Unable to set a Dependabot secret with selected repos

[juanitosvq]

Describe the bug

When trying to save a Dependabot secret with selected repos using the CLI, I get an error saying that the selected repository is not of type string. See logs below.

This is happening running the CLI locally but also inside an action:

$ gh --version
gh version 2.22.1 (2023-01-27)
https://github.com/cli/cli/releases/tag/v2.22.1

Seems similar to google/go-github#2401?

Steps to reproduce the behavior

See logs

Expected vs actual behavior

Should be able to save a Dependabot secret with selected repos.

Logs

Paste the activity from your command line. Redact if needed.

$ gh secret set MY_DEPENDABOT_SECRET --org my-org --visibility selected --repos admin --app dependabot --body "TEST"
1 error occurred:
	* failed to set secret "MY_DEPENDABOT_SECRET": HTTP 422: Invalid request. (https://api.github.com/orgs/my_org/dependabot/secrets/MY_DEPENDABOT_SECRET)

Invalid property /selected_repository_ids/0: `58XXXXXXX` is not of type `string`.

[juanitosvq]

For completion, when I run the same command on actions secrets, it is successful:

$ gh secret set MY_ACTIONS_SECRET --org my-org --visibility selected --repos admin --app actions --body "TEST"
✓ Set Actions secret MY_ACTIONS_SECRET for my-org

[samcoe]

@juanitosvq Thanks for writing in with the bug. I was able to confirm that this is the same issue as google/go-github#2401 where we are sending integers for repository ids instead of strings. This is a weird inconsistency in the Dependabot API as all other secret endpoints request integers. I am checking internally if this is something that is being addressed or if we should create a workaround here in gh.

[mislav]

@joshmgross do you have insight here re: #6923?

[joshmgross]

@mislav we should use the same workaround for Dependabot org secrets that #6923 had for Codespaces user secrets.

It'd be worth tracking this internally and fixing, but this API is available on GHES as well - https://docs.github.com/en/enterprise-server@3.7/rest/dependabot/secrets

[samcoe]

Great, sounds like we have a path forward with creating a workaround. I will assign myself and open a PR to fix this.