setup-secrets.py

#!/usr/bin/env python3

"""
GitHub Secrets Setup Script
Sets all required secrets for Cloudflare deployment via GitHub API
"""

import os
import sys
import json
import base64
from pathlib import Path

try:
    import requests
except ImportError:
    print("❌ requests library not installed")
    print("Install with: pip install requests")
    sys.exit(1)

try:
    from nacl import public, utils
except ImportError:
    print("❌ PyNaCl library not installed")
    print("Install with: pip install pynacl")
    sys.exit(1)

# Configuration
REPO = "ciscoittech/binary-math-system"
GITHUB_API = "https://api.github.com"

SECRETS = {
    "CLOUDFLARE_API_TOKEN": {
        "description": "API token for Cloudflare",
        "source": "https://dash.cloudflare.com/profile/api-tokens",
        "permission": "Edit Cloudflare Workers",
        "sensitive": True,
    },
    "CLOUDFLARE_ACCOUNT_ID": {
        "description": "Your Cloudflare Account ID",
        "source": "https://dash.cloudflare.com (right sidebar)",
        "permission": "None",
        "sensitive": False,
    },
    "TURSO_URL": {
        "description": "Turso database connection URL",
        "source": "Turso Dashboard",
        "permission": "None",
        "example": "libsql://your-db.turso.io",
        "sensitive": False,
    },
    "TURSO_AUTH_TOKEN": {
        "description": "Turso authentication token",
        "source": "Turso Dashboard",
        "permission": "None",
        "sensitive": True,
    },
    "OPENROUTER_API_KEY": {
        "description": "OpenRouter API key (optional)",
        "source": "https://openrouter.ai",
        "permission": "None",
        "sensitive": True,
        "optional": True,
    },
}


def get_github_token():
    """Get GitHub token from environment variable"""
    token = os.getenv("GITHUB_TOKEN")
    if not token:
        print("❌ GITHUB_TOKEN environment variable not set")
        print()
        print("Create a Personal Access Token:")
        print("  1. Go to: https://github.com/settings/tokens/new")
        print("  2. Name: 'Binary Math Secrets'")
        print("  3. Scopes: repo, admin:repo_hook")
        print("  4. Generate token and copy it")
        print()
        print("Then run:")
        print("  export GITHUB_TOKEN=ghp_xxxxxxxxxxxx")
        print("  python3 setup-secrets.py")
        return None
    return token


def get_public_key(token):
    """Get repository public key for encrypting secrets"""
    url = f"{GITHUB_API}/repos/{REPO}/actions/secrets/public-key"
    headers = {
        "Authorization": f"Bearer {token}",
        "Accept": "application/vnd.github.v3+json",
    }
    response = requests.get(url, headers=headers)
    if response.status_code == 200:
        return response.json()
    else:
        print(f"❌ Failed to get public key: {response.status_code}")
        print(response.text)
        return None


def encrypt_secret(public_key_b64, secret_value):
    """Encrypt secret using public key"""
    try:
        from nacl import public, utils, pynacl
    except ImportError:
        print("❌ PyNaCl not installed")
        print("Install with: pip install pynacl")
        sys.exit(1)

    public_key = public.PublicKey(public_key_b64, encoder=public.Base64Encoder)
    secret_bytes = secret_value.encode("utf-8")
    encrypted = public.SealedBox(public_key).encrypt(secret_bytes)
    return base64.b64encode(encrypted.ciphertext).decode("utf-8")


def set_secret(token, secret_name, secret_value, public_key_info):
    """Set a secret in GitHub"""
    url = f"{GITHUB_API}/repos/{REPO}/actions/secrets/{secret_name}"
    headers = {
        "Authorization": f"Bearer {token}",
        "Accept": "application/vnd.github.v3+json",
    }

    try:
        encrypted_value = encrypt_secret(
            public_key_info["key"], secret_value
        )
    except Exception as e:
        print(f"❌ Encryption failed: {e}")
        return False

    payload = {
        "encrypted_value": encrypted_value,
        "key_id": public_key_info["key_id"],
    }

    response = requests.put(url, json=payload, headers=headers)
    return response.status_code in [201, 204]


def main():
    print("🔐 GitHub Secrets Setup for Binary Math System")
    print("=" * 50)
    print()

    # Get GitHub token
    token = get_github_token()
    if not token:
        print("\n❌ Could not authenticate with GitHub")
        sys.exit(1)

    # Get public key for encryption
    print("📍 Fetching encryption key from GitHub...")
    public_key_info = get_public_key(token)
    if not public_key_info:
        sys.exit(1)

    print("✅ Got encryption key")
    print()

    # Collect secrets from user
    print("📝 Enter the following secrets:")
    print()

    collected_secrets = {}
    for i, (secret_name, config) in enumerate(SECRETS.items(), 1):
        is_optional = config.get("optional", False)
        optional_text = " (optional)" if is_optional else ""
        is_sensitive = config.get("sensitive", False)

        print(f"{i}️⃣  {secret_name}{optional_text}")
        print(f"   {config['description']}")
        print(f"   Source: {config['source']}")
        if "example" in config:
            print(f"   Example: {config['example']}")
        print()

        if is_sensitive:
            import getpass
            value = getpass.getpass(f"   Enter value (hidden): ")
        else:
            value = input(f"   Enter value: ")

        if value:
            collected_secrets[secret_name] = value
            print(f"   ✅ Got value")
        elif is_optional:
            print(f"   ⏭️  Skipped (optional)")
        else:
            print(f"   ❌ Required - skipping for now")

        print()

    if not collected_secrets:
        print("❌ No secrets provided")
        sys.exit(1)

    # Set secrets
    print("🚀 Setting secrets in GitHub...")
    print()

    failed = []
    for secret_name, secret_value in collected_secrets.items():
        try:
            if set_secret(token, secret_name, secret_value, public_key_info):
                print(f"✅ Set {secret_name}")
            else:
                print(f"❌ Failed to set {secret_name}")
                failed.append(secret_name)
        except Exception as e:
            print(f"❌ Error setting {secret_name}: {e}")
            failed.append(secret_name)

    print()
    print("=" * 50)
    if not failed:
        print("✅ All secrets configured successfully!")
        print()
        print("Next steps:")
        print(f"1. Verify: gh secret list --repo {REPO}")
        print("2. Deploy: git push origin main")
        print(f"3. Monitor: https://github.com/{REPO}/actions")
    else:
        print(f"⚠️  {len(failed)} secret(s) failed to set: {', '.join(failed)}")
        sys.exit(1)


if __name__ == "__main__":
    main()