47ce4818f0
CTO_ADMIN_TOKEN lacked permissions to set secrets on other repos. REPO_ADMIN_PAT has repo+workflow scopes needed for the GitHub secrets API. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
75 lines
2.7 KiB
YAML
Executable File
75 lines
2.7 KiB
YAML
Executable File
name: Copy SSH Secrets to New Repos
|
|
|
|
# Manual trigger only — run once to bootstrap new repos, then delete this file.
|
|
on:
|
|
workflow_dispatch:
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
copy-secrets:
|
|
name: Copy SSH secrets to peptide-repo-core and peptide-reconstitution-calculator
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Install dependencies
|
|
run: pip install pynacl requests
|
|
|
|
- name: Copy secrets to new repos
|
|
env:
|
|
GH_PAT: ${{ secrets.REPO_ADMIN_PAT }}
|
|
SSH_HOST: ${{ secrets.SSH_HOST }}
|
|
SSH_USERNAME: ${{ secrets.SSH_USERNAME }}
|
|
SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
|
|
SSH_PORT: ${{ secrets.SSH_PORT }}
|
|
run: |
|
|
python3 << 'PYEOF'
|
|
import base64, json, os, requests
|
|
from nacl import encoding, public
|
|
|
|
def encrypt_secret(public_key: str, secret_value: str) -> str:
|
|
"""Encrypt a secret using the repo's public key."""
|
|
pk = public.PublicKey(public_key.encode("utf-8"), encoding.Base64Encoder())
|
|
sealed = public.SealedBox(pk).encrypt(secret_value.encode("utf-8"))
|
|
return base64.b64encode(sealed).decode("utf-8")
|
|
|
|
def set_secret(repo: str, name: str, value: str, token: str):
|
|
"""Set a secret on a GitHub repo."""
|
|
headers = {"Authorization": f"token {token}", "Accept": "application/vnd.github+json"}
|
|
|
|
# Get the repo's public key.
|
|
r = requests.get(f"https://api.github.com/repos/{repo}/actions/secrets/public-key", headers=headers)
|
|
r.raise_for_status()
|
|
pk_data = r.json()
|
|
|
|
encrypted = encrypt_secret(pk_data["key"], value)
|
|
|
|
r = requests.put(
|
|
f"https://api.github.com/repos/{repo}/actions/secrets/{name}",
|
|
headers=headers,
|
|
json={"encrypted_value": encrypted, "key_id": pk_data["key_id"]},
|
|
)
|
|
r.raise_for_status()
|
|
print(f" ✓ Set {name} on {repo}")
|
|
|
|
token = os.environ["GH_PAT"]
|
|
secrets_to_copy = {
|
|
"SSH_HOST": os.environ["SSH_HOST"],
|
|
"SSH_USERNAME": os.environ["SSH_USERNAME"],
|
|
"SSH_PRIVATE_KEY": os.environ["SSH_PRIVATE_KEY"],
|
|
"SSH_PORT": os.environ["SSH_PORT"],
|
|
}
|
|
|
|
target_repos = [
|
|
"peptiderepo/peptide-repo-core",
|
|
"peptiderepo/peptide-reconstitution-calculator",
|
|
]
|
|
|
|
for repo in target_repos:
|
|
print(f"\nSetting secrets on {repo}:")
|
|
for name, value in secrets_to_copy.items():
|
|
set_secret(repo, name, value, token)
|
|
|
|
print("\n✓ All secrets copied successfully.")
|
|
PYEOF
|