Encrypting GitHub Actions Secrets with libsodium Before Sending Them to the REST API
You have a GitHub repository that uses GitHub Actions and stores access keys by using GitHub encrypted secrets. You plan to update the secrets by using the GitHub REST API. You need to wrap the secrets before adding them to a REST-based call. Which encryption library should you use?
Community Votes
100% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The GitHub REST API for creating or updating repository secrets requires the secret value to be encrypted with the repository's public key using the sealed box scheme, which is provided by the libsodium library. Sending the plaintext value is rejected.
A GitHub repository stores access keys as GitHub encrypted secrets, and the secrets must be updated through the GitHub REST API. The REST API expects the secret value to be wrapped with a specific public-key encryption scheme before it is sent, so the correct library has to be identified.
Substituting a general-purpose cryptography library such as BouncyCastle or a hashing library such as hashlib. Those provide primitives that are not the sealed box construction the API expects, and a hash cannot be reversed to recover the secret.
Community Discussion (3 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
The GitHub REST API for setting an Actions secret does not accept a plaintext value, because the API transports the value over a channel where the secret must already be protected. The API requires the secret to be encrypted with the repository's public key using the libsodium sealed box construction, so the library named in the API contract is the one that must be used client side. Because the scheme is explicitly specified, using any other library produces a payload the API will not accept even if the encryption itself is cryptographically sound. The vote was unanimous at 100 for C, and maqsoodshah explained that libsodium is the recommended library for encrypting secrets for GitHub and that GitHub uses it in its own encryption process, which is the compatibility requirement that matters.Why the Other Options Are Wrong
BouncyCastle (B) is a general-purpose cryptography library offering a wide range of algorithms, but it does not implement the sealed box construction the GitHub API specifies, so a value encrypted with it is not in the format the endpoint expects. hashlib (D) provides hashing functions, which are one-way and therefore cannot produce an encrypted value the server can decrypt at all, so it is categorically wrong for this purpose. CryptoNet (A) is not a standard cryptographic library used for GitHub secret encryption and has no role in this API contract, so it does not satisfy the requirement.Community Comment Notes
The community was unanimous at 100 for C, and the single substance comment from maqsoodshah gave the correct justification, identifying libsodium as the library GitHub itself uses for its encryption process and therefore the compatible choice for wrapping secrets before a REST call. The unanimity here is justified because the question is a direct specification lookup rather than a design judgment: the API documentation names the scheme, and only one of the four options implements it.Official Reference
Related Analysis
Practice All AZ-400 Questions
Access 100 questions with complete answers and detailed explanations.
View Full AZ-400 Practice Test →