From fca785533befe0db2deb588bf53881caef4ef1ab Mon Sep 17 00:00:00 2001
From: jgrusewski <jgrusewski@localhost>
Date: Wed, 25 Feb 2026 21:16:25 +0100
Subject: [PATCH] ci: add build-devcontainer job

Builds .devcontainer/Dockerfile with Kaniko, pushes to internal
GitLab registry. Triggers on .devcontainer/ changes or manual run.
Authenticates to both internal registry and Scaleway CR (for base image pull).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 .gitlab-ci.yml | 30 ++++++++++++++++++++++++++++++
 1 file changed, 30 insertions(+)

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 77547c5ed..2d0b606ce 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -57,6 +57,36 @@ build-ci-builder:
       --dockerfile "${CI_PROJECT_DIR}/infra/docker/Dockerfile.ci-builder"
       --destination "${CI_BUILDER_IMAGE}"
 
+# --------------------------------------------------------------------------
+# Stage 0b: Build devcontainer image → push to internal GitLab registry
+# --------------------------------------------------------------------------
+build-devcontainer:
+  stage: prepare
+  image:
+    name: gcr.io/kaniko-project/executor:debug
+    entrypoint: [""]
+  tags:
+    - kapsule
+    - docker
+  rules:
+    - if: $CI_PIPELINE_SOURCE == "push"
+      changes:
+        - .devcontainer/**
+      when: on_success
+    - when: manual
+      allow_failure: true
+  before_script:
+    - mkdir -p /kaniko/.docker
+    - |
+      echo "{\"auths\":{\"${INTERNAL_REGISTRY}\":{\"username\":\"${CI_REGISTRY_USER}\",\"password\":\"${CI_REGISTRY_PASSWORD}\"},\"rg.fr-par.scw.cloud\":{\"username\":\"nologin\",\"password\":\"${SCW_SECRET_KEY}\"}}}" > /kaniko/.docker/config.json
+  script:
+    - /kaniko/executor
+      --context "${CI_PROJECT_DIR}"
+      --dockerfile "${CI_PROJECT_DIR}/.devcontainer/Dockerfile"
+      --insecure-registry "${INTERNAL_REGISTRY}"
+      --destination "${REGISTRY}/devcontainer:${CI_COMMIT_SHA}"
+      --destination "${REGISTRY}/devcontainer:latest"
+
 # Base template for Rust jobs — pre-baked CI builder from Scaleway CR
 # Image pre-exists in SCR; rebuild via build-ci-builder when Dockerfile changes
 .rust-base: