ci: add scripts to run and verify the devcontainer

Co-authored-by: Taylor Braun-Jones <taylor@braun-jones.org>

.gitlab/ci/devcontainer-run.sh

@@ -0,0 +1,45 @@
+#!/bin/sh
+
+set -e
+
+# This job runs in a container whose filesystem is `overlayfs`, over which
+# `podman` cannot stack its own `overlay` storage driver:
+#
+#     'overlay' is not supported over overlayfs, a mount_program is required
+#
+# `vfs` copies each layer rather than stacking it, which is slower but asks
+# nothing of the filesystem underneath.  Name it in the environment so that
+# every `podman` command below addresses the same storage, the build included.
+export STORAGE_DRIVER=vfs
+
+readonly dockerfile=".devcontainer/Dockerfile"
+readonly name="cmake-dev-container"
+
+# Build the container image from the devcontainer Dockerfile
+echo "# Building devcontainer image"
+podman build -t "$name" -f "$dockerfile" .devcontainer
+
+# Ensure named volumes exist for ccache and glab-cli cache persistence
+echo "# Ensuring volumes exist"
+podman volume create cmake-dev-ccache 2>/dev/null || true
+podman volume create cmake-dev-glab-cli 2>/dev/null || true
+
+# Run the container with volumes mounted.
+#
+# The job's own container has no cgroup controllers delegated to it, so
+# `podman` cannot place the container it starts under one:
+#
+#     crun: controller `pids` is not available under /sys/fs/cgroup/...
+#
+# Ask for no cgroup at all.  Verification needs no resource limits, and there
+# is nothing to limit them with.  There is no terminal either, so do not ask
+# for one.
+echo "# Starting devcontainer"
+podman run --rm \
+    --cgroups=disabled \
+    -v "$PWD:/home/cmake-dev/workspace:Z" \
+    -v cmake-dev-ccache:/home/cmake-dev/.cache/ccache:Z \
+    -v cmake-dev-glab-cli:/home/cmake-dev/.config/glab-cli:Z \
+    --workdir /home/cmake-dev/workspace \
+    "$name" \
+    .gitlab/ci/devcontainer-verify.sh

.gitlab/ci/devcontainer-verify.sh

@@ -0,0 +1,75 @@
+#!/bin/sh
+
+set -e
+
+# Source CI environment scripts
+. .gitlab/ci/env.sh
+
+# Verify devcontainer volumes are accessible
+echo "# Verifying devcontainer volumes"
+
+# Check ccache volume
+if test -d /home/cmake-dev/.cache/ccache; then
+    echo "ccache volume found at /home/cmake-dev/.cache/ccache"
+    ccache -s 2>/dev/null || echo "ccache stats unavailable (may be fresh)"
+else
+    echo "WARNING: ccache volume not found at expected path"
+fi
+
+# Check glab-cli volume
+if test -d /home/cmake-dev/.config/glab-cli; then
+    echo "glab-cli volume found at /home/cmake-dev/.config/glab-cli"
+else
+    echo "WARNING: glab-cli volume not found at expected path"
+fi
+
+# Verify cmake is available
+echo "# Verifying cmake"
+cmake --version
+
+# Verify ccache is available
+echo "# Verifying ccache"
+ccache --version
+
+# Build a simple test project to verify the devcontainer works
+echo "# Building test project"
+
+# Create a temporary build directory
+mkdir -p /tmp/devcontainer-test
+cd /tmp/devcontainer-test
+
+# Create a minimal C project
+cat > CMakeLists.txt <<cmake
+cmake_minimum_required(VERSION 3.15)
+project(devcontainer-test C)
+
+add_executable(test
+    main.c
+)
+cmake
+
+cat > main.c <<cmake
+#include <stdio.h>
+
+int main(void) {
+    printf("Devcontainer CMake build OK\n");
+    return 0;
+}
+cmake
+
+# Configure with cmake using ccache cache path
+echo "# Configuring with cmake"
+cmake 2>&1 \
+    -GNinja \
+    -S. \
+    -Bbuild
+
+# Build
+echo "# Building"
+ninja -C build 2>&1
+
+# Verify cache was preserved
+echo "# Verifying ccache hit"
+ccache -s 2>/dev/null | head -5 || true
+
+echo "# Devcontainer verification complete"