[sandbox] Add Docker-based package sandbox testing environment

.github/scripts/cla_check.py

@@ -8,6 +8,7 @@
 import os
 import re
 import sys
+
 import requests
 
 # Configuration
@@ -85,11 +86,7 @@ def load_cla_signers() -> dict:
         sys.exit(1)
 
 
-def is_signer(
-    username: str | None,
-    email: str,
-    signers: dict
-) -> tuple[bool, str | None]:
+def is_signer(username: str | None, email: str, signers: dict) -> tuple[bool, str | None]:
     """
     Check if a user has signed the CLA.
     Returns (is_signed, signing_entity).
@@ -129,23 +126,15 @@ def is_signer(
     return False, None
 
 
-def get_pr_authors(
-    owner: str,
-    repo: str,
-    pr_number: int,
-    token: str
-) -> list[dict]:
+def get_pr_authors(owner: str, repo: str, pr_number: int, token: str) -> list[dict]:
     """
     Get all unique authors from PR commits.
     Returns list of {username, email, name, source}.
     """
     authors = {}
 
     # Get PR commits
-    commits = github_request(
-        f"repos/{owner}/{repo}/pulls/{pr_number}/commits?per_page=100",
-        token
-    )
+    commits = github_request(f"repos/{owner}/{repo}/pulls/{pr_number}/commits?per_page=100", token)
 
     for commit in commits:
         sha = commit["sha"]
@@ -167,7 +156,7 @@ def get_pr_authors(
                     "username": author_username,
                     "email": author_email,
                     "name": author_name,
-                    "source": f"commit {sha[:7]}"
+                    "source": f"commit {sha[:7]}",
                 }
 
         # Committer (if different)
@@ -185,7 +174,7 @@ def get_pr_authors(
                     "username": committer_username,
                     "email": committer_email,
                     "name": committer_name,
-                    "source": f"committer {sha[:7]}"
+                    "source": f"committer {sha[:7]}",
                 }
 
         # Co-authors from commit message
@@ -197,7 +186,7 @@ def get_pr_authors(
                     "username": None,
                     "email": co_email,
                     "name": co_name,
-                    "source": f"co-author {sha[:7]}"
+                    "source": f"co-author {sha[:7]}",
                 }
 
     return list(authors.values())
@@ -209,7 +198,7 @@ def post_comment(
     pr_number: int,
     token: str,
     missing_authors: list[dict],
-    signed_authors: list[tuple[dict, str]]
+    signed_authors: list[tuple[dict, str]],
 ) -> None:
     """Post or update CLA status comment on PR."""
     # Build comment body
@@ -250,8 +239,7 @@ def post_comment(
 
     # Check for existing CLA comment to update
     comments = github_request(
-        f"repos/{owner}/{repo}/issues/{pr_number}/comments?per_page=100",
-        token
+        f"repos/{owner}/{repo}/issues/{pr_number}/comments?per_page=100", token
     )
 
     cla_comment_id = None
@@ -269,23 +257,17 @@ def post_comment(
         requests.patch(
             f"{GITHUB_API}/repos/{owner}/{repo}/issues/comments/{cla_comment_id}",
             headers=headers,
-            json={"body": comment_body}
+            json={"body": comment_body},
         )
     else:
         # Create new comment
         github_post(
-            f"repos/{owner}/{repo}/issues/{pr_number}/comments",
-            token,
-            {"body": comment_body}
+            f"repos/{owner}/{repo}/issues/{pr_number}/comments", token, {"body": comment_body}
         )
 
 
 def post_success_comment(
-    owner: str,
-    repo: str,
-    pr_number: int,
-    token: str,
-    signed_authors: list[tuple[dict, str]]
+    owner: str, repo: str, pr_number: int, token: str, signed_authors: list[tuple[dict, str]]
 ) -> None:
     """Post success comment or update existing CLA comment."""
     lines = ["## CLA Verification Passed\n\n"]
@@ -306,8 +288,7 @@ def post_success_comment(
 
     # Check for existing CLA comment to update
     comments = github_request(
-        f"repos/{owner}/{repo}/issues/{pr_number}/comments?per_page=100",
-        token
+        f"repos/{owner}/{repo}/issues/{pr_number}/comments?per_page=100", token
     )
 
     for comment in comments:
@@ -320,17 +301,15 @@ def post_success_comment(
             requests.patch(
                 f"{GITHUB_API}/repos/{owner}/{repo}/issues/comments/{comment['id']}",
                 headers=headers,
-                json={"body": comment_body}
+                json={"body": comment_body},
             )
             return
 
     # No existing comment - only post if there were multiple authors
     # (single author PRs don't need a "you signed" comment)
     if len(signed_authors) > 1:
         github_post(
-            f"repos/{owner}/{repo}/issues/{pr_number}/comments",
-            token,
-            {"body": comment_body}
+            f"repos/{owner}/{repo}/issues/{pr_number}/comments", token, {"body": comment_body}
         )
 
 
@@ -358,8 +337,14 @@ def main():
 
     # Allowlist for bots
     bot_patterns = [
-        "dependabot", "github-actions", "renovate", "codecov",
-        "sonarcloud", "coderabbitai", "sonarqubecloud", "noreply@github.com"
+        "dependabot",
+        "github-actions",
+        "renovate",
+        "codecov",
+        "sonarcloud",
+        "coderabbitai",
+        "sonarqubecloud",
+        "noreply@github.com",
     ]
 
     for author in authors:

README.md

@@ -145,6 +145,7 @@ cortex rollback <installation-id>
 | `cortex install <query>` | Install packages matching natural language query |
 | `cortex install <query> --dry-run` | Preview installation plan (default) |
 | `cortex install <query> --execute` | Execute the installation |
+| `cortex sandbox <cmd>` | Test packages in Docker sandbox |
 | `cortex history` | View all past installations |
 | `cortex rollback <id>` | Undo a specific installation |
 | `cortex --version` | Show version information |