mirror of
https://github.com/fabro-sh/fabro.git
synced 2026-09-21 00:21:27 +00:00
d8edd410f3
Carry the resolved GitHub integration (permissions plus declared additional repositories) as one value from run materialization into workflow startup, and make the sandbox environment reach every declared repository through the single managed GITHUB_TOKEN. - `StartServices.github_permissions` becomes `github_integration: ResolvedGithubIntegration`; CLI and server workers build it with `resolve_integration()` after interpolation and pass it through `SandboxEnvSpec` as one unit. - `build_sandbox_env` constructs the validated `GitHubRepositoryAccess` and scopes the App token source to the whole effective set. Missing credentials or a missing origin are hard initialization errors when additional repositories are declared; legacy permissions-only configuration keeps its best-effort behavior. - When additional repositories are declared, initialization eagerly resolves each repository's App installation (naming any repository the App cannot see) and the token itself, so an inaccessible declared repository fails before the first workflow stage. - A new `git_bridge` module injects secret-free `GIT_CONFIG_*` entries into the stage environment: a github.com credential helper that reads `$GITHUB_TOKEN` at invocation time, per-repository SSH-to-HTTPS `insteadOf` rewrites, and `GIT_TERMINAL_PROMPT=0`. Entries append after a valid user-provided Git config overlay and fail clearly on a malformed one. Contract tests drive the installed git binary against local fixtures for the rewrite, credential, prefix-collision, and overlay-preservation behaviors. - The long-running ACP notice now says all declared repository access expires together. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| fabro-cli | ||
| fabro-mcp-server | ||
| fabro-server | ||
| fabro-spa | ||