chore: misc DevX improvments

Signed-off-by: Emilien Escalle <emilien.escalle@escemi.com>

.devcontainer/devcontainer.json

@@ -1,6 +1,6 @@
 {
   "name": "Debian",
-  "image": "mcr.microsoft.com/devcontainers/base:bullseye",
+  "image": "mcr.microsoft.com/devcontainers/base:debian",
   "features": {
     "ghcr.io/devcontainers/features/common-utils:2": {
       "configureZshAsDefaultShell": true

.github/workflows/__shared-ci.yml

@@ -16,15 +16,6 @@ jobs:
       pull-requests: write
       security-events: write
       statuses: write
-    with:
-      linter-env: |
-        FILTER_REGEX_EXCLUDE=dist/**/*|.github/social-preview.svg|.github/logo.svg
-        VALIDATE_JSCPD=false
-        VALIDATE_TYPESCRIPT_STANDARD=false
-        VALIDATE_TYPESCRIPT_ES=false
-        VALIDATE_TYPESCRIPT_PRETTIER=false
-        VALIDATE_JAVASCRIPT_ES=false
-        VALIDATE_JAVASCRIPT_STANDARD=false
 
   check-nodejs:
     name: Test nodejs

.github/workflows/greetings.yml

@@ -3,7 +3,7 @@ name: Greetings
 on:
   issues:
     types: [opened]
-  pull_request_target: # zizmor: ignore[dangerous-triggers] metadata-only reusable workflow with explicit write permissions and no checkout
+  pull_request:
     branches: [main]
 
 permissions: {}

.github/workflows/semantic-pull-request.yml

@@ -1,7 +1,7 @@
 name: "Pull Request - Semantic Lint"
 
 on:
-  pull_request_target: # zizmor: ignore[dangerous-triggers] validates PR metadata only through a pinned reusable workflow without checkout
+  pull_request:
     types:
       - opened
       - edited

Makefile

@@ -3,6 +3,9 @@
 help: ## Display help
 	@grep -E '^[a-zA-Z_-]+:.*?## .*$$' $(MAKEFILE_LIST) | awk 'BEGIN {FS = ":.*?## "}; {printf "\033[36m%-30s\033[0m %s\n", $$1, $$2}'
 
+setup: ## Install dependencies
+	@npm install
+
 lint: ## Execute linting
 	$(call run_linter,)
 
@@ -17,7 +20,7 @@ lint-fix: ## Execute linting and fix
 	)
 
 ci: ## Execute all formats and checks
-	@npm install
+	$(MAKE) setup
 	@npm audit fix || true
 	@npm run all
 	$(MAKE) lint-fix
@@ -26,14 +29,14 @@ define run_linter
 	DEFAULT_WORKSPACE="$(CURDIR)"; \
 	LINTER_IMAGE="linter:latest"; \
 	VOLUME="$$DEFAULT_WORKSPACE:$$DEFAULT_WORKSPACE"; \
-	docker build --build-arg UID=$(shell id -u) --build-arg GID=$(shell id -g) --tag $$LINTER_IMAGE .; \
+	docker build --platform=linux/amd64 --build-arg UID=$(shell id -u) --build-arg GID=$(shell id -g) --tag $$LINTER_IMAGE .; \
 	docker run \
-		-e DEFAULT_WORKSPACE="$$DEFAULT_WORKSPACE" \
+		--platform=linux/amd64 \
-		-e FILTER_REGEX_EXCLUDE="dist/**/*|.github/social-preview.svg|.github/logo.svg" \
-		-e FILTER_REGEX_INCLUDE="$(filter-out $@,$(MAKECMDGOALS))" \
-		$(1) \
 		-v $$VOLUME \
 		--rm \
+		-e DEFAULT_WORKSPACE="$$DEFAULT_WORKSPACE" \
+		-e FILTER_REGEX_INCLUDE="$(filter-out $@,$(MAKECMDGOALS))" \
+		$(1) \
 		$$LINTER_IMAGE
 endef
 

package.json

@@ -61,6 +61,6 @@
     "version": "20260604100000-migrate-to-vitest"
   },
   "allowScripts": {
-    "esbuild@0.27.7": true
+    "esbuild@0.28.1": true
   }
 }