Add PyPiLibrary, Per-Language Devcontainers, Signing Docs, NuGet Rename

.config/dotnet-tools.json

@@ -9,13 +9,6 @@
       ],
       "rollForward": false
     },
-    "husky": {
-      "version": "0.9.1",
-      "commands": [
-        "husky"
-      ],
-      "rollForward": false
-    },
     "dotnet-outdated-tool": {
       "version": "4.7.1",
       "commands": [

.devcontainer/dotnet/devcontainer.json

@@ -0,0 +1,58 @@
+{
+    "name": "ProjectTemplate (.NET)",
+    "image": "mcr.microsoft.com/devcontainers/dotnet:1-10.0",
+
+    "features": {
+        "ghcr.io/devcontainers/features/common-utils:2": {},
+        "ghcr.io/devcontainers/features/github-cli:1": {}
+    },
+
+    "mounts": [
+        {
+            "source": "${localEnv:HOME}${localEnv:USERPROFILE}/.ssh/id_ed25519.pub",
+            "target": "/home/vscode/.ssh/id_ed25519.pub",
+            "type": "bind",
+            "readonly": true
+        },
+        {
+            "source": "${localEnv:HOME}${localEnv:USERPROFILE}/.config/git/allowed_signers",
+            "target": "/home/vscode/.config/git/allowed_signers",
+            "type": "bind",
+            "readonly": true
+        },
+        {
+            "source": "${localEnv:HOME}${localEnv:USERPROFILE}/.config/gh",
+            "target": "/home/vscode/.config/gh",
+            "type": "bind",
+            "readonly": false
+        }
+    ],
+
+    "remoteUser": "vscode",
+
+    // The bind-mount on macOS hosts surfaces /home/vscode/.ssh as root-owned;
+    // chown it back so writes from inside the container (known_hosts updates
+    // by gh / git) land cleanly. Idempotent on Linux/WSL2.
+    "onCreateCommand": "sudo install -d -m 700 -o vscode -g vscode /home/vscode/.ssh",
+
+    // Restore .NET local tools (csharpier, dotnet-outdated). No git hooks are
+    // installed by default — see README "Optional: enable git hooks locally".
+    "postCreateCommand": ".devcontainer/dotnet/post-create.sh",
+
+    "customizations": {
+        "vscode": {
+            // Mirror of `recommendations` in DotNet.code-workspace.
+            "extensions": [
+                "csharpier.csharpier-vscode",
+                "davidanson.vscode-markdownlint",
+                "editorconfig.editorconfig",
+                "github.vscode-github-actions",
+                "gruntfuggly.todo-tree",
+                "ms-azuretools.vscode-docker",
+                "ms-dotnettools.csdevkit",
+                "streetsidesoftware.code-spell-checker",
+                "yzhang.markdown-all-in-one"
+            ]
+        }
+    }
+}

.devcontainer/dotnet/post-create.sh

@@ -0,0 +1,5 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Restore the .NET local-tool manifest (csharpier, dotnet-outdated).
+dotnet tool restore

.devcontainer/python/devcontainer.json

@@ -0,0 +1,58 @@
+{
+    "name": "ProjectTemplate (Python)",
+    "image": "mcr.microsoft.com/devcontainers/python:1-3.14-bookworm",
+
+    "features": {
+        "ghcr.io/devcontainers/features/common-utils:2": {},
+        "ghcr.io/devcontainers/features/github-cli:1": {}
+    },
+
+    "mounts": [
+        {
+            "source": "${localEnv:HOME}${localEnv:USERPROFILE}/.ssh/id_ed25519.pub",
+            "target": "/home/vscode/.ssh/id_ed25519.pub",
+            "type": "bind",
+            "readonly": true
+        },
+        {
+            "source": "${localEnv:HOME}${localEnv:USERPROFILE}/.config/git/allowed_signers",
+            "target": "/home/vscode/.config/git/allowed_signers",
+            "type": "bind",
+            "readonly": true
+        },
+        {
+            "source": "${localEnv:HOME}${localEnv:USERPROFILE}/.config/gh",
+            "target": "/home/vscode/.config/gh",
+            "type": "bind",
+            "readonly": false
+        }
+    ],
+
+    "remoteUser": "vscode",
+
+    // The bind-mount on macOS hosts surfaces /home/vscode/.ssh as root-owned;
+    // chown it back so writes from inside the container (known_hosts updates
+    // by gh / git) land cleanly. Idempotent on Linux/WSL2.
+    "onCreateCommand": "sudo install -d -m 700 -o vscode -g vscode /home/vscode/.ssh",
+
+    // Install pinned uv and pre-warm the PyPiLibrary venv. No git hooks are
+    // installed by default — see README "Optional: enable git hooks locally".
+    "postCreateCommand": ".devcontainer/python/post-create.sh",
+
+    "customizations": {
+        "vscode": {
+            // Mirror of `recommendations` in Python.code-workspace.
+            "extensions": [
+                "charliermarsh.ruff",
+                "davidanson.vscode-markdownlint",
+                "editorconfig.editorconfig",
+                "github.vscode-github-actions",
+                "gruntfuggly.todo-tree",
+                "ms-azuretools.vscode-docker",
+                "ms-python.python",
+                "streetsidesoftware.code-spell-checker",
+                "yzhang.markdown-all-in-one"
+            ]
+        }
+    }
+}

.devcontainer/python/post-create.sh

@@ -0,0 +1,47 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Install uv (Astral) for the Python project. Idempotent — re-running
+# overwrites in place. The installer drops the binary in $HOME/.local/bin and
+# updates user shell init to add it to PATH for new shells; we add it to the
+# current PATH explicitly so the rest of this script can invoke `uv` without a
+# hard-coded path.
+#
+# uv is pinned to a specific version (via the version-prefixed install URL,
+# https://astral.sh/uv/<version>/install.sh) so a compromised or broken
+# upstream `latest` script cannot silently change what runs on contributors'
+# machines and CI runners. Bump UV_VERSION when you've reviewed release notes.
+#
+# We re-install when uv is missing OR when the installed version doesn't
+# match the pin. The latter handles the case where a contributor (or a
+# previous run with a different pin) left a different uv version on PATH —
+# the pin is what's reproducible and what the lockfile is generated against.
+UV_VERSION="0.11.8"
+installed_uv_version=""
+if command -v uv >/dev/null 2>&1; then
+    installed_uv_version="$(uv --version | awk '{print $2}')"
+fi
+if [[ "$installed_uv_version" != "$UV_VERSION" ]]; then
+    # Download the pinned installer to a temp file first instead of piping
+    # `curl … | sh`. This produces a logged sha256 of exactly the bytes we
+    # ran, so a compromised installer leaves a forensic trail; it also lets
+    # a future change pin a known-good checksum (set EXPECTED_SHA below).
+    installer=$(mktemp -t uv-install.XXXXXX.sh)
+    trap 'rm -f "$installer"' EXIT
+    curl -LsSf "https://astral.sh/uv/${UV_VERSION}/install.sh" -o "$installer"
+    actual_sha=$(sha256sum "$installer" | awk '{print $1}')
+    echo "uv installer (v${UV_VERSION}) sha256: ${actual_sha}" >&2
+    # EXPECTED_SHA="<paste-from-trusted-source>"  # set to enforce
+    if [[ -n "${EXPECTED_SHA:-}" && "${actual_sha}" != "${EXPECTED_SHA}" ]]; then
+        echo "uv installer sha256 mismatch — refusing to run" >&2
+        exit 1
+    fi
+    sh "$installer"
+    export PATH="$HOME/.local/bin:$PATH"
+fi
+
+# Pre-warm uv environment for PyPiLibrary if it exists. Guarded so this script
+# is safe before PyPiLibrary lands in the repo.
+if [[ -f PyPiLibrary/pyproject.toml ]]; then
+    (cd PyPiLibrary && uv sync)
+fi