fix: sandbox id

src/adversary/contracts.ts

@@ -119,6 +119,19 @@ export function adversaryCoordinatorKey(
 	return `${input.repositoryId}:${input.pullNumber}`;
 }
 
+export function adversarySandboxId(
+	team: 'blue' | 'purple' | 'publisher',
+	input: Pick<
+		AdversaryWorkflowParams,
+		'repositoryId' | 'pullNumber' | 'deliveryId'
+	>,
+): string {
+	const delivery = input.deliveryId.toLowerCase().replace(/[^a-z0-9-]/g, '-');
+	return `adversary-${team}-${input.repositoryId}-${input.pullNumber}-${delivery}`
+		.slice(0, 63)
+		.replace(/-+$/, '');
+}
+
 export function blueQualifies(result: PurpleTeamResult): boolean {
 	return Object.values(result.qualification).every(Boolean);
 }

src/adversary/workflow.ts

@@ -29,6 +29,7 @@ import {
 	type AdversaryWorkflowOutcome,
 	type AdversaryWorkflowParams,
 	adversaryCoordinatorKey,
+	adversarySandboxId,
 	adversaryWorkflowParamsSchema,
 	type BlueTeamInput,
 	type BlueTeamResult,
@@ -421,13 +422,6 @@ export class AdversaryWorkflow extends WorkflowEntrypoint<
 	}
 }
 
-function adversarySandboxId(
-	team: 'blue' | 'purple' | 'publisher',
-	params: AdversaryWorkflowParams,
-): string {
-	return `adversary-${team}-${params.repositoryId}-${params.pullNumber}-${params.deliveryId}`;
-}
-
 async function destroyInStep(
 	step: WorkflowStep,
 	team: string,

tests/adversary-contracts.test.ts

@@ -1,6 +1,7 @@
 import { describe, expect, it } from 'vitest';
 import {
 	adversaryBranchName,
+	adversarySandboxId,
 	blueQualifies,
 	type PurpleTeamResult,
 } from '../src/adversary/contracts.ts';
@@ -41,4 +42,18 @@ describe('adversary contracts', () => {
 			'factory/adversary/pr-42-aaaaaaaaaaaa',
 		);
 	});
+
+	it('builds bounded DNS-label-safe sandbox ids', () => {
+		const input = {
+			repositoryId: 348060227,
+			pullNumber: 17736,
+			deliveryId: '560CE130_B10A 11F1/862F/F478BF7BDFDE',
+		};
+
+		for (const team of ['blue', 'purple', 'publisher'] as const) {
+			const id = adversarySandboxId(team, input);
+			expect(id.length).toBeLessThanOrEqual(63);
+			expect(id).toMatch(/^[a-z0-9][a-z0-9-]*[a-z0-9]$/);
+		}
+	});
 });