# GitHub Sandbox Helpers

These scripts keep GitHub CLI and API state inside the current workspace instead of relying on a user home directory or system keychain.

## Files

- `cxgh`: launch Codex with `workspace-write` + `network_access=true`
- `github_api.sh`: call GitHub REST or GraphQL with explicit token auth, timeout, and retry
- `preflight.sh`: verify DNS, token, rate limit, repository access, and Project V2 access before mutating GitHub state
- `issue-comment.sh`: create an issue comment via direct REST API
- `project-v2-update.sh`: add or update a Project V2 item via direct GraphQL API
- `_gh_env.sh`: prepare `GH_CONFIG_DIR` and `XDG_*` directories in the workspace
- `_gh_retry.sh`: retry `gh` CLI commands for transient network failures
- `sync-org-secrets-from-env.sh`: sync org secrets from `/root/codes/.env`
- `../env/workspace_env.py`: normalize and parse the workspace-shared `.env`
- `config.toml.example`: minimal Codex config for GitHub-heavy sessions

## Quick Start

```bash
export GH_TOKEN="<token>"

bash scripts/github/cxgh "查看当前 repo 的 open issues，并给 #150 添加进展评论"
```

Preflight:

```bash
export GH_TOKEN="<token>"

bash scripts/github/preflight.sh \
  --repo lingjingwanxiang/ljwx-deploy \
  --project-url 'https://github.com/orgs/lingjingwanxiang/projects/3/views/1'
```

## Direct API Example

```bash
export GH_TOKEN="<token>"

bash scripts/github/github_api.sh repos/lingjingwanxiang/ljwx-deploy/issues/150
```

Issue comment:

```bash
export GH_TOKEN="<token>"

bash scripts/github/issue-comment.sh \
  --repo lingjingwanxiang/ljwx-deploy \
  --issue 150 \
  --body 'Progress update'
```

Project update:

```bash
export GH_TOKEN="<token>"

bash scripts/github/project-v2-update.sh \
  --project-url 'https://github.com/orgs/lingjingwanxiang/projects/3/views/1' \
  --content-url 'https://github.com/lingjingwanxiang/ljwx-deploy/issues/150' \
  --field-name 'Status' \
  --single-select 'In progress'
```

Org secret sync from workspace `.env`:

```bash
export GH_TOKEN="<token>"

bash scripts/github/sync-org-secrets-from-env.sh \
  --env-file /root/codes/.env \
  --org lingjingwanxiang \
  --secret HARBOR_USERNAME \
  --secret HARBOR_PASSWORD \
  --repo ljwx-bookstore \
  --repo ljwx-dify
```

List parseable keys before syncing:

```bash
export GH_TOKEN="<token>"

bash scripts/github/sync-org-secrets-from-env.sh \
  --env-file /root/codes/.env \
  --show-keys
```

Normalize `/root/codes/.env` to standard `KEY=value` format:

```bash
python3 scripts/env/workspace_env.py normalize \
  --env-file /root/codes/.env \
  --in-place \
  --backup-suffix .bak
```

GraphQL:

```bash
export GH_TOKEN="<token>"

bash scripts/github/github_api.sh \
  --graphql \
  --data '{"query":"query { viewer { login } }"}'
```