0c9e6d7c58
Route git push and gh pr through the sandbox supervisor broker so project computers never receive GITHUB_TOKEN/GH_TOKEN. Remove NOPASSWD sudo from the computer image. Localize awareness strip copy via Lingui and wire computer-image-tools.test.sh into the validate-computer-image job. Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
21 lines
879 B
Bash
21 lines
879 B
Bash
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
REAL_GIT=/usr/bin/git
|
|
if [[ "${RAKAZO_GITHUB_BROKER_URL:-}" == "" || "${RAKAZO_GITHUB_BROKER_RUN_TOKEN:-}" == "" ]]; then
|
|
exec "$REAL_GIT" "$@"
|
|
fi
|
|
sub="${1:-}"
|
|
case "$sub" in
|
|
push|fetch|pull|clone|ls-remote)
|
|
payload="$(python3 -c 'import json,sys; print(json.dumps({"argv":["git"]+sys.argv[1:]}))' -- "$@")"
|
|
response="$(curl -fsS -X POST "${RAKAZO_GITHUB_BROKER_URL}/v1/git" \
|
|
-H "Authorization: Bearer ${RAKAZO_GITHUB_BROKER_RUN_TOKEN}" \
|
|
-H "Content-Type: application/json" \
|
|
--data-binary "$payload")"
|
|
code="$(python3 -c 'import json,sys; print(json.load(sys.stdin).get("code",1))' <<<"$response")"
|
|
python3 -c 'import json,sys; b=json.load(sys.stdin); sys.stdout.write(b.get("stdout") or ""); sys.stderr.write(b.get("stderr") or "")' <<<"$response"
|
|
exit "$code"
|
|
;;
|
|
esac
|
|
exec "$REAL_GIT" "$@"
|