Mish Ushakov
4fcf7cb150
The specs in `spec/` were copied from their source repos by hand and had
drifted ~2,400 lines behind infra, so they are now imported with
Copybara (`copy.bara.sky`, run in a pinned Docker image by
`scripts/fetch-spec.sh`): `make codegen` re-fetches them at the commits
pinned in `spec/infra-ref` and `spec/belt-ref` before generating, and
the generated-files CI check fails if the tracked copies don't match the
pins. Regenerating from the current pins picks up the accumulated spec
changes in the generated JS/Python clients (renamed request schemas,
`SandboxNetworkConfig`, `SandboxIam` workload identity,
`FILE_TYPE_SYMLINK`, access-token auth deprecation, volume path-metadata
tweaks). The one handwritten SDK change follows from that: the public
`FileType` enums gain a `SYMLINK` member (JS and both Python surfaces)
so entries envd reports as symlinks show up in `files.list()` and
`getInfo()`/`get_info()` instead of being silently skipped as unknown
types. The custom `spec/remove_extra_tags.py` tag-filtering script is
replaced by Redocly CLI's `filter-in` decorator (`redocly.yaml`), which
produces identical generated JS output; a `filter-out` decorator
additionally drops any operation or component schema the upstream specs
mark `x-not-implemented: true` (currently the SOCKS5
`SandboxEgressProxyConfig`/`egressProxy` surface, which infra flagged as
spec-only); each SDK's bundle now goes to its own gitignored
`spec/openapi_generated.<api>.yml` instead of both pipelines overwriting
one shared file; Python client models now list fields in spec order
instead of alphabetical (mechanical reordering only — construct models
with keyword args). Spec fetches try whatever GitHub token is available
and fall back to the tracked copies with a warning (the public infra
specs also fetch anonymously); in CI a short-lived belt-scoped token is
minted from the org-wide Autofixer GitHub App (no new secrets), so fork
PRs simply fall back for the belt spec; the CI workflows also cache the
Copybara image alongside the codegen image, and the previously ignored
`CODEGEN_IMAGE` env is honored by the Makefile.
## Usage
```sh
# update the specs: bump a pin, then regenerate
echo <infra-commit-sha> > spec/infra-ref
make codegen
# fetch a single spec without regenerating
pnpm fetch:api-spec # spec/openapi.yml from infra
pnpm fetch:envd-spec # spec/envd/ from infra
pnpm fetch:volume-spec # spec/openapi-volumecontent.yml from belt
# try the latest spec without touching the pin
E2B_INFRA_REF=main pnpm fetch:api-spec
# change which endpoint tags an SDK exposes
$EDITOR redocly.yaml && make codegen
```
```ts
// symlinks are now visible in the filesystem API (JS; same shape in Python)
const entries = await sandbox.files.list('/home/user')
const link = entries.find((e) => e.type === FileType.SYMLINK)
console.log(link?.symlinkTarget)
```
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
62 lines
2.1 KiB
Bash
Executable File
62 lines
2.1 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
# Fetches API specs from their source-of-truth repositories with Copybara.
|
|
#
|
|
# Usage: scripts/fetch-spec.sh <api-spec|envd-spec|volume-api-spec>
|
|
#
|
|
# api-spec and envd-spec come from e2b-dev/infra at the commit pinned in
|
|
# spec/infra-ref. Override it with E2B_INFRA_REF, e.g.
|
|
# `E2B_INFRA_REF=main pnpm fetch:api-spec` to try the latest spec without
|
|
# touching the pin. volume-api-spec comes from e2b-dev/belt at the commit
|
|
# pinned in spec/belt-ref (override with E2B_BELT_REF).
|
|
#
|
|
# Fetches authenticate with GITHUB_TOKEN (or `gh auth login`) when available;
|
|
# the public infra specs also fetch anonymously. volume-api-spec needs a
|
|
# token with read access to the private belt repo — `make fetch-specs` falls
|
|
# back to the tracked copy in spec/ with a warning when a fetch fails.
|
|
#
|
|
# This script only resolves the pin and auth and runs Copybara; which spec/
|
|
# paths each workflow owns (and therefore replaces) is declared by the
|
|
# destination_files globs in copy.bara.sky.
|
|
|
|
SPEC="${1:?usage: fetch-spec.sh <api-spec|envd-spec|volume-api-spec>}"
|
|
ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
|
|
|
TOKEN="${GITHUB_TOKEN:-$(gh auth token 2> /dev/null || true)}"
|
|
|
|
case "$SPEC" in
|
|
api-spec | envd-spec)
|
|
SOURCE="e2b-dev/infra"
|
|
REF="${E2B_INFRA_REF:-$(tr -d '[:space:]' < "$ROOT_DIR/spec/infra-ref")}"
|
|
;;
|
|
volume-api-spec)
|
|
SOURCE="e2b-dev/belt"
|
|
REF="${E2B_BELT_REF:-$(tr -d '[:space:]' < "$ROOT_DIR/spec/belt-ref")}"
|
|
;;
|
|
*)
|
|
echo "error: unknown spec '$SPEC'" >&2
|
|
exit 1
|
|
;;
|
|
esac
|
|
|
|
echo "Fetching $SPEC from $SOURCE@$REF"
|
|
|
|
# Set COPYBARA_IMAGE to skip the image build and use a prebuilt image instead
|
|
# (CI builds it separately with a warm buildkit cache).
|
|
if [ -z "${COPYBARA_IMAGE:-}" ]; then
|
|
docker build -q -t e2b-copybara - < "$ROOT_DIR/copybara.Dockerfile"
|
|
COPYBARA_IMAGE=e2b-copybara
|
|
fi
|
|
|
|
docker run --rm \
|
|
--user "$(id -u):$(id -g)" \
|
|
-e HOME=/tmp \
|
|
-e GH_TOKEN="$TOKEN" \
|
|
-v "$ROOT_DIR:/workspace" \
|
|
"$COPYBARA_IMAGE" \
|
|
migrate /workspace/copy.bara.sky "$SPEC" "$REF" \
|
|
--folder-dir /workspace/spec
|
|
|
|
echo "Updated spec/ from $SPEC ($SOURCE@$REF)"
|