chore: Copilot cloud-sandbox setup + dev container (hve-core-all preinstall)

[JoshLuedeman]

What this adds

A GitHub Copilot cloud-sandbox setup tailored to this repository's stack, plus a matching dev container. Both pre-install the hve-core-all Copilot CLI plugin from microsoft/hve-core. Three files, no other changes:

• .devcontainer/setup-hve-core.sh — shared, best-effort, non-fatal, idempotent installer for the Copilot CLI + hve-core-all plugin (set -euo pipefail, executable 100755). Every fallible command degrades to a ::warning:: so the sandbox / dev container still starts on failure.
• .github/workflows/copilot-setup-steps.yml — a single copilot-setup-steps job (ubuntu-latest, permissions: contents: read) that checks out (persist-credentials: false), provisions .NET 8 + Node 20 (npm cache), restores repo deps (continue-on-error), runs the installer (continue-on-error, env GITHUB_TOKEN: ${{ github.token }}), and prints tool versions. Triggers: workflow_dispatch + push/pull_request filtered to this workflow's path.
• .devcontainer/devcontainer.json — .NET 8 base image + Node 20 / docker-in-docker / azure-cli features; postCreateCommand installs repo deps then runs the installer.

Detected stack

Area	Detail
Backend	.NET 8 / ASP.NET Core 8 (Scaffold.sln, TargetFramework=net8.0); local tool dotnet-ef 8.0.11
Frontend	Node 20 · React 19 · Vite 7 · TypeScript 5.9 (src/Scaffold.Web, has package-lock.json)
Containers	docker-compose.yml (SQL Server 2025, Postgres 16), per-service Dockerfiles
Cloud	Azure Developer CLI (azure.yaml) + Bicep (infra/)
Other	pre-commit; .editorconfig → LF, 2-space indent, final newline

The Makefile / scripts/*.sh Go targets are unused scaffold-template residue (no go.mod / cmd/); the real commands come from .github/workflows/ci.yml.

Exact build / test / lint commands (from ci.yml)

Backend

dotnet restore
dotnet build --no-restore --configuration Release
dotnet test  --no-build --configuration Release --filter "FullyQualifiedName!~Scaffold.Integration.Tests"

Frontend (src/Scaffold.Web)

npm ci
npm run lint        # eslint .
npx tsc --noEmit
npm run build       # tsc -b && vite build

Action pinning

The new workflow SHA-pins all third-party actions (per the setup requirement), with the version in a trailing comment:

• actions/checkout 11d5960a326750d5838078e36cf38b85af677262 (v4.4.0)
• actions/setup-dotnet 67a3573c9a986a3f9c594539f4ab511d57bb3ce9 (v4.3.1)
• actions/setup-node 49933ea5288caeca8642d1e84afbd3f7d6820020 (v4.4.0)

Note: existing repo workflows (ci.yml, security.yml) use floating tag pins (@v4); this new workflow intentionally hardens to full commit SHAs.

Validation

Check	Result
Copilot Setup Steps workflow on a real ubuntu-24.04 runner	✅ pass (push + pull_request runs, exit 0)
actionlint on the workflow	✅ no errors
jq parse of devcontainer.json	✅ valid JSON
Base image mcr.microsoft.com/devcontainers/dotnet:1-8.0-bookworm	✅ tag exists in MCR
bash -n .devcontainer/setup-hve-core.sh	✅ syntax OK
devcontainer build	⚠️ not run locally — no Docker / devcontainer CLI on the validation host (the workflow itself green-lights the setup-hve-core.sh path end-to-end)

hve-core-all install result — ✅ SUCCESS (cold-start, real runner)

The workflow ran on a fresh GitHub-hosted ubuntu-24.04 runner with GITHUB_TOKEN: contents: read and no pre-installed Copilot CLI, so this exercised the full cold-start path. Verbatim log from the Install hve-core-all plugin step:

==> Setting up GitHub Copilot CLI + hve-core-all plugin...
added 3 packages in 4s
Marketplace "hve-core" added successfully.
Plugin "hve-core-all" installed successfully.
Installed plugins:
  • hve-core-all@hve-core (v3.3.101)
==> hve-core-all setup step complete.

Verify tools step:

dotnet:  10.0.301
node:    v20.20.2
npm:     10.8.2
copilot: GitHub Copilot CLI 1.0.73.
Installed plugins:
  • hve-core-all@hve-core (v3.3.101)

• added 3 packages in 4s → the idempotent guard found no copilot, so npm install -g @github/copilot installed the CLI cold.
• Marketplace "hve-core" added successfully → genuine first-time marketplace add (no fallback needed).
• hve-core-all@hve-core (v3.3.101) appears in copilot plugin list → install confirmed.
• No authentication error occurred; the step exited 0. The || echo "::warning::…" fallbacks were not needed here but keep the step non-blocking in any environment.

(A local git-bash dry-run on Windows earlier reproduced the same success and additionally confirmed the non-fatal "marketplace already registered" fallback path.)

About the other PR checks

This PR changes only the three files above (git diff --name-only main... = the 3 files). The repo's existing CI (ci.yml) and Security Scan workflows run on pull_request with no path filter, so they execute on this PR as well. The Frontend Build & Typecheck job comes from ci.yml and operates on src/Scaffold.Web, which this PR does not touch — any failure there is pre-existing / unrelated to this change and out of scope (three-files-only constraint).

Notes

• Three files only; no unrelated code changed.
• Auto-merge is not enabled.