feat: Add Agents secrets API #4533
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,15 @@ | ||
| // Copyright 2026 The go-github AUTHORS. All rights reserved. | ||
| // | ||
| // Use of this source code is governed by a BSD-style | ||
| // license that can be found in the LICENSE file. | ||
|
|
||
| package github | ||
|
|
||
| // AgentsService handles communication with the Agents related | ||
| // methods of the GitHub API. | ||
| // | ||
| // The Agents endpoints are only served by the 2026-03-10 API version, so these | ||
| // methods send that version explicitly instead of the client's default. | ||
| // | ||
| // GitHub API docs: https://docs.github.com/rest/agents?apiVersion=2026-03-10 | ||
| type AgentsService service |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,322 @@ | ||
| // Copyright 2026 The go-github AUTHORS. All rights reserved. | ||
| // | ||
| // Use of this source code is governed by a BSD-style | ||
| // license that can be found in the LICENSE file. | ||
|
|
||
| package github | ||
|
|
||
| import ( | ||
| "context" | ||
| "fmt" | ||
| ) | ||
|
|
||
| // GetRepoPublicKey gets a public key that should be used for Agents secret encryption. | ||
| // | ||
| // GitHub API docs: https://docs.github.com/rest/agents/secrets?apiVersion=2026-03-10#get-a-repository-public-key | ||
| // | ||
| //meta:operation GET /repos/{owner}/{repo}/agents/secrets/public-key | ||
| func (s *AgentsService) GetRepoPublicKey(ctx context.Context, owner, repo string) (*PublicKey, *Response, error) { | ||
| u := fmt.Sprintf("repos/%v/%v/agents/secrets/public-key", owner, repo) | ||
|
|
||
| req, err := s.client.NewRequest(ctx, "GET", u, nil, WithVersion(api20260310)) | ||
| if err != nil { | ||
| return nil, nil, err | ||
| } | ||
|
|
||
| var pubKey *PublicKey | ||
| resp, err := s.client.Do(req, &pubKey) | ||
| if err != nil { | ||
| return nil, resp, err | ||
| } | ||
|
|
||
| return pubKey, resp, nil | ||
| } | ||
|
|
||
| // GetOrgPublicKey gets a public key that should be used for Agents secret encryption. | ||
| // | ||
| // GitHub API docs: https://docs.github.com/rest/agents/secrets?apiVersion=2026-03-10#get-an-organization-public-key | ||
| // | ||
| //meta:operation GET /orgs/{org}/agents/secrets/public-key | ||
| func (s *AgentsService) GetOrgPublicKey(ctx context.Context, org string) (*PublicKey, *Response, error) { | ||
|
|
||
| u := fmt.Sprintf("orgs/%v/agents/secrets/public-key", org) | ||
|
|
||
| req, err := s.client.NewRequest(ctx, "GET", u, nil, WithVersion(api20260310)) | ||
| if err != nil { | ||
| return nil, nil, err | ||
| } | ||
|
|
||
| var pubKey *PublicKey | ||
| resp, err := s.client.Do(req, &pubKey) | ||
| if err != nil { | ||
| return nil, resp, err | ||
| } | ||
|
|
||
| return pubKey, resp, nil | ||
| } | ||
|
|
||
| // ListRepoSecrets lists all Agents secrets available in a repository | ||
| // without revealing their encrypted values. | ||
| // | ||
| // GitHub API docs: https://docs.github.com/rest/agents/secrets?apiVersion=2026-03-10#list-repository-secrets | ||
| // | ||
| //meta:operation GET /repos/{owner}/{repo}/agents/secrets | ||
| func (s *AgentsService) ListRepoSecrets(ctx context.Context, owner, repo string, opts *ListOptions) (*Secrets, *Response, error) { | ||
| u := fmt.Sprintf("repos/%v/%v/agents/secrets", owner, repo) | ||
| u, err := addOptions(u, opts) | ||
| if err != nil { | ||
| return nil, nil, err | ||
| } | ||
|
|
||
| req, err := s.client.NewRequest(ctx, "GET", u, nil, WithVersion(api20260310)) | ||
| if err != nil { | ||
| return nil, nil, err | ||
| } | ||
|
|
||
| var secrets *Secrets | ||
| resp, err := s.client.Do(req, &secrets) | ||
| if err != nil { | ||
| return nil, resp, err | ||
| } | ||
|
|
||
| return secrets, resp, nil | ||
| } | ||
|
|
||
| // ListOrgSecrets lists all Agents secrets available in an organization | ||
| // without revealing their encrypted values. | ||
| // | ||
| // GitHub API docs: https://docs.github.com/rest/agents/secrets?apiVersion=2026-03-10#list-organization-secrets | ||
| // | ||
| //meta:operation GET /orgs/{org}/agents/secrets | ||
| func (s *AgentsService) ListOrgSecrets(ctx context.Context, org string, opts *ListOptions) (*Secrets, *Response, error) { | ||
| u := fmt.Sprintf("orgs/%v/agents/secrets", org) | ||
| u, err := addOptions(u, opts) | ||
| if err != nil { | ||
| return nil, nil, err | ||
| } | ||
|
|
||
| req, err := s.client.NewRequest(ctx, "GET", u, nil, WithVersion(api20260310)) | ||
| if err != nil { | ||
| return nil, nil, err | ||
| } | ||
|
|
||
| var secrets *Secrets | ||
| resp, err := s.client.Do(req, &secrets) | ||
| if err != nil { | ||
| return nil, resp, err | ||
| } | ||
|
|
||
| return secrets, resp, nil | ||
| } | ||
|
|
||
| // ListRepoOrgSecrets lists all organization Agents secrets available in a repository | ||
| // without revealing their encrypted values. | ||
| // | ||
| // GitHub API docs: https://docs.github.com/rest/agents/secrets?apiVersion=2026-03-10#list-repository-organization-secrets | ||
| // | ||
| //meta:operation GET /repos/{owner}/{repo}/agents/organization-secrets | ||
| func (s *AgentsService) ListRepoOrgSecrets(ctx context.Context, owner, repo string, opts *ListOptions) (*Secrets, *Response, error) { | ||
| u := fmt.Sprintf("repos/%v/%v/agents/organization-secrets", owner, repo) | ||
| u, err := addOptions(u, opts) | ||
| if err != nil { | ||
| return nil, nil, err | ||
| } | ||
|
|
||
| req, err := s.client.NewRequest(ctx, "GET", u, nil, WithVersion(api20260310)) | ||
| if err != nil { | ||
| return nil, nil, err | ||
| } | ||
|
|
||
| var secrets *Secrets | ||
| resp, err := s.client.Do(req, &secrets) | ||
| if err != nil { | ||
| return nil, resp, err | ||
| } | ||
|
|
||
| return secrets, resp, nil | ||
| } | ||
|
|
||
| // GetRepoSecret gets a single repository Agents secret without revealing its encrypted value. | ||
| // | ||
| // GitHub API docs: https://docs.github.com/rest/agents/secrets?apiVersion=2026-03-10#get-a-repository-secret | ||
| // | ||
| //meta:operation GET /repos/{owner}/{repo}/agents/secrets/{secret_name} | ||
| func (s *AgentsService) GetRepoSecret(ctx context.Context, owner, repo, name string) (*Secret, *Response, error) { | ||
| u := fmt.Sprintf("repos/%v/%v/agents/secrets/%v", owner, repo, name) | ||
|
|
||
| req, err := s.client.NewRequest(ctx, "GET", u, nil, WithVersion(api20260310)) | ||
| if err != nil { | ||
| return nil, nil, err | ||
| } | ||
|
|
||
| var secret *Secret | ||
| resp, err := s.client.Do(req, &secret) | ||
| if err != nil { | ||
| return nil, resp, err | ||
| } | ||
|
|
||
| return secret, resp, nil | ||
| } | ||
|
|
||
| // GetOrgSecret gets a single organization Agents secret without revealing its encrypted value. | ||
| // | ||
| // GitHub API docs: https://docs.github.com/rest/agents/secrets?apiVersion=2026-03-10#get-an-organization-secret | ||
| // | ||
| //meta:operation GET /orgs/{org}/agents/secrets/{secret_name} | ||
| func (s *AgentsService) GetOrgSecret(ctx context.Context, org, name string) (*Secret, *Response, error) { | ||
| u := fmt.Sprintf("orgs/%v/agents/secrets/%v", org, name) | ||
|
|
||
| req, err := s.client.NewRequest(ctx, "GET", u, nil, WithVersion(api20260310)) | ||
| if err != nil { | ||
| return nil, nil, err | ||
| } | ||
|
|
||
| var secret *Secret | ||
| resp, err := s.client.Do(req, &secret) | ||
| if err != nil { | ||
| return nil, resp, err | ||
| } | ||
|
|
||
| return secret, resp, nil | ||
| } | ||
|
|
||
| // CreateOrUpdateRepoSecret creates or updates a repository Agents secret with an encrypted value. | ||
| // | ||
| // GitHub API docs: https://docs.github.com/rest/agents/secrets?apiVersion=2026-03-10#create-or-update-a-repository-secret | ||
| // | ||
| //meta:operation PUT /repos/{owner}/{repo}/agents/secrets/{secret_name} | ||
| func (s *AgentsService) CreateOrUpdateRepoSecret(ctx context.Context, owner, repo, name string, body SecretRequest) (*Response, error) { | ||
| u := fmt.Sprintf("repos/%v/%v/agents/secrets/%v", owner, repo, name) | ||
|
|
||
| req, err := s.client.NewRequest(ctx, "PUT", u, body, WithVersion(api20260310)) | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
|
|
||
| return s.client.Do(req, nil) | ||
| } | ||
|
|
||
| // CreateOrUpdateOrgSecret creates or updates an organization Agents secret with an encrypted value. | ||
| // | ||
| // GitHub API docs: https://docs.github.com/rest/agents/secrets?apiVersion=2026-03-10#create-or-update-an-organization-secret | ||
| // | ||
| //meta:operation PUT /orgs/{org}/agents/secrets/{secret_name} | ||
| func (s *AgentsService) CreateOrUpdateOrgSecret(ctx context.Context, org, name string, body SecretOrgRequest) (*Response, error) { | ||
| u := fmt.Sprintf("orgs/%v/agents/secrets/%v", org, name) | ||
|
|
||
| req, err := s.client.NewRequest(ctx, "PUT", u, body, WithVersion(api20260310)) | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
|
|
||
| return s.client.Do(req, nil) | ||
| } | ||
|
|
||
| // DeleteRepoSecret deletes an Agents secret in a repository using the secret name. | ||
| // | ||
| // GitHub API docs: https://docs.github.com/rest/agents/secrets?apiVersion=2026-03-10#delete-a-repository-secret | ||
| // | ||
| //meta:operation DELETE /repos/{owner}/{repo}/agents/secrets/{secret_name} | ||
| func (s *AgentsService) DeleteRepoSecret(ctx context.Context, owner, repo, name string) (*Response, error) { | ||
| u := fmt.Sprintf("repos/%v/%v/agents/secrets/%v", owner, repo, name) | ||
|
|
||
| req, err := s.client.NewRequest(ctx, "DELETE", u, nil, WithVersion(api20260310)) | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
|
|
||
| return s.client.Do(req, nil) | ||
| } | ||
|
|
||
| // DeleteOrgSecret deletes an Agents secret in an organization using the secret name. | ||
| // | ||
| // GitHub API docs: https://docs.github.com/rest/agents/secrets?apiVersion=2026-03-10#delete-an-organization-secret | ||
| // | ||
| //meta:operation DELETE /orgs/{org}/agents/secrets/{secret_name} | ||
| func (s *AgentsService) DeleteOrgSecret(ctx context.Context, org, name string) (*Response, error) { | ||
| u := fmt.Sprintf("orgs/%v/agents/secrets/%v", org, name) | ||
|
|
||
| req, err := s.client.NewRequest(ctx, "DELETE", u, nil, WithVersion(api20260310)) | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
|
|
||
| return s.client.Do(req, nil) | ||
| } | ||
|
|
||
| // ListSelectedReposForOrgSecret lists all repositories that have access to an Agents secret. | ||
| // | ||
| // GitHub API docs: https://docs.github.com/rest/agents/secrets?apiVersion=2026-03-10#list-selected-repositories-for-an-organization-secret | ||
| // | ||
| //meta:operation GET /orgs/{org}/agents/secrets/{secret_name}/repositories | ||
| func (s *AgentsService) ListSelectedReposForOrgSecret(ctx context.Context, org, name string, opts *ListOptions) (*SelectedReposList, *Response, error) { | ||
| u := fmt.Sprintf("orgs/%v/agents/secrets/%v/repositories", org, name) | ||
| u, err := addOptions(u, opts) | ||
| if err != nil { | ||
| return nil, nil, err | ||
| } | ||
|
|
||
| req, err := s.client.NewRequest(ctx, "GET", u, nil, WithVersion(api20260310)) | ||
| if err != nil { | ||
| return nil, nil, err | ||
| } | ||
|
|
||
| var result *SelectedReposList | ||
| resp, err := s.client.Do(req, &result) | ||
| if err != nil { | ||
| return nil, resp, err | ||
| } | ||
|
|
||
| return result, resp, nil | ||
| } | ||
|
|
||
| // SetSelectedReposForOrgSecret sets the repositories that have access to an Agents secret. | ||
| // | ||
| // GitHub API docs: https://docs.github.com/rest/agents/secrets?apiVersion=2026-03-10#set-selected-repositories-for-an-organization-secret | ||
| // | ||
| //meta:operation PUT /orgs/{org}/agents/secrets/{secret_name}/repositories | ||
| func (s *AgentsService) SetSelectedReposForOrgSecret(ctx context.Context, org, name string, ids []int64) (*Response, error) { | ||
| u := fmt.Sprintf("orgs/%v/agents/secrets/%v/repositories", org, name) | ||
|
|
||
| type repoIDs struct { | ||
| SelectedIDs []int64 `json:"selected_repository_ids"` | ||
| } | ||
|
|
||
| req, err := s.client.NewRequest(ctx, "PUT", u, repoIDs{SelectedIDs: ids}, WithVersion(api20260310)) | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
|
|
||
| return s.client.Do(req, nil) | ||
| } | ||
|
|
||
| // AddSelectedRepoToOrgSecret adds a repository to an organization Agents secret. | ||
| // | ||
| // GitHub API docs: https://docs.github.com/rest/agents/secrets?apiVersion=2026-03-10#add-selected-repository-to-an-organization-secret | ||
| // | ||
| //meta:operation PUT /orgs/{org}/agents/secrets/{secret_name}/repositories/{repository_id} | ||
| func (s *AgentsService) AddSelectedRepoToOrgSecret(ctx context.Context, org, name string, repoID int64) (*Response, error) { | ||
| u := fmt.Sprintf("orgs/%v/agents/secrets/%v/repositories/%v", org, name, repoID) | ||
|
|
||
| req, err := s.client.NewRequest(ctx, "PUT", u, nil, WithVersion(api20260310)) | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
|
|
||
| return s.client.Do(req, nil) | ||
| } | ||
|
|
||
| // RemoveSelectedRepoFromOrgSecret removes a repository from an organization Agents secret. | ||
| // | ||
| // GitHub API docs: https://docs.github.com/rest/agents/secrets?apiVersion=2026-03-10#remove-selected-repository-from-an-organization-secret | ||
| // | ||
| //meta:operation DELETE /orgs/{org}/agents/secrets/{secret_name}/repositories/{repository_id} | ||
| func (s *AgentsService) RemoveSelectedRepoFromOrgSecret(ctx context.Context, org, name string, repoID int64) (*Response, error) { | ||
| u := fmt.Sprintf("orgs/%v/agents/secrets/%v/repositories/%v", org, name, repoID) | ||
|
|
||
| req, err := s.client.NewRequest(ctx, "DELETE", u, nil, WithVersion(api20260310)) | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
|
|
||
| return s.client.Do(req, nil) | ||
| } | ||
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Response schema have few more fields
id,url,titleandcreated_at. Let's make a new struct.{ "title": "ActionsPublicKey", "description": "The public key used for setting Actions Secrets.", "type": "object", "properties": { "key_id": { "description": "The identifier for the key.", "type": "string" }, "key": { "description": "The Base64 encoded public key.", "type": "string" }, "id": { "type": "integer" }, "url": { "type": "string" }, "title": { "type": "string" }, "created_at": { "type": "string" } }, "required": [ "key_id", "key" ] }There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@Not-Dhananjay-Mishra I'm happy to expand the key fields, however this is a departure from the pattern already in use on the actions/dependabot/codespaces secrets:
go-github/github/actions_secrets.go
Lines 15 to 19 in 9b114ec
I suggest keeping this with the short format, or expanding the scope of this PR to update the actions/dependabot/codespaces keys ensure the pattern remains consistent.
What would you prefer?