a36b45b791
* Let computer git reach GitHub through the broker with working credentials The broker URL handed to computers pointed at the supervisor's loopback address, which a container cannot reach, and host git ignored the integration token for HTTPS remotes. Computers now get the host through host.docker.internal, host git receives the token via a one-off credential helper, and clone paths and the working directory map from the computer onto the host workspace. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Tgvrj34NMnaqvtgvruYQZZ * Serve the GitHub broker to computers on a Linux host-run supervisor A loopback-bound supervisor is unreachable from containers on Linux, so it also serves the broker routes alone on the default bridge gateway, which only containers on the same host can reach. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Tgvrj34NMnaqvtgvruYQZZ --------- Co-authored-by: Claude <noreply@anthropic.com>
22 lines
940 B
Bash
22 lines
940 B
Bash
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
REAL_GH=/usr/bin/gh
|
|
if [[ "${RAKAZO_GITHUB_BROKER_URL:-}" == "" || "${RAKAZO_GITHUB_BROKER_RUN_TOKEN:-}" == "" ]]; then
|
|
exec "$REAL_GH" "$@"
|
|
fi
|
|
joined="$*"
|
|
if [[ ! "$joined" =~ (^|[[:space:]])pr([[:space:]]|$) ]]; then
|
|
exec "$REAL_GH" "$@"
|
|
fi
|
|
payload="$(python3 -c 'import json,sys; print(json.dumps({"argv":["gh"]+sys.argv[1:]}))' -- "$@")"
|
|
response="$(curl -fsS -X POST "${RAKAZO_GITHUB_BROKER_URL}/v1/gh" \
|
|
-H "Authorization: Bearer ${RAKAZO_GITHUB_BROKER_RUN_TOKEN}" \
|
|
-H "Content-Type: application/json" \
|
|
--data-binary "$payload")" || {
|
|
echo "GitHub access through evOo failed (${RAKAZO_GITHUB_BROKER_URL})." >&2
|
|
exit 1
|
|
}
|
|
code="$(python3 -c 'import json,sys; print(json.load(sys.stdin).get("code",1))' <<<"$response")"
|
|
python3 -c 'import json,sys; b=json.load(sys.stdin); sys.stdout.write(b.get("stdout") or ""); sys.stderr.write(b.get("stderr") or "")' <<<"$response"
|
|
exit "$code"
|