docs: private repositories clone with a token in the runner's env (#91)

OP OpenVibers committed 12 days ago · 5c4b43ba16 · 2 files, +12 −3

* docs/worker.md: private repositories clone with a token in the runner's env (GITHUB_TOKEN, GITLAB_TOKEN, OPENVIBE_GIT_CREDENTIALS), sent as a header and never through OpenVibe (Codes CLI 0.6.1)

* CI: the race job and the Python matrix run on ubuntu-24.04 (ubuntu-latest became 26.04 on 11-01: no cgroup v2 delegation for the real desk sandbox test, no Python 3.9)

Changes

ddiff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
iindex 5a7993a..c7c3c46 100644
---- a/.github/workflows/ci.yml
++++ b/.github/workflows/ci.yml
@@@ -11,7 +11,9 @@ permissions:
  jobs:
    go:
      name: go vet and test (race)
--    runs-on: ubuntu-latest
++    # ubuntu-24.04, not -latest: on 2026-11-01 -latest moved to 26.04, whose runner scope will not delegate the cgroup v2
++    # controllers the real desk sandbox test needs (test_a_real_desk_in_the_sandbox), and has no Python 3.9.
++    runs-on: ubuntu-24.04
      steps:
        - uses: actions/checkout@v4
        - uses: actions/setup-go@v5
@@@ -100,7 +102,7 @@ jobs:
  
    python:
      name: plugins (python ${{ matrix.python }})
--    runs-on: ubuntu-latest
++    runs-on: ubuntu-24.04   # 26.04 (-latest since 2026-11-01) has no Python 3.9 to set up
      strategy:
        fail-fast: false
        matrix:
ddiff --git a/docs/worker.md b/docs/worker.md
iindex c3a4b31..5598680 100644
---- a/docs/worker.md
++++ b/docs/worker.md
@@@ -25,11 +25,18 @@ one-time code: `curl -fsSL https://openvibe.bot/install | sh -s -- --network …
    on a second run, and so do the keys you added.
  
  Then add your agent keys to the runner's `env` in `config.json` (`DEEPSEEK_API_KEY`, `ANTHROPIC_API_KEY`,
--`OPENAI_API_KEY`, and `GITHUB_TOKEN` to push branches and open pull requests), install any agent CLIs system-wide
++`OPENAI_API_KEY`, and `GITHUB_TOKEN` to clone private GitHub repositories, push branches and open pull requests;
++`GITLAB_TOKEN` for gitlab.com, and `OPENVIBE_GIT_CREDENTIALS` for any other host, one `https://user:token@host` per
++line, as git's credential store writes them), install any agent CLIs system-wide
  (`sudo npm install -g @anthropic-ai/claude-code @openai/codex`), and restart the service. A task started on
  openvibe.codes/run then clones the repository inside the job's sandbox, runs the agents there, and hands back the
  summary, the changed files and the patch; it never pushes to the branch it started from.
  
++Inside the sandbox nothing of yours is reachable (no home folder, no git sign-in), so a private repository clones only
++with a token from this `env`. Codes CLI 0.6.1 and later sends it to git as an `Authorization` header for that host
++alone, through `GIT_CONFIG_*` variables: it is never on a command line, in the clone's remote URL or in its
++`.git/config`, and it never passes through OpenVibe.
++
  ## Config
  
  `config.json`, section `worker` (defaults shown; a zero cap means the default):

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml

index 5a7993a..c7c3c46 100644

--- a/.github/workflows/ci.yml

+++ b/.github/workflows/ci.yml

@@ -11,7 +11,9 @@ permissions:

jobs:

go:

name: go vet and test (race)

- runs-on: ubuntu-latest

+ # ubuntu-24.04, not -latest: on 2026-11-01 -latest moved to 26.04, whose runner scope will not delegate the cgroup v2

+ # controllers the real desk sandbox test needs (test_a_real_desk_in_the_sandbox), and has no Python 3.9.

+ runs-on: ubuntu-24.04

steps:

- uses: actions/checkout@v4

- uses: actions/setup-go@v5

@@ -100,7 +102,7 @@ jobs:

python:

name: plugins (python ${{ matrix.python }})

- runs-on: ubuntu-latest

+ runs-on: ubuntu-24.04 # 26.04 (-latest since 2026-11-01) has no Python 3.9 to set up

strategy:

fail-fast: false

matrix:

diff --git a/docs/worker.md b/docs/worker.md

index c3a4b31..5598680 100644

--- a/docs/worker.md

+++ b/docs/worker.md

@@ -25,11 +25,18 @@ one-time code: `curl -fsSL https://openvibe.bot/install | sh -s -- --network …

on a second run, and so do the keys you added.

Then add your agent keys to the runner's `env` in `config.json` (`DEEPSEEK_API_KEY`, `ANTHROPIC_API_KEY`,

-`OPENAI_API_KEY`, and `GITHUB_TOKEN` to push branches and open pull requests), install any agent CLIs system-wide

+`OPENAI_API_KEY`, and `GITHUB_TOKEN` to clone private GitHub repositories, push branches and open pull requests;

+`GITLAB_TOKEN` for gitlab.com, and `OPENVIBE_GIT_CREDENTIALS` for any other host, one `https://user:token@host` per

+line, as git's credential store writes them), install any agent CLIs system-wide

(`sudo npm install -g @anthropic-ai/claude-code @openai/codex`), and restart the service. A task started on

openvibe.codes/run then clones the repository inside the job's sandbox, runs the agents there, and hands back the

summary, the changed files and the patch; it never pushes to the branch it started from.

+Inside the sandbox nothing of yours is reachable (no home folder, no git sign-in), so a private repository clones only

+with a token from this `env`. Codes CLI 0.6.1 and later sends it to git as an `Authorization` header for that host

+alone, through `GIT_CONFIG_*` variables: it is never on a command line, in the clone's remote URL or in its

+`.git/config`, and it never passes through OpenVibe.

## Config

`config.json`, section `worker` (defaults shown; a zero cap means the default):