handle that gracefully.