feat: add support for syncing secrets to GitHub Actions & Dependabot

[nimish-ks]

🔍 Overview

Add GitHub Dependabot secret sync support. Expanded the GitHub Actions integration to now able to sync secrets to GitHub Organization level. Both integrations use the same GitHub credentials, with repo/org destinations and org visibility (all/private). Includes org-duplicate guard to avoid races, oversized-secret handling, and UI parity with Actions.

Docs: phasehq/docs#198

💡 Proposed Changes

• Sync secrets to GitHub Depedabot (to repos, organizations)
• Sync secrets to GiHub Actions (to organizations)
• Fail the sync with an error if a secret value exceeds GitHub's official limit of 64KB. Log the secret key.
• Fix test cases and expanded test coverage to Dependabot

🖼️ Screenshots or Demo

📝 Release Notes

• New: Sync secrets to GitHub Dependabot (repo or org) with all/private org visibility.
• Improvement: Block duplicate org syncs for Dependabot to avoid races; oversized secrets now return a clear error.

🎯 Reviewer Focus

• Backend: api/utils/syncing/github/dependabot.py, backend/graphene/mutations/syncing.py, api/tasks/syncing.py, api/services.py, schema additions.
• Frontend: CreateGhDependabotSync.tsx, CreateSyncDialog.tsx, ServiceInfo.tsx, new mutation GQL.
• Schema/types regeneration steps.

💚 Did You...

• Ensure linting passes (code style checks)?
• Update dependencies and lockfiles (if required)
• Update migrations (if required)
• Regenerate graphql schema and types (if required)
• Verify the app builds locally?
• Manually test the changes on different browsers/devices?

[Copilot]

Pull request overview

This pull request adds support for syncing secrets to GitHub Actions at the organization level, complementing the existing repository-level sync functionality. Users can now choose to sync secrets to all repositories or only private repositories within a GitHub organization.

Key Changes:

• Added organization sync option with a tabbed UI to switch between repository and organization sync modes
• Updated GitHub OAuth scope from read:org to admin:org to support organization-level secret management
• Implemented backend logic to sync secrets to GitHub organization-level secrets with configurable repository visibility

Reviewed changes

Copilot reviewed 13 out of 13 changed files in this pull request and generated 12 comments.

Show a summary per file

File	Description
frontend/graphql/queries/syncing/github/getOrgs.gql	New GraphQL query to fetch user's GitHub organizations with their roles
frontend/graphql/mutations/syncing/github/CreateGhActionsSync.gql	Updated mutation to accept optional organization sync parameters (orgSync, repoVisibility) and made repoName optional
frontend/components/syncing/ServiceInfo.tsx	Added display logic to show organization sync information with repository visibility in the sync list
frontend/components/syncing/GitHub/SetupGhAuth.tsx	Updated OAuth scope from read:org to admin:org to enable organization secret management
frontend/components/syncing/GitHub/CreateGhActionsSync.tsx	Added tabbed interface for selecting between repository and organization sync, including organization picker and visibility options
frontend/apollo/schema.graphql	Added GitHubOrgType and updated mutation signature with new parameters
frontend/apollo/graphql.ts	Generated TypeScript types for the new GitHubOrgType and updated mutation types
frontend/apollo/gql.ts	Updated GraphQL document strings with new query and mutation signatures
backend/backend/schema.py	Registered GitHubOrgType and added githubOrgs query resolver
backend/backend/graphene/queries/syncing.py	Implemented resolve_gh_orgs to fetch user's GitHub organizations
backend/backend/graphene/mutations/syncing.py	Updated CreateGitHubActionsSync mutation to handle organization sync parameters and build appropriate sync options
backend/api/utils/syncing/github/actions.py	Added list_orgs, get_all_org_secrets, and sync_github_org_secrets functions for organization-level operations
backend/api/tasks/syncing.py	Updated perform_github_actions_sync to route to appropriate sync function based on org_sync flag

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 20 out of 20 changed files in this pull request and generated 12 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.