feat(sandbox): add Suno CLI and skill - #38
Open
joystick-gg[bot] wants to merge 6 commits into
Open
joystick-gg[bot] wants to merge 6 commits into
joystick-gg[bot] wants to merge 6 commits into
Conversation
Retarget publish-images.yml at ghcr.io/cartridge-gg/centaur on GitHub-hosted runners with docker buildx (this fork has no Depot project), add the release/c7e-centaur-overlay* branch glob and contrib/chart/** path trigger, and auto-dispatch the c7e overlay deploy when canonical-branch images publish. Add tag-release.yml: durable c7e-<upstream-base>-<counter> tags cut from main, so deployed commits can never be orphaned by history rewrites. Gate release-chart.yml's tag minting to the upstream repo so the fork cannot mint colliding centaur-* tags. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…ough
Console: add a github_app grant to the broker-credential registry. The
console holds the App private key (client_secret, stored encrypted) and
mints short-lived installation tokens via an RS256 App JWT, rotating
them like any other brokered credential. An idempotent seed migration
provisions the credential from GITHUB_APP_ID / GITHUB_APP_INSTALLATION_ID /
GITHUB_APP_PRIVATE_KEY_B64 when set; the chart wires those env vars into
the console from the shared infra Secret.
api-rs: let a tool's pyproject declare where an HTTP secret's value
comes from (source = {type = "token_broker", credential_id = ...}) and
forward the table verbatim into the generated iron-proxy fragment:
tool_discovery parses it, centaur-perms mirrors it, iron-control accepts
typed sources at startup. Falls back to the {placeholder: <secret_ref>}
shape when no source table is given.
Together these let a tool (the deployment's github_auth_headers) ride
broker-rotated GitHub App tokens: raw tokens never enter sandboxes and
no out-of-band CronJob rotates a shared secret.
Pending upstream as paradigmxyz#793 + companion.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
(cherry picked from commit 3ccdd79)
The tag-fetch step adds an upstream remote to the checkout, so gh resolved the base repo to paradigmxyz/centaur and the release step failed with "tag has not been pushed" (c7e-0.1.110-2 needed a manual gh release create). GH_REPO pins resolution to this repository. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The Chat SDK's event dispatch drops file events (file_shared,
file_change) before any callback fires, so nothing today can react to a
file being created or edited. Add a raw-body sidecar (the
channel_created / lateSlackFiles pattern) that, when enabled, creates a
durable workflow run via POST /api/workflows/runs for matching file
events.
Deployment-neutral and default-off: the target workflow name, event
types, channel allowlist, and files.info title-keyword filter all come
from env config (SLACKBOTV2_FILE_EVENT_*). The bot stays timer-free —
any settle/debounce behavior belongs in the target workflow, which can
sleep durably. Per-edit event storms collapse at spawn time via the
idempotency key slack-file-event:{workflow}:{file_id} (optionally
time-bucketed); the dispatch task never throws into the webhook path.
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
kariy
force-pushed
the
centaur/add-suno-cli-1787598510
branch
from
August 25, 2026 11:00
544df0e to
c378dd0
Compare
joystick-gg
Bot
force-pushed
the
main
branch
from
September 4, 2026 22:01
5530336 to
d8b3766
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
sunov0.9.0 in the sandbox base image using stable RustValidation
TOOL_ALLOWLIST= GIT_CONFIG_GLOBAL=/dev/null uv run python -m unittest discover -s services/sandbox -p "test_*.py"(35 tests)git diff --checkPrompted by: tarrence