Keep maintainer tools out of student workspaces

.github/workflows/ci.yml

@@ -21,7 +21,4 @@ jobs:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
-      - uses: devcontainers/ci@513af61f4de4f75d37e4438f184ba4358f0fc1ca # v0.3.1900000450
-        with:
-          push: never
-          runCmd: FIRSTDRAFT_REQUIRE_IMAGE_SOURCE_COMMIT=1 script/check && script/check-depth-one && script/devcontainer-smoke && script/devcontainer-smoke
+      - uses: firstdraft/dockerfiles/drawing-board@84cf8ecbb310f0abf2ace754ab3cb720fa8afd09

.github/workflows/devcontainer-image.yml

@@ -14,43 +14,21 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-      - uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
-      - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
       - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
-      - uses: devcontainers/ci@513af61f4de4f75d37e4438f184ba4358f0fc1ca # v0.3.1900000450
-        with:
-          configFile: .devcontainer/image/devcontainer.json
-          imageName: ghcr.io/firstdraft/drawing-board-workspace
-          imageTag: sha-${{ github.sha }}
-          platform: linux/amd64,linux/arm64
-          push: always
+      - uses: firstdraft/dockerfiles/drawing-board/image@84cf8ecbb310f0abf2ace754ab3cb720fa8afd09
 
   verify:
     needs: build
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-      - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
       - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
-      - name: Verify published image
-        env:
-          IMAGE: ghcr.io/firstdraft/drawing-board-workspace:sha-${{ github.sha }}
-        run: |
-          set -Eeuo pipefail
-          index="$(docker buildx imagetools inspect --raw "$IMAGE")"
-          printf '%s\n' "$index" > /tmp/index.json
-          amd64="$(jq -er '.manifests[] | select(.platform.os == "linux" and .platform.architecture == "amd64") | .digest' /tmp/index.json)"
-          arm64="$(jq -er '.manifests[] | select(.platform.os == "linux" and .platform.architecture == "arm64") | .digest' /tmp/index.json)"
-          [[ "$(jq '[.manifests[] | select(.platform.os == "linux" and (.platform.architecture == "amd64" or .platform.architecture == "arm64"))] | length' /tmp/index.json)" == 2 ]]
-          docker pull --platform linux/amd64 "${IMAGE%:*}@$amd64"
-          script/devcontainer-image-smoke "${IMAGE%:*}@$amd64"
-          docker pull --platform linux/arm64 "${IMAGE%:*}@$arm64"
-          script/devcontainer-image-smoke --metadata-only "${IMAGE%:*}@$arm64"
+      - uses: firstdraft/dockerfiles/drawing-board/image/verify@84cf8ecbb310f0abf2ace754ab3cb720fa8afd09

AGENTS.md

@@ -24,16 +24,17 @@ name the Skill or translate the request into a command.
   checking that no real credentials or private CLI state are staged. Reviewed public demo logins in the generated
   README, development seeds, and submitted Plan are expected; preserve them. Before setup or source edits, save it
   to the user's own **private** repository through VS Code's **Publish to GitHub** or the
-  [Codespaces publication API](CONTRIBUTING.md#publish-from-the-codespace-terminal).
+  [Codespaces publication API](README.md#publish-from-the-codespace-terminal).
   Obtain approval of the owner and repository name, then verify the baseline arrived. If a remote already exists,
   show it and push there with approval instead. Never infer publication permission from Compile approval.
-  Never run `script/initialize-application` or
-  `script/application-smoke`, including their copies under `.firstdraft/design/`: those helpers require a separate
+  Never run `script/initialize-application`, including its copy under `.firstdraft/design/`: it requires a separate
   nested app. Run ordinary Rails commands at the new root. For later First Draft authoring commands, enter
   `.firstdraft/design/` and use its `bin/firstdraft`; do not rely on the original container's bare `firstdraft` PATH after relocation.
 - If the user chooses the optional nested mode, run `bin/firstdraft plan compile --output ./application` into an
-  absent destination. Then run root `script/initialize-application application` before setup or edits, followed by
-  `script/application-smoke`. Only in this mode is `application/` an ignored, separate Git repository with no remote;
+  absent destination. Then run root `script/initialize-application application` before setup or edits. Continue with the generated
+  README, `bin/setup --skip-server`, and ordinary application tests. For browser tests, start Selenium with the
+  [Compose recipe](README.md#7-open-your-app) from `application/` and stop it afterward.
+  Only in this mode is `application/` an ignored, separate Git repository with no remote;
   continue with Rails commands inside it. Do not manufacture Git metadata or repair generated bytes by hand.
 - If `application/` already exists, preserve it. Never delete, overwrite, or move it merely to satisfy the absent-path
   precondition. Stop and ask the user whether to continue in the existing application, push its nested `main` to an
@@ -108,4 +109,4 @@ or a prerequisite for the internal-alpha test. Inspect that application's produc
 guides; prefer Rails conventions over new First Draft deployment machinery. Never infer permission to spend money,
 publish source, or expose private data from an earlier Compile approval.
 
-When changing the Drawing Board template itself, read `CONTRIBUTING.md` and run `script/check`.
+Template maintenance lives in [firstdraft/dockerfiles](https://github.com/firstdraft/dockerfiles/tree/main/drawing-board).