sbx/gitlab-ssh-kit:20260910-34edb9066bc5d091ce74a30d8f65e2ffc89d2f21

schemaVersion: "2"
kind: mixin
name: gitlab-ssh
displayName: GitLab SSH
description: Pre-populates GitLab.com's SSH host keys so git clone/push/pull over SSH work without interactive host verification prompts.
agentInstructions:
    content: |
        ## GitLab SSH authentication

        GitLab.com's SSH host keys are pre-populated in `~/.ssh/known_hosts`, so
        SSH operations to GitLab (clone, push, pull) work without interactive
        host verification prompts. Use `[email protected]:group/project.git`
        remotes — the sandbox proxy does not rewrite git-over-HTTPS Basic auth
        for GitLab (see the `gitlab` kit), so SSH is the supported push/pull path.
permissions:
    network:
        allow:
            - gitlab.com
setup:
    install:
        - command: |
            mkdir -p /home/agent/.ssh
            chmod 700 /home/agent/.ssh
            chown agent:agent /home/agent/.ssh
            cat >> /home/agent/.ssh/known_hosts <<'EOF'
            gitlab.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAfuCHKVTjquxvt6CM6tdG4SLp1Btn/nOeHHE5UOzRdf
            gitlab.com ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCsj2bNKTBSpIYDEGk9KxsGh3mySTRgMtXL583qmBpzeQ+jqCMRgBqB98u3z++J1sKlXHWfM9dyhSevkMwSbhoR8XIq/U0tCNyokEi/ueaBMCvbcTHhO7FcwzY92WK4Yt0aGROY5qX2UKSeOvuP4D6TPqKF1onrSzH9bx9XUf2lEdWT/ia1NEKjunUqu1xOB/StKDHMoX4/OKyIzuS0q/T1zOATthvasJFoPrAjkohTyaDUz2LN5JoH839hViyEG82yB+MjcFV5MU3N1l1QL3cVUCh93xSaua1N85qivl+siMkPGbO5xR/En4iEY6K2XPASUEMaieWVNTRCtJ4S8H+9
            gitlab.com ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBFSMqzJeV9rUzU4kWitGjeR4PWSa29SPqJ1fVkhtj3Hw9xjLVXVYrU9QlYWrOLXBpQ6KWjbjTDTdDkoohFzgbEY=
            EOF
            chmod 644 /home/agent/.ssh/known_hosts
            chown agent:agent /home/agent/.ssh/known_hosts
          user: "0"
          description: Pin GitLab.com's published SSH host keys into known_hosts