ci: build the desktop template on every cluster (foxtrot, juliett, tango) by devin-ai-integration[bot] · Pull Request #260 · e2b-dev/desktop

devin-ai-integration · 2026-09-07T14:40:35Z

Summary

The desktop template is now built on every production cluster — foxtrot, juliett and tango — instead of foxtrot only. Clusters are separate tenancies with separate template registries, so a template built on one does not exist on the others.

template.yml splits into the DockerHub image job (unchanged, push-only) and a buildTemplate matrix job, one leg per cluster. The matrix holds {cluster, domain}; the API key is selected in the build step with static secret references, so the runner only receives these three keys (a dynamic secrets[...] index would hand the job every org and repo secret):

matrix:
  include:
    - { cluster: foxtrot, domain: e2b.dev }
    - { cluster: juliett, domain: e2b-juliett.dev }
    - { cluster: tango,   domain: e2b-tango.dev }
# build step only
E2B_API_KEY: ${{ (matrix.cluster == 'foxtrot' && secrets.E2B_API_KEY) || (matrix.cluster == 'juliett' && secrets.E2B_JULIETT_API_KEY) || (matrix.cluster == 'tango' && secrets.E2B_TANGO_API_KEY) || '' }}

E2B_JULIETT_API_KEY and E2B_TANGO_API_KEY are new repo secrets and must be added before merging. A missing key fails that leg with Missing API key secret for cluster: <cluster>; fail-fast: false so the other clusters still build.

Also adds a bare workflow_dispatch so the template can be rebuilt on all clusters without a template change (the Docker image only rebuilds on push). Legs on the same cluster serialize via Template-${{ github.ref }}-<cluster>; different clusters run in parallel. Both jobs use the uv setup from main.

Merging this PR triggers the workflow (its path filter includes the workflow file), which will do the first juliett/tango builds.

Companion PR for the code-interpreter template: e2b-dev/code-interpreter#338.

Link to Devin session: https://app.devin.ai/sessions/e307a60ded5e4986a82930c5f7b8169e
Open in Devin Desktop: https://app.devin.ai/desktop/session/e307a60ded5e4986a82930c5f7b8169e?variant=devin
Requested by: @mishushakov

devin-ai-integration · 2026-09-07T14:40:38Z

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

Disable automatic comment, CI, and merge conflict monitoring

chatgpt-codex-connector · 2026-10-13T14:44:44Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-13T14:47:13.097526Z	`0766d5d`	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

devin-ai-integration · 2026-10-13T14:44:52Z

❌ Cannot revive Devin session - the session is too old. Please start a new session instead.

View session

mishushakov · 2026-10-13T14:44:55Z

has conflicts

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 0766d5d34e

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

chatgpt-codex-connector · 2026-10-13T14:47:10Z

+      - name: Check the cluster API key
+        env:
+          CLUSTER: ${{ matrix.cluster }}
+          API_KEY_SECRET: ${{ matrix.api_key_secret }}
+        run: |


Check out before running in the template directory

Every matrix leg starts on a fresh runner, but the job-wide working-directory: ./template also applies to this first run step, before checkout has created that directory. GitHub requires the assigned working directory to exist before starting the shell, so all three template builds fail before the API-key check executes; move checkout ahead of this step or override this step's working directory. GitHub workflow syntax

Useful? React with 👍 / 👎.

…ngo) Co-Authored-By: mish@e2b.dev <mish@e2b.dev>

Co-Authored-By: mish@e2b.dev <mish@e2b.dev>

cursor · 2026-10-13T14:51:48Z

-        run: uv run python build_prod.py
+  # The template is built on every production cluster. Clusters are separate
+  # tenancies with separate template registries, so each needs its own build.
+  buildTemplate:


🔒 Agentic Security Review

Severity: MEDIUM

Description: buildTemplate runs on workflow_dispatch for whatever ref the caller selects, with production cluster API keys in the job environment and no GitHub Environment. GitHub executes the workflow file and commit from that ref, then poetry run python build_prod.py publishes alias desktop. A repository writer can push a non-main branch and dispatch it to read those keys and replace the production desktop template.

Impact: Push-triggered runs of this workflow are already limited to main, and buildAndPushImage refuses every non-push event. workflow_dispatch drops that gate. A writer who cannot land unreviewed code on main can still run branch-controlled code with E2B_API_KEY, E2B_JULIETT_API_KEY, and E2B_TANGO_API_KEY, exfiltrate them, and Template.build alias desktop onto e2b.dev, e2b-juliett.dev, and e2b-tango.dev. Because the selected ref's workflow file is what runs, that writer can also drop the DockerHub job's push-only guard and read DOCKERHUB_USERNAME and DOCKERHUB_TOKEN. Fork contributors without write cannot dispatch. An in-file if: github.ref == 'refs/heads/main' does not hold: the attacker deletes it on the branch. Reachability: exposure internal (repo write required), automatable yes (branch push plus the workflow dispatch API, secret names are in this file), technical_impact total (production credentials).

Remediation: Store the three cluster API keys in a GitHub Environment whose deployment branch policy allows only the protected main ref, and set environment: on buildTemplate so a non-main ref cannot receive them. Keep them out of repository-level secrets. Do not rely on if: github.ref == 'refs/heads/main' in this file: workflow_dispatch runs the workflow from the selected ref, so a writer can remove that condition. Removing workflow_dispatch also closes the path. Apply the same environment gate to DockerHub credentials if a dispatched ref must not be able to name them.

mishushakov · 2026-10-13T15:20:40Z

check security review above

devin-ai-integration · 2026-10-13T15:20:44Z

Devin is archived and cannot be woken up. Please unarchive Devin if you want to continue using it.

View session

mishushakov · 2026-10-13T19:31:25Z

we will be moving it to customer templates

devin-ai-integration Bot assigned mishushakov Sep 7, 2026

cla-bot Bot added the cla-signed label Sep 7, 2026

mishushakov reviewed Sep 7, 2026

View reviewed changes

Comment thread template/README.md Outdated

mishushakov reviewed Sep 7, 2026

View reviewed changes

Comment thread .github/workflows/template.yml Outdated

devin-ai-integration Bot mentioned this pull request Sep 7, 2026

ci: build the prod template on every cluster (foxtrot, juliett, tango) e2b-dev/code-interpreter#338

Draft

github-advanced-security Bot found potential problems Sep 7, 2026

View reviewed changes

Comment thread .github/workflows/template.yml Fixed

mishushakov reviewed Sep 7, 2026

View reviewed changes

Comment thread .github/workflows/template.yml Outdated

mishushakov approved these changes Oct 13, 2026

View reviewed changes

mishushakov marked this pull request as ready for review October 13, 2026 14:44

chatgpt-codex-connector Bot reviewed Oct 13, 2026

View reviewed changes

devin-ai-integration Bot and others added 5 commits October 13, 2026 14:47

ci: build the desktop template on every cluster (foxtrot, juliett, ta…

147c04a

…ngo) Co-Authored-By: mish@e2b.dev <mish@e2b.dev>

docs: drop README clusters section

3c54aa1

Co-Authored-By: mish@e2b.dev <mish@e2b.dev>

ci: build clusters from a matrix instead of one job per cluster

9748b05

Co-Authored-By: mish@e2b.dev <mish@e2b.dev>

ci: spell out the foxtrot domain

6b2824f

Co-Authored-By: mish@e2b.dev <mish@e2b.dev>

ci: reference cluster API keys statically

33eb360

Co-Authored-By: mish@e2b.dev <mish@e2b.dev>

devin-ai-integration Bot force-pushed the devin/1788791818-build-templates-all-clusters branch from 0766d5d to 33eb360 Compare October 13, 2026 14:48

cursor Bot reviewed Oct 13, 2026

View reviewed changes

mishushakov closed this Oct 13, 2026

Navigation Menu

Repository navigation

ci: build the desktop template on every cluster (foxtrot, juliett, tango) - #260

ci: build the desktop template on every cluster (foxtrot, juliett, tango)#260
devin-ai-integration[bot] wants to merge 5 commits into
mainfrom
devin/1788791818-build-templates-all-clusters

devin-ai-integration Bot commented Sep 7, 2026 •

edited

Loading

Uh oh!

devin-ai-integration Bot commented Sep 7, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

chatgpt-codex-connector Bot commented Oct 13, 2026 •

edited

Loading

Uh oh!

devin-ai-integration Bot commented Oct 13, 2026

Uh oh!

mishushakov commented Oct 13, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

chatgpt-codex-connector Bot Oct 13, 2026

Uh oh!

cursor Bot Oct 13, 2026

Uh oh!

mishushakov commented Oct 13, 2026

Uh oh!

devin-ai-integration Bot commented Oct 13, 2026

Uh oh!

mishushakov commented Oct 13, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

devin-ai-integration Bot commented Sep 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Uh oh!

devin-ai-integration Bot commented Sep 7, 2026

🤖 Devin AI Engineer

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

chatgpt-codex-connector Bot commented Oct 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codex Review Summary

Uh oh!

devin-ai-integration Bot commented Oct 13, 2026

Uh oh!

mishushakov commented Oct 13, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Oct 13, 2026

Choose a reason for hiding this comment

Uh oh!

cursor Bot Oct 13, 2026

Choose a reason for hiding this comment

Uh oh!

mishushakov commented Oct 13, 2026

Uh oh!

devin-ai-integration Bot commented Oct 13, 2026

Uh oh!

mishushakov commented Oct 13, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

devin-ai-integration Bot commented Sep 7, 2026 •

edited

Loading

chatgpt-codex-connector Bot commented Oct 13, 2026 •

edited

Loading