Skip to content

Feature/continue fix - #13

Merged
DevNiall merged 9 commits into
mainfrom
feature/continue-fix
Nov 23, 2025
Merged

Feature/continue fix#13
DevNiall merged 9 commits into
mainfrom
feature/continue-fix

Conversation

@DevNiall

Copy link
Copy Markdown
Contributor

This pull request makes several updates to the development container configuration to improve compatibility and streamline the environment. The most significant changes are the removal (by commenting out) of R language and Quarto CLI features from the devcontainer setup, and the explicit targeting of the linux/amd64 platform in both the Dockerfile and GitHub Actions workflow.

Devcontainer configuration changes:

  • Commented out the R language (r-apt) and Quarto CLI features in .devcontainer/devcontainer.json, removing their installation and related configuration. This simplifies the devcontainer and avoids installing unnecessary tools.

Platform compatibility updates:

  • Updated the base image declaration in Dockerfile to explicitly target the linux/amd64 platform, improving architecture consistency.
  • Added the platform: linux/amd64 specification to the devcontainers/ci job in .github/workflows/build-devcontainer.yml, ensuring builds run on the intended architecture.

@github-actions

Copy link
Copy Markdown

🔒 Trivy Security Scan Results

Status: ⚠️ Vulnerabilities found (see details in artifacts)
Vulnerabilities Found: 22 critical/high severity issues

⚠️ Action Required: Critical or high severity vulnerabilities detected.

Top 10 Critical/High Severity Vulnerabilities:

Type Package Vulnerability Severity Fixed Version
python-pkg Twisted CVE-2022-24801 CRITICAL 22.4.0
node-pkg glob CVE-2025-64756 HIGH 11.1.0, 10.5.0
node-pkg glob CVE-2025-64756 HIGH 11.1.0, 10.5.0
node-pkg glob CVE-2025-64756 HIGH 11.1.0, 10.5.0
node-pkg grunt CVE-2020-7729 HIGH 1.3.0
node-pkg grunt CVE-2022-1537 HIGH 1.5.3
node-pkg npm CVE-2018-7408 HIGH 5.7.1
node-pkg npm CVE-2019-16775 HIGH 6.13.3
node-pkg npm CVE-2019-16776 HIGH 6.13.3
node-pkg npm CVE-2019-16777 HIGH 6.13.4

📊 Scan Details

  • Image: ghcr.io/smartdatafoundry/devcontainer
  • Scan Date: 2025-11-21 16:37:28 UTC
  • Total Vulnerabilities: 22

Action Run: view run
Trivy Report: view report

@github-actions

Copy link
Copy Markdown

🔒 Trivy Security Scan Results

Status: ⚠️ Vulnerabilities found (see details in artifacts)
Vulnerabilities Found: 22 critical/high severity issues

⚠️ Action Required: Critical or high severity vulnerabilities detected.

Top 10 Critical/High Severity Vulnerabilities:

Type Package Vulnerability Severity Fixed Version
python-pkg Twisted CVE-2022-24801 CRITICAL 22.4.0
node-pkg glob CVE-2025-64756 HIGH 11.1.0, 10.5.0
node-pkg glob CVE-2025-64756 HIGH 11.1.0, 10.5.0
node-pkg glob CVE-2025-64756 HIGH 11.1.0, 10.5.0
node-pkg grunt CVE-2020-7729 HIGH 1.3.0
node-pkg grunt CVE-2022-1537 HIGH 1.5.3
node-pkg npm CVE-2018-7408 HIGH 5.7.1
node-pkg npm CVE-2019-16775 HIGH 6.13.3
node-pkg npm CVE-2019-16776 HIGH 6.13.3
node-pkg npm CVE-2019-16777 HIGH 6.13.4

📊 Scan Details

  • Image: ghcr.io/smartdatafoundry/devcontainer
  • Scan Date: 2025-11-21 17:08:51 UTC
  • Total Vulnerabilities: 22

Action Run: view run
Trivy Report: view report

@github-actions

Copy link
Copy Markdown

🔒 Trivy Security Scan Results

Status: ⚠️ Vulnerabilities found (see details in artifacts)
Vulnerabilities Found: 22 critical/high severity issues

⚠️ Action Required: Critical or high severity vulnerabilities detected.

Top 10 Critical/High Severity Vulnerabilities:

Type Package Vulnerability Severity Fixed Version
python-pkg Twisted CVE-2022-24801 CRITICAL 22.4.0
node-pkg glob CVE-2025-64756 HIGH 11.1.0, 10.5.0
node-pkg glob CVE-2025-64756 HIGH 11.1.0, 10.5.0
node-pkg glob CVE-2025-64756 HIGH 11.1.0, 10.5.0
node-pkg grunt CVE-2020-7729 HIGH 1.3.0
node-pkg grunt CVE-2022-1537 HIGH 1.5.3
node-pkg npm CVE-2018-7408 HIGH 5.7.1
node-pkg npm CVE-2019-16775 HIGH 6.13.3
node-pkg npm CVE-2019-16776 HIGH 6.13.3
node-pkg npm CVE-2019-16777 HIGH 6.13.4

📊 Scan Details

  • Image: ghcr.io/smartdatafoundry/devcontainer
  • Scan Date: 2025-11-21 17:24:57 UTC
  • Total Vulnerabilities: 22

Action Run: view run
Trivy Report: view report

@github-actions

Copy link
Copy Markdown

🔒 Trivy Security Scan Results

Status: ⚠️ Vulnerabilities found (see details in artifacts)
Vulnerabilities Found: 22 critical/high severity issues

⚠️ Action Required: Critical or high severity vulnerabilities detected.

Top 10 Critical/High Severity Vulnerabilities:

Type Package Vulnerability Severity Fixed Version
python-pkg Twisted CVE-2022-24801 CRITICAL 22.4.0
node-pkg glob CVE-2025-64756 HIGH 11.1.0, 10.5.0
node-pkg glob CVE-2025-64756 HIGH 11.1.0, 10.5.0
node-pkg glob CVE-2025-64756 HIGH 11.1.0, 10.5.0
node-pkg grunt CVE-2020-7729 HIGH 1.3.0
node-pkg grunt CVE-2022-1537 HIGH 1.5.3
node-pkg npm CVE-2018-7408 HIGH 5.7.1
node-pkg npm CVE-2019-16775 HIGH 6.13.3
node-pkg npm CVE-2019-16776 HIGH 6.13.3
node-pkg npm CVE-2019-16777 HIGH 6.13.4

📊 Scan Details

  • Image: ghcr.io/smartdatafoundry/devcontainer
  • Scan Date: 2025-11-21 19:16:53 UTC
  • Total Vulnerabilities: 22

Action Run: view run
Trivy Report: view report

- Rename continue configuration from "Local Assistant" to "Local Config"
- Update API URLs and keys in continue.env for OpenAI integration
- Add qwen-settings.json for Qwen model configuration
- Include qwenlm.qwen-code-vscode-ide-companion in extensions-to-install.txt
- Modify Dockerfile to copy Qwen settings into the container
- Update README and documentation for script paths and usage
- Enhance devcontainerctl script with update and restart functionalities
@github-actions

Copy link
Copy Markdown

🔒 Trivy Security Scan Results

Status: ⚠️ Vulnerabilities found (see details in artifacts)
Vulnerabilities Found: 22 critical/high severity issues

⚠️ Action Required: Critical or high severity vulnerabilities detected.

Top 10 Critical/High Severity Vulnerabilities:

Type Package Vulnerability Severity Fixed Version
python-pkg Twisted CVE-2022-24801 CRITICAL 22.4.0
node-pkg glob CVE-2025-64756 HIGH 11.1.0, 10.5.0
node-pkg glob CVE-2025-64756 HIGH 11.1.0, 10.5.0
node-pkg glob CVE-2025-64756 HIGH 11.1.0, 10.5.0
node-pkg grunt CVE-2020-7729 HIGH 1.3.0
node-pkg grunt CVE-2022-1537 HIGH 1.5.3
node-pkg npm CVE-2018-7408 HIGH 5.7.1
node-pkg npm CVE-2019-16775 HIGH 6.13.3
node-pkg npm CVE-2019-16776 HIGH 6.13.3
node-pkg npm CVE-2019-16777 HIGH 6.13.4

📊 Scan Details

  • Image: ghcr.io/smartdatafoundry/devcontainer
  • Scan Date: 2025-11-23 00:58:42 UTC
  • Total Vulnerabilities: 22

Action Run: view run
Trivy Report: view report

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This pull request updates the development container configuration to improve platform compatibility and refine the tooling setup. The changes include explicit platform targeting for linux/amd64, commenting out R and Quarto features, updating configuration paths, and integrating new AI coding assistant tools (Qwen and Continue).

  • Standardized platform architecture to linux/amd64 across Dockerfile and GitHub Actions workflow
  • Disabled R language and Quarto CLI features to streamline the container
  • Updated script paths from /workspace/scripts to /opt/scripts for better organization
  • Integrated Qwen and Continue AI assistant configurations with local LLM endpoint support

Reviewed changes

Copilot reviewed 13 out of 13 changed files in this pull request and generated 9 comments.

Show a summary per file
File Description
Dockerfile Added explicit linux/amd64 platform specification and new Qwen settings file copy
.github/workflows/build-devcontainer.yml Added platform specification to ensure consistent amd64 builds
.devcontainer/devcontainer.json Commented out R and Quarto features, added Qwen npm package
.devcontainer/qwen-settings.json New configuration file for Qwen AI assistant with local API endpoint
.devcontainer/continue-config.yaml Simplified Continue AI assistant configuration with Qwen model integration
.devcontainer/continue.env Updated environment variables from OpenWebUI to OpenAI-compatible naming
.devcontainer/vscode-init/extensions-to-install.txt Added Qwen extension, enabled Continue pre-release, uncommented marimo extension
.devcontainer/vscode-init/extensions-to-download.txt Added Qwen extension to download list
.devcontainer/vscode-init/02-download-extensions.sh Updated download directory path and improved extension download URL resolution
scripts/devcontainerctl Removed automatic image pulling from start, removed proxy env flag, added dedicated restart function, updated usage documentation
docs/SDF_TRE_SETUP.md Updated script paths to /opt/scripts, standardized proxy variables to lowercase, clarified cron job behavior
docs/DEVCONTAINER.md Updated script paths and usage examples to reflect new command behavior
README.md Updated script paths, clarified cron job timing, added VS Code commit default value

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread .devcontainer/continue.env Outdated
Comment thread .devcontainer/qwen-settings.json
Comment on lines 17 to 18
REditorSupport.r
REditorSupport.r-syntax

Copilot AI Nov 23, 2025

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

R-related VS Code extensions are still configured for installation (lines 17-18) even though the R language support feature has been commented out (lines 36-44). The extensions REditorSupport.r and REditorSupport.r-syntax will be installed but may not function properly without the underlying R language support. Consider either:

  1. Commenting out these R extensions as well, or
  2. Uncommenting the R language support feature if R functionality is still needed
Suggested change
REditorSupport.r
REditorSupport.r-syntax
# REditorSupport.r
# REditorSupport.r-syntax

Copilot uses AI. Check for mistakes.
Comment thread README.md Outdated
Comment on lines +49 to 50
| jq -r '.versions[] | select(.targetPlatform == "linux-x64" or .targetPlatform == null) | select(.flags | contains("prerelease") | not) | .files[] | select(.assetType == "Microsoft.VisualStudio.Services.VSIXPackage") | .source' | head -n1)"

Copilot AI Nov 23, 2025

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The download URL construction logic may fail or produce incorrect URLs. The jq command filters for non-prerelease versions (select(.flags | contains("prerelease") | not)), but the flags field may not always be a string or array that supports the contains() function. Additionally, if no matching version is found, download_url will be empty, leading to a curl failure without a clear error message.

Consider adding validation to check if download_url is non-empty before proceeding with the download, and handle the case where the jq filter returns no results more gracefully.

Suggested change
| jq -r '.versions[] | select(.targetPlatform == "linux-x64" or .targetPlatform == null) | select(.flags | contains("prerelease") | not) | .files[] | select(.assetType == "Microsoft.VisualStudio.Services.VSIXPackage") | .source' | head -n1)"
| jq -r '.versions[] | select(.targetPlatform == "linux-x64" or .targetPlatform == null) | select((has("flags") and (.flags | type == "string" or type == "array") and (.flags | contains("prerelease") | not)) or (has("flags") | not)) | .files[] | select(.assetType == "Microsoft.VisualStudio.Services.VSIXPackage") | .source' | head -n1)"
if [[ -z "${download_url}" ]]; then
echo " ✗ No suitable version found for ${extension_id} (no download URL)"
exit 1
fi

Copilot uses AI. Check for mistakes.
eamodio.gitlens
# The marimo extension has been removed from the marketplace whilst it is being rewritten.
# marimo-team.vscode-marimo
marimo-team.vscode-marimo

Copilot AI Nov 23, 2025

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The marimo extension is being installed on line 9 despite the comment on line 8 stating that "The marimo extension has been removed from the marketplace whilst it is being rewritten." This inconsistency suggests that either the extension has been re-added to the marketplace (in which case the comment should be updated or removed), or the extension should remain commented out.

Suggested change
marimo-team.vscode-marimo
# marimo-team.vscode-marimo

Copilot uses AI. Check for mistakes.
Comment thread scripts/devcontainerctl
Comment thread .devcontainer/qwen-settings.json Outdated
Comment thread docs/DEVCONTAINER.md Outdated
DevNiall and others added 2 commits November 23, 2025 01:06
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
@github-actions

Copy link
Copy Markdown

🔒 Trivy Security Scan Results

Status: ⚠️ Vulnerabilities found (see details in artifacts)
Vulnerabilities Found: 22 critical/high severity issues

⚠️ Action Required: Critical or high severity vulnerabilities detected.

Top 10 Critical/High Severity Vulnerabilities:

Type Package Vulnerability Severity Fixed Version
python-pkg Twisted CVE-2022-24801 CRITICAL 22.4.0
node-pkg glob CVE-2025-64756 HIGH 11.1.0, 10.5.0
node-pkg glob CVE-2025-64756 HIGH 11.1.0, 10.5.0
node-pkg glob CVE-2025-64756 HIGH 11.1.0, 10.5.0
node-pkg grunt CVE-2020-7729 HIGH 1.3.0
node-pkg grunt CVE-2022-1537 HIGH 1.5.3
node-pkg npm CVE-2018-7408 HIGH 5.7.1
node-pkg npm CVE-2019-16775 HIGH 6.13.3
node-pkg npm CVE-2019-16776 HIGH 6.13.3
node-pkg npm CVE-2019-16777 HIGH 6.13.4

📊 Scan Details

  • Image: ghcr.io/smartdatafoundry/devcontainer
  • Scan Date: 2025-11-23 01:16:39 UTC
  • Total Vulnerabilities: 22

Action Run: view run
Trivy Report: view report

@DevNiall
DevNiall merged commit 45999b1 into main Nov 23, 2025
1 check passed
@DevNiall
DevNiall deleted the feature/continue-fix branch November 23, 2025 01:20
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants