name: Copy SSH Secrets to New Repos

# Manual trigger only — run once to bootstrap new repos, then delete this file.
on:
  workflow_dispatch:

permissions:
  contents: read

jobs:
  copy-secrets:
    name: Copy SSH secrets to peptide-repo-core and peptide-reconstitution-calculator
    runs-on: ubuntu-latest
    steps:
      - name: Install dependencies
        run: pip install pynacl requests

      - name: Copy secrets to new repos
        env:
          GH_PAT: ${{ secrets.CTO_ADMIN_TOKEN }}
          SSH_HOST: ${{ secrets.SSH_HOST }}
          SSH_USERNAME: ${{ secrets.SSH_USERNAME }}
          SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
          SSH_PORT: ${{ secrets.SSH_PORT }}
        run: |
          python3 << 'PYEOF'
          import base64, json, os, requests
          from nacl import encoding, public

          def encrypt_secret(public_key: str, secret_value: str) -> str:
              """Encrypt a secret using the repo's public key."""
              pk = public.PublicKey(public_key.encode("utf-8"), encoding.Base64Encoder())
              sealed = public.SealedBox(pk).encrypt(secret_value.encode("utf-8"))
              return base64.b64encode(sealed).decode("utf-8")

          def set_secret(repo: str, name: str, value: str, token: str):
              """Set a secret on a GitHub repo."""
              headers = {"Authorization": f"token {token}", "Accept": "application/vnd.github+json"}

              # Get the repo's public key.
              r = requests.get(f"https://api.github.com/repos/{repo}/actions/secrets/public-key", headers=headers)
              r.raise_for_status()
              pk_data = r.json()

              encrypted = encrypt_secret(pk_data["key"], value)

              r = requests.put(
                  f"https://api.github.com/repos/{repo}/actions/secrets/{name}",
                  headers=headers,
                  json={"encrypted_value": encrypted, "key_id": pk_data["key_id"]},
              )
              r.raise_for_status()
              print(f"  ✓ Set {name} on {repo}")

          token = os.environ["GH_PAT"]
          secrets_to_copy = {
              "SSH_HOST": os.environ["SSH_HOST"],
              "SSH_USERNAME": os.environ["SSH_USERNAME"],
              "SSH_PRIVATE_KEY": os.environ["SSH_PRIVATE_KEY"],
              "SSH_PORT": os.environ["SSH_PORT"],
          }

          target_repos = [
              "peptiderepo/peptide-repo-core",
              "peptiderepo/peptide-reconstitution-calculator",
          ]

          for repo in target_repos:
              print(f"\nSetting secrets on {repo}:")
              for name, value in secrets_to_copy.items():
                  set_secret(repo, name, value, token)

          print("\n✓ All secrets copied successfully.")
          PYEOF