## Problem
The release workflow's "Commit new versions" step
(`.github/workflows/publish_packages.yml`) ran `git commit -am … && git
push` with no rebase. If any PR merged into the target branch while a
release was in flight, the remote moved ahead and the push failed as a
non-fast-forward — failing the whole release.
## Fix
Run `git pull --rebase origin "${GITHUB_REF_NAME}"` before `git push`,
so the release commit is replayed on top of the latest remote state.
```yaml
git commit -am "[skip ci] Release new versions" || exit 0
git pull --rebase origin "${GITHUB_REF_NAME}"
git push
```
Note: a narrow window remains if a PR merges between the rebase and the
push (sub-second), which would still fail; a retry loop would fully
eliminate it but adds complexity. Happy to add one if preferred.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
## Summary
PR-gated workflows filter changed paths to decide whether to run, but
their package/spec globs (`packages/**`, `spec/**`) matched every `.md`
file in those directories — so docs-only changes (e.g. a package README)
triggered full test/lint/typecheck/codegen runs.
This appends the picomatch extglob `**/!(*.md)` to those directory globs
so Markdown no longer matches, across:
- **sdk_tests.yml** — JS/Python/CLI suites (prod + staging)
- **lint.yml** — lint/format only touch `src/`, `tests/`, and Python
code, never Markdown
- **typecheck.yml** — typecheck only covers `.ts`/`.py`
- **generated_files.yml** — codegen derives from `spec/`, unaffected by
docs
The exclusion is baked into each glob rather than added as a `!**/*.md`
rule because that only subtracts under `predicate-quantifier: every`,
which is global to the step and would break the OR between the shared
and package globs. PRs touching code (or code **and** docs together)
still run as before.
Note: `pkg_artifacts.yml` builds packages on every PR with no path
filter at all — left as-is since gating it would require adding a
`changes` job and change its always-runs behavior.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
## What
The release workflow only pinged Slack on failure. This adds two
notifications to the `monitoring-releases` channel, each including an
itinerary of what is being released:
- **Release Started** (`report-start`) — posts as soon as a production
release is triggered.
- **Release Succeeded** (`report-success`) — posts when the release
publishes successfully.
The itinerary (package name + target version) is computed once in
`preflight` via `changeset status` and exposed as a job output, so both
notifications stay consistent. The jobs only fire for production
releases (`release == 'true'` / `publish` success), never for RC
publishes.
## Example Slack messages
**Started**
> 🚀 A new release has been triggered ⏳
>
> *Releasing:*
> • JS SDK (e2b) v2.30.3
> • Python SDK (e2b) v2.29.3
> • CLI (@e2b/cli) v2.12.1
**Succeeded**
> 🚀🎉 A new version has been released successfully!
:ship-it-parrot:
>
> *Released:*
> • JS SDK (e2b) v2.30.3
> • Python SDK (e2b) v2.29.3
> • CLI (@e2b/cli) v2.12.1
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Changes the **Build and push prepared templates** workflow to run only
on manual trigger (`workflow_dispatch`) instead of automatically on
every push to `main` touching `templates/**`.
This prevents the base template from being rebuilt and republished to
DockerHub/E2B on every change, giving control over when builds happen.
Once merged to `main`, the workflow can be triggered from the Actions UI
("Run workflow") or via `gh workflow run templates.yml`.
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
## Problem
The reusable SDK test workflows gated the matrix `test` job with `if:
${{ inputs.run }}`. GitHub evaluates a job's `if` *before* expanding the
matrix, so when `run` was `false` the per-OS check contexts (`JS SDK -
Build and test (ubuntu-22.04)`, `... (windows-latest)`, and the
Python/CLI equivalents) were never created — leaving required
branch-protection checks pending forever on path-filtered PRs that don't
touch the relevant package.
## Fix
Removed the job-level `if` so the matrix always expands and every per-OS
check context is created, and moved `if: ${{ inputs.run }}` onto each
step instead. When `run` is false all steps skip and the job reports
success, satisfying the required check; when true, behavior is
unchanged. Applied to `js_sdk_tests.yml`, `python_sdk_tests.yml`, and
`cli_tests.yml`.
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Adds a `buildTemplate` CI job that builds and publishes the `base`
template through the e2b CLI, running alongside the existing DockerHub
image push (renamed to `buildAndPushImage`). For security, the CLI is
built from source in this repo rather than installing the published
`@e2b/cli` package; this build-and-global-install logic lives in a
reusable composite action at `.github/actions/build-cli` so it can be
shared across workflows. Removes the static `templates/base/e2b.toml`
since template config is now driven by the CLI invocation, and switches
the Dockerfile's `node` user/group creation to system accounts (`-r`).
## Usage
Any workflow can build and install the CLI globally with a single step:
```yaml
steps:
- uses: actions/checkout@v4
- uses: ./.github/actions/build-cli
- run: e2b template create base --memory-mb 512
```
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Adds a `dorny/paths-filter` change-detection job to the PR-triggered
workflows so jobs only run when relevant paths change: Lint/Typecheck
run only when package code, spec, or lint configs change; Generated
files runs only when codegen inputs/outputs change; and the
JS/Python/CLI SDK tests run only when the respective SDK changes (CLI
also runs on JS SDK changes since it builds against it). The SDK test
jobs are gated *inside* the reusable workflows via a new `run` input
rather than by skipping the caller, so the required matrix status checks
still report (skipped jobs report success) and branch protection stays
satisfied. Shared paths (spec, lockfiles, `package.json`,
`.tool-versions`) and `workflow_dispatch` runs still trigger everything.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Adds `.github/ISSUE_TEMPLATE/config.yml` to disable blank issues,
forcing users to pick an existing template. Also adds contact links to
the E2B Docs and the E2B Discord (reusing the invite already referenced
in `CONTRIBUTING.md`).
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
<!-- CURSOR_SUMMARY -->
> [!NOTE]
> **Medium Risk**
> Medium risk because it deletes a large subtree (`apps/web`) and
removes SDK-reference generation/commit steps from the package publish
workflow, which may affect downstream docs/release expectations.
>
> **Overview**
> **Removes the docs web app and generated SDK reference content.** The
PR deletes `apps/web` configs/scripts (Next.js/MDX setup, Sentry config,
prebuild/sitemap generation) and removes the committed `sdk-reference`
MDX pages.
>
> **Simplifies repo automation and ownership.** The package publish
workflow no longer generates/clones/commits SDK reference docs,
`CODEOWNERS` drops web/docs ownership entries, and the root ESLint
config removes `@stylistic/ts` in favor of the built-in `semi` rule.
>
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
4158d777b5f3d3fa30b538e434d34ce0e697d473. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
<!-- CURSOR_SUMMARY -->
> [!NOTE]
> **Low Risk**
> Mostly CI/test changes plus a small logging tweak; low production
impact, with main risk being altered test timing/flake behavior due to
new timeout defaults.
>
> **Overview**
> Improves release-candidate GitHub workflows by passing sanitized
`tag`/`preid` via step `env` vars and quoting them when running `npm
version`/`npm publish`, reducing the chance of input/expansion issues.
>
> Stabilizes sandbox internet-access tests in JS and Python by switching
the curl target to Google’s `generate_204` endpoint and updating
expected status codes. Python tests also tighten global `pytest` timeout
to 30s, remove per-sandbox default timeouts from fixtures, and add 180s
timeouts specifically for template test suites via new `conftest.py`
files.
>
> CLI sandbox status polling now logs the caught error when
`Sandbox.getInfo` fails (instead of silently returning `false`).
>
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
187849338dd46f9d0dd1adb0a070719ebad87309. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
Potential fix for
[https://github.com/e2b-dev/E2B/security/code-scanning/3](https://github.com/e2b-dev/E2B/security/code-scanning/3)
In general, the fix is to declare an explicit `permissions` block that
restricts the `GITHUB_TOKEN` to the minimal scope required. For this
workflow, the steps only need to read the repository contents to check
out code and run tooling; they do not perform any write operations
against the GitHub API, so `contents: read` at the workflow or job level
is sufficient.
The best minimal fix is to add a top-level `permissions` block
immediately after the `name: Lint` line in `.github/workflows/lint.yml`.
This will apply to all jobs in the workflow (currently just `lint`)
without altering any existing steps. The block should be:
```yaml
permissions:
contents: read
```
No additional imports, steps, or changes to the existing job logic are
required.
_Suggested fixes powered by Copilot Autofix. Review carefully before
merging._
<!-- CURSOR_SUMMARY -->
---
> [!NOTE]
> **Low Risk**
> CI-only change that narrows GitHub token permissions; no application
logic or deployment behavior is affected.
>
> **Overview**
> Adds an explicit top-level `permissions` block to the `Lint` GitHub
Actions workflow, restricting the default `GITHUB_TOKEN` to
**read-only** repository access (`contents: read`).
>
> No lint job steps or behavior are changed; the update is purely to
tighten workflow token scope to satisfy code-scanning guidance.
>
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
fd6bd36e778825fcf2f1c9d758c65b36ba0a045a. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Potential fix for
[https://github.com/e2b-dev/E2B/security/code-scanning/4](https://github.com/e2b-dev/E2B/security/code-scanning/4)
In general, the fix is to explicitly declare a `permissions:` block that
grants only the minimal required scopes. Since this workflow only needs
to read repository contents (to check out code and inspect git
status/diff) and does not perform any writes via the GitHub API,
`contents: read` is sufficient.
The best minimally invasive fix is to add a `permissions:` block at the
workflow root (top level, alongside `on:` and `jobs:`) so that it
applies to all jobs in this workflow. Concretely, in
`.github/workflows/generated_files.yml`, insert:
```yaml
permissions:
contents: read
```
between the `on:` block (lines 3–5) and the `jobs:` block (line 6). No
changes to steps, images, or other configuration are required, and no
additional imports or tools are needed. This documents the workflow’s
needs and prevents it from gaining unintended write powers if repository
defaults change.
_Suggested fixes powered by Copilot Autofix. Review carefully before
merging._
<!-- CURSOR_SUMMARY -->
---
> [!NOTE]
> **Low Risk**
> Workflow-only change that restricts token permissions; no application
logic or data paths are affected.
>
> **Overview**
> Tightens the GitHub Actions `Generated files` workflow by explicitly
setting top-level `permissions` to `contents: read`.
>
> This addresses code-scanning guidance by ensuring the workflow token
is read-only while still allowing `actions/checkout` and the
generated-file checks to run.
>
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
225a3ee2370629605e4372768b3d018031e68e9e. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
## Summary
- Resolved 43 type diagnostics reported by ty (Astral's Python type
checker)
- Fixed Self type issues on class singletons
- Added explicit type annotations for shadowed attributes
- Replaced None with UNSET for auto-generated API parameters
- Fixed method signature alignment for protocol matching
- Added targeted type: ignore suppressions for pattern-based limitations
All checks pass: ty check, ruff format, ruff check.
<!-- CURSOR_SUMMARY -->
---
> [!NOTE]
> **Medium Risk**
> Mostly typing/CI changes, but some adjustments affect sandbox
connect/pause overload dispatch and API response/parameter handling
(`UNSET` vs `None`), which could alter edge-case runtime behavior.
>
> **Overview**
> Fixes Python SDK static typing issues for Astral’s `ty` checker and
wires typechecking into CI.
>
> Adds a new `Typecheck` GitHub Action plus workspace `typecheck`
scripts (TS packages via `tsc`, Python SDK via `make typecheck` running
`ty`), and publishes a patch changeset for `@e2b/python-sdk`.
>
> Across the Python SDK, adjusts type annotations and overloads (e.g.,
`Self`/singleton typing, `connect` overloads, optional
`user`/token/domain handling), tightens API model parsing with
`cast`/`Optional` checks and `UNSET` usage, and adds a few targeted `ty`
ignore comments in tests/protocols to silence checker limitations.
>
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
f66402847c40cee7e44e1aaa7caa97e271ba9978. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
---------
Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com>
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
<!-- CURSOR_SUMMARY -->
> [!NOTE]
> Caches Playwright binaries in JS CI and refactors JS/Python template
tests to use API mocks and aliases, add Dockerfile tests, and update
install APIs to single-package calls.
>
> - **CI**:
> - Cache Playwright binaries on `ubuntu-22.04` and `windows-latest` in
`.github/workflows/js_sdk_tests.yml` to speed JS SDK tests.
> - **JS SDK Tests**:
> - Extend `buildTemplate` options to accept `alias` in
`tests/setup.ts`.
> - Add `fromDockerfile` tests and switch some builds to
`fromBaseImage`; add build-from-base-template test.
> - Update install method tests to single-package calls for
`aptInstall`, `npmInstall`, `bunInstall`, `pipInstall`.
> - Tweak `makeSymlink` test order to ensure overwrite behavior.
> - Overhaul stacktrace tests to use `msw` server mocks and alias-based
failure mapping.
> - **Python SDK Tests**:
> - `build`/`async_build` fixtures accept optional `alias`.
> - Add `from_dockerfile` tests (sync/async); use base image/base
template where applicable.
> - Update install method tests to single-package calls.
> - Rewrite stacktrace tests to monkeypatch API calls with alias-based
failure mapping.
> - **Dependencies**:
> - Add dev dependency `msw` to `packages/js-sdk/package.json`.
>
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
1b7f84f4ce692f664c3ce4cdb345f4c3a028b17a. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
<!-- CURSOR_SUMMARY -->
> [!NOTE]
> Add Windows to CI matrices and make JS/Python utils and tests
cross-platform via path handling updates.
>
> - **CI**:
> - Add Windows to test matrices in `cli_tests.yml`, `js_sdk_tests.yml`,
`python_sdk_tests.yml`; set bash shell/workdirs; disable fail-fast for
some jobs.
> - Python CI runs `pytest -n 4` via Poetry.
> - **JS SDK**:
> - Path normalization for globbing (`normalizePath`) and use of
`Path.relativePosix()` in hashing and tar creation in
`src/template/utils.ts`.
> - **Python SDK**:
> - Add `normalize_path` and use forward-slash glob patterns in
`e2b/template/utils.py`.
> - **Tests**:
> - Make stack trace parsing robust to Windows paths; use `basename` in
file assertions; adjust Python tar tests tempdir fixture handling.
> - **Changeset**: add patch note for windows-related fixes.
>
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
1b8dbe4a1af642dbcb86500837e93f7998b223f6. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
---------
Co-authored-by: Joseph Lombrozo <joe.lombrozo@e2b.dev>
This requires [infra#1448](https://github.com/e2b-dev/infra/pull/1448)
first.
<!-- CURSOR_SUMMARY -->
---
> [!NOTE]
> Adds support to override the sandbox API URL (E2B_SANDBOX_URL) across
JS/Python SDKs, centralizes sandbox host/url logic with headers, and
updates CI to build the SDK before CLI.
>
> - **SDKs (JS & Python)**
> - Add `sandboxUrl` support in `ConnectionConfig` (env var
`E2B_SANDBOX_URL`), with new helpers `getSandboxUrl`/`getHost` and
shared `envdPort`.
> - Refactor sandbox initialization to use
`ConnectionConfig.getSandboxUrl(...)` and `getHost(...)`.
> - Always attach sandbox headers `E2b-Sandbox-Id` and
`E2b-Sandbox-Port` to sandbox and connect requests.
> - Python: thread `sandbox_url` through opts; update async/sync connect
calls to pass headers; minor fix to default `headers=None` in
`e2b_connect.client.Client` stream prep.
> - **CI**
> - Build `packages/js-sdk` before `packages/cli`; set step
`working-directory` for build/test.
> - **Dependencies**
> - Point `e2b` dependency in lockfile to local `../js-sdk` link.
>
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
5dc58171af6c170f8640f49d736dbe9c571f2b21. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
---------
Co-authored-by: Mish <10400064+mishushakov@users.noreply.github.com>
- Individual tests must complete in less than 5 minutes
- Add a `make test` option that runs tests
- Upgrade poetry to 2.1.1 (the lock file was generated by this version,
so this just matches what we already expect)
<!-- CURSOR_SUMMARY -->
> [!NOTE]
> Move npm publishing to OIDC by adding id-token permissions and
removing NPM_TOKEN, update actions/setup-node to v6, and upgrade npm in
workflows.
>
> - **Workflows**:
> - **OIDC for npm publish**:
> - Add `permissions: id-token: write` in
`workflows/publish_packages.yml` and `workflows/release.yml`.
> - Remove `NPM_TOKEN` secret requirement and set `NPM_TOKEN: ""` in
`changesets/action` env.
> - **Node/tooling updates**:
> - Bump `actions/setup-node` from `v3` to `v6` and set `registry-url`
where needed.
> - Add step to upgrade `npm` to `^11.6` in `publish_packages.yml`.
> - Keep pnpm caching/configuration and other steps intact.
>
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
539db5937bfe83c4222015de3dcf9c1f90764bf3. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
<!-- CURSOR_SUMMARY -->
> [!NOTE]
> Expand Release Candidates workflow to run on PR label, open, reopen,
and sync events.
>
> - **CI/CD**:
> - Update `on.pull_request.types` in
`.github/workflows/release_candidates.yml` to include `labeled`,
`opened`, `reopened`, and `synchronize` so the Release Candidate
workflow runs on these events.
>
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
a0842f5d6e0902ed04f9d42fa9b258dd098d56da. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
This way a version bump in the `.tool-versions` file is automatically
used in tests, linters, releases, and local dev. It also helps make it
clear which version we expect people to use locally.
<!-- CURSOR_SUMMARY -->
---
> [!NOTE]
> Add .tool-versions and update GitHub Actions to parse and use its
values for pnpm, Node.js, Python, Poetry, and Deno.
>
> - **CI Workflows**:
> - Add parsing of `.tool-versions` via
`wistia/parse-tool-versions@v2.1.1` in `cli_tests.yml`,
`generated_files.yml`, `js_sdk_tests.yml`, `lint.yml`,
`publish_packages.yml`, `python_sdk_tests.yml`, `release.yml`,
`release_candidates.yml`.
> - Replace hardcoded versions with `${{ env.TOOL_VERSION_* }}`:
> - `pnpm`: `TOOL_VERSION_PNPM`
> - `node-version`: `TOOL_VERSION_NODEJS`
> - `python-version`: `TOOL_VERSION_PYTHON`
> - `poetry` installer `version`: `TOOL_VERSION_POETRY`
> - `deno-version`: `TOOL_VERSION_DENO`
> - **Tooling**:
> - Add `.tool-versions` specifying `deno 1.46.3`, `nodejs 20.19.5`,
`pnpm 9.15.5`, `python 3.9`, `poetry 1.8.3`.
>
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
358b62f586f3dfa164ad331f0ee7c7372e96bfac. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
<!-- CURSOR_SUMMARY -->
> [!NOTE]
> Update CI to use Poetry 1.8.3 across workflows and add
`.tool-versions` (Python 3.9.24, Poetry 1.8.3) for the Python SDK.
>
> - **CI/Workflows**:
> - Bump Poetry from `1.5.1` to `1.8.3` in
`/.github/workflows/{lint.yml,publish_packages.yml,python_sdk_tests.yml,release_candidates.yml}`.
> - **Tooling**:
> - Add `packages/python-sdk/.tool-versions` specifying `python 3.9.24`
and `poetry 1.8.3`.
>
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
9ae519772a9cd62333313dcc594edcc90a591c0a. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
Introduce beta submodule with beta features - pause and resume
Update Sandbox list to also return paused sandboxes
---------
Co-authored-by: Tomas Valenta <valenta.and.thomas@gmail.com>
# Description
Fixes an issue in generating files in Docker. There has been an
incompatibility of `buf` (version `29.5`) and `protoc-gen-es` (version
`2.2.2`).
I updated `protoc-gen-es@` to `2.6.2`
Also refactored the code a little so it's easier to read
Added a CI pipeline job to check all files are properly generated
Mish Ushakov