mayoite/oando-project:1.0.0

schemaVersion: "3"
displayName: Oando project toolchain
description: Node 26.13.0, pnpm 12.15.0 and Supabase CLI 2.122.0 for the oando repo, with egress limited to what install and CI need and hosted app services denied
sourceUrl: https://github.com/mayoite/oando-wip
version: 1.0.0
kind: mixin
provides:
    - [email protected]
capabilities:
    - type: com.docker.sandbox/network-policy@2
      config:
        runtime:
            allow:
                - github.com
                - api.github.com
                - codeload.github.com
                - objects.githubusercontent.com
                - release-assets.githubusercontent.com
                - registry.npmjs.org
                - nodejs.org
                - deb.debian.org
                - public.ecr.aws
                - '*.cloudfront.net'
                - registry-1.docker.io
                - auth.docker.io
                - production.cloudflare.docker.com
                - cdn.playwright.dev
                - playwright.download.prss.microsoft.com
            deny:
                - '*.supabase.co'
                - '*.supabase.in'
                - '*.r2.cloudflarestorage.com'
                - api.resend.com
                - '*.ingest.sentry.io'
                - '*.ingest.us.sentry.io'
                - api.vercel.com
    - type: com.docker.sandbox/credential@1
      optional: true
      config:
        apiKey:
            inject:
                - domain: github.com
                  format: Bearer %s
                  header: Authorization
                - domain: api.github.com
                  format: Bearer %s
                  header: Authorization
            name: GH_TOKEN
            proxyManaged: true
        phase:
            - runtime
        service: github
      description: GitHub read access for cloning the private repository
    - type: com.docker.sandbox/agent-context@1
      optional: true
      config:
        content: |
            # Oando project

            - Node 26.13.0, pnpm 12.15.0 and `supabase` 2.122.0 are on PATH.
            - `oando-prepare [--install] [dir]` clones the repo into an empty
              workspace (cloud sandboxes mount no local folder) or fast-forwards
              an existing clone, then checks the toolchain pins.
            - `OANDO_ENV_FILE=off` is set: no `.env` file is loaded. Hosted
              Supabase, R2, Resend, Sentry and Vercel are denied by policy.
            - CI: `pnpm run ci:docker` (gate in the Linux container, then the
              stack lane against both local Supabase stacks).
    - type: com.docker.sandbox/agent-context@2
      optional: true
      config:
        content: |
            # Oando project

            - Node 26.13.0, pnpm 12.15.0 and `supabase` 2.122.0 are on PATH.
            - `oando-prepare [--install] [dir]` clones the repo into an empty
              workspace (cloud sandboxes mount no local folder) or fast-forwards
              an existing clone, then checks the toolchain pins.
            - `OANDO_ENV_FILE=off` is set: no `.env` file is loaded. Hosted
              Supabase, R2, Resend, Sentry and Vercel are denied by policy.
            - CI: `pnpm run ci:docker` (gate in the Linux container, then the
              stack lane against both local Supabase stacks).
dockerfile: oando.dockerfile