Chore: [AEA-0000] - Use common dev container by anthony-nhs · Pull Request #65 · NHSDigital/eps-devcontainers

anthony-nhs · 2026-03-23T08:44:00Z

Summary

Routine Change

Details

use common dev container

github-actions · 2026-03-23T08:44:13Z

This PR is linked to a ticket in an NHS Digital JIRA Project. Here's a handy link to the ticket:

AEA-0000

Copilot

Pull request overview

This PR migrates the repository to use the shared “eps common” devcontainer approach, simplifying CI by pulling config (including pinned devcontainer images) from a reusable workflow and removing the repo-level asdf version file.

Changes:

Switch CI/pull request/release workflows to get-repo-config + *-devcontainer reusable workflows and pass pinned_image.
Update devcontainer to build FROM a published ghcr.io/nhsdigital/eps-devcontainers/... image and simplify post-attach setup.
Remove root .tool-versions.asdf, bump asdf version in the base devcontainer config, and add a bootstrap .tool-versions file for fallback builds.

Reviewed changes

Copilot reviewed 8 out of 9 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
src/base/.devcontainer/.tool-versions.asdf	Bumps asdf version used by base devcontainer scripts.
.tool-versions.asdf	Removes repo-level asdf version file (no longer used by workflows).
.github/workflows/release.yml	Uses common reusable workflows and consumes `pinned_image`/`tag_format`.
.github/workflows/pull_request.yml	Uses common reusable workflows for PR quality checks with `pinned_image`.
.github/workflows/ci.yml	Uses common reusable workflows; adds permissions for tag workflow.
.devcontainer/devcontainer.json	Updates build args and post-attach behavior to match the common devcontainer image approach.
.devcontainer/Dockerfile.bootstrap	Adds a bootstrap build for when published images aren’t available.
.devcontainer/Dockerfile	Changes devcontainer build to extend from a published eps-devcontainers image and optionally remap docker group GID.
.devcontainer/.tool-versions.bootstrap	Adds tool versions used by the bootstrap Dockerfile.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-03-23T08:48:48Z

.devcontainer/Dockerfile

+FROM ghcr.io/nhsdigital/eps-devcontainers/${IMAGE_NAME}:${IMAGE_VERSION}
+
+USER root
+# specify DOCKER_GID to force container docker group id to match host
+RUN if [ -n "${DOCKER_GID}" ]; then \
+  if ! getent group docker; then \
+  groupadd -g ${DOCKER_GID} docker; \
+  else \
+  groupmod -g ${DOCKER_GID} docker; \


DOCKER_GID is used in the RUN block but isn't declared as a build arg (ARG DOCKER_GID) anywhere in this Dockerfile, so the value passed from devcontainer.json won't be available and the docker group remap will never run. Declare ARG DOCKER_GID (and ideally validate it’s a numeric GID and quote the variable when passing it to groupadd/groupmod) before this RUN instruction.

Suggested change

FROM ghcr.io/nhsdigital/eps-devcontainers/${IMAGE_NAME}:${IMAGE_VERSION}

USER root

# specify DOCKER_GID to force container docker group id to match host

RUN if [ -n "${DOCKER_GID}" ]; then \

if ! getent group docker; then \

groupadd -g ${DOCKER_GID} docker; \

else \

groupmod -g ${DOCKER_GID} docker; \

ARG DOCKER_GID

FROM ghcr.io/nhsdigital/eps-devcontainers/${IMAGE_NAME}:${IMAGE_VERSION}

USER root

# specify DOCKER_GID to force container docker group id to match host

RUN if [ -n "${DOCKER_GID}" ]; then \

if ! printf '%s\n' "${DOCKER_GID}" | grep -Eq '^[0-9]+$'; then \

echo "Invalid DOCKER_GID: ${DOCKER_GID} (must be a numeric GID)" >&2; \

exit 1; \

fi; \

if ! getent group docker >/dev/null; then \

groupadd -g "${DOCKER_GID}" docker; \

else \

groupmod -g "${DOCKER_GID}" docker; \

Copilot · 2026-03-23T08:48:49Z

.devcontainer/devcontainer.json

        },
        "eslint.useFlatConfig": true,
        "eslint.format.enable": true
      }


eslint.useFlatConfig and eslint.format.enable are currently defined as siblings of settings, not inside the settings object. Devcontainer VS Code settings are only picked up from customizations.vscode.settings, so these values likely won’t apply unless they’re moved under settings.

Copilot · 2026-03-23T08:48:49Z

.devcontainer/devcontainer.json

+      "DOCKER_GID": "${env:DOCKER_GID:}",
+      "IMAGE_NAME": "node_24_python_3_14",
+      "IMAGE_VERSION": "latest",
+      "USER_UID": "${localEnv:USER_ID:}",
+      "USER_GID": "${localEnv:GROUP_ID:}"


The build arg for DOCKER_GID is sourced from ${env:DOCKER_GID:} while other host-derived values use ${localEnv:...}. For a host Docker group mapping, this should likely be ${localEnv:DOCKER_GID:}; otherwise it will typically resolve empty at build time. Also, USER_UID/USER_GID are being passed but the current .devcontainer/Dockerfile doesn’t declare/use them, which can be confusing unless the image build is updated to apply them.

Suggested change

"DOCKER_GID": "${env:DOCKER_GID:}",

"IMAGE_NAME": "node_24_python_3_14",

"IMAGE_VERSION": "latest",

"USER_UID": "${localEnv:USER_ID:}",

"USER_GID": "${localEnv:GROUP_ID:}"

"DOCKER_GID": "${localEnv:DOCKER_GID:}",

"IMAGE_NAME": "node_24_python_3_14",

"IMAGE_VERSION": "latest"

Copilot · 2026-03-23T08:48:49Z

.github/workflows/release.yml

  tag_release:
-    needs: [quality_checks, get_asdf_version]
-    uses: NHSDigital/eps-common-workflows/.github/workflows/tag-release.yml@5ac2707dd9cd60ad127275179495b9c890d74711
+    needs: [quality_checks, get_config_values]
+    uses: NHSDigital/eps-common-workflows/.github/workflows/tag-release-devcontainer.yml@5ac2707dd9cd60ad127275179495b9c890d74711
    with:
      dry_run: false
-      asdfVersion: ${{ needs.get_asdf_version.outputs.asdf_version }}
+      pinned_image: ${{ needs.get_config_values.outputs.pinned_image }}
      branch_name: main
-      tag_format: ${{ needs.get_asdf_version.outputs.tag_format }}
+      tag_format: ${{ needs.get_config_values.outputs.tag_format }}
    secrets: inherit


tag_release in this workflow calls the same reusable workflow as ci.yml, but unlike ci.yml it doesn't grant contents: write (and potentially id-token: write) permissions. If the reusable workflow needs these to create tags/releases or use OIDC, this run will fail; consider mirroring the permissions block from .github/workflows/ci.yml here.

anthony-nhs added 14 commits March 21, 2026 10:34

Verify trivy installation

e2f228d

update script location

ddbe311

Merge remote-tracking branch 'origin/main' into verify_trivy

d0be713

copilot suggestions

fa65932

install trivy from arch

890ce6c

use date for dockerfile

906f8a0

use alpine

3a69e97

fix path

3f0575b

fix local dockerfile

6af21f1

update copilot

b471edb

more comments

1a64425

use common dev container

9c160c3

Merge remote-tracking branch 'origin/main' into common_dev_container

9c520a0

use common devcontainer

0700205

Copilot AI review requested due to automatic review settings March 23, 2026 08:44

Copilot started reviewing on behalf of anthony-nhs March 23, 2026 08:44 View session

Copilot AI reviewed Mar 23, 2026

View reviewed changes

anthony-nhs added 3 commits March 23, 2026 08:58

fix makefile

03c9bcd

fix install

f175aaa

add permissions

5eecb7b

anthony-nhs merged commit 25fb477 into main Mar 23, 2026
4 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Chore: [AEA-0000] - Use common dev container#65

Chore: [AEA-0000] - Use common dev container#65
anthony-nhs merged 17 commits intomainfrom
common_dev_container

anthony-nhs commented Mar 23, 2026

Uh oh!

github-actions bot commented Mar 23, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Mar 23, 2026

Uh oh!

Copilot AI Mar 23, 2026

Uh oh!

Copilot AI Mar 23, 2026

Uh oh!

Copilot AI Mar 23, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

anthony-nhs commented Mar 23, 2026

Summary

Details

Uh oh!

github-actions bot commented Mar 23, 2026

AEA-0000

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Mar 23, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 23, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 23, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 23, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants