c858cb816c
Add git, gh, openssh-client, curl, and sudo to the computer image with a docker smoke test. Mount deployment-owner project workspacePath at /home/rakazo/project, align /home/rakazo file paths with shell, and resolve default branch from origin/HEAD. Inject the owner GitHub token from encrypted deployment settings only into project computers; enforce branch-only push, block force-push, and require approval before the first push or gh pr in a run. Add runaway guards (tool fuse and stall pause), collapse live narration, fix streaming progress merge, DE run strings, and Lead as the project main Oo name. Fix evo-deploy test flake. Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
24 lines
820 B
TypeScript
24 lines
820 B
TypeScript
import type { DeploymentSettings } from "@rakazo/db";
|
|
|
|
type SecretLoader = {
|
|
load(ciphertext: string, recordId: string): string;
|
|
};
|
|
|
|
/** Injects the deployment owner's GitHub token into project computer shells only. */
|
|
export function ownerGithubEnvironmentForRun(input: {
|
|
settings: Pick<DeploymentSettings, "ownerUserId" | "ownerGithubTokenCipher"> | null;
|
|
userId: string;
|
|
spaceIsDefault: boolean;
|
|
secrets: SecretLoader;
|
|
}): Record<string, string> {
|
|
if (input.spaceIsDefault) return {};
|
|
if (!input.settings?.ownerGithubTokenCipher) return {};
|
|
if (input.settings.ownerUserId !== input.userId) return {};
|
|
const token = input.secrets.load(
|
|
input.settings.ownerGithubTokenCipher,
|
|
"deployment-github-token",
|
|
);
|
|
if (!token.trim()) return {};
|
|
return { GITHUB_TOKEN: token, GH_TOKEN: token };
|
|
}
|