feat: add support for syncing secrets to GitHub Actions & Dependabot

backend/api/services.py

@@ -129,6 +129,13 @@ class ServiceConfig:
         "provider": Providers.GITHUB,
         "resource_type": "repo",
     }
+
+    GITHUB_DEPENDABOT = {
+        "id": "github_dependabot",
+        "name": "GitHub Dependabot",
+        "provider": Providers.GITHUB,
+        "resource_type": "repo",
+    }
 
     GITLAB_CI = {
         "id": "gitlab_ci",

backend/api/tasks/syncing.py

@@ -8,6 +8,11 @@
 from api.utils.syncing.github.actions import (
     get_gh_actions_credentials,
     sync_github_secrets,
+    sync_github_org_secrets,
+)
+from api.utils.syncing.github.dependabot import (
+    sync_github_dependabot_secrets,
+    sync_github_dependabot_org_secrets,
 )
 from api.utils.syncing.vault.main import sync_vault_secrets
 from api.utils.syncing.nomad.main import sync_nomad_secrets
@@ -84,6 +89,15 @@ def trigger_sync_tasks(env_sync):
 
         EnvironmentSyncEvent.objects.create(id=job_id, env_sync=env_sync)
 
+    elif env_sync.service == ServiceConfig.GITHUB_DEPENDABOT["id"]:
+        env_sync.status = EnvironmentSync.IN_PROGRESS
+        env_sync.save()
+
+        job = perform_github_dependabot_sync.delay(env_sync)
+        job_id = job.get_id()
+
+        EnvironmentSyncEvent.objects.create(id=job_id, env_sync=env_sync)
+
     elif env_sync.service == ServiceConfig.HASHICORP_VAULT["id"]:
         env_sync.status = EnvironmentSync.IN_PROGRESS
         env_sync.save()
@@ -238,7 +252,12 @@ def handle_sync_event(environment_sync, sync_function, *args, **kwargs):
 @job("default", timeout=DEFAULT_TIMEOUT)
 def perform_cloudflare_pages_sync(environment_sync):
 
-    account_id, access_token = get_cf_pages_credentials(environment_sync)
+    account_id = None
+    access_token = None
+
+    if environment_sync.authentication:
+        account_id, access_token = get_cf_pages_credentials(environment_sync)
+
     project_info = environment_sync.options
 
     handle_sync_event(
@@ -254,33 +273,92 @@ def perform_cloudflare_pages_sync(environment_sync):
 @job("default", timeout=DEFAULT_TIMEOUT)
 def perform_github_actions_sync(environment_sync):
 
-    access_token, api_host = get_gh_actions_credentials(environment_sync)
-    repo_name = environment_sync.options.get("repo_name")
-    repo_owner = environment_sync.options.get("owner")
-    environment_name = environment_sync.options.get("environment_name")
+    access_token = None
+    api_host = None
+
+    if environment_sync.authentication:
+        access_token, api_host = get_gh_actions_credentials(environment_sync)
+
+    is_org_sync = environment_sync.options.get("org_sync", False)
+
+    if is_org_sync:
+        org = environment_sync.options.get("org")
+        visibility = environment_sync.options.get("visibility", "all")
+        handle_sync_event(
+            environment_sync,
+            sync_github_org_secrets,
+            access_token,
+            org,
+            api_host,
+            visibility,
+        )
+    else:
+        repo_name = environment_sync.options.get("repo_name")
+        repo_owner = environment_sync.options.get("owner")
+        environment_name = environment_sync.options.get("environment_name")
+
+        handle_sync_event(
+            environment_sync,
+            sync_github_secrets,
+            access_token,
+            repo_name,
+            repo_owner,
+            api_host,
+            environment_name,
+        )
 
-    handle_sync_event(
-        environment_sync,
-        sync_github_secrets,
-        access_token,
-        repo_name,
-        repo_owner,
-        api_host,
-        environment_name,
-    )
+
+@job("default", timeout=DEFAULT_TIMEOUT)
+def perform_github_dependabot_sync(environment_sync):
+
+    access_token = None
+    api_host = None
+
+    if environment_sync.authentication:
+        access_token, api_host = get_gh_actions_credentials(environment_sync)
+
+    is_org_sync = environment_sync.options.get("org_sync", False)
+
+    if is_org_sync:
+        org = environment_sync.options.get("org")
+        visibility = environment_sync.options.get("visibility", "all")
+        handle_sync_event(
+            environment_sync,
+            sync_github_dependabot_org_secrets,
+            access_token,
+            org,
+            api_host,
+            visibility,
+        )
+    else:
+        repo_name = environment_sync.options.get("repo_name")
+        repo_owner = environment_sync.options.get("owner")
+
+        handle_sync_event(
+            environment_sync,
+            sync_github_dependabot_secrets,
+            access_token,
+            repo_name,
+            repo_owner,
+            api_host,
+        )
 
 
 @job("default", timeout=DEFAULT_TIMEOUT)
 def perform_aws_sm_sync(environment_sync):
     project_info = environment_sync.options
 
     # Determine authentication method and get appropriate credentials
-    has_role_arn = "role_arn" in environment_sync.authentication.credentials
+    credentials = {}
+
+    if environment_sync.authentication:
+        has_role_arn = "role_arn" in environment_sync.authentication.credentials
+
+        if has_role_arn:
+            credentials = get_aws_assume_role_credentials(environment_sync)
+        else:
+            credentials = get_aws_secrets_manager_credentials(environment_sync)
 
-    if has_role_arn:
-        credentials = get_aws_assume_role_credentials(environment_sync)
-    else:
-        credentials = get_aws_secrets_manager_credentials(environment_sync)
     handle_sync_event(
         environment_sync,
         sync_aws_secrets,
@@ -300,10 +378,14 @@ def perform_vault_sync(environment_sync):
 
     project_info = environment_sync.options
 
+    auth_id = None
+    if environment_sync.authentication:
+        auth_id = environment_sync.authentication.id
+
     handle_sync_event(
         environment_sync,
         sync_vault_secrets,
-        environment_sync.authentication.id,
+        auth_id,
         project_info.get("engine"),
         project_info.get("path"),
     )
@@ -314,10 +396,14 @@ def perform_nomad_sync(environment_sync):
 
     project_info = environment_sync.options
 
+    auth_id = None
+    if environment_sync.authentication:
+        auth_id = environment_sync.authentication.id
+
     handle_sync_event(
         environment_sync,
         sync_nomad_secrets,
-        environment_sync.authentication.id,
+        auth_id,
         project_info.get("path"),
         project_info.get("namespace"),
     )
@@ -330,10 +416,14 @@ def perform_gitlab_sync(environment_sync):
     resource_id = project_info.get("resource_id")
     resource_path = project_info.get("resource_path")
 
+    auth_id = None
+    if environment_sync.authentication:
+        auth_id = environment_sync.authentication.id
+
     handle_sync_event(
         environment_sync,
         sync_gitlab_secrets,
-        environment_sync.authentication.id,
+        auth_id,
         resource_id if resource_id is not None else resource_path,
         project_info.get("is_group"),
         project_info.get("masked"),
@@ -350,10 +440,14 @@ def perform_railway_sync(environment_sync):
     railway_environment = railway_sync_options.get("environment")
     railway_service = railway_sync_options.get("service")
 
+    auth_id = None
+    if environment_sync.authentication:
+        auth_id = environment_sync.authentication.id
+
     handle_sync_event(
         environment_sync,
         sync_railway_secrets,
-        environment_sync.authentication.id,
+        auth_id,
         railway_project["id"],
         railway_environment["id"],
         railway_service["id"] if railway_service is not None else None,
@@ -370,10 +464,14 @@ def perform_vercel_sync(environment_sync):
     vercel_environment = vercel_sync_options.get("environment", "production")
     vercel_secret_type = vercel_sync_options.get("secret_type", "encrypted")
 
+    auth_id = None
+    if environment_sync.authentication:
+        auth_id = environment_sync.authentication.id
+
     handle_sync_event(
         environment_sync,
         sync_vercel_secrets,
-        environment_sync.authentication.id,
+        auth_id,
         vercel_project["id"],
         vercel_team["id"] if vercel_team is not None else None,
         vercel_environment,
@@ -383,7 +481,11 @@ def perform_vercel_sync(environment_sync):
 
 @job("default", timeout=DEFAULT_TIMEOUT)
 def perform_cloudflare_workers_sync(environment_sync):
-    account_id, access_token = get_cf_workers_credentials(environment_sync)
+    account_id = None
+    access_token = None
+
+    if environment_sync.authentication:
+        account_id, access_token = get_cf_workers_credentials(environment_sync)
 
     worker_info = environment_sync.options
 
@@ -402,13 +504,17 @@ def perform_render_service_sync(environment_sync):
     render_resource_id = render_service_options.get("resource_id")
     render_resource_type = render_service_options.get("resource_type")
 
+    auth_id = None
+    if environment_sync.authentication:
+        auth_id = environment_sync.authentication.id
+
     if render_resource_type == RenderResourceType.ENVIRONMENT_GROUP.value:
         secret_file_name = render_service_options.get("secret_file_name")
 
         handle_sync_event(
             environment_sync,
             sync_render_env_group_secret_file,
-            environment_sync.authentication.id,
+            auth_id,
             render_resource_id,
             secret_file_name,
         )
@@ -417,6 +523,6 @@ def perform_render_service_sync(environment_sync):
         handle_sync_event(
             environment_sync,
             sync_render_service_env_vars,
-            environment_sync.authentication.id,
+            auth_id,
             render_resource_id,
         )