Skip to content

Feature/workflow inputs - #4

Merged
DevNiall merged 15 commits into
mainfrom
feature/workflow-inputs
Sep 30, 2025
Merged

Feature/workflow inputs#4
DevNiall merged 15 commits into
mainfrom
feature/workflow-inputs

Conversation

@DevNiall

@DevNiall DevNiall commented Sep 26, 2025

Copy link
Copy Markdown
Contributor

This pull request introduces improvements to the dev container's reproducibility, documentation, and workflow flexibility. The key changes focus on making VS Code Server versioning explicit and overridable, updating documentation to reflect first-class R support, and enhancing the build workflow to support manual version pinning and more robust tagging.

Dev Container Versioning & Build Workflow

  • Added a default VSCODE_COMMIT value directly in .devcontainer/Dockerfile, making the VS Code Server version explicit and overridable via build args. (.devcontainer/Dockerfile)
  • Updated the GitHub Actions workflow to allow manual dispatch with a vscode_commit input, and improved logic to resolve the VS Code Server commit hash from either workflow input or Dockerfile default, including validation and output of the source. (.github/workflows/build-devcontainer.yml) [1] [2] [3] [4]

Documentation & Tagging Strategy

  • Revised documentation in README.md and DEVCONTAINER.md to clarify tag families, reproducibility, and the process for pinning VS Code Server versions; also highlighted first-class R support and updated extension management instructions. (README.md, DEVCONTAINER.md) [1] [2] [3] [4] [5] [6] [7] [8] [9] [10]
  • Updated SDF_TRE_SETUP.md to clarify VS Code Server extension extraction and version management, reflecting the new workflow and Dockerfile behavior. (SDF_TRE_SETUP.md) [1] [2] [3]

Configuration Flexibility

  • Changed .devcontainer/devcontainer.json to use the local environment variable for VSCODE_COMMIT, supporting local overrides and reproducible builds. (.devcontainer/devcontainer.json)

These changes make it easier to reproduce development environments, pin VS Code Server versions for compatibility, and maintain clear documentation for users and contributors.

@github-actions

Copy link
Copy Markdown

🔒 Trivy Security Scan Results

Status: ⚠️ Vulnerabilities found (see details in artifacts)
Vulnerabilities Found: 130 critical/high severity issues

⚠️ Action Required: Critical or high severity vulnerabilities detected.

Top 10 Critical/High Severity Vulnerabilities:

Type Package Vulnerability Severity Fixed Version
gobinary stdlib CVE-2024-24790 CRITICAL 1.21.11, 1.22.4
gobinary stdlib CVE-2024-24790 CRITICAL 1.21.11, 1.22.4
gobinary stdlib CVE-2024-24790 CRITICAL 1.21.11, 1.22.4
gobinary stdlib CVE-2024-24790 CRITICAL 1.21.11, 1.22.4
node-pkg grunt CVE-2020-7729 HIGH 1.3.0
node-pkg grunt CVE-2022-1537 HIGH 1.5.3
node-pkg npm CVE-2018-7408 HIGH 5.7.1
node-pkg npm CVE-2019-16775 HIGH 6.13.3
node-pkg npm CVE-2019-16776 HIGH 6.13.3
node-pkg npm CVE-2019-16777 HIGH 6.13.4

... and 4 more issues.

📊 Scan Details

  • Image: ghcr.io/smartdatafoundry/devcontainer
  • Scan Date: 2025-09-26 23:07:02 UTC
  • Total Vulnerabilities: 130

Action Run: view run
Trivy Report: view report

@github-actions

Copy link
Copy Markdown

🔒 Trivy Security Scan Results

Status: ⚠️ Vulnerabilities found (see details in artifacts)
Vulnerabilities Found: 130 critical/high severity issues

⚠️ Action Required: Critical or high severity vulnerabilities detected.

Top 10 Critical/High Severity Vulnerabilities:

Type Package Vulnerability Severity Fixed Version
gobinary stdlib CVE-2024-24790 CRITICAL 1.21.11, 1.22.4
gobinary stdlib CVE-2024-24790 CRITICAL 1.21.11, 1.22.4
gobinary stdlib CVE-2024-24790 CRITICAL 1.21.11, 1.22.4
gobinary stdlib CVE-2024-24790 CRITICAL 1.21.11, 1.22.4
node-pkg grunt CVE-2020-7729 HIGH 1.3.0
node-pkg grunt CVE-2022-1537 HIGH 1.5.3
node-pkg npm CVE-2018-7408 HIGH 5.7.1
node-pkg npm CVE-2019-16775 HIGH 6.13.3
node-pkg npm CVE-2019-16776 HIGH 6.13.3
node-pkg npm CVE-2019-16777 HIGH 6.13.4

... and 4 more issues.

📊 Scan Details

  • Image: ghcr.io/smartdatafoundry/devcontainer
  • Scan Date: 2025-09-29 22:19:40 UTC
  • Total Vulnerabilities: 130

Action Run: view run
Trivy Report: view report

@DevNiall
DevNiall merged commit 57e28af into main Sep 30, 2025
2 checks passed
@DevNiall
DevNiall deleted the feature/workflow-inputs branch September 30, 2025 00:35
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant