fix: devcontainer obj/ files owned by root break incremental builds

[joshsmithxrm]

Summary

• postCreateCommand runs dotnet restore as root in some devcontainer CLI versions, creating obj/ directories owned by root:root
• MSBuild's incremental build fails with MSB3374 because utimensat() requires file ownership to set timestamps — 777 permissions aren't sufficient
• Adds explicit remoteUser: vscode to devcontainer.json and a chown safety net in setup.sh after dotnet restore

Test plan

• Run dev reset to rebuild the container from scratch
• Run dev ppds on main repo — verify build succeeds
• Run dev ppds on a worktree — verify build succeeds
• Verify ls -la src/PPDS.Cli/obj/Debug/net10.0/ shows vscode:vscode ownership

🤖 Generated with Claude Code

[gemini-code-assist]

Summary of Changes

Hello @joshsmithxrm, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request addresses a critical issue in the devcontainer setup where dotnet restore could create build artifacts with incorrect root ownership, leading to incremental build failures. By explicitly setting the remote user and adding a robust ownership correction step, the changes ensure a consistent and functional development environment, improving build reliability and developer experience.

Highlights

• Devcontainer User Configuration: Explicitly configured the remoteUser to vscode in devcontainer.json to ensure that commands within the devcontainer run under the intended user, preventing root-owned file creation.
• File Ownership Safety Net: Implemented a conditional chown command in setup.sh to automatically correct file ownership to vscode:vscode if the postCreateCommand runs as root, specifically targeting obj/ directories created by dotnet restore.
• Incremental Build Fix: Resolved MSB3374 errors that occurred during incremental builds by addressing the root cause of obj/ files being owned by root:root, which prevented MSBuild from setting timestamps due to utimensat() requiring file ownership.

Changelog

• .devcontainer/devcontainer.json
  • Added "remoteUser": "vscode" to ensure commands run as the vscode user.
• .devcontainer/setup.sh
  • Introduced a conditional chown -R 1000:1000 "$(pwd)" command to fix workspace ownership if the script is executed as root.
  • Added comments explaining the purpose of the ownership fix related to dotnet restore and utimensat().

Activity

• The pull request was created by joshsmithxrm to fix devcontainer build issues related to file ownership.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[gemini-code-assist]

Code Review

This pull request addresses an issue with file ownership in the dev container that breaks incremental builds. The fix involves explicitly setting the remoteUser in devcontainer.json and adding a safety net in setup.sh to correct file permissions if the script runs as root. The changes are logical and well-explained. I have one suggestion to improve the robustness of the shell script by using the username vscode instead of a hardcoded UID/GID.

[joshsmithxrm]

@gemini-code-assist review

[joshsmithxrm]

Addressed in 978a40e — using vscode:vscode now. Good catch.

[gemini-code-assist]

Code Review

The pull request addresses an important issue with file ownership in the devcontainer, which can break incremental builds. The scripts/devcontainer.ps1 introduces several instances where the $workdir variable is unsafely concatenated into bash command strings. While in this local development context, with $workdir derived from trusted sources like git worktree names, the risk is primarily related to shell injection from unescaped special characters rather than a high-severity command injection by an attacker, it is still important to address. It is recommended to use positional arguments with bash -c to safely pass variables and prevent unexpected command execution. The file ownership fix in .devcontainer/devcontainer.json and .devcontainer/setup.sh is robust, and the push command simplification (using force-with-lease) is a positive improvement. Future pull requests should ideally separate unrelated changes to streamline the review process.

[joshsmithxrm]

Addressed the shell injection feedback across all 13 call sites in 36baafc. Converted all \ to \ using positional args. Verified the \ pattern passes through the PowerShell → devcontainer exec → docker exec → bash chain correctly.

[joshsmithxrm]

@gemini-code-assist review

[gemini-code-assist]

Code Review

This pull request addresses an issue with file ownership in the devcontainer that was breaking incremental builds. While it successfully hardens scripts/devcontainer.ps1 against command injection vulnerabilities by using parameterized arguments, a new security concern was identified. The recursive chown operation in .devcontainer/setup.sh could be exploited via malicious symbolic links to change the ownership of sensitive system files. Additionally, scripts/devcontainer.ps1 has been refactored to include a new rebase command and a safer push command. I have provided specific feedback regarding the chown vulnerability and a minor suggestion for consistency in the new rebase command.