alchemy 0.1.13 → 0.1.14

package/src/github/client.ts

@@ -0,0 +1,115 @@
+import { Octokit } from "@octokit/rest";
+import { exec } from "child_process";
+import { promisify } from "util";
+
+// Convert exec to promise-based
+const execAsync = promisify(exec);
+
+/**
+ * Try to get a GitHub token from the GitHub CLI
+ */
+export async function getGitHubTokenFromCLI(): Promise<string | null> {
+  try {
+    // Check if GitHub CLI is installed
+    const { stdout: ghVersion } = await execAsync("gh --version");
+    if (!ghVersion) return null;
+
+    // Get the auth token
+    const { stdout: token } = await execAsync("gh auth token");
+    return token?.trim() || null;
+  } catch (error) {
+    return null;
+  }
+}
+
+/**
+ * Get GitHub authentication token with the following priority:
+ * 1. Explicit token provided in props
+ * 2. GITHUB_ACCESS_TOKEN environment variable (for actions with admin permissions)
+ * 3. GITHUB_TOKEN environment variable
+ * 4. GitHub CLI token (if gh is installed and authenticated)
+ *
+ * @param token Optional token to use
+ * @returns The resolved token or null if not available
+ */
+export async function getGitHubToken(token?: string): Promise<string | null> {
+  return (
+    token ||
+    process.env.GITHUB_ACCESS_TOKEN ||
+    process.env.GITHUB_TOKEN ||
+    (await getGitHubTokenFromCLI())
+  );
+}
+
+/**
+ * Create an authenticated Octokit client
+ *
+ * @param options Options for creating the client
+ * @returns An authenticated Octokit client
+ */
+export async function createGitHubClient(
+  options: { token?: string } = {},
+): Promise<Octokit> {
+  const token = await getGitHubToken(options.token);
+
+  return new Octokit({
+    auth: token,
+  });
+}
+
+/**
+ * Verifies GitHub authentication and provides helpful error messages
+ *
+ * @param octokit Octokit client
+ * @param owner Repository owner
+ * @param repo Repository name
+ */
+export async function verifyGitHubAuth(
+  octokit: Octokit,
+  owner: string,
+  repo: string,
+): Promise<void> {
+  try {
+    // Make a test request to check authentication
+    await octokit.rest.repos.get({
+      owner,
+      repo,
+    });
+  } catch (error: any) {
+    if (error.status === 401) {
+      console.error(
+        "\n⚠️ GitHub authentication failed. Please try one of the following:",
+      );
+      console.error(
+        "1. Run 'gh auth login' to authenticate with the GitHub CLI",
+      );
+      console.error(
+        "2. Set the GITHUB_TOKEN environment variable with a personal access token",
+      );
+      console.error("3. Pass a token directly to the constructor");
+      console.error(
+        "\nTo create a token, visit: https://github.com/settings/tokens",
+      );
+      console.error(
+        "Required scopes: 'repo' for private repos or 'public_repo' for public repos\n",
+      );
+      throw new Error("GitHub authentication failed");
+    } else if (error.status === 403) {
+      console.error(
+        "\n⚠️ Insufficient permissions. You need admin access to the repository.",
+      );
+      console.error(
+        "Make sure your token has the 'repo' scope for private repos or 'public_repo' for public repos\n",
+      );
+      throw new Error("Insufficient GitHub permissions");
+    } else if (error.status === 404) {
+      console.error(`\n⚠️ Repository not found: ${owner}/${repo}`);
+      console.error(
+        "Make sure the repository exists and you have access to it\n",
+      );
+      throw new Error("GitHub repository not found");
+    } else {
+      throw error;
+    }
+  }
+}

package/src/github/index.ts

@@ -0,0 +1 @@
+export * from "./secret";

package/src/github/secret.ts

@@ -0,0 +1,172 @@
+import sodium from "libsodium-wrappers";
+import { type Context, Resource } from "../resource";
+import { createGitHubClient, verifyGitHubAuth } from "./client";
+
+/**
+ * Properties for creating or updating a GitHub Secret
+ */
+export interface GitHubSecretProps {
+  /**
+   * Repository owner (user or organization)
+   */
+  owner: string;
+
+  /**
+   * Repository name
+   */
+  repository: string;
+
+  /**
+   * Secret name
+   */
+  name: string;
+
+  /**
+   * Secret value (will be stored securely on GitHub)
+   */
+  value: string;
+
+  /**
+   * Optional GitHub API token (overrides environment variable)
+   */
+  token?: string;
+}
+
+/**
+ * Output returned after Secret creation/update
+ */
+export interface GitHubSecretOutput extends Omit<GitHubSecretProps, "value"> {
+  /**
+   * The ID of the resource
+   */
+  id: string;
+
+  /**
+   * Time at which the object was created/updated
+   */
+  updatedAt: string;
+}
+
+/**
+ * Encrypt a value for GitHub using libsodium
+ * Based on GitHub's documentation for encrypting secrets
+ *
+ * @param value - The secret value to encrypt
+ * @param publicKey - The base64-encoded public key from GitHub
+ * @returns The base64-encoded encrypted value
+ */
+async function encryptValue(value: string, publicKey: string): Promise<string> {
+  // Initialize libsodium
+  await sodium.ready;
+
+  // Convert the public key from base64 to binary
+  const binKey = sodium.from_base64(publicKey, sodium.base64_variants.ORIGINAL);
+
+  // Convert the message to a Uint8Array
+  const binMessage = sodium.from_string(value);
+
+  // Encrypt the message with the public key using libsodium's sealed box
+  const encryptedBin = sodium.crypto_box_seal(binMessage, binKey);
+
+  // Convert the encrypted message to base64
+  return sodium.to_base64(encryptedBin, sodium.base64_variants.ORIGINAL);
+}
+
+/**
+ * Resource for managing GitHub repository secrets
+ */
+export class GitHubSecret extends Resource(
+  "github::Secret",
+  async (
+    ctx: Context<GitHubSecretOutput>,
+    props: GitHubSecretProps,
+  ): Promise<GitHubSecretOutput | void> => {
+    // Create authenticated Octokit client - will automatically handle token resolution
+    const octokit = await createGitHubClient({ token: props.token });
+
+    // Verify authentication and permissions
+    if (!ctx.quiet) {
+      await verifyGitHubAuth(octokit, props.owner, props.repository);
+    }
+
+    if (ctx.event === "delete") {
+      if (ctx.output?.id) {
+        try {
+          // Delete the secret
+          await octokit.rest.actions.deleteRepoSecret({
+            owner: props.owner,
+            repo: props.repository,
+            secret_name: props.name,
+          });
+        } catch (error: any) {
+          // Ignore 404 errors (secret already deleted)
+          if (error.status === 404) {
+            console.log("Secret doesn't exist, ignoring");
+          } else {
+            throw error;
+          }
+        }
+      }
+
+      // Return void (a deleted resource has no content)
+      return undefined;
+    } else {
+      try {
+        // Get the repository's public key for encrypting secrets
+        const { data: publicKey } = await octokit.rest.actions.getRepoPublicKey(
+          {
+            owner: props.owner,
+            repo: props.repository,
+          },
+        );
+
+        // Encrypt the secret value using libsodium
+        const encryptedValue = await encryptValue(props.value, publicKey.key);
+
+        // Create or update the secret with the encrypted value and key_id
+        const response = await octokit.rest.actions.createOrUpdateRepoSecret({
+          owner: props.owner,
+          repo: props.repository,
+          secret_name: props.name,
+          encrypted_value: encryptedValue,
+          key_id: publicKey.key_id,
+        });
+
+        // Log success
+        if (!ctx.quiet) {
+          console.log(`Successfully created/updated secret: ${props.name}`);
+        }
+
+        // GitHub doesn't return the secret details on create/update, so we need to construct it
+        const output: GitHubSecretOutput = {
+          id: `${props.owner}/${props.repository}/${props.name}`,
+          owner: props.owner,
+          repository: props.repository,
+          name: props.name,
+          token: props.token,
+          updatedAt: new Date().toISOString(),
+        };
+
+        return output;
+      } catch (error: any) {
+        if (
+          error.status === 403 &&
+          error.message?.includes("Must have admin rights")
+        ) {
+          console.error(
+            "\n⚠️ Error creating/updating GitHub secret: You must have admin rights to the repository.",
+          );
+          console.error(
+            "Make sure your GitHub token has the required permissions (repo scope for private repos).\n",
+          );
+        } else {
+          console.error(
+            "Error creating/updating GitHub secret:",
+            error.message,
+          );
+        }
+        throw error;
+      }
+    }
+  },
+) {}

package/src/utils/retry.ts

@@ -0,0 +1,36 @@
+/**
+ * Utility function for exponential backoff retry
+ * Retries an operation with exponential backoff when a retryable error occurs
+ *
+ * @param operation The async operation to execute and potentially retry
+ * @param isRetryable Function to determine if an error should trigger a retry
+ * @param maxAttempts Maximum number of attempts before giving up
+ * @param initialDelayMs Initial delay in milliseconds before first retry
+ * @returns Result of the operation
+ * @throws The last error encountered if all retries fail
+ */
+export async function withExponentialBackoff<T>(
+  operation: () => Promise<T>,
+  isRetryable: (error: any) => boolean,
+  maxAttempts = 5,
+  initialDelayMs = 100,
+): Promise<T> {
+  let attempt = 0;
+  let delay = initialDelayMs;
+
+  while (true) {
+    try {
+      return await operation();
+    } catch (error) {
+      attempt++;
+      if (attempt >= maxAttempts || !isRetryable(error)) {
+        throw error;
+      }
+
+      // Exponential backoff with jitter
+      const jitter = Math.random() * 0.1 * delay;
+      await new Promise((resolve) => setTimeout(resolve, delay + jitter));
+      delay *= 2; // Double the delay for next attempt
+    }
+  }
+}