feat(github): add method to delete repository/org secrets

Author: dclong

.claude/settings.json

@@ -1,10 +1,25 @@
 """Simple wrapper of GitHub REST APIs."""
 
 from abc import ABCMeta, abstractmethod
+from base64 import b64encode
+from collections.abc import Sequence
 from enum import StrEnum
 from typing import Any, Callable
 from pathlib import Path
 import requests
+from nacl import encoding, public
+
+URL_API = "https://api.github.com"
+
+
+def _encrypt_secret(public_key: str, value: str) -> str:
+    """Encrypt a secret value using a LibSodium sealed box.
+    :param public_key: The base64-encoded public key to encrypt against.
+    :param value: The plaintext secret value to encrypt.
+    """
+    pkey = public.PublicKey(public_key.encode(), encoding.Base64Encoder)
+    encrypted = public.SealedBox(pkey).encrypt(value.encode())
+    return b64encode(encrypted).decode()
 
 
 def build_http_headers(token: str) -> dict[str, str]:
@@ -67,11 +82,12 @@ def _delete(self, url, raise_for_status: bool = True) -> requests.Response:
             resp.raise_for_status()
         return resp
 
-    def _put(self, url, raise_for_status: bool = True) -> requests.Response:
+    def _put(self, url, raise_for_status: bool = True, **kwargs) -> requests.Response:
         resp = requests.put(
             url=url,
             headers=self._headers,
             timeout=10,
+            **kwargs,
         )
         if raise_for_status:
             resp.raise_for_status()
@@ -118,15 +134,15 @@ def __init__(self, token: str, repo: str):
         """
         super().__init__(token)
         self._repo = repo
-        self._url = "https://api.github.com/repos"
-        self._url_repo = f"{self._url}/{repo}"
+        self._url_repo = f"{URL_API}/repos/{repo}"
         self._url_tags = f"{self._url_repo}/tags"
         self._url_transfer = f"{self._url_repo}/transfer"
         self._url_pull = f"{self._url_repo}/pulls"
         self._url_branches = f"{self._url_repo}/branches"
         self._url_refs = f"{self._url_repo}/git/refs"
         self._url_issues = f"{self._url_repo}/issues"
         self._url_releases = f"{self._url_repo}/releases"
+        self._url_secrets = f"{self._url_repo}/actions/secrets"
 
     def get_releases(self, n: int = 0) -> list[dict[str, Any]]:
         """List releases in this repository."""
@@ -171,7 +187,9 @@ def upload_release_asset(
             path = Path(path)
         with path.open(mode="rb") as fin:
             return self._post(
-                url=f"{self._url_releases.replace('api', 'uploads', 1)}/{release}/assets",
+                url=f"{self._url_releases.replace('api', 'uploads', 1)}/{
+                    release
+                }/assets",
                 params={
                     "name": name,
                 },
@@ -284,6 +302,38 @@ def delete_branch(self, branch: str) -> requests.Response:
         """
         return self.delete_ref(ref=f"heads/{branch}")
 
+    def delete_secret(self, name: str) -> requests.Response:
+        """Delete a secret from this repository.
+        :param name: The name of the secret to delete.
+        """
+        if not isinstance(name, str):
+            raise ValueError("A string value is required for `name`.")
+        return self._delete(
+            url=f"{self._url_secrets}/{name}",
+        )
+
+    def get_secret_public_key(self) -> dict[str, Any]:
+        """Get the public key for encrypting secrets in this repository."""
+        return self._get(url=f"{self._url_secrets}/public-key").json()
+
+    def create_or_update_secret(self, name: str, value: str) -> requests.Response:
+        """Create or update a secret in this repository.
+        :param name: The name of the secret.
+        :param value: The plaintext value of the secret.
+        """
+        if not isinstance(name, str):
+            raise ValueError("A string value is required for `name`.")
+        if not isinstance(value, str):
+            raise ValueError("A string value is required for `value`.")
+        key = self.get_secret_public_key()
+        return self._put(
+            url=f"{self._url_secrets}/{name}",
+            json={
+                "encrypted_value": _encrypt_secret(key["key"], value),
+                "key_id": key["key_id"],
+            },
+        )
+
     def pr_has_change(
         self, pr_number: int, pred: Callable[[str], bool] = lambda _: True
     ) -> bool:
@@ -354,6 +404,7 @@ def __init__(self, token: str, owner: str):
         """
         super().__init__(token)
         self._owner = owner
+        self._url_owner = ""
         self._url_repos = ""
         self._url_create_repo = ""
 
@@ -400,8 +451,9 @@ def __init__(self, token: str, user: str):
         self._set_urls()
 
     def _set_urls(self) -> None:
-        self._url_repos = f"https://api.github.com/users/{self._owner}/repos"
-        self._url_create_repo = "https://api.github.com/user/repos"
+        self._url_owner = f"{URL_API}/users/{self._owner}"
+        self._url_repos = f"{self._url_owner}/repos"
+        self._url_create_repo = f"{URL_API}/user/repos"
 
 
 class Organization(Owner):
@@ -416,5 +468,53 @@ def __init__(self, token: str, org: str):
         self._set_urls()
 
     def _set_urls(self) -> None:
-        self._url_repos = f"https://api.github.com/orgs/{self._owner}/repos"
+        self._url_owner = f"{URL_API}/orgs/{self._owner}"
+        self._url_repos = f"{self._url_owner}/repos"
         self._url_create_repo = self._url_repos
+        self._url_secrets = f"{self._url_owner}/actions/secrets"
+
+    def delete_secret(self, name: str) -> requests.Response:
+        """Delete an organization secret.
+        :param name: The name of the secret to delete.
+        """
+        if not isinstance(name, str):
+            raise ValueError("A string value is required for `name`.")
+        return self._delete(
+            url=f"{self._url_secrets}/{name}",
+        )
+
+    def get_secret_public_key(self) -> dict[str, Any]:
+        """Get the public key for encrypting secrets in this organization."""
+        return self._get(url=f"{self._url_secrets}/public-key").json()
+
+    def create_or_update_secret(
+        self,
+        name: str,
+        value: str,
+        visibility: str = "all",
+        selected_repository_ids: Sequence[int] = (),
+    ) -> requests.Response:
+        """Create or update an organization secret.
+        :param name: The name of the secret.
+        :param value: The plaintext value of the secret.
+        :param visibility: Which repositories can access the secret
+            (all, private, or selected).
+        :param selected_repository_ids: Repository IDs that can access the secret
+            when visibility is `selected`.
+        """
+        if not isinstance(name, str):
+            raise ValueError("A string value is required for `name`.")
+        if not isinstance(value, str):
+            raise ValueError("A string value is required for `value`.")
+        key = self.get_secret_public_key()
+        json: dict[str, Any] = {
+            "encrypted_value": _encrypt_secret(key["key"], value),
+            "key_id": key["key_id"],
+            "visibility": visibility,
+        }
+        if selected_repository_ids:
+            json["selected_repository_ids"] = list(selected_repository_ids)
+        return self._put(
+            url=f"{self._url_secrets}/{name}",
+            json=json,
+        )

github_rest_api/github.py

@@ -18,6 +18,7 @@ classifiers = [
 dependencies = [
   "dulwich>=0.25.1",
   "psutil>=5.9.4",
+  "pynacl>=1.5",
   "pyyaml>=6",
   "requests>=2.28.2",
   "tenacity>=9.1.4",