[KaiSchwarz-cnic]

Jira: RSRMID-3096

Problem

ghCredentialHelper makes gh auth git-credential the only git credential helper, but gh kept its login in ~/.config/gh, which nothing persisted. Every rebuilt container was logged out, and every HTTPS git operation failed with terminal prompts disabled until someone ran gh auth login by hand. Nothing said so.

Change

• Manifest: mounts a per-devcontainer named volume, devbase-gh-${devcontainerId}, at /var/lib/devbase/gh, and sets containerEnv.GH_CONFIG_DIR to that path. No host path is mounted (cf. RSRMID-3052).
• install.sh: creates that directory owned by the remote user (mode 0700). Docker seeds an empty named volume with that ownership.
• Post-create: devbase_check_gh_config_dir proves the directory is writable with a real write. If it is not, it reports the chown / remove-the-volume fix. It never uses sudo and is never fatal.
• Post-attach: devbase_check_gh_login warns and names gh auth login when gh has no token. It uses gh auth token, which is local, needs no network, and honours GH_TOKEN. It runs only with ghCredentialHelper on, is independent of the banner, and always exits 0.
• validate-features.sh: fails when the path disagrees between the mount target, GH_CONFIG_DIR and install.sh.
• Docs: README, NOTES and CLAUDE.md. The mounts rule now allows exactly this one volume. A consumer can stop gh using it by setting their own GH_CONFIG_DIR, but cannot stop the volume from mounting.

Tests

• Features suite: checks the GH_CONFIG_DIR value, that the path is a mount, that it is writable, that a logged-out gh warns while the helper stays configured, that a logged-in gh stays quiet, and that an unwritable directory is reported. minimal.sh checks that no warning appears with the helper off.
• New rebuild job (pnpm features:test:rebuild): brings a scratch devcontainer up, asserts the first-create warning, seeds a login, then rebuilds with --remove-existing-container. It asserts the rebuild produced a new container, that the same volume is attached, that the login survived, and that attach is quiet. ci-success now gates on both jobs.

Not verified locally

There is no Docker daemon in the dev container, so none of the container tests (old or new) have run before this PR. This CI run is their first. Two premises are worth watching: that devcontainer features test applies a Feature's mounts, and that gh accepts the seeded hosts.yml. Each has its own explicit failure message. The new checks have also not yet been shown to go red against a deliberately broken implementation, as CLAUDE.md asks for.

Releases as a minor (feat(devbase)).

🤖 Generated with Claude Code

[github-actions]

🎉 This PR is included in version 2.1.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀