devcontainers/.github/workflows/build-claude-code.yml at master · gatezh/devcontainers · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
name: Build claude-code

on:
  push:
    branches: [master]
    paths:
      - "claude-code/.devcontainer/Dockerfile"
      - "claude-code/.devcontainer/*.sh"
      - "claude-code/.devcontainer/managed-settings.json"
  workflow_dispatch:

permissions:
  contents: read
  packages: write
  id-token: write

concurrency:
  group: build-claude-code-${{ github.ref }}
  cancel-in-progress: true

jobs:
  build-default:
    uses: docker/github-builder/.github/workflows/build.yml@v1
    permissions:
      contents: read
      packages: write
      id-token: write
    with:
      output: image
      push: true
      target: default
      context: claude-code/.devcontainer
      # Reuse unchanged layers so a Claude Code bump republishes only its own layer.
      cache: true
      cache-scope: claude-code

      platforms: linux/amd64,linux/arm64
      meta-images: ghcr.io/gatezh/devcontainers/claude-code
      meta-tags: |
        type=raw,value=latest
        type=sha,prefix=
        type=raw,value={{date 'YYYYMMDD'}}
    secrets:
      registry-auths: |
        - registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

  build-sandbox:
    uses: docker/github-builder/.github/workflows/build.yml@v1
    permissions:
      contents: read
      packages: write
      id-token: write
    with:
      output: image
      push: true
      target: sandbox
      context: claude-code/.devcontainer
      cache: true
      cache-scope: claude-code-sandbox

      platforms: linux/amd64,linux/arm64
      meta-images: ghcr.io/gatezh/devcontainers/claude-code-sandbox
      meta-tags: |
        type=raw,value=latest
        type=sha,prefix=
        type=raw,value={{date 'YYYYMMDD'}}
    secrets:
      registry-auths: |
        - registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

  verify:
    name: Verify ${{ matrix.image-suffix }} (${{ matrix.arch }})
    needs: [build-default, build-sandbox]
    strategy:
      fail-fast: false
      matrix:
        include:
          - image-suffix: claude-code
            verify-command: "bun --version || true && claude --version && mise --version && zsh --version && gh --version && gh stack --version && rtk --version && ralphex --version && cf --version && cf cli search 'list zones' | jq -e '.[0].command' >/dev/null && python3 -c 'import ensurepip' && test -x /usr/local/bin/patch-playwright-mcp && test -r /etc/claude-code/managed-settings.json && jq -r '.hooks.SessionStart[0].hooks[0].command' /etc/claude-code/managed-settings.json | grep -qx /usr/local/bin/patch-playwright-mcp && jq -r '.managedMcpServers.mdn.url' /etc/claude-code/managed-settings.json | grep -qx https://mcp.mdn.mozilla.net/ && agent-browser --version && printenv AGENT_BROWSER_EXECUTABLE_PATH | grep -qx /usr/bin/chromium && test -r /etc/claude-code/.claude/skills/devcontainer-browser/SKILL.md && jq -e '.permissions.deny | index(\"Bash(agent-browser install *)\")' /etc/claude-code/managed-settings.json >/dev/null && printenv AGENT_BROWSER_CONFIG | grep -qx /etc/agent-browser/config.json && jq -e .contentBoundaries /etc/agent-browser/config.json >/dev/null && jq -r '.claudeMd' /etc/claude-code/managed-settings.json | grep -q devcontainer-browser && zsh -ic 'typeset -p ZSH_THEME' | grep -q powerlevel10k/powerlevel10k && zsh -ic '(( $+_comps[gh] && $+_comps[cf] ))' && stat -c %U /home/node/.local/share | grep -qx node && stat -c %U /home/node/.config/gh | grep -qx node && jq -r .claudeMd /etc/claude-code/managed-settings.json | grep -q cloudflare.config.ts && jq -r '.permissions.ask[]' /etc/claude-code/managed-settings.json | grep -qxF 'Bash(cf * --force*)' && printenv CF_SEND_TELEMETRY | grep -qx false && printenv WRANGLER_SEND_METRICS | grep -qx false && stat -c %U /home/node/.config/cloudflare | grep -qx node"
            runner: ubuntu-24.04
            arch: amd64
          - image-suffix: claude-code
            verify-command: "bun --version || true && claude --version && mise --version && zsh --version && gh --version && gh stack --version && rtk --version && ralphex --version && cf --version && cf cli search 'list zones' | jq -e '.[0].command' >/dev/null && python3 -c 'import ensurepip' && test -x /usr/local/bin/patch-playwright-mcp && test -r /etc/claude-code/managed-settings.json && jq -r '.hooks.SessionStart[0].hooks[0].command' /etc/claude-code/managed-settings.json | grep -qx /usr/local/bin/patch-playwright-mcp && jq -r '.managedMcpServers.mdn.url' /etc/claude-code/managed-settings.json | grep -qx https://mcp.mdn.mozilla.net/ && agent-browser --version && printenv AGENT_BROWSER_EXECUTABLE_PATH | grep -qx /usr/bin/chromium && test -r /etc/claude-code/.claude/skills/devcontainer-browser/SKILL.md && jq -e '.permissions.deny | index(\"Bash(agent-browser install *)\")' /etc/claude-code/managed-settings.json >/dev/null && printenv AGENT_BROWSER_CONFIG | grep -qx /etc/agent-browser/config.json && jq -e .contentBoundaries /etc/agent-browser/config.json >/dev/null && jq -r '.claudeMd' /etc/claude-code/managed-settings.json | grep -q devcontainer-browser && zsh -ic 'typeset -p ZSH_THEME' | grep -q powerlevel10k/powerlevel10k && zsh -ic '(( $+_comps[gh] && $+_comps[cf] ))' && stat -c %U /home/node/.local/share | grep -qx node && stat -c %U /home/node/.config/gh | grep -qx node && jq -r .claudeMd /etc/claude-code/managed-settings.json | grep -q cloudflare.config.ts && jq -r '.permissions.ask[]' /etc/claude-code/managed-settings.json | grep -qxF 'Bash(cf * --force*)' && printenv CF_SEND_TELEMETRY | grep -qx false && printenv WRANGLER_SEND_METRICS | grep -qx false && stat -c %U /home/node/.config/cloudflare | grep -qx node"
            runner: ubuntu-24.04-arm
            arch: arm64
          - image-suffix: claude-code-sandbox
            verify-command: "claude --version && mise --version && zsh --version && gh --version && gh stack --version && which iptables && rtk --version && ralphex --version && cf --version && cf cli search 'list zones' | jq -e '.[0].command' >/dev/null && python3 -c 'import ensurepip' && test -x /usr/local/bin/patch-playwright-mcp && test -r /etc/claude-code/managed-settings.json && jq -r '.hooks.SessionStart[0].hooks[0].command' /etc/claude-code/managed-settings.json | grep -qx /usr/local/bin/patch-playwright-mcp && jq -r '.managedMcpServers.mdn.url' /etc/claude-code/managed-settings.json | grep -qx https://mcp.mdn.mozilla.net/ && agent-browser --version && printenv AGENT_BROWSER_EXECUTABLE_PATH | grep -qx /usr/bin/chromium && test -r /etc/claude-code/.claude/skills/devcontainer-browser/SKILL.md && jq -e '.permissions.deny | index(\"Bash(agent-browser install *)\")' /etc/claude-code/managed-settings.json >/dev/null && printenv AGENT_BROWSER_CONFIG | grep -qx /etc/agent-browser/config.json && jq -e .contentBoundaries /etc/agent-browser/config.json >/dev/null && jq -r '.claudeMd' /etc/claude-code/managed-settings.json | grep -q devcontainer-browser && zsh -ic 'typeset -p ZSH_THEME' | grep -q powerlevel10k/powerlevel10k && zsh -ic '(( $+_comps[gh] && $+_comps[cf] ))' && stat -c %U /home/node/.local/share | grep -qx node && stat -c %U /home/node/.config/gh | grep -qx node && jq -r .claudeMd /etc/claude-code/managed-settings.json | grep -q cloudflare.config.ts && jq -r '.permissions.ask[]' /etc/claude-code/managed-settings.json | grep -qxF 'Bash(cf * --force*)' && printenv CF_SEND_TELEMETRY | grep -qx false && printenv WRANGLER_SEND_METRICS | grep -qx false && stat -c %U /home/node/.config/cloudflare | grep -qx node"
            runner: ubuntu-24.04
            arch: amd64
          - image-suffix: claude-code-sandbox
            verify-command: "claude --version && mise --version && zsh --version && gh --version && gh stack --version && which iptables && rtk --version && ralphex --version && cf --version && cf cli search 'list zones' | jq -e '.[0].command' >/dev/null && python3 -c 'import ensurepip' && test -x /usr/local/bin/patch-playwright-mcp && test -r /etc/claude-code/managed-settings.json && jq -r '.hooks.SessionStart[0].hooks[0].command' /etc/claude-code/managed-settings.json | grep -qx /usr/local/bin/patch-playwright-mcp && jq -r '.managedMcpServers.mdn.url' /etc/claude-code/managed-settings.json | grep -qx https://mcp.mdn.mozilla.net/ && agent-browser --version && printenv AGENT_BROWSER_EXECUTABLE_PATH | grep -qx /usr/bin/chromium && test -r /etc/claude-code/.claude/skills/devcontainer-browser/SKILL.md && jq -e '.permissions.deny | index(\"Bash(agent-browser install *)\")' /etc/claude-code/managed-settings.json >/dev/null && printenv AGENT_BROWSER_CONFIG | grep -qx /etc/agent-browser/config.json && jq -e .contentBoundaries /etc/agent-browser/config.json >/dev/null && jq -r '.claudeMd' /etc/claude-code/managed-settings.json | grep -q devcontainer-browser && zsh -ic 'typeset -p ZSH_THEME' | grep -q powerlevel10k/powerlevel10k && zsh -ic '(( $+_comps[gh] && $+_comps[cf] ))' && stat -c %U /home/node/.local/share | grep -qx node && stat -c %U /home/node/.config/gh | grep -qx node && jq -r .claudeMd /etc/claude-code/managed-settings.json | grep -q cloudflare.config.ts && jq -r '.permissions.ask[]' /etc/claude-code/managed-settings.json | grep -qxF 'Bash(cf * --force*)' && printenv CF_SEND_TELEMETRY | grep -qx false && printenv WRANGLER_SEND_METRICS | grep -qx false && stat -c %U /home/node/.config/cloudflare | grep -qx node"
            runner: ubuntu-24.04-arm
            arch: arm64
    runs-on: ${{ matrix.runner }}
    steps:
      - name: Log in to GHCR
        uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Verify image
        run: |
          docker pull ghcr.io/gatezh/devcontainers/${{ matrix.image-suffix }}:latest
          docker run --rm ghcr.io/gatezh/devcontainers/${{ matrix.image-suffix }}:latest bash -c "${{ matrix.verify-command }}"