ci: centralize dev-env image version + bump to v1.2.0

[marc0olo]

What

Centralizes the icp-dev-env CI image version into a single source, bumps it to v1.2.0, and fixes a few image-variant mismatches. Previously the version was hardcoded across ~60 workflow files plus the devcontainer, which had already drifted (devcontainer was on 0.3.1 while CI was on 1.0.1).

Changes (net, vs master)

• New .github/workflows/_run-example.yml — a reusable (workflow_call) workflow that runs an example's CI steps inside the dev-env container. It is the single source of truth for the CI image version. Callers pass language (image variant), working-directory, and run (commands). Examples needing a PocketIC server use the optional install-pocketic / pocketic-version inputs.
• All example workflows converted to thin callers of _run-example.yml — no workflow hardcodes the image version anymore. Extra setup steps (apt installs, rustup target add, model download) are folded into run; PocketIC integration tests use install-pocketic.
• New .github/workflows/dev-env-version-check.yml — fails the PR if the devcontainer and the reusable workflow drift to different versions.
• .devcontainer/devcontainer.json bumped icp-dev-env-all:0.3.1 → v1.2.0.
• Image-variant fixes: frontend-only hosting/react and hosting/oisy-signer-demo now use the all image (were incorrectly on motoko), consistent with the other hosting/* examples.
• .github/workflow-template.yml updated to the caller pattern.

Tag convention (v-prefix)

The dev-env release CI tags each release with a v prefix and publishes both forms to the registry — type=ref,event=tag yields v1.2.0, type=semver,pattern={{version}} yields 1.2.0. We pin the v-prefixed form (v1.2.0) to match the git release tag. dev-env-version-check.yml extracts the numeric X.Y.Z from both files, so the prefix does not affect the drift check.

Not touched: basic_bitcoin (bespoke workflow — needs a bitcoind regtest node and Docker bind-mounts, so it can't use the shared container-based workflow) and ninja_pr_checks (uses the unrelated -slim image on a Node-version tag scheme).

Result

Bumping the dev-env version is now a one-line change in _run-example.yml + devcontainer.json (kept equal by dev-env-version-check). Because each caller watches _run-example.yml in its paths:, a bump automatically re-runs every affected example — which is what this PR itself does: all example suites run against v1.2.0.

Validation

The v1.2.0 images are published (via dfinity/icp-dev-env#43), and all 63 checks pass on this PR: every example suite (Motoko + Rust, including the PocketIC and ML examples — image-classification, face-recognition), plus the dev-env-version-check drift guard with both places on v1.2.0.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR centralizes the ghcr.io/dfinity/icp-dev-env-* container image version used by CI into a single reusable workflow, bumps the dev-env version to 1.1.0, and adds a guard workflow to prevent the devcontainer and CI image versions from drifting.

Changes:

• Introduces a reusable workflow (.github/workflows/_run-example.yml) as the single source of truth for the CI dev-env image tag (now 1.1.0) and optional PocketIC installation.
• Converts many example workflows into thin callers of the reusable workflow (eliminating per-workflow hardcoded image tags).
• Adds a version-drift check workflow and bumps the devcontainer image to 1.1.0; updates the workflow template to the new caller pattern.

Reviewed changes

Copilot reviewed 65 out of 65 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
.devcontainer/devcontainer.json	Bumps devcontainer image to icp-dev-env-all:1.1.0.
.github/workflows/_run-example.yml	Adds reusable workflow; centralizes CI container tag at 1.1.0 and PocketIC install option.
.github/workflows/dev-env-version-check.yml	Adds PR guard to ensure devcontainer and CI dev-env versions match.
.github/workflow-template.yml	Updates template to use the reusable workflow caller pattern.
.github/workflows/backend_only.yml	Switches to reusable workflow caller.
.github/workflows/backend_wasm64.yml	Switches to reusable workflow caller.
.github/workflows/basic_ethereum.yml	Switches to reusable workflow caller.
.github/workflows/canister-info.yml	Switches to reusable workflow caller.
.github/workflows/canister-snapshot-download.yml	Switches to reusable workflow caller.
.github/workflows/canister-snapshots.yml	Switches to reusable workflow caller.
.github/workflows/canister_factory.yml	Switches to reusable workflow caller.
.github/workflows/canister_logs.yml	Switches to reusable workflow caller.
.github/workflows/candid_type_generation.yml	Switches to reusable workflow caller.
.github/workflows/cert-var.yml	Switches to reusable workflow caller.
.github/workflows/composite_query.yml	Switches to reusable workflow caller.
.github/workflows/daily_planner.yml	Switches to reusable workflow caller.
.github/workflows/evm_block_explorer.yml	Switches to reusable workflow caller.
.github/workflows/exchange-rates.yml	Switches to reusable workflow caller.
.github/workflows/face-recognition.yml	Switches to reusable workflow caller.
.github/workflows/filevault.yml	Switches to reusable workflow caller.
.github/workflows/flying_ninja.yml	Switches to reusable workflow caller.
.github/workflows/guards.yml	Switches to reusable workflow caller; routes PocketIC via reusable workflow inputs.
.github/workflows/hello_cycles.yml	Switches to reusable workflow caller.
.github/workflows/hello_world.yml	Switches both Motoko and Rust jobs to reusable workflow caller.
.github/workflows/hosting-godot-html5-template-example.yml	Switches to reusable workflow caller.
.github/workflows/hosting-photo-storage-example.yml	Switches to reusable workflow caller.
.github/workflows/hosting-static-website-example.yaml	Switches to reusable workflow caller.
.github/workflows/hosting-unity-webgl-example.yaml	Switches to reusable workflow caller.
.github/workflows/ic_pos.yml	Switches to reusable workflow caller.
.github/workflows/icp_transfer.yml	Switches both Motoko and Rust jobs to reusable workflow caller.
.github/workflows/icrc2-swap.yml	Switches to reusable workflow caller.
.github/workflows/image-classification.yml	Switches to reusable workflow caller (keeps custom setup in run).
.github/workflows/inter-canister-calls.yml	Switches to reusable workflow caller.
.github/workflows/llm_chatbot.yml	Switches both Motoko and Rust jobs to reusable workflow caller.
.github/workflows/low_wasm_memory.yml	Switches both Motoko and Rust jobs to reusable workflow caller.
.github/workflows/oisy_signer_demo.yml	Switches to reusable workflow caller (uses all variant).
.github/workflows/parallel_calls.yml	Switches all jobs to reusable workflow caller (including multi-subnet jobs).
.github/workflows/performance_counters.yml	Switches to reusable workflow caller.
.github/workflows/periodic_tasks.yml	Switches to reusable workflow caller.
.github/workflows/photo_gallery.yml	Switches to reusable workflow caller.
.github/workflows/pub-sub.yml	Switches to reusable workflow caller.
.github/workflows/qrcode.yml	Switches to reusable workflow caller.
.github/workflows/query_stats.yml	Switches both Motoko and Rust jobs to reusable workflow caller.
.github/workflows/random_maze.yml	Switches to reusable workflow caller.
.github/workflows/react.yml	Switches to reusable workflow caller (uses all variant).
.github/workflows/receiving-icp.yml	Switches to reusable workflow caller.
.github/workflows/send_http_get.yml	Switches both Motoko and Rust jobs to reusable workflow caller.
.github/workflows/send_http_post.yml	Switches both Motoko and Rust jobs to reusable workflow caller.
.github/workflows/simd.yml	Switches to reusable workflow caller.
.github/workflows/stake_neuron_from_cli.yml	Switches to reusable workflow caller.
.github/workflows/superheroes.yml	Switches to reusable workflow caller.
.github/workflows/threshold-ecdsa.yml	Switches both Motoko and Rust jobs to reusable workflow caller.
.github/workflows/threshold-schnorr.yml	Switches both Motoko and Rust jobs to reusable workflow caller; routes PocketIC via reusable workflow inputs.
.github/workflows/unity_ii_deeplink.yml	Switches to reusable workflow caller.
.github/workflows/unit_testable_rust_canister.yml	Switches to reusable workflow caller; routes PocketIC via reusable workflow inputs.
.github/workflows/vetkeys-basic-bls-signing.yml	Switches both Motoko and Rust jobs to reusable workflow caller.
.github/workflows/vetkeys-basic-ibe.yml	Switches both Motoko and Rust jobs to reusable workflow caller.
.github/workflows/vetkeys-basic-timelock-ibe.yml	Switches to reusable workflow caller.
.github/workflows/vetkeys-basic-vetkd.yml	Switches both Motoko and Rust jobs to reusable workflow caller.
.github/workflows/vetkeys-encrypted-notes-app-vetkd.yml	Switches both Motoko and Rust jobs to reusable workflow caller.
.github/workflows/vetkeys-password-manager-with-metadata.yml	Switches both Motoko and Rust jobs to reusable workflow caller.
.github/workflows/vetkeys-password-manager.yml	Switches both Motoko and Rust jobs to reusable workflow caller.
.github/workflows/wasm_counter.yml	Switches to reusable workflow caller (uses all variant).
.github/workflows/who_am_i.yml	Switches both Motoko and Rust jobs to reusable workflow caller.
.github/workflows/x509.yml	Switches to reusable workflow caller; routes PocketIC via reusable workflow inputs.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[marc0olo]

Thanks @Copilot — both points were fair and are addressed in 315dbbb:

• workflow-template.yml paths: the template now shows the two-language (Motoko + Rust) form by default, with one pull_request path entry per language directory, and documents how to adapt it for single-language, frontend-only (language: all + hosting/<name>), and PocketIC cases. This removes the earlier mismatch where a copied two-language workflow would only trigger on one language directory.
• dev-env-version-check.yml grep: the version is now extracted from the actual container: ghcr.io/dfinity/icp-dev-env line (first match, anchored to the key), so a comment or example line can't be matched by mistake. Verified it still resolves 1.1.0 on both sides.