Make Dependabot secret store opt-in per secret

Previously every secret was written to both the Actions and Dependabot
secret stores. Write to Actions by default and only to Dependabot when a
secret sets `dependabot: true`, so Actions-only credentials are not
exposed to the Dependabot attack surface. Skip fetching the Dependabot
public key when no secret opts in.

Author: phelma

lib/rake_github/tasks/secrets/provision.rb

@@ -42,18 +42,25 @@ def provision_actions_secrets(client, task)
         end
 
         def provision_dependabot_secrets(client, task)
+          secrets = task.secrets.select { |secret| secret[:dependabot] }
+          return if secrets.empty?
+
           public_key = client.get_dependabot_public_key(task.repository)
-          task.secrets.each do |secret|
-            $stdout.print "Adding '#{secret[:name]}' to Dependabot... "
-            client.create_or_update_dependabot_secret(
-              task.repository,
-              secret[:name],
-              secret_options(public_key, secret[:value])
-            )
-            $stdout.puts 'Done.'
+          secrets.each do |secret|
+            write_dependabot_secret(client, task, public_key, secret)
           end
         end
 
+        def write_dependabot_secret(client, task, public_key, secret)
+          $stdout.print "Adding '#{secret[:name]}' to Dependabot... "
+          client.create_or_update_dependabot_secret(
+            task.repository,
+            secret[:name],
+            secret_options(public_key, secret[:value])
+          )
+          $stdout.puts 'Done.'
+        end
+
         def secret_options(public_key, value)
           {
             key_id: public_key.key_id,

spec/rake_github/tasks/secrets/provision_spec.rb

@@ -116,6 +116,69 @@ def define_task(opts = {}, &block)
   end
   # rubocop:enable RSpec/MultipleExpectations
 
+  it 'does not write to the dependabot store by default' do
+    repository = 'org/repo'
+
+    client = stub_github_client
+
+    define_task(
+      repository:,
+      access_token: 'some-token',
+      secrets: [{ name: 'SOME_SECRET', value: 'some-value' }]
+    )
+
+    Rake::Task['secrets:provision'].invoke
+
+    expect(client)
+      .not_to(have_received(:create_or_update_dependabot_secret))
+  end
+
+  it 'does not fetch the dependabot public key when no secret opts in' do
+    client = stub_github_client
+
+    define_task(
+      repository: 'org/repo',
+      access_token: 'some-token',
+      secrets: [{ name: 'SOME_SECRET', value: 'some-value' }]
+    )
+
+    Rake::Task['secrets:provision'].invoke
+
+    expect(client).not_to(have_received(:get_dependabot_public_key))
+  end
+
+  # rubocop:disable RSpec/MultipleExpectations
+  it 'writes every secret to actions but only opted-in secrets to dependabot' do
+    repository = 'org/repo'
+
+    client = stub_github_client
+
+    define_task(
+      repository:,
+      access_token: 'some-token',
+      secrets: [
+        { name: 'ACTIONS_ONLY', value: 'value-one' },
+        { name: 'BOTH', value: 'value-two', dependabot: true }
+      ]
+    )
+
+    Rake::Task['secrets:provision'].invoke
+
+    expect(client)
+      .to(have_received(:create_or_update_actions_secret)
+            .with(repository, 'ACTIONS_ONLY', anything))
+    expect(client)
+      .to(have_received(:create_or_update_actions_secret)
+            .with(repository, 'BOTH', anything))
+    expect(client)
+      .to(have_received(:create_or_update_dependabot_secret)
+            .with(repository, 'BOTH', anything))
+    expect(client)
+      .not_to(have_received(:create_or_update_dependabot_secret)
+                .with(repository, 'ACTIONS_ONLY', anything))
+  end
+  # rubocop:enable RSpec/MultipleExpectations
+
   it 'creates or updates the dependabot secret with a sealed value' do
     repository = 'org/repo'
     access_token = 'some-token'
@@ -129,7 +192,7 @@ def define_task(opts = {}, &block)
     define_task(
       repository:,
       access_token:,
-      secrets: [{ name: 'SOME_SECRET', value: 'some-value' }]
+      secrets: [{ name: 'SOME_SECRET', value: 'some-value', dependabot: true }]
     )
 
     Rake::Task['secrets:provision'].invoke
@@ -155,7 +218,7 @@ def define_task(opts = {}, &block)
     define_task(
       repository:,
       access_token: 'some-token',
-      secrets: [{ name: 'SOME_SECRET', value: 'some-value' }]
+      secrets: [{ name: 'SOME_SECRET', value: 'some-value', dependabot: true }]
     )
 
     Rake::Task['secrets:provision'].invoke
@@ -192,6 +255,29 @@ def define_task(opts = {}, &block)
                   hash_including(key_id: 'actions-key-id')))
   end
 
+  it 'passes the fetched key id to the dependabot secret' do
+    repository = 'org/repo'
+    private_key = RbNaCl::PrivateKey.generate
+
+    client = stub_github_client
+    stub_dependabot_public_key(
+      client, repository, 'dependabot-key-id', private_key
+    )
+
+    define_task(
+      repository:,
+      access_token: 'some-token',
+      secrets: [{ name: 'SOME_SECRET', value: 'some-value', dependabot: true }]
+    )
+
+    Rake::Task['secrets:provision'].invoke
+
+    expect(client)
+      .to(have_received(:create_or_update_dependabot_secret)
+            .with(repository, 'SOME_SECRET',
+                  hash_including(key_id: 'dependabot-key-id')))
+  end
+
   # rubocop:disable RSpec/MultipleExpectations
   it 'fetches each public key once per run rather than per secret' do
     repository = 'org/repo'
@@ -207,8 +293,8 @@ def define_task(opts = {}, &block)
       repository:,
       access_token: 'some-token',
       secrets: [
-        { name: 'SECRET_ONE', value: 'value-one' },
-        { name: 'SECRET_TWO', value: 'value-two' }
+        { name: 'SECRET_ONE', value: 'value-one', dependabot: true },
+        { name: 'SECRET_TWO', value: 'value-two', dependabot: true }
       ]
     )