ci: build the prod template on every cluster (foxtrot, juliett, tango) by devin-ai-integration[bot] · Pull Request #338 · e2b-dev/code-interpreter

devin-ai-integration · 2026-09-07T14:40:32Z

Summary

code-interpreter-v1 is now built on every production cluster — foxtrot, juliett and tango — instead of foxtrot only. Clusters are separate tenancies with separate template registries, so a template built on one does not exist on the others.

The build moves into a reusable workflow, build_prod_template_clusters.yml (workflow_call: inputs target, skip_cache; optional secrets E2B_PROD_API_KEY, E2B_JULIETT_API_KEY, E2B_TANGO_API_KEY, E2B_STAGING_API_KEY), which holds the cluster map once and fans out as a matrix:

plan            -> jq: [{cluster, domain, production}] filtered by `target`
build-template  -> strategy.matrix.include: fromJSON(needs.plan.outputs.matrix)
                   env: E2B_DOMAIN: ${{ matrix.domain }}
                   build step only:
                   E2B_API_KEY: ${{ (matrix.cluster == 'foxtrot' && secrets.E2B_PROD_API_KEY) || (matrix.cluster == 'juliett' && secrets.E2B_JULIETT_API_KEY) || ... || '' }}

Secrets are referenced statically and passed explicitly by the callers (no secrets: inherit), so a build runner only gets the cluster keys — not PyPI, DockerHub, Slack or app credentials. A dynamic secrets[...] index would hand the job every org and repo secret.

Cluster	`E2B_DOMAIN`	Secret	in `all`
foxtrot	`e2b.dev` (was `vars.E2B_DOMAIN`)	`E2B_PROD_API_KEY` (existing)	yes
juliett	`e2b-juliett.dev`	`E2B_JULIETT_API_KEY` (existing)	yes
tango	`e2b-tango.dev`	`E2B_TANGO_API_KEY` — new, must be added before merging	yes
staging	`e2b-staging.dev`	`E2B_STAGING_API_KEY` (existing)	no

release.yml: build-template calls it with target: all and the three prod keys; a failed leg on any cluster blocks the release (a missing key fails with Missing API key secret for cluster: <cluster>).
build_prod_template.yml (manual): target_environment gains all (new default) and tango, passed straight through as target with all four keys; the runtime case that resolved domain/key is gone.
Concurrency: the release workflow's group drops the -foxtrot suffix (Release-${{ github.ref }}). The per-cluster group Release-${{ github.ref }}-<cluster> is on the matrix job, so a manual build and a release for the same cluster still serialize while different clusters run in parallel.

Companion PR for the desktop template: e2b-dev/desktop#260.

Link to Devin session: https://app.devin.ai/sessions/e307a60ded5e4986a82930c5f7b8169e
Open in Devin Desktop: https://app.devin.ai/desktop/session/e307a60ded5e4986a82930c5f7b8169e?variant=devin
Requested by: @mishushakov

devin-ai-integration · 2026-09-07T14:40:35Z

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

Disable automatic comment, CI, and merge conflict monitoring

cursor

Stale comment

Agentic security review found 1 medium issue: dynamic secrets[...] lookup plus secrets: inherit expands the template-build runner’s secret set beyond the intended cluster API key.

_{Sent by Cursor Security Agent: Security Reviewer}

cursor · 2026-09-07T15:34:20Z

+      group: Release-${{ github.ref }}-${{ matrix.cluster }}
+      cancel-in-progress: false
+    env:
+      E2B_API_KEY: ${{ secrets[matrix.api_key_secret] }}


🔒 Agentic Security Review
Severity: MEDIUM

The reusable cluster-build job selects the API key with a dynamic secrets lookup (secrets[matrix.api_key_secret]). GitHub cannot statically determine which secrets that expression needs, so the runner receives every secret inherited by the called workflow. Both callers pass secrets: inherit, so the release path now delivers unused high-value credentials (PyPI, Docker Hub, version-bumper private key, Slack webhooks, and other clusters’ API keys) to this job. E2B_API_KEY is also set at job scope, so every step—including third-party actions and pip install—sees the selected cluster key.

Impact: Compromise of any step on a template-build runner (hijacked Action, poisoned pip dependency, or later logging of context) can read the full inherited secret set instead of a single cluster API key.

^{Reviewed by Cursor Security Reviewer for commit 6bccfc0. Configure here.}

shroog12317-crypto

devin/1788791816-build-templates-all-clusters

Co-Authored-By: mish@e2b.dev <mish@e2b.dev>

devin-ai-integration Bot assigned mishushakov Sep 7, 2026

cla-bot Bot added the cla-signed label Sep 7, 2026

devin-ai-integration Bot mentioned this pull request Sep 7, 2026

ci: build the desktop template on every cluster (foxtrot, juliett, tango) e2b-dev/desktop#260

Closed

github-advanced-security Bot found potential problems Sep 7, 2026

View reviewed changes

Comment thread .github/workflows/build_prod_template_clusters.yml Fixed

cursor Bot reviewed Sep 7, 2026

View reviewed changes

Comment thread .github/workflows/build_prod_template_clusters.yml Outdated

cursor Bot reviewed Sep 7, 2026

View reviewed changes

shroog12317-crypto reviewed Oct 4, 2026

View reviewed changes

devin-ai-integration Bot and others added 5 commits October 13, 2026 14:47

ci: build the prod template on every cluster (foxtrot, juliett, tango)

7fbc3d8

Co-Authored-By: mish@e2b.dev <mish@e2b.dev>

docs: drop README clusters section

3644149

Co-Authored-By: mish@e2b.dev <mish@e2b.dev>

ci: build clusters from a matrix instead of one job per cluster

aa8967b

Co-Authored-By: mish@e2b.dev <mish@e2b.dev>

ci: spell out the foxtrot domain

8801233

Co-Authored-By: mish@e2b.dev <mish@e2b.dev>

ci: reference cluster API keys statically

d81f9ce

Co-Authored-By: mish@e2b.dev <mish@e2b.dev>

devin-ai-integration Bot force-pushed the devin/1788791816-build-templates-all-clusters branch from 6bccfc0 to d81f9ce Compare October 13, 2026 14:48

Navigation Menu

Repository navigation

ci: build the prod template on every cluster (foxtrot, juliett, tango) - #338

ci: build the prod template on every cluster (foxtrot, juliett, tango)#338
devin-ai-integration[bot] wants to merge 5 commits into
mainfrom
devin/1788791816-build-templates-all-clusters

devin-ai-integration Bot commented Sep 7, 2026 •

edited

Loading

Uh oh!

devin-ai-integration Bot commented Sep 7, 2026

Uh oh!

Uh oh!

cursor Bot left a comment •

edited

Loading

Uh oh!

Uh oh!

cursor Bot Sep 7, 2026

Uh oh!

shroog12317-crypto left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

devin-ai-integration Bot commented Sep 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Uh oh!

devin-ai-integration Bot commented Sep 7, 2026

🤖 Devin AI Engineer

Uh oh!

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

cursor Bot Sep 7, 2026

Choose a reason for hiding this comment

Uh oh!

shroog12317-crypto left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

devin-ai-integration Bot commented Sep 7, 2026 •

edited

Loading

cursor Bot left a comment •

edited

Loading