Repo deployment keys rotated remediation

ssh-keygen -t ed25519 -C "deploy-key-for-<repo-name>" -f ~/.ssh/<repo-name>-deploy-key

cat ~/.ssh/<repo-name>-deploy-key.pub

# Set variables
OWNER="your-org-or-username"
REPO="your-repo-name"

# List current deploy keys
gh api repos/$OWNER/$REPO/keys --jq '.[] | {id, title, read_only, created_at}'

# Create a new key pair specifically for this repo
ssh-keygen -t ed25519 -C "deploy-key-$OWNER-$REPO-$(date +%Y%m%d)" -f ~/.ssh/deploy_key_$OWNER_$REPO -N ""

NEW_KEY_TITLE="deploy-key-$OWNER-$REPO-$(date +%Y%m%d)"
NEW_PUB_KEY=$(cat ~/.ssh/deploy_key_$OWNER_$REPO.pub)

# Add as read-only (set to false if you truly need write access)
gh api repos/$OWNER/$REPO/keys \
  -X POST \
  -f title="$NEW_KEY_TITLE" \
  -f key="$NEW_PUB_KEY" \
  -F read_only=true

gh api repos/$OWNER/$REPO/keys --jq '.[] | {id, title, read_only, created_at}'

pip install requests cryptography

export GITHUB_TOKEN="ghp_XXXXXXXXXXXXXXXXXXXX"

from cryptography.hazmat.primitives import serialization
from cryptography.hazmat.primitives.asymmetric import rsa
from cryptography.hazmat.backends import default_backend

def generate_ssh_keypair():
    # Generate private key
    private_key = rsa.generate_private_key(
        public_exponent=65537,
        key_size=4096,
        backend=default_backend()
    )

    # Private key PEM
    private_pem = private_key.private_bytes(
        encoding=serialization.Encoding.PEM,
        format=serialization.PrivateFormat.TraditionalOpenSSL,
        encryption_algorithm=serialization.NoEncryption(),
    ).decode("utf-8")

    # Public key in OpenSSH format
    public_key = private_key.public_key()
    public_openssh = public_key.public_bytes(
        encoding=serialization.Encoding.OpenSSH,
        format=serialization.PublicFormat.OpenSSH,
    ).decode("utf-8")

    return private_pem, public_openssh

# Example usage
private_key_pem, public_key_ssh = generate_ssh_keypair()
print("Public key:", public_key_ssh)
# Store/print private_key_pem securely for your CI/CD or deployment system

import os
import requests

GITHUB_TOKEN = os.environ["GITHUB_TOKEN"]
REPO_OWNER = "your-org-or-user"
REPO_NAME = "your-repo"

def add_deploy_key(title, public_key, read_only=True):
    url = f"https://api.github.com/repos/{REPO_OWNER}/{REPO_NAME}/keys"
    headers = {
        "Authorization": f"token {GITHUB_TOKEN}",
        "Accept": "application/vnd.github+json",
    }
    payload = {
        "title": title,
        "key": public_key,
        "read_only": read_only,  # False if you need write
    }

    resp = requests.post(url, json=payload, headers=headers)
    resp.raise_for_status()
    return resp.json()

# Example: add newly-generated key
private_key_pem, public_key_ssh = generate_ssh_keypair()
new_key = add_deploy_key("rotated-deploy-key-2026-07-25", public_key_ssh)
print("New deploy key ID:", new_key["id"])

def list_deploy_keys():
    url = f"https://api.github.com/repos/{REPO_OWNER}/{REPO_NAME}/keys"
    headers = {
        "Authorization": f"token {GITHUB_TOKEN}",
        "Accept": "application/vnd.github+json",
    }
    resp = requests.get(url, headers=headers)
    resp.raise_for_status()
    return resp.json()

keys = list_deploy_keys()
for k in keys:
    print(k["id"], k["title"], k["key"])

def delete_deploy_key(key_id: int):
    url = f"https://api.github.com/repos/{REPO_OWNER}/{REPO_NAME}/keys/{key_id}"
    headers = {
        "Authorization": f"token {GITHUB_TOKEN}",
        "Accept": "application/vnd.github+json",
    }
    resp = requests.delete(url, headers=headers)
    if resp.status_code not in (204, 404):
        # 204 = success; 404 = already gone
        resp.raise_for_status()

# Example: delete all keys with a specific old title pattern
OLD_TITLE = "old-deploy-key"

for k in list_deploy_keys():
    if OLD_TITLE in k["title"]:
        print(f"Deleting key {k['id']} ({k['title']})")
        delete_deploy_key(k["id"])

# GitHub provider configuration
provider "github" {
  owner = "GITHUB_ORG_OR_USER" # e.g. "my-org"
  token = "GITHUB_TOKEN_WITH_REPO_SCOPE" # or use environment variable GITHUB_TOKEN
}

# Existing repository
resource "github_repository" "repo" {
  name        = "REPOSITORY_NAME" # e.g. "my-service"
  visibility  = "private"
  description = "REPOSITORY_DESCRIPTION"
}

# NEW deploy key (rotation target)
# Generate a new SSH key pair outside Terraform; put the PUBLIC key here.
resource "github_repository_deploy_key" "new_deploy_key" {
  repository = github_repository.repo.name

  title      = "NEW_DEPLOY_KEY_TITLE"   # e.g. "ci-deploy-key-2024-07"
  key        = "NEW_PUBLIC_SSH_KEY"     # e.g. "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAI..."
  read_only  = false                    # set to true if write is not required

  # rotation note: changing `key` forces replacement of this resource
}

# Remove the OLD deploy key from Terraform state/config
# 1. Replace the old resource block in your code with the new one above, OR
# 2. If you still have it declared, delete the old block:
#
# resource "github_repository_deploy_key" "old_deploy_key" { ... }  # <-- DELETE this block
#
# Any applications using the old key must be reconfigured to use the
# NEW private key that matches NEW_PUBLIC_SSH_KEY before applying.