GitHub operations

import asyncio
from boxlite import SimpleBox, BoxliteError

async def main() -> None:
    # ubuntu base image makes it convenient to install git via apt-get
    try:
        async with SimpleBox(image="ubuntu:24.04") as box:
            # 1) Install git (a non-zero exit from exec does not raise; check exit_code yourself)
            setup = await box.exec("bash", "-lc", "apt-get update && apt-get install -y git")
            if setup.exit_code != 0:
                print("git install failed:\n", setup.stderr)
                return

            # 2) Clone a public repository
            clone = await box.exec(
                "git", "clone", "--depth", "1",
                "https://github.com/octocat/Hello-World.git", "/work/repo",
            )
            if clone.exit_code != 0:
                print("clone failed:\n", clone.stderr)
                return

            # 3) Read the most recent commit
            log = await box.exec(
                "git", "-C", "/work/repo", "log", "-1", "--pretty=%h %s",
            )
            print("latest commit:", log.stdout.strip())
    except BoxliteError as exc:
        # Wrapper-layer error (e.g. validation failure); an image pull failure may be a standard RuntimeError
        print("BoxLite error:", exc)
    except RuntimeError as exc:
        print("runtime error (commonly image pull / virtualization unavailable):", exc)

if __name__ == "__main__":
    asyncio.run(main())

import asyncio
from boxlite import Boxlite, BoxOptions, Secret, NetworkSpec, BoxliteError

# TODO: replace with your real token; prefer reading from an environment variable over hardcoding
GITHUB_TOKEN = "<YOUR_GITHUB_TOKEN>"  # e.g. os.environ["GITHUB_TOKEN"]

# After the Secret is injected, the placeholder env var is named BOXLITE_SECRET_GITHUB_TOKEN,
# whose value is the placeholder string (below); the real token is not inside the sandbox.
PLACEHOLDER = "<BOXLITE_SECRET:github_token>"

async def main() -> None:
    options = BoxOptions(
        image="ubuntu:24.04",
        # Disable auto-remove so the runtime.remove in finally is the single cleanup point (default auto_remove=True)
        auto_remove=False,
        # Narrow outbound network to GitHub (default NetworkSpec is Enabled with allow_net=[], i.e. allow all)
        network=NetworkSpec(mode="enabled", allow_net=["github.com", "api.github.com"]),
        # Inject via Secret: the MITM proxy replaces the placeholder with the real token only when
        # an outbound request matches hosts and the placeholder appears in the header/body.
        secrets=[
            Secret(
                name="github_token",
                value=GITHUB_TOKEN,
                hosts=["github.com", "api.github.com"],
            ),
        ],
    )

    try:
        # Boxlite is a synchronous context manager (do not await); but runtime.create/remove are coroutines and must be awaited.
        with Boxlite.default() as runtime:
            box = await runtime.create(options)
            try:
                async with box:  # Box is an async context manager
                    # Install git inside the sandbox
                    # The native Box.exec returns an Execution (streaming handle); await wait() to get the exit code
                    setup = await box.exec(
                        "bash", args=["-lc", "apt-get update && apt-get install -y git"],
                    )
                    setup_result = await setup.wait()
                    if setup_result.exit_code != 0:
                        print("git install failed")
                        return

                    # Clone a private repo: use http.extraHeader to put the placeholder in plaintext in the Authorization header;
                    # the real token is substituted by the MITM proxy on the outbound request. The placeholder itself is not a secret and may appear on the command line.
                    clone = await box.exec(
                        "git",
                        args=[
                            "-c", f"http.extraHeader=Authorization: Bearer {PLACEHOLDER}",
                            "clone", "--depth", "1",
                            # TODO: replace with your private repository
                            "https://github.com/<YOUR_ORG>/<YOUR_PRIVATE_REPO>.git",
                            "/work/repo",
                        ],
                    )
                    clone_result = await clone.wait()
                    print("clone exit code:", clone_result.exit_code)
            finally:
                await runtime.remove(box.id, force=True)  # runtime method: remove lives on the runtime
    except BoxliteError as exc:
        print("BoxLite error:", exc)
    except RuntimeError as exc:
        print("runtime error:", exc)

if __name__ == "__main__":
    asyncio.run(main())