feat: install basic tooling

.devcontainer/.env

@@ -0,0 +1,12 @@
+DEVCONTAINER_WORKDIR=/usr/local/devcontainer
+DEVCONTAINER_BUILD_SCRIPT=$DEVCONTAINER_WORKDIR/build/run.sh
+
+PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
+
+HOMEBREW_PREFIX=/home/linuxbrew/.linuxbrew
+PATH=$HOMEBREW_PREFIX/sbin:$HOMEBREW_PREFIX/bin:$PATH
+
+GOPATH=/usr/local/go
+GOBIN=/usr/local/bin
+
+USE_EMOJI=false

.devcontainer/Brewfile

@@ -0,0 +1,49 @@
+brew "actionlint"
+brew "bash-completion@2"
+brew "codespell"
+brew "direnv"
+brew "dotenv-linter"
+brew "editorconfig-checker"
+brew "fd"
+brew "fdupes"
+brew "gcc"
+brew "gh"
+brew "git"
+brew "gitleaks"
+brew "go"
+brew "hadolint"
+brew "htop"
+brew "jq"
+brew "lychee"
+brew "markdownlint-cli"
+brew "markdownlint-cli2"
+brew "moreutils"
+brew "optipng"
+brew "pipx"
+brew "pngcheck"
+brew "pngcrush"
+brew "pngnq"
+brew "pngquant"
+brew "proselint"
+brew "python"
+brew "semgrep"
+brew "shellcheck"
+brew "shfmt"
+brew "sqlfluff"
+brew "svgo"
+brew "syft"
+brew "taplo"
+brew "the_silver_searcher"
+brew "tree"
+brew "trivy"
+brew "yamllint"
+
+# TODO
+# -----------------------------------------------------------------------------
+
+# - [ ] fixred
+# - [ ] brok
+# - [ ] ripgrep
+# - [ ] fzf
+#   - [ ] Install https://github.com/junegunn/fzf in devcontainer
+# - [ ] Install hooks in dotfiles repo

.devcontainer/Dockerfile

@@ -1,13 +1,6 @@
 # Use the latest Debian release
 FROM mcr.microsoft.com/vscode/devcontainers/base:bullseye as base
 
-ENV BREW_BIN='/home/linuxbrew/.linuxbrew/bin'
-ENV SYS_PATH='/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin'
-ENV PATH="${BREW_BIN}:${SYS_PATH}"
-
-COPY . /opt/devcontainer
-WORKDIR /opt/devcontainer
-RUN ./run.d/00_apt.sh && \
-    ./run.d/01_npm.sh && \
-    ./run.d/02_homebrew.sh && \
-    ./run.d/03_system.sh
+COPY . $DEVCONTAINER_WORKDIR
+WORKDIR $DEVCONTAINER_WORKDIR
+RUN ./bootstrap.sh && make build

.devcontainer/Makefile

@@ -0,0 +1,20 @@
+# =============================================================================
+# Container build
+# =============================================================================
+
+.EXPORT_ALL_VARIABLES:
+
+LC_ALL = C # Ensure simplest POSIX locale
+
+# Primary targets
+# =============================================================================
+
+.PHONY: build # Build the container
+# -----------------------------------------------------------------------------
+
+build:
+	echo "TODO: Implement this target"
+	exit 1
+
+.PHONY: build-test # Test the build in the current container
+# -----------------------------------------------------------------------------

.devcontainer/bootstrap.sh

@@ -0,0 +1,4 @@
+#!/bin/sh -ex
+
+sudo apt-get -qq update
+sudo apt-get -qq install -y --no-install-recommends build-essential

.devcontainer/build/run.d/00_init.sh

@@ -0,0 +1,12 @@
+#!/bin/sh -ex
+
+# shellcheck source=.devcontainer/build/sh.d/common
+. ./build/sh.d/common
+print_running "$0"
+
+# Switch default `root` user shell
+sudo sed -i 's,/root:/bin/ash,/root:/bin/bash,' /etc/passwd
+
+# Create the `admin` group (intended for the devcontainer `remoteUser`, to
+# provide write access to necessary directories)
+sudo groupadd -f admin

.devcontainer/build/run.d/01_apt.sh

@@ -0,0 +1,12 @@
+#!/bin/sh -ex
+
+# shellcheck source=.devcontainer/build/sh.d/common
+. ./build/sh.d/common
+print_running "$0"
+
+apt_install \
+    acl \
+    build-essential \
+    cronic \
+    file \
+    gcc

.devcontainer/build/run.d/02_node.sh

@@ -0,0 +1,41 @@
+#!/bin/bash -ex
+
+# shellcheck source=.devcontainer/build/sh.d/common
+. ./build/sh.d/common
+print_running "$0"
+
+NODESOURCE_URL=https://deb.nodesource.com/setup_19.x
+NODESOURCE_SCRIPT=nodesource_setup.sh
+
+YARN_DEB_REPO=https://dl.yarnpkg.com/debian
+YARN_PUBKEY_URL="${YARN_DEB_REPO}/pubkey.gpg"
+YARN_PUBKEY=pubkey.gpg
+YARN_KEY_PATH="/usr/share/keyrings/yarnkey.gpg"
+YARN_LIST=/etc/apt/sources.list.d/yarn.list
+
+tmp_dir="$(mktemp -d)"
+clean() { rm -rf "${tmp_dir}"; }
+trap clean EXIT
+
+(
+    cd "${tmp_dir}"
+    # Set up APT for latest Node.js
+    wget -q "${NODESOURCE_URL}" -O "${NODESOURCE_SCRIPT}"
+    chmod 755 "${NODESOURCE_SCRIPT}"
+    sudo "./${NODESOURCE_SCRIPT}"
+    # Set up APT for latest Yarn
+    wget -q "${YARN_PUBKEY_URL}" -O "${YARN_PUBKEY}"
+    sudo rm -f "${YARN_KEY_PATH}"
+    sudo gpg --dearmor --output "${YARN_KEY_PATH}" "${YARN_PUBKEY}"
+    echo "deb [signed-by=${YARN_KEY_PATH}] ${YARN_DEB_REPO} stable main" \
+        >yarn.list
+    sudo mv yarn.list "${YARN_LIST}"
+)
+
+apt_install \
+    nodejs \
+    yarn
+
+sudo yarn install --global --prefer-dedupe
+
+sudo yarn cache clean --global --force

.devcontainer/build/run.d/03_brew.sh

@@ -0,0 +1,50 @@
+#!/bin/sh -ex
+
+# shellcheck source=.devcontainer/build/sh.d/common
+. ./build/sh.d/common
+print_running "$0"
+
+GH_RAW_URL=https://raw.githubusercontent.com
+INSTALL_SCRIPT=install.sh
+INSTALL_URL="${GH_RAW_URL}/Homebrew/install/HEAD/${INSTALL_SCRIPT}"
+
+user_id="$(id -u)"
+if test "${user_id}" = 0; then
+    # Let Homebrew know it's safe to run as the superuser
+    sudo touch /.dockerenv
+fi
+
+# This assignment will fail if the container environtment variables are not set
+homebrew_prefix="${HOMEBREW_PREFIX:?}"
+
+# Remove any existing Homebrew directory (to ensure a clean install)
+sudo rm -rf "${homebrew_prefix}"
+
+tmp_dir="$(mktemp -d)"
+clean() { rm -rf "${tmp_dir}"; }
+trap clean EXIT
+
+(
+    cd "${tmp_dir}"
+    wget -q "${INSTALL_URL}" -O "${INSTALL_SCRIPT}"
+    chmod 755 "${INSTALL_SCRIPT}"
+    HOMEBREW_NO_EMOJI=1
+    export HOMEBREW_NO_EMOJI
+    NONINTERACTIVE=true
+    export NONINTERACTIVE
+    HOMEBREW_INSTALL_FROM_API=true
+    export HOMEBREW_INSTALL_FROM_API
+    "./${INSTALL_SCRIPT}"
+)
+
+# Copy the `Brewfile` to the Homebrew home directorys so `Brewfile.lock.json`
+# is writeable
+cp Brewfile "${homebrew_prefix}/Brewfile"
+cd "${homebrew_prefix}"
+
+brew update --quiet
+brew bundle install
+brew doctor
+
+brew_cache="$(brew --cache)"
+rm -rf "${brew_cache}"

.devcontainer/build/run.d/04_python.sh

@@ -0,0 +1,39 @@
+#!/bin/sh -ex
+
+# shellcheck source=.devcontainer/build/sh.d/common
+. ./build/sh.d/common
+print_running "$0"
+
+pipx ensurepath
+
+pipx_install() {
+    echo "${@}" | tr ' ' '\0' | xargs -0 -n1 \
+        pipx install --system-site-packages --pip-args='--no-cache-dir'
+}
+
+pipx_install \
+    bandit \
+    black \
+    flake8 \
+    ipython \
+    isort \
+    mypy \
+    pep8 \
+    pipenv \
+    poetry \
+    prospector \
+    pylint \
+    pyright \
+    pyroma \
+    reorder-python-imports \
+    restructuredtext-lint \
+    rstcheck \
+    rstfmt \
+    sourcery \
+    tox \
+    virtualenv \
+    pydocstyle \
+    vulture \
+    yapf
+
+pip3 cache purge

.devcontainer/build/run.d/05_go.sh

@@ -0,0 +1,11 @@
+#!/bin/sh -ex
+
+# shellcheck source=.devcontainer/build/sh.d/common
+. ./build/sh.d/common
+print_running "$0"
+
+go install github.com/client9/misspell/cmd/misspell@latest
+go install github.com/rif/imgdup2go@latest
+
+go clean --cache
+go clean --modcache

.devcontainer/build/run.d/06_haskell.sh

@@ -0,0 +1,27 @@
+#!/bin/sh -ex
+
+# shellcheck source=.devcontainer/build/sh.d/common
+. ./build/sh.d/common
+print_running "$0"
+
+BROK_URL=https://github.com/smallhadroncollider/brok
+RELEASES_URL="${BROK_URL}/releases/download"
+VERSION=1.1.0
+
+DOWNLOAD_FILE="brok-${VERSION}_x86-64-linux.tar.gz"
+DOWNLOAD_URL="${RELEASES_URL}/${VERSION}/${DOWNLOAD_FILE}"
+
+BIN_SCRIPT=brok
+INSTALL_DIR=/usr/local/bin
+
+tmp_dir="$(mktemp -d)"
+clean() { rm -rf "${tmp_dir}"; }
+trap clean EXIT
+
+(
+    cd "${tmp_dir}"
+    wget -q "${DOWNLOAD_URL}" -O "${DOWNLOAD_FILE}"
+    tar -xvzf "${DOWNLOAD_FILE}"
+    chmod 755 "${BIN_SCRIPT}"
+    sudo mv "${BIN_SCRIPT}" "${INSTALL_DIR}"
+)

.devcontainer/build/run.d/07_rust.sh

@@ -0,0 +1,7 @@
+#!/bin/sh -ex
+
+# shellcheck source=.devcontainer/build/sh.d/common
+. ./build/sh.d/common
+print_running "$0"
+
+# TODO: https://github.com/rhysd/fixred

.devcontainer/build/run.d/99_finalize.sh

@@ -0,0 +1,9 @@
+#!/bin/sh -ex
+
+# shellcheck source=.devcontainer/build/sh.d/common
+. ./build/sh.d/common
+print_running "$0"
+
+# Ensure correct permissions of the `/usr/local` directory (so the devcontainer
+# `remoteUser` will have write access)
+sudo chown -R root:admin /usr/local

.devcontainer/build/run.sh

@@ -0,0 +1,12 @@
+#!/bin/sh -e
+
+# This assigment will fail if the container environment variables are not set
+workdir="${DEVCONTAINER_WORKDIR:?}"
+cd "${workdir}"
+
+# Build specific environment variables (i.e., we don't want to leak these into
+# the final container environment)
+DEBIAN_FRONTEND=noninteractive
+export DEBIAN_FRONTEND
+
+run-parts --exit-on-error --regex '\.sh$' ./build/run.d

.devcontainer/build/sh.d/common

@@ -0,0 +1,13 @@
+# shellcheck shell=sh
+
+print_running() {
+    # Bold text, reversed colors, and padded to 79 characters (to stand out
+    # from normal output)
+    printf "\e[1m\e[7mRUNNING: %-79s\e[0m\n" "$*"
+}
+
+apt_install() {
+    sudo apt-get -qq update -y
+    sudo apt-get -qq install -y --no-install-recommends "$@"
+    sudo rm -rf /var/lib/apt/lists/*
+}

.devcontainer/devcontainer.json

@@ -3,9 +3,12 @@
     "dockerfile": "Dockerfile"
   },
   // "remoteUser": "root",
+  "onCreateCommand": ["${DEVCONTAINER_WORKDIR}/scripts/on_create.sh"],
   "updateContentCommand": [
-    "/opt/devcontainer/update-content.sh",
-    "${containerWorkspaceFolder}"
+    "${DEVCONTAINER_WORKDIR}/scripts/update_content.sh"
+  ],
+  "postCreateCommand": [
+    "${DEVCONTAINER_WORKDIR}/scripts/post_create.sh"
   ],
   "customizations": {
     "vscode": {

.devcontainer/life_cycle/on_create.sh

@@ -0,0 +1,9 @@
+#!/bin/sh -e
+
+# This script is run from the workspace directory when the development
+# container is first created, and the results will be cached during the build
+# process for subsequent container starts
+
+# cf. https://containers.dev/implementors/json_reference/#lifecycle-scripts
+
+# ============================================================================

.devcontainer/life_cycle/post_create.sh

@@ -0,0 +1,10 @@
+#!/bin/sh -e
+
+# Finalize container setup when dev container is created
+
+# cf. https://containers.dev/implementors/json_reference/#lifecycle-scripts
+
+# ============================================================================
+
+# TODO: Update repository with `make upgrade` (?) so the cached results are
+# updated at container start time