feat(tools): provision tools from declared environment selections

.devcontainer/post_create_command.sh

@@ -13,20 +13,10 @@
 # SPDX-License-Identifier: Apache-2.0
 # *******************************************************************************
 
-npm install -g @devcontainers/cli
-
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd -P)"
 REPOSITORY_ROOT="$(cd "${SCRIPT_DIR}/.." && pwd -P)"
 
-# Install uv and uvx from the native lockfile first. The pinned uv release then
-# resolves every Python distribution declared in the shared catalog.
-sudo "${REPOSITORY_ROOT}/tools/internal/devcontainer/install.py" install actionlint bazelisk buildifier ruff shellcheck uv uvx yamlfmt
-
-# Install the catalogued Python distribution system-wide. The explicit
-# directories avoid root-specific uv defaults and make pre-commit available to
-# the non-root development user.
-sudo "${REPOSITORY_ROOT}/tools/internal/devcontainer/install.py" install-python pre-commit \
-    --bin-dir /usr/local/bin --tool-dir /usr/local/share/uv/tools
+"${REPOSITORY_ROOT}/tools/internal/devcontainer/install.py" install-environment repository-devcontainer
 
 # Hooks can only be registered after the catalogued executable is on PATH.
 pre-commit install

.github/renovate.json5

@@ -81,30 +81,6 @@
       "datasourceTemplate": "github-releases",
       "depNameTemplate": "astral-sh/uv",
       "versioningTemplate": "semver"
-    },
-    {
-      "customType": "regex",
-      "fileMatch": [
-        "versions\\.yaml$"
-      ],
-      "matchStrings": [
-        "apm:\\n\\s+version:\\s+(?<currentValue>\\d+\\.\\d+\\.\\d+)"
-      ],
-      "datasourceTemplate": "github-releases",
-      "depNameTemplate": "microsoft/apm",
-      "versioningTemplate": "semver"
-    },
-    {
-      "customType": "regex",
-      "fileMatch": [
-        "versions\\.yaml$"
-      ],
-      "matchStrings": [
-        "opencode:\\n\\s+version:\\s+(?<currentValue>\\d+\\.\\d+\\.\\d+)"
-      ],
-      "datasourceTemplate": "github-releases",
-      "depNameTemplate": "anomalyco/opencode",
-      "versioningTemplate": "semver"
     }
   ],
   "enabledManagers": [

.pre-commit-config.yaml

@@ -72,8 +72,8 @@ repos:
         entry: python3 tools/internal/sync_readme.py
         language: system
         pass_filenames: false
-        # Watch the shared reader as well as both catalog formats.
-        files: ^tools/(README\.md|internal/(catalog\.py|sync_readme\.py|devcontainer/install\.py)|lockfiles/(.*\.lock\.json|python_tools\.bzl))$
+        # Watch the shared reader, package definitions and native lockfiles.
+        files: ^tools/(README\.md|(environments|providers)\.json|internal/(catalog\.py|sync_readme\.py|devcontainer/install\.py)|lockfiles/.*\.lock\.json)$
   - repo: https://github.com/eclipse-score/tooling
     rev: 31ff8eee214e4e97ef8f5cb46e443273515b63ec
     hooks:

MODULE.bazel

@@ -19,6 +19,16 @@ bazel_dep(name = "rules_multitool", version = "1.11.1")
 # Bazel versions.
 bazel_dep(name = "rules_shell", version = "0.4.1")
 
+# Python packages live beside the other provider definitions in JSON. Convert
+# that data to a loadable Starlark value in Bazel's cache, without a second
+# maintained package list or a host Python dependency.
+catalog_repository = use_repo_rule("//tools:catalog_repository.bzl", "catalog_repository")
+
+catalog_repository(
+    name = "score_tool_catalog",
+    definitions = "//tools:providers.json",
+)
+
 multitool = use_extension("@rules_multitool//multitool:extension.bzl", "multitool")
 multitool.hub(lockfile = "//tools:lockfiles/actionlint.lock.json")
 multitool.hub(lockfile = "//tools:lockfiles/apm.lock.json")

REUSE.toml

@@ -27,6 +27,8 @@ SPDX-License-Identifier = "Apache-2.0"
 path = ["resources/reopen_in_container.png",
         "resources/devcontainer_success.png",
         "tools/lockfiles/*.lock.json",
+        "tools/environments.json",
+        "tools/providers.json",
         "MODULE.bazel.lock",
         ".bazelversion",
         ]

src/s-core-devcontainer/.devcontainer/bazel-feature/install.sh

@@ -26,54 +26,13 @@ rm -f "${COPY_TARGET}/devcontainer-features.env" "${COPY_TARGET}/devcontainer-fe
 
 # shellcheck disable=SC2034
 # used by apt-get only inside this script
-DEBIAN_FRONTEND=noninteractive
-
-# Read tool versions + metadata into environment variables
-. /usr/local/share/score-tools/internal/devcontainer/load_feature_versions.sh /devcontainer/features/bazel/versions.yaml
-
-ARCHITECTURE=$(dpkg --print-architecture)
+export DEBIAN_FRONTEND=noninteractive
 
 apt-get update
 
-# INSTALL CONTAINER BUILD DEPENDENCIES
-# Container build dependencies are not pinned, since they are removed anyway after container creation.
-apt-get install apt-transport-https -y
-
-# Lockfile-managed Bazel tooling
-/usr/local/share/score-tools/internal/devcontainer/install.py install bazelisk buildifier starpls
-
-# Bazelisk + Bazel
-ln -sf /usr/local/bin/bazelisk /usr/local/bin/bazel
-
-# Pre-install a fixed Bazel version, setup the bash command completion
-export USE_BAZEL_VERSION=${bazel_version}
-# bazelisk downloads Bazel into the home directory of the user running the command
-# lets assume there is only one user in the devcontainer
-su $(ls /home) -c "bazel help completion bash > /tmp/bazel-complete.bash"
-mkdir -p /etc/bash_completion.d
-mv /tmp/bazel-complete.bash /etc/bash_completion.d/bazel-complete.bash
-sh -c "echo 'INSTALLED_BAZEL_VERSION=${bazel_version}' >> /devcontainer/features/bazel/bazel_setup.sh"
-
-# Configure Bazel to use system trust store for SSL/TLS connections
-# This is required for corporate environments with custom CA certificates
-echo 'startup --host_jvm_args=-Djavax.net.ssl.trustStore=/etc/ssl/certs/java/cacerts --host_jvm_args=-Djavax.net.ssl.trustStorePassword=changeit' >> /etc/bazel.bazelrc
-
-# Code completion for C++ code of Bazel projects
-# (see https://github.com/kiron1/bazel-compile-commands)
-source /etc/lsb-release
-curl -L "https://github.com/kiron1/bazel-compile-commands/releases/download/v${bazel_compile_commands_version}/bazel-compile-commands_${bazel_compile_commands_version}-${DISTRIB_CODENAME}_${ARCHITECTURE}.deb" -o /tmp/bazel-compile-commands.deb
-# Extract correct sha256 for current DISTRIB_CODENAME and check
-SHA256SUM="${bazel_compile_commands_amd64_sha256}"
-if [ "${ARCHITECTURE}" = "arm64" ]; then
-    SHA256SUM="${bazel_compile_commands_arm64_sha256}"
-fi
-echo "${SHA256SUM} /tmp/bazel-compile-commands.deb" | sha256sum -c - || exit 1
-apt-get install -y --no-install-recommends --fix-broken /tmp/bazel-compile-commands.deb
-rm /tmp/bazel-compile-commands.deb
+# environments.json selects the tools; providers.json names their extra setup scripts.
+/usr/local/share/score-tools/internal/devcontainer/install.py install-environment bazel-feature
 
-# Cleanup
-# REMOVE CONTAINER BUILD DEPENDENCIES
-apt-get remove --purge -y apt-transport-https
 apt-get autoremove -y
 apt-get clean
 rm -rf /var/lib/apt/lists/*

src/s-core-devcontainer/.devcontainer/bazel-feature/tests/test_default.sh

@@ -16,20 +16,17 @@
 set -euo pipefail
 
 # Read tool versions + metadata into environment variables
-. /usr/local/share/score-tools/internal/devcontainer/load_feature_versions.sh /devcontainer/features/bazel/versions.yaml
+eval "$(/usr/local/share/score-tools/internal/devcontainer/install.py shell-metadata)"
 
-bazelisk_lockfile_version="$(/usr/local/share/score-tools/internal/devcontainer/install.py version bazelisk)"
-buildifier_lockfile_version="$(/usr/local/share/score-tools/internal/devcontainer/install.py version buildifier)"
-starpls_lockfile_version="$(/usr/local/share/score-tools/internal/devcontainer/install.py version starpls)"
 # Bazel-related tools
 ## This is the bazel version preinstalled in the devcontainer.
 ## A solid test would disable the network interface first to prevent a different version from being downloaded,
 ## but that requires CAP_NET_ADMIN, which is not yet added.
 export USE_BAZEL_VERSION=${bazel_version}
-check "validate bazelisk is working and has the correct version" bash -c "bazelisk version | grep '${bazelisk_lockfile_version}'"
+check "validate bazelisk is working and has the correct version" bash -c "bazelisk version | grep '${bazelisk_version}'"
 check "validate bazel is working and has the correct version" bash -c "bazel version | grep '${bazel_version}'"
 unset USE_BAZEL_VERSION
 
-check "validate buildifier is working and has the correct version" bash -c "buildifier --version | grep '${buildifier_lockfile_version}'"
-check "validate starpls is working and has the correct version" bash -c "starpls version | grep '${starpls_lockfile_version}'"
+check "validate buildifier is working and has the correct version" bash -c "buildifier --version | grep '${buildifier_version}'"
+check "validate starpls is working and has the correct version" bash -c "starpls version | grep '${starpls_version}'"
 check "validate bazel-compile-commands is working and has the correct version" bash -c "bazel-compile-commands --version 2>&1 | grep '${bazel_compile_commands_version}'"

src/s-core-devcontainer/.devcontainer/s-core-local/fix_config_volume_ownership.sh

@@ -36,6 +36,14 @@ ensure_owner() {
   fi
 }
 
-ensure_owner "/home/vscode/.config/opencode"
-ensure_owner "/home/vscode/.local/share/opencode"
-ensure_owner "/home/vscode/.config/gh"
+# Docker may create .local and .local/share as root when mounting a volume
+# below them. Give the user ownership of these parents too, so tools can create
+# directories such as .local/state. Leave existing contents alone.
+# mkdir preserves existing directory permissions, including private mode 0700.
+sudo mkdir -p "${HOME}/.config" "${HOME}/.local" "${HOME}/.local/share"
+sudo chown "${current_user_group}" \
+  "${HOME}/.config" "${HOME}/.local" "${HOME}/.local/share"
+
+ensure_owner "${HOME}/.config/opencode"
+ensure_owner "${HOME}/.local/share/opencode"
+ensure_owner "${HOME}/.config/gh"

src/s-core-devcontainer/.devcontainer/s-core-local/install.sh

@@ -12,9 +12,6 @@
 # SPDX-License-Identifier: Apache-2.0
 # *******************************************************************************
 
-# shellcheck disable=SC2016
-# Variables in strings with single quotes are expected to be evaluated later by `eval`
-
 set -euo pipefail
 
 # Copy feature sources and tests to expected location
@@ -28,159 +25,16 @@ rm -f "${COPY_TARGET}/devcontainer-features.env" "${COPY_TARGET}/devcontainer-fe
 
 # shellcheck disable=SC2034
 # used by apt-get only inside this script
-DEBIAN_FRONTEND=noninteractive
-
-# Read tool versions + metadata into environment variables
-. /usr/local/share/score-tools/internal/devcontainer/load_feature_versions.sh /devcontainer/features/s-core-local/versions.yaml
-
-ARCHITECTURE=$(dpkg --print-architecture)
-KERNEL=$(uname -s)
+export DEBIAN_FRONTEND=noninteractive
 
 apt-get update
 
-# Unminimize the image to include standard packages like man pages
+# Restore standard OS documentation in the development image.
 bash -c "yes || true" | unminimize
-apt-get install -y man-db manpages manpages-dev manpages-posix manpages-posix-dev
-
-# INSTALL CONTAINER BUILD DEPENDENCIES
-# Container build dependencies are not pinned, since they are removed anyway after container creation.
-apt-get install apt-transport-https -y
-
-# Python, via APT
-apt-get install -y "python${python_version}" python3-pip python3-venv
-# The following packages correspond to the list of packages installed by the
-# devcontainer feature "python" (cf. https://github.com/devcontainers/features/tree/main/src/python )
-apt-get install -y flake8 python3-autopep8 black python3-yapf mypy pydocstyle pycodestyle bandit pipenv virtualenv pylint
-
-# uv must be installed from the native lockfile before it can install the
-# Python distributions declared in the shared Python tool catalog below.
-/usr/local/share/score-tools/internal/devcontainer/install.py install shellcheck ruff actionlint yamlfmt uv uvx apm opencode
-
-# Keep Python CLIs in system directories so every DevContainer user sees the
-# same entrypoint and isolated environment. Bazel reads the same package pin
-# from this catalog but executes it on demand with uvx.
-/usr/local/share/score-tools/internal/devcontainer/install.py install-python pre-commit \
-    --bin-dir /usr/local/bin --tool-dir /usr/local/share/uv/tools
-
-# GraphViz
-# The Ubuntu Noble package of GraphViz
-apt-get install -y graphviz="${graphviz_version}*"
-
-# Protobuf compiler, via APT (needed by FEO)
-apt-get install -y protobuf-compiler="${protobuf_compiler_version}*"
-
-# Git and Git LFS, via APT
-apt-get install -y git
-apt-get install -y git-lfs
-apt-get install -y gh
-
-# OpenJDK 21, via APT
-# Set JAVA_HOME environment variable system-wide, since some tools rely on it (e.g., Bazel's rules_java)
-apt-get install -y ca-certificates-java openjdk-21-jdk-headless="${openjdk_21_version}*"
-JAVA_HOME="$(dirname $(dirname $(realpath $(command -v javac))))"
-export JAVA_HOME
-echo -e "JAVA_HOME=${JAVA_HOME}\nexport JAVA_HOME" > /etc/profile.d/java_home.sh
-
-# QEMU system emulators for ARM and x86
-apt-get install -y --no-install-recommends --fix-broken \
-    qemu-system-arm="${qemu_system_version}*" \
-    qemu-system-x86="${qemu_system_version}*"
-
-# basedpyright
-su $(ls /home) -c "uv tool install basedpyright@\"${basedpyright_version}\""
-
-# pytest
-su $(ls /home) -c "uv tool install pytest@\"${pytest_version}\""
-
-# sshpass
-apt-get install -y sshpass="${sshpass_version}*"
-
-# pycairo build dependencies (pkg-config + cairo headers needed when pip builds pycairo from source)
-apt-get install -y pkg-config="${pkg_config_version}*" libcairo2-dev="${libcairo2_dev_version}*"
-
-# additional developer tools
-apt-get install -y gdb="${gdb_version}*"
-
-apt-get install -y valgrind="1:${valgrind_version}*"
-
-apt-get install -y ripgrep="${ripgrep_version}*"
-
-# lcov - code coverage reporting for C/C++
-apt-get install -y lcov="${lcov_version}*"
-
-# CodeQL
-apt-get install -y zstd
-if [ "${ARCHITECTURE}" = "amd64" ]; then
-    VARIANT=linux64
-    SHA256SUM="${codeql_amd64_sha256}"
-elif [ "${ARCHITECTURE}" = "arm64" ]; then
-    if [ "${KERNEL}" = "Darwin" ]; then
-        VARIANT=osx64
-        SHA256SUM="${codeql_arm64_sha256}"
-    else
-        echo "CodeQl unsupported architecture/os: ${ARCHITECTURE} on ${KERNEL}, skipping installation"
-        VARIANT=noinstall
-    fi
-else
-    echo "Unsupported architecture: ${ARCHITECTURE} for CodeQL"
-    exit 1
-fi
-
-if [ "${VARIANT}" != "noinstall" ]; then
-    codeql_install_dir="/usr/local"
-    curl -L "https://github.com/github/codeql-action/releases/download/codeql-bundle-v${codeql_version}/codeql-bundle-${VARIANT}.tar.zst" -o /tmp/codeql.tar.zst
-    echo "${SHA256SUM} /tmp/codeql.tar.zst" | sha256sum -c - || exit 1
-    tar -I zstd -xf /tmp/codeql.tar.zst -C "${codeql_install_dir}"
-    ln -s "${codeql_install_dir}"/codeql/codeql /usr/local/bin/codeql
-    rm /tmp/codeql.tar.zst
-    export CODEQL_HOME=${codeql_install_dir}/codeql
-    echo "export CODEQL_HOME=${codeql_install_dir}/codeql" > /etc/profile.d/codeql.sh
-
-    codeql pack download codeql/misra-cpp-coding-standards@"${codeql_coding_standards_version}" -d "${codeql_install_dir}/codeql/qlpacks/"
-    codeql pack download codeql/misra-c-coding-standards@"${codeql_coding_standards_version}" -d "${codeql_install_dir}/codeql/qlpacks/"
-    codeql pack download codeql/cert-cpp-coding-standards@"${codeql_coding_standards_version}" -d "${codeql_install_dir}/codeql/qlpacks/"
-    codeql pack download codeql/cert-c-coding-standards@"${codeql_coding_standards_version}" -d "${codeql_install_dir}/codeql/qlpacks/"
 
-    # slim down codeql bundle (1.7GB -> 1.1 GB) by removing unnecessary language extractors and qlpacks
-    codeql_purge_dirs=(
-        "${codeql_install_dir}/codeql/csharp"
-        "${codeql_install_dir}/codeql/go"
-        "${codeql_install_dir}/codeql/java"
-        "${codeql_install_dir}/codeql/javascript"
-        "${codeql_install_dir}/codeql/python"
-        "${codeql_install_dir}/codeql/qlpacks/codeql/csharp-all"
-        "${codeql_install_dir}/codeql/qlpacks/codeql/csharp-examples"
-        "${codeql_install_dir}/codeql/qlpacks/codeql/csharp-queries"
-        "${codeql_install_dir}/codeql/qlpacks/codeql/go-all"
-        "${codeql_install_dir}/codeql/qlpacks/codeql/go-examples"
-        "${codeql_install_dir}/codeql/qlpacks/codeql/go-queries"
-        "${codeql_install_dir}/codeql/qlpacks/codeql/java-all"
-        "${codeql_install_dir}/codeql/qlpacks/codeql/java-examples"
-        "${codeql_install_dir}/codeql/qlpacks/codeql/java-queries"
-        "${codeql_install_dir}/codeql/qlpacks/codeql/javascript-all"
-        "${codeql_install_dir}/codeql/qlpacks/codeql/javascript-examples"
-        "${codeql_install_dir}/codeql/qlpacks/codeql/javascript-queries"
-        "${codeql_install_dir}/codeql/qlpacks/codeql/python-all"
-        "${codeql_install_dir}/codeql/qlpacks/codeql/python-examples"
-        "${codeql_install_dir}/codeql/qlpacks/codeql/python-queries"
-        "${codeql_install_dir}/codeql/qlpacks/codeql/ruby-all"
-        "${codeql_install_dir}/codeql/qlpacks/codeql/ruby-examples"
-        "${codeql_install_dir}/codeql/qlpacks/codeql/ruby-queries"
-        "${codeql_install_dir}/codeql/qlpacks/codeql/swift-all"
-        "${codeql_install_dir}/codeql/qlpacks/codeql/swift-queries"
-        "${codeql_install_dir}/codeql/ruby"
-        "${codeql_install_dir}/codeql/swift"
-    )
-    for dir in "${codeql_purge_dirs[@]}"; do
-        if [ -d "${dir}" ]; then
-            rm -rf "${dir}"
-        fi
-    done
-fi
+# environments.json selects the tools; providers.json names their extra setup scripts.
+/usr/local/share/score-tools/internal/devcontainer/install.py install-environment s-core-local
 
-# Cleanup
-# REMOVE CONTAINER BUILD DEPENDENCIES
-apt-get remove --purge -y apt-transport-https zstd
 apt-get autoremove -y
 apt-get clean
 rm -rf /var/lib/apt/lists/*