#!/usr/bin/env sh
# Store the bot App credentials as repository secrets. Neither value enters
# a process argument list: gh reads a secret from standard input when --body
# is omitted, and printf is a shell builtin, so no external process sees the
# App ID either.
#
# The private key arrives on this script's own standard input, written there
# by rk from the file it validated. rk holds the bytes; this script never
# learns where they came from, so nothing between rk's check and gh's read
# can substitute a different file. The App ID's gh call takes its standard
# input from the pipe on its own line, which leaves this script's standard
# input untouched for the one call that needs it.
#
# The armor and newlines land verbatim. Overwriting is correct: a rotated
# credential must be able to replace an old one.
|