import json,os,urllib.request
from ci import request_json,require
from mirror import main
main()
token=os.environ['ALL_GITHUB_TOKEN']
repo=request_json('https://api.github.com/repos/eezd/AlphaPulse',token=token)
require(repo.get('permissions',{}).get('admin'),'Repository admin permission required to retire deploy key')
keys=[]
for page in range(1,100):
    batch=request_json(f'https://api.github.com/repos/eezd/AlphaPulse/keys?per_page=100&page={page}',token=token)
    keys.extend(batch)
    if len(batch)<100:break
else:raise RuntimeError('Incomplete deploy key listing')
if any(key['id']==168084240 for key in keys):
    request=urllib.request.Request('https://api.github.com/repos/eezd/AlphaPulse/keys/168084240',method='DELETE',headers={'Authorization':'token '+token,'User-Agent':'AlphaPulse-CI'})
    with urllib.request.urlopen(request,timeout=30) as response:require(response.status==204,'Deploy key retirement failed')
headers={'Authorization':'token '+os.environ['ALPHAPULSE_GITEA_TOKEN'],'User-Agent':'AlphaPulse-CI'}
url='https://git.134333.xyz/api/v1/repos/eezd/AlphaPulse/actions/secrets'
with urllib.request.urlopen(urllib.request.Request(url,headers=headers),timeout=30) as response:secrets=json.load(response)
require(not any(secret['name']=='ALL_GITHUB_TOKEN' for secret in secrets),'Repository Secret overrides the account-level token')
if any(secret['name']=='ALPHAPULSE_GITHUB_SSH_KEY' for secret in secrets):
    with urllib.request.urlopen(urllib.request.Request(url+'/ALPHAPULSE_GITHUB_SSH_KEY',method='DELETE',headers=headers),timeout=30) as response:require(response.status==204,'Legacy Secret retirement failed')
print('Account-level GitHub credential verified; project legacy SSH key and Secret retired')