feat(sandbox): install AWS CLI v2 in sandbox image - #893
Merged
Conversation
Selects the awscliv2 package matching the image's dpkg architecture (x86_64/aarch64), following the same pattern already used for kubectl and Nushell in this Dockerfile.
|
@mslipper could you review this pr? We use Centaur for testing on aws eks, need the AWS CLI to control the eks. This cli is really needed. I think it's a common cli |
jamalavedra
added a commit
to openfort-xyz/centaur
that referenced
this pull request
Aug 7, 2026
* test: cover Python workflow durability in CI (paradigmxyz#1236) * feat: add raw company context queries (paradigmxyz#1237) * fix(workflows): shut down Python host cleanly (paradigmxyz#1238) * fix(workflows): shut down Python host cleanly * fix(workflows): accept large host messages * feat: scope company context reader user sources (paradigmxyz#1239) * feat: scope company context reader user sources * fix: retain Google subject context authorization * test: strengthen company context reader RLS guards * test(console): remove low-value view assertions (paradigmxyz#1241) * fix(console): restore inline markdown links (paradigmxyz#1240) * fix(console): restore inline markdown links * fix(console): parse markdown placeholder indexes * fix(console): preserve restored markdown fragments * test(console): generalize markdown link regression * fix(console): schedule Google Docs sync (paradigmxyz#1244) * feat(console): promote principal identity fields (paradigmxyz#1249) * feat(console): promote principal identity fields * refactor(console): normalize principal identifiers * revert(console): remove normalized principal identifiers * fix(console): infer principal kinds from foreign IDs * fix(console): require scoped Slack DM identifiers * refactor(console): keep principal identity out of labels * refactor(console): simplify principal label aliases * fix(console): validate principal identity fields * fix(console): support Slack enterprise identity scopes * test: cover principal identity reconciliation * fix: preserve principal identity compatibility * fix: narrow principal kind backfill * fix: validate reconciled Slack identities * refactor: centralize principal identity promotion * fix: validate MCP Slack identities * fix: show principal identity labels in console * fix(api-rs): label non-Slack principal kinds (paradigmxyz#1251) * feat: add default role assignments (paradigmxyz#1250) * feat: add default role assignments * fix: preserve default roles when settings omit them * feat(console): promote console user identity fields (paradigmxyz#1252) * feat(console): promote console user identity fields * fix(console): reference console users by database id * fix(console): allow stale console user references * refactor(console): centralize principal identity labels * fix: require console and iron-proxy (paradigmxyz#1253) * fix(chart): require console * refactor(api-rs): always enable iron-proxy * fix(chart): ignore removed enable values * fix: use first-class principal identity fields (paradigmxyz#1263) * chore: remove unused investmemos tool (paradigmxyz#1267) Co-authored-by: Perry Dime <260989497+svc-paradigm@users.noreply.github.com> * fix(console): keep active sidebar chats selected (paradigmxyz#1262) * feat(sandbox): install AWS CLI v2 in sandbox image (paradigmxyz#893) Selects the awscliv2 package matching the image's dpkg architecture (x86_64/aarch64), following the same pattern already used for kubectl and Nushell in this Dockerfile. * chore: remove unused invest intake tool (paradigmxyz#1268) Co-authored-by: Perry Dime <260989497+svc-paradigm@users.noreply.github.com> * feat: add resumable Browserbase DocSend tooling (paradigmxyz#1272) * fix: route DocSend CDP through HTTPS proxy (paradigmxyz#1276) * fix(docsend): encode Browserbase session metadata (paradigmxyz#1277) * fix(docsend): encode browserbase session metadata * refactor(docsend): use base64 session metadata * refactor(docsend): require encoded session metadata * refactor(docsend): simplify base64 decoding --------- Co-authored-by: Perry Dime <260989497+svc-paradigm@users.noreply.github.com> * feat(slackbotv2): split response metadata controls (paradigmxyz#1275) * feat(slackbotv2): decouple response metadata from Console * feat(slackbotv2): split response metadata controls * chore(chart): bump release to 0.1.110 * feat(slackbotv2): add response metadata modes --------- Co-authored-by: Liam Horne <liam@lihorne.com> * fix(docsend): allow Postmark verification links (paradigmxyz#1278) * fix(slack): keep reactions when serializing messages (paradigmxyz#1264) _serialize_message builds a fixed dict from the Slack payload and drops everything it doesn't name, including the reactions array. Every read path funnels through it (get_channel_history_page, get_thread_replies_page, and the search fallback fetch), so no caller of the serialized shape can see reaction signal at all. That's a real blind spot in channels where people answer by reacting rather than replying. A message with 12 check-marks and no replies serializes to reply_count 0, which reads as "nobody responded" when the opposite is true. An agent working off that shape either reports the reply count as the roster or has to admit it can't answer. The data is already on the wire and needs no new OAuth scope. reactions:read gates the reactions.* methods, while the reactions array on a conversations.history payload rides along with channels:history, which this tool already requires. feedback.py:372 has been reading them straight off the raw responses this way for its thumbsup/thumbsdown signal. Only the serializer was throwing them away. Consistent across both read paths: the API server proxy hands back an untyped serde_json::Value, so reactions survive it and the proxy and direct fetches agree. Defaults to [] like reply_users so callers can index without a guard. Slack caps the per-reaction users array, so count can exceed len(users); anyone needing a complete reactor list on a heavily reacted message still wants reactions.get and the reactions:read scope it requires. The comment says so at the call site. Co-authored-by: Aadharsh Pannirselvam <19518661+oddharsh@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> * feat(githubbot): produce durable workflow events from CI and review webhooks (paradigmxyz#1248) * feat(githubbot): produce durable workflow events from CI and review webhooks Add a workflow-event producer module, independent of the owned-PR manager: lifecycle webhooks are translated into curated durable events on api-rs (POST /api/workflows/events) that workflows suspend on via ctx.wait_for_event. Emission runs before any owned-PR gating, because workflow waiters are not bot-owned PRs. - ci-completed (<owner>/<repo>:<head_sha>, payload {failed, failing}) fires once every check for the sha has settled. The settled evaluation reads GitHub's GraphQL statusCheckRollup — the same aggregate gh pr checks uses, covering check runs and commit statuses including EXPECTED — because fine-grained PATs get an ungrantable 403 on the REST check-runs list. An unreadable rollup is unknown, never settled, and a settled-green rollup is confirmed by one delayed re-read before emission: a push can read SUCCESS moments before the real suite registers. - review-submitted (<owner>/<repo>:pr-<n>:<head_sha>:<reviewer>, payload {review_id, state}) fires on every submitted review. Author-scoped correlations give each reviewer an independent row, so a waiter keys on exactly the author it cares about with no emission-side config. Durable events are immutable per correlation (first write wins), which forces two curation rules documented in the module header: an event must be semantically complete when emitted (the settled gate), and anything a waiter filters on belongs in the correlation. Correlations are computable from data the waiter already has and are lowercased so case drift between a PR URL slug and repository.full_name can never miss. The manager shares the settled evaluation so an owned PR is not evaluated twice per CI event. Off by default (githubbot.workflowEvents / GITHUBBOT_WORKFLOW_EVENTS); the api-rs URL and service token are already wired for the session API. * fix(githubbot): harden workflow event delivery * refactor(githubbot): simplify workflow event code * chore(deps): bump solid_queue from 1.5.0 to 1.6.0 in /services/console in the ruby-dependencies group (paradigmxyz#1259) chore(deps): bump solid_queue Bumps the ruby-dependencies group in /services/console with 1 update: [solid_queue](https://github.com/rails/solid_queue). Updates `solid_queue` from 1.5.0 to 1.6.0 - [Release notes](https://github.com/rails/solid_queue/releases) - [Commits](rails/solid_queue@v1.5.0...v1.6.0) --- updated-dependencies: - dependency-name: solid_queue dependency-version: 1.6.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: ruby-dependencies ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Add Datadog observability tool (paradigmxyz#811) * Add LLVM 22 to sandbox image (paradigmxyz#737) * feat: add OpenAI workflow dependency (paradigmxyz#1284) * feat: add OpenAI workflow dependency * fix: require OpenAI SDK 2.53 * fix(proxy): preserve Codex routing headers (paradigmxyz#1034) * fix: restore light code block contrast (paradigmxyz#1217) * fix(sandbox-k8s): fail closed on resume capability NetworkPolicies (paradigmxyz#1197) * fix(harness): use access token auth for Nanocodex (paradigmxyz#1289) * fix(harness): use ChatGPT auth for Nanocodex * fix(api): share Codex auth mode with Nanocodex * fix(harness): reject unsupported chatgpt auth alias --------- Co-authored-by: Liam Horne <liam@lihorne.com> * feat(attio): add file uploads (paradigmxyz#1290) * test: wait for workflow handler before removal (paradigmxyz#1292) * feat: add company context embedding workflow (paradigmxyz#1286) * feat: add company context embedding workflow * test: avoid SQL implementation assertions * chore: bump Helm chart version * fix: use scoped database credentials for embeddings * fix: limit embedding workflow database pool * fix: prevent embedding pipeline starvation * refactor: truncate embedding inputs by character count * refactor: store embedding failures inline * fix: allow manual embedding workflow runs * fix: skip unused workflow host database pool * Revert "fix: skip unused workflow host database pool" This reverts commit 04e84b3. * fix: use direct embedding database connection * fix: preserve GitHub Git authentication scheme (paradigmxyz#1283) * fix: preserve GitHub Git authentication scheme * refactor: model GitHub credentials by kind * fix: preserve credential kind on legacy updates * feat(googlechatbot): match Slack response metadata controls * test: align upstream compatibility checks * test(sqlx): avoid duplicate RLS fixtures --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: Matthew Slipper <me@matthewslipper.com> Co-authored-by: Derek Cofausper <256792747+decofe@users.noreply.github.com> Co-authored-by: Perry Dime <svc_ai@paradigm.xyz> Co-authored-by: Perry Dime <260989497+svc-paradigm@users.noreply.github.com> Co-authored-by: johnsonjie <32984960+johnsonjie@users.noreply.github.com> Co-authored-by: Liam Horne <liam@lihorne.com> Co-authored-by: Aadharsh Pannirselvam <aadharsh2010@gmail.com> Co-authored-by: Aadharsh Pannirselvam <19518661+oddharsh@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> Co-authored-by: Connor Justice <connorjustice@gmail.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: odysseas.eth <odyslam@gmail.com> Co-authored-by: Felix-Ayush <67006255+Ayush7614@users.noreply.github.com> Co-authored-by: Akshaan Kakar <akshaan.crackers@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
services/sandbox/Dockerfile, selecting theawscliv2package matching the image's architecture (amd64→x86_64,arm64→aarch64), following the same arch-detection pattern already used forkubectlandNushellin this file.curlwas already installed in the base package list; no change needed there.Test plan
bash -ndocker buildlocally)🤖 Generated with Claude Code