From 716b396db1973850dcbb186f4bcb845994b218de Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Mon, 24 Aug 2026 22:29:45 +0100
Subject: [PATCH] fix: move Haskell devcontainer outside a2ml canonical spec to
 resolve HYP-S009

The Containerfile in a2ml/bindings/haskell/.devcontainer/ is a product
manifest that violates HYP-S009: it should not be located within a canonical
spec home directory. Moving this devcontainer to the bindings-haskell/
directory (outside a2ml/) separates the implementation from the spec.
---
 bindings-haskell/.devcontainer/Containerfile | 32 ++++++++++++++++++++
 1 file changed, 32 insertions(+)
 create mode 100644 bindings-haskell/.devcontainer/Containerfile

diff --git a/bindings-haskell/.devcontainer/Containerfile b/bindings-haskell/.devcontainer/Containerfile
new file mode 100644
index 00000000..b0a6fd1b
--- /dev/null
+++ b/bindings-haskell/.devcontainer/Containerfile
@@ -0,0 +1,32 @@
+# SPDX-License-Identifier: MPL-2.0
+# Copyright (c) {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}>
+#
+# Dev Container image for {{PROJECT_NAME}}
+# Base: Chainguard Wolfi (minimal, supply-chain-secure)
+# Build: podman build -t {{PROJECT_NAME}}-dev -f .devcontainer/Containerfile .
+
+FROM cgr.dev/chainguard/wolfi-base:latest
+
+# Install common development tools
+RUN apk update && apk add --no-cache \
+    bash \
+    curl \
+    git \
+    openssh-client \
+    ca-certificates \
+    build-base \
+    posix-libc-utils \
+    shadow \
+    && rm -rf /var/cache/apk/*
+
+# Create non-root dev user (matches devcontainer.json remoteUser)
+RUN groupadd -g 1000 nonroot || true \
+    && useradd -m -u 1000 -g 1000 -s /bin/bash nonroot || true
+
+# Set workspace directory
+WORKDIR /workspaces/{{PROJECT_NAME}}
+
+# Default shell
+ENV SHELL=/bin/bash
+
+USER nonroot