fix: Address PR #568 review threads — container startup, caching, caps, lint boundary

- Add podman-version.env with pinned apt version (5.0.2+ds1-4ubuntu1) for
  Renovate-friendly version management
- Source version pin in install step to prevent runner-image drift
- Export GIT_COMMIT/BUILD_UID/BUILD_GID to $GITHUB_ENV so docker-compose.yml
  image tag and user: directive resolve correctly
- Add actions/cache + podman save/load for dev image to avoid rebuilding on
  every CI run (keys on Containerfile/docker-compose.yml/conanfile.py hash)
- Add explicit podman-compose up -d dev + readiness poll (10×2s) so build
  failures abort loudly instead of surfacing as confusing exec errors
- Add cap_add: SYS_PTRACE and security_opt: seccomp:unconfined to dev service
  in docker-compose.yml for ASan/TSan sanitizer builds
- Stabilize dev image tag to :latest and container_name to projectkeystone-dev
- Wrap Configure CMake and Build with clang-tidy steps in
  podman-compose exec -T dev to maintain environment parity with make deps

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Signed-off-by: mvillmow <4211002+mvillmow@users.noreply.github.com>

Author: mvillmow

.github/actions/install-build-deps/action.yml

@@ -96,7 +96,9 @@ runs:
 
     - name: Install Podman and docker-compose
       run: |
-        sudo apt-get install -y podman podman-compose
+        # shellcheck source=/dev/null
+        source "${GITHUB_ACTION_PATH}/podman-version.env"
+        sudo apt-get install -y "podman=${PODMAN_APT_VERSION}" podman-compose
       shell: bash
 
     - name: Start Podman rootless socket
@@ -105,10 +107,56 @@ runs:
         echo "DOCKER_HOST=unix:///run/user/$(id -u)/podman/podman.sock" >> "$GITHUB_ENV"
       shell: bash
 
+    - name: Set container build environment
+      run: |
+        echo "GIT_COMMIT=${{ github.sha }}" >> "$GITHUB_ENV"
+        echo "BUILD_UID=$(id -u)" >> "$GITHUB_ENV"
+        echo "BUILD_GID=$(id -g)" >> "$GITHUB_ENV"
+      shell: bash
+
     - name: Fix workspace permissions for Podman bind mounts
       run: chmod -R a+rwX .
       shell: bash
 
+    - name: Restore dev container image cache
+      id: image_cache
+      uses: actions/cache@v5
+      with:
+        path: /tmp/dev-image.tar
+        key: podman-${{ hashFiles('Containerfile', 'docker-compose.yml', 'conanfile.py') }}
+        restore-keys: |
+          podman-
+
+    - name: Load or build dev container image
+      run: |
+        if [ "${{ steps.image_cache.outputs.cache-hit }}" = "true" ] && podman load -i /tmp/dev-image.tar 2>/dev/null; then
+          echo "Loaded dev image from cache"
+        else
+          DOCKER_HOST="$DOCKER_HOST" podman-compose build dev
+          podman save -o /tmp/dev-image.tar projectkeystone-dev:latest
+        fi
+      shell: bash
+
+    - name: Start dev container
+      run: |
+        DOCKER_HOST="$DOCKER_HOST" podman-compose up -d dev
+      shell: bash
+
+    - name: Wait for dev container readiness
+      run: |
+        for i in $(seq 1 10); do
+          if DOCKER_HOST="$DOCKER_HOST" podman-compose exec -T dev true 2>/dev/null; then
+            echo "Container ready"
+            exit 0
+          fi
+          echo "Waiting for container... attempt $i/10"
+          sleep 2
+        done
+        echo "Container failed to become ready" >&2
+        DOCKER_HOST="$DOCKER_HOST" podman-compose logs dev >&2
+        exit 1
+      shell: bash
+
     - name: Verify Podman works
       run: |
         podman info --format '{{.Host.Security.Rootless}}'

.github/actions/install-build-deps/podman-version.env

@@ -0,0 +1 @@
+PODMAN_APT_VERSION=5.0.2+ds1-4ubuntu1

.github/workflows/_required.yml

@@ -243,32 +243,47 @@ jobs:
         run: make deps
 
       - name: Configure CMake with clang-tidy
+        # `make deps` runs Conan inside the dev container, so the generated
+        # conan_toolchain.cmake references container-internal compiler/library
+        # paths. Configure must therefore run inside the same container or the
+        # toolchain will not resolve — this preserves the environment-parity
+        # goal. We reuse the Makefile's container invocation pattern
+        # (DOCKER_HOST + podman-compose exec -T dev).
         run: |
-          CONAN_TOOLCHAIN=""
-          if [ -f build/conan-deps/conan_toolchain.cmake ]; then
-            CONAN_TOOLCHAIN="-DCMAKE_TOOLCHAIN_FILE=build/conan-deps/conan_toolchain.cmake"
-          fi
-          cmake -S . -B build/x86.debug.clang-tidy \
-            -G Ninja \
-            -DCMAKE_BUILD_TYPE=Debug \
-            -DENABLE_CLANG_TIDY=ON \
-            $CONAN_TOOLCHAIN
+          DOCKER_HOST="${DOCKER_HOST:-}" podman-compose exec -T dev bash -c '
+            CONAN_TOOLCHAIN=""
+            if [ -f build/conan-deps/conan_toolchain.cmake ]; then
+              CONAN_TOOLCHAIN="-DCMAKE_TOOLCHAIN_FILE=build/conan-deps/conan_toolchain.cmake"
+            fi
+            cmake -S . -B build/x86.debug.clang-tidy \
+              -G Ninja \
+              -DCMAKE_BUILD_TYPE=Debug \
+              -DENABLE_CLANG_TIDY=ON \
+              $CONAN_TOOLCHAIN
+          '
 
       - name: Build with clang-tidy
+        # Must run inside the dev container for the same reason as the configure
+        # step: the build consumes the container-generated Conan toolchain and
+        # uses the container's clang/clang-tidy. clang-tidy-output.txt and
+        # clang-tidy-build.rc are written under /workspace, which is bind-mounted
+        # back to the host so the gating step below can read them.
         run: |
           # clang-tidy build often returns non-zero when diagnostics are found.
           # The next step parses clang-tidy-output.txt and decides whether those
           # diagnostics reference real source files (vs. third-party headers).
           # We must capture the build output without aborting the job — but we
           # also must record the build rc for the next step to inspect, rather
           # than silently masking it with continue-on-error.
-          set +e
-          set -o pipefail
-          cmake --build build/x86.debug.clang-tidy -j"$(nproc)" 2>&1 | tee clang-tidy-output.txt
-          rc=${PIPESTATUS[0]}
-          set -e
-          echo "$rc" > clang-tidy-build.rc
-          echo "clang-tidy build exited rc=$rc (gating happens in next step)"
+          DOCKER_HOST="${DOCKER_HOST:-}" podman-compose exec -T dev bash -c '
+            set +e
+            set -o pipefail
+            cmake --build build/x86.debug.clang-tidy -j"$(nproc)" 2>&1 | tee clang-tidy-output.txt
+            rc=${PIPESTATUS[0]}
+            set -e
+            echo "$rc" > clang-tidy-build.rc
+            echo "clang-tidy build exited rc=$rc (gating happens in next step)"
+          '
 
       - name: Fail on clang-tidy errors
         run: |

docker-compose.yml

@@ -41,15 +41,19 @@ services:
       args:
         BUILD_UID: "${BUILD_UID}"
         BUILD_GID: "${BUILD_GID}"
-    image: projectkeystone-dev:${GIT_COMMIT}-dev
-    container_name: projectkeystone-dev-${GIT_COMMIT}
+    image: projectkeystone-dev:latest
+    container_name: projectkeystone-dev
     user: "${BUILD_UID}:${BUILD_GID}"  # Run as host user
     volumes:
       - .:/workspace:Z
     working_dir: /workspace
     stdin_open: true
     tty: true
     command: /bin/bash
+    cap_add:
+      - SYS_PTRACE
+    security_opt:
+      - seccomp:unconfined
     environment:
       - HOME=/workspace/.docker-home  # Avoid permission issues with $HOME
       - GIT_COMMIT=${GIT_COMMIT}