feat: switch base image to GitHub runner and add DevOps tools

[miragecentury]

Replace ubuntu:24.04 base with ghcr.io/actions/runner for native
GitHub Actions runner support. Add skopeo, Argo Workflows CLI,
HashiCorp Packer, and Cloud Native Buildpacks (pack) CLI as
configurable build args.

https://claude.ai/code/session_01RofXXAMZxK4irobNYjYn3W

[Copilot]

Pull request overview

This pull request transitions the container image from a basic Ubuntu base to the official GitHub Actions runner image, adding comprehensive DevOps tooling to create a self-hosted runner capable of building itself. The changes establish a complete CI/CD pipeline with automated version management, security scanning, and tool updates.

Changes:

• Replaced ubuntu:24.04 base image with ghcr.io/actions/runner for native GitHub Actions support
• Added DevOps CLI tools (Argo Workflows, Kargo, pack, skopeo) and build pipeline tools (buildah, dive, trivy, hadolint, yq, pre-commit)
• Implemented automated release workflow with semantic versioning, vulnerability scanning, and multi-tag publishing to GHCR

Reviewed changes

Copilot reviewed 11 out of 11 changed files in this pull request and generated 11 comments.

Show a summary per file

File	Description
Containerfile	Switched to GitHub runner base image; added skopeo, buildah, trivy, dive, hadolint, yq, Argo CLI, Kargo CLI, pack CLI, and pre-commit; added Python 3.12/3.13/3.14 with Poetry and UV
manifest.yaml	Updated build args from Ubuntu-specific to tool version args (RUNNER_VERSION, ARGO_VERSION, KARGO_VERSION, PACK_VERSION, DIVE_VERSION, HADOLINT_VERSION, YQ_VERSION)
README.md	Complete documentation rewrite covering included tools, CI/CD workflows, release process, local development setup, and project structure
.github/workflows/release.yaml	New semantic release workflow with buildah build, hadolint/dive/trivy scanning, and multi-tag push to GHCR
.github/workflows/ci.yaml	New CI workflow with commitlint, hadolint linting, and test build validation
.github/workflows/update-tools.yaml	New automated tool version checker that creates PRs when updates are available
.releaserc.yaml	Semantic release configuration for automated versioning and changelog generation
.pre-commit-config.yaml	Pre-commit hooks for code quality, linting, and commit message validation
.hadolint.yaml	Hadolint configuration defining trusted container registries
.commitlintrc.yaml	Commitlint configuration extending conventional commit rules
.containerignore	Build context exclusions for CI artifacts and configuration files

Comments suppressed due to low confidence (1)

Containerfile:114

• Poetry and UV are installed twice - once in the base stage as root (lines 105-114) and again in the runtime stage as the runner user (lines 127-136). This duplication is wasteful and increases image size unnecessarily. The base stage installations as root won't be available to the runner user anyway. Consider removing lines 105-114 from the base stage since they are properly installed in the runtime stage where they will actually be used.

# Install Poetry latest version and add it to PATH
# hadolint ignore=DL4006
RUN curl -sSL https://install.python-poetry.org | python3 -

# Install UV
# hadolint ignore=DL4006
RUN curl -LsSf https://astral.sh/uv/install.sh | sh

# Add Poetry and UV to PATH
RUN echo "export PATH=\"${APP_HOME}/.local/bin:\$PATH\"" >> ~/.bashrc

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.