chore: FIx devcontainer python install issue

[Alon Yeshurun (ayeshurun)]

📥 Pull Request

The devcontainer previously relied on the base image's Python setup plus a separate npm-based changie install, which was failing dependency installation. This switches to a custom Dockerfile (pinned Python 3.12-bookworm) that installs build deps and changie via a verified .deb package instead of npm, removes the now-unneeded Node feature, and hardens install_dev_container_dependencies.sh (set -euo pipefail, absolute paths, optional PIP_INDEX_URL override via a git-ignored local.env) so dev container setup is reliable across environments, including restricted-network mirrors.

Changes

• .devcontainer/devcontainer.json: Switched from a fixed base image to build.dockerfile, and removed the node feature (no longer needed since changie is installed via the Dockerfile).
• .devcontainer/local.env.example (new): Documents an optional PIP_INDEX_URL override for use with internal pip mirrors; copy to .devcontainer/local.env (git-ignored) to use.
• scripts/install_dev_container_dependencies.sh: Made executable; added set -euo pipefail; resolves paths relative to the repo root; sources PIP_INDEX_URL from .devcontainer/local.env if present; installs pip requirements only (apt packages and changie moved into the Dockerfile).
• Base image: Switched from python:1-3.12-bullseye (legacy tag format, Debian 11) to python:3-3.12-bookworm (current tag format, Debian 12), needed for a valid, maintained base to build the custom Dockerfile from.

[Copilot]

🟡 Changes recommended

The post-create script’s pip install is likely to fail under the default non-root devcontainer user unless it installs to user/venv or uses elevation, undermining the PR’s reliability goal.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR updates the repository’s devcontainer setup to make dependency installation more reliable by switching to a custom Dockerfile (Debian bookworm) and simplifying the post-create setup script, including an optional PIP_INDEX_URL override via a git-ignored local env file.

Changes:

• Switch .devcontainer/devcontainer.json to build from a repo-local Dockerfile and remove the Node feature (since changie is installed in the image).
• Add .devcontainer/local.env.example and ignore .devcontainer/local.env to support private pip index overrides without committing secrets.
• Harden scripts/install_dev_container_dependencies.sh (strict bash flags, repo-root-relative paths) and reduce it to pip requirements installation.

File summaries

File	Description
scripts/install_dev_container_dependencies.sh	Uses strict bash mode, resolves repo root, optionally reads PIP_INDEX_URL, and installs Python dev/docs requirements.
.gitignore	Ignores .devcontainer/local.env and devcontainer-lock.json to prevent accidental commits.
.devcontainer/local.env.example	Documents how to configure an optional PIP_INDEX_URL override for restricted networks.
.devcontainer/Dockerfile	Installs build deps and installs changie via a verified .deb with SHA256 validation.
.devcontainer/devcontainer.json	Moves from a fixed image reference to building the custom Dockerfile; removes the Node feature.

Review details

• Files reviewed: 4/5 changed files
• Comments generated: 2
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.