chore: remove one-shot copy-secrets workflow
SSH secrets have been successfully copied to peptide-repo-core and peptide-reconstitution-calculator. This workflow is no longer needed. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
74
.github/workflows/copy-secrets.yml
vendored
74
.github/workflows/copy-secrets.yml
vendored
@@ -1,74 +0,0 @@
|
||||
name: Copy SSH Secrets to New Repos
|
||||
|
||||
# Manual trigger only — run once to bootstrap new repos, then delete this file.
|
||||
on:
|
||||
workflow_dispatch:
|
||||
|
||||
permissions:
|
||||
contents: read
|
||||
|
||||
jobs:
|
||||
copy-secrets:
|
||||
name: Copy SSH secrets to peptide-repo-core and peptide-reconstitution-calculator
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- name: Install dependencies
|
||||
run: pip install pynacl requests
|
||||
|
||||
- name: Copy secrets to new repos
|
||||
env:
|
||||
GH_PAT: ${{ secrets.REPO_ADMIN_PAT }}
|
||||
SSH_HOST: ${{ secrets.SSH_HOST }}
|
||||
SSH_USERNAME: ${{ secrets.SSH_USERNAME }}
|
||||
SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
|
||||
SSH_PORT: ${{ secrets.SSH_PORT }}
|
||||
run: |
|
||||
python3 << 'PYEOF'
|
||||
import base64, json, os, requests
|
||||
from nacl import encoding, public
|
||||
|
||||
def encrypt_secret(public_key: str, secret_value: str) -> str:
|
||||
"""Encrypt a secret using the repo's public key."""
|
||||
pk = public.PublicKey(public_key.encode("utf-8"), encoding.Base64Encoder())
|
||||
sealed = public.SealedBox(pk).encrypt(secret_value.encode("utf-8"))
|
||||
return base64.b64encode(sealed).decode("utf-8")
|
||||
|
||||
def set_secret(repo: str, name: str, value: str, token: str):
|
||||
"""Set a secret on a GitHub repo."""
|
||||
headers = {"Authorization": f"token {token}", "Accept": "application/vnd.github+json"}
|
||||
|
||||
# Get the repo's public key.
|
||||
r = requests.get(f"https://api.github.com/repos/{repo}/actions/secrets/public-key", headers=headers)
|
||||
r.raise_for_status()
|
||||
pk_data = r.json()
|
||||
|
||||
encrypted = encrypt_secret(pk_data["key"], value)
|
||||
|
||||
r = requests.put(
|
||||
f"https://api.github.com/repos/{repo}/actions/secrets/{name}",
|
||||
headers=headers,
|
||||
json={"encrypted_value": encrypted, "key_id": pk_data["key_id"]},
|
||||
)
|
||||
r.raise_for_status()
|
||||
print(f" ✓ Set {name} on {repo}")
|
||||
|
||||
token = os.environ["GH_PAT"]
|
||||
secrets_to_copy = {
|
||||
"SSH_HOST": os.environ["SSH_HOST"],
|
||||
"SSH_USERNAME": os.environ["SSH_USERNAME"],
|
||||
"SSH_PRIVATE_KEY": os.environ["SSH_PRIVATE_KEY"],
|
||||
"SSH_PORT": os.environ["SSH_PORT"],
|
||||
}
|
||||
|
||||
target_repos = [
|
||||
"peptiderepo/peptide-repo-core",
|
||||
"peptiderepo/peptide-reconstitution-calculator",
|
||||
]
|
||||
|
||||
for repo in target_repos:
|
||||
print(f"\nSetting secrets on {repo}:")
|
||||
for name, value in secrets_to_copy.items():
|
||||
set_secret(repo, name, value, token)
|
||||
|
||||
print("\n✓ All secrets copied successfully.")
|
||||
PYEOF
|
||||
Reference in New Issue
Block a user