From 3001efa0bc4b73d35bbce1133dd945a66990921c Mon Sep 17 00:00:00 2001
From: Michael Bolens <1218380+bolens@users.noreply.github.com>
Date: Sun, 6 Sep 2026 14:08:14 -0600
Subject: [PATCH 1/2] chore(devcontainer): configure repository development
 tools

---
 .devcontainer/.dockerignore     |  5 ++++
 .devcontainer/Dockerfile        | 51 +++++++++++++++++++++++++++++++++
 .devcontainer/README.md         | 29 +++++++++++++++++++
 .devcontainer/devcontainer.json | 39 +++++++++++++++++++++++++
 .devcontainer/post-create.sh    |  5 ++++
 .devcontainer/smoke.sh          | 11 +++++++
 .github/dependabot.yml          | 10 +++++++
 README.md                       |  5 ++++
 8 files changed, 155 insertions(+)
 create mode 100644 .devcontainer/.dockerignore
 create mode 100644 .devcontainer/Dockerfile
 create mode 100644 .devcontainer/README.md
 create mode 100644 .devcontainer/devcontainer.json
 create mode 100644 .devcontainer/post-create.sh
 create mode 100644 .devcontainer/smoke.sh
 create mode 100644 .github/dependabot.yml

diff --git a/.devcontainer/.dockerignore b/.devcontainer/.dockerignore
new file mode 100644
index 0000000..092ccca
--- /dev/null
+++ b/.devcontainer/.dockerignore
@@ -0,0 +1,5 @@
+*
+!Dockerfile
+!install-pwsh-linux.sh
+!ubuntu/Dockerfile
+!arch/Dockerfile
diff --git a/.devcontainer/Dockerfile b/.devcontainer/Dockerfile
new file mode 100644
index 0000000..9096664
--- /dev/null
+++ b/.devcontainer/Dockerfile
@@ -0,0 +1,51 @@
+FROM docker.io/library/node:24-trixie-slim@sha256:50c3b2f6988dfc307b86e5301d69611af31f4789bdf232863b07d3b02fe55ae0 AS node
+FROM ghcr.io/astral-sh/uv:latest@sha256:2bb3ebca0a796a155094a27773d290c4b074572e6107f171d88d086682fd2500 AS uv
+FROM ghcr.io/astral-sh/ruff:latest@sha256:77e0110c04fdfdd7c97657a680aad0faa7c7d2161556d698695e87d608071ac2 AS ruff
+FROM docker.io/rhysd/actionlint:latest@sha256:b1934ee5f1c509618f2508e6eb47ee0d3520686341fec936f3b79331f9315667 AS actionlint
+FROM docker.io/hadolint/hadolint:latest@sha256:32dac94127fd60b7b7e3fbfc65e1383b9b5e25c9bfd7b8536de7a539fe68a12d AS hadolint
+
+FROM mcr.microsoft.com/devcontainers/base:trixie@sha256:b8c3669fb4cc652621b3386517c40ab3e151e827de958d6fe75528798ffb5727
+
+# Distribution packages provide native tools used by this repository.
+# hadolint ignore=DL3008
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    bash \
+    bash-completion \
+    build-essential \
+    ca-certificates \
+    curl \
+    diffutils \
+    file \
+    findutils \
+    gawk \
+    git \
+    jq \
+    less \
+    locales \
+    openssh-client \
+    pkg-config \
+    procps \
+    python3 \
+    python3-pip \
+    python3-venv \
+    ripgrep \
+    shellcheck \
+    sudo \
+    tar \
+    unzip \
+    wget \
+    xz-utils \
+    zip \
+    && rm -rf /var/lib/apt/lists/*
+
+COPY --from=node /usr/local/ /usr/local/
+COPY --from=uv /uv /uvx /usr/local/bin/
+COPY --from=ruff /ruff /usr/local/bin/ruff
+COPY --from=actionlint /usr/local/bin/actionlint /usr/local/bin/actionlint
+COPY --from=hadolint /bin/hadolint /usr/local/bin/hadolint
+
+RUN npm install --global corepack@0.36.0 markdownlint-cli2@0.23.2 \
+    && corepack enable \
+    && UV_TOOL_DIR=/opt/uv-tools UV_TOOL_BIN_DIR=/usr/local/bin uv tool install zizmor==1.30.0
+ENV LANG=C.UTF-8 LC_ALL=C.UTF-8 COREPACK_ENABLE_DOWNLOAD_PROMPT=0
+WORKDIR /workspace
diff --git a/.devcontainer/README.md b/.devcontainer/README.md
new file mode 100644
index 0000000..184a2ef
--- /dev/null
+++ b/.devcontainer/README.md
@@ -0,0 +1,29 @@
+# k1-max-config-backup devcontainer
+
+Open this repository in VS Code and run **Dev Containers: Reopen in
+Container**. A local Docker-compatible engine and the Dev Containers extension
+are required. The first build downloads the pinned tool images and distribution
+packages. Setup installs dependencies from this checkout's lockfiles and runs
+`smoke.sh`. Rebuild the container after Dockerfile changes. Rerun
+`bash .devcontainer/post-create.sh` after changing dependency lockfiles.
+
+Includes Python, Ruff, ShellCheck, actionlint, zizmor and Markdown tooling for
+repository maintenance. This repository has no application runtime to start.
+
+Run from the workspace root:
+
+```sh
+bash scripts/check-development.sh
+```
+
+The editor runs as `vscode`, with its UID adjusted for the local workspace. The
+source is bind-mounted at `/workspace` and is never copied into image layers.
+Use a regular clone when the container cannot see a linked worktree's external
+Git directory. Keep credentials in your local development environment.
+
+`bash .devcontainer/smoke.sh` checks installed tools and checkout access. It
+does not run the application test suite. No application starts automatically.
+Image references include immutable digests. Dependabot monitors the Dockerfiles
+where supported. Distribution packages resolve from the configured Debian
+repositories at build time. Update image pins and rerun setup and native checks
+together. Existing native and Nix workflows remain available independently.
diff --git a/.devcontainer/devcontainer.json b/.devcontainer/devcontainer.json
new file mode 100644
index 0000000..6808c96
--- /dev/null
+++ b/.devcontainer/devcontainer.json
@@ -0,0 +1,39 @@
+{
+  "name": "k1-max-config-backup development",
+  "build": {
+    "dockerfile": "Dockerfile",
+    "context": "."
+  },
+  "workspaceMount": "source=${localWorkspaceFolder},target=/workspace,type=bind",
+  "workspaceFolder": "/workspace",
+  "remoteUser": "vscode",
+  "updateRemoteUserUID": true,
+  "init": true,
+  "postCreateCommand": [
+    "bash",
+    ".devcontainer/post-create.sh"
+  ],
+  "waitFor": "postCreateCommand",
+  "customizations": {
+    "vscode": {
+      "extensions": [
+        "editorconfig.editorconfig",
+        "timonwong.shellcheck",
+        "ms-python.python",
+        "charliermarsh.ruff",
+        "redhat.vscode-yaml",
+        "github.vscode-github-actions"
+      ],
+      "settings": {
+        "terminal.integrated.defaultProfile.linux": "bash",
+        "terminal.integrated.profiles.linux": {
+          "bash": {
+            "path": "/bin/bash"
+          }
+        },
+        "python.defaultInterpreterPath": "/usr/bin/python3",
+        "files.eol": "\n"
+      }
+    }
+  }
+}
diff --git a/.devcontainer/post-create.sh b/.devcontainer/post-create.sh
new file mode 100644
index 0000000..0607544
--- /dev/null
+++ b/.devcontainer/post-create.sh
@@ -0,0 +1,5 @@
+#!/usr/bin/env bash
+# Install checkout dependencies without starting application or host services.
+set -euo pipefail
+cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.."
+bash .devcontainer/smoke.sh
diff --git a/.devcontainer/smoke.sh b/.devcontainer/smoke.sh
new file mode 100644
index 0000000..bd7a7b4
--- /dev/null
+++ b/.devcontainer/smoke.sh
@@ -0,0 +1,11 @@
+#!/usr/bin/env bash
+# Fail setup when the tools or mounted checkout are unavailable.
+set -euo pipefail
+cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.."
+test -w .
+git rev-parse --show-toplevel >/dev/null
+for tool in git bash python3 node shellcheck ruff actionlint hadolint zizmor; do
+  command -v "${tool}" >/dev/null || { echo "Missing development tool: ${tool}" >&2; exit 1; }
+done
+node -e 'if (Number(process.versions.node.split(".")[0]) !== 24) process.exit(1)'
+printf "%s\n" "Development tools ready. See .devcontainer/README.md for repository checks."
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..09f5793
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,10 @@
+version: 2
+updates:
+
+  - package-ecosystem: docker
+    directory: /.devcontainer
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 3
+    commit-message:
+      prefix: chore(deps)
diff --git a/README.md b/README.md
index 7376afc..e84018a 100644
--- a/README.md
+++ b/README.md
@@ -12,3 +12,8 @@ See [development environments](docs/development-environments.md) for locked repo
 
 See [third-party notices](THIRD_PARTY_NOTICES.md) for the project license scope,
 retained upstream notices, and dependency or asset exceptions.
+
+## Devcontainer
+
+See [the devcontainer guide](.devcontainer/README.md) for the repository toolchain,
+setup, checks and platform limits.

From 56a7c321e45a39746e990a912d6d15aa7b833de3 Mon Sep 17 00:00:00 2001
From: bolens <bolens@duck.com>
Date: Sun, 6 Sep 2026 18:11:27 -0600
Subject: [PATCH 2/2] fix(devcontainer): apply dependency update cooldown

---
 .github/dependabot.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 09f5793..895ac8b 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -3,6 +3,8 @@ updates:
 
   - package-ecosystem: docker
     directory: /.devcontainer
+    cooldown:
+      default-days: 7
     schedule:
       interval: weekly
     open-pull-requests-limit: 3