Encrypt values for storing on GitHub Secrets

encryptForGitHub

import sodium from "libsodium-wrappers";

// publicKey is from GET /repos/{owner}/{repo}/actions/secrets/public-key
// secretValue is the value you want to get encrypted
export async function encryptForGitHub(secretValue: string, publicKey: string) {
  await sodium.ready;

  // Convert the secret and key to a Uint8Array.
  const binkey = sodium.from_base64(publicKey, sodium.base64_variants.ORIGINAL);
  const binsec = sodium.from_string(secretValue);

  // Encrypt the secret using libsodium.
  const encBytes = sodium.crypto_box_seal(binsec, binkey);

  // Convert the encrypted Uint8Array to Base64.
  return sodium.to_base64(encBytes, sodium.base64_variants.ORIGINAL);
}