djordjelukic1639080/pi-sbx:0.1.0

schemaVersion: "2"
kind: mixin
name: pi-sbx
displayName: Pi Cloud Sandbox
description: Prepares /project for pi-sbx-cloud by cloning the repository named by PI_SBX_REPO and PI_SBX_REF.
agentInstructions:
    content: |
        Pi runs on the host while its coding tools execute in this sandbox. The repository is checked out at `/project`.
permissions:
    network:
        allow:
            - api.github.com
            - github.com
            - codeload.github.com
            - raw.githubusercontent.com
            - cli.github.com
            - archive.ubuntu.com
            - security.ubuntu.com
            - ports.ubuntu.com
            - download.docker.com
credentials:
    - service: github
      description: GitHub token for cloning and later git/gh operations in the Pi sandbox.
      apiKey:
        name: GH_TOKEN
        proxyManaged: true
        inject:
            - domain: api.github.com
              header: Authorization
              format: Bearer %s
            - domain: github.com
              header: Authorization
              format: '%s'
              username: x-access-token
setup:
    install:
        - command: |
            set -euo pipefail

            missing=""
            command -v gh >/dev/null 2>&1 || missing="$missing gh"
            command -v git >/dev/null 2>&1 || missing="$missing git"
            [ -z "$missing" ] && exit 0

            if ! command -v apt-get >/dev/null 2>&1; then
              echo "pi-sbx: missing:$missing and apt-get is unavailable" >&2
              exit 1
            fi

            export DEBIAN_FRONTEND=noninteractive
            if ! command -v gh >/dev/null 2>&1; then
              install -m 0755 -d /etc/apt/keyrings
              if ! command -v curl >/dev/null 2>&1; then
                apt-get update -qq
                apt-get install -y -qq --no-install-recommends curl ca-certificates
              fi
              curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg \
                -o /etc/apt/keyrings/githubcli-archive-keyring.gpg
              chmod go+r /etc/apt/keyrings/githubcli-archive-keyring.gpg
              echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" \
                > /etc/apt/sources.list.d/github-cli.list
            fi

            apt-get update -qq
            # The value is assembled exclusively from the fixed package names above.
            apt-get install -y -qq --no-install-recommends $missing
            rm -rf /var/lib/apt/lists/*
          user: "0"
          description: Ensure gh and git are installed
        - command: |
            set -euo pipefail

            repo="${PI_SBX_REPO:?PI_SBX_REPO is required}"
            ref="${PI_SBX_REF:?PI_SBX_REF is required}"
            dir="${PI_SBX_DIR:-/project}"

            case "$repo" in
              *[!A-Za-z0-9._/-]*|/*|*/|*/*/*) echo "pi-sbx: invalid owner/repository: $repo" >&2; exit 1 ;;
            esac
            case "$ref" in
              *[!A-Za-z0-9._/-]*) echo "pi-sbx: invalid git ref: $ref" >&2; exit 1 ;;
            esac
            case "$dir" in
              /*) ;;
              *) echo "pi-sbx: PI_SBX_DIR must be absolute" >&2; exit 1 ;;
            esac

            git config --system --unset-all credential."https://github.com".helper 2>/dev/null || true
            git config --system --add credential."https://github.com".helper ''
            git config --system --add credential."https://github.com".helper '!gh auth git-credential'

            if [ -d "$dir/.git" ]; then
              exit 0
            fi
            if [ -e "$dir" ] && [ -n "$(ls -A "$dir" 2>/dev/null || true)" ]; then
              echo "pi-sbx: $dir exists and is non-empty but is not a Git checkout" >&2
              exit 1
            fi

            mkdir -p "$dir"
            chown agent:agent "$dir"
          user: "0"
          description: Validate settings and prepare the project directory
        - command: |
            set -euo pipefail

            repo="$PI_SBX_REPO"
            ref="$PI_SBX_REF"
            dir="${PI_SBX_DIR:-/project}"

            [ -d "$dir/.git" ] && exit 0
            if ! gh repo clone "$repo" "$dir" -- --depth 1 --branch "$ref" 2>/dev/null; then
              find "$dir" -mindepth 1 -maxdepth 1 -exec rm -rf -- {} +
              gh repo clone "$repo" "$dir"
              git -C "$dir" checkout "$ref"
            fi
          user: "1000"
          description: Clone the repository for Pi