diff --git a/.github/workflows/copy-secrets.yml b/.github/workflows/copy-secrets.yml deleted file mode 100755 index 2ca8b52..0000000 --- a/.github/workflows/copy-secrets.yml +++ /dev/null @@ -1,74 +0,0 @@ -name: Copy SSH Secrets to New Repos - -# Manual trigger only — run once to bootstrap new repos, then delete this file. -on: - workflow_dispatch: - -permissions: - contents: read - -jobs: - copy-secrets: - name: Copy SSH secrets to peptide-repo-core and peptide-reconstitution-calculator - runs-on: ubuntu-latest - steps: - - name: Install dependencies - run: pip install pynacl requests - - - name: Copy secrets to new repos - env: - GH_PAT: ${{ secrets.REPO_ADMIN_PAT }} - SSH_HOST: ${{ secrets.SSH_HOST }} - SSH_USERNAME: ${{ secrets.SSH_USERNAME }} - SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }} - SSH_PORT: ${{ secrets.SSH_PORT }} - run: | - python3 << 'PYEOF' - import base64, json, os, requests - from nacl import encoding, public - - def encrypt_secret(public_key: str, secret_value: str) -> str: - """Encrypt a secret using the repo's public key.""" - pk = public.PublicKey(public_key.encode("utf-8"), encoding.Base64Encoder()) - sealed = public.SealedBox(pk).encrypt(secret_value.encode("utf-8")) - return base64.b64encode(sealed).decode("utf-8") - - def set_secret(repo: str, name: str, value: str, token: str): - """Set a secret on a GitHub repo.""" - headers = {"Authorization": f"token {token}", "Accept": "application/vnd.github+json"} - - # Get the repo's public key. - r = requests.get(f"https://api.github.com/repos/{repo}/actions/secrets/public-key", headers=headers) - r.raise_for_status() - pk_data = r.json() - - encrypted = encrypt_secret(pk_data["key"], value) - - r = requests.put( - f"https://api.github.com/repos/{repo}/actions/secrets/{name}", - headers=headers, - json={"encrypted_value": encrypted, "key_id": pk_data["key_id"]}, - ) - r.raise_for_status() - print(f" āœ“ Set {name} on {repo}") - - token = os.environ["GH_PAT"] - secrets_to_copy = { - "SSH_HOST": os.environ["SSH_HOST"], - "SSH_USERNAME": os.environ["SSH_USERNAME"], - "SSH_PRIVATE_KEY": os.environ["SSH_PRIVATE_KEY"], - "SSH_PORT": os.environ["SSH_PORT"], - } - - target_repos = [ - "peptiderepo/peptide-repo-core", - "peptiderepo/peptide-reconstitution-calculator", - ] - - for repo in target_repos: - print(f"\nSetting secrets on {repo}:") - for name, value in secrets_to_copy.items(): - set_secret(repo, name, value, token) - - print("\nāœ“ All secrets copied successfully.") - PYEOF