fix: replace orchestrator-develop branch references with main

The orchestrator-develop branch no longer exists. Update all fallback
clone commands and test fixtures to use main instead.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

action.yml

@@ -194,42 +194,15 @@ inputs:
     description:
       '[Orchestrator] Either local, k8s or aws can be used to run builds on a remote cluster. Additional parameters must
       be configured.'
-  fallbackProviderStrategy:
+  secretSource:
     default: ''
     required: false
     description:
-      '[Orchestrator] Fallback provider when the primary is unavailable. Used with runnerCheckEnabled for automatic
-      failover, or as a catch-all if the primary provider fails to initialize.'
-  runnerCheckEnabled:
-    default: 'false'
-    required: false
-    description:
-      '[Orchestrator] Check GitHub Actions runner availability before starting a build. When no suitable runners are
-      available and fallbackProviderStrategy is set, automatically routes to the fallback provider.'
-  runnerCheckLabels:
-    default: ''
-    required: false
-    description:
-      '[Orchestrator] Comma-separated runner labels to filter when checking availability (e.g. self-hosted,linux).
-      When empty, checks all runners in the repository.'
-  runnerCheckMinAvailable:
-    default: '1'
-    required: false
-    description:
-      '[Orchestrator] Minimum number of idle runners required for the primary provider. If fewer are available,
-      routes to fallbackProviderStrategy.'
-  retryOnFallback:
-    default: 'false'
-    required: false
-    description:
-      '[Orchestrator] When true and fallbackProviderStrategy is set, automatically retry the build on the fallback
-      provider if the primary provider fails. Useful for long builds where transient cloud failures are common.'
-  providerInitTimeout:
-    default: '0'
-    required: false
-    description:
-      '[Orchestrator] Maximum seconds to wait for the primary provider to initialize (setupWorkflow). If exceeded
-      and fallbackProviderStrategy is set, switches to the fallback. Set to 0 to disable (default).'
+      '[Orchestrator] Premade secret source for pulling build secrets. Supported values: aws-secrets-manager,
+      aws-parameter-store, gcp-secret-manager, azure-key-vault, hashicorp-vault, hashicorp-vault-kv1,
+      vault (alias for hashicorp-vault), env. Can also be a custom shell command with {0} placeholder
+      for the key, or a path to a YAML file defining custom sources. Takes precedence over
+      inputPullCommand when set.'
   resourceTracking:
     default: 'false'
     required: false

dist/index.js

@@ -327,12 +327,6 @@ class BuildParameters {
             containerRegistryRepository: input_1.default.containerRegistryRepository,
             containerRegistryImageVersion: input_1.default.containerRegistryImageVersion,
             providerStrategy: orchestrator_options_1.default.providerStrategy,
-            fallbackProviderStrategy: orchestrator_options_1.default.fallbackProviderStrategy,
-            runnerCheckEnabled: orchestrator_options_1.default.runnerCheckEnabled,
-            runnerCheckLabels: orchestrator_options_1.default.runnerCheckLabels,
-            runnerCheckMinAvailable: orchestrator_options_1.default.runnerCheckMinAvailable,
-            retryOnFallback: orchestrator_options_1.default.retryOnFallback,
-            providerInitTimeout: orchestrator_options_1.default.providerInitTimeout,
             buildPlatform: orchestrator_options_1.default.buildPlatform,
             kubeConfig: orchestrator_options_1.default.kubeConfig,
             containerMemory: orchestrator_options_1.default.containerMemory,
@@ -2210,25 +2204,6 @@ class OrchestratorOptions {
         }
         return provider || 'local';
     }
-    static get fallbackProviderStrategy() {
-        return OrchestratorOptions.getInput('fallbackProviderStrategy') || '';
-    }
-    static get runnerCheckEnabled() {
-        return OrchestratorOptions.getInput('runnerCheckEnabled') === 'true';
-    }
-    static get runnerCheckLabels() {
-        const labels = OrchestratorOptions.getInput('runnerCheckLabels');
-        return labels ? labels.split(',').map((l) => l.trim()) : [];
-    }
-    static get runnerCheckMinAvailable() {
-        return Number(OrchestratorOptions.getInput('runnerCheckMinAvailable')) || 1;
-    }
-    static get retryOnFallback() {
-        return OrchestratorOptions.getInput('retryOnFallback') === 'true';
-    }
-    static get providerInitTimeout() {
-        return Number(OrchestratorOptions.getInput('providerInitTimeout')) || 0;
-    }
     static get containerCpu() {
         return OrchestratorOptions.getInput('containerCpu') || `1024`;
     }
@@ -2268,6 +2243,9 @@ class OrchestratorOptions {
     static get pullInputList() {
         return OrchestratorOptions.getInput('pullInputList')?.split(`,`) || [];
     }
+    static get secretSource() {
+        return OrchestratorOptions.getInput('secretSource') || '';
+    }
     static get inputPullCommand() {
         const value = OrchestratorOptions.getInput('inputPullCommand');
         if (value === 'gcp-secret-manager') {
@@ -2389,13 +2367,39 @@ exports["default"] = OrchestratorOptions;
 
 "use strict";
 
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", ({ value: true }));
+const core = __importStar(__nccwpck_require__(42186));
 const input_1 = __importDefault(__nccwpck_require__(91933));
 const generic_input_reader_1 = __nccwpck_require__(2263);
 const orchestrator_options_1 = __importDefault(__nccwpck_require__(82473));
+const secret_source_service_1 = __nccwpck_require__(79089);
+const orchestrator_logger_1 = __importDefault(__nccwpck_require__(32549));
 const formatFunction = (value, arguments_) => {
     for (const element of arguments_) {
         value = value.replace(`{${element.key}}`, element.value);
@@ -2403,7 +2407,6 @@ const formatFunction = (value, arguments_) => {
     return value;
 };
 class OrchestratorQueryOverride {
-    // TODO accept premade secret sources or custom secret source definition yamls
     static query(key, alternativeKey) {
         if (OrchestratorQueryOverride.queryOverrides && OrchestratorQueryOverride.queryOverrides[key] !== undefined) {
             return OrchestratorQueryOverride.queryOverrides[key];
@@ -2431,11 +2434,49 @@ class OrchestratorQueryOverride {
         if (!this.shouldUseOverride(query)) {
             throw new Error(`Should not be trying to run override query on ${query}`);
         }
-        return await generic_input_reader_1.GenericInputReader.Run(formatFunction(orchestrator_options_1.default.inputPullCommand, [{ key: 0, value: query }]));
+        // Validate the query key before interpolating it into a shell command
+        (0, secret_source_service_1.validateSecretKey)(query);
+        const result = await generic_input_reader_1.GenericInputReader.Run(formatFunction(orchestrator_options_1.default.inputPullCommand, [{ key: 0, value: query }]));
+        // Mask the fetched secret value so it does not appear in GitHub Actions logs
+        if (result && result.trim().length > 0) {
+            core.setSecret(result);
+        }
+        return result;
     }
+    /**
+     * Populate query overrides using either:
+     * 1. Premade/custom secret sources (via secretSource input), or
+     * 2. Shell command (via inputPullCommand, legacy approach)
+     *
+     * The secretSource input takes precedence if set. It supports:
+     * - Premade names: 'aws-secrets-manager', 'aws-parameter-store', 'gcp-secret-manager', 'azure-key-vault', 'env'
+     * - Custom commands: any string containing {0} placeholder
+     * - YAML file path: a path ending in .yml or .yaml containing custom source definitions
+     */
     static async PopulateQueryOverrideInput() {
         const queries = orchestrator_options_1.default.pullInputList;
         OrchestratorQueryOverride.queryOverrides = {};
+        const secretSource = orchestrator_options_1.default.secretSource;
+        // Use SecretSourceService if secretSource is configured
+        if (secretSource) {
+            orchestrator_logger_1.default.log(`Using secret source: ${secretSource}`);
+            // YAML file: load definitions and use the first source
+            if (secretSource.endsWith('.yml') || secretSource.endsWith('.yaml')) {
+                const definitions = secret_source_service_1.SecretSourceService.loadFromYaml(secretSource);
+                if (definitions.length > 0) {
+                    orchestrator_logger_1.default.log(`Loaded ${definitions.length} secret source(s) from ${secretSource}`);
+                    for (const key of queries) {
+                        OrchestratorQueryOverride.queryOverrides[key] = await secret_source_service_1.SecretSourceService.fetchSecret(definitions[0], key);
+                    }
+                }
+                return;
+            }
+            // Premade or custom command source
+            const results = await secret_source_service_1.SecretSourceService.fetchAll(secretSource, queries);
+            Object.assign(OrchestratorQueryOverride.queryOverrides, results);
+            return;
+        }
+        // Legacy: use inputPullCommand if set
         for (const element of queries) {
             if (OrchestratorQueryOverride.shouldUseOverride(element)) {
                 OrchestratorQueryOverride.queryOverrides[element] = await OrchestratorQueryOverride.queryOverride(element);
@@ -2533,7 +2574,6 @@ const follow_log_stream_service_1 = __nccwpck_require__(36149);
 const orchestrator_result_1 = __importDefault(__nccwpck_require__(86819));
 const orchestrator_options_1 = __importDefault(__nccwpck_require__(82473));
 const resource_tracking_1 = __importDefault(__nccwpck_require__(42604));
-const runner_availability_service_1 = __nccwpck_require__(18876);
 class Orchestrator {
     static get isOrchestratorEnvironment() {
         return process.env[`GITHUB_ACTIONS`] !== `true`;
@@ -2570,26 +2610,6 @@ class Orchestrator {
     }
     static async setupSelectedBuildPlatform() {
         orchestrator_logger_1.default.log(`Orchestrator platform selected ${Orchestrator.buildParameters.providerStrategy}`);
-        // Check runner availability and apply fallback if needed
-        if (Orchestrator.buildParameters.runnerCheckEnabled && Orchestrator.buildParameters.fallbackProviderStrategy) {
-            const owner = orchestrator_options_1.default.githubOwner;
-            const repo = orchestrator_options_1.default.githubRepoName;
-            const token = Orchestrator.buildParameters.gitPrivateToken || process.env.GITHUB_TOKEN || '';
-            orchestrator_logger_1.default.log(`Checking runner availability (labels: [${Orchestrator.buildParameters.runnerCheckLabels.join(', ')}], min: ${Orchestrator.buildParameters.runnerCheckMinAvailable})`);
-            const result = await runner_availability_service_1.RunnerAvailabilityService.checkAvailability(owner, repo, token, Orchestrator.buildParameters.runnerCheckLabels, Orchestrator.buildParameters.runnerCheckMinAvailable);
-            orchestrator_logger_1.default.log(`Runner check: ${result.totalRunners} total, ${result.matchingRunners} matching, ${result.idleRunners} idle — ${result.reason}`);
-            if (result.shouldFallback) {
-                const original = Orchestrator.buildParameters.providerStrategy;
-                const fallback = Orchestrator.buildParameters.fallbackProviderStrategy;
-                orchestrator_logger_1.default.log(`Falling back from '${original}' to '${fallback}' — ${result.reason}`);
-                Orchestrator.buildParameters.providerStrategy = fallback;
-                core.setOutput('providerFallbackUsed', 'true');
-                core.setOutput('providerFallbackReason', result.reason);
-            }
-            else {
-                core.setOutput('providerFallbackUsed', 'false');
-            }
-        }
         // Detect LocalStack endpoints and handle AWS provider appropriately
         // AWS_FORCE_PROVIDER options:
         //   - 'aws': Force AWS provider (requires LocalStack Pro with ECS support)
@@ -2688,33 +2708,13 @@ class Orchestrator {
         if (baseImage.includes(`undefined`)) {
             throw new Error(`baseImage is undefined`);
         }
-        try {
-            return await Orchestrator.runWithProvider(buildParameters, baseImage);
-        }
-        catch (primaryError) {
-            // Retry on fallback provider if enabled and a fallback is configured
-            const fallback = buildParameters.fallbackProviderStrategy;
-            const alreadyOnFallback = buildParameters.providerStrategy === fallback;
-            if (buildParameters.retryOnFallback && fallback && !alreadyOnFallback) {
-                orchestrator_logger_1.default.log(`Primary provider '${buildParameters.providerStrategy}' failed: ${primaryError.message}`);
-                orchestrator_logger_1.default.log(`Retrying build on fallback provider '${fallback}'...`);
-                buildParameters.providerStrategy = fallback;
-                core.setOutput('providerFallbackUsed', 'true');
-                core.setOutput('providerFallbackReason', `Primary provider failed: ${primaryError.message}`);
-                return await Orchestrator.runWithProvider(buildParameters, baseImage);
-            }
-            throw primaryError;
-        }
-    }
-    static async runWithProvider(buildParameters, baseImage) {
         await Orchestrator.setup(buildParameters);
         // When aws-local mode is enabled, validate AWS CloudFormation templates
         // This ensures AWS templates are correct even when executing via local-docker
         if (Orchestrator.validateAwsTemplates) {
             await Orchestrator.validateAwsCloudFormationTemplates();
         }
-        // Setup workflow with optional init timeout
-        await Orchestrator.setupWorkflowWithTimeout();
+        await Orchestrator.Provider.setupWorkflow(Orchestrator.buildParameters.buildGuid, Orchestrator.buildParameters, Orchestrator.buildParameters.branch, Orchestrator.defaultSecrets);
         try {
             if (buildParameters.maxRetainedWorkspaces > 0) {
                 Orchestrator.lockedWorkspace = shared_workspace_locking_1.default.NewWorkspaceName();
@@ -2764,24 +2764,6 @@ class Orchestrator {
             throw error;
         }
     }
-    /**
-     * Runs setupWorkflow with an optional timeout. If providerInitTimeout is set and the
-     * provider takes longer than that to initialize, throws an error that triggers
-     * retry-on-fallback (if enabled).
-     */
-    static async setupWorkflowWithTimeout() {
-        const timeoutSeconds = Orchestrator.buildParameters.providerInitTimeout;
-        const setupPromise = Orchestrator.Provider.setupWorkflow(Orchestrator.buildParameters.buildGuid, Orchestrator.buildParameters, Orchestrator.buildParameters.branch, Orchestrator.defaultSecrets);
-        if (timeoutSeconds <= 0) {
-            await setupPromise;
-            return;
-        }
-        orchestrator_logger_1.default.log(`Provider init timeout: ${timeoutSeconds}s`);
-        const timeoutPromise = new Promise((_, reject) => {
-            setTimeout(() => reject(new Error(`Provider initialization timed out after ${timeoutSeconds}s`)), timeoutSeconds * 1000);
-        });
-        await Promise.race([setupPromise, timeoutPromise]);
-    }
     static async updateStatusWithBuildParameters() {
         const content = { ...Orchestrator.buildParameters };
         content.gitPrivateToken = ``;
@@ -8723,176 +8705,6 @@ class ResourceTracking {
 exports["default"] = ResourceTracking;
 
 
-/***/ }),
-
-/***/ 18876:
-/***/ (function(__unused_webpack_module, exports, __nccwpck_require__) {
-
-"use strict";
-
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.RunnerAvailabilityService = void 0;
-const core_1 = __nccwpck_require__(76762);
-const orchestrator_logger_1 = __importDefault(__nccwpck_require__(32549));
-/**
- * Maximum number of pages to fetch when paginating through GitHub API results.
- * 100 pages * 100 per page = 10,000 runners maximum.
- */
-const MAX_PAGINATION_PAGES = 100;
-/**
- * Total timeout in milliseconds for the pagination loop.
- * Prevents indefinite API calls if GitHub is slow or pagination is unexpectedly deep.
- */
-const PAGINATION_TIMEOUT_MS = 30000;
-/**
- * Checks GitHub Actions runner availability to support automatic provider fallback.
- *
- * When a user configures `runnerCheckEnabled: true` with a `fallbackProviderStrategy`,
- * this service queries the GitHub API for runner status before the build starts.
- * If insufficient runners are available, the orchestrator routes to the fallback provider.
- */
-class RunnerAvailabilityService {
-    /**
-     * Check if enough runners are available to handle the build.
-     *
-     * @param owner - GitHub repository owner
-     * @param repo - GitHub repository name
-     * @param token - GitHub token with repo/actions scope
-     * @param requiredLabels - Labels runners must have (empty = any runner)
-     * @param minAvailable - Minimum idle runners required
-     * @returns RunnerCheckResult with decision and diagnostics
-     */
-    static async checkAvailability(owner, repo, token, requiredLabels, minAvailable) {
-        if (!token) {
-            return {
-                shouldFallback: false,
-                reason: 'No GitHub token available — skipping runner check',
-                totalRunners: 0,
-                matchingRunners: 0,
-                idleRunners: 0,
-            };
-        }
-        try {
-            const octokit = new core_1.Octokit({ auth: token });
-            // Fetch all runners for the repository
-            const runners = await RunnerAvailabilityService.fetchRunners(octokit, owner, repo);
-            if (runners.length === 0) {
-                return {
-                    shouldFallback: true,
-                    reason: 'No runners registered for this repository',
-                    totalRunners: 0,
-                    matchingRunners: 0,
-                    idleRunners: 0,
-                };
-            }
-            // Filter by required labels
-            const matching = RunnerAvailabilityService.filterByLabels(runners, requiredLabels);
-            // Count idle (online + not busy)
-            const idle = matching.filter((r) => r.status === 'online' && !r.busy);
-            const result = {
-                shouldFallback: idle.length < minAvailable,
-                reason: idle.length >= minAvailable
-                    ? `${idle.length} idle runner(s) available (need ${minAvailable})`
-                    : `Only ${idle.length} idle runner(s) available, need ${minAvailable}`,
-                totalRunners: runners.length,
-                matchingRunners: matching.length,
-                idleRunners: idle.length,
-            };
-            return result;
-        }
-        catch (error) {
-            // If the API call fails (permissions, rate limit, etc.), don't block the build
-            orchestrator_logger_1.default.log(`Runner availability check failed: ${error.message}`);
-            return {
-                shouldFallback: false,
-                reason: `Runner check failed (${error.message}) — proceeding with primary provider`,
-                totalRunners: 0,
-                matchingRunners: 0,
-                idleRunners: 0,
-            };
-        }
-    }
-    /**
-     * Fetch all runners for a repository, handling pagination.
-     *
-     * Includes defensive limits:
-     * - Maximum page count (MAX_PAGINATION_PAGES) to prevent infinite loops
-     * - Total timeout (PAGINATION_TIMEOUT_MS) to prevent indefinite API calls
-     * - Rate-limit detection (HTTP 403/429 with X-RateLimit-Remaining header)
-     */
-    static async fetchRunners(octokit, owner, repo) {
-        const allRunners = [];
-        let page = 1;
-        const perPage = 100;
-        const startTime = Date.now();
-        while (page <= MAX_PAGINATION_PAGES) {
-            // Check total timeout
-            if (Date.now() - startTime > PAGINATION_TIMEOUT_MS) {
-                orchestrator_logger_1.default.logWarning(`[RunnerAvailability] Pagination timeout reached after ${page - 1} pages and ${Date.now() - startTime}ms. ` +
-                    `Using ${allRunners.length} runners found so far.`);
-                break;
-            }
-            let response;
-            try {
-                response = await octokit.request('GET /repos/{owner}/{repo}/actions/runners', {
-                    owner,
-                    repo,
-                    per_page: perPage,
-                    page,
-                });
-            }
-            catch (requestError) {
-                // Octokit throws for non-2xx responses. Check if this is a rate limit error.
-                const status = requestError.status ?? requestError.response?.status;
-                if (status === 403 || status === 429) {
-                    const resetTime = requestError.response?.headers?.['x-ratelimit-reset'] ?? requestError.headers?.['x-ratelimit-reset'];
-                    const resetMessage = resetTime
-                        ? ` Resets at ${new Date(Number.parseInt(String(resetTime), 10) * 1000).toISOString()}`
-                        : '';
-                    orchestrator_logger_1.default.logWarning(`[RunnerAvailability] GitHub API rate limit reached (HTTP ${status}).${resetMessage} ` +
-                        `Using ${allRunners.length} runners found so far.`);
-                    break;
-                }
-                // Re-throw non-rate-limit errors to be handled by the outer catch
-                throw requestError;
-            }
-            const runners = (response.data.runners || []);
-            allRunners.push(...runners);
-            if (runners.length < perPage)
-                break;
-            page++;
-        }
-        if (page > MAX_PAGINATION_PAGES) {
-            orchestrator_logger_1.default.logWarning(`[RunnerAvailability] Maximum pagination limit reached (${MAX_PAGINATION_PAGES} pages). ` +
-                `Using ${allRunners.length} runners found so far.`);
-        }
-        if (allRunners.length === 0) {
-            orchestrator_logger_1.default.log('[RunnerAvailability] No runners found. Possible causes: ' +
-                'wrong token permissions (needs repo or actions scope), ' +
-                'no self-hosted runners registered, ' +
-                'or runners are registered at the organization level instead of the repository.');
-        }
-        return allRunners;
-    }
-    /**
-     * Filter runners by required labels. A runner matches if it has ALL required labels.
-     * If requiredLabels is empty, all runners match.
-     */
-    static filterByLabels(runners, requiredLabels) {
-        if (requiredLabels.length === 0)
-            return runners;
-        return runners.filter((runner) => {
-            const runnerLabelNames = runner.labels.map((l) => l.name.toLowerCase());
-            return requiredLabels.every((required) => runnerLabelNames.includes(required.toLowerCase()));
-        });
-    }
-}
-exports.RunnerAvailabilityService = RunnerAvailabilityService;
-
-
 /***/ }),
 
 /***/ 54222:
@@ -9886,6 +9698,333 @@ class ContainerHookService {
 exports.ContainerHookService = ContainerHookService;
 
 
+/***/ }),
+
+/***/ 79089:
+/***/ (function(__unused_webpack_module, exports, __nccwpck_require__) {
+
+"use strict";
+
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.SecretSourceService = exports.validateSecretKey = void 0;
+const node_fs_1 = __importDefault(__nccwpck_require__(87561));
+const core = __importStar(__nccwpck_require__(42186));
+const orchestrator_logger_1 = __importDefault(__nccwpck_require__(32549));
+const orchestrator_system_1 = __nccwpck_require__(9744);
+/**
+ * Validate that a secret key name contains only safe characters.
+ * Prevents shell injection when keys are interpolated into commands.
+ *
+ * Allowed characters: alphanumeric, hyphens, underscores, dots, forward slashes.
+ *
+ * @param key - The secret key name to validate
+ * @returns The validated key (unchanged)
+ * @throws Error if the key contains disallowed characters
+ */
+function validateSecretKey(key) {
+    if (!/^[a-zA-Z0-9\-_./]+$/.test(key)) {
+        throw new Error(`Invalid secret key name: "${key}". Keys may only contain alphanumeric characters, hyphens, underscores, dots, and forward slashes.`);
+    }
+    return key;
+}
+exports.validateSecretKey = validateSecretKey;
+/**
+ * Mask a secret value so it does not appear in GitHub Actions logs.
+ * Empty or whitespace-only values are skipped (core.setSecret would be a no-op).
+ */
+function maskSecretValue(value) {
+    if (value.trim().length > 0) {
+        core.setSecret(value);
+    }
+}
+/**
+ * Premade secret sources and custom YAML-based secret source definitions.
+ *
+ * Premade sources are string shortcuts that expand to shell commands:
+ *   - `aws-secrets-manager` -- AWS Secrets Manager
+ *   - `aws-parameter-store` -- AWS Systems Manager Parameter Store
+ *   - `gcp-secret-manager` -- Google Cloud Secret Manager
+ *   - `azure-key-vault` -- Azure Key Vault (requires AZURE_VAULT_NAME env var)
+ *   - `hashicorp-vault` -- HashiCorp Vault KV v2 (requires VAULT_ADDR, optionally VAULT_MOUNT)
+ *   - `hashicorp-vault-kv1` -- HashiCorp Vault KV v1 (requires VAULT_ADDR, optionally VAULT_MOUNT)
+ *   - `env` -- Read from environment variables (no shell command needed)
+ *
+ * Custom YAML format:
+ *   sources:
+ *     - name: my-vault
+ *       command: 'vault kv get -field=value secret/{0}'
+ *     - name: my-api
+ *       command: 'curl -s https://secrets.example.com/api/{0}'
+ *       parseOutput: json-field
+ *       jsonField: value
+ */
+class SecretSourceService {
+    /**
+     * Check if a source name is a known premade source.
+     */
+    static isPremadeSource(sourceName) {
+        return sourceName in SecretSourceService.premadeSources;
+    }
+    /**
+     * Get the list of available premade source names.
+     */
+    static getAvailableSources() {
+        return Object.keys(SecretSourceService.premadeSources);
+    }
+    /**
+     * Resolve a source name to a SecretSourceDefinition.
+     *
+     * - If the name matches a premade source, returns that definition.
+     * - If it looks like a shell command (contains spaces or {0}), wraps it as a custom command.
+     * - Otherwise, returns undefined.
+     */
+    static resolveSource(sourceName) {
+        // Check premade sources
+        if (SecretSourceService.isPremadeSource(sourceName)) {
+            return SecretSourceService.premadeSources[sourceName];
+        }
+        // If it contains a placeholder or spaces, treat it as a raw command
+        if (sourceName.includes('{0}') || sourceName.includes(' ')) {
+            return {
+                name: 'custom-command',
+                command: sourceName,
+                parseOutput: 'raw',
+            };
+        }
+        return undefined;
+    }
+    /**
+     * Load custom secret source definitions from a YAML file.
+     *
+     * Expected format:
+     *   sources:
+     *     - name: my-source
+     *       command: 'my-tool get-secret {0}'
+     *     - name: my-api
+     *       command: 'curl -s https://api.example.com/secrets/{0}'
+     *       parseOutput: json-field
+     *       jsonField: value
+     */
+    static loadFromYaml(filePath) {
+        if (!node_fs_1.default.existsSync(filePath)) {
+            orchestrator_logger_1.default.logWarning(`Secret source YAML not found: ${filePath}`);
+            return [];
+        }
+        try {
+            const content = node_fs_1.default.readFileSync(filePath, 'utf8');
+            const parsed = SecretSourceService.parseSimpleYaml(content);
+            return parsed;
+        }
+        catch (error) {
+            orchestrator_logger_1.default.logWarning(`Failed to parse secret source YAML: ${error.message}`);
+            return [];
+        }
+    }
+    /**
+     * Fetch a secret value using the given source definition.
+     *
+     * Validates the key against an allowlist pattern before interpolating it
+     * into the command string to prevent shell injection. The fetched secret
+     * value is masked via core.setSecret() so it does not leak in logs.
+     *
+     * @param source - The secret source definition to use
+     * @param key - The secret key to fetch
+     * @returns The secret value, or empty string on failure
+     */
+    static async fetchSecret(source, key) {
+        // Validate the key to prevent shell injection
+        validateSecretKey(key);
+        const command = source.command.replace(/\{0\}/g, key);
+        try {
+            const output = await orchestrator_system_1.OrchestratorSystem.Run(command, false, true);
+            let value;
+            if (source.parseOutput === 'json-field' && source.jsonField) {
+                try {
+                    const parsed = JSON.parse(output);
+                    value = parsed[source.jsonField] || '';
+                }
+                catch {
+                    orchestrator_logger_1.default.logWarning(`Failed to parse JSON output from ${source.name} for key ${key}`);
+                    value = output.trim();
+                }
+            }
+            else {
+                value = output.trim();
+            }
+            // Mask the secret value so it does not appear in GitHub Actions logs
+            maskSecretValue(value);
+            return value;
+        }
+        catch (error) {
+            orchestrator_logger_1.default.logWarning(`Failed to fetch secret '${key}' from ${source.name}: ${error.message}`);
+            return '';
+        }
+    }
+    /**
+     * Fetch a secret from an environment variable. No shell command needed.
+     * The value is masked via core.setSecret() so it does not leak in logs.
+     */
+    static fetchFromEnv(key) {
+        const value = process.env[key] || '';
+        maskSecretValue(value);
+        return value;
+    }
+    /**
+     * Resolve a source name and fetch all secrets from it.
+     *
+     * @param sourceName - Premade source name, shell command, or 'env'
+     * @param keys - List of secret keys to fetch
+     * @returns Map of key -> value
+     */
+    static async fetchAll(sourceName, keys) {
+        const results = {};
+        if (sourceName === 'env') {
+            for (const key of keys) {
+                results[key] = SecretSourceService.fetchFromEnv(key);
+            }
+            return results;
+        }
+        const source = SecretSourceService.resolveSource(sourceName);
+        if (!source) {
+            orchestrator_logger_1.default.logWarning(`Unknown secret source '${sourceName}'. Available sources: ${SecretSourceService.getAvailableSources().join(', ')}`);
+            return results;
+        }
+        orchestrator_logger_1.default.log(`Fetching ${keys.length} secret(s) from ${source.name}`);
+        for (const key of keys) {
+            results[key] = await SecretSourceService.fetchSecret(source, key);
+        }
+        return results;
+    }
+    /**
+     * Simple YAML parser for secret source definitions.
+     * Handles the specific structure we expect without requiring a YAML library.
+     */
+    static parseSimpleYaml(content) {
+        const definitions = [];
+        const lines = content.split('\n');
+        let current = null;
+        for (const rawLine of lines) {
+            const line = rawLine.replace(/\r$/, '');
+            const trimmed = line.trim();
+            if (trimmed === '' || trimmed.startsWith('#'))
+                continue;
+            if (trimmed === '- name:' || trimmed.startsWith('- name:')) {
+                if (current?.name && current?.command) {
+                    definitions.push(current);
+                }
+                current = {
+                    name: trimmed
+                        .replace('- name:', '')
+                        .trim()
+                        .replace(/^['"]|['"]$/g, ''),
+                    parseOutput: 'raw',
+                };
+                continue;
+            }
+            if (current && trimmed.startsWith('command:')) {
+                current.command = trimmed
+                    .replace('command:', '')
+                    .trim()
+                    .replace(/^['"]|['"]$/g, '');
+            }
+            else if (current && trimmed.startsWith('parseOutput:')) {
+                const value = trimmed
+                    .replace('parseOutput:', '')
+                    .trim()
+                    .replace(/^['"]|['"]$/g, '');
+                current.parseOutput = value;
+            }
+            else if (current && trimmed.startsWith('jsonField:')) {
+                current.jsonField = trimmed
+                    .replace('jsonField:', '')
+                    .trim()
+                    .replace(/^['"]|['"]$/g, '');
+            }
+        }
+        if (current?.name && current?.command) {
+            definitions.push(current);
+        }
+        return definitions;
+    }
+}
+exports.SecretSourceService = SecretSourceService;
+SecretSourceService.premadeSources = {
+    'aws-secrets-manager': {
+        name: 'aws-secrets-manager',
+        command: 'aws secretsmanager get-secret-value --secret-id {0} --query SecretString --output text',
+        parseOutput: 'raw',
+    },
+    'aws-secret-manager': {
+        // Alias for backward compatibility (original name in inputPullCommand)
+        name: 'aws-secret-manager',
+        command: 'aws secretsmanager get-secret-value --secret-id {0} --query SecretString --output text',
+        parseOutput: 'raw',
+    },
+    'aws-parameter-store': {
+        name: 'aws-parameter-store',
+        command: 'aws ssm get-parameter --name {0} --with-decryption --query Parameter.Value --output text',
+        parseOutput: 'raw',
+    },
+    'gcp-secret-manager': {
+        name: 'gcp-secret-manager',
+        command: 'gcloud secrets versions access latest --secret="{0}"',
+        parseOutput: 'raw',
+    },
+    'azure-key-vault': {
+        name: 'azure-key-vault',
+        command: 'az keyvault secret show --vault-name "$AZURE_VAULT_NAME" --name {0} --query value --output tsv',
+        parseOutput: 'raw',
+    },
+    'hashicorp-vault': {
+        // HashiCorp Vault KV v2 (default). Requires VAULT_ADDR env var.
+        // Optionally set VAULT_MOUNT to override the mount path (default: 'secret').
+        // Authentication is handled by VAULT_TOKEN or other Vault auth env vars.
+        name: 'hashicorp-vault',
+        command: 'vault kv get -mount="${VAULT_MOUNT:-secret}" -field=value {0}',
+        parseOutput: 'raw',
+    },
+    'hashicorp-vault-kv1': {
+        // HashiCorp Vault KV v1. Requires VAULT_ADDR env var.
+        // Optionally set VAULT_MOUNT to override the mount path (default: 'secret').
+        name: 'hashicorp-vault-kv1',
+        command: 'vault read -mount="${VAULT_MOUNT:-secret}" -field=value {0}',
+        parseOutput: 'raw',
+    },
+    vault: {
+        // Short alias for hashicorp-vault (KV v2)
+        name: 'vault',
+        command: 'vault kv get -mount="${VAULT_MOUNT:-secret}" -field=value {0}',
+        parseOutput: 'raw',
+    },
+};
+
+
 /***/ }),
 
 /***/ 23451:

src/model/build-parameters.ts

@@ -54,12 +54,6 @@ class BuildParameters {
   public sshAgent!: string;
   public sshPublicKeysDirectoryPath!: string;
   public providerStrategy!: string;
-  public fallbackProviderStrategy!: string;
-  public runnerCheckEnabled!: boolean;
-  public runnerCheckLabels!: string[];
-  public runnerCheckMinAvailable!: number;
-  public retryOnFallback!: boolean;
-  public providerInitTimeout!: number;
   public gitPrivateToken!: string;
   public awsStackName!: string;
   public awsEndpoint?: string;
@@ -200,12 +194,6 @@ class BuildParameters {
       containerRegistryRepository: Input.containerRegistryRepository,
       containerRegistryImageVersion: Input.containerRegistryImageVersion,
       providerStrategy: OrchestratorOptions.providerStrategy,
-      fallbackProviderStrategy: OrchestratorOptions.fallbackProviderStrategy,
-      runnerCheckEnabled: OrchestratorOptions.runnerCheckEnabled,
-      runnerCheckLabels: OrchestratorOptions.runnerCheckLabels,
-      runnerCheckMinAvailable: OrchestratorOptions.runnerCheckMinAvailable,
-      retryOnFallback: OrchestratorOptions.retryOnFallback,
-      providerInitTimeout: OrchestratorOptions.providerInitTimeout,
       buildPlatform: OrchestratorOptions.buildPlatform,
       kubeConfig: OrchestratorOptions.kubeConfig,
       containerMemory: OrchestratorOptions.containerMemory,

src/model/orchestrator/options/orchestrator-options.ts

@@ -138,32 +138,6 @@ class OrchestratorOptions {
     return provider || 'local';
   }
 
-  static get fallbackProviderStrategy(): string {
-    return OrchestratorOptions.getInput('fallbackProviderStrategy') || '';
-  }
-
-  static get runnerCheckEnabled(): boolean {
-    return OrchestratorOptions.getInput('runnerCheckEnabled') === 'true';
-  }
-
-  static get runnerCheckLabels(): string[] {
-    const labels = OrchestratorOptions.getInput('runnerCheckLabels');
-
-    return labels ? labels.split(',').map((l) => l.trim()) : [];
-  }
-
-  static get runnerCheckMinAvailable(): number {
-    return Number(OrchestratorOptions.getInput('runnerCheckMinAvailable')) || 1;
-  }
-
-  static get retryOnFallback(): boolean {
-    return OrchestratorOptions.getInput('retryOnFallback') === 'true';
-  }
-
-  static get providerInitTimeout(): number {
-    return Number(OrchestratorOptions.getInput('providerInitTimeout')) || 0;
-  }
-
   static get containerCpu(): string {
     return OrchestratorOptions.getInput('containerCpu') || `1024`;
   }
@@ -216,6 +190,10 @@ class OrchestratorOptions {
     return OrchestratorOptions.getInput('pullInputList')?.split(`,`) || [];
   }
 
+  static get secretSource(): string {
+    return OrchestratorOptions.getInput('secretSource') || '';
+  }
+
   static get inputPullCommand(): string {
     const value = OrchestratorOptions.getInput('inputPullCommand');
 

src/model/orchestrator/options/orchestrator-query-override.ts

@@ -1,6 +1,9 @@
+import * as core from '@actions/core';
 import Input from '../../input';
 import { GenericInputReader } from '../../input-readers/generic-input-reader';
 import OrchestratorOptions from './orchestrator-options';
+import { SecretSourceService, validateSecretKey } from '../services/secrets/secret-source-service';
+import OrchestratorLogger from '../services/core/orchestrator-logger';
 
 const formatFunction = (value: string, arguments_: any[]) => {
   for (const element of arguments_) {
@@ -13,8 +16,6 @@ const formatFunction = (value: string, arguments_: any[]) => {
 class OrchestratorQueryOverride {
   static queryOverrides: { [key: string]: string } | undefined;
 
-  // TODO accept premade secret sources or custom secret source definition yamls
-
   public static query(key: string, alternativeKey: string) {
     if (OrchestratorQueryOverride.queryOverrides && OrchestratorQueryOverride.queryOverrides[key] !== undefined) {
       return OrchestratorQueryOverride.queryOverrides[key];
@@ -49,14 +50,62 @@ class OrchestratorQueryOverride {
       throw new Error(`Should not be trying to run override query on ${query}`);
     }
 
-    return await GenericInputReader.Run(
+    // Validate the query key before interpolating it into a shell command
+    validateSecretKey(query);
+
+    const result = await GenericInputReader.Run(
       formatFunction(OrchestratorOptions.inputPullCommand, [{ key: 0, value: query }]),
     );
+
+    // Mask the fetched secret value so it does not appear in GitHub Actions logs
+    if (result && result.trim().length > 0) {
+      core.setSecret(result);
+    }
+
+    return result;
   }
 
+  /**
+   * Populate query overrides using either:
+   * 1. Premade/custom secret sources (via secretSource input), or
+   * 2. Shell command (via inputPullCommand, legacy approach)
+   *
+   * The secretSource input takes precedence if set. It supports:
+   * - Premade names: 'aws-secrets-manager', 'aws-parameter-store', 'gcp-secret-manager', 'azure-key-vault', 'env'
+   * - Custom commands: any string containing {0} placeholder
+   * - YAML file path: a path ending in .yml or .yaml containing custom source definitions
+   */
   public static async PopulateQueryOverrideInput() {
     const queries = OrchestratorOptions.pullInputList;
     OrchestratorQueryOverride.queryOverrides = {};
+
+    const secretSource = OrchestratorOptions.secretSource;
+
+    // Use SecretSourceService if secretSource is configured
+    if (secretSource) {
+      OrchestratorLogger.log(`Using secret source: ${secretSource}`);
+
+      // YAML file: load definitions and use the first source
+      if (secretSource.endsWith('.yml') || secretSource.endsWith('.yaml')) {
+        const definitions = SecretSourceService.loadFromYaml(secretSource);
+        if (definitions.length > 0) {
+          OrchestratorLogger.log(`Loaded ${definitions.length} secret source(s) from ${secretSource}`);
+          for (const key of queries) {
+            OrchestratorQueryOverride.queryOverrides[key] = await SecretSourceService.fetchSecret(definitions[0], key);
+          }
+        }
+
+        return;
+      }
+
+      // Premade or custom command source
+      const results = await SecretSourceService.fetchAll(secretSource, queries);
+      Object.assign(OrchestratorQueryOverride.queryOverrides, results);
+
+      return;
+    }
+
+    // Legacy: use inputPullCommand if set
     for (const element of queries) {
       if (OrchestratorQueryOverride.shouldUseOverride(element)) {
         OrchestratorQueryOverride.queryOverrides[element] = await OrchestratorQueryOverride.queryOverride(element);

src/model/orchestrator/orchestrator.ts

@@ -20,7 +20,6 @@ import { FollowLogStreamService } from './services/core/follow-log-stream-servic
 import OrchestratorResult from './services/core/orchestrator-result';
 import OrchestratorOptions from './options/orchestrator-options';
 import ResourceTracking from './services/core/resource-tracking';
-import { RunnerAvailabilityService } from './services/core/runner-availability-service';
 
 class Orchestrator {
   public static Provider: ProviderInterface;
@@ -77,42 +76,6 @@ class Orchestrator {
   private static async setupSelectedBuildPlatform() {
     OrchestratorLogger.log(`Orchestrator platform selected ${Orchestrator.buildParameters.providerStrategy}`);
 
-    // Check runner availability and apply fallback if needed
-    if (Orchestrator.buildParameters.runnerCheckEnabled && Orchestrator.buildParameters.fallbackProviderStrategy) {
-      const owner = OrchestratorOptions.githubOwner;
-      const repo = OrchestratorOptions.githubRepoName;
-      const token = Orchestrator.buildParameters.gitPrivateToken || process.env.GITHUB_TOKEN || '';
-
-      OrchestratorLogger.log(
-        `Checking runner availability (labels: [${Orchestrator.buildParameters.runnerCheckLabels.join(', ')}], min: ${
-          Orchestrator.buildParameters.runnerCheckMinAvailable
-        })`,
-      );
-
-      const result = await RunnerAvailabilityService.checkAvailability(
-        owner,
-        repo,
-        token,
-        Orchestrator.buildParameters.runnerCheckLabels,
-        Orchestrator.buildParameters.runnerCheckMinAvailable,
-      );
-
-      OrchestratorLogger.log(
-        `Runner check: ${result.totalRunners} total, ${result.matchingRunners} matching, ${result.idleRunners} idle — ${result.reason}`,
-      );
-
-      if (result.shouldFallback) {
-        const original = Orchestrator.buildParameters.providerStrategy;
-        const fallback = Orchestrator.buildParameters.fallbackProviderStrategy;
-        OrchestratorLogger.log(`Falling back from '${original}' to '${fallback}' — ${result.reason}`);
-        Orchestrator.buildParameters.providerStrategy = fallback;
-        core.setOutput('providerFallbackUsed', 'true');
-        core.setOutput('providerFallbackReason', result.reason);
-      } else {
-        core.setOutput('providerFallbackUsed', 'false');
-      }
-    }
-
     // Detect LocalStack endpoints and handle AWS provider appropriately
     // AWS_FORCE_PROVIDER options:
     //   - 'aws': Force AWS provider (requires LocalStack Pro with ECS support)
@@ -219,30 +182,6 @@ class Orchestrator {
     if (baseImage.includes(`undefined`)) {
       throw new Error(`baseImage is undefined`);
     }
-
-    try {
-      return await Orchestrator.runWithProvider(buildParameters, baseImage);
-    } catch (primaryError: any) {
-      // Retry on fallback provider if enabled and a fallback is configured
-      const fallback = buildParameters.fallbackProviderStrategy;
-      const alreadyOnFallback = buildParameters.providerStrategy === fallback;
-      if (buildParameters.retryOnFallback && fallback && !alreadyOnFallback) {
-        OrchestratorLogger.log(
-          `Primary provider '${buildParameters.providerStrategy}' failed: ${primaryError.message}`,
-        );
-        OrchestratorLogger.log(`Retrying build on fallback provider '${fallback}'...`);
-        buildParameters.providerStrategy = fallback;
-        core.setOutput('providerFallbackUsed', 'true');
-        core.setOutput('providerFallbackReason', `Primary provider failed: ${primaryError.message}`);
-
-        return await Orchestrator.runWithProvider(buildParameters, baseImage);
-      }
-
-      throw primaryError;
-    }
-  }
-
-  private static async runWithProvider(buildParameters: BuildParameters, baseImage: string) {
     await Orchestrator.setup(buildParameters);
 
     // When aws-local mode is enabled, validate AWS CloudFormation templates
@@ -250,10 +189,12 @@ class Orchestrator {
     if (Orchestrator.validateAwsTemplates) {
       await Orchestrator.validateAwsCloudFormationTemplates();
     }
-
-    // Setup workflow with optional init timeout
-    await Orchestrator.setupWorkflowWithTimeout();
-
+    await Orchestrator.Provider.setupWorkflow(
+      Orchestrator.buildParameters.buildGuid,
+      Orchestrator.buildParameters,
+      Orchestrator.buildParameters.branch,
+      Orchestrator.defaultSecrets,
+    );
     try {
       if (buildParameters.maxRetainedWorkspaces > 0) {
         Orchestrator.lockedWorkspace = SharedWorkspaceLocking.NewWorkspaceName();
@@ -334,39 +275,6 @@ class Orchestrator {
     }
   }
 
-  /**
-   * Runs setupWorkflow with an optional timeout. If providerInitTimeout is set and the
-   * provider takes longer than that to initialize, throws an error that triggers
-   * retry-on-fallback (if enabled).
-   */
-  private static async setupWorkflowWithTimeout() {
-    const timeoutSeconds = Orchestrator.buildParameters.providerInitTimeout;
-
-    const setupPromise = Orchestrator.Provider.setupWorkflow(
-      Orchestrator.buildParameters.buildGuid,
-      Orchestrator.buildParameters,
-      Orchestrator.buildParameters.branch,
-      Orchestrator.defaultSecrets,
-    );
-
-    if (timeoutSeconds <= 0) {
-      await setupPromise;
-
-      return;
-    }
-
-    OrchestratorLogger.log(`Provider init timeout: ${timeoutSeconds}s`);
-
-    const timeoutPromise = new Promise<never>((_, reject) => {
-      setTimeout(
-        () => reject(new Error(`Provider initialization timed out after ${timeoutSeconds}s`)),
-        timeoutSeconds * 1000,
-      );
-    });
-
-    await Promise.race([setupPromise, timeoutPromise]);
-  }
-
   private static async updateStatusWithBuildParameters() {
     const content = { ...Orchestrator.buildParameters };
     content.gitPrivateToken = ``;

src/model/orchestrator/services/core/runner-availability-service.test.ts

@@ -1,318 +0,0 @@
-import { RunnerAvailabilityService } from './runner-availability-service';
-
-// Mock @octokit/core
-jest.mock('@octokit/core', () => ({
-  Octokit: jest.fn().mockImplementation(() => ({
-    request: jest.fn(),
-  })),
-}));
-
-jest.mock('./orchestrator-logger', () => ({
-  __esModule: true,
-  default: {
-    log: jest.fn(),
-    logWarning: jest.fn(),
-    error: jest.fn(),
-  },
-}));
-
-import { Octokit } from '@octokit/core';
-
-const MockedOctokit = Octokit as jest.MockedClass<typeof Octokit>;
-
-function createMockRunners(runners: Array<{ name: string; status: string; busy: boolean; labels: string[] }>) {
-  return runners.map((r, i) => ({
-    id: i + 1,
-    name: r.name,
-    status: r.status,
-    busy: r.busy,
-    labels: r.labels.map((l) => ({ name: l })),
-  }));
-}
-
-describe('RunnerAvailabilityService', () => {
-  beforeEach(() => {
-    jest.clearAllMocks();
-  });
-
-  describe('checkAvailability', () => {
-    it('should skip check and not fallback when no token is provided', async () => {
-      const result = await RunnerAvailabilityService.checkAvailability('owner', 'repo', '', [], 1);
-      expect(result.shouldFallback).toBe(false);
-      expect(result.reason).toContain('No GitHub token');
-    });
-
-    it('should fallback when no runners are registered', async () => {
-      const mockRequest = jest.fn().mockResolvedValue({ status: 200, data: { runners: [] } });
-      MockedOctokit.mockImplementation(() => ({ request: mockRequest } as any));
-
-      const result = await RunnerAvailabilityService.checkAvailability('owner', 'repo', 'token', [], 1);
-      expect(result.shouldFallback).toBe(true);
-      expect(result.reason).toContain('No runners registered');
-      expect(result.totalRunners).toBe(0);
-    });
-
-    it('should not fallback when enough idle runners are available', async () => {
-      const runners = createMockRunners([
-        { name: 'runner-1', status: 'online', busy: false, labels: ['self-hosted', 'linux'] },
-        { name: 'runner-2', status: 'online', busy: false, labels: ['self-hosted', 'linux'] },
-      ]);
-      const mockRequest = jest.fn().mockResolvedValue({ status: 200, data: { runners } });
-      MockedOctokit.mockImplementation(() => ({ request: mockRequest } as any));
-
-      const result = await RunnerAvailabilityService.checkAvailability('owner', 'repo', 'token', [], 1);
-      expect(result.shouldFallback).toBe(false);
-      expect(result.idleRunners).toBe(2);
-      expect(result.totalRunners).toBe(2);
-    });
-
-    it('should fallback when all runners are busy', async () => {
-      const runners = createMockRunners([
-        { name: 'runner-1', status: 'online', busy: true, labels: ['self-hosted'] },
-        { name: 'runner-2', status: 'online', busy: true, labels: ['self-hosted'] },
-      ]);
-      const mockRequest = jest.fn().mockResolvedValue({ status: 200, data: { runners } });
-      MockedOctokit.mockImplementation(() => ({ request: mockRequest } as any));
-
-      const result = await RunnerAvailabilityService.checkAvailability('owner', 'repo', 'token', [], 1);
-      expect(result.shouldFallback).toBe(true);
-      expect(result.idleRunners).toBe(0);
-      expect(result.matchingRunners).toBe(2);
-    });
-
-    it('should fallback when all runners are offline', async () => {
-      const runners = createMockRunners([
-        { name: 'runner-1', status: 'offline', busy: false, labels: ['self-hosted'] },
-      ]);
-      const mockRequest = jest.fn().mockResolvedValue({ status: 200, data: { runners } });
-      MockedOctokit.mockImplementation(() => ({ request: mockRequest } as any));
-
-      const result = await RunnerAvailabilityService.checkAvailability('owner', 'repo', 'token', [], 1);
-      expect(result.shouldFallback).toBe(true);
-      expect(result.idleRunners).toBe(0);
-    });
-
-    it('should filter runners by required labels', async () => {
-      const runners = createMockRunners([
-        { name: 'linux-runner', status: 'online', busy: false, labels: ['self-hosted', 'linux'] },
-        { name: 'windows-runner', status: 'online', busy: false, labels: ['self-hosted', 'windows'] },
-      ]);
-      const mockRequest = jest.fn().mockResolvedValue({ status: 200, data: { runners } });
-      MockedOctokit.mockImplementation(() => ({ request: mockRequest } as any));
-
-      const result = await RunnerAvailabilityService.checkAvailability(
-        'owner',
-        'repo',
-        'token',
-        ['self-hosted', 'linux'],
-        1,
-      );
-
-      expect(result.shouldFallback).toBe(false);
-      expect(result.matchingRunners).toBe(1);
-      expect(result.idleRunners).toBe(1);
-      expect(result.totalRunners).toBe(2);
-    });
-
-    it('should fallback when no runners match required labels', async () => {
-      const runners = createMockRunners([
-        { name: 'windows-runner', status: 'online', busy: false, labels: ['self-hosted', 'windows'] },
-      ]);
-      const mockRequest = jest.fn().mockResolvedValue({ status: 200, data: { runners } });
-      MockedOctokit.mockImplementation(() => ({ request: mockRequest } as any));
-
-      const result = await RunnerAvailabilityService.checkAvailability(
-        'owner',
-        'repo',
-        'token',
-        ['self-hosted', 'linux'],
-        1,
-      );
-
-      expect(result.shouldFallback).toBe(true);
-      expect(result.matchingRunners).toBe(0);
-      expect(result.idleRunners).toBe(0);
-    });
-
-    it('should respect minAvailable threshold', async () => {
-      const runners = createMockRunners([{ name: 'runner-1', status: 'online', busy: false, labels: ['self-hosted'] }]);
-      const mockRequest = jest.fn().mockResolvedValue({ status: 200, data: { runners } });
-      MockedOctokit.mockImplementation(() => ({ request: mockRequest } as any));
-
-      // Need 2, have 1 — should fallback
-      const result = await RunnerAvailabilityService.checkAvailability('owner', 'repo', 'token', [], 2);
-      expect(result.shouldFallback).toBe(true);
-      expect(result.idleRunners).toBe(1);
-    });
-
-    it('should be case-insensitive for label matching', async () => {
-      const runners = createMockRunners([
-        { name: 'runner-1', status: 'online', busy: false, labels: ['Self-Hosted', 'Linux'] },
-      ]);
-      const mockRequest = jest.fn().mockResolvedValue({ status: 200, data: { runners } });
-      MockedOctokit.mockImplementation(() => ({ request: mockRequest } as any));
-
-      const result = await RunnerAvailabilityService.checkAvailability(
-        'owner',
-        'repo',
-        'token',
-        ['self-hosted', 'linux'],
-        1,
-      );
-      expect(result.shouldFallback).toBe(false);
-      expect(result.matchingRunners).toBe(1);
-    });
-
-    it('should not fallback on API error (fail-open)', async () => {
-      const mockRequest = jest.fn().mockRejectedValue(new Error('403 Forbidden'));
-      MockedOctokit.mockImplementation(() => ({ request: mockRequest } as any));
-
-      const result = await RunnerAvailabilityService.checkAvailability('owner', 'repo', 'token', [], 1);
-      expect(result.shouldFallback).toBe(false);
-      expect(result.reason).toContain('Runner check failed');
-    });
-
-    it('should count only online+idle runners', async () => {
-      const runners = createMockRunners([
-        { name: 'idle', status: 'online', busy: false, labels: ['self-hosted'] },
-        { name: 'busy', status: 'online', busy: true, labels: ['self-hosted'] },
-        { name: 'offline', status: 'offline', busy: false, labels: ['self-hosted'] },
-      ]);
-      const mockRequest = jest.fn().mockResolvedValue({ status: 200, data: { runners } });
-      MockedOctokit.mockImplementation(() => ({ request: mockRequest } as any));
-
-      const result = await RunnerAvailabilityService.checkAvailability('owner', 'repo', 'token', [], 1);
-      expect(result.shouldFallback).toBe(false);
-      expect(result.totalRunners).toBe(3);
-      expect(result.matchingRunners).toBe(3);
-      expect(result.idleRunners).toBe(1);
-    });
-  });
-
-  describe('pagination limits', () => {
-    it('should stop paginating after reaching the page limit', async () => {
-      // Return full pages (100 runners each) to force continued pagination
-      let callCount = 0;
-      const mockRequest = jest.fn().mockImplementation(() => {
-        callCount++;
-        const runners = createMockRunners(
-          Array.from({ length: 100 }, (_, i) => ({
-            name: `runner-${callCount}-${i}`,
-            status: 'online' as const,
-            busy: false,
-            labels: ['self-hosted'],
-          })),
-        );
-
-        return Promise.resolve({ status: 200, data: { runners } });
-      });
-      MockedOctokit.mockImplementation(() => ({ request: mockRequest } as any));
-
-      const result = await RunnerAvailabilityService.checkAvailability('owner', 'repo', 'token', [], 1);
-
-      // Should have called at most 100 pages (the MAX_PAGINATION_PAGES limit)
-      expect(mockRequest).toHaveBeenCalledTimes(100);
-      // Should still have runners from the pages it did fetch
-      expect(result.totalRunners).toBe(10000);
-      expect(result.shouldFallback).toBe(false);
-    });
-
-    it('should stop paginating on rate limit (HTTP 403)', async () => {
-      let callCount = 0;
-      const mockRequest = jest.fn().mockImplementation(() => {
-        callCount++;
-        if (callCount === 2) {
-          // Octokit throws for non-2xx responses
-          const error: any = new Error('API rate limit exceeded');
-          error.status = 403;
-          error.response = {
-            status: 403,
-            headers: { 'x-ratelimit-reset': String(Math.floor(Date.now() / 1000) + 3600) },
-          };
-
-          return Promise.reject(error);
-        }
-        const runners = createMockRunners(
-          Array.from({ length: 100 }, (_, i) => ({
-            name: `runner-${i}`,
-            status: 'online' as const,
-            busy: false,
-            labels: ['self-hosted'],
-          })),
-        );
-
-        return Promise.resolve({ status: 200, data: { runners } });
-      });
-      MockedOctokit.mockImplementation(() => ({ request: mockRequest } as any));
-
-      const result = await RunnerAvailabilityService.checkAvailability('owner', 'repo', 'token', [], 1);
-
-      // Should have stopped at page 2 (rate limited)
-      expect(mockRequest).toHaveBeenCalledTimes(2);
-      // Should use the 100 runners from the first page
-      expect(result.totalRunners).toBe(100);
-      expect(result.shouldFallback).toBe(false);
-    });
-
-    it('should stop paginating on rate limit (HTTP 429)', async () => {
-      let callCount = 0;
-      const mockRequest = jest.fn().mockImplementation(() => {
-        callCount++;
-        if (callCount === 1) {
-          // Octokit throws for non-2xx responses
-          const error: any = new Error('Too Many Requests');
-          error.status = 429;
-          error.response = { status: 429, headers: {} };
-
-          return Promise.reject(error);
-        }
-
-        return Promise.resolve({ status: 200, data: { runners: [] } });
-      });
-      MockedOctokit.mockImplementation(() => ({ request: mockRequest } as any));
-
-      const result = await RunnerAvailabilityService.checkAvailability('owner', 'repo', 'token', [], 1);
-
-      // Should have stopped at first page (rate limited immediately)
-      expect(mockRequest).toHaveBeenCalledTimes(1);
-      // No runners found — should fallback
-      expect(result.totalRunners).toBe(0);
-      expect(result.shouldFallback).toBe(true);
-    });
-
-    it('should handle pagination timeout gracefully', async () => {
-      // Mock Date.now to simulate timeout
-      const originalDateNow = Date.now;
-      let callCount = 0;
-
-      const mockRequest = jest.fn().mockImplementation(() => {
-        callCount++;
-        // After first call, advance time past the timeout
-        if (callCount >= 2) {
-          Date.now = jest.fn(() => originalDateNow() + 31_000);
-        }
-        const runners = createMockRunners(
-          Array.from({ length: 100 }, (_, i) => ({
-            name: `runner-${callCount}-${i}`,
-            status: 'online' as const,
-            busy: false,
-            labels: ['self-hosted'],
-          })),
-        );
-
-        return Promise.resolve({ status: 200, data: { runners } });
-      });
-      MockedOctokit.mockImplementation(() => ({ request: mockRequest } as any));
-
-      const result = await RunnerAvailabilityService.checkAvailability('owner', 'repo', 'token', [], 1);
-
-      // Should have stopped after timeout was detected (2 pages: first succeeds, second triggers timeout check)
-      expect(mockRequest.mock.calls.length).toBeLessThanOrEqual(3);
-      // Should have runners from pages fetched before timeout
-      expect(result.totalRunners).toBeGreaterThan(0);
-
-      // Restore
-      Date.now = originalDateNow;
-    });
-  });
-});

src/model/orchestrator/services/core/runner-availability-service.ts

@@ -1,205 +0,0 @@
-import { Octokit } from '@octokit/core';
-import OrchestratorLogger from './orchestrator-logger';
-
-interface GitHubRunner {
-  id: number;
-  name: string;
-  status: 'online' | 'offline';
-  busy: boolean;
-  labels: Array<{ name: string }>;
-}
-
-interface RunnerCheckResult {
-  shouldFallback: boolean;
-  reason: string;
-  totalRunners: number;
-  matchingRunners: number;
-  idleRunners: number;
-}
-
-/**
- * Maximum number of pages to fetch when paginating through GitHub API results.
- * 100 pages * 100 per page = 10,000 runners maximum.
- */
-const MAX_PAGINATION_PAGES = 100;
-
-/**
- * Total timeout in milliseconds for the pagination loop.
- * Prevents indefinite API calls if GitHub is slow or pagination is unexpectedly deep.
- */
-const PAGINATION_TIMEOUT_MS = 30_000;
-
-/**
- * Checks GitHub Actions runner availability to support automatic provider fallback.
- *
- * When a user configures `runnerCheckEnabled: true` with a `fallbackProviderStrategy`,
- * this service queries the GitHub API for runner status before the build starts.
- * If insufficient runners are available, the orchestrator routes to the fallback provider.
- */
-export class RunnerAvailabilityService {
-  /**
-   * Check if enough runners are available to handle the build.
-   *
-   * @param owner - GitHub repository owner
-   * @param repo - GitHub repository name
-   * @param token - GitHub token with repo/actions scope
-   * @param requiredLabels - Labels runners must have (empty = any runner)
-   * @param minAvailable - Minimum idle runners required
-   * @returns RunnerCheckResult with decision and diagnostics
-   */
-  static async checkAvailability(
-    owner: string,
-    repo: string,
-    token: string,
-    requiredLabels: string[],
-    minAvailable: number,
-  ): Promise<RunnerCheckResult> {
-    if (!token) {
-      return {
-        shouldFallback: false,
-        reason: 'No GitHub token available — skipping runner check',
-        totalRunners: 0,
-        matchingRunners: 0,
-        idleRunners: 0,
-      };
-    }
-
-    try {
-      const octokit = new Octokit({ auth: token });
-
-      // Fetch all runners for the repository
-      const runners = await RunnerAvailabilityService.fetchRunners(octokit, owner, repo);
-
-      if (runners.length === 0) {
-        return {
-          shouldFallback: true,
-          reason: 'No runners registered for this repository',
-          totalRunners: 0,
-          matchingRunners: 0,
-          idleRunners: 0,
-        };
-      }
-
-      // Filter by required labels
-      const matching = RunnerAvailabilityService.filterByLabels(runners, requiredLabels);
-
-      // Count idle (online + not busy)
-      const idle = matching.filter((r) => r.status === 'online' && !r.busy);
-
-      const result: RunnerCheckResult = {
-        shouldFallback: idle.length < minAvailable,
-        reason:
-          idle.length >= minAvailable
-            ? `${idle.length} idle runner(s) available (need ${minAvailable})`
-            : `Only ${idle.length} idle runner(s) available, need ${minAvailable}`,
-        totalRunners: runners.length,
-        matchingRunners: matching.length,
-        idleRunners: idle.length,
-      };
-
-      return result;
-    } catch (error: any) {
-      // If the API call fails (permissions, rate limit, etc.), don't block the build
-      OrchestratorLogger.log(`Runner availability check failed: ${error.message}`);
-
-      return {
-        shouldFallback: false,
-        reason: `Runner check failed (${error.message}) — proceeding with primary provider`,
-        totalRunners: 0,
-        matchingRunners: 0,
-        idleRunners: 0,
-      };
-    }
-  }
-
-  /**
-   * Fetch all runners for a repository, handling pagination.
-   *
-   * Includes defensive limits:
-   * - Maximum page count (MAX_PAGINATION_PAGES) to prevent infinite loops
-   * - Total timeout (PAGINATION_TIMEOUT_MS) to prevent indefinite API calls
-   * - Rate-limit detection (HTTP 403/429 with X-RateLimit-Remaining header)
-   */
-  private static async fetchRunners(octokit: Octokit, owner: string, repo: string): Promise<GitHubRunner[]> {
-    const allRunners: GitHubRunner[] = [];
-    let page = 1;
-    const perPage = 100;
-    const startTime = Date.now();
-
-    while (page <= MAX_PAGINATION_PAGES) {
-      // Check total timeout
-      if (Date.now() - startTime > PAGINATION_TIMEOUT_MS) {
-        OrchestratorLogger.logWarning(
-          `[RunnerAvailability] Pagination timeout reached after ${page - 1} pages and ${Date.now() - startTime}ms. ` +
-            `Using ${allRunners.length} runners found so far.`,
-        );
-        break;
-      }
-
-      let response: any;
-      try {
-        response = await octokit.request('GET /repos/{owner}/{repo}/actions/runners', {
-          owner,
-          repo,
-          per_page: perPage,
-          page,
-        });
-      } catch (requestError: any) {
-        // Octokit throws for non-2xx responses. Check if this is a rate limit error.
-        const status = requestError.status ?? requestError.response?.status;
-        if (status === 403 || status === 429) {
-          const resetTime =
-            requestError.response?.headers?.['x-ratelimit-reset'] ?? requestError.headers?.['x-ratelimit-reset'];
-          const resetMessage = resetTime
-            ? ` Resets at ${new Date(Number.parseInt(String(resetTime), 10) * 1000).toISOString()}`
-            : '';
-          OrchestratorLogger.logWarning(
-            `[RunnerAvailability] GitHub API rate limit reached (HTTP ${status}).${resetMessage} ` +
-              `Using ${allRunners.length} runners found so far.`,
-          );
-          break;
-        }
-        // Re-throw non-rate-limit errors to be handled by the outer catch
-        throw requestError;
-      }
-
-      const runners = (response.data.runners || []) as GitHubRunner[];
-      allRunners.push(...runners);
-
-      if (runners.length < perPage) break;
-      page++;
-    }
-
-    if (page > MAX_PAGINATION_PAGES) {
-      OrchestratorLogger.logWarning(
-        `[RunnerAvailability] Maximum pagination limit reached (${MAX_PAGINATION_PAGES} pages). ` +
-          `Using ${allRunners.length} runners found so far.`,
-      );
-    }
-
-    if (allRunners.length === 0) {
-      OrchestratorLogger.log(
-        '[RunnerAvailability] No runners found. Possible causes: ' +
-          'wrong token permissions (needs repo or actions scope), ' +
-          'no self-hosted runners registered, ' +
-          'or runners are registered at the organization level instead of the repository.',
-      );
-    }
-
-    return allRunners;
-  }
-
-  /**
-   * Filter runners by required labels. A runner matches if it has ALL required labels.
-   * If requiredLabels is empty, all runners match.
-   */
-  private static filterByLabels(runners: GitHubRunner[], requiredLabels: string[]): GitHubRunner[] {
-    if (requiredLabels.length === 0) return runners;
-
-    return runners.filter((runner) => {
-      const runnerLabelNames = runner.labels.map((l) => l.name.toLowerCase());
-
-      return requiredLabels.every((required) => runnerLabelNames.includes(required.toLowerCase()));
-    });
-  }
-}

src/model/orchestrator/services/secrets/secret-source-service.test.ts

@@ -0,0 +1,446 @@
+import fs from 'node:fs';
+import * as core from '@actions/core';
+import { SecretSourceService, validateSecretKey } from './secret-source-service';
+
+jest.mock('node:fs');
+jest.mock('@actions/core', () => ({
+  setSecret: jest.fn(),
+  info: jest.fn(),
+  warning: jest.fn(),
+  error: jest.fn(),
+}));
+jest.mock('../core/orchestrator-system', () => ({
+  OrchestratorSystem: {
+    Run: jest.fn().mockResolvedValue(''),
+  },
+}));
+jest.mock('../core/orchestrator-logger', () => ({
+  __esModule: true,
+  default: {
+    log: jest.fn(),
+    logWarning: jest.fn(),
+    error: jest.fn(),
+  },
+}));
+
+const mockFs = fs as jest.Mocked<typeof fs>;
+
+describe('SecretSourceService', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  describe('validateSecretKey', () => {
+    it('should accept alphanumeric keys', () => {
+      expect(validateSecretKey('MY_SECRET_KEY')).toBe('MY_SECRET_KEY');
+    });
+
+    it('should accept keys with hyphens', () => {
+      expect(validateSecretKey('my-secret-key')).toBe('my-secret-key');
+    });
+
+    it('should accept keys with dots', () => {
+      expect(validateSecretKey('my.secret.key')).toBe('my.secret.key');
+    });
+
+    it('should accept keys with forward slashes', () => {
+      expect(validateSecretKey('path/to/secret')).toBe('path/to/secret');
+    });
+
+    it('should accept keys with mixed valid characters', () => {
+      expect(validateSecretKey('my-app/prod_db.password')).toBe('my-app/prod_db.password');
+    });
+
+    it('should reject keys with semicolons (shell injection)', () => {
+      expect(() => validateSecretKey('; rm -rf /')).toThrow('Invalid secret key name');
+    });
+
+    it('should reject keys with backticks (command substitution)', () => {
+      expect(() => validateSecretKey('`whoami`')).toThrow('Invalid secret key name');
+    });
+
+    it('should reject keys with dollar signs (variable expansion)', () => {
+      expect(() => validateSecretKey('$HOME')).toThrow('Invalid secret key name');
+    });
+
+    it('should reject keys with pipe characters', () => {
+      expect(() => validateSecretKey('key | cat /etc/passwd')).toThrow('Invalid secret key name');
+    });
+
+    it('should reject keys with ampersands', () => {
+      expect(() => validateSecretKey('key && echo pwned')).toThrow('Invalid secret key name');
+    });
+
+    it('should reject keys with newlines', () => {
+      expect(() => validateSecretKey('key\nmalicious')).toThrow('Invalid secret key name');
+    });
+
+    it('should reject keys with quotes', () => {
+      expect(() => validateSecretKey('"key"')).toThrow('Invalid secret key name');
+      expect(() => validateSecretKey("'key'")).toThrow('Invalid secret key name');
+    });
+
+    it('should reject keys with parentheses (subshell)', () => {
+      expect(() => validateSecretKey('$(whoami)')).toThrow('Invalid secret key name');
+    });
+
+    it('should reject empty keys', () => {
+      expect(() => validateSecretKey('')).toThrow('Invalid secret key name');
+    });
+
+    it('should reject keys with spaces', () => {
+      expect(() => validateSecretKey('key with spaces')).toThrow('Invalid secret key name');
+    });
+  });
+
+  describe('isPremadeSource', () => {
+    it('should return true for aws-secrets-manager', () => {
+      expect(SecretSourceService.isPremadeSource('aws-secrets-manager')).toBe(true);
+    });
+
+    it('should return true for aws-secret-manager (legacy alias)', () => {
+      expect(SecretSourceService.isPremadeSource('aws-secret-manager')).toBe(true);
+    });
+
+    it('should return true for aws-parameter-store', () => {
+      expect(SecretSourceService.isPremadeSource('aws-parameter-store')).toBe(true);
+    });
+
+    it('should return true for gcp-secret-manager', () => {
+      expect(SecretSourceService.isPremadeSource('gcp-secret-manager')).toBe(true);
+    });
+
+    it('should return true for azure-key-vault', () => {
+      expect(SecretSourceService.isPremadeSource('azure-key-vault')).toBe(true);
+    });
+
+    it('should return true for hashicorp-vault', () => {
+      expect(SecretSourceService.isPremadeSource('hashicorp-vault')).toBe(true);
+    });
+
+    it('should return true for hashicorp-vault-kv1', () => {
+      expect(SecretSourceService.isPremadeSource('hashicorp-vault-kv1')).toBe(true);
+    });
+
+    it('should return true for vault (short alias)', () => {
+      expect(SecretSourceService.isPremadeSource('vault')).toBe(true);
+    });
+
+    it('should return false for unknown source', () => {
+      expect(SecretSourceService.isPremadeSource('unknown-source')).toBe(false);
+    });
+  });
+
+  describe('getAvailableSources', () => {
+    it('should return all premade source names', () => {
+      const sources = SecretSourceService.getAvailableSources();
+      expect(sources).toContain('aws-secrets-manager');
+      expect(sources).toContain('aws-parameter-store');
+      expect(sources).toContain('gcp-secret-manager');
+      expect(sources).toContain('azure-key-vault');
+      expect(sources).toContain('hashicorp-vault');
+      expect(sources).toContain('hashicorp-vault-kv1');
+      expect(sources).toContain('vault');
+      expect(sources.length).toBeGreaterThanOrEqual(8);
+    });
+  });
+
+  describe('resolveSource', () => {
+    it('should resolve premade source by name', () => {
+      const source = SecretSourceService.resolveSource('aws-secrets-manager');
+      expect(source).toBeDefined();
+      expect(source!.name).toBe('aws-secrets-manager');
+      expect(source!.command).toContain('secretsmanager');
+    });
+
+    it('should resolve custom command with {0} placeholder', () => {
+      const source = SecretSourceService.resolveSource('vault kv get -field=value secret/{0}');
+      expect(source).toBeDefined();
+      expect(source!.name).toBe('custom-command');
+      expect(source!.command).toContain('{0}');
+    });
+
+    it('should resolve command with spaces as custom command', () => {
+      const source = SecretSourceService.resolveSource('my-tool get-secret');
+      expect(source).toBeDefined();
+      expect(source!.name).toBe('custom-command');
+    });
+
+    it('should return undefined for unknown single-word source', () => {
+      const source = SecretSourceService.resolveSource('unknown');
+      expect(source).toBeUndefined();
+    });
+  });
+
+  describe('fetchSecret', () => {
+    it('should run the command with {0} replaced by key', async () => {
+      const { OrchestratorSystem } = require('../core/orchestrator-system');
+      OrchestratorSystem.Run.mockResolvedValue('my-secret-value');
+
+      const source = SecretSourceService.resolveSource('aws-secrets-manager')!;
+      const result = await SecretSourceService.fetchSecret(source, 'MY_SECRET');
+
+      expect(result).toBe('my-secret-value');
+      expect(OrchestratorSystem.Run).toHaveBeenCalledWith(expect.stringContaining('MY_SECRET'), false, true);
+    });
+
+    it('should parse JSON output when parseOutput is json-field', async () => {
+      const { OrchestratorSystem } = require('../core/orchestrator-system');
+      OrchestratorSystem.Run.mockResolvedValue(JSON.stringify({ value: 'extracted-secret' }));
+
+      const source = {
+        name: 'test-source',
+        command: 'fetch {0}',
+        parseOutput: 'json-field' as const,
+        jsonField: 'value',
+      };
+      const result = await SecretSourceService.fetchSecret(source, 'KEY');
+
+      expect(result).toBe('extracted-secret');
+    });
+
+    it('should fall back to raw output on invalid JSON with json-field mode', async () => {
+      const { OrchestratorSystem } = require('../core/orchestrator-system');
+      OrchestratorSystem.Run.mockResolvedValue('not-json');
+
+      const source = {
+        name: 'test-source',
+        command: 'fetch {0}',
+        parseOutput: 'json-field' as const,
+        jsonField: 'value',
+      };
+      const result = await SecretSourceService.fetchSecret(source, 'KEY');
+
+      expect(result).toBe('not-json');
+    });
+
+    it('should return empty string on command failure', async () => {
+      const { OrchestratorSystem } = require('../core/orchestrator-system');
+      OrchestratorSystem.Run.mockRejectedValue(new Error('command not found'));
+
+      const source = SecretSourceService.resolveSource('aws-secrets-manager')!;
+      const result = await SecretSourceService.fetchSecret(source, 'KEY');
+
+      expect(result).toBe('');
+    });
+
+    it('should reject keys with shell injection characters', async () => {
+      const source = SecretSourceService.resolveSource('aws-secrets-manager')!;
+
+      await expect(SecretSourceService.fetchSecret(source, '; rm -rf /')).rejects.toThrow('Invalid secret key name');
+    });
+
+    it('should reject keys with command substitution', async () => {
+      const source = SecretSourceService.resolveSource('aws-secrets-manager')!;
+
+      await expect(SecretSourceService.fetchSecret(source, '$(whoami)')).rejects.toThrow('Invalid secret key name');
+    });
+
+    it('should reject keys with backtick command substitution', async () => {
+      const source = SecretSourceService.resolveSource('aws-secrets-manager')!;
+
+      await expect(SecretSourceService.fetchSecret(source, '`cat /etc/passwd`')).rejects.toThrow(
+        'Invalid secret key name',
+      );
+    });
+
+    it('should accept keys with valid path-like patterns', async () => {
+      const { OrchestratorSystem } = require('../core/orchestrator-system');
+      OrchestratorSystem.Run.mockResolvedValue('secret-value');
+
+      const source = SecretSourceService.resolveSource('aws-secrets-manager')!;
+      const result = await SecretSourceService.fetchSecret(source, 'prod/database/password');
+
+      expect(result).toBe('secret-value');
+    });
+
+    it('should mask fetched secret values with core.setSecret', async () => {
+      const { OrchestratorSystem } = require('../core/orchestrator-system');
+      OrchestratorSystem.Run.mockResolvedValue('super-secret-value');
+
+      const source = SecretSourceService.resolveSource('aws-secrets-manager')!;
+      await SecretSourceService.fetchSecret(source, 'MY_SECRET');
+
+      expect(core.setSecret).toHaveBeenCalledWith('super-secret-value');
+    });
+
+    it('should not mask empty secret values', async () => {
+      const { OrchestratorSystem } = require('../core/orchestrator-system');
+      OrchestratorSystem.Run.mockResolvedValue('');
+
+      const source = SecretSourceService.resolveSource('aws-secrets-manager')!;
+      await SecretSourceService.fetchSecret(source, 'MY_SECRET');
+
+      expect(core.setSecret).not.toHaveBeenCalled();
+    });
+
+    it('should mask JSON-extracted secret values', async () => {
+      const { OrchestratorSystem } = require('../core/orchestrator-system');
+      OrchestratorSystem.Run.mockResolvedValue(JSON.stringify({ value: 'json-secret' }));
+
+      const source = {
+        name: 'test-source',
+        command: 'fetch {0}',
+        parseOutput: 'json-field' as const,
+        jsonField: 'value',
+      };
+      await SecretSourceService.fetchSecret(source, 'KEY');
+
+      expect(core.setSecret).toHaveBeenCalledWith('json-secret');
+    });
+  });
+
+  describe('fetchFromEnv', () => {
+    it('should return env var value when set', () => {
+      process.env.TEST_SECRET_KEY = 'env-value';
+      const result = SecretSourceService.fetchFromEnv('TEST_SECRET_KEY');
+      expect(result).toBe('env-value');
+      delete process.env.TEST_SECRET_KEY;
+    });
+
+    it('should return empty string when env var is not set', () => {
+      const result = SecretSourceService.fetchFromEnv('NONEXISTENT_KEY_12345');
+      expect(result).toBe('');
+    });
+
+    it('should mask env var values with core.setSecret', () => {
+      process.env.TEST_MASK_KEY = 'masked-env-value';
+      SecretSourceService.fetchFromEnv('TEST_MASK_KEY');
+      expect(core.setSecret).toHaveBeenCalledWith('masked-env-value');
+      delete process.env.TEST_MASK_KEY;
+    });
+
+    it('should not mask empty env var values', () => {
+      const result = SecretSourceService.fetchFromEnv('NONEXISTENT_KEY_99999');
+      expect(result).toBe('');
+      expect(core.setSecret).not.toHaveBeenCalled();
+    });
+  });
+
+  describe('fetchAll', () => {
+    it('should fetch all keys from env source', async () => {
+      process.env.KEY_A = 'val-a';
+      process.env.KEY_B = 'val-b';
+
+      const results = await SecretSourceService.fetchAll('env', ['KEY_A', 'KEY_B']);
+
+      expect(results.KEY_A).toBe('val-a');
+      expect(results.KEY_B).toBe('val-b');
+
+      delete process.env.KEY_A;
+      delete process.env.KEY_B;
+    });
+
+    it('should fetch all keys from premade source', async () => {
+      const { OrchestratorSystem } = require('../core/orchestrator-system');
+      OrchestratorSystem.Run.mockResolvedValueOnce('secret-1').mockResolvedValueOnce('secret-2');
+
+      const results = await SecretSourceService.fetchAll('aws-parameter-store', ['param1', 'param2']);
+
+      expect(results.param1).toBe('secret-1');
+      expect(results.param2).toBe('secret-2');
+      expect(OrchestratorSystem.Run).toHaveBeenCalledTimes(2);
+    });
+
+    it('should return empty results for unknown source', async () => {
+      const results = await SecretSourceService.fetchAll('unknown', ['key1']);
+      expect(results).toEqual({});
+    });
+  });
+
+  describe('loadFromYaml', () => {
+    it('should return empty array when file does not exist', () => {
+      (mockFs.existsSync as jest.Mock).mockReturnValue(false);
+      const result = SecretSourceService.loadFromYaml('/nonexistent.yml');
+      expect(result).toEqual([]);
+    });
+
+    it('should parse valid YAML source definitions', () => {
+      (mockFs.existsSync as jest.Mock).mockReturnValue(true);
+      (mockFs.readFileSync as jest.Mock).mockReturnValue(`
+sources:
+  - name: my-vault
+    command: 'vault kv get -field=value secret/{0}'
+  - name: my-api
+    command: 'curl -s https://api.example.com/{0}'
+    parseOutput: json-field
+    jsonField: secret_value
+`);
+
+      const result = SecretSourceService.loadFromYaml('/sources.yml');
+
+      expect(result).toHaveLength(2);
+      expect(result[0].name).toBe('my-vault');
+      expect(result[0].command).toBe('vault kv get -field=value secret/{0}');
+      expect(result[1].name).toBe('my-api');
+      expect(result[1].parseOutput).toBe('json-field');
+      expect(result[1].jsonField).toBe('secret_value');
+    });
+
+    it('should handle YAML with single source', () => {
+      (mockFs.existsSync as jest.Mock).mockReturnValue(true);
+      (mockFs.readFileSync as jest.Mock).mockReturnValue(`
+sources:
+  - name: simple
+    command: echo {0}
+`);
+
+      const result = SecretSourceService.loadFromYaml('/simple.yml');
+      expect(result).toHaveLength(1);
+      expect(result[0].name).toBe('simple');
+    });
+
+    it('should return empty array on parse error', () => {
+      (mockFs.existsSync as jest.Mock).mockReturnValue(true);
+      (mockFs.readFileSync as jest.Mock).mockImplementation(() => {
+        throw new Error('Permission denied');
+      });
+
+      const result = SecretSourceService.loadFromYaml('/error.yml');
+      expect(result).toEqual([]);
+    });
+  });
+
+  describe('premade source commands', () => {
+    it('aws-secrets-manager uses --query SecretString', () => {
+      const source = SecretSourceService.resolveSource('aws-secrets-manager')!;
+      expect(source.command).toContain('--query SecretString');
+      expect(source.command).toContain('--output text');
+    });
+
+    it('aws-parameter-store uses --with-decryption', () => {
+      const source = SecretSourceService.resolveSource('aws-parameter-store')!;
+      expect(source.command).toContain('--with-decryption');
+      expect(source.command).toContain('--query Parameter.Value');
+    });
+
+    it('gcp-secret-manager uses latest version', () => {
+      const source = SecretSourceService.resolveSource('gcp-secret-manager')!;
+      expect(source.command).toContain('latest');
+    });
+
+    it('azure-key-vault uses AZURE_VAULT_NAME env var', () => {
+      const source = SecretSourceService.resolveSource('azure-key-vault')!;
+      expect(source.command).toContain('$AZURE_VAULT_NAME');
+    });
+
+    it('hashicorp-vault uses vault kv get with VAULT_MOUNT', () => {
+      const source = SecretSourceService.resolveSource('hashicorp-vault')!;
+      expect(source.command).toContain('vault kv get');
+      expect(source.command).toContain('VAULT_MOUNT');
+      expect(source.command).toContain('-field=value');
+    });
+
+    it('hashicorp-vault-kv1 uses vault read for KV v1', () => {
+      const source = SecretSourceService.resolveSource('hashicorp-vault-kv1')!;
+      expect(source.command).toContain('vault read');
+      expect(source.command).toContain('-field=value');
+    });
+
+    it('vault alias resolves to same command as hashicorp-vault', () => {
+      const vault = SecretSourceService.resolveSource('vault')!;
+      const hashicorpVault = SecretSourceService.resolveSource('hashicorp-vault')!;
+      expect(vault.command).toBe(hashicorpVault.command);
+    });
+  });
+});

src/model/orchestrator/services/secrets/secret-source-service.ts

@@ -0,0 +1,337 @@
+import fs from 'node:fs';
+import * as core from '@actions/core';
+import OrchestratorLogger from '../core/orchestrator-logger';
+import { OrchestratorSystem } from '../core/orchestrator-system';
+
+/**
+ * A secret source definition: how to fetch a secret value by key.
+ */
+export interface SecretSourceDefinition {
+  name: string;
+  command: string;
+  parseOutput?: 'raw' | 'json-field';
+  jsonField?: string;
+}
+
+/**
+ * Validate that a secret key name contains only safe characters.
+ * Prevents shell injection when keys are interpolated into commands.
+ *
+ * Allowed characters: alphanumeric, hyphens, underscores, dots, forward slashes.
+ *
+ * @param key - The secret key name to validate
+ * @returns The validated key (unchanged)
+ * @throws Error if the key contains disallowed characters
+ */
+export function validateSecretKey(key: string): string {
+  if (!/^[a-zA-Z0-9\-_./]+$/.test(key)) {
+    throw new Error(
+      `Invalid secret key name: "${key}". Keys may only contain alphanumeric characters, hyphens, underscores, dots, and forward slashes.`,
+    );
+  }
+
+  return key;
+}
+
+/**
+ * Mask a secret value so it does not appear in GitHub Actions logs.
+ * Empty or whitespace-only values are skipped (core.setSecret would be a no-op).
+ */
+function maskSecretValue(value: string): void {
+  if (value.trim().length > 0) {
+    core.setSecret(value);
+  }
+}
+
+/**
+ * Premade secret sources and custom YAML-based secret source definitions.
+ *
+ * Premade sources are string shortcuts that expand to shell commands:
+ *   - `aws-secrets-manager` -- AWS Secrets Manager
+ *   - `aws-parameter-store` -- AWS Systems Manager Parameter Store
+ *   - `gcp-secret-manager` -- Google Cloud Secret Manager
+ *   - `azure-key-vault` -- Azure Key Vault (requires AZURE_VAULT_NAME env var)
+ *   - `hashicorp-vault` -- HashiCorp Vault KV v2 (requires VAULT_ADDR, optionally VAULT_MOUNT)
+ *   - `hashicorp-vault-kv1` -- HashiCorp Vault KV v1 (requires VAULT_ADDR, optionally VAULT_MOUNT)
+ *   - `env` -- Read from environment variables (no shell command needed)
+ *
+ * Custom YAML format:
+ *   sources:
+ *     - name: my-vault
+ *       command: 'vault kv get -field=value secret/{0}'
+ *     - name: my-api
+ *       command: 'curl -s https://secrets.example.com/api/{0}'
+ *       parseOutput: json-field
+ *       jsonField: value
+ */
+export class SecretSourceService {
+  private static readonly premadeSources: Record<string, SecretSourceDefinition> = {
+    'aws-secrets-manager': {
+      name: 'aws-secrets-manager',
+      command: 'aws secretsmanager get-secret-value --secret-id {0} --query SecretString --output text',
+      parseOutput: 'raw',
+    },
+    'aws-secret-manager': {
+      // Alias for backward compatibility (original name in inputPullCommand)
+      name: 'aws-secret-manager',
+      command: 'aws secretsmanager get-secret-value --secret-id {0} --query SecretString --output text',
+      parseOutput: 'raw',
+    },
+    'aws-parameter-store': {
+      name: 'aws-parameter-store',
+      command: 'aws ssm get-parameter --name {0} --with-decryption --query Parameter.Value --output text',
+      parseOutput: 'raw',
+    },
+    'gcp-secret-manager': {
+      name: 'gcp-secret-manager',
+      command: 'gcloud secrets versions access latest --secret="{0}"',
+      parseOutput: 'raw',
+    },
+    'azure-key-vault': {
+      name: 'azure-key-vault',
+      command: 'az keyvault secret show --vault-name "$AZURE_VAULT_NAME" --name {0} --query value --output tsv',
+      parseOutput: 'raw',
+    },
+    'hashicorp-vault': {
+      // HashiCorp Vault KV v2 (default). Requires VAULT_ADDR env var.
+      // Optionally set VAULT_MOUNT to override the mount path (default: 'secret').
+      // Authentication is handled by VAULT_TOKEN or other Vault auth env vars.
+      name: 'hashicorp-vault',
+      command: 'vault kv get -mount="${VAULT_MOUNT:-secret}" -field=value {0}',
+      parseOutput: 'raw',
+    },
+    'hashicorp-vault-kv1': {
+      // HashiCorp Vault KV v1. Requires VAULT_ADDR env var.
+      // Optionally set VAULT_MOUNT to override the mount path (default: 'secret').
+      name: 'hashicorp-vault-kv1',
+      command: 'vault read -mount="${VAULT_MOUNT:-secret}" -field=value {0}',
+      parseOutput: 'raw',
+    },
+    vault: {
+      // Short alias for hashicorp-vault (KV v2)
+      name: 'vault',
+      command: 'vault kv get -mount="${VAULT_MOUNT:-secret}" -field=value {0}',
+      parseOutput: 'raw',
+    },
+  };
+
+  /**
+   * Check if a source name is a known premade source.
+   */
+  static isPremadeSource(sourceName: string): boolean {
+    return sourceName in SecretSourceService.premadeSources;
+  }
+
+  /**
+   * Get the list of available premade source names.
+   */
+  static getAvailableSources(): string[] {
+    return Object.keys(SecretSourceService.premadeSources);
+  }
+
+  /**
+   * Resolve a source name to a SecretSourceDefinition.
+   *
+   * - If the name matches a premade source, returns that definition.
+   * - If it looks like a shell command (contains spaces or {0}), wraps it as a custom command.
+   * - Otherwise, returns undefined.
+   */
+  static resolveSource(sourceName: string): SecretSourceDefinition | undefined {
+    // Check premade sources
+    if (SecretSourceService.isPremadeSource(sourceName)) {
+      return SecretSourceService.premadeSources[sourceName];
+    }
+
+    // If it contains a placeholder or spaces, treat it as a raw command
+    if (sourceName.includes('{0}') || sourceName.includes(' ')) {
+      return {
+        name: 'custom-command',
+        command: sourceName,
+        parseOutput: 'raw',
+      };
+    }
+
+    return undefined;
+  }
+
+  /**
+   * Load custom secret source definitions from a YAML file.
+   *
+   * Expected format:
+   *   sources:
+   *     - name: my-source
+   *       command: 'my-tool get-secret {0}'
+   *     - name: my-api
+   *       command: 'curl -s https://api.example.com/secrets/{0}'
+   *       parseOutput: json-field
+   *       jsonField: value
+   */
+  static loadFromYaml(filePath: string): SecretSourceDefinition[] {
+    if (!fs.existsSync(filePath)) {
+      OrchestratorLogger.logWarning(`Secret source YAML not found: ${filePath}`);
+
+      return [];
+    }
+
+    try {
+      const content = fs.readFileSync(filePath, 'utf8');
+      const parsed = SecretSourceService.parseSimpleYaml(content);
+
+      return parsed;
+    } catch (error: any) {
+      OrchestratorLogger.logWarning(`Failed to parse secret source YAML: ${error.message}`);
+
+      return [];
+    }
+  }
+
+  /**
+   * Fetch a secret value using the given source definition.
+   *
+   * Validates the key against an allowlist pattern before interpolating it
+   * into the command string to prevent shell injection. The fetched secret
+   * value is masked via core.setSecret() so it does not leak in logs.
+   *
+   * @param source - The secret source definition to use
+   * @param key - The secret key to fetch
+   * @returns The secret value, or empty string on failure
+   */
+  static async fetchSecret(source: SecretSourceDefinition, key: string): Promise<string> {
+    // Validate the key to prevent shell injection
+    validateSecretKey(key);
+
+    const command = source.command.replace(/\{0\}/g, key);
+
+    try {
+      const output = await OrchestratorSystem.Run(command, false, true);
+
+      let value: string;
+
+      if (source.parseOutput === 'json-field' && source.jsonField) {
+        try {
+          const parsed = JSON.parse(output);
+          value = parsed[source.jsonField] || '';
+        } catch {
+          OrchestratorLogger.logWarning(`Failed to parse JSON output from ${source.name} for key ${key}`);
+          value = output.trim();
+        }
+      } else {
+        value = output.trim();
+      }
+
+      // Mask the secret value so it does not appear in GitHub Actions logs
+      maskSecretValue(value);
+
+      return value;
+    } catch (error: any) {
+      OrchestratorLogger.logWarning(`Failed to fetch secret '${key}' from ${source.name}: ${error.message}`);
+
+      return '';
+    }
+  }
+
+  /**
+   * Fetch a secret from an environment variable. No shell command needed.
+   * The value is masked via core.setSecret() so it does not leak in logs.
+   */
+  static fetchFromEnv(key: string): string {
+    const value = process.env[key] || '';
+    maskSecretValue(value);
+
+    return value;
+  }
+
+  /**
+   * Resolve a source name and fetch all secrets from it.
+   *
+   * @param sourceName - Premade source name, shell command, or 'env'
+   * @param keys - List of secret keys to fetch
+   * @returns Map of key -> value
+   */
+  static async fetchAll(sourceName: string, keys: string[]): Promise<Record<string, string>> {
+    const results: Record<string, string> = {};
+
+    if (sourceName === 'env') {
+      for (const key of keys) {
+        results[key] = SecretSourceService.fetchFromEnv(key);
+      }
+
+      return results;
+    }
+
+    const source = SecretSourceService.resolveSource(sourceName);
+    if (!source) {
+      OrchestratorLogger.logWarning(
+        `Unknown secret source '${sourceName}'. Available sources: ${SecretSourceService.getAvailableSources().join(
+          ', ',
+        )}`,
+      );
+
+      return results;
+    }
+
+    OrchestratorLogger.log(`Fetching ${keys.length} secret(s) from ${source.name}`);
+
+    for (const key of keys) {
+      results[key] = await SecretSourceService.fetchSecret(source, key);
+    }
+
+    return results;
+  }
+
+  /**
+   * Simple YAML parser for secret source definitions.
+   * Handles the specific structure we expect without requiring a YAML library.
+   */
+  private static parseSimpleYaml(content: string): SecretSourceDefinition[] {
+    const definitions: SecretSourceDefinition[] = [];
+    const lines = content.split('\n');
+    let current: Partial<SecretSourceDefinition> | null = null;
+
+    for (const rawLine of lines) {
+      const line = rawLine.replace(/\r$/, '');
+      const trimmed = line.trim();
+
+      if (trimmed === '' || trimmed.startsWith('#')) continue;
+
+      if (trimmed === '- name:' || trimmed.startsWith('- name:')) {
+        if (current?.name && current?.command) {
+          definitions.push(current as SecretSourceDefinition);
+        }
+
+        current = {
+          name: trimmed
+            .replace('- name:', '')
+            .trim()
+            .replace(/^['"]|['"]$/g, ''),
+          parseOutput: 'raw',
+        };
+        continue;
+      }
+
+      if (current && trimmed.startsWith('command:')) {
+        current.command = trimmed
+          .replace('command:', '')
+          .trim()
+          .replace(/^['"]|['"]$/g, '');
+      } else if (current && trimmed.startsWith('parseOutput:')) {
+        const value = trimmed
+          .replace('parseOutput:', '')
+          .trim()
+          .replace(/^['"]|['"]$/g, '');
+        current.parseOutput = value as 'raw' | 'json-field';
+      } else if (current && trimmed.startsWith('jsonField:')) {
+        current.jsonField = trimmed
+          .replace('jsonField:', '')
+          .trim()
+          .replace(/^['"]|['"]$/g, '');
+      }
+    }
+
+    if (current?.name && current?.command) {
+      definitions.push(current as SecretSourceDefinition);
+    }
+
+    return definitions;
+  }
+}