From 73e636fb4f05942f8ebe6e9d685715d5466bf885 Mon Sep 17 00:00:00 2001 From: Copilot <198982749+Copilot@users.noreply.github.com> Date: Fri, 7 Aug 2026 11:59:51 +0100 Subject: [PATCH 1/5] Support version pinning for terraform-docs in the Terraform feature (#1698) * Initial plan * Add terraformDocsVersion option to pin terraform-docs version --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> --- src/terraform/README.md | 1 + src/terraform/devcontainer-feature.json | 12 +++++++++++- src/terraform/install.sh | 2 +- .../install_terraform_docs_version.sh | 18 ++++++++++++++++++ test/terraform/scenarios.json | 9 +++++++++ 5 files changed, 40 insertions(+), 2 deletions(-) create mode 100644 test/terraform/install_terraform_docs_version.sh diff --git a/src/terraform/README.md b/src/terraform/README.md index 4b37b4260..8cfb673dc 100644 --- a/src/terraform/README.md +++ b/src/terraform/README.md @@ -21,6 +21,7 @@ Installs the Terraform CLI and optionally TFLint and Terragrunt. Auto-detects la | installSentinel | Install sentinel, a language and framework for policy built to be embedded in existing software to enable fine-grained, logic-based policy decisions | boolean | false | | installTFsec | Install tfsec, a tool to spot potential misconfigurations for your terraform code | boolean | false | | installTerraformDocs | Install terraform-docs, a utility to generate documentation from Terraform modules | boolean | false | +| terraformDocsVersion | terraform-docs version to install (only used when installTerraformDocs is true) (https://github.com/terraform-docs/terraform-docs/releases) | string | latest | | httpProxy | Connect to a keyserver using a proxy by configuring this option | string | - | | customDownloadServer | Custom server URL for downloading Terraform and Sentinel packages, including protocol (e.g., https://releases.hashicorp.com). If not provided, the default HashiCorp download server (https://releases.hashicorp.com) will be used. | string | - | diff --git a/src/terraform/devcontainer-feature.json b/src/terraform/devcontainer-feature.json index 29d3efb30..634d865ef 100644 --- a/src/terraform/devcontainer-feature.json +++ b/src/terraform/devcontainer-feature.json @@ -1,6 +1,6 @@ { "id": "terraform", - "version": "1.4.5", + "version": "1.5.0", "name": "Terraform, tflint, and TFGrunt", "documentationURL": "https://github.com/devcontainers/features/tree/main/src/terraform", "description": "Installs the Terraform CLI and optionally TFLint and Terragrunt. Auto-detects latest version and installs needed dependencies.", @@ -50,6 +50,16 @@ "default": false, "description": "Install terraform-docs, a utility to generate documentation from Terraform modules" }, + "terraformDocsVersion": { + "type": "string", + "proposals": [ + "latest", + "0.20.0", + "0.19.0" + ], + "default": "latest", + "description": "terraform-docs version to install (only used when installTerraformDocs is true) (https://github.com/terraform-docs/terraform-docs/releases)" + }, "httpProxy": { "type": "string", "default": "", diff --git a/src/terraform/install.sh b/src/terraform/install.sh index ef0c73e5d..43779f825 100755 --- a/src/terraform/install.sh +++ b/src/terraform/install.sh @@ -18,6 +18,7 @@ TERRAGRUNT_VERSION="${TERRAGRUNT:-"latest"}" INSTALL_SENTINEL=${INSTALLSENTINEL:-false} INSTALL_TFSEC=${INSTALLTFSEC:-false} INSTALL_TERRAFORM_DOCS=${INSTALLTERRAFORMDOCS:-false} +TERRAFORM_DOCS_VERSION="${TERRAFORMDOCSVERSION:-"latest"}" CUSTOM_DOWNLOAD_SERVER="${CUSTOMDOWNLOADSERVER:-""}" # This is because ubuntu noble, ubuntu resolute and debian trixie don't support the old format of GPG keys and validation NEW_GPG_CODENAMES="trixie noble resolute" @@ -641,7 +642,6 @@ install_terraform_docs() { } if [ "${INSTALL_TERRAFORM_DOCS}" = "true" ]; then - TERRAFORM_DOCS_VERSION="latest" terraform_docs_url='https://github.com/terraform-docs/terraform-docs' find_version_from_git_tags TERRAFORM_DOCS_VERSION $terraform_docs_url tfdocs_filename="terraform-docs-v${TERRAFORM_DOCS_VERSION}-linux-${architecture}.tar.gz" diff --git a/test/terraform/install_terraform_docs_version.sh b/test/terraform/install_terraform_docs_version.sh new file mode 100644 index 000000000..4a747f82e --- /dev/null +++ b/test/terraform/install_terraform_docs_version.sh @@ -0,0 +1,18 @@ +#!/bin/bash + +set -e + +# Import test library for `check` command +source dev-container-features-test-lib + +# Check to make sure the user is vscode +check "user is vscode" whoami | grep vscode + +# Terraform Docs specific tests +check "terraform-docs" terraform-docs --version + +# Verify the pinned version was installed +check "terraform-docs version is pinned to 0.20.0" bash -c "terraform-docs --version | grep 'v0.20.0'" + +# Report result +reportResults diff --git a/test/terraform/scenarios.json b/test/terraform/scenarios.json index 796efbd3e..de897b5e9 100644 --- a/test/terraform/scenarios.json +++ b/test/terraform/scenarios.json @@ -79,6 +79,15 @@ } } }, + "install_terraform_docs_version": { + "image": "mcr.microsoft.com/devcontainers/base:jammy", + "features": { + "terraform": { + "installTerraformDocs": true, + "terraformDocsVersion": "0.20.0" + } + } + }, "terraform_docs_fallback_test": { "image": "mcr.microsoft.com/devcontainers/base:jammy", "features": { From c6f2fbd033181b346af0cb039ad8219cd8e0f41c Mon Sep 17 00:00:00 2001 From: Kaniska Date: Fri, 7 Aug 2026 16:31:49 +0530 Subject: [PATCH 2/5] Use GitHub App token instead of PAT in update workflows (#1702) --- .../update-aws-cli-completer-scripts.yml | 18 ++++++++++++++---- .github/workflows/update-documentation.yml | 18 ++++++++++++++---- .../workflows/update-dotnet-install-script.yml | 18 ++++++++++++++---- 3 files changed, 42 insertions(+), 12 deletions(-) diff --git a/.github/workflows/update-aws-cli-completer-scripts.yml b/.github/workflows/update-aws-cli-completer-scripts.yml index fde3a29fc..ea6090fe9 100644 --- a/.github/workflows/update-aws-cli-completer-scripts.yml +++ b/.github/workflows/update-aws-cli-completer-scripts.yml @@ -9,10 +9,20 @@ jobs: runs-on: ubuntu-latest environment: documentation # grants access to secrets.PAT, for creating pull requests permissions: - contents: write - pull-requests: write + contents: read steps: - - uses: actions/checkout@v7 + - name: Generate a token + id: app-token + uses: actions/create-github-app-token@v2 + with: + app-id: ${{ vars.DEVCONTAINERS_REPO_AUTOMATION_ID }} + private-key: ${{ secrets.DEVCONTAINERS_REPO_AUTOMATION_PRIVATE_KEY }} + + - name: Checkout + id: checkout + uses: actions/checkout@v7 + with: + token: ${{ steps.app-token.outputs.token }} - name: Run fetch-latest-completer-scripts.sh run: src/aws-cli/scripts/fetch-latest-completer-scripts.sh @@ -20,7 +30,7 @@ jobs: - name: Create a PR for completer scripts id: push_image_info env: - GITHUB_TOKEN: ${{ secrets.PAT }} + GITHUB_TOKEN: ${{ steps.app-token.outputs.token }} run: | set -e echo "Start." diff --git a/.github/workflows/update-documentation.yml b/.github/workflows/update-documentation.yml index 50a643fd7..c766a6871 100644 --- a/.github/workflows/update-documentation.yml +++ b/.github/workflows/update-documentation.yml @@ -10,11 +10,21 @@ jobs: runs-on: ubuntu-latest environment: documentation permissions: - contents: write - pull-requests: write + contents: read if: "github.ref == 'refs/heads/main'" steps: - - uses: actions/checkout@v7 + - name: Generate a token + id: app-token + uses: actions/create-github-app-token@v2 + with: + app-id: ${{ vars.DEVCONTAINERS_REPO_AUTOMATION_ID }} + private-key: ${{ secrets.DEVCONTAINERS_REPO_AUTOMATION_PRIVATE_KEY }} + + - name: Checkout + id: checkout + uses: actions/checkout@v7 + with: + token: ${{ steps.app-token.outputs.token }} - name: Generate Documentation uses: devcontainers/action@v1 @@ -25,7 +35,7 @@ jobs: - name: Create a PR for Documentation id: push_image_info env: - GITHUB_TOKEN: ${{ secrets.PAT }} + GITHUB_TOKEN: ${{ steps.app-token.outputs.token }} run: | set -e echo "Start." diff --git a/.github/workflows/update-dotnet-install-script.yml b/.github/workflows/update-dotnet-install-script.yml index 16f737ff2..fd2161d27 100644 --- a/.github/workflows/update-dotnet-install-script.yml +++ b/.github/workflows/update-dotnet-install-script.yml @@ -9,10 +9,20 @@ jobs: runs-on: ubuntu-latest environment: documentation # grants access to secrets.PAT, for creating pull requests permissions: - contents: write - pull-requests: write + contents: read steps: - - uses: actions/checkout@v7 + - name: Generate a token + id: app-token + uses: actions/create-github-app-token@v2 + with: + app-id: ${{ vars.DEVCONTAINERS_REPO_AUTOMATION_ID }} + private-key: ${{ secrets.DEVCONTAINERS_REPO_AUTOMATION_PRIVATE_KEY }} + + - name: Checkout + id: checkout + uses: actions/checkout@v7 + with: + token: ${{ steps.app-token.outputs.token }} - name: Run fetch-latest-dotnet-install.sh run: src/dotnet/scripts/fetch-latest-dotnet-install.sh @@ -20,7 +30,7 @@ jobs: - name: Create a PR for dotnet-install.sh id: push_image_info env: - GITHUB_TOKEN: ${{ secrets.PAT }} + GITHUB_TOKEN: ${{ steps.app-token.outputs.token }} run: | set -e echo "Start." From 8b03a989e09c8a8f11e23145ab10de101baa3e1b Mon Sep 17 00:00:00 2001 From: Tyler Kropiewnicki Date: Wed, 19 Aug 2026 09:08:14 -0400 Subject: [PATCH 3/5] feat(github-cli): support private extension installs (#1705) Co-authored-by: Kaniska --- src/github-cli/NOTES.md | 4 +++- src/github-cli/devcontainer-feature.json | 2 +- src/github-cli/install.sh | 6 +++++- src/github-cli/scripts/install-extensions.sh | 18 ++++++++++++++++-- 4 files changed, 25 insertions(+), 5 deletions(-) diff --git a/src/github-cli/NOTES.md b/src/github-cli/NOTES.md index e742805e6..53c5322dd 100644 --- a/src/github-cli/NOTES.md +++ b/src/github-cli/NOTES.md @@ -6,4 +6,6 @@ This Feature should work on recent versions of Debian/Ubuntu-based distributions ## Extensions -If you set the `extensions` option, the feature will run `gh extension install` for each entry (comma-separated). Extensions are installed for the most appropriate non-root user (based on `USERNAME` / `_REMOTE_USER`), with a fallback to `root`. +If you set the `extensions` option, the feature will install each comma-separated entry. Extensions are installed for the most appropriate non-root user (based on `USERNAME` / `_REMOTE_USER`), with a fallback to `root`. + +Private extensions can be installed when `GH_TOKEN` or `GITHUB_TOKEN` is available during feature installation. The token is forwarded to the selected non-root user and used through the GitHub CLI Git credential helper. diff --git a/src/github-cli/devcontainer-feature.json b/src/github-cli/devcontainer-feature.json index 15a91e43d..58b3e5b2f 100644 --- a/src/github-cli/devcontainer-feature.json +++ b/src/github-cli/devcontainer-feature.json @@ -1,6 +1,6 @@ { "id": "github-cli", - "version": "1.1.0", + "version": "1.1.1", "name": "GitHub CLI", "documentationURL": "https://github.com/devcontainers/features/tree/main/src/github-cli", "description": "Installs the GitHub CLI. Auto-detects latest version and installs needed dependencies.", diff --git a/src/github-cli/install.sh b/src/github-cli/install.sh index e3eaba0c3..3638d9392 100755 --- a/src/github-cli/install.sh +++ b/src/github-cli/install.sh @@ -271,7 +271,11 @@ if [ -n "${EXTENSIONS}" ]; then else EXTENSIONS_ESCAPED="$(printf '%q' "${EXTENSIONS}")" USERNAME_ESCAPED="$(printf '%q' "${USERNAME}")" - su - "${USERNAME}" -c "EXTENSIONS=${EXTENSIONS_ESCAPED} USERNAME=${USERNAME_ESCAPED} INSTALL_EXTENSIONS=true bash '${EXTENSIONS_SCRIPT}'" + su \ + --login \ + --whitelist-environment=GH_TOKEN,GITHUB_TOKEN \ + --command "EXTENSIONS=${EXTENSIONS_ESCAPED} USERNAME=${USERNAME_ESCAPED} INSTALL_EXTENSIONS=true bash '${EXTENSIONS_SCRIPT}'" \ + "${USERNAME}" INSTALL_EXTENSIONS=false bash "${EXTENSIONS_SCRIPT}" fi fi diff --git a/src/github-cli/scripts/install-extensions.sh b/src/github-cli/scripts/install-extensions.sh index 436accf03..f8a893534 100644 --- a/src/github-cli/scripts/install-extensions.sh +++ b/src/github-cli/scripts/install-extensions.sh @@ -26,18 +26,32 @@ install_extension() { mkdir -p "${extensions_root}" if [ ! -d "${extensions_root}/${repo_name}" ]; then - git clone --depth 1 "https://github.com/${extension}.git" "${extensions_root}/${repo_name}" + git \ + -c credential.helper= \ + -c credential.helper='!gh auth git-credential' \ + clone --depth 1 "https://github.com/${extension}.git" "${extensions_root}/${repo_name}" fi } ensure_gh_extension_list_wrapper() { + local gh_config_dir + if [ "$(id -u)" -ne 0 ]; then return fi - if gh extension list >/dev/null 2>&1; then + gh_config_dir="$(mktemp -d)" + if env \ + -u GH_TOKEN \ + -u GITHUB_TOKEN \ + -u GH_ENTERPRISE_TOKEN \ + -u GITHUB_ENTERPRISE_TOKEN \ + GH_CONFIG_DIR="${gh_config_dir}" \ + gh extension list >/dev/null 2>&1; then + rm -rf "${gh_config_dir}" return fi + rm -rf "${gh_config_dir}" cat > /usr/local/bin/gh <<'EOF' #!/usr/bin/env bash From be75f4afe80de657343c8c4966e32e3e96935c93 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 21 Aug 2026 12:21:35 +0100 Subject: [PATCH 4/5] Bump actions/create-github-app-token from 2 to 3 (#1706) Bumps [actions/create-github-app-token](https://github.com/actions/create-github-app-token) from 2 to 3. - [Release notes](https://github.com/actions/create-github-app-token/releases) - [Changelog](https://github.com/actions/create-github-app-token/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/create-github-app-token/compare/v2...v3) --- updated-dependencies: - dependency-name: actions/create-github-app-token dependency-version: '3' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/update-aws-cli-completer-scripts.yml | 2 +- .github/workflows/update-documentation.yml | 2 +- .github/workflows/update-dotnet-install-script.yml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/update-aws-cli-completer-scripts.yml b/.github/workflows/update-aws-cli-completer-scripts.yml index ea6090fe9..eeec43475 100644 --- a/.github/workflows/update-aws-cli-completer-scripts.yml +++ b/.github/workflows/update-aws-cli-completer-scripts.yml @@ -13,7 +13,7 @@ jobs: steps: - name: Generate a token id: app-token - uses: actions/create-github-app-token@v2 + uses: actions/create-github-app-token@v3 with: app-id: ${{ vars.DEVCONTAINERS_REPO_AUTOMATION_ID }} private-key: ${{ secrets.DEVCONTAINERS_REPO_AUTOMATION_PRIVATE_KEY }} diff --git a/.github/workflows/update-documentation.yml b/.github/workflows/update-documentation.yml index c766a6871..e5023ccb3 100644 --- a/.github/workflows/update-documentation.yml +++ b/.github/workflows/update-documentation.yml @@ -15,7 +15,7 @@ jobs: steps: - name: Generate a token id: app-token - uses: actions/create-github-app-token@v2 + uses: actions/create-github-app-token@v3 with: app-id: ${{ vars.DEVCONTAINERS_REPO_AUTOMATION_ID }} private-key: ${{ secrets.DEVCONTAINERS_REPO_AUTOMATION_PRIVATE_KEY }} diff --git a/.github/workflows/update-dotnet-install-script.yml b/.github/workflows/update-dotnet-install-script.yml index fd2161d27..d8f532d9d 100644 --- a/.github/workflows/update-dotnet-install-script.yml +++ b/.github/workflows/update-dotnet-install-script.yml @@ -13,7 +13,7 @@ jobs: steps: - name: Generate a token id: app-token - uses: actions/create-github-app-token@v2 + uses: actions/create-github-app-token@v3 with: app-id: ${{ vars.DEVCONTAINERS_REPO_AUTOMATION_ID }} private-key: ${{ secrets.DEVCONTAINERS_REPO_AUTOMATION_PRIVATE_KEY }} From 23c5205d67278aa170e1bc70a115ad0d89dd584b Mon Sep 17 00:00:00 2001 From: Kaniska Date: Fri, 21 Aug 2026 16:51:53 +0530 Subject: [PATCH 5/5] Removing flaky tests which are not compatible configurations and not required henceforth (#1701) Removing flaky tests which are not compatible cases --- .github/workflows/test-all.yaml | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) diff --git a/.github/workflows/test-all.yaml b/.github/workflows/test-all.yaml index dd1d216a0..3d4aa3fed 100644 --- a/.github/workflows/test-all.yaml +++ b/.github/workflows/test-all.yaml @@ -50,6 +50,19 @@ jobs: "mcr.microsoft.com/devcontainers/base:debian", "mcr.microsoft.com/devcontainers/base:noble" ] + exclude: + - features: oryx + baseImage: ubuntu:jammy + - features: oryx + baseImage: mcr.microsoft.com/devcontainers/base:ubuntu + - features: docker-in-docker + baseImage: mcr.microsoft.com/devcontainers/base:debian + - features: docker-outside-of-docker + baseImage: mcr.microsoft.com/devcontainers/base:debian + - features: docker-in-docker + baseImage: mcr.microsoft.com/devcontainers/base:ubuntu + - features: docker-outside-of-docker + baseImage: mcr.microsoft.com/devcontainers/base:ubuntu steps: - uses: actions/checkout@v7 @@ -100,6 +113,15 @@ jobs: - name: "Install latest devcontainer CLI" run: npm install -g @devcontainers/cli + - name: "Exclude iptables-isolation scenarios from docker-in-docker (run in separate 'iptables-isolation' job)" + if: matrix.features == 'docker-in-docker' + run: | + sudo apt-get update && sudo apt-get install -y jq + sed 's://.*$::' test/docker-in-docker/scenarios.json \ + | jq 'del(.docker_with_default_iptables, .docker_with_default_iptables_ubuntu)' \ + > test/docker-in-docker/scenarios.json.tmp + mv test/docker-in-docker/scenarios.json.tmp test/docker-in-docker/scenarios.json + - name: "Testing '${{ matrix.features }}' scenarios" run: devcontainer features test -f ${{ matrix.features }} --skip-autogenerated .