Copier update: install pulumi CLI in devcontainer#106
Conversation
|
Caution Review failedPull request was closed or merged during review Warning Ignoring CodeRabbit configuration file changes. For security, only the configuration from the base branch is applied for open source repositories. 📝 WalkthroughWalkthroughThis pull request updates the Copier template from v0.0.102 to v0.0.109 and makes comprehensive updates across the repository: adds CI workflow enhancements for skip-duplicate checking and copier template validation, refactors git safe-directory configuration to use dynamic paths, introduces Pulumi CLI installation control, updates multiple tool and dependency versions, adds a new ECR authentication action, and expands agent and documentation guidelines. Changes
Estimated code review effort🎯 4 (Complex) | ⏱️ ~50 minutes Possibly related PRs
Suggested reviewers
🚥 Pre-merge checks | ✅ 1 | ❌ 2❌ Failed checks (2 warnings)
✅ Passed checks (1 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
Pull request overview
Pulls in upstream Copier template updates to improve devcontainer/CI ergonomics, including conditional Pulumi CLI installation and additional CI guardrails for template usage.
Changes:
- Bump template tooling/deps (Copier, pytest-cov, uv/pnpm, assorted frontend + GitHub Action versions).
- Add CI workflows/actions for skipping duplicate push runs and enforcing non-dev
_committemplate refs. - Adjust devcontainer scripts and dependency setup to support Pulumi CLI installation (with opt-out flags).
Reviewed changes
Copilot reviewed 34 out of 35 changed files in this pull request and generated 7 comments.
Show a summary per file
| File | Description |
|---|---|
| uv.lock | Bumps Copier and pytest-cov lock entries. |
| pyproject.toml | Updates Copier + pytest-cov dependency constraints. |
| extensions/context.py | Updates template context version pins (uv/pnpm/Copier/Pulumi/etc.). |
| AGENTS.md | Expands repository guidance (style/testing/tooling). |
| template/AGENTS.md | Mirrors AGENTS.md guidance for generated repos. |
| .devcontainer/Dockerfile | Updates devcontainer base image tag. |
| template/.devcontainer/Dockerfile | Updates template devcontainer base image tag. |
| .devcontainer/devcontainer.json | Adds host requirements + bumps editor extension versions + updates hash. |
| template/.devcontainer/devcontainer.json.jinja | Adds host requirements + bumps editor extension versions for generated repos. |
| .devcontainer/on-create-command.sh | Makes git safe.directory path dynamic based on script location. |
| .devcontainer/post-start-command.sh | Makes git safe.directory path dynamic based on script location. |
| template/.devcontainer/on-create-command.sh.jinja | Makes git safe.directory path dynamic for generated repos. |
| template/.devcontainer/post-start-command.sh.jinja | Makes git safe.directory path dynamic for generated repos. |
| .devcontainer/install-ci-tooling.py | Bumps UV/PNPM/Copier versions used in CI tooling bootstrap. |
| .devcontainer/manual-setup-deps.py | Adds optional Pulumi CLI install hook + skip flag. |
| template/.devcontainer/manual-setup-deps.py | Adds optional Pulumi CLI install hook + skip flag for generated repos. |
| .github/actions/install_deps/action.yml | Adds skip-installing-pulumi-cli input; bumps setup-node + configure-aws-credentials. |
| template/.github/actions/install_deps/action.yml | Same as root install_deps action for generated repos. |
| .github/actions/check-skip-duplicates/action.yml | New composite action to skip duplicate push CI runs when PR exists. |
| .github/workflows/ci.yaml | Adds pull_request trigger; introduces duplicate-skip job; adds confirm-on-tagged-template job; updates summary job gating. |
| template/.github/workflows/ci.yaml.jinja | Template version of CI workflow changes, including pulumi CLI skip and tagged-template confirmation. |
| .github/workflows/pre-commit.yaml | Skips Pulumi CLI install during pre-commit workflow runs. |
| template/.github/workflows/pre-commit.yaml | Skips Pulumi CLI install during template pre-commit runs. |
| template/.github/workflows/pulumi-aws.yml | Skips Pulumi CLI install in deps step (installed elsewhere for deploy action). |
| .github/workflows/confirm-on-tagged-copier-template.yaml | New reusable workflow enforcing _commit is a clean release tag. |
| template/.github/workflows/confirm-on-tagged-copier-template.yaml | Template version of the _commit release-tag enforcement workflow. |
| .github/reusable_workflows/build-docker-image.yaml | Adds full-image-tag output; refactors tagging/pull/push behavior; switches to local ecr-auth action. |
| template/.github/actions/ecr-auth/action.yml.jinja | New template composite action to assume role + login to ECR. |
| template/.github/actions/pulumi_ephemeral_deploy/action.yml | Bumps configure-aws-credentials version. |
| .github/workflows/tag-on-merge.yaml | Bumps checkout; switches tagging action to a Node 22-compatible fork. |
| .coderabbit.yaml | Adds instruction to not comment on _commit cleanliness (now enforced by CI). |
| template/.coderabbit.yaml | Same coderabbit instruction update for generated repos. |
| .copier-answers.yml | Updates _commit ref for upstream template source. |
| template/.claude/settings/permissions/bash.jsonc | Refines allowed/asked/denied GitHub CLI subcommands. |
| template/.claude/commands/green.md | Adds post-green coverage verification guidance. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| - name: OIDC Auth for ECR | ||
| if: ${{ inputs.push-role-name != 'no-push' }} | ||
| uses: aws-actions/configure-aws-credentials@v5.1.1 | ||
| uses: ./.github/actions/ecr-auth | ||
| with: | ||
| role-to-assume: arn:aws:iam::${{ steps.parse_ecr_url.outputs.aws_account_id }}:role/${{ inputs.push-role-name }} | ||
| role-arn: arn:aws:iam::${{ steps.parse_ecr_url.outputs.aws_account_id }}:role/${{ inputs.push-role-name }} | ||
| aws-region: ${{ steps.parse_ecr_url.outputs.aws_region }} |
There was a problem hiding this comment.
.github/actions/ecr-auth is referenced here, but that action directory/file does not exist in this repo (only check-skip-duplicates, install_deps, and update-devcontainer-hash are present). This reusable workflow will fail at runtime unless the ecr-auth composite action is added (or this step is changed back to a published action).
|
|
||
| permissions: | ||
| id-token: write # needed to assume OIDC roles (e.g. for downloading from CodeArtifact) | ||
| contents: read # need to explicitly provide this whenever defining permissions because the default value is 'none' for anything not explicitly set when permissions are defined |
There was a problem hiding this comment.
The check-skip-duplicates action calls gh pr list, which requires pull-requests: read permission. This workflow sets explicit permissions, so any permission not listed becomes none; without pull-requests: read, the gh pr list call will be unauthorized and the duplicate-skip check will not work (or may behave unpredictably). Add pull-requests: read at the workflow level or at least for the check-skip-duplicate job.
| contents: read # need to explicitly provide this whenever defining permissions because the default value is 'none' for anything not explicitly set when permissions are defined | |
| contents: read # need to explicitly provide this whenever defining permissions because the default value is 'none' for anything not explicitly set when permissions are defined | |
| pull-requests: read |
| _ = subprocess.run( | ||
| ["sh", str(REPO_ROOT_DIR / ".devcontainer" / "install-pulumi-cli.sh"), str(env.lock_file)], | ||
| check=True, | ||
| ) |
There was a problem hiding this comment.
This code invokes .devcontainer/install-pulumi-cli.sh, but that script is not present in .devcontainer/ in this repository. As written, dependency setup will fail on Linux whenever the lock file contains the Pulumi package. Either add the missing install-pulumi-cli.sh script (and ensure it’s executable) or remove/guard this call so it can’t trigger without the script.
| _ = subprocess.run( | |
| ["sh", str(REPO_ROOT_DIR / ".devcontainer" / "install-pulumi-cli.sh"), str(env.lock_file)], | |
| check=True, | |
| ) | |
| install_script = REPO_ROOT_DIR / ".devcontainer" / "install-pulumi-cli.sh" | |
| if install_script.exists(): | |
| _ = subprocess.run( | |
| ["sh", str(install_script), str(env.lock_file)], | |
| check=True, | |
| ) | |
| else: | |
| print( | |
| f"Skipping Pulumi CLI installation because '{install_script}' does not exist.", | |
| file=sys.stderr, | |
| ) |
| _ = subprocess.run( | ||
| ["sh", str(REPO_ROOT_DIR / ".devcontainer" / "install-pulumi-cli.sh"), str(env.lock_file)], | ||
| check=True, | ||
| ) |
There was a problem hiding this comment.
This code invokes .devcontainer/install-pulumi-cli.sh, but that script is not present in .devcontainer/ in this repository. Template instantiations (and/or local dev setup) will fail on Linux whenever the lock file contains the Pulumi package unless the script is added or this call is guarded.
| _ = subprocess.run( | |
| ["sh", str(REPO_ROOT_DIR / ".devcontainer" / "install-pulumi-cli.sh"), str(env.lock_file)], | |
| check=True, | |
| ) | |
| pulumi_install_script = REPO_ROOT_DIR / ".devcontainer" / "install-pulumi-cli.sh" | |
| if pulumi_install_script.exists(): | |
| _ = subprocess.run( | |
| ["sh", str(pulumi_install_script), str(env.lock_file)], | |
| check=True, | |
| ) |
| # Changes here will be overwritten by Copier | ||
| _commit: v0.0.102 | ||
| _commit: v0.0.108-8-g1f264ca | ||
| _src_path: gh:LabAutomationAndScreening/copier-base-template.git |
There was a problem hiding this comment.
This repo’s .copier-answers.yml now points _commit to a dev-style ref containing hyphens (v0.0.108-8-g...). With the newly added confirm-on-tagged-copier-template workflow, this will cause CI to fail. Update _commit to a clean release tag (no hyphens) before merging, or adjust the workflow logic if dev refs are intended to be allowed.
| COMMIT_LINE=$(grep "^_commit:" "$ANSWERS_FILE") | ||
| if echo "$COMMIT_LINE" | grep -q "-"; then | ||
| echo "Error: $COMMIT_LINE" | ||
| echo "_commit must be a clean release tag (e.g. v0.0.111), not a dev commit (e.g. v0.0.106-14-g7847d7b)" | ||
| exit 1 |
There was a problem hiding this comment.
If _commit: is missing from the answers file, COMMIT_LINE becomes empty and this check will currently pass. Consider explicitly failing when grep finds no _commit: line (or using grep -q with an explicit error path) so the workflow enforces the invariant reliably.
| COMMIT_LINE=$(grep "^_commit:" "$ANSWERS_FILE") | ||
| if echo "$COMMIT_LINE" | grep -q "-"; then | ||
| echo "Error: $COMMIT_LINE" | ||
| echo "_commit must be a clean release tag (e.g. v0.0.111), not a dev commit (e.g. v0.0.106-14-g7847d7b)" | ||
| exit 1 |
There was a problem hiding this comment.
If _commit: is missing from the answers file, COMMIT_LINE becomes empty and this check will currently pass. Consider explicitly failing when grep finds no _commit: line so the workflow enforces the invariant reliably for generated repos.
Pull in upstream template changes
Tested in ejfine/aws-central-infrastructure#99
Summary by CodeRabbit
Release Notes
Chores
Documentation