package main

import (
	"context"
	"encoding/base64"
	"fmt"
	"log"
	"os"

	"github.com/google/go-github/v53/github"
	"golang.org/x/crypto/nacl/box"
	"golang.org/x/oauth2"
)

func main() {
	ctx := context.Background()
	if err := run(ctx); err != nil {
		log.Fatal(err)
	}
}

func run(ctx context.Context) error {
	ts := oauth2.StaticTokenSource(
		&oauth2.Token{AccessToken: os.Getenv("GITHUB_API_TOKEN")},
	)
	tc := oauth2.NewClient(ctx, ts)

	client := github.NewClient(tc)
	org := os.Getenv("GITHUB_OWNER")

	pubKey, _, err := client.Dependabot.GetOrgPublicKey(ctx, org)
	if err != nil {
		return err
	}

	enc, err := encryptPlaintext("SECRET", *pubKey.Key)
	if err != nil {
		return err
	}

	_, err = client.Dependabot.CreateOrUpdateOrgSecret(ctx, org, &github.DependabotEncryptedSecret{
		Name:                  "EXAMPLE",
		KeyID:                 *pubKey.KeyID,
		EncryptedValue:        base64.StdEncoding.EncodeToString(enc),
		SelectedRepositoryIDs: []int64{123456789},
		Visibility:            "selected",
	})

	return err
}

func encryptPlaintext(plaintext, publicKeyB64 string) ([]byte, error) {
	publicKeyBytes, err := base64.StdEncoding.DecodeString(publicKeyB64)
	if err != nil {
		return nil, err
	}

	var publicKeyBytes32 [32]byte
	copiedLen := copy(publicKeyBytes32[:], publicKeyBytes)
	if copiedLen == 0 {
		return nil, fmt.Errorf("could not convert publicKey to bytes")
	}

	plaintextBytes := []byte(plaintext)
	var encryptedBytes []byte

	cipherText, err := box.SealAnonymous(encryptedBytes, plaintextBytes, &publicKeyBytes32, nil)
	if err != nil {
		return nil, err
	}

	return cipherText, nil
}