fix the remaining batch of resources

Author: nickfloyd

.github/workflows/copy-secrets-to-environment.yml

@@ -0,0 +1,127 @@
+name: Copy Secrets to Release Environment
+
+on:
+  workflow_dispatch:
+    inputs:
+      environment:
+        description: 'Target environment'
+        required: true
+        default: 'release'
+
+jobs:
+  copy-secrets:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      actions: write
+    
+    steps:
+      - name: Install dependencies
+        run: pip3 install PyNaCl requests
+      
+      - name: Copy secrets to environment
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          TARGET_ENV: ${{ inputs.environment }}
+
+          SECRET_GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
+          SECRET_PASSPHRASE: ${{ secrets.PASSPHRASE }}
+
+        run: |
+          python3 << 'EOF'
+          import os
+          import sys
+          import base64
+          import requests
+          from nacl import encoding, public
+
+          def encrypt_secret(public_key: str, secret_value: str) -> str:
+              """Encrypt a secret using the public key."""
+              public_key_bytes = base64.b64decode(public_key)
+              sealed_box = public.SealedBox(public.PublicKey(public_key_bytes))
+              encrypted = sealed_box.encrypt(secret_value.encode("utf-8"))
+              return base64.b64encode(encrypted).decode("utf-8")
+
+          # Get config from environment
+          token = os.environ["GITHUB_TOKEN"]
+          repo = os.environ["GITHUB_REPOSITORY"]
+          target_env = os.environ["TARGET_ENV"]
+          
+          headers = {
+              "Authorization": f"token {token}",
+              "Accept": "application/vnd.github+json",
+              "Content-Type": "application/json"
+          }
+          
+          # Get environment public key
+          print(f"Fetching public key for environment: {target_env}")
+          response = requests.get(
+              f"https://api.github.com/repos/{repo}/environments/{target_env}/secrets/public-key",
+              headers=headers
+          )
+          response.raise_for_status()
+          env_key_data = response.json()
+          env_key = env_key_data["key"]
+          env_key_id = env_key_data["key_id"]
+          
+          print(f"✓ Got public key (ID: {env_key_id})")
+          print()
+          
+          # Get secrets from environment variables (prefixed with SECRET_)
+          secrets_to_copy = {}
+          for key, value in os.environ.items():
+              if key.startswith("SECRET_") and value:
+                  secret_name = key[7:]  # Remove SECRET_ prefix
+                  secrets_to_copy[secret_name] = value
+          
+          if not secrets_to_copy:
+              print("⚠️  No secrets found to copy!")
+              sys.exit(1)
+          
+          print(f"Copying {len(secrets_to_copy)} secret(s) to environment '{target_env}':")
+          print()
+          
+          success_count = 0
+          fail_count = 0
+          
+          for secret_name, secret_value in secrets_to_copy.items():
+              try:
+                  print(f"  • {secret_name} ... ", end="", flush=True)
+                  
+                  # Encrypt the secret
+                  encrypted_value = encrypt_secret(env_key, secret_value)
+                  
+                  # Upload to environment
+                  response = requests.put(
+                      f"https://api.github.com/repos/{repo}/environments/{target_env}/secrets/{secret_name}",
+                      headers=headers,
+                      json={
+                          "encrypted_value": encrypted_value,
+                          "key_id": env_key_id
+                      }
+                  )
+                  
+                  if response.status_code in [201, 204]:
+                      print("✓")
+                      success_count += 1
+                  else:
+                      print(f"✗ (HTTP {response.status_code})")
+                      print(f"    Error: {response.text}")
+                      fail_count += 1
+              
+              except Exception as e:
+                  print(f"✗ (Error: {str(e)})")
+                  fail_count += 1
+          
+          print()
+          print("Summary:")
+          print(f"  ✓ Successfully copied: {success_count}")
+          if fail_count > 0:
+              print(f"  ✗ Failed: {fail_count}")
+          print()
+          
+          if fail_count > 0:
+              sys.exit(1)
+          
+          print("All secrets copied successfully!")
+          EOF