Skip to content

Install the secrets-proxy CA and GitHub HTTPS credentials in the sandbox - #652

Open
chaosk wants to merge 2 commits into
mainfrom
ksocha/dru-584-install-the-secrets-proxy-ca-and-github-https-credentials-in
Open

chaosk wants to merge 2 commits into
mainfrom
ksocha/dru-584-install-the-secrets-proxy-ca-and-github-https-credentials-in

Conversation

@chaosk

@chaosk chaosk commented Sep 19, 2026

Copy link
Copy Markdown
Collaborator

https://linear.app/fellaworks/issue/DRU-584/install-the-secrets-proxy-ca-and-github-https-credentials-in-the

The sandbox entrypoint installs the secrets-proxy CA and points git at gh / HTTPS when GH_TOKEN is set.

Made with Cursor

@chaosk
chaosk requested a review from czpython as a code owner September 19, 2026 13:41

@czpython czpython left a comment

Copy link
Copy Markdown
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The two blocks are correct. They match the drukbox base entrypoint line for line, and the certificate path matches the NODE_EXTRA_CA_CERTS value that drukbox sends. The problem is the approach: the PR syncs a copy by hand, and the copy is the bug. See the two comments.

One more item: the commit has a Co-authored-by: Cursor trailer. Remove it before the squash, or the trailer lands on main.

Not in scope here: deploy/browser/entrypoint holds the same copy. Browser boxes boot with no secrets, so nothing fails there today.

Comment thread deploy/sandbox/entrypoint.sh Outdated
Comment thread backend/tests/test_sandbox_entrypoint.py Outdated
@chaosk

chaosk commented Sep 19, 2026

Copy link
Copy Markdown
Collaborator Author

A local commit hook re-adds Co-authored-by: Cursor on every commit. Drop that trailer at squash so it does not land on main.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants