unkinben
748048be50
Sessions run claude with --dangerously-skip-permissions and a prompt built from issue/PR/comment text, so only trusted authors may supply that text. teabot now dispatches a job only when the triggering event's author login is on an allowlist; an empty allowlist dispatches nothing (fail-closed). Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv
75 lines
2.6 KiB
Go
75 lines
2.6 KiB
Go
package config
|
|
|
|
// Example is a fully-commented sample config written by `teabot config init`.
|
|
const Example = `# teabot configuration
|
|
# Location: $XDG_CONFIG_HOME/teabot/config.yaml (default ~/.config/teabot/config.yaml)
|
|
|
|
# Base URL of the Gitea instance to watch.
|
|
gitea_url: https://git.unkin.net
|
|
|
|
# How often to poll each repo.
|
|
poll_interval: 60s
|
|
|
|
# Repositories to watch, in owner/name form.
|
|
repos:
|
|
- unkin/teabot
|
|
|
|
# Maximum number of Claude job containers running at once.
|
|
max_concurrent: 2
|
|
|
|
# Per-session wall-clock timeout.
|
|
job_timeout: 30m
|
|
|
|
# Container image each session runs in. The default already ships the Claude
|
|
# CLI plus a Go/Node/Python/tea developer toolchain.
|
|
job_image: git.unkin.net/unkin/agent-dev:latest
|
|
|
|
# Home directory inside job_image (mount target for tea/claude config).
|
|
container_home: /home/agent
|
|
|
|
# Host directory holding Claude Code credentials (subscription auth). A private
|
|
# copy is mounted into each container so token refreshes never touch this dir.
|
|
claude_config_dir: ~/.claude
|
|
|
|
# Optional: use an Anthropic API key / gateway instead of subscription auth.
|
|
# When set these are injected as ANTHROPIC_API_KEY / ANTHROPIC_BASE_URL.
|
|
# anthropic_api_key: ""
|
|
# anthropic_base_url: ""
|
|
|
|
# Optional: override the state directory (default ~/.local/state/teabot).
|
|
# state_dir: ~/.local/state/teabot
|
|
|
|
# SECURITY: author allowlist. Jobs run with --dangerously-skip-permissions in a
|
|
# container whose prompt is built from issue/PR/comment TEXT, so only trusted
|
|
# authors may supply that text. teabot dispatches a job only when the event's
|
|
# author login is listed here. Events from anyone else are recorded (so they do
|
|
# not re-trigger) and logged, but never spawn a container. This is fail-closed:
|
|
# an empty/absent list dispatches NOTHING.
|
|
allowed_authors:
|
|
- benvin
|
|
|
|
# Optional per-repo override. A present entry fully replaces allowed_authors for
|
|
# that repo (an empty list disables dispatch for it); absent falls back to the
|
|
# global list above.
|
|
# repo_allowed_authors:
|
|
# unkin/teabot:
|
|
# - benvin
|
|
# - trusted-colleague
|
|
|
|
# Bot personalities. Each is a distinct Gitea account backed by its own tea
|
|
# config file (create it with: tea logins add --name <bot> ...). teabot reads
|
|
# the token + username from that file and mounts it into the container so tea
|
|
# acts as this identity. Roles: implementer, reviewer, both.
|
|
personalities:
|
|
- name: implementer
|
|
tea_config: ~/.config/teabot/tea-implementer.yml
|
|
role: implementer
|
|
git_name: Teabot Implementer
|
|
git_email: teabot-implementer@unkin.net
|
|
- name: reviewer
|
|
tea_config: ~/.config/teabot/tea-reviewer.yml
|
|
role: reviewer
|
|
git_name: Teabot Reviewer
|
|
git_email: teabot-reviewer@unkin.net
|
|
`
|