devcontainer.yml

name: DevContainer

on:
  push:
    branches:
      - main
  pull_request:
    paths:
      - .devcontainer/**/*
      - .github/workflows/devcontainer.yml

concurrency:
  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  build:
    name: Build
    runs-on: ubuntu-latest
    permissions:
      contents: write
      packages: read
      actions: read

    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
        with:
          egress-policy: audit

      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Lint Dockerfile
        uses: hadolint/hadolint-action@2332a7b74a6de0dda2e2221d575162eba76ba5e5 # v3.3.0
        with:
          dockerfile: .devcontainer/ubuntu-24.04/Dockerfile

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0

      - name: Prepare image tag
        shell: bash
        run: |
          RAW_TAG="${GITHUB_HEAD_REF:-$GITHUB_RUN_ID}"
          SAFE_TAG=$(echo "$RAW_TAG" | tr '[:upper:]' '[:lower:]' | sed 's/[^a-z0-9_.-]/-/g')
          if ! [[ "$SAFE_TAG" =~ ^[a-z0-9_] ]]; then SAFE_TAG="x-$SAFE_TAG"; fi
          SAFE_TAG="${SAFE_TAG:0:128}"
          echo "image_tag=devcontainer:${SAFE_TAG}" >> "$GITHUB_ENV"

      - name: Build Docker image
        run: |
          docker buildx build .devcontainer/ubuntu-24.04/ \
            --tag "${{ env.image_tag }}" \
            --label "runnumber=${{ github.run_id }}" \
            --load

      - uses: addnab/docker-run-action@4f65fabd2431ebc8d299f8e5a018d79a769ae185 # v3
        env:
          GITHUB_TOKEN: ${{ github.token }}
        with:
          image: ${{ env.image_tag }}
          options: -v ${{ github.workspace }}:/workspace -e GITHUB_TOKEN
          shell: zsh
          run: |
            . ~/.zshrc
            cd /workspace
            npm install
            npm run build