ci: automate sandbox image push and SANDBOX_IMAGE_URI pin

[bhaveshpatel640]

ci: automate sandbox image push and SANDBOX_IMAGE_URI pin

---

Note

Medium Risk
The pin job writes source and opens PRs with elevated contents/pull-requests permissions; mistakes could publish wrong image URIs into @truefoundry/trueforge-core, though URI validation limits injection risk.

Overview
Automates the sandbox image release loop so changes under packages/trueforge-core/scripts/sandbox/** no longer rely on manual dispatch-only builds.

On pull requests, a verify job only runs docker build (no registry push). On main and dispatch, the existing Artifactory push still runs, with concurrency scoped per event/ref and PR runs allowed to cancel in-progress.

After a successful push on main, a new pin job rewrites packages/trueforge-core/src/core/sandbox/sandboxImage.ts with SANDBOX_IMAGE_URI for trueforge-sandbox:<sha>, runs scripts/changeset-sandbox-image.sh to add a @truefoundry/trueforge-core patch changeset, and opens a bot PR (release-sandbox-image) so release.yml can publish the pin. The URI is validated with a strict regex before writing.

RELEASING.md documents the sandbox image in the release table and versioning row (tag = full commit SHA).

^{Reviewed by Cursor Bugbot for commit a810950. Bugbot is set up for automated code reviews on this repo. Configure here.}

[changeset-bot]

⚠️ No Changeset found

Latest commit: 0bcd917

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit a810950. Configure here.}

[cursor]

No-op pin bumps package

Medium Severity

The pin job always rewrites sandboxImage.ts and runs changeset-sandbox-image.sh, which always creates a new changeset. On workflow_dispatch when SANDBOX_IMAGE_URI already matches, create-pull-request still opens a changeset-only PR, so merging yields a patch bump of @truefoundry/trueforge-core with no image pin change.

Additional Locations (1)

• scripts/changeset-sandbox-image.sh#L1-L16

 

^{Reviewed by Cursor Bugbot for commit a810950. Configure here.}

[cursor]

Push and dispatch race

Medium Severity

Concurrency keys on github.event_name, so a push to main and a workflow_dispatch on main do not share a group. Both can build, push, and update the pin PR at once; whichever pin job finishes last wins, and that can leave SANDBOX_IMAGE_URI pointing at an older SHA than the newest successful push.

 

^{Reviewed by Cursor Bugbot for commit a810950. Configure here.}