From b89a3d27b60f3c9878bfe0bd22718d4e80a028d4 Mon Sep 17 00:00:00 2001 From: Alexander Lanin Date: Thu, 13 Aug 2026 23:48:02 +0200 Subject: [PATCH 1/2] feat: install pre-commit from shared catalog Replace the standalone DevContainer feature with the catalogued pre-commit package installed by pinned uv. Keep the repository container and published feature aligned with the Bazel target. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- .devcontainer/devcontainer-lock.json | 5 ----- .devcontainer/devcontainer.json | 3 --- .devcontainer/post_create_command.sh | 11 ++++++++++- .../.devcontainer/devcontainer-lock.json | 5 ----- .../s-core-local/devcontainer-feature.json | 7 +------ .../.devcontainer/s-core-local/install.sh | 9 ++++++++- .../.devcontainer/s-core-local/tests/test_default.sh | 9 +++++++-- 7 files changed, 26 insertions(+), 23 deletions(-) diff --git a/.devcontainer/devcontainer-lock.json b/.devcontainer/devcontainer-lock.json index 96396c5..b9f7155 100644 --- a/.devcontainer/devcontainer-lock.json +++ b/.devcontainer/devcontainer-lock.json @@ -1,10 +1,5 @@ { "features": { - "ghcr.io/devcontainers-extra/features/pre-commit:2": { - "version": "2.0.18", - "resolved": "ghcr.io/devcontainers-extra/features/pre-commit@sha256:6e0bb2ce80caca1d94f44dab5d0653d88a1c00984e590adb7c6bce012d0ade6e", - "integrity": "sha256:6e0bb2ce80caca1d94f44dab5d0653d88a1c00984e590adb7c6bce012d0ade6e" - }, "ghcr.io/devcontainers/features/docker-in-docker:4": { "version": "4.0.0", "resolved": "ghcr.io/devcontainers/features/docker-in-docker@sha256:4fa87399214366e320d489991769c4f3f461e1ffe461f54eea78a41b34945bb5", diff --git a/.devcontainer/devcontainer.json b/.devcontainer/devcontainer.json index 2e7b5d2..f067f93 100644 --- a/.devcontainer/devcontainer.json +++ b/.devcontainer/devcontainer.json @@ -3,9 +3,6 @@ "features": { "ghcr.io/devcontainers/features/docker-in-docker:4": { "moby": "false" // does not work with Debian Trixie based images - }, - "ghcr.io/devcontainers-extra/features/pre-commit:2": { - "version": "4.5.1" } }, "postCreateCommand": "${containerWorkspaceFolder}/.devcontainer/post_create_command.sh", diff --git a/.devcontainer/post_create_command.sh b/.devcontainer/post_create_command.sh index e87b8cc..d1cc20f 100755 --- a/.devcontainer/post_create_command.sh +++ b/.devcontainer/post_create_command.sh @@ -18,8 +18,17 @@ npm install -g @devcontainers/cli SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd -P)" REPOSITORY_ROOT="$(cd "${SCRIPT_DIR}/.." && pwd -P)" -sudo "${REPOSITORY_ROOT}/tools/internal/devcontainer/install.py" install actionlint bazelisk buildifier ruff shellcheck yamlfmt +# Install uv and uvx from the native lockfile first. The pinned uv release then +# resolves every Python distribution declared in the shared catalog. +sudo "${REPOSITORY_ROOT}/tools/internal/devcontainer/install.py" install actionlint bazelisk buildifier ruff shellcheck uv uvx yamlfmt +# Install the catalogued Python distribution system-wide. The explicit +# directories avoid root-specific uv defaults and make pre-commit available to +# the non-root development user. +sudo "${REPOSITORY_ROOT}/tools/internal/devcontainer/install.py" install-python pre-commit \ + --bin-dir /usr/local/bin --tool-dir /usr/local/share/uv/tools + +# Hooks can only be registered after the catalogued executable is on PATH. pre-commit install scripts/create_builder.sh diff --git a/src/s-core-devcontainer/.devcontainer/devcontainer-lock.json b/src/s-core-devcontainer/.devcontainer/devcontainer-lock.json index 8baccd5..552c519 100644 --- a/src/s-core-devcontainer/.devcontainer/devcontainer-lock.json +++ b/src/s-core-devcontainer/.devcontainer/devcontainer-lock.json @@ -5,11 +5,6 @@ "resolved": "ghcr.io/devcontainers-community/features/llvm@sha256:4f464ab97a59439286a55490b55ba9851616f6f76ac3025e134127ac08ad79e2", "integrity": "sha256:4f464ab97a59439286a55490b55ba9851616f6f76ac3025e134127ac08ad79e2" }, - "ghcr.io/devcontainers-extra/features/pre-commit:2": { - "version": "2.0.18", - "resolved": "ghcr.io/devcontainers-extra/features/pre-commit@sha256:6e0bb2ce80caca1d94f44dab5d0653d88a1c00984e590adb7c6bce012d0ade6e", - "integrity": "sha256:6e0bb2ce80caca1d94f44dab5d0653d88a1c00984e590adb7c6bce012d0ade6e" - }, "ghcr.io/devcontainers/features/common-utils": { "version": "2.5.4", "resolved": "ghcr.io/devcontainers/features/common-utils@sha256:00fd45550f578d9d515044d9e2226e908dbc3d7aa6fcb9dee4d8bdb60be114cf", diff --git a/src/s-core-devcontainer/.devcontainer/s-core-local/devcontainer-feature.json b/src/s-core-devcontainer/.devcontainer/s-core-local/devcontainer-feature.json index 0faca54..5c39d93 100644 --- a/src/s-core-devcontainer/.devcontainer/s-core-local/devcontainer-feature.json +++ b/src/s-core-devcontainer/.devcontainer/s-core-local/devcontainer-feature.json @@ -2,12 +2,7 @@ "name": "Eclipse S-CORE-specific Local Tools", "id": "s-core-local", "version": "1.0.0", - "description": "Tools which are not available as already existing development container feature", - "dependsOn": { - "ghcr.io/devcontainers-extra/features/pre-commit:2": { - "version": "4.5.1" - } - }, + "description": "S-CORE-specific local development tools", "onCreateCommand": "/devcontainer/features/s-core-local/on_create_command.sh", "postCreateCommand": { "Fix ownership of mounted config volumes": "bash /devcontainer/features/s-core-local/fix_config_volume_ownership.sh", diff --git a/src/s-core-devcontainer/.devcontainer/s-core-local/install.sh b/src/s-core-devcontainer/.devcontainer/s-core-local/install.sh index 8464cae..0b54fcf 100755 --- a/src/s-core-devcontainer/.devcontainer/s-core-local/install.sh +++ b/src/s-core-devcontainer/.devcontainer/s-core-local/install.sh @@ -57,9 +57,16 @@ apt-get install -y "python${python_version}" python3-pip python3-venv # devcontainer feature "python" (cf. https://github.com/devcontainers/features/tree/main/src/python ) apt-get install -y flake8 python3-autopep8 black python3-yapf mypy pydocstyle pycodestyle bandit pipenv virtualenv pylint -# Lockfile-managed local developer tools +# uv must be installed from the native lockfile before it can install the +# Python distributions declared in the shared Python tool catalog below. /usr/local/share/score-tools/internal/devcontainer/install.py install shellcheck ruff actionlint yamlfmt uv uvx apm opencode +# Keep Python CLIs in system directories so every DevContainer user sees the +# same entrypoint and isolated environment. Bazel reads the same package pin +# from this catalog but executes it on demand with uvx. +/usr/local/share/score-tools/internal/devcontainer/install.py install-python pre-commit \ + --bin-dir /usr/local/bin --tool-dir /usr/local/share/uv/tools + # GraphViz # The Ubuntu Noble package of GraphViz apt-get install -y graphviz="${graphviz_version}*" diff --git a/src/s-core-devcontainer/.devcontainer/s-core-local/tests/test_default.sh b/src/s-core-devcontainer/.devcontainer/s-core-local/tests/test_default.sh index 82561ee..f83eb4a 100755 --- a/src/s-core-devcontainer/.devcontainer/s-core-local/tests/test_default.sh +++ b/src/s-core-devcontainer/.devcontainer/s-core-local/tests/test_default.sh @@ -30,8 +30,13 @@ uvx_lockfile_version="$(/usr/local/share/score-tools/internal/devcontainer/insta apm_lockfile_version="$(/usr/local/share/score-tools/internal/devcontainer/install.py version apm)" opencode_lockfile_version="$(/usr/local/share/score-tools/internal/devcontainer/install.py version opencode)" -# pre-commit, it is available via $PATH in login shells, but not in non-login shells -check "validate pre-commit is working and has the correct version" bash -c "pre-commit --version | grep '4.5.1'" +# The shared catalog is the assertion source, so installation metadata and the +# executable exposed on PATH are checked against the same release. +pre_commit_catalog_version="$(/usr/local/share/score-tools/internal/devcontainer/install.py version pre-commit)" + +# Verify the system-wide uv installation exposes the catalogued release to the +# non-root user running feature tests. +check "validate pre-commit is working and has the correct version" bash -c "pre-commit --version | grep '${pre_commit_catalog_version}'" # Common tooling check "validate shellcheck is working and has the correct version" bash -c "shellcheck --version | grep '${shellcheck_lockfile_version}'" From 85ccee37bc554d41ed94e318760d604e34d23008 Mon Sep 17 00:00:00 2001 From: Alexander Lanin Date: Fri, 14 Aug 2026 00:10:20 +0200 Subject: [PATCH 2/2] fix: remove implicit pipx feature dependency Use the catalogued uvx runner for REUSE commands and remove the feature installer assumption that PIPX_BIN_DIR was written by another DevContainer feature. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- README.md | 2 +- scripts/run_reuse_annotate.sh | 3 ++- .../.devcontainer/s-core-local/install.sh | 5 ----- 3 files changed, 3 insertions(+), 7 deletions(-) diff --git a/README.md b/README.md index 50fe4fb..e09fabd 100644 --- a/README.md +++ b/README.md @@ -388,7 +388,7 @@ There should rarely be a need to modify this. This repo uses [`reuse`](https://codeberg.org/fsfe/reuse-tool) to check for and validate licenses and copyrights. Checks are performend via pre-commit hooks. -If you want to run it standalone run `pipx run reuse lint` in a terminal. +If you want to run it standalone, run `tools/run-tool uvx reuse lint` in a terminal. To fix found issues run `scripts/run_reuse_annotate.sh`. ### Modify, Build, Test, Use diff --git a/scripts/run_reuse_annotate.sh b/scripts/run_reuse_annotate.sh index 67321e3..450caeb 100755 --- a/scripts/run_reuse_annotate.sh +++ b/scripts/run_reuse_annotate.sh @@ -28,7 +28,8 @@ files_to_annotate=$(comm -23 <(git ls-files | sort) <(echo "${deleted_files}" | # shellcheck disable=SC2086 # Expansion of ${files_to_annotate} is intentional to pass the list of files as separate arguments to the reuse annotate command. -pipx run reuse annotate --template apache-2.0 --merge-copyrights --recursive --skip-unrecognised \ +# The shared runner supplies the catalogued uvx binary in containers and Bazel. +tools/run-tool uvx reuse annotate --template apache-2.0 --merge-copyrights --recursive --skip-unrecognised \ --copyright="Contributors to the Eclipse Foundation" --license=Apache-2.0 ${files_to_annotate} popd > /dev/null diff --git a/src/s-core-devcontainer/.devcontainer/s-core-local/install.sh b/src/s-core-devcontainer/.devcontainer/s-core-local/install.sh index 0b54fcf..8e3ded8 100755 --- a/src/s-core-devcontainer/.devcontainer/s-core-local/install.sh +++ b/src/s-core-devcontainer/.devcontainer/s-core-local/install.sh @@ -36,11 +36,6 @@ DEBIAN_FRONTEND=noninteractive ARCHITECTURE=$(dpkg --print-architecture) KERNEL=$(uname -s) -# always add PIPX_BIN_DIR to path -PIPX_BIN_DIR_EXPORT="$(grep "export PIPX_BIN_DIR" /etc/bash.bashrc)" -eval "${PIPX_BIN_DIR_EXPORT}" -echo -e "PATH=\"${PIPX_BIN_DIR}:\$PATH\"\nexport PATH" >> /etc/profile.d/pipx_bin_dir.sh - apt-get update # Unminimize the image to include standard packages like man pages