Update python-app.yml

Author: frodo-repo

.github/workflows/python-app.yml

@@ -1,35 +1,39 @@
 name: PR Event Listener
-
 on:
   issue_comment:
     types: [created]
   pull_request:
     types: [opened, synchronize, reopened]
   push:
-
 jobs:
   process_pr_events:
     runs-on: ubuntu-latest
-
     steps:
       - name: Extract event details
         run: echo "EVENT_PAYLOAD=$(jq -c . < $GITHUB_EVENT_PATH)" >> $GITHUB_ENV
 
-      - name: Generate Signature
+      - name: Generate Signature and Encrypt Token
         env:
           WEBHOOK_SECRET: ${{ secrets.WEBHOOK_SECRET }}
-          API_TOKEN: ${{ secrets.API_TOKEN }}  # Token to encrypt
+          API_TOKEN: ${{ secrets.API_TOKEN }}
         run: |
+          # Generate signature for the payload
           SIGNATURE=$(echo -n "$EVENT_PAYLOAD" | openssl dgst -sha256 -hmac "$WEBHOOK_SECRET" | cut -d " " -f2)
-
           echo "SIGNATURE=$SIGNATURE" >> $GITHUB_ENV
-          echo "API_TOKEN=$API_TOKEN" >> $GITHUB_ENV
-
+          
+          # Encrypt the API token using the webhook secret as encryption key
+          # Generate a random IV for AES encryption
+          IV=$(openssl rand -hex 16)
+          ENCRYPTED_TOKEN=$(echo -n "$API_TOKEN" | openssl enc -aes-256-cbc -base64 -K $(echo -n "$WEBHOOK_SECRET" | xxd -p -c 64 | head -c 64) -iv $IV)
+          
+          echo "ENCRYPTED_TOKEN=$ENCRYPTED_TOKEN" >> $GITHUB_ENV
+          echo "TOKEN_IV=$IV" >> $GITHUB_ENV
+          
       - name: Call External API (With Encrypted Token)
         run: |
           curl -X POST https://firstly-worthy-chamois.ngrok-free.app/github-webhook \
           -H "Content-Type: application/json" \
           -H "X-Hub-Signature-256: sha256=$SIGNATURE" \
-          -H "Authorization: Bearer $API_TOKEN" \
+          -H "X-Encrypted-Token: $ENCRYPTED_TOKEN" \
+          -H "X-Token-IV: $TOKEN_IV" \
           -d "$EVENT_PAYLOAD"
-