Use devcontainer for localdev and CI/CD

.devcontainer/devcontainer.json

@@ -0,0 +1,45 @@
+// For format details, see https://aka.ms/devcontainer.json. For config options, see the
+// README at: https://github.com/devcontainers/templates/tree/main/src/ubuntu
+{
+	"name": "Ubuntu",
+	// Or use a Dockerfile or Docker Compose file. More info: https://containers.dev/guide/dockerfile
+	"image": "mcr.microsoft.com/devcontainers/base:noble",
+	"features": {
+		"ghcr.io/devcontainers/features/python:1": {
+			"version": "3.13"
+		},
+		"ghcr.io/devcontainers-extra/features/pulumi:1": {
+			"version": "3.207.0"
+		},
+		"ghcr.io/devcontainers-extra/features/ruff:1": {
+			"version": "0.14.5"
+		},
+		"ghcr.io/devcontainers/features/aws-cli:1": {},
+		"ghcr.io/devcontainers/features/docker-in-docker:2": {},
+		"ghcr.io/devcontainers/features/node:1": {
+			"version": "22"
+		},
+		"ghcr.io/larsnieuwenhuizen/features/jqyq:0": {}
+	},
+	"mounts": [
+        // "source=/${localEnv:HOME}${localEnv:USERPROFILE}/.aws,target=/home/vscode/.aws,type=bind,consistency=cached",
+		// "source=/${localEnv:HOME}${localEnv:USERPROFIaLE}/.ssh,target=/home/vscode/.ssh,type=bind,consistency=cached",
+		// "source=/${localEnv:HOME}${localEnv:USERPROFILE}/src,target=/home/vscode/src,type=bind,consistency=cached"
+    ],
+
+
+	// Features to add to the dev container. More info: https://containers.dev/features.
+	// "features": {},
+
+	// Use 'forwardPorts' to make a list of ports inside the container available locally.
+	// "forwardPorts": [],
+
+	// Use 'postCreateCommand' to run commands after the container is created.
+	// "postCreateCommand": "npm install -g bun"
+
+	// Configure tool-specific properties.
+	// "customizations": {},
+
+	// Uncomment to connect as root instead. More info: https://aka.ms/dev-containers-non-root.
+	// "remoteUser": "root"
+}

.github/workflows/build-and-push-devcontainer.yaml

@@ -0,0 +1,39 @@
+---
+name: build-and-push-devcontainer
+
+concurrency:
+  group: merge-main
+  cancel-in-progress: true
+
+on:
+  push:
+    branches:
+      - main
+
+env:
+  CACHE_IMAGE_PREFIX: ghcr.io/${{ github.repository }}
+
+jobs:
+  # Build and cache devcontainer for faster CI stages
+  devcontainer-build:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout (GitHub)
+        uses: actions/checkout@v3
+
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v2 
+        with:
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Build and cache devcontainer
+        uses: devcontainers/ci@v0.3
+        with:
+          # Change this to point to your image name
+          imageName: ${{ env.CACHE_IMAGE_PREFIX }}/cached-devcontainer
+          cacheFrom: ${{ env.CACHE_IMAGE_PREFIX }}/cached-devcontainer
+          push: always
+          # Change this to be your CI task/script
+          # runCmd: 

.github/workflows/merge.yml

@@ -58,16 +58,15 @@ jobs:
     if: needs.detect-changes.outputs.src-changed == 'true' || needs.detect-changes.outputs.iac-changed == 'true'
     environment: staging
     runs-on: ubuntu-latest
+    container:
+      image: ghcr.io/${{ github.repository }}/cached-devcontainer:latest
     env:
       IS_CI_AUTOMATION: "yes"
       PULUMI_DIR: "pulumi"
       CELERY_WORKER_TAG: '-celery-worker'
     steps:
       # Preparation for future steps
       - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: "22"
 
       - name: Configure AWS credentials
         uses: aws-actions/configure-aws-credentials@v4
@@ -82,27 +81,6 @@ jobs:
         with:
           mask-password: "true"
 
-      - name: Set up Python ${{ vars.PYTHON_VERSION}}
-        uses: actions/setup-python@v5
-        with:
-          python-version: ${{ vars.PYTHON_VERSION}}
-
-      - name: Set up virtual environment
-        shell: bash
-        run: |
-          python -m pip install virtualenv
-          cd $PULUMI_DIR
-          virtualenv ./venv
-
-      - name: Set up Pulumi environment
-        id: pulumi-env
-        shell: bash
-        run: |
-          cd $PULUMI_DIR
-          source ./venv/bin/activate
-          curl -fsSL https://get.pulumi.com | sh
-          pip install -Ur requirements.txt
-
       # Produce a container image
       - name: Build, tag, and push accounts image to Amazon ECR
         id: build-accounts
@@ -134,7 +112,6 @@ jobs:
           path: deployment.json
 
       - name: Package Pulumi code
-        shell: bash
         run: |
           tar -cvjf pulumi.tbz pulumi/
 
@@ -147,7 +124,6 @@ jobs:
 
       # Deploy to stage
       - name: Deploy new image to stage
-        shell: bash
         env:
           PULUMI_ACCESS_TOKEN: ${{ secrets.PULUMI_ACCESS_TOKEN }}
         run: |
@@ -178,7 +154,6 @@ jobs:
           # Use yq to merge the stump into the main config
           yq -i '. *= load("newimage.yaml")' config.stage.yaml
 
-          source ./venv/bin/activate
           pulumi login
           pulumi stack select thunderbird/stage
           pulumi up -y --diff \
@@ -192,16 +167,15 @@ jobs:
     if: needs.detect-changes.outputs.keycloak-theme-changed == 'true' || needs.detect-changes.outputs.iac-changed == 'true'
     environment: staging
     runs-on: ubuntu-latest
+    container:
+      image: ghcr.io/${{ github.repository }}/cached-devcontainer:latest
     env:
       IS_CI_AUTOMATION: "yes"
       PULUMI_DIR: "pulumi"
       KEYCLOAK_TAG: '-keycloak'
     steps:
       # Preparation for future steps
       - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: "22"
 
       - name: Configure AWS credentials
         uses: aws-actions/configure-aws-credentials@v4
@@ -216,27 +190,6 @@ jobs:
         with:
           mask-password: "true"
 
-      - name: Set up Python ${{ vars.PYTHON_VERSION}}
-        uses: actions/setup-python@v5
-        with:
-          python-version: ${{ vars.PYTHON_VERSION}}
-
-      - name: Set up virtual environment
-        shell: bash
-        run: |
-          python -m pip install virtualenv
-          cd $PULUMI_DIR
-          virtualenv ./venv
-
-      - name: Set up Pulumi environment
-        id: pulumi-env
-        shell: bash
-        run: |
-          cd $PULUMI_DIR
-          source ./venv/bin/activate
-          curl -fsSL https://get.pulumi.com | sh
-          pip install -Ur requirements.txt
-
       # Produce a container image
       - name: Build, tag, and push accounts image to Amazon ECR
         id: build-keycloak
@@ -281,7 +234,6 @@ jobs:
 
       # Deploy to stage
       - name: Deploy new image to stage
-        shell: bash
         env:
           PULUMI_ACCESS_TOKEN: ${{ secrets.PULUMI_ACCESS_TOKEN }}
         run: |
@@ -364,6 +316,8 @@ jobs:
     needs: accounts-deploy
     if: '!cancelled()'
     runs-on: ubuntu-latest
+    container:
+      image: ghcr.io/${{ github.repository }}/cached-devcontainer:latest
     environment: staging
     env:
       ACCTS_OIDC_EMAIL: ${{ secrets.E2E_ACCTS_OIDC_EMAIL }}
@@ -373,12 +327,6 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'npm'
-          cache-dependency-path: 'test/e2e/package-lock.json'
-
       - name: Install dependencies
         run: |
           cd ./test/e2e

.github/workflows/release.yml

@@ -16,6 +16,8 @@ permissions:
 jobs:
   deploy-production:
     runs-on: ubuntu-latest
+    container:
+        image: ghcr.io/${{ github.repository }}/cached-devcontainer:latest
     environment: production
     env:
       IS_CI_AUTOMATION: "yes"
@@ -71,22 +73,10 @@ jobs:
           file: pulumi.tbz
 
       - name: Decompress Pulumi code
-        shell: bash
         run: |
           tar -xvf pulumi.tbz
-
-      - name: Set up Python ${{ vars.PYTHON_VERSION}}
-        uses: actions/setup-python@v5
-        with:
-          python-version: ${{ vars.PYTHON_VERSION}}
-
-      - name: Install Pulumi
-        shell: bash
-        run: |
-          curl -fsSL https://get.pulumi.com | sh
 
       - name: Deploy version-tagged image to prod
-        shell: bash
         env:
           PULUMI_ACCESS_TOKEN: ${{ secrets.PULUMI_ACCESS_TOKEN }}
         run: |

.github/workflows/validate.yml

@@ -28,9 +28,6 @@ jobs:
       iac-changed: ${{ steps.check.outputs.iac-changed }}
     steps:
       - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: "22"
 
       - uses: dorny/paths-filter@v3
         id: check
@@ -87,26 +84,25 @@ jobs:
     needs: detect-changes
     if: needs.detect-changes.outputs.iac-changed
     runs-on: ubuntu-latest
+    container:
+        image: ghcr.io/${{ github.repository }}/cached-devcontainer:latest
     environment: staging
     steps:
       - uses: actions/checkout@v4
 
       - name: Ruff formatting/linting checks
-        uses: chartboost/ruff-action@v1
-        with:
-          src: "pulumi"
-          args: "format --check"
+        run: ruff format --check pulumi && ruff check pulumi
 
       - name: Ruff error checks
-        uses: chartboost/ruff-action@v1
-        with:
-          src: "pulumi"
+        run: ruff check pulumi
 
   run-e2e-tests-local:
     needs: detect-changes
     # if: needs.detect-changes.outputs.iac-changed
     if: false
     runs-on: ubuntu-latest
+    container:
+        image: ghcr.io/${{ github.repository }}/cached-devcontainer:latest
     environment: staging
     env:
       ACCTS_FXA_EMAIL: ${{ secrets.E2E_ACCTS_FXA_EMAIL }}
@@ -138,12 +134,6 @@ jobs:
       - name: Start appointment stack via docker
         run: docker compose up -d --build -V
 
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'npm'
-          cache-dependency-path: 'test/e2e/package-lock.json'
-
       - name: Install E2E test dependencies
         run: |
           cd ./test/e2e