create-op-node 0.10.15 → 0.10.17

package/dist/cli.js

@@ -4,6 +4,7 @@ import pc2 from 'picocolors';
 import * as p3 from '@clack/prompts';
 import { execa } from 'execa';
 import { Octokit } from '@octokit/rest';
+import _sodium from 'libsodium-wrappers';
 import { randomBytes, createHmac } from 'crypto';
 import { join, resolve, dirname } from 'path';
 import { mkdir, writeFile, access, chmod, rename, rm } from 'fs/promises';
@@ -443,25 +444,54 @@ async function createRepoFromTemplate(input) {
     defaultBranch: res.data.default_branch ?? "main"
   };
 }
-async function setRepoSecret(input) {
-  const res = await safeExeca(
-    "gh",
-    ["secret", "set", input.name, "--repo", input.repo, "--body", "-"],
-    { input: input.value }
-  );
-  if (res === null) {
+function parseRepoSlug(repo) {
+  const slash = repo.indexOf("/");
+  if (slash <= 0 || slash === repo.length - 1 || repo.indexOf("/", slash + 1) !== -1) return null;
+  return { owner: repo.slice(0, slash), repo: repo.slice(slash + 1) };
+}
+async function setRepoSecrets(input) {
+  const firstName = input.secrets[0]?.name ?? "(none)";
+  const parsed = parseRepoSlug(input.repo);
+  if (!parsed) {
     return {
-      written: false,
-      reason: "`gh` CLI not installed \u2014 install from https://cli.github.com or seed secrets manually"
+      seeded: [],
+      failed: { name: firstName, reason: `invalid repo "${input.repo}" (expected <owner>/<repo>)` }
     };
   }
-  if (res.exitCode !== 0) {
+  const { owner, repo } = parsed;
+  const octokit = client(input.token);
+  let key;
+  try {
+    key = await octokit.actions.getRepoPublicKey({ owner, repo });
+  } catch (err) {
     return {
-      written: false,
-      reason: `gh secret set failed (${res.exitCode ?? "signal"}): ${res.stderr || res.stdout}`
+      seeded: [],
+      failed: { name: firstName, reason: `fetching the repo public key failed: ${err.message}` }
     };
   }
-  return { written: true };
+  await _sodium.ready;
+  const sodium = _sodium;
+  const publicKey = sodium.from_base64(key.data.key, sodium.base64_variants.ORIGINAL);
+  const seeded = [];
+  for (const s of input.secrets) {
+    const encrypted_value = sodium.to_base64(
+      sodium.crypto_box_seal(sodium.from_string(s.value), publicKey),
+      sodium.base64_variants.ORIGINAL
+    );
+    try {
+      await octokit.actions.createOrUpdateRepoSecret({
+        owner,
+        repo,
+        secret_name: s.name,
+        encrypted_value,
+        key_id: key.data.key_id
+      });
+    } catch (err) {
+      return { seeded, failed: { name: s.name, reason: `setting secret ${s.name} failed: ${err.message}` } };
+    }
+    seeded.push(s.name);
+  }
+  return { seeded };
 }
 async function commitFile(input) {
   const [owner, repo] = input.repo.split("/");
@@ -728,7 +758,7 @@ var initCommand = new Command("init").description(
   await confirmPlan({ opts, region, owner, newRepoFull, publicConfig });
   const created = await createRegionRepo({ opts, ghToken, owner, newRepoName, newRepoFull, region });
   if (publicConfig) {
-    await seedRepoSecrets({ publicConfig, newRepoFull });
+    await seedRepoSecrets({ ghToken, publicConfig, newRepoFull });
   }
   const pr = publicConfig ? await openInfraPr({ opts, ghToken, region, newRepoFull, publicConfig, created }) : null;
   await persistPgsodiumKey({ keychain, opts, region });
@@ -889,7 +919,7 @@ async function createRegionRepo(args) {
   }
 }
 async function seedRepoSecrets(args) {
-  const { publicConfig, newRepoFull } = args;
+  const { ghToken, publicConfig, newRepoFull } = args;
   const secrets = [
     { name: "CLOUDFLARE_API_TOKEN", value: publicConfig.cfToken },
     { name: "CLOUDFLARE_ACCOUNT_ID", value: publicConfig.cfAccount },
@@ -899,24 +929,20 @@ async function seedRepoSecrets(args) {
   ];
   const secSpin = p3.spinner();
   secSpin.start(`Seeding ${secrets.length} repo secrets\u2026`);
-  const seeded = [];
-  for (const s of secrets) {
-    const r = await setRepoSecret({ repo: newRepoFull, name: s.name, value: s.value });
-    if (!r.written) {
-      secSpin.stop(pc2.red(`\u2717 Failed to set ${s.name}: ${r.reason ?? "unknown"}`));
-      const remaining = secrets.slice(secrets.findIndex((x) => x.name === s.name)).map((x) => x.name);
-      p3.cancel(
-        [
-          seeded.length > 0 ? `Already seeded on ${newRepoFull}: ${seeded.join(", ")}.` : `Nothing seeded yet on ${newRepoFull}.`,
-          `Still pending: ${remaining.join(", ")}.`,
-          "",
-          `Make sure \`gh\` is installed and signed in (\`gh auth login\`).`,
-          `Re-run with --use-existing-repo to retry (GitHub will overwrite the already-set secrets idempotently).`
-        ].join("\n")
-      );
-      process.exit(1);
-    }
-    seeded.push(s.name);
+  const { seeded, failed } = await setRepoSecrets({ token: ghToken, repo: newRepoFull, secrets });
+  if (failed) {
+    secSpin.stop(pc2.red(`\u2717 Failed to set ${failed.name}: ${failed.reason}`));
+    const remaining = secrets.slice(seeded.length).map((x) => x.name);
+    p3.cancel(
+      [
+        seeded.length > 0 ? `Already seeded on ${newRepoFull}: ${seeded.join(", ")}.` : `Nothing seeded yet on ${newRepoFull}.`,
+        `Still pending: ${remaining.join(", ")}.`,
+        "",
+        `Make sure your --gh-token PAT has "Actions Secrets: write" (fine-grained) or \`repo\` scope (classic).`,
+        `Re-run with --use-existing-repo to retry (GitHub will overwrite the already-set secrets idempotently).`
+      ].join("\n")
+    );
+    process.exit(1);
   }
   secSpin.stop(pc2.green(`\u2713 Seeded ${secrets.length} secrets on ${newRepoFull}`));
 }
@@ -3331,7 +3357,7 @@ function reportResetOutcome(args) {
 
 // src/lib/cosign.ts
 var COSIGN_OIDC_ISSUER = "https://token.actions.githubusercontent.com";
-var DEFAULT_IDENTITY_REGEXP = "^https://github\\.com/OpusPopuli/opuspopuli/\\.github/workflows/.*$";
+var DEFAULT_IDENTITY_REGEXP = "^https://github\\.com/OpusPopuli/opuspopuli/\\.github/workflows/release\\.yml@refs/heads/.*$";
 async function cosignVerifyImage(input) {
   const idRegex = input.certificateIdentityRegexp ?? DEFAULT_IDENTITY_REGEXP;
   const issuer = input.certificateOidcIssuer ?? COSIGN_OIDC_ISSUER;
@@ -4860,7 +4886,7 @@ async function looksLikeRegionsRepo(dir) {
 }
 
 // src/cli.ts
-var VERSION = "0.10.15";
+var VERSION = "0.10.17";
 var program = new Command();
 program.name("create-op-node").description(
   "Interactive bootstrap for an Opus Populi federation node.\nCloudflare infrastructure \u2192 Mac Studio \u2192 live public API."