build: run the dev container on arm64 hosts

.devcontainer/devcontainer-lock.json

@@ -0,0 +1,24 @@
+{
+  "features": {
+    "ghcr.io/devcontainers/features/docker-in-docker:4": {
+      "version": "4.1.0",
+      "resolved": "ghcr.io/devcontainers/features/docker-in-docker@sha256:7d979c4a36d595eb4ab79909caa3f396daf3b6152dcf38e8328ea4eff42206c7",
+      "integrity": "sha256:7d979c4a36d595eb4ab79909caa3f396daf3b6152dcf38e8328ea4eff42206c7"
+    },
+    "ghcr.io/devcontainers/features/github-cli:1": {
+      "version": "1.1.2",
+      "resolved": "ghcr.io/devcontainers/features/github-cli@sha256:7c409bf6316ffd85f04fd92fba85a744282639e603417dd4796409866bdb6805",
+      "integrity": "sha256:7c409bf6316ffd85f04fd92fba85a744282639e603417dd4796409866bdb6805"
+    },
+    "ghcr.io/devcontainers/features/node:2": {
+      "version": "2.1.0",
+      "resolved": "ghcr.io/devcontainers/features/node@sha256:586c9a6f7dd40bd3ba2cd41e7f2f88dcc31fbe5d1442afcbf07ffbc66b686857",
+      "integrity": "sha256:586c9a6f7dd40bd3ba2cd41e7f2f88dcc31fbe5d1442afcbf07ffbc66b686857"
+    },
+    "ghcr.io/devcontainers/features/python:1": {
+      "version": "1.8.0",
+      "resolved": "ghcr.io/devcontainers/features/python@sha256:fbcad6955caeecc5ad3f7886baf652e25cba5225a6c4c2287c536de2e5607511",
+      "integrity": "sha256:fbcad6955caeecc5ad3f7886baf652e25cba5225a6c4c2287c536de2e5607511"
+    }
+  }
+}

.devcontainer/devcontainer.json

@@ -1,4 +1,17 @@
 {
   "name": "Ona",
-  "image": "mcr.microsoft.com/devcontainers/universal:4.0.1-noble"
+  // devcontainers/universal publishes a linux/amd64 manifest only, so it cannot
+  // run natively on arm64 hosts. base:noble keeps the Ubuntu Noble userland the
+  // Ona automations expect and supplies the toolchains through features.
+  "image": "mcr.microsoft.com/devcontainers/base:noble",
+  "features": {
+    "ghcr.io/devcontainers/features/docker-in-docker:4": { "moby": false },
+    "ghcr.io/devcontainers/features/github-cli:1": {},
+    "ghcr.io/devcontainers/features/node:2": {
+      "version": "22",
+      "pnpmVersion": "none"
+    },
+    "ghcr.io/devcontainers/features/python:1": { "version": "3.12" }
+  },
+  "onCreateCommand": "sh .devcontainer/install.sh"
 }

.devcontainer/install.sh

@@ -0,0 +1,32 @@
+#!/bin/sh
+
+set -eu
+
+# Install the development dependencies for the Node.js and Python workflows.
+# Shared by .devcontainer/devcontainer.json and .ona/automations.yml so editors
+# and Ona environments install the same toolchain.
+
+cd "$(dirname "$0")/.."
+
+# Install the pnpm release pinned by packageManager in package.json. Node ships
+# a corepack shim for pnpm, so installing it with npm collides with that shim.
+COREPACK_ENABLE_DOWNLOAD_PROMPT=0
+export COREPACK_ENABLE_DOWNLOAD_PROMPT
+corepack install
+
+# Keep bun aligned with the version pinned in .github/workflows/node-ci.yml.
+npm install --global bun@1.3.14 --no-audit --no-fund
+
+if ! command -v rg >/dev/null 2>&1; then
+    # Refresh only the Ubuntu sources. Dev container features add APT sources of
+    # their own, and apt-get update exits 100 when any configured source fails
+    # validation, which would stop this script before ripgrep installs.
+    sudo apt-get update \
+        -o Dir::Etc::sourcelist=/etc/apt/sources.list.d/ubuntu.sources \
+        -o Dir::Etc::sourceparts=-
+    sudo apt-get install --yes ripgrep
+fi
+
+pnpm --dir sdk/typescript install --frozen-lockfile
+pnpm --dir plugins/codex-security/mcp-app install --frozen-lockfile
+python -m pip install --disable-pip-version-check --no-input -e 'plugins/codex-security[test]'

.gitignore

@@ -14,6 +14,7 @@ __pycache__/
 /codex-security.json
 /findings.json
 /*.sarif
+.pnpm-store/
 
 # Never publish internal-only plugin data.
 .internal/

.ona/automations.yml

@@ -1,18 +1,7 @@
 tasks:
   install:
     name: Install dependencies
-    command: |
-      pnpm_package="$(node -p 'require("./package.json").packageManager.split("+")[0]')"
-      npm install --global "$pnpm_package" bun@1.3.14 --no-audit --no-fund
-      if ! command -v rg >/dev/null 2>&1; then
-        sudo apt-get update \
-          -o Dir::Etc::sourcelist=/etc/apt/sources.list.d/ubuntu.sources \
-          -o Dir::Etc::sourceparts=-
-        sudo apt-get install --yes ripgrep
-      fi
-      pnpm --dir sdk/typescript install --frozen-lockfile
-      pnpm --dir plugins/codex-security/mcp-app install --frozen-lockfile
-      python -m pip install --disable-pip-version-check --no-input -e 'plugins/codex-security[test]'
+    command: sh .devcontainer/install.sh
     triggeredBy:
       - manual
       - prebuild