@getmonoceros/workbench 1.29.2 → 1.31.0

package/bundled-components/features/atlassian/component.yml

@@ -1,7 +1,7 @@
 id: atlassian
 category: feature
 displayName: Atlassian
-description: 'Rovo Dev (`acli rovodev`) and Teamwork Graph (`twg`) CLIs sharing one Atlassian account. Auth persists across rebuilds.'
+description: 'Rovo Dev (`acli rovodev`), Teamwork Graph (`twg`) and Forge (`forge`) CLIs sharing one Atlassian account. Auth persists across rebuilds.'
 documentationURL: https://developer.atlassian.com/cloud/
 options:
   rovodev:
@@ -14,6 +14,11 @@ options:
     default: true
     description: 'Install twg (Teamwork Graph CLI).'
     surface: yml
+  forge:
+    type: boolean
+    default: true
+    description: 'Install the Forge CLI (`forge`) for building Atlassian apps.'
+    surface: yml
   instance:
     type: string
     default: ''
@@ -35,18 +40,36 @@ options:
     description: "Optional Bitbucket app password; only needed for twg's Bitbucket commands."
     surface: env
 feature:
-  version: 1.1.0
+  version: 1.2.0
   persistentHomePaths: [.config/acli, .rovodev, .config/twg, .agents]
   vscodeExtensions: [Atlassian.atlascode]
+  # Forge is keychain-free in a container: instead of `forge login` (which
+  # needs libsecret), Atlassian's documented path is the FORGE_EMAIL /
+  # FORGE_API_TOKEN env vars, read at command time. We hand them to the
+  # workspace runtime env from the shared account options, gated on the
+  # `forge` toggle. Sibling of a service's connectionEnv (ADR 0021).
+  workspaceEnv:
+    - whenOption: forge
+      vars:
+        FORGE_EMAIL: '${email}'
+        FORGE_API_TOKEN: '${apiToken}'
 briefing:
   - whenOption: rovodev
     text: 'Atlassian Rovo Dev — invoke via `acli rovodev`. Pre-authenticated against the Atlassian account configured in the feature options (shared with twg).'
   - whenOption: twg
     text: 'Atlassian Teamwork Graph CLI (`twg`) — work-data access across Jira, Confluence, Bitbucket, JSM and Assets. Pre-authenticated. Sub-skills cover status rollups, engineering work, ops health and context discovery.'
+  - whenOption: forge
+    text: 'Atlassian Forge CLI (`forge`) for building and deploying Forge apps. Authenticated via FORGE_EMAIL / FORGE_API_TOKEN from the shared account (no `forge login` needed in the container).'
 presets:
   twg:
     rovodev: false
     twg: true
+    forge: false
   rovodev:
     rovodev: true
     twg: false
+    forge: false
+  forge:
+    rovodev: false
+    twg: false
+    forge: true

package/bundled-components/features/atlassian/install.sh

@@ -3,25 +3,31 @@
 #
 # Installs Atlassian CLIs that share a single Atlassian account:
 #   - Rovo Dev (acli, default on) — the `acli rovodev` AI agent
-#   - Teamwork Graph (twg, default off)
+#   - Teamwork Graph (twg, default on)
+#   - Forge (forge, default on) — the `@forge/cli` app-dev toolchain
 #
-# Each tool is toggled independently via the `rovodev` / `twg`
-# options. Credentials (instance / email / apiToken) are shared
-# across both tools when set; per-tool post-create hooks under
-# /usr/local/share/monoceros/post-create.d/ perform the
-# non-interactive login on first container start.
+# Each tool is toggled independently via the `rovodev` / `twg` / `forge`
+# options. Credentials (instance / email / apiToken) are shared across
+# the tools when set; rovodev and twg get per-tool post-create hooks
+# under /usr/local/share/monoceros/post-create.d/ that perform the
+# non-interactive login on first container start. Forge has no login
+# hook: it reads FORGE_EMAIL / FORGE_API_TOKEN from the workspace
+# runtime env, which the workbench injects from the shared account
+# options (feature.workspaceEnv) — the keychain-free path Atlassian
+# recommends for containers.
 
 set -euo pipefail
 
 ROVODEV="${ROVODEV:-true}"
 TWG="${TWG:-true}"
+FORGE="${FORGE:-true}"
 INSTANCE="${INSTANCE:-}"
 EMAIL="${EMAIL:-}"
 APITOKEN="${APITOKEN:-}"
 BITBUCKETTOKEN="${BITBUCKETTOKEN:-}"
 
-if [ "${ROVODEV}" != "true" ] && [ "${TWG}" != "true" ]; then
-  echo "[atlassian] both rovodev and twg disabled — nothing to install" >&2
+if [ "${ROVODEV}" != "true" ] && [ "${TWG}" != "true" ] && [ "${FORGE}" != "true" ]; then
+  echo "[atlassian] rovodev, twg and forge all disabled — nothing to install" >&2
   exit 0
 fi
 
@@ -185,4 +191,24 @@ EOF
   fi
 fi
 
+# ─── Forge (@forge/cli) ───────────────────────────────────────────
+if [ "${FORGE}" = "true" ]; then
+  # Forge is a Node CLI; the runtime ships Node, so a global npm install
+  # is enough. No post-create login hook: `forge login` stores creds in
+  # the OS keychain (libsecret on Linux), which we deliberately do not
+  # carry. Instead Forge reads FORGE_EMAIL / FORGE_API_TOKEN at command
+  # time; the workbench injects them into the workspace runtime env from
+  # this feature's `email` / `apiToken` options (feature.workspaceEnv),
+  # so the right account is in scope without a login step here.
+  echo "[atlassian/forge] installing @forge/cli globally via npm"
+  npm install -g @forge/cli
+  forge --version >/dev/null 2>&1 || {
+    echo "[atlassian/forge] ERROR: install completed but \`forge\` is not on PATH" >&2
+    exit 1
+  }
+  if [ -z "${EMAIL}" ] || [ -z "${APITOKEN}" ]; then
+    echo "[atlassian/forge] no email/apiToken set — set them in the container yml so FORGE_EMAIL/FORGE_API_TOKEN reach the shell"
+  fi
+fi
+
 echo "[atlassian] done"

package/bundled-components/languages/dotnet/component.yml

@@ -6,3 +6,8 @@ language:
   feature: ghcr.io/devcontainers/features/dotnet:2
   defaultVersion: latest
   versions: [latest, lts, 10.0, 9.0, 8.0, 7.0, 6.0]
+  # No single C# extension on both registries: ms-dotnettools.csharp is
+  # MS-Marketplace-only, muhammad-sammy.csharp is Open-VSX-only. Listing
+  # both lets VS Code and VSCodium each pick the one its registry has and
+  # silently skip the other. See ADR 0016.
+  vscodeExtensions: [ms-dotnettools.csharp, muhammad-sammy.csharp]

package/bundled-components/languages/go/component.yml

@@ -6,3 +6,4 @@ language:
   feature: ghcr.io/devcontainers/features/go:1
   defaultVersion: latest
   versions: [latest, 1.24, 1.23]
+  vscodeExtensions: [golang.go]

package/bundled-components/languages/java/component.yml

@@ -6,6 +6,7 @@ language:
   feature: ghcr.io/devcontainers/features/java:1
   defaultVersion: latest
   versions: [latest, 21, 17, 11, 8]
+  vscodeExtensions: [vscjava.vscode-java-pack]
 options:
   installMaven:
     type: boolean

package/bundled-components/languages/python/component.yml

@@ -6,3 +6,6 @@ language:
   feature: ghcr.io/devcontainers/features/python:1
   defaultVersion: latest
   versions: [latest, 3.12, 3.11, 3.10, 3.9, 3.8]
+  # Pylance is MS-Marketplace-only (not on Open VSX); VSCodium silently
+  # skips it and keeps ms-python.python. See ADR 0016.
+  vscodeExtensions: [ms-python.python, ms-python.vscode-pylance]

package/bundled-components/languages/rust/component.yml

@@ -6,3 +6,4 @@ language:
   feature: ghcr.io/devcontainers/features/rust:1
   defaultVersion: latest
   versions: [latest, 1.87]
+  vscodeExtensions: [rust-lang.rust-analyzer]

package/bundled-components/services/keycloak/component.yml

@@ -0,0 +1,46 @@
+id: keycloak
+category: service
+displayName: Keycloak
+description: 'Keycloak identity & access management (OAuth2 / OpenID Connect / SAML) for local dev. Reachable in-container as host `keycloak`. Starts in dev mode and imports realm JSON from a repo you mount; see the usage notes.'
+documentationURL: https://www.keycloak.org/
+service:
+  image: quay.io/keycloak/keycloak:26.6
+  defaultPort: 8080
+  # Dev mode + realm import. The Keycloak image has no auto-start default,
+  # so a command is mandatory. `--import-realm` reads every *.json from
+  # /opt/keycloak/data/import at startup (a no-op if the dir is empty).
+  command: start-dev --import-realm
+  # Starts in a host-side second wave AFTER the repo clone (ADR 0025), so a
+  # mounted realm.json / theme from the project is present at boot. No
+  # dataMount: the dev H2 database is ephemeral and re-seeds from the
+  # mounted realm JSON on every apply. No healthcheck: the service is not
+  # in runServices (nothing gates on it) and the image ships no curl.
+  deferStart: true
+  # Rendered as a COMMENTED volumes: scaffold in the yml (the catalog
+  # can't know your repo path). Uncomment + edit to mount realm/theme.
+  exampleVolumes:
+    - projects/<app>/keycloak/realm.json:/opt/keycloak/data/import/<app>.json:ro
+    - projects/<app>/keycloak/theme:/opt/keycloak/themes/<app>
+  connectionEnv:
+    URL: http://${host}:${port}
+    HOST: ${host}
+    PORT: ${port}
+    USER: ${KC_BOOTSTRAP_ADMIN_USERNAME}
+    PASSWORD: ${KC_BOOTSTRAP_ADMIN_PASSWORD}
+options:
+  KC_BOOTSTRAP_ADMIN_USERNAME:
+    type: string
+    default: admin
+    surface: env
+  KC_BOOTSTRAP_ADMIN_PASSWORD:
+    type: string
+    default: admin
+    surface: env
+usageNotes:
+  - 'Realm import: keep your realm export(s) in the repo and bind-mount them into `/opt/keycloak/data/import`. Add an entry to the service `volumes:`, e.g. `projects/<app>/keycloak/realm.json:/opt/keycloak/data/import/<app>.json:ro`. With no mount, Keycloak starts with an empty realm.'
+  - 'Multiple realms from different projects: one file-mount per realm to a distinct target name (two directories cannot mount onto the same target). Keycloak imports every *.json in the import dir.'
+  - 'Custom theme: bind-mount it into `/opt/keycloak/themes/<name>`, e.g. `projects/<app>/keycloak/theme:/opt/keycloak/themes/<app>`, then set `loginTheme`/`accountTheme` to `<name>` in the realm. In dev mode themes are not cached, so edits show on reload.'
+  - 'Paths are relative to the container root (`projects/<app>/...`); Monoceros resolves the bind source for you. Do not turn off the deferred start while mounting a repo file - the file would not exist at boot.'
+  - 'Import is one-way: admin-UI changes live in the Keycloak database, not the file. To keep them, export the realm and overwrite the committed JSON.'
+briefing:
+  - text: 'Keycloak (identity & access management) runs as service `keycloak`. Reach it at `$KEYCLOAK_URL` (admin user `$KEYCLOAK_USER` / `$KEYCLOAK_PASSWORD`). Realms come from JSON files the project mounts into `/opt/keycloak/data/import`; the database is ephemeral and re-seeds from them on each apply.'