(client *api.RESTClient, owner, repo string)
| 229 | } |
| 230 | |
| 231 | func getRepoPublicKey(client *api.RESTClient, owner, repo string) (*repoPublicKey, error) { |
| 232 | var key repoPublicKey |
| 233 | path := fmt.Sprintf("repos/%s/%s/actions/secrets/public-key", owner, repo) |
| 234 | if err := client.Get(path, &key); err != nil { |
| 235 | return nil, fmt.Errorf("get public key: %w", err) |
| 236 | } |
| 237 | if key.ID == "" || key.Key == "" { |
| 238 | return nil, errors.New("public key response missing key_id or key") |
| 239 | } |
| 240 | return &key, nil |
| 241 | } |
| 242 | |
| 243 | // encryptWithPublicKey encrypts plaintext using NaCl's sealed box construction |
| 244 | // (Curve25519 + XSalsa20 + Poly1305) as required by GitHub's Actions Secrets API. |
no test coverage detected