From 06737e208f9ecc11d3b946f9adef0c1c71878f2f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Raimondas=20Rimkevi=C4=8Dius?= <github@mekdrop.name>
Date: Thu, 23 Apr 2026 20:10:47 +0300
Subject: [PATCH] worker: add GitHub secret encryption utility

---
 worker/.eslintrc.cjs          |  1 +
 worker/src/services/crypto.js | 14 ++++++++++++++
 2 files changed, 15 insertions(+)
 create mode 100644 worker/src/services/crypto.js

diff --git a/worker/.eslintrc.cjs b/worker/.eslintrc.cjs
index 52fd518..c3aacf1 100644
--- a/worker/.eslintrc.cjs
+++ b/worker/.eslintrc.cjs
@@ -1,6 +1,7 @@
 module.exports = {
   env: {
     browser: true,
+    es2021: true,
   },
   extends: ['eslint:recommended'],
   parserOptions: {
diff --git a/worker/src/services/crypto.js b/worker/src/services/crypto.js
new file mode 100644
index 0000000..926d1a2
--- /dev/null
+++ b/worker/src/services/crypto.js
@@ -0,0 +1,14 @@
+import { box } from 'tweetnacl'
+
+export async function encryptForGitHub(base64PublicKey, secretValue) {
+  const repoKey = Uint8Array.from(atob(base64PublicKey), (c) => c.charCodeAt(0))
+  const ephemeral = box.keyPair()
+  const nonce = crypto.getRandomValues(new Uint8Array(24))
+  const msg = new TextEncoder().encode(secretValue)
+  const sealed = box(msg, nonce, repoKey, ephemeral.secretKey)
+  const out = new Uint8Array(ephemeral.publicKey.length + nonce.length + sealed.length)
+  out.set(ephemeral.publicKey, 0)
+  out.set(nonce, ephemeral.publicKey.length)
+  out.set(sealed, ephemeral.publicKey.length + nonce.length)
+  return btoa(String.fromCharCode(...out))
+}