1{
 2  "extends": "pi-nono-local",
 3  "meta": {
 4    "name": "pi-nono-github-ro",
 5    "description": "Pi with read-only GitHub research through a brokered token"
 6  },
 7  "command_policies": {
 8    "credentials": {
 9      "github-api": {
10        "type": "proxy",
11        "upstream": "https://api.github.com",
12        "credential_key": "env://NONO_GH_TOKEN",
13        "env_var": "GH_TOKEN",
14        "inject_header": "Authorization",
15        "credential_format": "Bearer {}"
16      }
17    },
18    "commands": {
19      "gh": {
20        "from": {
21          "session": {
22            "sandbox": {
23              "fs_read": ["$WORKDIR"],
24              "credentials": [
25                {
26                  "name": "github-api",
27                  "endpoint_policy": {
28                    "default": "deny",
29                    "allow": [
30                      { "method": "GET", "path": "/user" },
31                      { "method": "GET", "path": "/repos/**" },
32                      { "method": "GET", "path": "/user/repos" }
33                    ]
34                  }
35                }
36              ]
37            },
38            "invocation_policy": {
39              "default": "deny",
40              "allow": [
41                { "argv": { "prefix": ["repo", "view"] } },
42                { "argv": { "prefix": ["repo", "list"] } },
43                { "argv": { "prefix": ["issue", "list"] } },
44                { "argv": { "prefix": ["issue", "view"] } },
45                { "argv": { "prefix": ["pr", "list"] } },
46                { "argv": { "prefix": ["pr", "view"] } },
47                { "argv": { "prefix": ["pr", "checks"] } },
48                { "argv": { "prefix": ["run", "list"] } },
49                { "argv": { "prefix": ["run", "view"] } },
50                { "argv": { "prefix": ["api"] } }
51              ]
52            }
53          }
54        }
55      }
56    }
57  }
58}