sbx/gitlab-ssh-kit:latest

schemaVersion: "2"
kind: mixin
name: gitlab-ssh
displayName: GitLab SSH
description: Appends a GitLab instance's SSH host keys to ~/.ssh/known_hosts so git clone/push/pull over SSH work without interactive host verification. GitLab.com's keys are pinned; a self-managed instance's key is supplied with the hostKey argument. Writes no private key material and touches nothing else under ~/.ssh.
args:
    host:
        default: gitlab.com
        description: GitLab instance hostname, e.g. gitlab.example.com for a self-managed instance
        pattern: ^[A-Za-z0-9][A-Za-z0-9.-]*$
    hostKey:
        default: ""
        description: known_hosts key for a self-managed instance, as 'ALGORITHM BASE64' with no trailing comment. Required when host is not gitlab.com; ignored for gitlab.com, whose keys are pinned below.
        pattern: ^$|^(ssh-ed25519|ssh-rsa|ecdsa-sha2-nistp256|ecdsa-sha2-nistp384|ecdsa-sha2-nistp521) [A-Za-z0-9+/]+=*$
agentInstructions:
    content: |
        ## GitLab SSH authentication

        ${{ kit.args.host }}'s SSH host keys are pre-populated in
        `~/.ssh/known_hosts`, so SSH operations to GitLab (clone, push, pull)
        work without interactive host verification prompts. Use
        `git@${{ kit.args.host }}:group/project.git` remotes — the sandbox proxy
        does not rewrite git-over-HTTPS Basic auth for GitLab (see the `gitlab`
        kit), so SSH is the supported push/pull path.
permissions:
    network:
        allow:
            - ${{ kit.args.host }}
setup:
    install:
        - command: |
            set -euo pipefail
            HOST='${{ kit.args.host }}'
            HOST_KEY='${{ kit.args.hostKey }}'

            if [ "$HOST" = "gitlab.com" ]; then
              KEYS=$(cat <<'EOF'
            gitlab.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAfuCHKVTjquxvt6CM6tdG4SLp1Btn/nOeHHE5UOzRdf
            gitlab.com ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCsj2bNKTBSpIYDEGk9KxsGh3mySTRgMtXL583qmBpzeQ+jqCMRgBqB98u3z++J1sKlXHWfM9dyhSevkMwSbhoR8XIq/U0tCNyokEi/ueaBMCvbcTHhO7FcwzY92WK4Yt0aGROY5qX2UKSeOvuP4D6TPqKF1onrSzH9bx9XUf2lEdWT/ia1NEKjunUqu1xOB/StKDHMoX4/OKyIzuS0q/T1zOATthvasJFoPrAjkohTyaDUz2LN5JoH839hViyEG82yB+MjcFV5MU3N1l1QL3cVUCh93xSaua1N85qivl+siMkPGbO5xR/En4iEY6K2XPASUEMaieWVNTRCtJ4S8H+9
            gitlab.com ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBFSMqzJeV9rUzU4kWitGjeR4PWSa29SPqJ1fVkhtj3Hw9xjLVXVYrU9QlYWrOLXBpQ6KWjbjTDTdDkoohFzgbEY=
            EOF
            )
            elif [ -n "$HOST_KEY" ]; then
              KEYS="$HOST $HOST_KEY"
            else
              echo "gitlab-ssh: host is $HOST, not gitlab.com, and no hostKey was supplied." >&2
              echo "" >&2
              echo "A self-managed instance's SSH host key is not published anywhere this" >&2
              echo "kit can verify, so it must be supplied explicitly. On the GitLab server:" >&2
              echo "" >&2
              echo "    cat /etc/ssh/ssh_host_ed25519_key.pub" >&2
              echo "" >&2
              echo "Take the first two fields only (algorithm and key, no trailing comment)" >&2
              echo "and pass them, quoted because of the space:" >&2
              echo "" >&2
              echo "    --kit-arg \"hostKey=ssh-ed25519 AAAAC3Nz...\"" >&2
              echo "" >&2
              echo "Confirm it is the right key before trusting it:" >&2
              echo "    ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub" >&2
              exit 1
            fi

            mkdir -p /home/agent/.ssh
            chmod 700 /home/agent/.ssh
            chown agent:agent /home/agent/.ssh
            printf '%s\n' "$KEYS" >> /home/agent/.ssh/known_hosts
            chmod 644 /home/agent/.ssh/known_hosts
            chown agent:agent /home/agent/.ssh/known_hosts
          user: "0"
          description: Pin the target instance's SSH host keys into known_hosts