djordjelukic1639080/cbx-example-github:1

schemaVersion: "3"
displayName: GitHub repository, web and SSH
description: Clone a GitHub repository, browse GitHub and optionally authenticate over SSH
version: 1.0.0
kind: mixin
provides:
    - [email protected]
capabilities:
    - type: com.docker.sandbox/network-policy@2
      config:
        install:
            allow:
                - hosts:
                    - github.com
                  methods:
                    - GET
                    - POST
                  paths:
                    - /${{ kit.args.repo }}.git/**
                    - /${{ kit.args.repo }}/**
        runtime:
            allow:
                - hosts:
                    - github.com
                  methods:
                    - GET
                    - POST
                  paths:
                    - /${{ kit.args.repo }}.git/**
                    - /${{ kit.args.repo }}/**
    - type: com.docker.sandbox/credential@1
      optional: true
      config:
        apiKey:
            inject:
                - domain: github.com
                  scheme: basic
                  username: x-access-token
            name: GH_TOKEN
            proxyManaged: true
        phase:
            - install
            - runtime
        service: github
      description: GitHub token to clone and push to the repository
    - type: com.docker.sandbox/lifecycle@1
      config:
        install:
            - command: |
                set -eu
                if [ -d "$GITHUB_REPO_DIR/.git" ]; then
                  echo "github-repo: $GITHUB_REPO_DIR already holds a clone; leaving it"
                  exit 0
                fi
                mkdir -p "$GITHUB_REPO_DIR"
                if [ -n "$(ls -A "$GITHUB_REPO_DIR")" ]; then
                  echo "github-repo: $GITHUB_REPO_DIR is not empty; refusing to clone into it" >&2
                  exit 1
                fi
                git clone --quiet "https://github.com/$GITHUB_REPO.git" "$GITHUB_REPO_DIR"
                echo "github-repo: cloned $GITHUB_REPO into $GITHUB_REPO_DIR"
              description: Clone the repository into the workspace
              env:
                - GITHUB_REPO
                - GITHUB_REPO_DIR
                - HTTP_PROXY
                - HTTPS_PROXY
                - http_proxy
                - https_proxy
              user: agent
    - type: com.docker.sandbox/agent-context@1
      config:
        content: |
            The GitHub repository ${{ kit.args.repo }} is cloned at
            ${{ kit.args.dir }}. git can fetch from and push to that repository
            over HTTPS. The GitHub web group also permits other repositories and
            the GitHub API; HTTPS access is not confined to this repository.
    - group:
        name: github-web
        capabilities:
            - type: com.docker.sandbox/network-policy@2
              config:
                runtime:
                    allow:
                        - github.com
                        - api.github.com
                        - raw.githubusercontent.com
                        - codeload.github.com
                        - release-assets.githubusercontent.com
            - type: io.cbx/graphql@1
              config:
                runtime:
                    - deny:
                        - Mutation.createCommitOnBranch
                        - Query.viewer
                      hosts:
                        - api.github.com
                      paths:
                        - /graphql
            - type: com.docker.sandbox/agent-context@1
              config:
                content: |
                    github.com, api.github.com and GitHub's content hosts
                    (raw.githubusercontent.com, codeload.github.com,
                    release-assets.githubusercontent.com) are reachable over HTTPS.
                    The GraphQL createCommitOnBranch mutation is refused: make
                    commits locally and push them with git.
    - group:
        name: github-ssh
        optional: true
        capabilities:
            - type: com.docker.sandbox/ssh-agent@1
              config:
                authenticate:
                    - [email protected]
                phase: runtime
                unrestricted: false
              description: Log in to GitHub over SSH with the user's key
            - type: com.docker.sandbox/network-policy@2
              config:
                runtime:
                    allow:
                        - github.com:22
            - type: com.docker.sandbox/lifecycle@1
              config:
                files:
                    - content: |
                        Host github.com
                          UserKnownHostsFile ${{ kit.env.HOME }}/.ssh/known_hosts_github
                          StrictHostKeyChecking yes
                      description: Check GitHub's host keys
                      mode: "0644"
                      overwrite: false
                      path: ${{ kit.env.HOME }}/.ssh/config
                    - content: |
                        github.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl
                        github.com ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBEmKSENjQEezOmxkZMy7opKgwFB9nkt5YRrYMjNuG5N87uRgg6CLrbo5wAdT/y6v0mKV0U2w0WZ2YB/++Tpockg=
                        github.com ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCj7ndNxQowgcQnjshcLrqPEiiphnt+VTTvDP6mHBL9j1aNUkY4Ue1gvwnGLVlOhGeYrnZaMgRK6+PKCUXaDbC7qtbW8gIkhL7aGCsOr/C56SJMy/BCZfxd1nWzAOxSDPgVsmerOBYfNqltV9/hWCqBywINIR+5dIg6JTJ72pcEpEjcYgXkE2YEFXV1JHnsKgbLWNlhScqb2UmyRkQyytRLtL+38TGxkxCflmO+5Z8CSSNY7GidjMIZ7Q4zMjA2n1nGrlTDkzwDCsw+wqFPGQA179cnfGWOWRVruj16z6XyvxvjJwbz0wQZ75XK5tKSb7FNyeIEs4TT4jk+S4dhPeAUC5y+bDYirYgM4GC7uEnztnZyaVWQ7B381AK4Qdrwt51ZqExKbQpTUNn+EjqoTwvqNj4kqx5QUCI0ThS/YkOxJCXmPUWZbhjpCg56i+2aB6CmK2JGhn57K5mj0MNdBXA4/WnwH6XoPWJzK5Nyu2zB3nAZp+S5hpQs+p1vN1/wsjk=
                      description: GitHub's SSH host keys
                      mode: "0644"
                      path: ${{ kit.env.HOME }}/.ssh/known_hosts_github
            - type: com.docker.sandbox/agent-context@1
              config:
                content: |
                    git can clone, fetch and push GitHub repositories over SSH
                    ([email protected]:owner/repo.git) with the user's key. The agent logs in
                    to github.com as git and refuses every other server and account, so
                    do not use ssh for anything else. If ssh reports a changed host key,
                    stop and tell the user; never disable host key checking. The key is
                    the user's: push only what the user asked for.
args:
    dir:
        default: /home/agent/workspace
        description: Absolute directory to clone into
        pattern: /[A-Za-z0-9_.-]+(?:/[A-Za-z0-9_.-]+)*
        env: GITHUB_REPO_DIR
    repo:
        required: true
        description: GitHub repository to clone, as owner/name
        pattern: '[A-Za-z0-9](?:[A-Za-z0-9-]{0,38})/(?:[A-Za-z0-9_.-]*(?:[A-Za-su-z0-9_-]|[A-Za-hj-z0-9_.-]t|[A-Za-fh-z0-9_.-]it|[A-Za-z0-9_-]git)|t|it|git)'
        env: GITHUB_REPO