chore: add mermaid CLI to sandbox image with usage instructions (#8104)

* chore: add mermaid CLI to sandbox image with usage instructions

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* chore: mount host ~/.ssh into sandbox and install openssh-client

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* chore: remove sample diagram

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* chore: address PR review comments on mermaid CLI setup

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

.wmdev.yaml

@@ -18,6 +18,9 @@ profiles:
       - R2_BUCKET
       - R2_PUBLIC_URL
     extraMounts:
+      - hostPath: ~/.ssh
+        guestPath: /root/.ssh
+        writable: true
       - hostPath: ~/.codex
         guestPath: /root/.codex
         writable: true
@@ -74,6 +77,30 @@ profiles:
           XDG_DATA_HOME=/tmp/.local/share \
             asciinema upload --server-url https://asciinema.org /tmp/demo.cast
 
+      --- Mermaid Diagrams ---
+      You can render Mermaid diagrams to SVG using the pre-installed mmdc CLI.
+      The puppeteer config (no-sandbox + Chromium path) is at /root/.puppeteerrc.json.
+
+      1) Write a .mmd file with your diagram:
+          cat > /tmp/diagram.mmd << 'EOF'
+          graph TD
+            A[Start] --> B[End]
+          EOF
+
+      2) Render to SVG (the -p flag is required):
+          mmdc -i /tmp/diagram.mmd -o /tmp/diagram.svg -p /root/.puppeteerrc.json
+
+      3) Upload to R2:
+          aws s3 cp /tmp/diagram.svg
+          "s3://$(printenv R2_BUCKET)/$(git rev-parse --abbrev-ref HEAD)/diagram.svg"
+          --endpoint-url "$(printenv R2_ENDPOINT)"
+
+      4) The public URL will be:
+          $(printenv R2_PUBLIC_URL)/<branch>/diagram.svg
+
+      5) Include in PR descriptions as markdown images:
+          ![description]($(printenv R2_PUBLIC_URL)/<branch>/diagram.svg)
+
 linkedRepos:
   - repo: windmill-labs/windmill-ee-private
-    alias: ee
+    alias: ee

sandbox-image/Dockerfile.sandbox

@@ -2,7 +2,7 @@ FROM debian:bookworm-slim
 
 # ── System packages ───────────────────────────────────────────────────────────
 RUN apt-get update && apt-get install -y --no-install-recommends \
-    curl ca-certificates git unzip \
+    curl ca-certificates git unzip openssh-client \
     # Rust native build deps
     pkg-config cmake clang mold libtool \
     libssl-dev libxml2-dev libxmlsec1-dev libxslt1-dev \
@@ -56,6 +56,13 @@ ENV PATH="/root/.local/bin:$PATH"
 # ── Codex ─────────────────────────────────────────────────────────────────────
 RUN npm i -g @openai/codex
 
+# ── Mermaid CLI ───────────────────────────────────────────────────────────────
+# Skip puppeteer's own Chromium download; reuse the one Playwright already installed above
+RUN PUPPETEER_SKIP_DOWNLOAD=true npm i -g @mermaid-js/mermaid-cli \
+    && CHROMIUM=$(find /root/.cache/ms-playwright -name 'chrome' -executable -type f | head -1) \
+    && printf '{"args":["--no-sandbox","--disable-setuid-sandbox"],"executablePath":"%s"}\n' "$CHROMIUM" \
+       > /root/.puppeteerrc.json
+
 # ── Entrypoint (run explicitly via docker exec, not on container start) ──────
 COPY entrypoint.sh /usr/local/bin/entrypoint.sh
 RUN chmod +x /usr/local/bin/entrypoint.sh