rake_github 0.16.0.pre.3 → 0.16.0.pre.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6ce3d495a40896a827bc5d040bc9d04c9c8d0a04034797e1588694e66f88ef4a
-  data.tar.gz: 6a5077f3d2c3d57f0cc6a0bb3eb7f5545a3d0cfd0704484e671708efe4cf93c7
+  metadata.gz: f120b956192eb362519228ff9729bb5a0f7dbe55f2c1778140d818fa5b9d9596
+  data.tar.gz: 527b937b23abfaf85ec50d4789cb16273aa2ff45c5288256a611d98071e93028
 SHA512:
-  metadata.gz: 964e0c598270de1d9d670410d86624af377820dc6e094bcc9b2b7a2def6104956030f30e051fd10e89a147750091509a688c1176385516cbabbbd1f2e60b9c8c
-  data.tar.gz: 8810f89d5c5720be6c67f83302f038949e54f4d05251897426daface8240bb800ba28a43c0623dbb0fb0cd7a91461172e04bba38c5cded803b9aef832c4598a2
+  metadata.gz: 1cc3b0768de864672330930dfb61f51b37c3d7ccf57c3eae2b737b79136f142fd0ae899a26f01149c51c1f02ab09c0bc8dfe811c73996db12e2480d9e04e5c9c
+  data.tar.gz: 9bed9380255dc0e0c0f4e5258fe25a18ad981094ac27919d33d6daf17c6ed95e8fcbe1e6e9f5df354885fb9ca57137b78bc1cd1963f123292b2416edce267485

data/Gemfile.lock

@@ -1,10 +1,11 @@
 PATH
   remote: .
   specs:
-    rake_github (0.16.0.pre.3)
+    rake_github (0.16.0.pre.4)
       colored2 (~> 3.1)
-      octokit (>= 4.16, < 11.0)
+      octokit (>= 7.0, < 11.0)
       rake_factory (~> 0.33)
+      rbnacl (~> 7.1)
       sshkey (~> 2.0)
 
 GEM
@@ -42,6 +43,7 @@ GEM
       logger
     faraday-net_http (3.4.0)
       net-http (>= 0.5.0)
+    ffi (1.17.4)
     gem-release (2.2.4)
     git (1.19.1)
       addressable (~> 2.8)
@@ -100,6 +102,8 @@ GEM
       colored2 (~> 3.1)
       rake_factory (~> 0.33)
       sshkey (~> 2.0)
+    rbnacl (7.1.2)
+      ffi (~> 1)
     rchardet (1.8.0)
     regexp_parser (2.10.0)
     rspec (3.13.1)
@@ -157,7 +161,7 @@ GEM
     unicode-display_width (3.1.4)
       unicode-emoji (~> 4.0, >= 4.0.4)
     unicode-emoji (4.0.4)
-    uri (1.0.3)
+    uri (1.1.1)
 
 PLATFORMS
   ruby

data/README.md

@@ -18,6 +18,21 @@ Or install it yourself as:
 
     $ gem install rake_github
 
+### System dependencies
+
+The `secrets` task group encrypts secrets client-side using `rbnacl`, which
+requires the native [libsodium](https://libsodium.org) library to be present on
+the host. Install it before running any `secrets` task:
+
+    # macOS
+    $ brew install libsodium
+
+    # Debian/Ubuntu
+    $ apt-get install libsodium23
+
+libsodium is only required when using the `secrets` tasks; the other task groups
+have no additional system dependencies.
+
 ## Usage
 
 ### define_deploy_keys_tasks
@@ -52,6 +67,16 @@ end
 | deploy_keys_destroy_task_name   | symbol | N        | Option to change the destroy task name                     | :obliterate                                            | :destroy                             |
 | deploy_keys_provision_task_name | symbol | N        | Option to change the provision task name                   | :add                                                   | :provision                           |
 | deploy_keys_ensure_task_name    | symbol | N        | Option to change the ensure task name                      | :destroy_and_provision                                 | :ensure                              |
+| secrets                         | array  | N        | Secrets to provision on the repository                     | { name: string, value: string, dependabot: bool }     | [ ]                                  |
+| secrets_namespace               | symbol | N        | Namespace to contain secrets tasks                         | :repository_secrets                                    | :secrets                             |
+| secrets_destroy_task_name       | symbol | N        | Option to change the secrets destroy task name             | :obliterate                                            | :destroy                             |
+| secrets_provision_task_name     | symbol | N        | Option to change the secrets provision task name           | :add                                                   | :provision                           |
+| secrets_ensure_task_name        | symbol | N        | Option to change the secrets ensure task name              | :destroy_and_provision                                 | :ensure                              |
+| environments                    | array  | N        | Environments to provision on the repository                | { name: string, reviewers: array }                     | [ ]                                  |
+| environments_namespace          | symbol | N        | Namespace to contain environments tasks                    | :repository_environments                               | :environments                        |
+| environments_destroy_task_name  | symbol | N        | Option to change the environments destroy task name        | :obliterate                                            | :destroy                             |
+| environments_provision_task_name| symbol | N        | Option to change the environments provision task name      | :add                                                   | :provision                           |
+| environments_ensure_task_name   | symbol | N        | Option to change the environments ensure task name         | :destroy_and_provision                                 | :ensure                              |
 | namespace                       | symbol | N        | Namespace for tasks to live in, defaults to root namespace | :rake_github                                           | N/A                                  |
 
 Exposes tasks:
@@ -62,6 +87,12 @@ $ rake -T
 rake github:deploy_keys:destroy
 rake github:deploy_keys:ensure
 rake github:deploy_keys:provision
+rake github:secrets:destroy
+rake github:secrets:ensure
+rake github:secrets:provision
+rake github:environments:destroy
+rake github:environments:ensure
+rake github:environments:provision
 rake github:pull_requests:merge[branch_name,commit_message]
 ```
 
@@ -84,6 +115,145 @@ Merges the PR associated with the `branch_name`. Branch name is required.
 `commit_message` is optional, and can contain the original commit message with
 the `%s` placeholder, e.g. `pull_requests:merge[new_feature,"%s [skip ci]"]`.
 
+### define_secrets_tasks
+
+Sets up rake tasks for managing repository secrets. Each secret is written to
+the Actions secret store by default. A secret can additionally be written to the
+Dependabot secret store by setting `dependabot: true`, so that
+Dependabot-triggered workflow runs can read the secrets they need. Secrets are
+encrypted client-side before being sent to GitHub.
+
+These tasks require the native libsodium library to be installed on the host —
+see [System dependencies](#system-dependencies) above.
+
+```ruby
+require 'rake_github'
+
+RakeGithub.define_secrets_tasks(
+  namespace: :secrets,
+  repository: 'org/repo', # required
+) do |t|
+  t.access_token = "your_github_access_token" # required
+  t.secrets = [
+    {
+      name: 'SOME_SECRET',
+      value: 'some-plaintext-value'
+    },
+    {
+      name: 'SHARED_SECRET',
+      value: 'another-plaintext-value',
+      dependabot: true # also write to the Dependabot store
+    }
+  ]
+end
+```
+
+| Parameter            | Type   | Required | Description                                                | Example                                     | Default    |
+|----------------------|--------|----------|------------------------------------------------------------|---------------------------------------------|------------|
+| repository           | string | Y        | Repository to perform tasks upon                           | 'organisation/repository_name'              | N/A        |
+| access_token         | string | Y        | Github token for authorisation                             | 'ghp_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx' | N/A        |
+| secrets              | array  | N        | Secrets to provision on the repository                     | { name: string, value: string, dependabot: bool } | [ ]        |
+| destroy_task_name    | symbol | N        | Option to change the destroy task name                     | :obliterate                                 | :destroy   |
+| provision_task_name  | symbol | N        | Option to change the provision task name                   | :add                                        | :provision |
+| ensure_task_name     | symbol | N        | Option to change the ensure task name                      | :destroy_and_provision                      | :ensure    |
+| namespace            | symbol | N        | Namespace for tasks to live in, defaults to root namespace | :secrets                                    | N/A        |
+
+Exposes tasks:
+
+```shell
+$ rake -T
+
+rake secrets:destroy
+rake secrets:ensure
+rake secrets:provision
+```
+
+#### secrets:provision
+
+Provisions the specified secrets to the repository, writing each one to the
+Actions secret store and, for secrets marked `dependabot: true`, also to the
+Dependabot secret store.
+
+#### secrets:destroy
+
+Destroys the specified secrets from the repository, removing each one from both
+the Actions and Dependabot secret stores.
+
+#### secrets:ensure
+
+Destroys and then provisions the specified secrets on the repository.
+
+### define_environments_tasks
+
+Sets up rake tasks for managing GitHub deployment environments, including
+protection rules such as required reviewers. Team and user reviewers are
+resolved to their numeric ids before being sent to GitHub.
+
+```ruby
+require 'rake_github'
+
+RakeGithub.define_environments_tasks(
+  namespace: :environments,
+  repository: 'org/repo', # required
+) do |t|
+  t.access_token = "your_github_access_token" # required
+  t.environments = [
+    {
+      name: 'release',
+      wait_timer: 0,
+      prevent_self_review: false,
+      reviewers: [
+        { team: 'maintainers' },
+        { user: 'someone' }
+      ],
+      deployment_branch_policy: {
+        protected_branches: true,
+        custom_branch_policies: false
+      }
+    }
+  ]
+end
+```
+
+Only `name` is required for each environment; every other key is optional and
+is omitted from the GitHub API payload when absent.
+
+| Parameter            | Type   | Required | Description                                                | Example                                     | Default        |
+|----------------------|--------|----------|------------------------------------------------------------|---------------------------------------------|----------------|
+| repository           | string | Y        | Repository to perform tasks upon                           | 'organisation/repository_name'              | N/A            |
+| access_token         | string | Y        | Github token for authorisation                             | 'ghp_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx' | N/A            |
+| environments         | array  | N        | Environments to provision on the repository                | { name: string, reviewers: array }          | [ ]            |
+| destroy_task_name    | symbol | N        | Option to change the destroy task name                     | :obliterate                                 | :destroy       |
+| provision_task_name  | symbol | N        | Option to change the provision task name                   | :add                                        | :provision     |
+| ensure_task_name     | symbol | N        | Option to change the ensure task name                      | :destroy_and_provision                      | :ensure        |
+| namespace            | symbol | N        | Namespace for tasks to live in, defaults to root namespace | :environments                               | N/A            |
+
+Exposes tasks:
+
+```shell
+$ rake -T
+
+rake environments:destroy
+rake environments:ensure
+rake environments:provision
+```
+
+#### environments:provision
+
+Provisions the specified environments on the repository, resolving any team
+and user reviewers to their numeric ids.
+
+#### environments:destroy
+
+Destroys the specified environments from the repository. This is irreversible
+and also discards each environment's protection rules, environment secrets and
+deployment history. `environments:ensure` therefore fully recreates each
+environment rather than patching it in place.
+
+#### environments:ensure
+
+Destroys and then provisions the specified environments on the repository.
+
 ### define_release_task
 
 ## Development

data/lib/rake_github/task_sets/environments.rb

@@ -0,0 +1,34 @@
+# frozen_string_literal: true
+
+require 'rake_factory'
+
+require_relative '../tasks'
+
+module RakeGithub
+  module TaskSets
+    class Environments < RakeFactory::TaskSet
+      prepend RakeFactory::Namespaceable
+
+      parameter :repository, required: true
+      parameter :access_token, required: true
+      parameter :environments, default: []
+
+      parameter :destroy_task_name, default: :destroy
+      parameter :provision_task_name, default: :provision
+      parameter :ensure_task_name, default: :ensure
+
+      task Tasks::Environments::Provision,
+           name: RakeFactory::DynamicValue.new { |ts|
+             ts.provision_task_name
+           }
+      task Tasks::Environments::Destroy,
+           name: RakeFactory::DynamicValue.new { |ts|
+             ts.destroy_task_name
+           }
+      task Tasks::Environments::Ensure,
+           name: RakeFactory::DynamicValue.new { |ts|
+             ts.ensure_task_name
+           }
+    end
+  end
+end

data/lib/rake_github/task_sets/repository.rb

@@ -12,12 +12,24 @@ module RakeGithub
       parameter :repository, required: true
       parameter :access_token, required: true
       parameter :deploy_keys, default: []
+      parameter :secrets, default: []
+      parameter :environments, default: []
 
       parameter :deploy_keys_namespace, default: :deploy_keys
       parameter :deploy_keys_destroy_task_name, default: :destroy
       parameter :deploy_keys_provision_task_name, default: :provision
       parameter :deploy_keys_ensure_task_name, default: :ensure
 
+      parameter :secrets_namespace, default: :secrets
+      parameter :secrets_destroy_task_name, default: :destroy
+      parameter :secrets_provision_task_name, default: :provision
+      parameter :secrets_ensure_task_name, default: :ensure
+
+      parameter :environments_namespace, default: :environments
+      parameter :environments_destroy_task_name, default: :destroy
+      parameter :environments_provision_task_name, default: :provision
+      parameter :environments_ensure_task_name, default: :ensure
+
       task Tasks::DeployKeys::Provision,
            name: RakeFactory::DynamicValue.new { |ts|
              ts.deploy_keys_provision_task_name
@@ -36,6 +48,42 @@ module RakeGithub
            destroy_task_name: RakeFactory::DynamicValue.new { |ts|
              ts.deploy_keys_destroy_task_name
            }
+      task Tasks::Secrets::Provision,
+           name: RakeFactory::DynamicValue.new { |ts|
+             ts.secrets_provision_task_name
+           }
+      task Tasks::Secrets::Destroy,
+           name: RakeFactory::DynamicValue.new { |ts|
+             ts.secrets_destroy_task_name
+           }
+      task Tasks::Secrets::Ensure,
+           name: RakeFactory::DynamicValue.new { |ts|
+             ts.secrets_ensure_task_name
+           },
+           provision_task_name: RakeFactory::DynamicValue.new { |ts|
+             ts.secrets_provision_task_name
+           },
+           destroy_task_name: RakeFactory::DynamicValue.new { |ts|
+             ts.secrets_destroy_task_name
+           }
+      task Tasks::Environments::Provision,
+           name: RakeFactory::DynamicValue.new { |ts|
+             ts.environments_provision_task_name
+           }
+      task Tasks::Environments::Destroy,
+           name: RakeFactory::DynamicValue.new { |ts|
+             ts.environments_destroy_task_name
+           }
+      task Tasks::Environments::Ensure,
+           name: RakeFactory::DynamicValue.new { |ts|
+             ts.environments_ensure_task_name
+           },
+           provision_task_name: RakeFactory::DynamicValue.new { |ts|
+             ts.environments_provision_task_name
+           },
+           destroy_task_name: RakeFactory::DynamicValue.new { |ts|
+             ts.environments_destroy_task_name
+           }
       task Tasks::PullRequests::Merge
 
       def define_on(application)
@@ -57,6 +105,8 @@ module RakeGithub
       def resolve_namespace(task_definition)
         case task_definition.klass.to_s
         when /DeployKeys/ then deploy_keys_namespace
+        when /Secrets/ then secrets_namespace
+        when /Environments/ then environments_namespace
         when /PullRequests/ then :pull_requests
         end
       end

data/lib/rake_github/task_sets/secrets.rb

@@ -0,0 +1,34 @@
+# frozen_string_literal: true
+
+require 'rake_factory'
+
+require_relative '../tasks'
+
+module RakeGithub
+  module TaskSets
+    class Secrets < RakeFactory::TaskSet
+      prepend RakeFactory::Namespaceable
+
+      parameter :repository, required: true
+      parameter :access_token, required: true
+      parameter :secrets, default: []
+
+      parameter :destroy_task_name, default: :destroy
+      parameter :provision_task_name, default: :provision
+      parameter :ensure_task_name, default: :ensure
+
+      task Tasks::Secrets::Provision,
+           name: RakeFactory::DynamicValue.new { |ts|
+             ts.provision_task_name
+           }
+      task Tasks::Secrets::Destroy,
+           name: RakeFactory::DynamicValue.new { |ts|
+             ts.destroy_task_name
+           }
+      task Tasks::Secrets::Ensure,
+           name: RakeFactory::DynamicValue.new { |ts|
+             ts.ensure_task_name
+           }
+    end
+  end
+end

data/lib/rake_github/task_sets.rb

@@ -1,4 +1,6 @@
 # frozen_string_literal: true
 
 require_relative 'task_sets/deploy_keys'
+require_relative 'task_sets/secrets'
+require_relative 'task_sets/environments'
 require_relative 'task_sets/repository'

data/lib/rake_github/tasks/environments/destroy.rb

@@ -0,0 +1,41 @@
+# frozen_string_literal: true
+
+require 'rake_factory'
+require 'octokit'
+
+module RakeGithub
+  module Tasks
+    module Environments
+      class Destroy < RakeFactory::Task
+        default_name :destroy
+        default_description(RakeFactory::DynamicValue.new do |t|
+          "Destroys environments from the #{t.repository} repository"
+        end)
+
+        parameter :repository, required: true
+        parameter :access_token, required: true
+        parameter :environments, default: []
+
+        action do |t|
+          client = Octokit::Client.new(access_token:)
+
+          $stdout.puts 'Removing specified environments from the ' \
+                       "'#{t.repository}' repository... "
+          t.environments.each do |environment|
+            $stdout.print "Removing '#{environment[:name]}'... "
+            delete_environment(client, t.repository, environment[:name])
+            $stdout.puts 'Done.'
+          end
+        end
+
+        private
+
+        def delete_environment(client, repository, name)
+          client.delete_environment(repository, name)
+        rescue Octokit::NotFound
+          nil
+        end
+      end
+    end
+  end
+end

data/lib/rake_github/tasks/environments/ensure.rb

@@ -0,0 +1,27 @@
+# frozen_string_literal: true
+
+require 'rake_factory'
+
+module RakeGithub
+  module Tasks
+    module Environments
+      class Ensure < RakeFactory::Task
+        default_name :ensure
+        default_description(RakeFactory::DynamicValue.new do |t|
+          'Ensure environments are configured on the ' \
+            "#{t.repository} repository"
+        end)
+
+        parameter :repository, required: true
+
+        parameter :provision_task_name, default: :provision
+        parameter :destroy_task_name, default: :destroy
+
+        action do |t, args|
+          t.application[t.destroy_task_name, t.scope].invoke(*args)
+          t.application[t.provision_task_name, t.scope].invoke(*args)
+        end
+      end
+    end
+  end
+end

data/lib/rake_github/tasks/environments/provision.rb

@@ -0,0 +1,83 @@
+# frozen_string_literal: true
+
+require 'rake_factory'
+require 'octokit'
+
+module RakeGithub
+  module Tasks
+    module Environments
+      class Provision < RakeFactory::Task
+        default_name :provision
+        default_description(RakeFactory::DynamicValue.new do |t|
+          "Provision environments to the #{t.repository} repository"
+        end)
+
+        parameter :repository, required: true
+        parameter :access_token, required: true
+        parameter :environments, default: []
+
+        action do |t|
+          client = Octokit::Client.new(access_token:)
+          org = t.repository.split('/').first
+
+          $stdout.puts 'Provisioning specified environments on the ' \
+                       "'#{t.repository}' repository... "
+          t.environments.each do |environment|
+            $stdout.print "Adding '#{environment[:name]}'... "
+            client.create_or_update_environment(
+              t.repository,
+              environment[:name],
+              environment_options(client, org, environment)
+            )
+            $stdout.puts 'Done.'
+          end
+        end
+
+        private
+
+        def environment_options(client, org, environment)
+          {
+            wait_timer: environment[:wait_timer],
+            prevent_self_review: environment[:prevent_self_review],
+            reviewers: resolve_reviewers(client, org, environment[:reviewers]),
+            deployment_branch_policy: environment[:deployment_branch_policy]
+          }.compact
+        end
+
+        def resolve_reviewers(client, org, reviewers)
+          return nil if reviewers.nil? || reviewers.empty?
+
+          reviewers.map { |reviewer| resolve_reviewer(client, org, reviewer) }
+        end
+
+        def resolve_reviewer(client, org, reviewer)
+          if reviewer[:team]
+            { type: 'Team', id: resolve_team_id(client, org, reviewer[:team]) }
+          elsif reviewer[:user]
+            { type: 'User', id: resolve_user_id(client, reviewer[:user]) }
+          else
+            raise(ArgumentError,
+                  "invalid reviewer: #{reviewer.inspect} " \
+                  '(must have :team or :user)')
+          end
+        end
+
+        def resolve_team_id(client, org, slug)
+          team_ids[slug] ||= client.team_by_name(org, slug).id
+        end
+
+        def resolve_user_id(client, login)
+          user_ids[login] ||= client.user(login).id
+        end
+
+        def team_ids
+          @team_ids ||= {}
+        end
+
+        def user_ids
+          @user_ids ||= {}
+        end
+      end
+    end
+  end
+end

data/lib/rake_github/tasks/environments.rb

@@ -0,0 +1,5 @@
+# frozen_string_literal: true
+
+require_relative 'environments/provision'
+require_relative 'environments/destroy'
+require_relative 'environments/ensure'

data/lib/rake_github/tasks/secrets/destroy.rb

@@ -0,0 +1,48 @@
+# frozen_string_literal: true
+
+require 'rake_factory'
+require 'octokit'
+
+module RakeGithub
+  module Tasks
+    module Secrets
+      class Destroy < RakeFactory::Task
+        default_name :destroy
+        default_description(RakeFactory::DynamicValue.new do |t|
+          "Destroys secrets from the #{t.repository} repository"
+        end)
+
+        parameter :repository, required: true
+        parameter :access_token, required: true
+        parameter :secrets, default: []
+
+        action do |t|
+          client = Octokit::Client.new(access_token:)
+
+          $stdout.puts 'Removing specified secrets from the ' \
+                       "'#{t.repository}' repository... "
+          t.secrets.each do |secret|
+            $stdout.print "Removing '#{secret[:name]}'... "
+            delete_actions_secret(client, t.repository, secret[:name])
+            delete_dependabot_secret(client, t.repository, secret[:name])
+            $stdout.puts 'Done.'
+          end
+        end
+
+        private
+
+        def delete_actions_secret(client, repository, name)
+          client.delete_actions_secret(repository, name)
+        rescue Octokit::NotFound
+          nil
+        end
+
+        def delete_dependabot_secret(client, repository, name)
+          client.delete_dependabot_secret(repository, name)
+        rescue Octokit::NotFound
+          nil
+        end
+      end
+    end
+  end
+end

data/lib/rake_github/tasks/secrets/ensure.rb

@@ -0,0 +1,27 @@
+# frozen_string_literal: true
+
+require 'rake_factory'
+
+module RakeGithub
+  module Tasks
+    module Secrets
+      class Ensure < RakeFactory::Task
+        default_name :ensure
+        default_description(RakeFactory::DynamicValue.new do |t|
+          'Ensure secrets are configured on the ' \
+            "#{t.repository} repository"
+        end)
+
+        parameter :repository, required: true
+
+        parameter :provision_task_name, default: :provision
+        parameter :destroy_task_name, default: :destroy
+
+        action do |t, args|
+          t.application[t.destroy_task_name, t.scope].invoke(*args)
+          t.application[t.provision_task_name, t.scope].invoke(*args)
+        end
+      end
+    end
+  end
+end

data/lib/rake_github/tasks/secrets/provision.rb

@@ -0,0 +1,83 @@
+# frozen_string_literal: true
+
+require 'base64'
+require 'rake_factory'
+require 'octokit'
+
+module RakeGithub
+  module Tasks
+    module Secrets
+      class Provision < RakeFactory::Task
+        default_name :provision
+        default_description(RakeFactory::DynamicValue.new do |t|
+          "Provision secrets to the #{t.repository} repository"
+        end)
+
+        parameter :repository, required: true
+        parameter :access_token, required: true
+        parameter :secrets, default: []
+
+        action do |t|
+          client = Octokit::Client.new(access_token:)
+
+          $stdout.puts 'Provisioning specified secrets on the ' \
+                       "'#{t.repository}' repository... "
+          provision_actions_secrets(client, t)
+          provision_dependabot_secrets(client, t)
+        end
+
+        private
+
+        def provision_actions_secrets(client, task)
+          public_key = client.get_actions_public_key(task.repository)
+          task.secrets.each do |secret|
+            $stdout.print "Adding '#{secret[:name]}' to Actions... "
+            client.create_or_update_actions_secret(
+              task.repository,
+              secret[:name],
+              secret_options(public_key, secret[:value])
+            )
+            $stdout.puts 'Done.'
+          end
+        end
+
+        def provision_dependabot_secrets(client, task)
+          secrets = task.secrets.select { |secret| secret[:dependabot] }
+          return if secrets.empty?
+
+          public_key = client.get_dependabot_public_key(task.repository)
+          secrets.each do |secret|
+            write_dependabot_secret(client, task, public_key, secret)
+          end
+        end
+
+        def write_dependabot_secret(client, task, public_key, secret)
+          $stdout.print "Adding '#{secret[:name]}' to Dependabot... "
+          client.create_or_update_dependabot_secret(
+            task.repository,
+            secret[:name],
+            secret_options(public_key, secret[:value])
+          )
+          $stdout.puts 'Done.'
+        end
+
+        def secret_options(public_key, value)
+          {
+            key_id: public_key.key_id,
+            encrypted_value: encrypt(public_key.key, value)
+          }
+        end
+
+        def encrypt(base64_public_key, value)
+          require 'rbnacl'
+
+          decoded_key = Base64.decode64(base64_public_key)
+          box = RbNaCl::Boxes::Sealed.from_public_key(
+            RbNaCl::PublicKey.new(decoded_key)
+          )
+          Base64.strict_encode64(box.encrypt(value))
+        end
+      end
+    end
+  end
+end

data/lib/rake_github/tasks/secrets.rb

@@ -0,0 +1,5 @@
+# frozen_string_literal: true
+
+require_relative 'secrets/provision'
+require_relative 'secrets/destroy'
+require_relative 'secrets/ensure'

data/lib/rake_github/tasks.rb

@@ -3,3 +3,5 @@
 require_relative 'tasks/deploy_keys'
 require_relative 'tasks/releases'
 require_relative 'tasks/pull_requests'
+require_relative 'tasks/secrets'
+require_relative 'tasks/environments'

data/lib/rake_github/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module RakeGithub
-  VERSION = '0.16.0.pre.3'
+  VERSION = '0.16.0.pre.4'
 end

data/lib/rake_github.rb

@@ -10,6 +10,14 @@ module RakeGithub
     RakeGithub::TaskSets::DeployKeys.define(opts, &)
   end
 
+  def self.define_secrets_tasks(opts = {}, &)
+    RakeGithub::TaskSets::Secrets.define(opts, &)
+  end
+
+  def self.define_environments_tasks(opts = {}, &)
+    RakeGithub::TaskSets::Environments.define(opts, &)
+  end
+
   def self.define_repository_tasks(opts = {}, &)
     RakeGithub::TaskSets::Repository.define(opts, &)
   end

data/rake_github.gemspec

@@ -36,8 +36,9 @@ Gem::Specification.new do |spec|
   spec.required_ruby_version = '>= 3.1'
 
   spec.add_dependency 'colored2', '~> 3.1'
-  spec.add_dependency 'octokit', '>= 4.16', '< 11.0'
+  spec.add_dependency 'octokit', '>= 7.0', '< 11.0'
   spec.add_dependency 'rake_factory', '~> 0.33'
+  spec.add_dependency 'rbnacl', '~> 7.1'
   spec.add_dependency 'sshkey', '~> 2.0'
 
   spec.add_development_dependency 'activesupport'

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rake_github
 version: !ruby/object:Gem::Version
-  version: 0.16.0.pre.3
+  version: 0.16.0.pre.4
 platform: ruby
 authors:
 - InfraBlocks Maintainers
@@ -30,7 +30,7 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '4.16'
+        version: '7.0'
     - - "<"
       - !ruby/object:Gem::Version
         version: '11.0'
@@ -40,7 +40,7 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '4.16'
+        version: '7.0'
     - - "<"
       - !ruby/object:Gem::Version
         version: '11.0'
@@ -58,6 +58,20 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '0.33'
+- !ruby/object:Gem::Dependency
+  name: rbnacl
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '7.1'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '7.1'
 - !ruby/object:Gem::Dependency
   name: sshkey
   requirement: !ruby/object:Gem::Requirement
@@ -317,16 +331,26 @@ files:
 - lib/rake_github/exceptions/required_argument_unset.rb
 - lib/rake_github/task_sets.rb
 - lib/rake_github/task_sets/deploy_keys.rb
+- lib/rake_github/task_sets/environments.rb
 - lib/rake_github/task_sets/repository.rb
+- lib/rake_github/task_sets/secrets.rb
 - lib/rake_github/tasks.rb
 - lib/rake_github/tasks/deploy_keys.rb
 - lib/rake_github/tasks/deploy_keys/destroy.rb
 - lib/rake_github/tasks/deploy_keys/ensure.rb
 - lib/rake_github/tasks/deploy_keys/provision.rb
+- lib/rake_github/tasks/environments.rb
+- lib/rake_github/tasks/environments/destroy.rb
+- lib/rake_github/tasks/environments/ensure.rb
+- lib/rake_github/tasks/environments/provision.rb
 - lib/rake_github/tasks/pull_requests.rb
 - lib/rake_github/tasks/pull_requests/merge.rb
 - lib/rake_github/tasks/releases.rb
 - lib/rake_github/tasks/releases/create.rb
+- lib/rake_github/tasks/secrets.rb
+- lib/rake_github/tasks/secrets/destroy.rb
+- lib/rake_github/tasks/secrets/ensure.rb
+- lib/rake_github/tasks/secrets/provision.rb
 - lib/rake_github/version.rb
 - rake_github.gemspec
 homepage: https://github.com/infrablocks/rake_github