Add xvec containerized C++ toolchain, devcontainer, and GHCR image workflow

[Copilot]

This adds a repository-owned Ubuntu 24.04 C++ toolchain environment for intel/xvec and wires it into local Docker use, VS Code Dev Containers/Codespaces, and GHCR publishing. The image definition pins the requested compiler/doc/test tooling set, includes Intel SDE with amd64-only handling, and documents the proxy and redistribution constraints around that bundle.

• Toolchain image

  • Adds a root Dockerfile for Ubuntu 24.04 with:
    • GCC/G++ 16 from ppa:ubuntu-toolchain-r/test, selected as default gcc, g++, cc, c++
    • LLVM/Clang 20 toolchain from apt.llvm.org with unversioned alternatives for clang, clangd, clang-format, clang-tidy, lldb
    • Intel oneAPI DPC++/C++ compiler with working icx / icpx
    • MrDocs 2026.9.4 under /opt/mrdocs
    • Intel SDE 10.13.1-2026-07-28 under /opt/intel-sde, exposed as sde, sde64, xed, xed64
    • requested build tools including ccmake and Boost.Test
  • Uses explicit NO_PROXY / no_proxy clearing for external repo/download steps.
  • Fails early on non-amd64 builds and verifies the installed toolchain at build time.

• Dev container

  • Adds .devcontainer/devcontainer.json targeting ghcr.io/intel/xvec-toolchain:latest.
  • Configures SDE-compatible runtime args:
    • --cap-add=SYS_PTRACE
    • --security-opt=seccomp=unconfined
  • Sets clangd/CMake defaults, disables MS C/C++ IntelliSense, and defaults CC=gcc, CXX=g++.
  • Adds a lightweight post-create verification command for the expected tools.

• GHCR publishing

  • Adds .github/workflows/toolchain-image.yml to:
    • build on PRs for validation
    • publish on main
    • support manual dispatch
  • Publishes ghcr.io/intel/xvec-toolchain for linux/amd64 only.
  • Uses Buildx, GHCR login, metadata tagging, GitHub Actions cache, SBOM/provenance, and concurrency cancellation.
  • Includes lightweight validation for the devcontainer metadata and related docs/notices.

• Build context and editor metadata

  • Adds .dockerignore with generated-output and platform junk exclusions while keeping repository-owned devcontainer/editor config needed for image-related validation.
  • Adds .vscode/extensions.json recommending Dev Containers for local repository use.

• Docs

  • Adds docs/development-container.md covering:
    • proxy-aware and normal Docker builds
    • manual docker run with workspace bind mounts
    • SDE runtime permissions vs installation
    • VS Code Dev Containers workflow, rebuild flow, compiler switching, and build/ usage
    • GHCR image name/tag behavior and access expectations
    • linux/amd64 / Codespaces caveats
  • Links the new page from README.md.

• Licensing / redistribution

  • Updates third-party-programs.txt for MrDocs and Intel SDE.
  • Documents the current Intel SDE redistribution caveat conservatively: bundled license materials indicate redistribution of the unmodified package may be allowed with notices preserved, but the exact pinned release should still be confirmed before making the GHCR package broadly public.

Example local proxy build now documented in-repo:

sudo docker build --no-cache --progress=plain \
  --build-arg HTTP_PROXY="${HTTP_PROXY:-$http_proxy}" \
  --build-arg HTTPS_PROXY="${HTTPS_PROXY:-$https_proxy}" \
  --build-arg http_proxy="${http_proxy:-$HTTP_PROXY}" \
  --build-arg https_proxy="${https_proxy:-$HTTPS_PROXY}" \
  --build-arg NO_PROXY= \
  --build-arg no_proxy= \
  -t xvec-toolchain:latest .

[danieltowner]

@copilot Pleas make icx the default tool chain.

[Copilot]

@copilot Pleas make icx the default tool chain.

Addressed in c10c026 by switching the devcontainer/CMake defaults to icx and icpx, and updating the developer-container docs to match.

[danieltowner]

@copilot Remove the documentation note about SDE redistribution.

[Copilot]

@copilot Remove the documentation note about SDE redistribution.

Addressed in 2cc7c94 by removing the SDE redistribution note from docs/development-container.md.

[Copilot]

Copilot review overview

🟡 Changes recommended

Unresolved critical and moderate findings affect workflow security, artifact integrity, publication, runtime configuration, and compiler selection.

Get a fresh assessment by requesting another Copilot review.

Review effort: Lite
Findings: 2 · 1

Open (3)

• PR workflow grants package write access while executing untrusted code · New
• MrDocs download lacks integrity verification · New
• Missing oneAPI environment initialization breaks compiler linking and runtime · New

What changed in this PR

Adds a containerized Ubuntu 24.04 C++ toolchain, Dev Container configuration, GHCR publishing workflow, documentation, and licensing metadata.

Changes:

• Adds GCC, Clang, oneAPI, MrDocs, Intel SDE, CMake, and Boost tooling.
• Adds Docker, Dev Container, VS Code, and GHCR workflow configuration.
• Documents usage, proxy builds, compiler selection, and redistribution terms.

File	Summary
third-party-programs.txt	Documents MrDocs and Intel SDE redistribution terms.
README.md	Links to container development documentation.
docs/​development-container.md	Documents builds, usage, compiler switching, and GHCR behavior.
Dockerfile	Defines the toolchain image. Findings: critical unverified MrDocs download (3 votes); moderate oneAPI runtime setup and proxy handling; nit inaccurate license label.
.vscode/​extensions.json	Recommends Dev Containers.
.github/​workflows/​toolchain-image.yml	Builds and publishes the image. Findings: critical PR packages: write permissions; moderate unconditional publication and redistribution gating.
.dockerignore	Controls Docker build context.
.devcontainer/​devcontainer.json	Configures Dev Containers. Finding: moderate hard-coded compiler settings override environment selection.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Fixed in d8c0095: the workflow now runs validation builds with packages: none and isolates publishing to a separate job that only runs on pushes to main with packages: write.

[Copilot]

Addressed in 23a8ed2 by pinning the MRDocs release SHA-256 in the Dockerfile and verifying the downloaded archive before extraction.

[Copilot]

Fixed in 871e2b7.