fix(devcontainer-base): validate base updates before publishing

.devcontainer/Containerfile

@@ -1,3 +1,5 @@
+ARG DEVCONTAINER_BASE_TAG=latest
+
 FROM ghcr.io/hadolint/hadolint:v2.14.0@sha256:27086352fd5e1907ea2b934eb1023f217c5ae087992eb59fde121dce9c9ff21e AS hadolint
 FROM registry.k8s.io/kustomize/kustomize:v5.8.1@sha256:899fcd3bc898160e62bcaf82932b0cb29ba38d16272353db2e7acbba82129429 AS kustomize
 
@@ -6,7 +8,7 @@ COPY .devcontainer/build_files /
 COPY ansible/requirements.txt /requirements.txt
 
 # hadolint ignore=DL3007
-FROM ghcr.io/marinatedconcrete/devcontainer-base:latest
+FROM ghcr.io/marinatedconcrete/devcontainer-base:${DEVCONTAINER_BASE_TAG}
 
 USER root
 

.devcontainer/devcontainer.json

@@ -1,6 +1,9 @@
 {
   "name": "config",
   "build": {
+    "args": {
+      "DEVCONTAINER_BASE_TAG": "${localEnv:DEVCONTAINER_BASE_TAG:latest}"
+    },
     "cacheFrom": "ghcr.io/marinatedconcrete/config-devcontainer",
     "context": "..",
     "dockerfile": "Containerfile"

.github/workflows/checks.yml

@@ -3,6 +3,9 @@ name: Run checks
 on:
   push:
 
+env:
+  DEVCONTAINER_BASE_TAG: candidate-${{ github.sha }}
+
 jobs:
   build:
     permissions:
@@ -18,15 +21,18 @@ jobs:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
-      - name: Set up Buildx
-        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4
+      - name: Build Candidate Base Image
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
-          driver: docker-container
+          context: images/devcontainer-base
+          file: images/devcontainer-base/Containerfile
+          load: true
+          push: false
+          tags: ghcr.io/${{ github.repository_owner }}/devcontainer-base:${{ env.DEVCONTAINER_BASE_TAG }}
       - name: Build devcontainer image
         uses: devcontainers/ci@513af61f4de4f75d37e4438f184ba4358f0fc1ca # v0.3.1900000450
         with:
           cacheFrom: ghcr.io/marinatedconcrete/config-devcontainer
-          cacheTo: ghcr.io/marinatedconcrete/config-devcontainer
           env: |
             CI=1
           imageName: ghcr.io/marinatedconcrete/config-devcontainer
@@ -38,6 +44,14 @@ jobs:
     steps:
       - name: Checkout Repo
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - name: Build Candidate Base Image
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        with:
+          context: images/devcontainer-base
+          file: images/devcontainer-base/Containerfile
+          load: true
+          push: false
+          tags: ghcr.io/${{ github.repository_owner }}/devcontainer-base:${{ env.DEVCONTAINER_BASE_TAG }}
       - name: Check formatting
         uses: devcontainers/ci@513af61f4de4f75d37e4438f184ba4358f0fc1ca # v0.3.1900000450
         with:
@@ -53,6 +67,14 @@ jobs:
     steps:
       - name: Checkout Repo
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - name: Build Candidate Base Image
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        with:
+          context: images/devcontainer-base
+          file: images/devcontainer-base/Containerfile
+          load: true
+          push: false
+          tags: ghcr.io/${{ github.repository_owner }}/devcontainer-base:${{ env.DEVCONTAINER_BASE_TAG }}
       - name: Validate configs
         uses: devcontainers/ci@513af61f4de4f75d37e4438f184ba4358f0fc1ca # v0.3.1900000450
         with:
@@ -77,6 +99,14 @@ jobs:
     steps:
       - name: Checkout Repo
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - name: Build Candidate Base Image
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        with:
+          context: images/devcontainer-base
+          file: images/devcontainer-base/Containerfile
+          load: true
+          push: false
+          tags: ghcr.io/${{ github.repository_owner }}/devcontainer-base:${{ env.DEVCONTAINER_BASE_TAG }}
       - name: Validate configs
         uses: devcontainers/ci@513af61f4de4f75d37e4438f184ba4358f0fc1ca # v0.3.1900000450
         with:

.github/workflows/image-devcontainer-base.yml

@@ -15,14 +15,20 @@ on: # yamllint disable-line rule:truthy
       - .github/workflows/image-devcontainer-base.yml
       - images/devcontainer-base/**
   schedule:
-      - cron: '0 0 * * 0'  # Triggers every Sunday at midnight UTC
+    - cron: "0 0 * * 0" # Triggers every Sunday at midnight UTC
+
+concurrency:
+  cancel-in-progress: true
+  group: devcontainer-base-${{ github.ref }}
 
 jobs:
   build-container:
     runs-on: ubuntu-latest
     permissions:
       contents: read
       packages: write
+    env:
+      DEVCONTAINER_BASE_TAG: candidate-${{ github.sha }}
 
     steps:
       - name: Checkout Repo
@@ -33,15 +39,27 @@ jobs:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
-      - name: Generate Metadata
-        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
-        id: metadata
-        with:
-          images: ghcr.io/${{ github.repository_owner }}/devcontainer-base
-      - name: Build Image
+      - name: Build Candidate Image
         uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
           context: images/devcontainer-base
           file: images/devcontainer-base/Containerfile
-          push: ${{ github.event_name != 'pull_request' }}
-          tags: ghcr.io/${{ github.repository_owner }}/devcontainer-base:latest
+          load: true
+          push: false
+          tags: ghcr.io/${{ github.repository_owner }}/devcontainer-base:${{ env.DEVCONTAINER_BASE_TAG }}
+      - name: Validate Full CI Pipeline
+        uses: devcontainers/ci@513af61f4de4f75d37e4438f184ba4358f0fc1ca # v0.3.1900000450
+        with:
+          cacheFrom: ghcr.io/marinatedconcrete/config-devcontainer
+          env: |
+            CI=1
+          imageName: config-devcontainer-candidate
+          push: never
+          runCmd: just check-format && just lint && just test
+      - name: Push Tested Image
+        if: github.event_name != 'pull_request'
+        run: |
+          docker tag \
+            "ghcr.io/${{ github.repository_owner }}/devcontainer-base:${DEVCONTAINER_BASE_TAG}" \
+            ghcr.io/${{ github.repository_owner }}/devcontainer-base:latest
+          docker push ghcr.io/${{ github.repository_owner }}/devcontainer-base:latest

images/devcontainer-base/Containerfile

@@ -1,7 +1,7 @@
 FROM scratch AS ctx
 COPY build_files /
 
-FROM quay.io/fedora/fedora-minimal:45
+FROM quay.io/fedora/fedora-minimal:44
 
 ARG USERNAME=vscode
 ARG USERID=1000