Question

You are writing a script that uses the GitHub REST API to create a new organization-level secret programmatically. Your script has already retrieved the organization's public key and key_id from the 'Get an organization public key' endpoint. Before calling the 'Create or update an organization secret' endpoint, what must your script do with the plaintext secret value?

Accepted Answer

Encrypt the value with a LibSodium sealed box using the organization's public key, then Base64-encode the result for the encrypted_value field

Answer

Base64-encode the plaintext value and send it directly in the encrypted_value field along with the key_id

Answer

Send the plaintext value over HTTPS; GitHub encrypts it at rest automatically, so no client-side encryption is required

Answer

Hash the value with SHA-256 using the key_id as a salt and submit the digest in the encrypted_value field