sbx/github-ssh:latest

schemaVersion: "3"
displayName: GitHub SSH
description: Pre-populates GitHub host keys so SSH operations work without interactive host verification prompts.
version: 1.0.0
kind: mixin
requires:
    - deb/jq
    - deb/openssh-client
capabilities:
    - type: com.docker.sandbox/network-policy@1
      config:
        install:
            allow:
                - api.github.com
        runtime:
            allow:
                - github.com
    - type: com.docker.sandbox/lifecycle@1
      config:
        install:
            - command: |
                mkdir -p /home/agent/.ssh
                chmod 700 /home/agent/.ssh
                chown agent:agent /home/agent/.ssh
                curl -s https://api.github.com/meta \
                  | jq -r '.ssh_keys[] | "github.com " + .' \
                  >> /home/agent/.ssh/known_hosts
                chmod 644 /home/agent/.ssh/known_hosts
                chown agent:agent /home/agent/.ssh/known_hosts
              description: Fetch and install GitHub host keys from api.github.com/meta
              user: "0"
    - type: com.docker.sandbox/agent-context@1
      config:
        contentFile: /usr/share/sandbox/kit/github-ssh/github-ssh-context.md