Am I missing sth. here, I followed the instructions https://github.com/pulumi/esc-examples/tree/main/sync/github-secrets to sync the secrets between esc and my github repo it say that is can't find the properties which I added in the

syncEnv.yml

as explained in the `README.md`:

imports:
  - case-traders/cms
values:
  sync:
    githubSecrets:
      - name: CMS_GITHUB_TOKEN
        value: ${CMS_GITHUB_TOKEN}
      - name: CMS_REPO
        value: ${CMS_REPO}
      - name: CMS_REPO_OWNER
        value: ${CMS_REPO_OWNER}
      - name: CMS_USERNAME
        value: ${CMS_USERNAME}
      - name: CMS_PASSWORD
        value: ${CMS_PASSWORD}

when I try

pulumi up

I get the following error

Type                                Name                         Status                  Info
     pulumi:pulumi:Stack                 esc-sync-github-secrets-dev  **failed**              1 error
 +   └─ pulumiservice:index:Environment  env                          **creating failed**     1 error

Diagnostics:
  pulumi:pulumi:Stack (esc-sync-github-secrets-dev):
    error: update failed

  pulumiservice:index:Environment (env):
    error: failed to check environment due to error: [0]
    Diags: unknown property "CMS_GITHUB_TOKEN"
    unknown property "CMS_REPO"
    unknown property "CMS_REPO_OWNER"
    unknown property "CMS_USERNAME"
    unknown property "CMS_PASSWORD"

    [Pulumi Copilot] Would you like help with these diagnostics?
    <https://app.pulumi.com/case-traders/esc-sync-github-secrets/dev/updates/2?explainFailure>

Resources:
    2 unchanged

Duration: 3s

Hey @adamant-solstice-35288 you'll have to edit the code a bit to fit your use case. Specifically, in the example code the env.yaml is defined as if there's only 1 secret to sync, i.e.

githubSecrets

is an object. In your code,

githubSecrets

is an array of objects.

so I changed the code in the

target/index.ts

import * as pulumi from "@pulumi/pulumi";

import * as github from "@pulumi/github";
import * as fs from "fs";


const config = new pulumi.Config();
const repository = config.require("repository");


const secretsFile = "sync.json";
const secretsConfig = JSON.parse(fs.readFileSync(secretsFile, "utf8"));

if (!Array.isArray(secretsConfig.githubSecrets)) {
  throw new Error("Invalid secrets configuration. Expected a list of secrets under `githubSecrets`.");
}


const secrets = secretsConfig.githubSecrets.map((secret:Record<string, string>) => {
  if (!secret.name || !secret.value) {
    throw new Error(`Invalid secret entry: ${JSON.stringify(secret)}`);
  }

  return new github.ActionsSecret(`githubSecret-${secret.name}`, {
    repository,
    secretName: secret.name,
    plaintextValue: secret.value,
  });
});


export const secretNames = secrets.map((secret) => secret.secretName);

but it still gives the same error

You need to change the code in

index.ts

specifically, here's where it assumes

githubSecrets

is an object: https://github.com/pulumi/esc-examples/blob/main/sync/github-secrets/index.ts#L43-L48

after inspecting the main

index.ts

file I find this

operationContext: {
    preRunCommands: [
      "pulumi login",
      pulumi
        .interpolate`pulumi config env add ${projectName}/${env.name} -s ${fullyQualifiedStackName} --yes`,
      pulumi
        .interpolate`pulumi env open ${fullyQualifiedEnvName} sync.githubSecrets.value > sync.json`,
      pulumi
        .interpolate`pulumi config set -s ${fullyQualifiedStackName} secretName $(pulumi env open ${fullyQualifiedEnvName} sync.githubSecrets.name)`,
    ],
  },

You could pass in the entire

githubSecrets

array as a secret config and then parse it in

target/index.ts

I really don't understand what this line actually does, specifically after the word

open

pulumi
        .interpolate`pulumi config set -s ${fullyQualifiedStackName} secretName $(pulumi env open ${fullyQualifiedEnvName} sync.githubSecrets.name)`,

That's just setting a configuration key

secretName

on the target stack to whatever the name of your secret is.

ok so passing the whole array by the following changes still gives the same error:

pulumi
        .interpolate`pulumi env open ${fullyQualifiedEnvName} sync.githubSecrets > sync.json`,

Yeah, sorry, I'm a little pressed for time so I'm going to explain to you what the code does - but you're going to have to figure out how to change it on your own. It's not just a one line change. Specifically, based on the example, this line:

pulumi.interpolate`pulumi env open ${fullyQualifiedEnvName} sync.githubSecrets.value > sync.json`

writes the value of the secret to

sync.json

And this line:

pulumi.interpolate`pulumi config set -s ${fullyQualifiedStackName} secretName $(pulumi env open ${fullyQualifiedEnvName} sync.githubSecrets.name)`

creates a configuration key called

secretName

and sets it to the name of the secret. And then in target/index.ts it takes that secret name and value and pushes it to github.

I did what u did already but it still gives the same error

one second, I'm still working on the changes to target/index.ts

u mean the logic is flawed?

You are doing a different thing than what is defined in the example, and so you need to change your code. Sorry, I'm trying to help but this is a bit of a frustrating conversation because it seems like you just want someone else to do all the work and not understand the code yourself.

I am really sorry for that, but I am trying really to wrap my head around it, but thanks anyway

You can edit

target/index.ts

to something like this:

import * as pulumi from "@pulumi/pulumi";
import * as github from "@pulumi/github";
import * as fs from "fs";

const config = new pulumi.Config();
const repository = config.require("repository");

const json = fs.readFileSync("sync.json", "utf8");
const secrets = JSON.parse(json);

for (const {name, value} of secrets) {
    const secret = new github.ActionsSecret(`githubSecret-${name}`, {
        repository,
        secretName: name,
        plaintextValue: value,
    });
}

Thank u alot, this has really helped, ironically the actual error was because of adding $ sign to the vars:

sync:
    githubSecrets:
      - name: CMS_GITHUB_TOKEN
        value: {CMS_GITHUB_TOKEN}
      - name: CMS_REPO
        value: {CMS_REPO}

removing it solved the issue 😅