|
| 1 | +import _sodium from 'libsodium-wrappers' |
| 2 | +import {load} from 'js-yaml' |
| 3 | +import {readFileSync} from 'fs' |
| 4 | + |
| 5 | +/** |
| 6 | + * @param {import('@octoherd/cli').Octokit} octokit |
| 7 | + * @param {import('@octoherd/cli').Repository} repository |
| 8 | + * @param {object} options |
| 9 | + * @param {string} [options.path=.secrets.yml] |
| 10 | + * @param {boolean} [options.dryRun=false] |
| 11 | + */ |
| 12 | +export async function script(octokit, repository, {path = '.secrets.yml', dryRun = false}) { |
| 13 | + const { |
| 14 | + archived, |
| 15 | + disabled, |
| 16 | + fork, |
| 17 | + name: repo, |
| 18 | + owner: {login: owner}, |
| 19 | + size, |
| 20 | + clone_url: url, |
| 21 | + } = repository |
| 22 | + |
| 23 | + // skip archived, disabled, forked and empty repos |
| 24 | + if (archived || disabled || fork || size === 0) return |
| 25 | + |
| 26 | + try { |
| 27 | + // read secrets from file |
| 28 | + const buff = readFileSync(path, 'utf-8') |
| 29 | + const {secrets, variables} = await load(buff) |
| 30 | + |
| 31 | + // fail if no secrets or variables found |
| 32 | + if (!secrets && !variables) { |
| 33 | + octokit.log.error(`❌ no secrets nor variables found in ${path}`) |
| 34 | + return |
| 35 | + } |
| 36 | + |
| 37 | + // repository secrets |
| 38 | + if (secrets) { |
| 39 | + // https://docs.github.com/en/rest/actions/secrets#get-a-repository-public-key |
| 40 | + const { |
| 41 | + data: {key_id, key}, |
| 42 | + } = await octokit.request('GET /repos/{owner}/{repo}/actions/secrets/public-key', { |
| 43 | + owner, |
| 44 | + repo, |
| 45 | + }) |
| 46 | + |
| 47 | + for (const secret of Object.keys(secrets)) { |
| 48 | + const secretName = secret |
| 49 | + const secretValue = secrets[secret] |
| 50 | + |
| 51 | + const encryptedValue = await encrypt(key, secretValue) |
| 52 | + |
| 53 | + if (dryRun) { |
| 54 | + octokit.log.info(` 🐢 dry-run create or update secret ${secretName}`) |
| 55 | + } else { |
| 56 | + try { |
| 57 | + // https://docs.github.com/en/rest/actions/secrets#create-or-update-a-repository-secret |
| 58 | + const {status} = await octokit.request('PUT /repos/{owner}/{repo}/actions/secrets/{secret_name}', { |
| 59 | + owner, |
| 60 | + repo, |
| 61 | + secret_name: secretName, |
| 62 | + encrypted_value: encryptedValue, |
| 63 | + key_id, |
| 64 | + }) |
| 65 | + |
| 66 | + octokit.log.info(` 🛡️ ${status === 201 ? 'created' : 'updated'} ${secretName}`) |
| 67 | + } catch (error) { |
| 68 | + octokit.log.error({error: error.message, secret: secretName}, ` ❌ create or update secret ${secretName}`) |
| 69 | + } |
| 70 | + } |
| 71 | + } |
| 72 | + } |
| 73 | + |
| 74 | + // repository variables |
| 75 | + if (variables) { |
| 76 | + for (const variable of Object.keys(variables)) { |
| 77 | + const variableName = variable |
| 78 | + const variableValue = variables[variable] |
| 79 | + |
| 80 | + let create = false |
| 81 | + let value = null |
| 82 | + |
| 83 | + try { |
| 84 | + // https://docs.github.com/en/rest/actions/variables#get-a-repository-variable |
| 85 | + const { |
| 86 | + data: {value: v}, |
| 87 | + } = await octokit.request('GET /repos/{owner}/{repo}/actions/variables/{name}', { |
| 88 | + owner, |
| 89 | + repo, |
| 90 | + name: variableName, |
| 91 | + }) |
| 92 | + |
| 93 | + value = v |
| 94 | + } catch (error) { |
| 95 | + create = true |
| 96 | + } |
| 97 | + |
| 98 | + if (variableValue === value) { |
| 99 | + octokit.log.info(` 🙊 no change for variable ${variableName}`) |
| 100 | + continue |
| 101 | + } |
| 102 | + |
| 103 | + if (dryRun) { |
| 104 | + octokit.log.info(` 🐢 dry-run ${create ? 'create' : 'update'} variable ${variableName}`) |
| 105 | + } else { |
| 106 | + try { |
| 107 | + if (create) { |
| 108 | + // https://docs.github.com/en/rest/actions/variables#create-a-repository-variable |
| 109 | + await octokit.request('POST /repos/{owner}/{repo}/actions/variables', { |
| 110 | + owner, |
| 111 | + repo, |
| 112 | + name: variableName, |
| 113 | + value: variableValue, |
| 114 | + }) |
| 115 | + } else { |
| 116 | + // https://docs.github.com/en/rest/actions/variables#create-a-repository-variable |
| 117 | + await octokit.request('PATCH /repos/{owner}/{repo}/actions/variables/{name}', { |
| 118 | + owner, |
| 119 | + repo, |
| 120 | + name: variableName, |
| 121 | + value: variableValue, |
| 122 | + }) |
| 123 | + } |
| 124 | + |
| 125 | + octokit.log.info(` 🛡️ ${create ? 'created' : 'updated'} ${variableName}`) |
| 126 | + } catch (error) { |
| 127 | + octokit.log.error({error: error.message}, ` ❌ ${create ? 'create' : 'update'} variable ${variableName}`) |
| 128 | + } |
| 129 | + } |
| 130 | + } |
| 131 | + } |
| 132 | + |
| 133 | + octokit.log.info(` ✅ ${url}`) |
| 134 | + return |
| 135 | + } catch (error) { |
| 136 | + // eslint-disable-next-line no-console |
| 137 | + console.error(error) |
| 138 | + octokit.log.error(`❌ ${error.message}`) |
| 139 | + } |
| 140 | +} |
| 141 | + |
| 142 | +/** |
| 143 | + * Encrypt a secret using a public key. |
| 144 | + * https://www.npmjs.com/package/libsodium-wrappers |
| 145 | + * |
| 146 | + * @function encrypt |
| 147 | + * @async |
| 148 | + * |
| 149 | + * @param {string} key |
| 150 | + * @param {string} secret |
| 151 | + * |
| 152 | + * @returns {Promise<string>} |
| 153 | + */ |
| 154 | +const encrypt = async (key, secret) => { |
| 155 | + await _sodium.ready |
| 156 | + const sodium = _sodium |
| 157 | + |
| 158 | + // convert base64 key & secret to Uint8Array. |
| 159 | + const binkey = sodium.from_base64(key, sodium.base64_variants.ORIGINAL) |
| 160 | + const binsec = sodium.from_string(secret) |
| 161 | + |
| 162 | + // encrypt the secret using LibSodium |
| 163 | + const encBytes = sodium.crypto_box_seal(binsec, binkey) |
| 164 | + |
| 165 | + // convert encrypted Uint8Array to Base64 |
| 166 | + return sodium.to_base64(encBytes, sodium.base64_variants.ORIGINAL) |
| 167 | +} |
0 commit comments