Integrate OpenHands secrets manager and GitHub API

[rbren]

Summary

This PR integrates the OpenHands secrets manager into the CVE demo project and replaces browser automation with GitHub API-based Pull Request creation for improved security and reliability.

Key Changes

🔐 Secrets Manager Integration

• BaseAgent: Added _setup_secrets() method for automatic GITHUB_TOKEN configuration
• Secure Storage: Uses StaticSecret with SecretStr for proper secret handling
• Automatic Injection: Secrets are automatically injected into bash commands (e.g., $GITHUB_TOKEN)
• Output Masking: All secret values are automatically masked in logs and outputs

🐙 GitHub API Integration

• PR Creation: New create_github_pr() method using GitHub REST API
• Branch Management: create_github_branch() for secure branch operations
• Complete Workflow: push_changes_and_create_pr() for end-to-end PR creation
• Error Handling: Comprehensive error handling with fallback mechanisms

🛠️ Updated CVE Solver

• Secure Operations: Uses secrets manager for all git operations
• API-based PRs: Creates PRs via GitHub API instead of browser automation
• Backward Compatibility: Maintains fallback to old methods if needed
• Enhanced Workflow: Improved _finalize_pull_request() with API integration

📚 Documentation

• Comprehensive Guide: docs/SECRETS_AND_GITHUB_API.md with detailed usage instructions
• Code Examples: Working examples of secrets manager and GitHub API usage
• Best Practices: Security guidelines and troubleshooting tips

Benefits

Security Improvements

• ✅ Secrets never exposed in logs or outputs
• ✅ Proper token-based authentication
• ✅ Automatic masking of sensitive values
• ✅ Secure storage using OpenHands best practices

Reliability Enhancements

• ✅ GitHub API more stable than browser automation
• ✅ Proper error handling and fallbacks
• ✅ Consistent authentication across operations
• ✅ Reduced dependency on browser-based workflows

Developer Experience

• ✅ Simple setup with environment variables
• ✅ Automatic secret injection in commands
• ✅ Clear error messages and debugging
• ✅ Comprehensive documentation

Usage

Environment Setup

export GITHUB_TOKEN="your_github_token_here"

Agent Usage

# Secrets are automatically configured
agent = BaseAgent(config, "agent-1", workspace)

# Create conversation with secrets
agent_instance, conversation = agent.create_agent_conversation()

# Git operations with automatic token injection
conversation.send_message("git clone https://[email protected]/owner/repo.git")

GitHub PR Creation

# Create PR programmatically
pr_result = agent.create_github_pr(
    repo_owner="owner",
    repo_name="repo",
    title="Fix CVE-2023-XXXX",
    body="Security vulnerability fix",
    head_branch="fix/cve-2023-xxxx"
)

Testing

The implementation has been tested with:

• ✅ Secret manager setup and configuration
• ✅ GitHub API connectivity and authentication
• ✅ Automatic secret injection in bash commands
• ✅ PR creation via GitHub API
• ✅ Backward compatibility with existing workflows

Migration

Existing agents can migrate by:

1. Extending from the updated BaseAgent
2. Using create_agent_conversation() for secrets-enabled conversations
3. Replacing browser automation with GitHub API methods
4. Following the documentation for best practices

---

This integration provides enterprise-grade secrets management and reliable GitHub operations for the CVE demo project.

@rbren can click here to continue refining the PR