Repository navigation
Moved the devcontainer and Amp to the host dev flow - #31746
Conversation
no ref The devcontainer and Amp were the last users of the containerised `pnpm dev:docker` flow. Running the same `pnpm dev` as a laptop lets that flow be deleted later without breaking either, and drops the Caddy gateway and the ghost-dev image build from both.
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info
📜 Recent review details
WalkthroughThe development setup now uses a Node-based devcontainer and Suggested reviewers: Priority: ⬇️ Low Change: Refactor Merge Risk | ⚪ Minimal · up to
|
| Check name | Status | Explanation | Resolution |
|---|---|---|---|
| Type-Safe Boundaries |  |
The PR adds HTTP-boundary handling in apps/admin/vite-front-door.ts at lines 82-88. It reads x-forwarded-host, x-forwarded-proto, origin, and host, then constructs a new Origin. The code c… |
Add a boundary schema for the relevant request headers. Validate x-forwarded-host as a valid host and x-forwarded-proto against the allowed protocol values before constructing Origin. Validate the other header values used in the compa… |
✅ Passed checks (5 passed)
-
Check name Status Explanation Title check The title clearly summarizes the primary change: moving the devcontainer and Amp to the host development flow. Description check The description directly explains the devcontainer, Amp, Codespaces origin handling, removed files, updated tasks, and testing results. Linked Issues check Check skipped because no linked issues were found for this pull request. Out of Scope Changes check Check skipped because no linked issues were found for this pull request. New Files Are Typescript The pull-request diff adds no files. It only modifies existing files and deletes two files. Therefore, it does not add a new .js, .jsx, .cjs, or .mjs source file.
Full details: Type-Safe Boundaries
-
Explanation
The PR adds HTTP-boundary handling in
apps/admin/vite-front-door.tsat lines 82-88. It readsx-forwarded-host,x-forwarded-proto,origin, andhost, then constructs a newOrigin. The code checks only that two values are strings. It does not validate that the host and protocol have valid, allowed formats before using them. No Zod schema or equivalent boundary validator is present. The changed code adds noany, uncheckedas,@ts-nocheck, or@ts-ignore.Resolution
Add a boundary schema for the relevant request headers. Validate
x-forwarded-hostas a valid host andx-forwarded-protoagainst the allowed protocol values before constructingOrigin. Validate the other header values used in the comparison, and skip the rewrite when parsing fails. Use the parsed values only after successful validation.
- Fix all pre-merge checks with AI
✨ Finishing Touches
-
📝 Generate docstrings
-
-
- Commit to this branch
- Create a new PR
-
🧪 Generate unit tests (beta)
-
- Commit to this branch
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Comment @coderabbitai help to get the list of available commands.
|
| Command | Status | Duration | Result |
|---|---|---|---|
nx run @tryghost/admin:test:acceptance --shard=3/3 |
✅ Succeeded | 6m 11s | View ↗ |
nx run @tryghost/admin:test:acceptance --shard=2/3 |
✅ Succeeded | 5m 41s | View ↗ |
nx run @tryghost/admin:test:acceptance --shard=1/3 |
✅ Succeeded | 4m 41s | View ↗ |
nx run ghost:test:integration |
✅ Succeeded | 1m 57s | View ↗ |
nx run ghost:test:ci:unit |
✅ Succeeded | 1s | View ↗ |
nx run-many -t test:unit -p @tryghost/adapter-b... |
✅ Succeeded | 3m 7s | View ↗ |
nx run ghost:test:e2e |
✅ Succeeded | 3m 26s | View ↗ |
nx run @tryghost/koenig-lexical:test:acceptance... |
✅ Succeeded | 2m 26s | View ↗ |
Additional runs (16) |
✅ Succeeded | ... | View ↗ |
💡 Verify your cache is correct by running tasks in a sandbox. Read docs ↗
☁️ Nx Cloud last updated this comment at 2026-10-10 18:50:15 UTC
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #31746 +/- ##
==========================================
+ Coverage 85.13% 85.15% +0.02%
==========================================
Files 1365 1365
Lines 51276 51276
Branches 8809 8809
==========================================
+ Hits 43652 43665 +13
+ Misses 6544 6511 -33
- Partials 1080 1100 +20
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
no ref Codespaces forwards ports from the VM host, not from inside the devcontainer, so the forwarded 2368 URL returned 502 until the devcontainer service published the port. The gateway used to publish it.
no ref Codespaces' forwarded URL rewrites Host and same-origin Origin headers to localhost:2368, so Ghost rejected Admin sign-in and every write against the https url the script set. Ghost's default localhost url matches what it receives.
no ref Codespaces' port forwarding rewrites a same-origin Origin to localhost:2368 but leaves the Referer alone, so whichever url Ghost had, half of Admin's requests failed its origin check. With the https url back and the Admin dev server undoing the Origin rewrite, Admin works through the forwarded URL and Ghost's images and site links point at it.
1 participant
no ref
The devcontainer and Amp were the last users of the container flow (
pnpm dev:docker, the ghost-dev image and the Caddy gateway), so that flow couldn't be deleted.node:22.23.3-bookwormimage. It runspnpm devagainst MySQL, Redis and Mailpit by service name, and publishes 2368 because Codespaces forwards ports from the host.localhost:2368but leaves the Referer alone, so Admin failed Ghost's origin check whicheverurlGhost had. The Admin dev server now undoes that rewrite, and Ghost keeps the forwarded httpsurl.pnpm devon its portal port withurl=$PUBLIC_URL.devcontainer-build.ymlandcompose.dev.orb.yaml. The VS Code dev tasks now runpnpm dev.Tested in a real Codespace with browser-shaped requests. Login,
users/me, post create, image upload and load, the site and HMR all work, and foreign origins are still rejected. VS Code desktop's localhost forward fails the origin check, as it did before. Amp is untested.