From 4629406cdcedf843bb0d9a55207c1886b7ad09ad Mon Sep 17 00:00:00 2001
From: peptiderepo <peptiderepo@users.noreply.github.com>
Date: Fri, 17 Apr 2026 17:07:39 +0700
Subject: [PATCH] chore: add one-shot workflow to copy SSH secrets to new repos
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Copies SSH_HOST, SSH_USERNAME, SSH_PRIVATE_KEY, SSH_PORT from this
repo to peptide-repo-core and peptide-reconstitution-calculator.
Manual trigger only — delete after running.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 .github/workflows/copy-secrets.yml | 74 ++++++++++++++++++++++++++++++
 1 file changed, 74 insertions(+)
 create mode 100755 .github/workflows/copy-secrets.yml

diff --git a/.github/workflows/copy-secrets.yml b/.github/workflows/copy-secrets.yml
new file mode 100755
index 0000000..bc9edd4
--- /dev/null
+++ b/.github/workflows/copy-secrets.yml
@@ -0,0 +1,74 @@
+name: Copy SSH Secrets to New Repos
+
+# Manual trigger only — run once to bootstrap new repos, then delete this file.
+on:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  copy-secrets:
+    name: Copy SSH secrets to peptide-repo-core and peptide-reconstitution-calculator
+    runs-on: ubuntu-latest
+    steps:
+      - name: Install dependencies
+        run: pip install pynacl requests
+
+      - name: Copy secrets to new repos
+        env:
+          GH_PAT: ${{ secrets.CTO_ADMIN_TOKEN }}
+          SSH_HOST: ${{ secrets.SSH_HOST }}
+          SSH_USERNAME: ${{ secrets.SSH_USERNAME }}
+          SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
+          SSH_PORT: ${{ secrets.SSH_PORT }}
+        run: |
+          python3 << 'PYEOF'
+          import base64, json, os, requests
+          from nacl import encoding, public
+
+          def encrypt_secret(public_key: str, secret_value: str) -> str:
+              """Encrypt a secret using the repo's public key."""
+              pk = public.PublicKey(public_key.encode("utf-8"), encoding.Base64Encoder())
+              sealed = public.SealedBox(pk).encrypt(secret_value.encode("utf-8"))
+              return base64.b64encode(sealed).decode("utf-8")
+
+          def set_secret(repo: str, name: str, value: str, token: str):
+              """Set a secret on a GitHub repo."""
+              headers = {"Authorization": f"token {token}", "Accept": "application/vnd.github+json"}
+
+              # Get the repo's public key.
+              r = requests.get(f"https://api.github.com/repos/{repo}/actions/secrets/public-key", headers=headers)
+              r.raise_for_status()
+              pk_data = r.json()
+
+              encrypted = encrypt_secret(pk_data["key"], value)
+
+              r = requests.put(
+                  f"https://api.github.com/repos/{repo}/actions/secrets/{name}",
+                  headers=headers,
+                  json={"encrypted_value": encrypted, "key_id": pk_data["key_id"]},
+              )
+              r.raise_for_status()
+              print(f"  ✓ Set {name} on {repo}")
+
+          token = os.environ["GH_PAT"]
+          secrets_to_copy = {
+              "SSH_HOST": os.environ["SSH_HOST"],
+              "SSH_USERNAME": os.environ["SSH_USERNAME"],
+              "SSH_PRIVATE_KEY": os.environ["SSH_PRIVATE_KEY"],
+              "SSH_PORT": os.environ["SSH_PORT"],
+          }
+
+          target_repos = [
+              "peptiderepo/peptide-repo-core",
+              "peptiderepo/peptide-reconstitution-calculator",
+          ]
+
+          for repo in target_repos:
+              print(f"\nSetting secrets on {repo}:")
+              for name, value in secrets_to_copy.items():
+                  set_secret(repo, name, value, token)
+
+          print("\n✓ All secrets copied successfully.")
+          PYEOF