Refine Actions secret encryption path in nacl/box usage

[Copilot]

gh-aw uses golang.org/x/crypto only for repository secret encryption, and this issue called for two low-risk cleanups: remove an unnecessary key copy in production code and replace a test magic number with box’s exported overhead constant.

• Production: eliminate redundant public-key copy

  • Updated encryptWithPublicKey to convert the validated decoded key bytes directly to *[32]byte for box.SealAnonymous, instead of copying into a temporary array.
  • Keeps existing strict length validation and behavior unchanged.

• Tests: remove hardcoded ciphertext-size expectation

  • Replaced the fixed base64 length threshold for empty plaintext with base64.StdEncoding.EncodedLen(box.AnonymousOverhead).
  • Makes the assertion self-documenting and aligned with upstream nacl/box constants.

if len(raw) != publicKeySize {
	return "", fmt.Errorf("unexpected public key length: %d, expected %d", len(raw), publicKeySize)
}
pk := (*[publicKeySize]byte)(raw[:publicKeySize])
ciphertext, err := box.SealAnonymous(nil, []byte(plaintext), pk, rand.Reader)

// test
minBase64CiphertextLen := base64.StdEncoding.EncodedLen(box.AnonymousOverhead)

[Copilot]

Pull request overview

Small cleanups in the Actions secret encryption code path: a redundant key-copy is removed in the production helper, and a hardcoded ciphertext-size magic number in tests is replaced with the upstream nacl/box constant. The remaining file changes are regenerated workflow lock files (linguist-generated artifacts) reflecting compiler/output updates unrelated to the encryption refactor.

Changes:

• Convert decoded public-key bytes directly to *[32]byte via slice-to-array-pointer conversion in encryptWithPublicKey, avoiding a temporary array and copy.
• Replace hardcoded 64 minimum base64 ciphertext length in TestEncryptWithPublicKeyEmptyPlaintext with base64.StdEncoding.EncodedLen(box.AnonymousOverhead).
• Regenerated .github/workflows/*.lock.yml artifacts (new experiment outputs, AWF version bumps, setup action layout changes).

Show a summary per file

File	Description
pkg/cli/secret_set_command.go	Removes redundant 32-byte copy; uses slice-to-array-pointer cast for box.SealAnonymous.
pkg/cli/secret_set_command_test.go	Replaces magic 64 with base64.StdEncoding.EncodedLen(box.AnonymousOverhead).
.github/workflows/daily-byok-ollama-test.lock.yml	Regenerated: schema v4, AWF 0.25.56, inline ./actions/setup, model-multiplier step, etc.
.github/workflows/*.lock.yml (many)	Regenerated artifacts adding individual pick-experiment outputs.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 27/27 changed files
• Comments generated: 0