ljwx-deploy/scripts/github/README.md

GitHub Sandbox Helpers

These scripts keep GitHub CLI and API state inside the current workspace instead of relying on a user home directory or system keychain.

Files

• cxgh: launch Codex with workspace-write + network_access=true
• github_api.sh: call GitHub REST or GraphQL with explicit token auth, timeout, and retry
• preflight.sh: verify DNS, token, rate limit, repository access, and Project V2 access before mutating GitHub state
• issue-comment.sh: create an issue comment via direct REST API
• project-v2-update.sh: add or update a Project V2 item via direct GraphQL API
• audit-org-workflows.sh: scan org repositories for hosted-runner usage and legacy workflow references
• _gh_env.sh: prepare GH_CONFIG_DIR and XDG_* directories in the workspace
• _gh_retry.sh: retry gh CLI commands for transient network failures
• sync-org-secrets-from-env.sh: sync org secrets from /root/codes/.env
• ../env/workspace_env.py: normalize and parse the workspace-shared .env
• config.toml.example: minimal Codex config for GitHub-heavy sessions

Quick Start

export GH_TOKEN="<token>"

bash scripts/github/cxgh "查看当前 repo 的 open issues，并给 #150 添加进展评论"

Preflight:

export GH_TOKEN="<token>"

bash scripts/github/preflight.sh \
  --repo lingjingwanxiang/ljwx-deploy \
  --project-url 'https://github.com/orgs/lingjingwanxiang/projects/3/views/1'

Direct API Example

export GH_TOKEN="<token>"

bash scripts/github/github_api.sh repos/lingjingwanxiang/ljwx-deploy/issues/150

Issue comment:

export GH_TOKEN="<token>"

bash scripts/github/issue-comment.sh \
  --repo lingjingwanxiang/ljwx-deploy \
  --issue 150 \
  --body 'Progress update'

Project update:

export GH_TOKEN="<token>"

bash scripts/github/project-v2-update.sh \
  --project-url 'https://github.com/orgs/lingjingwanxiang/projects/3/views/1' \
  --content-url 'https://github.com/lingjingwanxiang/ljwx-deploy/issues/150' \
  --field-name 'Status' \
  --single-select 'In progress'

Org secret sync from workspace .env:

export GH_TOKEN="<token>"

bash scripts/github/sync-org-secrets-from-env.sh \
  --env-file /root/codes/.env \
  --org lingjingwanxiang \
  --secret HARBOR_USERNAME \
  --secret HARBOR_PASSWORD \
  --repo ljwx-bookstore \
  --repo ljwx-dify

List parseable keys before syncing:

export GH_TOKEN="<token>"

bash scripts/github/sync-org-secrets-from-env.sh \
  --env-file /root/codes/.env \
  --show-keys

Audit organization workflows for hosted runners and legacy owner references:

export GH_TOKEN="<token>"

bash scripts/github/audit-org-workflows.sh \
  --org lingjingwanxiang \
  --fail-on-findings

Normalize /root/codes/.env to standard KEY=value format:

python3 scripts/env/workspace_env.py normalize \
  --env-file /root/codes/.env \
  --in-place \
  --backup-suffix .bak

GraphQL:

export GH_TOKEN="<token>"

bash scripts/github/github_api.sh \
  --graphql \
  --data '{"query":"query { viewer { login } }"}'