1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
|
// Copyright 2020 The go-github AUTHORS. All rights reserved.
//
// Use of this source code is governed by a BSD-style
// license that can be found in the LICENSE file.
// newreposecretwithlibsodium creates a new secret in GitHub for a given owner/repo.
// newreposecretwithlibsodium depends on sodium being installed. Installation instructions for Sodium can be found at this url:
// https://github.com/jedisct1/libsodium
//
// nnewreposecretwithlibsodium has two required flags for owner and repo, and takes in one argument for the name of the secret to add.
// The secret value is pulled from an environment variable based on the secret name.
// To authenticate with GitHub, provide your token via an environment variable GITHUB_AUTH_TOKEN.
//
// To verify the new secret, navigate to GitHub Repository > Settings > left side options bar > Secrets.
//
// Usage:
//
// export GITHUB_AUTH_TOKEN=<auth token from github that has secret create rights>
// export SECRET_VARIABLE=<secret value of the secret variable>
// go run main.go -owner <owner name> -repo <repository name> SECRET_VARIABLE
//
// Example:
//
// export GITHUB_AUTH_TOKEN=0000000000000000
// export SECRET_VARIABLE="my-secret"
// go run main.go -owner google -repo go-github SECRET_VARIABLE
package main
import (
"context"
"encoding/base64"
"errors"
"flag"
"fmt"
"log"
"os"
sodium "github.com/GoKillers/libsodium-go/cryptobox"
"github.com/google/go-github/v60/github"
)
var (
repo = flag.String("repo", "", "The repo that the secret should be added to, ex. go-github")
owner = flag.String("owner", "", "The owner of there repo this should be added to, ex. google")
)
func main() {
flag.Parse()
token := os.Getenv("GITHUB_AUTH_TOKEN")
if token == "" {
log.Fatal("please provide a GitHub API token via env variable GITHUB_AUTH_TOKEN")
}
if *repo == "" {
log.Fatal("please provide required flag --repo to specify GitHub repository ")
}
if *owner == "" {
log.Fatal("please provide required flag --owner to specify GitHub user/org owner")
}
secretName, err := getSecretName()
if err != nil {
log.Fatal(err)
}
secretValue, err := getSecretValue(secretName)
if err != nil {
log.Fatal(err)
}
ctx := context.Background()
client := github.NewClient(nil).WithAuthToken(token)
if err := addRepoSecret(ctx, client, *owner, *repo, secretName, secretValue); err != nil {
log.Fatal(err)
}
fmt.Printf("Added secret %q to the repo %v/%v\n", secretName, *owner, *repo)
}
func getSecretName() (string, error) {
secretName := flag.Arg(0)
if secretName == "" {
return "", fmt.Errorf("missing argument secret name")
}
return secretName, nil
}
func getSecretValue(secretName string) (string, error) {
secretValue := os.Getenv(secretName)
if secretValue == "" {
return "", fmt.Errorf("secret value not found under env variable %q", secretName)
}
return secretValue, nil
}
// addRepoSecret will add a secret to a GitHub repo for use in GitHub Actions.
//
// Finally, the secretName and secretValue will determine the name of the secret added and it's corresponding value.
//
// The actual transmission of the secret value to GitHub using the api requires that the secret value is encrypted
// using the public key of the target repo. This encryption is done using sodium.
//
// First, the public key of the repo is retrieved. The public key comes base64
// encoded, so it must be decoded prior to use in sodiumlib.
//
// Second, the secret value is converted into a slice of bytes.
//
// Third, the secret is encrypted with sodium.CryptoBoxSeal using the repo's decoded public key.
//
// Fourth, the encrypted secret is encoded as a base64 string to be used in a github.EncodedSecret type.
//
// Fifth, The other two properties of the github.EncodedSecret type are determined. The name of the secret to be added
// (string not base64), and the KeyID of the public key used to encrypt the secret.
// This can be retrieved via the public key's GetKeyID method.
//
// Finally, the github.EncodedSecret is passed into the GitHub client.Actions.CreateOrUpdateRepoSecret method to
// populate the secret in the GitHub repo.
func addRepoSecret(ctx context.Context, client *github.Client, owner string, repo, secretName string, secretValue string) error {
publicKey, _, err := client.Actions.GetRepoPublicKey(ctx, owner, repo)
if err != nil {
return err
}
encryptedSecret, err := encryptSecretWithPublicKey(publicKey, secretName, secretValue)
if err != nil {
return err
}
if _, err := client.Actions.CreateOrUpdateRepoSecret(ctx, owner, repo, encryptedSecret); err != nil {
return fmt.Errorf("Actions.CreateOrUpdateRepoSecret returned error: %v", err)
}
return nil
}
func encryptSecretWithPublicKey(publicKey *github.PublicKey, secretName string, secretValue string) (*github.EncryptedSecret, error) {
decodedPublicKey, err := base64.StdEncoding.DecodeString(publicKey.GetKey())
if err != nil {
return nil, fmt.Errorf("base64.StdEncoding.DecodeString was unable to decode public key: %v", err)
}
secretBytes := []byte(secretValue)
encryptedBytes, exit := sodium.CryptoBoxSeal(secretBytes, decodedPublicKey)
if exit != 0 {
return nil, errors.New("sodium.CryptoBoxSeal exited with non zero exit code")
}
encryptedString := base64.StdEncoding.EncodeToString(encryptedBytes)
keyID := publicKey.GetKeyID()
encryptedSecret := &github.EncryptedSecret{
Name: secretName,
KeyID: keyID,
EncryptedValue: encryptedString,
}
return encryptedSecret, nil
}
|
