|
| 1 | +--- |
| 2 | +name: Create or update an organization secret |
| 3 | +example: octokit.rest.codespaces.createOrUpdateOrgSecret({ org, secret_name, visibility }) |
| 4 | +route: PUT /organizations/{org}/codespaces/secrets/{secret_name} |
| 5 | +scope: codespaces |
| 6 | +type: API method |
| 7 | +--- |
| 8 | + |
| 9 | +# Create or update an organization secret |
| 10 | + |
| 11 | +Creates or updates an organization secret with an encrypted value. Encrypt your secret using |
| 12 | +[LibSodium](https://libsodium.gitbook.io/doc/bindings_for_other_languages). You must authenticate using an access |
| 13 | +token with the `admin:org` scope to use this endpoint. |
| 14 | + |
| 15 | +#### Example encrypting a secret using Node.js |
| 16 | + |
| 17 | +Encrypt your secret using the [libsodium-wrappers](https://www.npmjs.com/package/libsodium-wrappers) library. |
| 18 | + |
| 19 | +``` |
| 20 | +// Written with ❤️ by PSJ and free to use under The Unlicense. |
| 21 | +const sodium=require('libsodium-wrappers') |
| 22 | +const secret = 'plain-text-secret' // replace with secret before running the script. |
| 23 | +const key = 'base64-encoded-public-key' // replace with the Base64 encoded public key. |
| 24 | +
|
| 25 | +//Check if libsodium is ready and then proceed. |
| 26 | +
|
| 27 | +sodium.ready.then( ()=>{ |
| 28 | +
|
| 29 | +// Convert Secret & Base64 key to Uint8Array. |
| 30 | +let binkey= sodium.from_base64(key, sodium.base64_variants.ORIGINAL) //Equivalent of Buffer.from(key, 'base64') |
| 31 | +let binsec= sodium.from_string(secret) // Equivalent of Buffer.from(secret) |
| 32 | +
|
| 33 | +//Encrypt the secret using LibSodium |
| 34 | +let encBytes= sodium.crypto_box_seal(binsec,binkey) // Similar to tweetsodium.seal(binsec,binkey) |
| 35 | +
|
| 36 | +// Convert encrypted Uint8Array to Base64 |
| 37 | +let output=sodium.to_base64(encBytes, sodium.base64_variants.ORIGINAL) //Equivalent of Buffer.from(encBytes).toString('base64') |
| 38 | +
|
| 39 | +console.log(output) |
| 40 | +}); |
| 41 | +``` |
| 42 | + |
| 43 | +#### Example encrypting a secret using Python |
| 44 | + |
| 45 | +Encrypt your secret using [pynacl](https://pynacl.readthedocs.io/en/latest/public/#nacl-public-sealedbox) with Python 3. |
| 46 | + |
| 47 | +``` |
| 48 | +from base64 import b64encode |
| 49 | +from nacl import encoding, public |
| 50 | +
|
| 51 | +def encrypt(public_key: str, secret_value: str) -> str: |
| 52 | + """Encrypt a Unicode string using the public key.""" |
| 53 | + public_key = public.PublicKey(public_key.encode("utf-8"), encoding.Base64Encoder()) |
| 54 | + sealed_box = public.SealedBox(public_key) |
| 55 | + encrypted = sealed_box.encrypt(secret_value.encode("utf-8")) |
| 56 | + return b64encode(encrypted).decode("utf-8") |
| 57 | +``` |
| 58 | + |
| 59 | +#### Example encrypting a secret using C# |
| 60 | + |
| 61 | +Encrypt your secret using the [Sodium.Core](https://www.nuget.org/packages/Sodium.Core/) package. |
| 62 | + |
| 63 | +``` |
| 64 | +var secretValue = System.Text.Encoding.UTF8.GetBytes("mySecret"); |
| 65 | +var publicKey = Convert.FromBase64String("2Sg8iYjAxxmI2LvUXpJjkYrMxURPc8r+dB7TJyvvcCU="); |
| 66 | +
|
| 67 | +var sealedPublicKeyBox = Sodium.SealedPublicKeyBox.Create(secretValue, publicKey); |
| 68 | +
|
| 69 | +Console.WriteLine(Convert.ToBase64String(sealedPublicKeyBox)); |
| 70 | +``` |
| 71 | + |
| 72 | +#### Example encrypting a secret using Ruby |
| 73 | + |
| 74 | +Encrypt your secret using the [rbnacl](https://github.com/RubyCrypto/rbnacl) gem. |
| 75 | + |
| 76 | +```ruby |
| 77 | +require "rbnacl" |
| 78 | +require "base64" |
| 79 | + |
| 80 | +key = Base64.decode64("+ZYvJDZMHUfBkJdyq5Zm9SKqeuBQ4sj+6sfjlH4CgG0=") |
| 81 | +public_key = RbNaCl::PublicKey.new(key) |
| 82 | + |
| 83 | +box = RbNaCl::Boxes::Sealed.from_public_key(public_key) |
| 84 | +encrypted_secret = box.encrypt("my_secret") |
| 85 | + |
| 86 | +# Print the base64 encoded secret |
| 87 | +puts Base64.strict_encode64(encrypted_secret) |
| 88 | +``` |
| 89 | + |
| 90 | +```js |
| 91 | +octokit.rest.codespaces.createOrUpdateOrgSecret({ |
| 92 | + org, |
| 93 | + secret_name, |
| 94 | + visibility, |
| 95 | +}); |
| 96 | +``` |
| 97 | + |
| 98 | +## Parameters |
| 99 | + |
| 100 | +<table> |
| 101 | + <thead> |
| 102 | + <tr> |
| 103 | + <th>name</th> |
| 104 | + <th>required</th> |
| 105 | + <th>description</th> |
| 106 | + </tr> |
| 107 | + </thead> |
| 108 | + <tbody> |
| 109 | + <tr><td>org</td><td>yes</td><td> |
| 110 | + |
| 111 | +The organization name. The name is not case sensitive. |
| 112 | + |
| 113 | +</td></tr> |
| 114 | +<tr><td>secret_name</td><td>yes</td><td> |
| 115 | + |
| 116 | +The name of the secret. |
| 117 | + |
| 118 | +</td></tr> |
| 119 | +<tr><td>encrypted_value</td><td>no</td><td> |
| 120 | + |
| 121 | +The value for your secret, encrypted with [LibSodium](https://libsodium.gitbook.io/doc/bindings_for_other_languages) using the public key retrieved from the [Get an organization public key](https://docs.github.com/rest/reference/codespaces#get-an-organization-public-key) endpoint. |
| 122 | + |
| 123 | +</td></tr> |
| 124 | +<tr><td>key_id</td><td>no</td><td> |
| 125 | + |
| 126 | +The ID of the key you used to encrypt the secret. |
| 127 | + |
| 128 | +</td></tr> |
| 129 | +<tr><td>visibility</td><td>yes</td><td> |
| 130 | + |
| 131 | +Which type of organization repositories have access to the organization secret. `selected` means only the repositories specified by `selected_repository_ids` can access the secret. |
| 132 | + |
| 133 | +</td></tr> |
| 134 | +<tr><td>selected_repository_ids</td><td>no</td><td> |
| 135 | + |
| 136 | +An array of repository IDs that can access the organization secret. You can only provide a list of repository IDs when the `visibility` is set to `selected`. You can manage the list of selected repositories using the [List selected repositories for an organization secret](https://docs.github.com/rest/reference/codespaces#list-selected-repositories-for-an-organization-secret), [Set selected repositories for an organization secret](https://docs.github.com/rest/reference/codespaces#set-selected-repositories-for-an-organization-secret), and [Remove selected repository from an organization secret](https://docs.github.com/rest/reference/codespaces#remove-selected-repository-from-an-organization-secret) endpoints. |
| 137 | + |
| 138 | +</td></tr> |
| 139 | + </tbody> |
| 140 | +</table> |
| 141 | + |
| 142 | +See also: [GitHub Developer Guide documentation](https://docs.github.com/rest/reference/codespaces#create-or-update-an-organization-secret). |
0 commit comments