feat: confirmation on regex matches

Author: jinghaihan

README.md

@@ -18,7 +18,7 @@ This tool automates the process, allowing you to sync secrets across multiple re
 
 ## Usage
 
-**Create a configuration file** (`secrets.config.yaml`) in your central repository:
+**Create a configuration file** (`secrets.config.yaml`) in your central repository or local directory:
 
 ```yaml
 repos:
@@ -29,7 +29,8 @@ envs:
   - OVSX_PAT
 ```
 
-> **Note**: Both `repos` and `envs` support `*` wildcards. For `repos`, the tool lists all repositories accessible by your token and filters by the pattern (e.g., `owner/vscode-*`). For `envs`, wildcards are expanded by listing secrets from the central repository and matching by name. The central repository is auto-detected in GitHub Actions (from the checked-out repo); for local runs, pass `--repo <owner/repo>`.
+> [!NOTE]
+> Both `repos` and `envs` support `*` wildcards. For `repos`, the tool lists all repositories accessible by your token and filters by the pattern (e.g., `owner/vscode-*`). For `envs`, wildcards are expanded by listing secrets from the central repository and matching by name. The central repository is auto-detected in GitHub Actions (from the checked-out repo); for local runs, pass `--repo <owner/repo>`.
 
 ### Local usage
 
@@ -76,7 +77,8 @@ jobs:
           node-version: lts/*
 
       - name: Sync Secrets
-        run: npx gh-secrets-sync
+        # if regex patterns are used in `repos` or `secrets` must set `--yes` in GitHub Actions
+        run: npx gh-secrets-sync --yes
         env:
           GITHUB_PAT: ${{secrets.GITHUB_PAT}}
           VSCE_PAT: ${{secrets.VSCE_PAT}}

package.json

@@ -50,6 +50,7 @@
     "prepublishOnly": "pnpm build"
   },
   "dependencies": {
+    "@clack/prompts": "catalog:node",
     "@octokit/core": "catalog:utils",
     "ansis": "catalog:node",
     "cac": "catalog:node",

pnpm-lock.yaml

@@ -14,6 +14,7 @@ catalogs:
     lint-staged: ^16.1.4
     simple-git-hooks: ^2.13.1
   node:
+    '@clack/prompts': ^0.11.0
     ansis: ^4.1.0
     cac: ^6.7.14
     execa: ^9.6.0

pnpm-workspace.yaml

@@ -20,6 +20,7 @@ try {
     .option('--env-prefix <prefix>', 'environment variable prefix', { default: '' })
     .option('--repo <repo>', 'central GitHub repository')
     .option('--strict', 'Throw error if secret is not found in the environment variables', { default: true })
+    .option('--yes', 'Prompt to confirm resolved matches when regex patterns are used in repos or secrets', { default: false })
     .option('--dry', 'Dry run', { default: false })
     .allowUnknownOptions()
     .action(async (options: CommandOptions) => {

src/cli.ts

@@ -1,6 +1,7 @@
 import type { CommandOptions, Repo, Secret, SyncOptions } from './types'
 import { readFile } from 'node:fs/promises'
 import process from 'node:process'
+import * as p from '@clack/prompts'
 import c from 'ansis'
 import { join } from 'pathe'
 import { parse } from 'yaml'
@@ -35,11 +36,12 @@ async function normalizeConfig(options: CommandOptions): Promise<SyncOptions> {
 export async function resolveConfig(options: CommandOptions): Promise<SyncOptions> {
   const config = await normalizeConfig(options)
 
-  // resolve repos with regex
+  // resolve repos with regex patterns
   if (config.repos.some(r => r.includes('*'))) {
     await resolveRepoPatterns(config)
   }
 
+  // resolve secrets with regex patterns
   if (config.secrets.some(s => s.includes('*'))) {
     await resolveSecretPatterns(config)
   }
@@ -57,25 +59,71 @@ export async function resolveConfig(options: CommandOptions): Promise<SyncOption
 async function resolveRepoPatterns(options: SyncOptions) {
   const filter = createRegexFilter<'full_name', Repo>(options.repos, 'full_name')
 
-  const repos = (await getRepos(options))
+  let repos = (await getRepos(options))
     .filter(i => filter(i) && (options.private || !i.private))
     .map(i => i.full_name)
 
   if (repos.length) {
-    options.repos = [...new Set([...options.repos, ...repos])]
+    repos = [...new Set([...options.repos, ...repos])]
   }
-  options.repos = options.repos.filter(i => !i.includes('*'))
+  repos = repos.filter(i => !i.includes('*'))
+
+  if (options.yes || !repos.length) {
+    options.repos = repos
+    return
+  }
+
+  const result = await p.multiselect<string>({
+    message: 'Select repos to sync',
+    options: repos.map(i => ({ label: i, value: i })),
+    initialValues: repos,
+  })
+
+  if (p.isCancel(result)) {
+    console.error(c.red('aborting'))
+    process.exit(1)
+  }
+
+  if (typeof result === 'symbol') {
+    console.error(c.red('invalid repo selection'))
+    process.exit(1)
+  }
+
+  options.repos = result
 }
 
 async function resolveSecretPatterns(options: SyncOptions) {
   const filter = createRegexFilter<'name', Secret>(options.secrets, 'name')
 
-  const secrets = (await getRepoSecrets(options))
+  let secrets = (await getRepoSecrets(options))
     .filter(i => filter(i))
     .map(i => i.name)
 
   if (secrets.length) {
-    options.secrets = [...new Set([...options.secrets, ...secrets])]
+    secrets = [...new Set([...options.secrets, ...secrets])]
   }
-  options.secrets = options.secrets.filter(i => !i.includes('*'))
+  secrets = secrets.filter(i => !i.includes('*'))
+
+  if (options.yes || !secrets.length) {
+    options.secrets = secrets
+    return
+  }
+
+  const result = await p.multiselect<string>({
+    message: 'Select secrets to sync',
+    options: secrets.map(i => ({ label: i, value: i })),
+    initialValues: secrets,
+  })
+
+  if (p.isCancel(result)) {
+    console.error(c.red('aborting'))
+    process.exit(1)
+  }
+
+  if (typeof result === 'symbol') {
+    console.error(c.red('invalid secret selection'))
+    process.exit(1)
+  }
+
+  options.secrets = result
 }

src/config.ts

@@ -9,4 +9,5 @@ export const DEFAULT_SYNC_OPTIONS = {
   repo: '',
   dry: false,
   strict: true,
+  yes: false,
 } as const

src/constants.ts

@@ -8,6 +8,11 @@ export interface CommonOptions {
    * Throw error if secret is not found in the environment variables
    */
   strict?: boolean
+  /**
+   * Prompt for confirmation when regex patterns are used in `repos` or `secrets`.
+   * Shows the resolved matches and requires user approval.
+   */
+  yes?: boolean
 }
 
 export interface CommandOptions extends CommonOptions {
@@ -67,5 +72,5 @@ export interface Repo {
 export interface Secret {
   name: string
   created_at: string
-  updated_ad: string
+  updated_at: string
 }