| 161 | } |
| 162 | |
| 163 | func resolveSecretValueForSet(fromEnv, fromFlag string) (string, error) { |
| 164 | if fromEnv != "" { |
| 165 | v := os.Getenv(fromEnv) |
| 166 | if v == "" { |
| 167 | return "", fmt.Errorf("environment variable %s is not set or empty", fromEnv) |
| 168 | } |
| 169 | return v, nil |
| 170 | } |
| 171 | |
| 172 | if fromFlag != "" { |
| 173 | return fromFlag, nil |
| 174 | } |
| 175 | |
| 176 | // Check if stdin is connected to a terminal (interactive mode) |
| 177 | info, err := os.Stdin.Stat() |
| 178 | if err != nil { |
| 179 | return "", err |
| 180 | } |
| 181 | |
| 182 | isTerminal := (info.Mode() & os.ModeCharDevice) != 0 |
| 183 | |
| 184 | // If we're in an interactive terminal, use Huh for a better UX with password masking |
| 185 | if isTerminal && tty.IsStderrTerminal() { |
| 186 | secretSetLog.Print("Using interactive password prompt with Huh") |
| 187 | value, err := console.PromptSecretInput( |
| 188 | "Enter secret value", |
| 189 | "The value will be encrypted and stored in the repository", |
| 190 | ) |
| 191 | if err != nil { |
| 192 | secretSetLog.Printf("Interactive prompt failed: %v", err) |
| 193 | return "", fmt.Errorf("failed to read secret value: %w", err) |
| 194 | } |
| 195 | return value, nil |
| 196 | } |
| 197 | |
| 198 | // Fallback to non-interactive stdin reading (piped input or non-TTY) |
| 199 | secretSetLog.Print("Using non-interactive stdin reading") |
| 200 | if isTerminal { |
| 201 | fmt.Fprintln(os.Stderr, "Enter secret value, then press Ctrl+D:") |
| 202 | } |
| 203 | |
| 204 | reader := io.Reader(os.Stdin) |
| 205 | data, err := io.ReadAll(reader) |
| 206 | if err != nil { |
| 207 | return "", err |
| 208 | } |
| 209 | |
| 210 | value := strings.TrimRight(string(data), "\r\n") |
| 211 | if value == "" { |
| 212 | return "", errors.New("secret value is empty") |
| 213 | } |
| 214 | return value, nil |
| 215 | } |
| 216 | |
| 217 | func setRepoSecret(client *api.RESTClient, owner, repo, name, value string) error { |
| 218 | pubKey, err := getRepoPublicKey(client, owner, repo) |