108 lines
3.9 KiB
Python
108 lines
3.9 KiB
Python
"""Seal per-node NODE_TOKENS GitHub Actions secrets from the merged pool.
|
||
|
||
Deterministic even slices: node i (index in fleet_deploy ok-list) gets
|
||
pool[(i*S) % len : ...] wrapping, so with S=25 over 1391 nodes every one of
|
||
the 2446 alive tokens is used ~14 times — "юзал все гх токены" without
|
||
committing any of them to git (Secrets API + libsodium seal).
|
||
|
||
imba.yml writes NODE_TOKENS *appended after* the node's own committed PAT
|
||
(line 1 of gh_tokens.txt stays the push credential).
|
||
|
||
usage: python fleet_seal_tokens.py [--limit N] [--node NAME] [--slice 25] [--apply]
|
||
Never prints token values.
|
||
"""
|
||
import argparse
|
||
import base64
|
||
import json
|
||
import sys
|
||
import time
|
||
from pathlib import Path
|
||
|
||
import requests
|
||
from nacl import encoding
|
||
from nacl.public import PublicKey, SealedBox
|
||
|
||
ROOT = Path(__file__).parent
|
||
DEPLOY = ROOT / "data" / "fleet_deploy.json"
|
||
POOL_FILE = ROOT / "gh_tokens.txt"
|
||
H = {"Accept": "application/vnd.github+json", "X-GitHub-Api-Version": "2022-11-28"}
|
||
S = requests.Session()
|
||
|
||
|
||
def load_pool():
|
||
toks = []
|
||
for l in open(POOL_FILE, encoding="utf-8"):
|
||
t = l.strip()
|
||
if t.startswith(("ghp_", "github_pat_")) and t not in toks:
|
||
toks.append(t)
|
||
if not toks:
|
||
sys.exit("REFUSING: pool is empty — nothing to seal")
|
||
return toks
|
||
|
||
|
||
def slice_for(i, size, pool):
|
||
n = len(pool)
|
||
return [pool[(i * size + k) % n] for k in range(min(size, n))]
|
||
|
||
|
||
def seal_node(rec, idx, size, pool, apply):
|
||
full = f"{rec['login']}/{rec['repo']}"
|
||
tok = rec.get("pat")
|
||
if not tok:
|
||
return full, False, "no node pat"
|
||
hdr = {**H, "Authorization": f"Bearer {tok}"}
|
||
try:
|
||
r = S.get(f"https://api.github.com/repos/{full}/actions/secrets/public-key",
|
||
headers=hdr, timeout=30)
|
||
if r.status_code != 200:
|
||
return full, False, f"pubkey {r.status_code}"
|
||
pj = r.json()
|
||
sl = slice_for(idx, size, pool)
|
||
if not apply:
|
||
return full, True, f"would seal {len(sl)} tokens (key_id={pj['key_id'][:8]}…)"
|
||
box = SealedBox(PublicKey(pj["key"], encoding.Base64Encoder))
|
||
sealed = base64.b64encode(box.encrypt("\n".join(sl).encode())).decode()
|
||
r = S.put(f"https://api.github.com/repos/{full}/actions/secrets/NODE_TOKENS",
|
||
headers=hdr, timeout=30,
|
||
json={"encrypted_value": sealed, "key_id": pj["key_id"]})
|
||
if r.status_code in (201, 204):
|
||
return full, True, f"sealed {len(sl)} tokens"
|
||
return full, False, f"put {r.status_code}: {r.text[:80]}"
|
||
except Exception as e:
|
||
return full, False, f"{type(e).__name__}: {str(e)[:60]}"
|
||
|
||
|
||
def main():
|
||
ap = argparse.ArgumentParser()
|
||
ap.add_argument("--limit", type=int, default=0)
|
||
ap.add_argument("--node", default="")
|
||
ap.add_argument("--slice", type=int, default=25)
|
||
ap.add_argument("--apply", action="store_true")
|
||
a = ap.parse_args()
|
||
pool = load_pool()
|
||
recs = [r for r in json.load(open(DEPLOY, encoding="utf-8")) if r.get("ok")]
|
||
print(f"pool={len(pool)} nodes={len(recs)} slice={a.slice} apply={a.apply}")
|
||
targets = list(enumerate(recs))
|
||
if a.node:
|
||
targets = [(i, r) for i, r in targets
|
||
if r.get("repo") == a.node or f"{r['login']}/{r['repo']}" == a.node]
|
||
elif a.limit:
|
||
step = max(1, len(recs) // a.limit) # uniform sample, not one owner
|
||
targets = targets[::step][:a.limit]
|
||
if not targets:
|
||
sys.exit("no nodes selected")
|
||
ok = fails = 0
|
||
t0 = time.time()
|
||
for i, rec in targets:
|
||
full, good, info = seal_node(rec, i, a.slice, pool, a.apply)
|
||
ok += good
|
||
fails += (not good)
|
||
print(f" {'ok ' if good else 'FAIL'} {full}: {info}", flush=True)
|
||
cov = min(len(pool), a.slice * len(targets))
|
||
print(f"\nDONE {time.time()-t0:.0f}s ok={ok} fail={fails} "
|
||
f"pool coverage this batch: ~{cov}/{len(pool)} tokens")
|
||
|
||
|
||
if __name__ == "__main__":
|
||
main()
|