Function encryptWithPublicKey

pkg/cli/secret_set_command.go:253–269

encryptWithPublicKey encrypts plaintext using NaCl's sealed box construction (Curve25519 + XSalsa20 + Poly1305) as required by GitHub's Actions Secrets API. The encrypted output can only be decrypted by the holder of the private key corresponding to the provided public key. Parameters: - publicKeyB

(publicKeyB64, plaintext string)

//
// Returns base64-encoded ciphertext or error.
func encryptWithPublicKey(publicKeyB64, plaintext string) (string, error) {
	raw, err := base64.StdEncoding.DecodeString(publicKeyB64)
	if err != nil {
		return "", fmt.Errorf("decode public key: %w", err)
	}
	if len(raw) != publicKeySize {
		return "", fmt.Errorf("unexpected public key length: %d, expected %d", len(raw), publicKeySize)
	}

	pk := (*[publicKeySize]byte)(raw[:publicKeySize])
	ciphertext, err := box.SealAnonymous(nil, []byte(plaintext), pk, rand.Reader)
	if err != nil {
		return "", fmt.Errorf("nacl encryption failed: %w", err)
	}

	return base64.StdEncoding.EncodeToString(ciphertext), nil
}

func putRepoSecret(client *api.RESTClient, owner, repo, name, keyID, encryptedValue string) error {
	path := fmt.Sprintf("repos/%s/%s/actions/secrets/%s", owner, repo, name)