a36b45b791
* Let computer git reach GitHub through the broker with working credentials The broker URL handed to computers pointed at the supervisor's loopback address, which a container cannot reach, and host git ignored the integration token for HTTPS remotes. Computers now get the host through host.docker.internal, host git receives the token via a one-off credential helper, and clone paths and the working directory map from the computer onto the host workspace. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Tgvrj34NMnaqvtgvruYQZZ * Serve the GitHub broker to computers on a Linux host-run supervisor A loopback-bound supervisor is unreachable from containers on Linux, so it also serves the broker routes alone on the default bridge gateway, which only containers on the same host can reach. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Tgvrj34NMnaqvtgvruYQZZ --------- Co-authored-by: Claude <noreply@anthropic.com>
47 lines
1.9 KiB
TypeScript
47 lines
1.9 KiB
TypeScript
import { evaluateGitShellPolicy } from "@rakazo/core";
|
|
import { describe, expect, it, vi } from "vitest";
|
|
import { githubIntegrationEnvironmentForRun } from "./deployment-github-token.js";
|
|
import { githubBrokerBaseUrl } from "./github-broker-client.js";
|
|
|
|
describe("home Chief GitHub broker integration", () => {
|
|
it("exposes broker env without raw GitHub tokens when integration is set", () => {
|
|
vi.stubEnv("SANDBOX_SUPERVISOR_TOKEN", "test-supervisor-token-test-32chars");
|
|
vi.stubEnv("SANDBOX_GITHUB_BROKER_URL", "http://supervisor:7091/internal/github-broker");
|
|
const env = githubIntegrationEnvironmentForRun({
|
|
runId: "run-home",
|
|
githubToken: "ghp_integration_only",
|
|
});
|
|
expect(env.GITHUB_TOKEN).toBeUndefined();
|
|
expect(env.GH_TOKEN).toBeUndefined();
|
|
expect(env.RAKAZO_GITHUB_BROKER_RUN_TOKEN).toMatch(/^rgb1\./);
|
|
vi.unstubAllEnvs();
|
|
});
|
|
|
|
it("points computers at the host when the supervisor listens on loopback", () => {
|
|
vi.stubEnv("SANDBOX_GITHUB_BROKER_URL", "");
|
|
vi.stubEnv("SANDBOX_SUPERVISOR_URL", "http://127.0.0.1:7091");
|
|
expect(githubBrokerBaseUrl()).toBe("http://host.docker.internal:7091/internal/github-broker");
|
|
vi.stubEnv("SANDBOX_SUPERVISOR_URL", "http://supervisor:7091/");
|
|
expect(githubBrokerBaseUrl()).toBe("http://supervisor:7091/internal/github-broker");
|
|
vi.unstubAllEnvs();
|
|
});
|
|
|
|
it("refuses push to the default branch even when approval was granted", () => {
|
|
const decision = evaluateGitShellPolicy({
|
|
command: "git push origin main",
|
|
defaultBranch: "main",
|
|
gitPushApprovedThisRun: true,
|
|
});
|
|
expect(decision.action).toBe("block");
|
|
});
|
|
|
|
it("requires approval before the first push in a run", () => {
|
|
const decision = evaluateGitShellPolicy({
|
|
command: "git push origin feature/login",
|
|
defaultBranch: "main",
|
|
gitPushApprovedThisRun: false,
|
|
});
|
|
expect(decision.action).toBe("require_approval");
|
|
});
|
|
});
|