Question

You are automating the rotation of an organization-level secret named DEPLOY_TOKEN using the GitHub REST API. Your script sends a PUT request to the create/update organization secret endpoint with the new value. However, GitHub rejects the request. What step must your script perform on the secret value before submitting it via the REST API?

Accepted Answer

Retrieve the organization public key from the API, encrypt the value with that key using libsodium (sealed box), and send the encrypted result with the corresponding key_id

Answer

Base64-encode the plaintext value and send it directly in the 'encrypted_value' field

Answer

Hash the value with SHA-256 and include the digest in the 'encrypted_value' field along with the repository IDs

Answer

Send the plaintext value over HTTPS since transport encryption already protects it in transit