Feat python workflow upgrade

.devcontainer/devcontainer.json

@@ -10,37 +10,30 @@
 
   "customizations": {
     "vscode": {
+      "extensions": [
+        "eamodio.gitlens",
+        "EditorConfig.EditorConfig",
+        "esbenp.prettier-vscode",
+        "jetmartin.bats",
+        "ms-azuretools.vscode-docker"
+      ],
       "settings": {
-        "editor.defaultFormatter": "esbenp.prettier-vscode",
-        "editor.formatOnSave": true,
-        "editor.rulers": [80, 120],
-        "editor.wordBasedSuggestions": "off",
-        "explorer.excludeGitIgnore": true,
-        "extensions.ignoreRecommendations": true,
+        "editor.defaultFormatter": "ms-azuretools.vscode-docker",
         "git.enableCommitSigning": true,
         "terminal.integrated.defaultProfile.linux": "bash",
-        "terminal.integrated.shellIntegration.decorationsEnabled": "never",
-
         "terminal.integrated.profiles.linux": {
           "bash": {
             "path": "/usr/bin/bash"
           }
-        }
-      },
-
-      "extensions": [
-        "eamodio.gitlens",
-        "EditorConfig.EditorConfig",
-        "esbenp.prettier-vscode",
-        "jetmartin.bats",
-        "ms-azuretools.vscode-docker",
-        "ms-vscode.makefile-tools"
-      ]
+        },
+        "terminal.integrated.shellIntegration.decorationsEnabled": "never"
+      }
     }
   },
 
   "mounts": [
-    "type=bind,source=/var/run/docker.sock,target=/var/run/docker.sock",
-    "type=bind,consistency=cached,source=${localWorkspaceFolder}/tmp/history,target=/home/dev/.history"
+    "type=bind,consistency=cached,source=${localWorkspaceFolder}/tmp/history,target=/home/dev/.history",
+    "type=bind,source=${localEnv:HOME}/.claude/,target=/home/dev/.claude/",
+    "type=bind,source=${localEnv:HOME}/.claude.json,target=/home/dev/.claude.json"
   ]
 }

.devcontainer/hooks/post_attach.sh

@@ -1,11 +1,17 @@
 #!/bin/bash
 
+# ##############################################################################
+# HOOK: POST START
+# ##############################################################################
+
+# ------------------------------------------------------------------------------
+# DIRENV
+# ------------------------------------------------------------------------------
+
 direnv allow /workspaces/*
 
-sudo chown root:docker /var/run/docker.sock
-sudo chmod g+w /var/run/docker.sock
+# ------------------------------------------------------------------------------
+# GIT
+# ------------------------------------------------------------------------------
 
 ls -d /workspaces/* | xargs git config --global --add safe.directory
-
-starship preset plain-text-symbols -o ~/.config/starship.toml
-starship config container.disabled true

.env

@@ -0,0 +1,34 @@
+# ##############################################################################
+# ENVIRONMENT VARIABLES
+# ##############################################################################
+
+#
+# GENERAL
+#
+
+export DOCKER_BUILDKIT=1
+
+#
+# PROJECT VARIABLES
+#
+
+export PROJECT_BUILD_DATE="$(date -u +'%Y-%m-%d %H:%M:%S%z')"
+export PROJECT_COMMIT="$(git rev-parse HEAD)"
+export PROJECT_VERSION="1.2.0"
+export PROJECT_DOCKER_ORG="schubergphilis"
+export PROJECT_DOCKER_PLATFORMS="linux/arm64,linux/amd64"
+export PROJECT_DOCKER_REPOSITORY="devcontainer"
+export PROJECT_NAME="devcontainer"
+export PROJECT_DOCKER_HOST="ghcr.io"
+
+
+#
+# DOCKER IMAGE ARGUMENTS
+#
+
+export DEFAULT_LANG="C.UTF-8"
+export DEFAULT_USER_PRIMARY_GROUP="developers"
+export DEFAULT_USER_SECONDARY_GROUPS="sudo"
+export DEFAULT_USER_SHELL="/bin/bash"
+export DEFAULT_USER="dev"
+export DEFAULT_LANG="C.UTF-8"

.envrc

@@ -1,2 +1,4 @@
-export PROJECT_BUILD_DATE="0000-00-00 00:00:00+00:00"
-export PROJECT_NAME="devcontainer"
+#!/bin/bash
+
+source_env_if_exists .env
+source_env_if_exists .env.local

.github/workflows/pipeline.yml

@@ -1,130 +1,174 @@
+# ##############################################################################
+# WORKFLOW
+# ##############################################################################
+
+# ------------------------------------------------------------------------------
+# METADATA
+# ------------------------------------------------------------------------------
+
+#
+# GENERAL
+#
+
 name: Pipeline
 
+#
+# TRIGGER
+#
+
 on:
   pull_request:
   push:
     tags:
       - "v*"
   workflow_dispatch:
 
+# ##############################################################################
+# ENVIRONMENT VARIABLES
+# ##############################################################################
+
 env:
-  DOCKER_BUILDKIT: 1
-  PROJECT_DOCKER_CACHE_BACKEND: ${{ vars.PROJECT_DOCKER_CACHE_BACKEND }}
-  PROJECT_DOCKER_HOST: ${{ vars.PROJECT_DOCKER_HOST }}
-  PROJECT_DOCKER_ORG: ${{ vars.PROJECT_DOCKER_ORG }}
-  PROJECT_DOCKER_PLATFORMS: ${{ vars.PROJECT_DOCKER_PLATFORMS }}
-  PROJECT_NAME: ${{ vars.PROJECT_NAME }}
+  PROJECT_DOCKER_EXTRA_ARGS: ${{ vars.PROJECT_DOCKER_EXTRA_ARGS }}
+
+# ##############################################################################
+# JOBS
+# ##############################################################################
 
 jobs:
   lint:
     name: Lint
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04-arm
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
 
       - name: Prepare
-        uses: schubergphilis/prepare-action@v1
+        uses: schubergphilis/prepare-action@68aa577339a0a7307c3c9c4d9141a9b632e1fff8  # v1.0.0
         with:
           type: container
           job: lint
 
+      - name: Load Environment Variables
+        run: |
+          direnv allow .
+          direnv export gha > "$GITHUB_ENV"
+
       - name: Lint
         run: |
-          make lint
+          task lint
 
   scan:
     name: Scan
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04-arm
     needs: lint
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
 
       - name: Prepare
-        uses: schubergphilis/prepare-action@v1
+        uses: schubergphilis/prepare-action@68aa577339a0a7307c3c9c4d9141a9b632e1fff8  # v1.0.0
         with:
           type: container
           job: scan
 
+      - name: Load Environment Variables
+        run: |
+          direnv allow .
+          direnv export gha > "$GITHUB_ENV"
+
       - name: Scan
         run: |
-          make scan
+          task scan
 
-  pre-ci:
-    name: Pre-CI
-    runs-on: ubuntu-22.04
+  ci-arm:
+    name: CI (arm64)
+    runs-on: ubuntu-24.04-arm
     needs: scan
-    outputs:
-      platforms: ${{ steps.platforms.outputs.value }}
     steps:
-      - name: Get Platforms as JSON
-        id: platforms
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+
+      - name: Prepare
+        uses: schubergphilis/prepare-action@68aa577339a0a7307c3c9c4d9141a9b632e1fff8  # v1.0.0
+        with:
+          type: container
+          job: ci
+
+      - name: Load Environment Variables
         run: |
-          echo "value=[\"$(echo $PROJECT_DOCKER_PLATFORMS | sed 's/,/\",\"/g')\"]" >> $GITHUB_OUTPUT
-
-  ci:
-    name: CI
-    runs-on: ubuntu-22.04
-    needs: pre-ci
-    strategy:
-      matrix:
-        platforms: ${{ fromJSON(needs.pre-ci.outputs.platforms) }}
-    permissions:
-      attestations: write
-      contents: read
-      id-token: write
-      packages: write
+          direnv allow .
+          direnv export gha > "$GITHUB_ENV"
+
+      - name: Build
+        env:
+          PROJECT_DOCKER_PLATFORMS: linux/arm64
+        run: |
+          task build
+
+      - name: Test
+        env:
+          PROJECT_DOCKER_PLATFORMS: linux/arm64
+        run: |
+          task test
+
+  ci-amd:
+    name: CI (amd64)
+    runs-on: ubuntu-24.04
+    needs: scan
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
 
       - name: Prepare
-        uses: schubergphilis/prepare-action@v1
+        uses: schubergphilis/prepare-action@68aa577339a0a7307c3c9c4d9141a9b632e1fff8  # v1.0.0
         with:
           type: container
           job: ci
 
-      - name: Login to GitHub Registry
-        uses: docker/login-action@v3
-        with:
-          registry: ${{ vars.PROJECT_DOCKER_HOST }}
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Load Environment Variables
+        run: |
+          direnv allow .
+          direnv export gha > "$GITHUB_ENV"
+
+      - name: Build
+        env:
+          PROJECT_DOCKER_PLATFORMS: linux/amd64
+        run: |
+          task build
 
       - name: Test
         env:
-          PROJECT_DOCKER_PLATFORMS: ${{ matrix.platforms }}
+          PROJECT_DOCKER_PLATFORMS: linux/amd64
         run: |
-          make test
+          task test
 
   cd:
     name: CD
-    runs-on: ubuntu-22.04
-    needs: ci
+    runs-on: ubuntu-24.04-arm
+    needs: [ci-amd, ci-arm]
     if: ${{ startsWith(github.ref, 'refs/tags/v') }}
-    permissions:
-      attestations: write
-      contents: read
-      id-token: write
-      packages: write
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
 
       - name: Prepare
-        uses: schubergphilis/prepare-action@v1
+        uses: schubergphilis/prepare-action@68aa577339a0a7307c3c9c4d9141a9b632e1fff8  # v1.0.0
         with:
           type: container
           job: cd
 
+      - name: Load Environment Variables
+        run: |
+          direnv allow .
+          direnv export gha > "$GITHUB_ENV"
+
       - name: Login to GitHub Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121  # v4.1.0
         with:
           registry: ${{ vars.PROJECT_DOCKER_HOST }}
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Release
         run: |
-          make release
+          task release

.gitignore

@@ -24,4 +24,9 @@ Temporary Items
 # PROJECT
 #
 
-tmp/history/.bash_history
+tmp/
+!tmp/history/.gitkeep
+.env.local
+
+# sbp-skills manifest (machine-specific)
+.sbp/

.hadolint.yaml

@@ -2,6 +2,7 @@ ignored:
   - DL3008 # Pin versions in apt get install
   - DL3050 # Superfluous label(s) present
   - DL3059 # Multiple consecutive `RUN` instructions
+  - SC2155 # Declare and assign separately to avoid masking return values.
 failure-threshold: style
 format: tty
 strict-labels: true

.pre-commit-config.yaml

@@ -1,10 +1,24 @@
 repos:
   - repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: v4.6.0
+    rev: 3e8a8703264a2f4a69428a0aa4dcb512790b2c8c # v6.0.0
     hooks:
-      - id: check-added-large-files
-      - id: check-json
-      - id: check-toml
-      - id: check-yaml
-      - id: end-of-file-fixer
       - id: trailing-whitespace
+      - id: end-of-file-fixer
+      - id: check-added-large-files
+      - id: check-merge-conflict
+      - id: check-case-conflict
+      - id: check-illegal-windows-names
+      - id: check-symlinks
+      - id: destroyed-symlinks
+
+  - repo: https://github.com/gitleaks/gitleaks
+    rev: 83d9cd684c87d95d656c1458ef04895a7f1cbd8e # v8.30.1
+    hooks:
+      - id: gitleaks
+
+  - repo: https://github.com/compilerla/conventional-pre-commit
+    rev: 91ab4bf57e58b32adf1a122681f6ebe164d081c8 # v4.4.0
+    hooks:
+      - id: conventional-pre-commit
+        stages: [ commit-msg ]
+        args: []