Publish devcontainer image storage size in prebuild release notes

[Copilot]

The GHCR package page is the only place to see the devcontainer image size, and it isn't surfaced in the prebuild release notes or artifacts. This adds the compressed, per-platform storage size to the exported release notes and build job summary.

Size is computed in the workflow (not at image build time) since the compressed layer bytes are only known after the manifest is pushed.

Changes

• script/devcontainer-image-size.sh (new): Sums OCI config + layer sizes from docker manifest inspect to report compressed per-platform download size. Handles multi-arch manifest lists and single-arch images.
• .github/workflows/devcontainer-prebuild.yaml:
  • merge job now checks out the repo (previously had no checkout) so the script is available.
  • Export devcontainer release notes appends an ## Image size section to the release notes — uploaded as an artifact and shown in $GITHUB_STEP_SUMMARY.
  • Added the script to push/PR path filters, mirroring the existing manifest script.
• .devcontainer/devcontainer.json: Pin the prebuilt image by digest only (ghcr.io/devsecninja/dotfiles-devcontainer@sha256:...) instead of the combined :latest@sha256:... form. The devcontainers CLI 0.87.0 cannot parse a :tag@digest reference (it leaves the tag in the path and fails path validation), which broke devcontainer up and cascaded into a Feature manifest resolution failure for git-lfs. Digest-only is parseable, keeps the immutable pin, and is stable under Renovate's pinDigests: true.
• Tests (tests/bash/validate-devcontainer.bats): Workflow wiring assertions plus script behavior via a stubbed docker (per-platform output, header, usage-error path), and a regression test asserting the image is pinned by digest only and guarding against the :tag@digest form returning.
• Docs: README and docs/installation.md note the published size.

Example output

## Image size

- `linux/amd64`: 884.0 MB compressed (12 layers)
- `linux/arm64`: 942.0 MB compressed (11 layers)

[DevSecNinja]

@copilot can you fix the CI? Build and start task fails with:

🏗️  Building and starting devcontainer from .devcontainer/devcontainer.json...
[2026-06-02T09:08:06.792Z] @devcontainers/cli 0.87.0. Node.js v22.22.3. linux 6.17.0-1015-azure x64.
[2026-06-02T09:08:06.993Z] Path 'devsecninja/dotfiles-devcontainer:latest' for input 'ghcr.io/devsecninja/dotfiles-devcontainer:latest@sha256:8ffabde8687b710cad726424dcdc2b31264fd9409d08caba0fbbdd162812f3a3' failed validation.  Expected path to match regex '/^[a-z0-9]+([._-][a-z0-9]+)*(\/[a-z0-9]+([._-][a-z0-9]+)*)*$/'.
[2026-06-02T09:08:06.993Z] Error fetching image details: Could not parse image name 'ghcr.io/devsecninja/dotfiles-devcontainer:latest@sha256:8ffabde8687b710cad726424dcdc2b31264fd9409d08caba0fbbdd162812f3a3'
[2026-06-02T09:08:14.981Z] Retrying (Attempt 0) with error 
			  'Command failed: docker pull ghcr.io/devsecninja/dotfiles-devcontainer:latest@sha256:8ffabde8687b710cad726424dcdc2b31264fd9409d08caba0fbbdd162812f3a3
'
[2026-06-02T09:08:52.008Z] Resolving Feature dependencies for 'ghcr.io/devcontainers/features/git-lfs:1'...
[2026-06-02T09:09:13.117Z] Could not resolve Feature manifest for 'ghcr.io/devcontainers/features/git-lfs:1'.  If necessary, provide registry credentials with 'docker login <registry>'.
[2026-06-02T09:09:13.117Z] Could not resolve Feature 'ghcr.io/devcontainers/features/git-lfs:1'.  Ensure the Feature is published and accessible from your current environment.
Error: ERR: Feature 'ghcr.io/devcontainers/features/git-lfs:1' could not be processed.  You may not have permission to access this Feature, or may not be logged in.  If the issue persists, report this to the Feature author.
    at eV (/usr/local/lib/node_modules/@devcontainers/cli/dist/spec-node/devContainersSpecCLI.js:287:4753)
{"outcome":"error","message":"ERR: Feature 'ghcr.io/devcontainers/features/git-lfs:1' could not be processed.  You may not have permission to access this Feature, or may not be logged in.  If the issue persists, report this to the Feature author.","description":"An error occurred setting up the container."}
    at process.processTicksAndRejections (node:internal/process/task_queues:103:5)
    at async wI (/usr/local/lib/node_modules/@devcontainers/cli/dist/spec-node/devContainersSpecCLI.js:287:7321)
    at async kQ (/usr/local/lib/node_modules/@devcontainers/cli/dist/spec-node/devContainersSpecCLI.js:287:7547)
    at async UQ (/usr/local/lib/node_modules/@devcontainers/cli/dist/spec-node/devContainersSpecCLI.js:392:1834)
    at async MI (/usr/local/lib/node_modules/@devcontainers/cli/dist/spec-node/devContainersSpecCLI.js:395:2321)
    at async PQ (/usr/local/lib/node_modules/@devcontainers/cli/dist/spec-node/devContainersSpecCLI.js:395:273)
    at async kp (/usr/local/lib/node_modules/@devcontainers/cli/dist/spec-node/devContainersSpecCLI.js:467:1947)
    at async fG (/usr/local/lib/node_modules/@devcontainers/cli/dist/spec-node/devContainersSpecCLI.js:467:608)
    at async f9 (/usr/local/lib/node_modules/@devcontainers/cli/dist/spec-node/devContainersSpecCLI.js:485:4649)
Error: Process completed with exit code 1.

[Copilot]

@copilot can you fix the CI? Build and start task fails with:

...

Fixed in 1f4c0c3 (latest commit on the branch).

Root cause: the devcontainers CLI 0.87.0 cannot parse the combined :latest@sha256:... reference in .devcontainer/devcontainer.json. Its parser keeps the tag in the path (devsecninja/dotfiles-devcontainer:latest) and fails path validation, so it never registers GHCR credentials — which then cascades into Could not resolve Feature manifest for 'ghcr.io/devcontainers/features/git-lfs:1'.

The image is now pinned by digest only (ghcr.io/devsecninja/dotfiles-devcontainer@sha256:..., no tag), which the CLI parses correctly while keeping the immutable digest pin. Since Renovate runs with pinDigests: true, digest-only is also the stable form — it bumps the digest without re-adding a tag. Added a regression test in tests/bash/validate-devcontainer.bats to guard against the :tag@digest form returning.

@copilot can you fix the CI? Build and start task fails with:

...

Correction: the fix is commit f4de863 (I mistyped the hash above).