Merge pull request #2 from rcwbr/1-define-initialize-script-with-cach…

…ing-logic

define initialize script with caching logic

.devcontainer/devcontainer-bake.hcl

@@ -0,0 +1,13 @@
+variable "devcontainer_layers" {
+  default = [
+    "docker-client",
+    "useradd",
+    "pre-commit"
+  ]
+}
+
+target "docker-client" {
+  contexts = {
+    base_context = "docker-image://python:3.12.4"
+  }
+}

.devcontainer/devcontainer.json

@@ -0,0 +1,19 @@
+{
+  "name": "devcontainer-cache-build",
+  "initializeCommand": ".devcontainer/initialize",
+  "image": "devcontainer-cache-build-devcontainer",
+  "mounts": [
+    { "source": "/var/run/docker.sock", "target": "/var/run/docker.sock", "type": "bind" }
+  ],
+  "secrets": {
+    "DEVCONTAINER_CACHE_BUILD_DEVCONTAINER_INITIALIZE": {
+      "description": "GitHub personal access token with `write:packages` scope to pull and push devcontainer image cache",
+      "documentationUrl": "https://github.com/rcwbr/devcontainer-cache-build/blob/main/README.md#initialize-script-github-container-registry-setup"
+    }
+  },
+  "hostRequirements": {
+    "cpus": 2,
+    "memory": "8gb",
+    "storage": "32gb"
+  }
+}

.devcontainer/initialize

@@ -0,0 +1,18 @@
+#!/bin/bash
+
+echo $DEVCONTAINER_CACHE_BUILD_DEVCONTAINER_INITIALIZE | docker login ghcr.io --username $GITHUB_USER --password-stdin
+export DEVCONTAINER_IMAGE=devcontainer-cache-build-devcontainer
+export DEVCONTAINER_REGISTRY=ghcr.io/rcwbr
+export DEVCONTAINER_DEFINITION_TYPE=bake
+export DEVCONTAINER_INITIALIZE_PID=$PPID
+devcontainer_definition_files_arr=(
+  devcontainer-bake.hcl
+  docker-client/devcontainer-bake.hcl
+  useradd/devcontainer-bake.hcl
+  pre-commit/devcontainer-bake.hcl
+  cwd://.devcontainer/devcontainer-bake.hcl
+)
+DEVCONTAINER_DEFINITION_FILES="${devcontainer_definition_files_arr[@]}"
+export DEVCONTAINER_DEFINITION_FILES
+export DEVCONTAINER_BUILD_ADDITIONAL_ARGS="https://github.com/rcwbr/dockerfile-partials.git#0.2.1 $@"
+bash devcontainer-cache-build-initialize

.github/CODEOWNERS

@@ -0,0 +1 @@
+* @rcwbr

.github/settings.yml

@@ -0,0 +1,73 @@
+repository:
+  name: devcontainer-cache-build
+  description: Build devcontainer images using remote Docker cache
+  default_branch: main
+
+  # Prevent strategies other than basic merge, as they interfere with conventional changelog version inference
+  allow_squash_merge: false
+  allow_rebase_merge: false
+  # Instead, merge by merge commit
+  allow_merge_commit: true
+  # Clean up branches when PRs merge
+  delete_branch_on_merge: true
+
+rulesets:
+  - name: Tags rules
+    target: tag
+    enforcement: active
+    conditions:
+      ref_name:
+        include:
+          - "~ALL"
+        exclude: []
+    bypass_actors:
+      - actor_id: 1050758 # devcntr-cache-build-ci-release-it release-it app
+        actor_type: Integration
+        bypass_mode: always
+    rules:
+      - type: creation
+      - type: deletion
+      - type: non_fast_forward
+      - type: update
+  - name: Default branch rules
+    target: branch
+    enforcement: active
+    conditions:
+      ref_name:
+        include:
+          - "~DEFAULT_BRANCH"
+        exclude: []
+    bypass_actors:
+      - actor_id: 5 # Based on https://registry.terraform.io/providers/integrations/github/latest/docs/resources/organization_ruleset#bypass_actors
+        actor_type: RepositoryRole
+        bypass_mode: pull_request
+    rules:
+      - type: creation
+      - type: deletion
+      - type: non_fast_forward
+      - type: pull_request
+        parameters:
+          dismiss_stale_reviews_on_push: true
+          require_code_owner_review: true
+          require_last_push_approval: false
+          # Use codeowners vs. review count, so codeowners can merge without review
+          required_approving_review_count: 0
+          required_review_thread_resolution: true
+      # Require workflow job as check to enable PR up-to-date rule
+      - type: required_status_checks
+        parameters:
+          required_status_checks:
+            - context: devcontainer-cache-build / Populate devcontainer image cache
+              integration_id: 15368 # GitHub Actions integration ID
+            - context: release-it-workflow / Release-it dry-run
+              integration_id: 15368 # GitHub Actions integration ID
+          # Requires PR branches to be up-to-date with target
+          strict_required_status_checks_policy: true
+
+collaborators: [] # No collaborators defined
+
+environments:
+  - name: Repo release # Must match the app-environment workflow input
+    deployment_branch_policy:
+      custom_branches:
+        - main

.github/workflows/devcontainer-cache-build.yaml

@@ -0,0 +1,26 @@
+on:
+  workflow_call:
+    inputs:
+      initialize-args:
+        description: Args to provide to the initialize script, e.g. to configure user info
+        default: "--set useradd.args.USER=codespace --set useradd.args.USER_UID=1000 --set useradd.args.USER_GID=1000 --set pre-commit.args.USER=codespace"
+        required: false
+        type: string
+jobs:
+  devcontainer-cache-build:
+    name: Populate devcontainer image cache
+    runs-on: ubuntu-24.04
+    permissions:
+      packages: write
+    steps:
+      - name: Checkout
+        uses: actions/[email protected]
+      - name: GHCR Login
+        uses: docker/[email protected]
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Build devcontainer cache
+        run: |
+          ./.devcontainer/initialize ${{ inputs.initialize-args }}

.github/workflows/push-workflow.yaml

@@ -0,0 +1,14 @@
+name: Push workflow
+on: push
+jobs:
+  devcontainer-cache-build:
+    uses: ./.github/workflows/devcontainer-cache-build.yaml
+    permissions:
+      packages: write
+  release-it-workflow:
+    uses: rcwbr/release-it-gh-workflow/.github/workflows/[email protected]
+    with:
+      app-id: 1050758 # devcntr-cache-build-ci-release-it release-it app
+      app-environment: Repo release
+    secrets:
+      app-secret: ${{ secrets.RELEASE_IT_GITHUB_APP_KEY }} # Secret belonging to the Repo release environment

.pre-commit-config.yaml

@@ -0,0 +1,8 @@
+repos:
+- repo: https://github.com/executablebooks/mdformat
+  rev: 0.7.17
+  hooks:
+  - id: mdformat
+    additional_dependencies:
+    - mdformat-shfmt
+    - mdformat-black

.vscode/settings.json

@@ -0,0 +1,4 @@
+{
+  "editor.insertSpaces": true,
+  "editor.tabSize": 2
+}

.vscode/tasks.json

@@ -0,0 +1,33 @@
+{
+  "version": "2.0.0",
+  "tasks": [
+    {
+      "label": "pre-commit all files",
+      "type": "shell",
+      "command": "pre-commit run --all-files",
+      "problemMatcher": []
+    },
+    {
+      "label": "Docker dive",
+      "type": "shell",
+      "command": "docker",
+      "args": [
+        "run",
+        "--rm",
+        "-it",
+        "-v",
+        "/var/run/docker.sock:/var/run/docker.sock",
+        "wagoodman/dive:latest",
+        "${input:dockerImage}"
+      ],
+      "problemMatcher": []
+    }
+  ],
+  "inputs": [
+    {
+      "id": "dockerImage",
+      "description": "Docker image",
+      "type": "promptString"
+    }
+  ]
+}

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2024 Eric Weber
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.