From 62aede1dca6078c166b6c5b4225866be2a62d8fe Mon Sep 17 00:00:00 2001
From: "devsy-app[bot]" <277138668+devsy-app[bot]@users.noreply.github.com>
Date: Sat, 15 Aug 2026 12:19:11 +0000
Subject: [PATCH 1/2] ci: enforce devcontainer lockfile integrity
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

## Spec requirement

The devcontainer spec/reference CLI (`@devcontainers/cli`) supports a committed
`devcontainer-lock.json` to pin feature digests for reproducible builds, and exposes
`--frozen-lockfile` to *enforce* an existing lockfile: the build fails if the lockfile
is missing or its resolved digests no longer match the features declared in
`devcontainer.json` (lock drift).

## Gap found

The repo commits `.devcontainer/devcontainer-lock.json` (4 pinned features: go-task,
prek, uv, node) for reproducibility, but the `Devcontainer` workflow
(`.github/workflows/devcontainer.yml`) only builds + runs the devcontainer via
`devcontainers/ci`. It never verifies the committed lockfile, so a stale/incorrect
lockfile would pass CI silently. The reference `devcontainers/ci` action exposes no
frozen-lockfile input, so enforcement must be a dedicated step.

## Change

Add a `Verify feature lockfile integrity` step to the `Devcontainer` workflow that:

1. Installs `@devcontainers/cli`.
2. Runs `devcontainer build --workspace-folder . --image-name devsy-lock-verify:tmp --frozen-lockfile`.

If the committed lockfile is out of sync with the declared features, the frozen build
fails and the job goes red. No feature versions are bumped; no SHA is changed. The
existing `devcontainers/ci` build/run step is unchanged.

## Verification performed

- `task cli:format` — clean (no Go changes).
- `task cli:lint:ci` — 0 new issues (`--new-from-patch`).
- `task cli:test` — pass; only the documented pre-existing `pkg/git` (`TestRepoClone*`)
  failure on origin/main, unrelated to this change (workflow YAML only).
- `task cli:test:e2e:suite -- "devcontainer"` — pass (0 devcontainer-labelled specs, no failures).
- **Positive control**: `devcontainer build --workspace-folder . --image-name dc-lock-verify:tmp --frozen-lockfile`
  against the current committed lockfile → `{"outcome":"success"}`, exit 0.
- **Negative control**: corrupting the `uv` feature digest in the lockfile and rerunning
  the frozen build → exit 1 (`could not be processed`), confirming the step catches drift.
  The lockfile was restored to its committed state afterward (no diff).

## Expected impact

Lock drift introduced by a feature version bump without `devcontainer-lock.json`
regeneration is now caught in CI before merge, keeping reproducible devcontainer builds
trustworthy.

This PR was created by an AI agent as part of an automated daily devcontainer spec job.
---
 .github/workflows/devcontainer.yml | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/.github/workflows/devcontainer.yml b/.github/workflows/devcontainer.yml
index 9d196c399..b4ee7822c 100644
--- a/.github/workflows/devcontainer.yml
+++ b/.github/workflows/devcontainer.yml
@@ -35,6 +35,13 @@ jobs:
         with:
           node-version: "latest"
 
+      # A frozen-lockfile build fails if devcontainer-lock.json is missing or
+      # out of sync with the declared features, catching lock drift in CI.
+      - name: Verify feature lockfile integrity
+        run: |
+          npm install -g @devcontainers/cli@latest
+          devcontainer build --workspace-folder . --image-name devsy-lock-verify:tmp --frozen-lockfile
+
       - uses: devcontainers/ci@513af61f4de4f75d37e4438f184ba4358f0fc1ca # v0.3
         with:
           runCmd: ${{ inputs.runCmd || env.DEFAULT_RUN_CMD }}

From cdac21bca6effd5c2b2d83cf93e429ff7a81b01d Mon Sep 17 00:00:00 2001
From: Samuel K <skevetter@pm.me>
Date: Sun, 16 Aug 2026 00:28:16 -0500
Subject: [PATCH 2/2] style: clean comment

---
 .github/workflows/devcontainer.yml | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/.github/workflows/devcontainer.yml b/.github/workflows/devcontainer.yml
index b4ee7822c..4d113123f 100644
--- a/.github/workflows/devcontainer.yml
+++ b/.github/workflows/devcontainer.yml
@@ -35,9 +35,7 @@ jobs:
         with:
           node-version: "latest"
 
-      # A frozen-lockfile build fails if devcontainer-lock.json is missing or
-      # out of sync with the declared features, catching lock drift in CI.
-      - name: Verify feature lockfile integrity
+      - name: verify feature lockfile integrity
         run: |
           npm install -g @devcontainers/cli@latest
           devcontainer build --workspace-folder . --image-name devsy-lock-verify:tmp --frozen-lockfile