@effected/github 0.3.0 → 0.4.0

package/index.js

@@ -6,6 +6,8 @@ import { InvalidRepoRefError, Repo, RepoRef } from "./Repo.js";
 import { ArtifactMetadata, StorageRecordInput } from "./ArtifactMetadata.js";
 import { Attestation, AttestationListEntry, AttestationRecord } from "./Attestation.js";
 import { Annotation, AnnotationLevel, CheckConclusion, CheckRun, CheckRunOutput, CheckRunRef } from "./CheckRun.js";
+import { CodeScanning } from "./CodeScanning.js";
+import { DeploymentEnvironment } from "./DeploymentEnvironment.js";
 import { GitBranch } from "./GitBranch.js";
 import { CommitRef, FileChange, FileContent, FileDeletion, FileMode, GitCommit } from "./GitCommit.js";
 import { AppIdentity, BotIdentity, GitHubApp, GitHubAppError, Installation, InstallationToken } from "./GitHubApp.js";
@@ -13,12 +15,16 @@ import { CommitComparison, CommitFile, CommitSummary, FileStatus, GitHubCommit }
 import { GitHubContent } from "./GitHubContent.js";
 import { GitHubIssue, IssueInfo, LinkedIssue } from "./GitHubIssue.js";
 import { GitHubRelease, ReleaseAsset, ReleaseInfo } from "./GitHubRelease.js";
-import { GitHubRepository } from "./GitHubRepository.js";
+import { GRAPHQL_ONLY_SETTINGS, GitHubRepository, SECURITY_ANALYSIS_STATUS_FIELDS, transformSecurityAndAnalysis } from "./GitHubRepository.js";
 import { GitTag, SemverTag, TagRef, versionFromTag } from "./GitTag.js";
 import { PageOptions } from "./Rest.js";
 import { MergeMethod, PullRequest, PullRequestInfo } from "./PullRequest.js";
 import { CommentMarker, CommentRecord, PullRequestComment } from "./PullRequestComment.js";
+import { RepositorySecret } from "./RepositorySecret.js";
+import { RepositorySecurity } from "./RepositorySecurity.js";
+import { RepositoryVariable } from "./RepositoryVariable.js";
+import { Ruleset } from "./Ruleset.js";
 import { ExtraPermission, PermissionGap, PermissionLevel, PermissionResult, TokenPermissionError, TokenPermissions } from "./TokenPermissions.js";
 import { WorkflowDispatch, WorkflowRunStatus } from "./WorkflowDispatch.js";
 
-export { Annotation, AnnotationLevel, AppIdentity, ArtifactMetadata, Attestation, AttestationListEntry, AttestationRecord, BotIdentity, CheckConclusion, CheckRun, CheckRunOutput, CheckRunRef, CommentMarker, CommentRecord, CommitComparison, CommitFile, CommitRef, CommitSummary, ExtraPermission, FileChange, FileContent, FileDeletion, FileMode, FileStatus, GitBranch, GitCommit, GitHubApp, GitHubAppError, GitHubClient, GitHubCommit, GitHubContent, GitHubError, GitHubErrorKind, GitHubGraphQLError, GitHubIssue, GitHubRelease, GitHubRepository, GitTag, GraphQLDocument, GraphQLErrorEntry, Installation, InstallationToken, InvalidRepoRefError, IssueInfo, LinkedIssue, MergeMethod, PageOptions, PermissionGap, PermissionLevel, PermissionResult, PullRequest, PullRequestComment, PullRequestInfo, RateLimitSnapshot, ReleaseAsset, ReleaseInfo, Repo, RepoRef, RetryPolicy, SemverTag, StorageRecordInput, TagRef, TokenPermissionError, TokenPermissions, WorkflowDispatch, WorkflowRunStatus, versionFromTag };
+export { Annotation, AnnotationLevel, AppIdentity, ArtifactMetadata, Attestation, AttestationListEntry, AttestationRecord, BotIdentity, CheckConclusion, CheckRun, CheckRunOutput, CheckRunRef, CodeScanning, CommentMarker, CommentRecord, CommitComparison, CommitFile, CommitRef, CommitSummary, DeploymentEnvironment, ExtraPermission, FileChange, FileContent, FileDeletion, FileMode, FileStatus, GRAPHQL_ONLY_SETTINGS, GitBranch, GitCommit, GitHubApp, GitHubAppError, GitHubClient, GitHubCommit, GitHubContent, GitHubError, GitHubErrorKind, GitHubGraphQLError, GitHubIssue, GitHubRelease, GitHubRepository, GitTag, GraphQLDocument, GraphQLErrorEntry, Installation, InstallationToken, InvalidRepoRefError, IssueInfo, LinkedIssue, MergeMethod, PageOptions, PermissionGap, PermissionLevel, PermissionResult, PullRequest, PullRequestComment, PullRequestInfo, RateLimitSnapshot, ReleaseAsset, ReleaseInfo, Repo, RepoRef, RepositorySecret, RepositorySecurity, RepositoryVariable, RetryPolicy, Ruleset, SECURITY_ANALYSIS_STATUS_FIELDS, SemverTag, StorageRecordInput, TagRef, TokenPermissionError, TokenPermissions, WorkflowDispatch, WorkflowRunStatus, transformSecurityAndAnalysis, versionFromTag };

package/internal/crypto.js

@@ -0,0 +1,63 @@
+import { Encoding, Result } from "effect";
+import blakejs from "blakejs";
+import nacl from "tweetnacl";
+
+//#region src/internal/crypto.ts
+const { blake2b } = blakejs;
+/** A sealed box opens with the recipient's key; the nonce is derived, not sent. */
+const NONCE_BYTES = 24;
+const PUBLIC_KEY_BYTES = 32;
+const utf8 = new TextEncoder();
+/**
+* Encrypt a secret with libsodium's sealed-box algorithm, the format GitHub's
+* secrets API requires.
+*
+* @remarks
+* A sealed box is `ephemeral_public_key (32 bytes) || ciphertext`. The sender
+* mints a throwaway keypair, derives the nonce deterministically from both
+* public keys, encrypts with `crypto_box`, and discards the ephemeral secret
+* key — so nobody, including this process a moment later, can decrypt what it
+* just wrote. Only the holder of `publicKey`'s private half can.
+*
+* The nonce is `blake2b(ephemeral_pk || recipient_pk, 24)`. It is **derived**
+* rather than random because the recipient has to recompute it from the two
+* public keys alone, having received no nonce alongside the box. Both the
+* concatenation order and the 24-byte length are fixed by the libsodium
+* specification — changing either produces a box GitHub accepts and cannot
+* decrypt, which is a silent failure that surfaces as a workflow reading a
+* corrupt secret rather than as an error here.
+*
+* ## Nothing here is Node-specific
+*
+* Base64 goes through core's `Encoding` and text through `TextEncoder`, so this
+* module imports **no builtin**. That is deliberate: an earlier draft used
+* `node:buffer` and was the only thing in this package's reachable graph tying
+* it to a runtime — neither `blakejs` (pure JS; its `util` is a *relative*
+* file) nor `tweetnacl` (which feature-detects `getRandomValues` and falls back
+* to Node's `crypto` only when there is no WebCrypto) locks it.
+*
+* A malformed `publicKey` fails as a typed `Result` rather than throwing:
+* garbage from the API is input, and input failures are typed.
+*
+* @param publicKey - The repository, environment or organization public key,
+* base64, as returned by GitHub's `.../secrets/public-key` endpoints.
+* @param secretValue - The plaintext to seal.
+* @returns The sealed box, base64, ready to send as `encrypted_value`.
+*
+* @internal
+*/
+const encryptSecret = (publicKey, secretValue) => Result.map(Encoding.decodeBase64(publicKey), (publicKeyBytes) => {
+	const ephemeralKeyPair = nacl.box.keyPair();
+	const nonceInput = /* @__PURE__ */ new Uint8Array(64);
+	nonceInput.set(ephemeralKeyPair.publicKey);
+	nonceInput.set(publicKeyBytes, PUBLIC_KEY_BYTES);
+	const nonce = blake2b(nonceInput, void 0, NONCE_BYTES);
+	const ciphertext = nacl.box(utf8.encode(secretValue), nonce, publicKeyBytes, ephemeralKeyPair.secretKey);
+	const sealed = new Uint8Array(ephemeralKeyPair.publicKey.length + ciphertext.length);
+	sealed.set(ephemeralKeyPair.publicKey);
+	sealed.set(ciphertext, ephemeralKeyPair.publicKey.length);
+	return Encoding.encodeBase64(sealed);
+});
+
+//#endregion
+export { encryptSecret };

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@effected/github",
-	"version": "0.3.0",
+	"version": "0.4.0",
 	"private": false,
 	"description": "Typed GitHub REST and GraphQL services over the octokit core request surface, with app auth and resource helpers.",
 	"keywords": [
@@ -42,6 +42,8 @@
 		"@octokit/core": "^7.0.6",
 		"@octokit/plugin-paginate-rest": "^14.0.0",
 		"@octokit/types": "^16.0.0",
+		"blakejs": "1.2.1",
+		"tweetnacl": "1.0.3",
 		"universal-github-app-jwt": "^2.2.2"
 	},
 	"peerDependencies": {