chore: extract postCreate into a script

So that the Codespaces workaround will only be applied on Codespaces.

And also reorganize devcontainer.json.

.devcontainer/devcontainer.json

@@ -1,15 +1,18 @@
 {
   "$schema": "https://raw.githubusercontent.com/devcontainers/spec/main/schemas/devContainer.schema.json",
-  "hostRequirements": {
-    "cpus": 4,
-    "memory": "7gb",
-    "storage": "32gb"
-  },
   "name": "Renovate",
   "dockerFile": "Dockerfile",
   "features": {
     "ghcr.io/devcontainers/features/common-utils:2": {}
   },
+  "capAdd": ["SYS_PTRACE"],
+  "privileged": true,
+  "securityOpt": ["seccomp=unconfined"],
+  "hostRequirements": {
+    "cpus": 4,
+    "memory": "7gb",
+    "storage": "32gb"
+  },
   "customizations": {
     "vscode": {
       "extensions": [
@@ -21,15 +24,7 @@
       ]
     }
   },
-  "runArgs": [
-    "--cap-add=SYS_PTRACE",
-    "--security-opt",
-    "seccomp=unconfined",
-    "--privileged"
-  ],
-  // The chmod command fixes the permissions of /tmp, which for some reason is
-  // broken on GitHub Codespaces
-  "postCreateCommand": "set -ex; sudo chmod 1777 /tmp; yarn install",
+  "postCreateCommand": [".devcontainer/post-create.sh"],
   // Otherwise jest watcher fails because deps were not installed yet
   "waitFor": "postCreateCommand"
 }

.devcontainer/post-create.sh

@@ -0,0 +1,12 @@
+#!/usr/bin/env bash
+
+set -e
+
+if [[ "${CODESPACES}" == true ]]; then
+  echo "Fixing permissions of /tmp for GitHub Codespaces..." >&2
+  sudo chmod 1777 /tmp
+fi
+
+set -x
+
+exec yarn install