djordjelukic1639080/cbx-example-github-ssh:1

schemaVersion: "3"
displayName: GitHub over SSH
description: Lets git fetch from and push to GitHub over SSH with the user's key ([email protected]:owner/repo), through the SSH agent cbx exposes. The agent may log in to github.com as git and do nothing else.
version: 1.0.0
kind: mixin
provides:
    - [email protected]
capabilities:
    - group:
        name: github-ssh
        capabilities:
            - type: com.docker.sandbox/ssh-agent@1
              config:
                authenticate:
                    - [email protected]
                phase: runtime
                unrestricted: false
              description: Log in to GitHub over SSH with the user's key
            - type: com.docker.sandbox/network-policy@2
              config:
                runtime:
                    allow:
                        - github.com:22
            - type: com.docker.sandbox/lifecycle@1
              config:
                files:
                    - content: |
                        Host github.com
                          UserKnownHostsFile ${{ kit.env.HOME }}/.ssh/known_hosts_github
                          StrictHostKeyChecking yes
                      description: Check GitHub's host keys
                      mode: "0644"
                      overwrite: false
                      path: ${{ kit.env.HOME }}/.ssh/config
                    - content: |
                        github.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl
                        github.com ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBEmKSENjQEezOmxkZMy7opKgwFB9nkt5YRrYMjNuG5N87uRgg6CLrbo5wAdT/y6v0mKV0U2w0WZ2YB/++Tpockg=
                        github.com ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCj7ndNxQowgcQnjshcLrqPEiiphnt+VTTvDP6mHBL9j1aNUkY4Ue1gvwnGLVlOhGeYrnZaMgRK6+PKCUXaDbC7qtbW8gIkhL7aGCsOr/C56SJMy/BCZfxd1nWzAOxSDPgVsmerOBYfNqltV9/hWCqBywINIR+5dIg6JTJ72pcEpEjcYgXkE2YEFXV1JHnsKgbLWNlhScqb2UmyRkQyytRLtL+38TGxkxCflmO+5Z8CSSNY7GidjMIZ7Q4zMjA2n1nGrlTDkzwDCsw+wqFPGQA179cnfGWOWRVruj16z6XyvxvjJwbz0wQZ75XK5tKSb7FNyeIEs4TT4jk+S4dhPeAUC5y+bDYirYgM4GC7uEnztnZyaVWQ7B381AK4Qdrwt51ZqExKbQpTUNn+EjqoTwvqNj4kqx5QUCI0ThS/YkOxJCXmPUWZbhjpCg56i+2aB6CmK2JGhn57K5mj0MNdBXA4/WnwH6XoPWJzK5Nyu2zB3nAZp+S5hpQs+p1vN1/wsjk=
                      description: GitHub's SSH host keys
                      mode: "0644"
                      path: ${{ kit.env.HOME }}/.ssh/known_hosts_github
            - type: com.docker.sandbox/agent-context@1
              config:
                content: |
                    git can clone, fetch and push GitHub repositories over SSH
                    ([email protected]:owner/repo.git) with the user's key. The agent logs in
                    to github.com as git and refuses every other server and account, so
                    do not use ssh for anything else. If ssh reports a changed host key,
                    stop and tell the user; never disable host key checking. The key is
                    the user's: push only what the user asked for.