Copier update: docker actions (#90)

## Why is this change necessary?
Pull in upstream changes


## How does this change address the issue?
Updates


## What side effects does this change have?
N/A


## How is this change tested?
Downstream repo


## Other
Also needed to tweak git_tags.py to follow new ruff-non-src rules

Author: ejfine

.copier-answers.yml

@@ -1,5 +1,5 @@
 # Changes here will be overwritten by Copier
-_commit: v0.0.116
+_commit: v0.0.120
 _src_path: gh:LabAutomationAndScreening/copier-base-template.git
 description: Copier template for creating Python libraries and executables
 install_claude_cli: true

.devcontainer/Dockerfile

@@ -1,14 +1,10 @@
 # base image tags available at https://mcr.microsoft.com/v2/devcontainers/universal/tags/list
 # added the platform flag to override any local settings since this image is only compatible with linux/amd64. since this image is only x64 compatible, suppressing the hadolint rule
 # hadolint ignore=DL3029
-FROM --platform=linux/amd64 mcr.microsoft.com/devcontainers/universal:5.1.5-noble
+FROM --platform=linux/amd64 mcr.microsoft.com/devcontainers/universal:6.0.3-noble
 
 SHELL ["/bin/bash", "-o", "pipefail", "-c"]
 
-# temporary hack until yarn updates its GPG key
-RUN rm /etc/apt/sources.list.d/yarn.list || true && \
-    curl -sS https://dl.yarnpkg.com/debian/pubkey.gpg | gpg --dearmor | tee /etc/apt/keyrings/yarn-archive-keyring.gpg > /dev/null
-
 RUN apt-get update -y && apt-get install -y \
     "bash-completion=$(apt-cache madison bash-completion | awk '{print $3}' | grep '^1:2.11' | head -n 1)" --no-install-recommends \
     && apt-get clean \

.devcontainer/devcontainer.json

@@ -22,12 +22,12 @@
       "extensions": [
         // basic tooling
         // "eamodio.gitlens@15.5.1",
-        "coderabbit.coderabbit-vscode@0.18.5",
+        "coderabbit.coderabbit-vscode@0.19.2",
         "ms-vscode.live-server@0.5.2025051301",
         "MS-vsliveshare.vsliveshare@1.0.5905",
         "github.copilot@1.388.0",
         "github.copilot-chat@0.44.2",
-        "anthropic.claude-code@2.1.117",
+        "anthropic.claude-code@2.1.126",
 
         // Python
         "ms-python.python@2026.5.2026032701",
@@ -54,7 +54,7 @@
         },
         "ruff.nativeServer": "on",
         // TODO: see if there's a way to specify different configurations for different folders
-        "ruff.configuration": "/workspaces/copier-python-package-template/ruff-test.toml", // use the test configuration since it's less restrictive and won't show false positives and underline things
+        "ruff.configuration": "/workspaces/copier-python-package-template/ruff-non-src.toml", // use the non-src configuration since it's less restrictive and won't show false positives and underline things
         "[jsonc][json][javascript][typescript][graphql][css][scss][html][vue]": {
           "editor.defaultFormatter": "esbenp.prettier-vscode",
           "editor.formatOnSave": true
@@ -65,5 +65,5 @@
   "initializeCommand": "sh .devcontainer/initialize-command.sh",
   "onCreateCommand": "sh .devcontainer/on-create-command.sh",
   "postStartCommand": "sh .devcontainer/post-start-command.sh"
-  // Devcontainer context hash (do not manually edit this, it's managed by a pre-commit hook): 1d087024 # spellchecker:disable-line
+  // Devcontainer context hash (do not manually edit this, it's managed by a pre-commit hook): 4ff43210 # spellchecker:disable-line
 }

.devcontainer/install-ci-tooling.py

@@ -7,9 +7,9 @@
 import tempfile
 from pathlib import Path
 
-UV_VERSION = "0.11.7"
-PNPM_VERSION = "10.33.1"
-COPIER_VERSION = "==9.14.3"
+UV_VERSION = "0.11.12"
+PNPM_VERSION = "11.0.9"
+COPIER_VERSION = "==9.15.0"
 COPIER_TEMPLATE_EXTENSIONS_VERSION = "==0.3.3"
 PRE_COMMIT_VERSION = "4.5.1"
 GITHUB_WINDOWS_RUNNER_BIN_PATH = r"C:\Users\runneradmin\.local\bin"
@@ -52,7 +52,7 @@ def main():
         if is_windows:
             uv_env.update({"PATH": rf"{GITHUB_WINDOWS_RUNNER_BIN_PATH};{uv_env['PATH']}"})
             # invoke installer in a pwsh process
-            _ = subprocess.run(
+            _ = subprocess.run(  # noqa: S603 # this is all our own input
                 [
                     pwsh,  # type: ignore[reportPossiblyUnboundVariable] # this matches the conditional above that defines pwsh
                     "-NoProfile",
@@ -64,14 +64,14 @@ def main():
                 env=uv_env,
             )
         else:
-            _ = subprocess.run(
+            _ = subprocess.run(  # noqa: S602 # we need to set shell to true to use the pipe operator, and this is all our own input
                 f"curl -fsSL --connect-timeout 20 --max-time 40 --retry 3 --retry-delay 5 --retry-connrefused --proto '=https' https://astral.sh/uv/{UV_VERSION}/install.sh | sh",
                 check=True,
                 shell=True,
                 env=uv_env,
             )
             # TODO: add uv autocompletion to the shell https://docs.astral.sh/uv/getting-started/installation/#shell-autocompletion
-        _ = subprocess.run(
+        _ = subprocess.run(  # noqa: S603 # this is all our own input
             [
                 uv_path,
                 "tool",
@@ -83,7 +83,7 @@ def main():
             check=True,
             env=uv_env,
         )
-        _ = subprocess.run(
+        _ = subprocess.run(  # noqa: S603 # this is all our own input
             [
                 uv_path,
                 "tool",
@@ -93,7 +93,7 @@ def main():
             check=True,
             env=uv_env,
         )
-        _ = subprocess.run(
+        _ = subprocess.run(  # noqa: S603 # this is all our own input
             [
                 uv_path,
                 "tool",
@@ -105,7 +105,7 @@ def main():
     if not args.no_node:
         pnpm_install_sequence = ["npm -v", f"npm install -g pnpm@{PNPM_VERSION}", "pnpm -v"]
         for cmd in pnpm_install_sequence:
-            cmd = (
+            run_cmd = (
                 [
                     pwsh,  # type: ignore[reportPossiblyUnboundVariable] # this matches the conditional above that defines pwsh
                     "-NoProfile",
@@ -116,46 +116,54 @@ def main():
                 if is_windows
                 else [cmd]
             )
-            _ = subprocess.run(cmd, shell=True, check=True)
+            _ = subprocess.run(run_cmd, shell=True, check=True)  # noqa: S602 # we need shell=True for npm commands, and this is all our own input
     if INSTALL_SSM_PLUGIN_BY_DEFAULT and not args.skip_installing_ssm_plugin:
         with tempfile.TemporaryDirectory() as tmp_dir:
             if is_windows:
                 local_package_path = Path(tmp_dir) / "SessionManagerPluginSetup.exe"
                 # Based on https://docs.aws.amazon.com/systems-manager/latest/userguide/install-plugin-windows.html
                 # no specific reason for that version, just pinning it for best practice
-                _ = subprocess.run(
-                    [
+                _ = subprocess.run(  # noqa: S603 # this is all our own input
+                    [  # noqa: S607 # curl should always be on PATH
                         "curl",
                         "https://s3.amazonaws.com/session-manager-downloads/plugin/1.2.707.0/windows/SessionManagerPluginSetup.exe",
                         "-o",
                         f"{local_package_path}",
                     ],
                     check=True,
                 )
-                _ = subprocess.run(
+                _ = subprocess.run(  # noqa: S603 # this is all our own input
                     [str(local_package_path), "/quiet"],
                     check=True,
                 )
             else:
                 local_package_path = Path(tmp_dir) / "session-manager-plugin.deb"
                 # Based on https://docs.aws.amazon.com/systems-manager/latest/userguide/install-plugin-debian-and-ubuntu.html
                 # no specific reason for that version, just pinning it for best practice
-                _ = subprocess.run(
-                    [
+                _ = subprocess.run(  # noqa: S603 # this is all our own input
+                    [  # noqa: S607 # curl should always be on PATH
                         "curl",
                         "https://s3.amazonaws.com/session-manager-downloads/plugin/1.2.707.0/ubuntu_64bit/session-manager-plugin.deb",
                         "-o",
                         f"{local_package_path}",
                     ],
                     check=True,
                 )
-                _ = subprocess.run(
-                    ["sudo", "dpkg", "-i", str(local_package_path)],
+                _ = subprocess.run(  # noqa: S603 # this is all our own input
+                    [  # noqa: S607 # sudo should always be on PATH
+                        "sudo",
+                        "dpkg",
+                        "-i",
+                        str(local_package_path),
+                    ],
                     check=True,
                 )
-            print("SSM Plugin Manager Version: ")
+            print("SSM Plugin Manager Version: ")  # noqa: T201 # we want the script to print to console for easy viewing
             _ = subprocess.run(
-                ["session-manager-plugin", "--version"],
+                [  # noqa: S607 # session-manager-plugin should be on PATH because we just installed it
+                    "session-manager-plugin",
+                    "--version",
+                ],
                 check=True,
             )
 

.devcontainer/manual-setup-deps.py

@@ -1,11 +1,11 @@
 import argparse
-import enum
 import json
 import os
 import platform
 import shutil
 import subprocess
 import sys
+from enum import StrEnum
 from pathlib import Path
 from typing import Any
 
@@ -53,7 +53,7 @@
 )
 
 
-class PackageManager(str, enum.Enum):
+class PackageManager(StrEnum):
     UV = "uv"
     PNPM = "pnpm"
 
@@ -73,7 +73,7 @@ def __init__(self, json_dict: dict[str, Any]):
             raise NotImplementedError(f"Package manager {self.package_manager} is not supported")
 
 
-def main():
+def main():  # noqa: C901,PLR0912,PLR0915 # TODO: cleanup into some subfunctions
     args = parser.parse_args(sys.argv[1:])
     is_windows = platform.system() == "Windows"
     uv_env = dict(os.environ)
@@ -82,7 +82,9 @@ def main():
     generate_lock_file_only = args.only_create_lock
     check_lock_file = not (args.skip_check_lock or args.optionally_check_lock or generate_lock_file_only)
     if args.skip_check_lock and args.optionally_check_lock:
-        print("Cannot skip and optionally check the lock file at the same time.")
+        print(  # noqa: T201 # we want this to print to console for easy viewing
+            "Cannot skip and optionally check the lock file at the same time."
+        )
         sys.exit(1)
 
     with ENVS_CONFIG.open("r") as f:
@@ -91,10 +93,14 @@ def main():
     for env_dict in envs:
         env = EnvConfig(env_dict)
         if args.no_python and env.package_manager == PackageManager.UV:
-            print(f"Skipping environment {env.path} as it uses a Python package manager and --no-python is set")
+            print(  # noqa: T201 # we want this to print to console for easy viewing
+                f"Skipping environment {env.path} as it uses a Python package manager and --no-python is set"
+            )
             continue
         if args.no_node and env.package_manager == PackageManager.PNPM:
-            print(f"Skipping environment {env.path} as it uses a Node package manager and --no-node is set")
+            print(  # noqa: T201 # we want this to print to console for easy viewing
+                f"Skipping environment {env.path} as it uses a Node package manager and --no-node is set"
+            )
             continue
         if env.package_manager == PackageManager.UV and not UV_PYTHON_ALREADY_CONFIGURED:
             if args.python_version is not None:
@@ -119,7 +125,9 @@ def main():
                 if not generate_lock_file_only:
                     uv_args.append("--check")
                 uv_args.extend(["--directory", str(env.path)])
-                _ = subprocess.run(uv_args, check=True, env=uv_env)
+                _ = subprocess.run(  # noqa: S603 # this is all our own input
+                    uv_args, check=True, env=uv_env
+                )
             elif env.package_manager == PackageManager.PNPM:
                 pass  # doesn't seem to be a way to do this https://github.com/orgs/pnpm/discussions/3202
             else:
@@ -129,7 +137,7 @@ def main():
             if env_check_lock:
                 sync_command.append("--frozen")
             if not generate_lock_file_only:
-                _ = subprocess.run(
+                _ = subprocess.run(  # noqa: S603 # this is all our own input
                     sync_command,
                     check=True,
                     env=uv_env,
@@ -142,18 +150,18 @@ def main():
                 and '"pulumi"' in env.lock_file.read_text()
             ):
                 if not PULUMI_CLI_INSTALL_SCRIPT.exists():
-                    print(
+                    print(  # noqa: T201 # we want this to print to console for easy viewing
                         f"Pulumi CLI install script not found at {PULUMI_CLI_INSTALL_SCRIPT}, skipping Pulumi CLI installation"
                     )
                 else:
-                    _ = subprocess.run(
-                        ["sh", str(PULUMI_CLI_INSTALL_SCRIPT), str(env.lock_file)],
+                    _ = subprocess.run(  # noqa: S603 # this is all our own input
+                        ["sh", str(PULUMI_CLI_INSTALL_SCRIPT), str(env.lock_file)],  # noqa: S607 # sh should always be on PATH
                         check=True,
                     )
         elif env.package_manager == PackageManager.PNPM:
             pnpm_command = ["pnpm", "install", "--dir", str(env.path)]
             if env_check_lock:
-                pnpm_command.append("--frozen-lockfile")
+                pnpm_command[1] = "ci"
             if is_windows:
                 pwsh = shutil.which("pwsh") or shutil.which("powershell")
                 if not pwsh:
@@ -165,7 +173,7 @@ def main():
                     "-Command",
                     " ".join(pnpm_command),
                 ]
-            _ = subprocess.run(
+            _ = subprocess.run(  # noqa: S603 # this is all our own input
                 pnpm_command,
                 check=True,
             )
@@ -180,7 +188,9 @@ def main():
         check=True,
         cwd=REPO_ROOT_DIR,
     )
-    print(result.stdout)
+    print(  # noqa: T201 # we need this to print it out so that other scripts can read it from stdout
+        result.stdout
+    )
 
 
 if __name__ == "__main__":

.github/dependabot.yml

@@ -1,5 +1,16 @@
 version: 2
 updates:
+  - package-ecosystem: "devcontainers"
+    directory: "/"
+    schedule:
+      interval: weekly
+      day: "monday"
+      time: "16:00"
+    open-pull-requests-limit: 5
+    ignore:
+      - dependency-name: "*"
+        update-types:
+          - "version-update:semver-patch" # we don't want to be bothered with patch updates for anything except security updates
   - package-ecosystem: "uv"
     directories:
       - "/"

.github/reusable_workflows/build-docker-image.yaml

@@ -21,6 +21,16 @@ on:
         type: string
         required: false
         default: './'
+      build-contexts:
+        description: 'Additional named build contexts (e.g. "repo-root=.")'
+        type: string
+        required: false
+        default: ''
+      additional-hash-paths:
+        description: 'Space-separated extra file paths (relative to repo root) to include in the build context hash'
+        type: string
+        required: false
+        default: ''
       push-role-name:
         type: string
         description: What's the IAM role name to use for Pushing to the ECR?
@@ -85,7 +95,12 @@ jobs:
         id: calculate-build-context-hash
         run: |
           python3 --version
-          BUILD_HASH=$(python3 .github/workflows/hash_git_files.py ${{ inputs.context }})
+          EXTRA_PATHS="${{ inputs.additional-hash-paths }}"
+          EXTRA_ARGS=""
+          if [ -n "$EXTRA_PATHS" ]; then
+            EXTRA_ARGS="--extra-paths $EXTRA_PATHS"
+          fi
+          BUILD_HASH=$(python3 .github/workflows/hash_git_files.py ${{ inputs.context }} $EXTRA_ARGS)
           echo "build_context_tag=context-${BUILD_HASH}" >> "$GITHUB_OUTPUT"
           echo "Calculated build context tag as: ${BUILD_HASH}"
 
@@ -123,15 +138,16 @@ jobs:
 
       - name: Set up Docker Buildx
         if: ${{ (inputs.save-as-artifact && inputs.push-role-name == 'no-push') || steps.check-if-exists.outputs.status == 'notfound' }}
-        uses: docker/setup-buildx-action@v3.11.1
+        uses: docker/setup-buildx-action@v4.0.0
         with:
-          version: v0.27.0
+          version: v0.33.0
 
       - name: Build Docker Image
         if: ${{ (inputs.save-as-artifact && inputs.push-role-name == 'no-push') || steps.check-if-exists.outputs.status == 'notfound' }}
-        uses: docker/build-push-action@v6.18.0
+        uses: docker/build-push-action@v7.1.0
         with:
           context: ${{ inputs.context }}
+          build-contexts: ${{ inputs.build-contexts }}
           push: ${{ inputs.push-role-name != 'no-push' && steps.check-if-exists.outputs.status == 'notfound' }}
           load: ${{ inputs.save-as-artifact }} # make the image available later for the `docker save` step
           tags: ${{ steps.calculate-build-context-hash.outputs.full_image_tag }}

.github/workflows/ci.yaml

@@ -173,7 +173,7 @@ jobs:
         timeout-minutes: 8  # this is the amount of time this action will wait to attempt to acquire the mutex lock before failing, e.g. if other jobs are queued up in front of it
 
       - name: Cache Pre-commit hooks
-        uses: actions/cache@v5.0.4
+        uses: actions/cache@v5.0.5
         env:
           cache-name: cache-pre-commit-hooks
         with: