24 lines
1.7 KiB
Python
24 lines
1.7 KiB
Python
import json,os,urllib.request
|
|
from ci import request_json,require
|
|
from mirror import main
|
|
main()
|
|
token=os.environ['ALL_GITHUB_TOKEN']
|
|
repo=request_json('https://api.github.com/repos/eezd/AlphaPulse',token=token)
|
|
require(repo.get('permissions',{}).get('admin'),'Repository admin permission required to retire deploy key')
|
|
keys=[]
|
|
for page in range(1,100):
|
|
batch=request_json(f'https://api.github.com/repos/eezd/AlphaPulse/keys?per_page=100&page={page}',token=token)
|
|
keys.extend(batch)
|
|
if len(batch)<100:break
|
|
else:raise RuntimeError('Incomplete deploy key listing')
|
|
if any(key['id']==168084240 for key in keys):
|
|
request=urllib.request.Request('https://api.github.com/repos/eezd/AlphaPulse/keys/168084240',method='DELETE',headers={'Authorization':'token '+token,'User-Agent':'AlphaPulse-CI'})
|
|
with urllib.request.urlopen(request,timeout=30) as response:require(response.status==204,'Deploy key retirement failed')
|
|
headers={'Authorization':'token '+os.environ['ALPHAPULSE_GITEA_TOKEN'],'User-Agent':'AlphaPulse-CI'}
|
|
url='https://git.134333.xyz/api/v1/repos/eezd/AlphaPulse/actions/secrets'
|
|
with urllib.request.urlopen(urllib.request.Request(url,headers=headers),timeout=30) as response:secrets=json.load(response)
|
|
require(not any(secret['name']=='ALL_GITHUB_TOKEN' for secret in secrets),'Repository Secret overrides the account-level token')
|
|
if any(secret['name']=='ALPHAPULSE_GITHUB_SSH_KEY' for secret in secrets):
|
|
with urllib.request.urlopen(urllib.request.Request(url+'/ALPHAPULSE_GITHUB_SSH_KEY',method='DELETE',headers=headers),timeout=30) as response:require(response.status==204,'Legacy Secret retirement failed')
|
|
print('Account-level GitHub credential verified; project legacy SSH key and Secret retired')
|