0c9e6d7c58
Route git push and gh pr through the sandbox supervisor broker so project computers never receive GITHUB_TOKEN/GH_TOKEN. Remove NOPASSWD sudo from the computer image. Localize awareness strip copy via Lingui and wire computer-image-tools.test.sh into the validate-computer-image job. Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
19 lines
846 B
Bash
19 lines
846 B
Bash
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
REAL_GH=/usr/bin/gh
|
|
if [[ "${RAKAZO_GITHUB_BROKER_URL:-}" == "" || "${RAKAZO_GITHUB_BROKER_RUN_TOKEN:-}" == "" ]]; then
|
|
exec "$REAL_GH" "$@"
|
|
fi
|
|
joined="$*"
|
|
if [[ ! "$joined" =~ (^|[[:space:]])pr([[:space:]]|$) ]]; then
|
|
exec "$REAL_GH" "$@"
|
|
fi
|
|
payload="$(python3 -c 'import json,sys; print(json.dumps({"argv":["gh"]+sys.argv[1:]}))' -- "$@")"
|
|
response="$(curl -fsS -X POST "${RAKAZO_GITHUB_BROKER_URL}/v1/gh" \
|
|
-H "Authorization: Bearer ${RAKAZO_GITHUB_BROKER_RUN_TOKEN}" \
|
|
-H "Content-Type: application/json" \
|
|
--data-binary "$payload")"
|
|
code="$(python3 -c 'import json,sys; print(json.load(sys.stdin).get("code",1))' <<<"$response")"
|
|
python3 -c 'import json,sys; b=json.load(sys.stdin); sys.stdout.write(b.get("stdout") or ""); sys.stderr.write(b.get("stderr") or "")' <<<"$response"
|
|
exit "$code"
|