Make Codespace creation pull a prebuilt Sample App development image

[rmcdaniel]

Problem

Creating a GitHub Codespace from main currently spends more than 400 seconds constructing the development environment before the sample application is usable. The current path starts from a general operating-system image and performs operating-system repository setup, PHP and extension installation, Node and Composer installation, database-client setup, and a Playwright browser/dependency download inside each new Codespace. This is the first interaction many evaluators have with the Sample App, and it is too slow and fragile.

Product outcome

A fresh Codespace should pull a prepared, public development image and reserve per-Codespace startup for repository-specific dependency/bootstrap work. The image must remain reproducible, regularly refreshed, usable on common local development hosts, and safe for untrusted pull requests.

Acceptance criteria

• The main Codespace path consumes a prebuilt public development image. Codespace creation does not run an operating-system package manager, add third-party package repositories, install PHP/Node/Composer, or download Playwright browsers.
• The prepared image contains the supported PHP 8.4 runtime and required extensions, Composer 2, Node 22, the Playwright-compatible Chromium runtime and system dependencies, FFmpeg, Git, Curl, and the database/Redis client support actually exercised by the Sample App.
• The same build publishes public images to ghcr.io/durable-workflow/sample-app-devcontainer and durableworkflow/sample-app-devcontainer, with coherent immutable revision tags plus a documented moving channel for main. AMD64 and ARM64 consumers are supported, or an evidence-backed architecture limitation is surfaced before completion.
• Image publication runs only from protected repository state. Pull requests can build and validate the image without registry credentials, package-write permission, deployment secrets, or a cache that can later influence a privileged publication job. Third-party Actions are pinned to reviewed immutable revisions.
• Published images carry source/revision metadata and verifiable provenance/SBOM output. Relevant image inputs trigger a rebuild, and a scheduled protected-main rebuild keeps operating-system and browser layers current.
• A clean qualification pulls the published image, starts the Codespace Compose topology without an image build, installs only repository dependencies, and reaches the application health endpoint with PHP, Composer, Node, Playwright/Chromium, and editable mounted files verified as the non-root development user.
• Qualification records phase timings for image pull, container readiness, dependency bootstrap, and application readiness. Fresh startup is materially below the observed 400+ second path, and a warm rebuild does not repeat immutable environment setup.
• Failure to pull or qualify the published image fails clearly; the configuration does not silently fall back to rebuilding the old slow environment.

Completion condition

Close when both registries serve the qualified image from the protected main revision, the repository's default Codespace path consumes it without an environment build, public CI is green, and retained timing evidence demonstrates the improved fresh and warm startup paths.

[rmcdaniel]

Fresh-main qualification update: the observed Codespace remained in the GitHub Provisioning state more than 18 minutes after creation on a 2-core machine, and creation logs were still unavailable. This confirms the P0 is the immutable environment build path itself, not a small post-create delay. Completion evidence must measure a fresh image pull and application readiness separately and demonstrate that new Codespaces no longer build the development image.

[rmcdaniel]

Fresh Codespace timing evidence after the prebuilt-image landing confirms that the old in-Codespace image build is gone, but the completion condition is not yet met:

• devcontainer image pull: 199.9s
• MariaDB image pull: 99.3s
• Redis image pull: 69.4s
• database healthy / application containers started: approximately 106.7s after Compose startup

The published image was pulled successfully and no fallback build occurred. Keep this P0 open until one qualification records end-to-end Codespace creation through application health, separates overlapping pull/readiness phases, proves the non-root toolchain/browser checks, and demonstrates the warm path. The current image-pull size is still a material first-run cost even though it is better than rebuilding the environment.