ljwx-shiti/scripts/setup-github-secrets.sh

#!/usr/bin/env bash
set -euo pipefail

REPO="${REPO:-BrunoGao/ljwx-shiti}"

RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
BLUE='\033[0;34m'
NC='\033[0m'

echo_info() { echo -e "${GREEN}[INFO]${NC} $1"; }
echo_warn() { echo -e "${YELLOW}[WARN]${NC} $1"; }
echo_error() { echo -e "${RED}[ERROR]${NC} $1"; }
echo_step() { echo -e "${BLUE}[STEP]${NC} $1"; }

check_gh_cli() {
  if ! command -v gh >/dev/null 2>&1; then
    echo_error "GitHub CLI (gh) is not installed"
    exit 1
  fi
  if ! gh auth status >/dev/null 2>&1; then
    echo_error "GitHub CLI is not authenticated"
    echo_info "run: gh auth login"
    exit 1
  fi
  echo_info "gh CLI is ready"
}

show_current_secrets() {
  echo_step "Current secrets in ${REPO}"
  gh secret list --repo "${REPO}" || true
  echo
}

set_secret() {
  local name="$1"
  local value="$2"
  printf "%s" "${value}" | gh secret set "${name}" --repo "${REPO}"
}

normalize_webhook_url() {
  local raw="$1"
  raw="${raw%/}"
  if [[ ! "${raw}" =~ ^https?:// ]]; then
    echo_error "SYNC_WEBHOOK_URL must start with http:// or https://"
    return 1
  fi
  printf "%s" "${raw}"
}

setup_sync_secrets() {
  echo_step "Configure sync webhook secrets"
  echo

  local webhook_url
  local hmac_secret
  local bearer_token

  echo -n "SYNC_WEBHOOK_URL (e.g. https://stock.omniverseai.net/sync-service): "
  read -r webhook_url
  webhook_url="$(normalize_webhook_url "${webhook_url}")" || return 1

  echo -n "SYNC_WEBHOOK_SECRET: "
  read -rs hmac_secret
  echo
  if [[ -z "${hmac_secret}" ]]; then
    echo_error "SYNC_WEBHOOK_SECRET cannot be empty"
    return 1
  fi

  echo -n "SYNC_BEARER_TOKEN: "
  read -rs bearer_token
  echo
  if [[ -z "${bearer_token}" ]]; then
    echo_error "SYNC_BEARER_TOKEN cannot be empty"
    return 1
  fi

  set_secret "SYNC_WEBHOOK_URL" "${webhook_url}"
  set_secret "SYNC_WEBHOOK_SECRET" "${hmac_secret}"
  set_secret "SYNC_BEARER_TOKEN" "${bearer_token}"

  echo_info "sync webhook secrets updated"
}

verify_secrets() {
  echo_step "Verify required secrets"
  local required=(
    "SYNC_WEBHOOK_URL"
    "SYNC_WEBHOOK_SECRET"
    "SYNC_BEARER_TOKEN"
  )
  local all_ok=true

  for key in "${required[@]}"; do
    if gh secret list --repo "${REPO}" | awk '{print $1}' | grep -qx "${key}"; then
      echo_info "${key} is set"
    else
      echo_error "${key} is missing"
      all_ok=false
    fi
  done

  if [[ "${all_ok}" != "true" ]]; then
    return 1
  fi
}

show_next_steps() {
  echo
  echo_info "next steps"
  echo "1) Push code to trigger build-and-notify"
  echo "2) Watch workflow: gh run watch --repo ${REPO}"
  echo "3) Run E2E verification: ./scripts/verify-e2e-deploy.sh --require-sync-logs"
}

non_interactive_mode() {
  : "${SYNC_WEBHOOK_URL:?missing SYNC_WEBHOOK_URL}"
  : "${SYNC_WEBHOOK_SECRET:?missing SYNC_WEBHOOK_SECRET}"
  : "${SYNC_BEARER_TOKEN:?missing SYNC_BEARER_TOKEN}"

  local webhook_url
  webhook_url="$(normalize_webhook_url "${SYNC_WEBHOOK_URL}")"
  set_secret "SYNC_WEBHOOK_URL" "${webhook_url}"
  set_secret "SYNC_WEBHOOK_SECRET" "${SYNC_WEBHOOK_SECRET}"
  set_secret "SYNC_BEARER_TOKEN" "${SYNC_BEARER_TOKEN}"
  verify_secrets
  show_next_steps
}

main_menu() {
  while true; do
    echo
    echo "=========================================="
    echo "GitHub Secrets Setup (${REPO})"
    echo "=========================================="
    echo "1. Show current secrets"
    echo "2. Configure sync webhook secrets"
    echo "3. Verify required secrets"
    echo "4. Configure + verify"
    echo "5. Exit"
    echo -n "Choose (1-5): "
    read -r choice

    case "${choice}" in
      1) show_current_secrets ;;
      2) setup_sync_secrets ;;
      3) verify_secrets ;;
      4) setup_sync_secrets && verify_secrets && show_next_steps ;;
      5) exit 0 ;;
      *) echo_error "invalid option" ;;
    esac
  done
}

main() {
  check_gh_cli
  if [[ "${NON_INTERACTIVE:-false}" == "true" ]]; then
    non_interactive_mode
  else
    main_menu
  fi
}

main "$@"