Retire legacy AlphaPulse mirror authentication

scripts/retire_legacy_auth.py

@@ -0,0 +1,23 @@
+import json,os,urllib.request
+from ci import request_json,require
+from mirror import main
+main()
+token=os.environ['ALL_GITHUB_TOKEN']
+repo=request_json('https://api.github.com/repos/eezd/AlphaPulse',token=token)
+require(repo.get('permissions',{}).get('admin'),'Repository admin permission required to retire deploy key')
+keys=[]
+for page in range(1,100):
+    batch=request_json(f'https://api.github.com/repos/eezd/AlphaPulse/keys?per_page=100&page={page}',token=token)
+    keys.extend(batch)
+    if len(batch)<100:break
+else:raise RuntimeError('Incomplete deploy key listing')
+if any(key['id']==168084240 for key in keys):
+    request=urllib.request.Request('https://api.github.com/repos/eezd/AlphaPulse/keys/168084240',method='DELETE',headers={'Authorization':'token '+token,'User-Agent':'AlphaPulse-CI'})
+    with urllib.request.urlopen(request,timeout=30) as response:require(response.status==204,'Deploy key retirement failed')
+headers={'Authorization':'token '+os.environ['ALPHAPULSE_GITEA_TOKEN'],'User-Agent':'AlphaPulse-CI'}
+url='https://git.134333.xyz/api/v1/repos/eezd/AlphaPulse/actions/secrets'
+with urllib.request.urlopen(urllib.request.Request(url,headers=headers),timeout=30) as response:secrets=json.load(response)
+require(not any(secret['name']=='ALL_GITHUB_TOKEN' for secret in secrets),'Repository Secret overrides the account-level token')
+if any(secret['name']=='ALPHAPULSE_GITHUB_SSH_KEY' for secret in secrets):
+    with urllib.request.urlopen(urllib.request.Request(url+'/ALPHAPULSE_GITHUB_SSH_KEY',method='DELETE',headers=headers),timeout=30) as response:require(response.status==204,'Legacy Secret retirement failed')
+print('Account-level GitHub credential verified; project legacy SSH key and Secret retired')