Merge branch 'develop' into feat/monitoring

Author: motatoes

.github/pull_request_template.md

@@ -1,25 +1,7 @@
-### 🧠 AI Assistance Disclosure Policy
 
-> [!IMPORTANT]  
-> Inspired by [ghostty](https://github.com/ghostty-org/ghostty/blob/main/CONTRIBUTING.md#ai-assistance-notice).  
-> If you used **any AI assistance** while contributing to Digger, you must disclose it in this PR.
+### :brain: **Ai UsageDetails (if applicable):**
 
----
-
-#### ✅ AI Disclosure Checklist
-
-- [ ] I understand that all AI assistance must be disclosed.
-- [ ] I did **not** use AI tools in this contribution.
-- [ ] I used AI tools and have disclosed details below.
-
-**Details (if applicable):**
+IMPORTANT: Please disclose any usage of ai tooling while making this change. If you did not use any AI write "NA" below
 > _Example: Used ChatGPT to help with doc phrasing._  
 > _Example: Code generated by Copilot; reviewed and verified manually._
 
----
-
-#### 💡 Notes
-
-- Trivial auto-completions (single words, short phrases) don’t need disclosure.
-- Contributors must understand and take responsibility for any AI-assisted code.
-- Failure to disclose is considered disrespectful to maintainers and may delay review.

.github/release-please-config.json

@@ -23,6 +23,11 @@
       "release-type": "go",
       "component": "taco/statesman",
       "changelog-path": ".changelog-ignore/CHANGELOG.md"
+    },
+    "sandbox-sidecar": {
+      "release-type": "node",
+      "component": "sandbox-sidecar",
+      "changelog-path": "CHANGELOG.md"
     }
   }
 }

.github/workflows/auto-tag-and-release.yml

@@ -7,7 +7,7 @@ on:
   workflow_dispatch:
     inputs:
       force_services:
-        description: 'Force tag these services (comma-separated: backend_ee,drift,ui,statesman,token-service,projects-refresh)'
+        description: 'Force tag these services (comma-separated: backend_ee,drift,ui,statesman,token-service,projects-refresh,sidecar)'
         required: false
         default: ''
 
@@ -25,12 +25,14 @@ jobs:
       statesman_changed: ${{ steps.changes.outputs.statesman }}
       token_service_changed: ${{ steps.changes.outputs.token_service }}
       projects_refresh_changed: ${{ steps.changes.outputs.projects_refresh }}
+      sidecar_changed: ${{ steps.changes.outputs.sidecar }}
       backend_ee_version: ${{ steps.versions.outputs.backend_ee_version }}
       drift_version: ${{ steps.versions.outputs.drift_version }}
       ui_version: ${{ steps.versions.outputs.ui_version }}
       statesman_version: ${{ steps.versions.outputs.statesman_version }}
       token_service_version: ${{ steps.versions.outputs.token_service_version }}
       projects_refresh_version: ${{ steps.versions.outputs.projects_refresh_version }}
+      sidecar_version: ${{ steps.versions.outputs.sidecar_version }}
     steps:
       - uses: actions/checkout@v4
         with:
@@ -49,6 +51,7 @@ jobs:
             [[ "$FORCE" == *"statesman"* ]] && echo "statesman=true" >> $GITHUB_OUTPUT || echo "statesman=false" >> $GITHUB_OUTPUT
             [[ "$FORCE" == *"token-service"* ]] && echo "token_service=true" >> $GITHUB_OUTPUT || echo "token_service=false" >> $GITHUB_OUTPUT
             [[ "$FORCE" == *"projects-refresh"* ]] && echo "projects_refresh=true" >> $GITHUB_OUTPUT || echo "projects_refresh=false" >> $GITHUB_OUTPUT
+            [[ "$FORCE" == *"sidecar"* ]] && echo "sidecar=true" >> $GITHUB_OUTPUT || echo "sidecar=false" >> $GITHUB_OUTPUT
           else
             # Auto-detect based on changed files
             PREV_COMMIT="${{ github.event.before }}"
@@ -94,6 +97,13 @@ jobs:
             else
               echo "projects_refresh=false" >> $GITHUB_OUTPUT
             fi
+            
+            # Check sidecar changes
+            if git diff --name-only $PREV_COMMIT HEAD | grep -E '^(sandbox-sidecar/|\.github/workflows/sidecar-release\.yml)'; then
+              echo "sidecar=true" >> $GITHUB_OUTPUT
+            else
+              echo "sidecar=false" >> $GITHUB_OUTPUT
+            fi
           fi
       
       - name: Calculate new versions
@@ -129,6 +139,7 @@ jobs:
           echo "statesman_version=$(get_next_version 'taco/statesman')" >> $GITHUB_OUTPUT
           echo "token_service_version=$(get_next_version 'taco/token-service')" >> $GITHUB_OUTPUT
           echo "projects_refresh_version=$(get_next_version 'projects-refresh')" >> $GITHUB_OUTPUT
+          echo "sidecar_version=$(get_next_version 'sandbox-sidecar')" >> $GITHUB_OUTPUT
 
   tag-backend-ee:
     needs: detect-changes
@@ -250,6 +261,26 @@ jobs:
           
           echo "Created and pushed tag: $TAG"
 
+  tag-sidecar:
+    needs: detect-changes
+    if: needs.detect-changes.outputs.sidecar_changed == 'true'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          token: ${{ secrets.HELM_CHARTS_PAT }}
+      
+      - name: Create and push tag
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          
+          TAG="sandbox-sidecar/${{ needs.detect-changes.outputs.sidecar_version }}"
+          git tag -a "$TAG" -m "Release sandbox-sidecar ${{ needs.detect-changes.outputs.sidecar_version }}"
+          git push origin "$TAG"
+          
+          echo "Created and pushed tag: $TAG"
+
   summary:
     needs: 
       - detect-changes
@@ -259,6 +290,7 @@ jobs:
       - tag-statesman
       - tag-token-service
       - tag-projects-refresh
+      - tag-sidecar
     if: always()
     runs-on: ubuntu-latest
     steps:
@@ -274,6 +306,7 @@ jobs:
           echo "| statesman | ${{ needs.detect-changes.outputs.statesman_changed }} | ${{ needs.detect-changes.outputs.statesman_version }} |" >> $GITHUB_STEP_SUMMARY
           echo "| token-service | ${{ needs.detect-changes.outputs.token_service_changed }} | ${{ needs.detect-changes.outputs.token_service_version }} |" >> $GITHUB_STEP_SUMMARY
           echo "| projects-refresh | ${{ needs.detect-changes.outputs.projects_refresh_changed }} | ${{ needs.detect-changes.outputs.projects_refresh_version }} |" >> $GITHUB_STEP_SUMMARY
+          echo "| sidecar | ${{ needs.detect-changes.outputs.sidecar_changed }} | ${{ needs.detect-changes.outputs.sidecar_version }} |" >> $GITHUB_STEP_SUMMARY
           echo "" >> $GITHUB_STEP_SUMMARY
           echo "Tags have been created and pushed. Build workflows will trigger automatically." >> $GITHUB_STEP_SUMMARY
 

.github/workflows/backend-ee-release.yml

@@ -59,8 +59,6 @@ jobs:
           platforms: linux/amd64,linux/arm64
           tags: ${{ steps.docker-meta.outputs.tags }}
           labels: ${{ steps.docker-meta.outputs.labels }}
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
           build-args: |
             COMMIT_SHA=${{ github.sha }}
             VERSION=${{ steps.meta.outputs.version }}

.github/workflows/drift-release.yml

@@ -59,8 +59,6 @@ jobs:
           platforms: linux/amd64,linux/arm64
           tags: ${{ steps.docker-meta.outputs.tags }}
           labels: ${{ steps.docker-meta.outputs.labels }}
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
           build-args: |
             COMMIT_SHA=${{ github.sha }}
             VERSION=${{ steps.meta.outputs.version }}

.github/workflows/projects-refresh-release.yml

@@ -48,9 +48,13 @@ jobs:
             type=ref,event=tag
             type=raw,value=latest
 
-      - name: Build and push Docker image
-        uses: docker/build-push-action@v5
+
+      - uses: depot/setup-action@v1
+      - name: Build projects-refresh image (no push)
+        uses: depot/build-push-action@v1
         with:
+          project: p9zgmm1k3n
+          token: ${{ secrets.DEPOT_TOKEN }}
           context: .
           file: ./Dockerfile_bg_projects_refresh
           push: true

.github/workflows/projects_refresh_image_build.yml

@@ -0,0 +1,41 @@
+name: projects-refresh-image-build
+
+on:
+  pull_request:
+    paths:
+      - background/projects-refresh-service/**
+      - Dockerfile_bg_projects_refresh
+      - .github/workflows/projects_refresh_image_build.yml
+  workflow_dispatch: {}
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - uses: depot/setup-action@v1
+      - name: Build projects-refresh image (no push)
+        uses: depot/build-push-action@v1
+        with:
+          project: p9zgmm1k3n
+          token: ${{ secrets.DEPOT_TOKEN }}
+          context: .
+          file: Dockerfile_bg_projects_refresh
+          platforms: linux/amd64,linux/arm64
+          push: false
+          tags: ghcr.io/diggerhq/digger/projects-refresh-service:ci-test
+          build-args: |
+            COMMIT_SHA=${{ github.sha }}
+

.github/workflows/sidecar-release.yml

@@ -0,0 +1,94 @@
+name: Sidecar Release
+
+on:
+  push:
+    tags:
+      - 'sandbox-sidecar/v*'
+
+env:
+  REGISTRY: ghcr.io
+  IMAGE_NAME: diggerhq/sandbox-sidecar
+
+jobs:
+  build-and-push:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Derive version
+        id: meta
+        run: |
+          TAG="${GITHUB_REF_NAME}"          # e.g. sandbox-sidecar/v0.1.0.0
+          VERSION="${TAG##*/}"              # v0.1.0.0
+          echo "version=$VERSION" >> $GITHUB_OUTPUT
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Log in to Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract metadata
+        id: docker-meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          tags: |
+            type=raw,value=${{ steps.meta.outputs.version }}
+            type=ref,event=tag
+            type=raw,value=latest
+
+      - uses: depot/setup-action@v1
+      - uses: depot/build-push-action@v1
+        with:
+          project: 43l6gkbwqm
+          token: ${{ secrets.DEPOT_TOKEN }}
+          context: ./sandbox-sidecar
+          file: ./sandbox-sidecar/Dockerfile_sidecar
+          push: true
+          platforms: linux/amd64,linux/arm64
+          tags: ${{ steps.docker-meta.outputs.tags }}
+          labels: ${{ steps.docker-meta.outputs.labels }}
+          build-args: |
+            COMMIT_SHA=${{ github.sha }}
+            VERSION=${{ steps.meta.outputs.version }}
+
+  create-release:
+    needs: [build-and-push]
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Derive version
+        id: meta
+        run: |
+          TAG="${GITHUB_REF_NAME}"          # e.g. sandbox-sidecar/v0.1.0.0
+          VERSION="${TAG##*/}"              # v0.1.0.0
+          echo "version=$VERSION" >> $GITHUB_OUTPUT
+
+      - name: Create GitHub Release
+        uses: softprops/action-gh-release@v1
+        with:
+          tag_name: ${{ github.ref_name }}
+          name: Sandbox Sidecar ${{ steps.meta.outputs.version }}
+          body: |
+            ## Sandbox Sidecar ${{ steps.meta.outputs.version }}
+            
+            Node.js service for managing E2B sandboxes for remote Terraform/OpenTofu execution.
+            
+            ### Docker Image
+            ```bash
+            docker pull ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.meta.outputs.version }}
+            ```
+            
+          draft: false
+          prerelease: false
+