fix(docker): ship git so the image can scaffold templates (#220)

The slim image only exposed --version/--help; scaffolding needs git to
clone cpa-templates. Install git+ca-certificates and add a Docker
scaffold smoke to catch regressions (#219).

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: ulises-jeremias

.github/workflows/smoke-distribution.yml

@@ -65,6 +65,25 @@ jobs:
           test -s /tmp/cpa-help.txt
           python3 -c "from pathlib import Path; print('\n'.join(Path('/tmp/cpa-help.txt').read_text().splitlines()[:5]))"
 
+      # Image must ship git so template/extension clones work (see #219).
+      - name: Verify scaffold smoke
+        run: |
+          set -euo pipefail
+          mkdir -p /tmp/cpa-docker-smoke
+          docker run --rm \
+            -e CI=true \
+            -v /tmp/cpa-docker-smoke:/out \
+            -w /out \
+            "$DOCKER_IMAGE:latest" \
+            --template fastapi-starter \
+            --addons github-setup \
+            --no-interactive \
+            --no-install \
+            --refresh always \
+            /out/app
+          test -d /tmp/cpa-docker-smoke/app/.github/workflows
+          test -d /tmp/cpa-docker-smoke/app/app
+
   homebrew:
     name: Homebrew (Create-Python-App/tap)
     runs-on: macos-latest

Dockerfile

@@ -6,6 +6,12 @@ FROM python:3.12-slim-bookworm
 # reproducible for its tag).
 ARG VERSION=latest
 
+# git is required to clone cpa-templates (see #219).
+# hadolint ignore=DL3008
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends git ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
+
 # Retry pip install: PyPI simple-index / CDN edges can lag the JSON API
 # that CI already observed as ready (see #217).
 # hadolint ignore=DL3013