feat: allow inheritance of devcontainer.metadata in the re-usable workflows#1357
Open
Ron (rjaegers) wants to merge 11 commits into
Open
feat: allow inheritance of devcontainer.metadata in the re-usable workflows#1357Ron (rjaegers) wants to merge 11 commits into
devcontainer.metadata in the re-usable workflows#1357Ron (rjaegers) wants to merge 11 commits into
Conversation
Ron (rjaegers)
changed the title
Ron (rjaegers)
changed the title
devcontainer.metadata in the re-usable workflows
Contributor
📦 Container Size AnalysisNote Comparing 📈 Size Comparison Table
|
Contributor
✅
|
| Descriptor | Linter | Files | Fixed | Errors | Warnings | Elapsed time |
|---|---|---|---|---|---|---|
| ✅ ACTION | actionlint | 23 | 0 | 0 | 0.1s | |
| ✅ DOCKERFILE | hadolint | 4 | 0 | 0 | 0.27s | |
| ✅ JSON | npm-package-json-lint | yes | no | no | 0.33s | |
| ✅ JSON | prettier | 43 | 2 | 0 | 0 | 0.57s |
| ✅ JSON | v8r | 43 | 0 | 0 | 9.66s | |
| ✅ MARKDOWN | markdownlint | 13 | 0 | 0 | 0 | 0.81s |
| ✅ MARKDOWN | markdown-table-formatter | 13 | 0 | 0 | 0 | 0.17s |
| ✅ REPOSITORY | betterleaks | yes | no | no | 1.0s | |
| ✅ REPOSITORY | checkov | yes | no | no | 31.55s | |
| ✅ REPOSITORY | gitleaks | yes | no | no | 0.75s | |
| ✅ REPOSITORY | git_diff | yes | no | no | 0.01s | |
| ✅ REPOSITORY | grype | yes | no | no | 50.02s | |
| osv-scanner | yes | 1 | no | 0.56s | ||
| ✅ REPOSITORY | secretlint | yes | no | no | 1.58s | |
| ✅ REPOSITORY | syft | yes | no | no | 1.75s | |
| ✅ REPOSITORY | trivy | yes | no | no | 9.28s | |
| ✅ REPOSITORY | trivy-sbom | yes | no | no | 0.34s | |
| ✅ REPOSITORY | trufflehog | yes | no | no | 2.27s | |
| lychee | 111 | 4 | 0 | 10.22s | ||
| ✅ YAML | prettier | 32 | 0 | 0 | 0 | 0.9s |
| ✅ YAML | v8r | 32 | 0 | 0 | 7.09s | |
| ✅ YAML | yamllint | 32 | 0 | 0 | 0.92s |
Detailed Issues
⚠️ SPELL / lychee - 4 errors
📝 Summary
---------------------
🔍 Total..........154
🔗 Unique.........126
✅ Successful.....145
⏳ Timeouts.........0
🔀 Redirected......19
👻 Excluded.........0
❓ Unknown..........0
🚫 Errors...........4
⛔ Unsupported......4
Errors in .github/CODE_OF_CONDUCT.md
[ERROR] https://www.contributor-covenant.org/ (at 76:42) | Network error: Connection reset by peer (os error 104)
Errors in .github/TOOL_VERSION_ISSUE_TEMPLATE.md
[403] https://developer.arm.com/downloads/-/arm-gnu-toolchain-downloads (at 38:7) | Rejected status code: 403 Forbidden
Errors in README.md
[ERROR] https://docs.sigstore.dev/cosign/signing/overview/ (at 156:76) | Network error: Connection reset by peer (os error 104)
[ERROR] https://docs.sigstore.dev/cosign/verifying/verify/ (at 158:22) | Network error: Connection reset by peer (os error 104)
Hint: Followed 19 redirects. You might want to consider replacing redirecting URLs with the resolved URLs. Use verbose mode (`-v`/`-vv`) to see redirection details.
Hint: You can configure accepted/rejected response codes with `-a` or `--accept`
⚠️ REPOSITORY / osv-scanner - 1 error
Scanning dir .
Starting filesystem walk for root: /
Scanned .devcontainer/cpp/requirements.txt file and found 20 packages
Scanned .devcontainer/docs/requirements.txt file and found 14 packages
Scanned test/embedded-rust/workspace/cortex-m/Cargo.lock file and found 20 packages
Scanned test/embedded-rust/workspace/cortex-mf/Cargo.lock file and found 20 packages
Scanned test/rust/workspace/cargo/Cargo.lock file and found 1 package
Scanned test/rust/workspace/clippy/Cargo.lock file and found 1 package
Scanned test/rust/workspace/test/Cargo.lock file and found 1 package
Scanned package-lock.json file and found 73 packages
End status: 100 dirs visited, 330 inodes visited, 8 Extract calls, 17.068872ms elapsed, 17.068985ms wall time
Total 2 packages affected by 2 known vulnerabilities (0 Critical, 0 High, 0 Medium, 0 Low, 2 Unknown) from 1 ecosystem.
0 vulnerabilities can be fixed.
+-----------------------------------+------+-----------+------------+---------+---------------+---------------------------------------------------+
| OSV URL | CVSS | ECOSYSTEM | PACKAGE | VERSION | FIXED VERSION | SOURCE |
+-----------------------------------+------+-----------+------------+---------+---------------+---------------------------------------------------+
| https://osv.dev/RUSTSEC-2026-0110 | | crates.io | bare-metal | 0.2.5 | -- | test/embedded-rust/workspace/cortex-m/Cargo.lock |
| https://osv.dev/RUSTSEC-2026-0110 | | crates.io | bare-metal | 0.2.5 | -- | test/embedded-rust/workspace/cortex-mf/Cargo.lock |
+-----------------------------------+------+-----------+------------+---------+---------------+---------------------------------------------------+
Notices
📣 MegaLinter 9.5.0 is out! Discover the new features and security recommendations in the release announcement. (Skip this info by defining SECURITY_SUGGESTIONS: false)
See detailed reports in MegaLinter artifacts
You could have the same capabilities but better runtime performances if you use a MegaLinter flavor:
- oxsecurity/megalinter/flavors/salesforce@v9.6.0 (57 linters)
- oxsecurity/megalinter/flavors/javascript@v9.6.0 (63 linters)
Your project could benefit from a custom flavor, which would allow you to run only the linters you need, and thus improve runtime performances. (Skip this info by defining FLAVOR_SUGGESTIONS: false)
- Documentation: Custom Flavors
- Command:
npx mega-linter-runner@9.6.0 --custom-flavor-setup --custom-flavor-linters ACTION_ACTIONLINT,DOCKERFILE_HADOLINT,JSON_V8R,JSON_PRETTIER,JSON_NPM_PACKAGE_JSON_LINT,MARKDOWN_MARKDOWNLINT,MARKDOWN_MARKDOWN_TABLE_FORMATTER,REPOSITORY_CHECKOV,REPOSITORY_GIT_DIFF,REPOSITORY_GITLEAKS,REPOSITORY_BETTERLEAKS,REPOSITORY_GRYPE,REPOSITORY_OSV_SCANNER,REPOSITORY_SECRETLINT,REPOSITORY_SYFT,REPOSITORY_TRIVY,REPOSITORY_TRIVY_SBOM,REPOSITORY_TRUFFLEHOG,SPELL_LYCHEE,YAML_PRETTIER,YAML_YAMLLINT,YAML_V8R
Show us your support by starring ⭐ the repository
Contributor
There was a problem hiding this comment.
Pull request overview
This PR reduces duplication in devcontainer metadata across image flavors by introducing a metadata-merge script and wiring it into the build/push workflows, while also updating per-flavor metadata payloads and expanding base image integration tests.
Changes:
- Add a script to merge
devcontainer.metadataarrays (base + flavor) and verify the resulting label on pushed images. - Refactor per-flavor
devcontainer-metadata.jsonto remove base-duplicated entries and centralize base defaults. - Expand base integration tests to validate pinned apt package versions, tool inventory presence, locale defaults, and bash-completion.
Reviewed changes
Copilot reviewed 13 out of 13 changed files in this pull request and generated 4 comments.
Show a summary per file
| File | Description |
|---|---|
test/base/integration-tests.bats |
Adds additional base-image verification tests (apt pins, tool inventory, locale, bash completion). |
README.md |
Documents the metadata-array inheritance/merge approach for flavors and derived images. |
.github/workflows/wc-build-push.yml |
Generates merged devcontainer.metadata label and verifies it on the pushed image. |
.github/workflows/wc-build-push-test.yml |
Plumbs base-image reference input through to the lower-level build workflow. |
.github/workflows/update-dependencies.yml |
Includes base flavor in the dependency update matrix. |
.github/workflows/build-push-test.yml |
Passes base image reference so flavor builds can merge inherited metadata. |
.github/scripts/merge-devcontainer-metadata.sh |
New helper to concatenate base + flavor devcontainer.metadata arrays per spec behavior. |
.devcontainer/base/devcontainer-metadata.json |
New base metadata entry to be inherited by flavors via array merging. |
.devcontainer/cpp/Dockerfile |
Creates a default compile_commands.json location for tooling compatibility. |
.devcontainer/cpp/devcontainer-metadata.json |
Updates C++ flavor extensions/settings to rely on inherited base metadata. |
.devcontainer/embedded-cpp/devcontainer-metadata.json |
Updates embedded C++ flavor extensions/settings to rely on inherited base metadata. |
.devcontainer/docs/devcontainer-metadata.json |
Streamlines docs flavor extension list. |
.devcontainer/rust/devcontainer-metadata.json |
Streamlines rust flavor extension list. |
Contributor
📦 Container Size AnalysisNote Comparing 📈 Size Comparison Table
|
Contributor
📦 Container Size AnalysisNote Comparing 📈 Size Comparison Table
|
Contributor
📦 Container Size AnalysisNote Comparing 📈 Size Comparison Table
|
Contributor
📦 Container Size AnalysisNote Comparing 📈 Size Comparison Table
|
Ron (rjaegers)
had a problem deploying
to
acceptance-testing
July 13, 2026 13:39 — with 
GitHub Actions
Failure
GitHub Actions
Failure
Contributor
Daniël Schenk (danielschenk)
approved these changes
Jul 14, 2026
Daniël Schenk (danielschenk)
left a comment
Daniël Schenk (danielschenk)
left a comment
Member
There was a problem hiding this comment.
LGTM but those AI comments are worth checking, especially the bats ones (I don't know enough of bats to say how valid they are).
5 tasks
Signed-off-by: Ron <45816308+rjaegers@users.noreply.github.com>
Contributor
📦 Container Size AnalysisNote Comparing 📈 Size Comparison Table
|
Ron (rjaegers)
had a problem deploying
to
acceptance-testing
July 15, 2026 20:18 — with
GitHub Actions
Error
GitHub Actions
Error
This reverts commit 9a5b54f.
Ron (rjaegers)
temporarily deployed
to
acceptance-testing
July 15, 2026 20:33 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Signed-off-by: Ron <45816308+rjaegers@users.noreply.github.com>
|
| # | ||
| # The gsub expression adds a space after each comma to prevent `docker buildx build --label` to | ||
| # misinterpret the array and produce invalid JSON (e.g. ["x","y"] -> ["x",y]). | ||
| merged="$(jq -cj --slurpfile flavor "${METADATA_FILE}" '. + $flavor | @json | gsub("\",\""; "\", \"")' <<< "${base_metadata}")" |
Comment on lines
+161
to
+167
| # Compare as normalized JSON so the array-quote whitespace workaround is ignored. | ||
| if ! diff <(jq -S . <<< "${expected}") <(jq -S . <<< "${actual}"); then | ||
| echo "error: devcontainer.metadata label on the image does not match the expected merged metadata" >&2 | ||
| exit 1 | ||
| fi | ||
|
|
||
| echo "devcontainer.metadata label verified ($(jq 'length' <<< "${actual}") entries)" |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
🚀 Hey, I have created a Pull Request
Description of changes
This pull request introduces significant improvements to how devcontainer metadata is managed and merged across image flavors, enhances the CI/CD workflows for building and testing images, and adds new integration tests for base image validation. The most important changes include implementing a script and workflow logic to merge
devcontainer.metadatalabels according to the Dev Container spec, updating metadata and extension lists for devcontainer flavors, and expanding test coverage for base image contents.Devcontainer metadata management and merging:
.github/scripts/merge-devcontainer-metadata.shto merge the base image'sdevcontainer.metadataarray with the current flavor's metadata, ensuring proper inheritance and avoiding duplication as per the Dev Container specification..github/workflows/wc-build-push.yml,.github/workflows/build-push-test.yml,.github/workflows/wc-build-push-test.yml) to use the new merge script, pass base image references, and verify the merged metadata label on built images. [1] [2] [3] [4] [5] [6]Devcontainer flavor metadata and extension updates:
.devcontainer/base/devcontainer-metadata.jsonand updated all flavor-specificdevcontainer-metadata.jsonfiles to streamline extension lists, remove redundant entries, and unify formatter settings. [1] [2] [3] [4] [5] [6]README.mdto document the new metadata merging approach and its rationale.Base image and flavor build/test improvements:
compile_commands.jsonto/root/.ampin the C++ Dockerfile to improve compatibility with tools like SonarLint and Clangd.baseflavor in the update-dependencies workflow matrix for comprehensive dependency management.Test coverage enhancements:
test/base/integration-tests.batsto verify that all apt packages are installed at their pinned versions, tools from the inventory are present, theC.UTF-8locale is set, and bash-completion is enabled for root.These changes collectively improve maintainability, correctness, and developer experience when working with devcontainer images and their metadata.
✔️ Checklist