Add PyPiLibrary Python sibling project

.devcontainer/devcontainer.json

@@ -0,0 +1,68 @@
+{
+    "name": "ProjectTemplate",
+    "image": "mcr.microsoft.com/devcontainers/dotnet:1-10.0",
+
+    "features": {
+        "ghcr.io/devcontainers/features/common-utils:2": {},
+        "ghcr.io/devcontainers/features/github-cli:1": {}
+    },
+
+    "mounts": [
+        {
+            "source": "${localEnv:HOME}${localEnv:USERPROFILE}/.ssh/id_ed25519.pub",
+            "target": "/home/vscode/.ssh/id_ed25519.pub",
+            "type": "bind",
+            "readonly": true
+        },
+        {
+            "source": "${localEnv:HOME}${localEnv:USERPROFILE}/.config/git/allowed_signers",
+            "target": "/home/vscode/.config/git/allowed_signers",
+            "type": "bind",
+            "readonly": true
+        },
+        {
+            "source": "${localEnv:HOME}${localEnv:USERPROFILE}/.config/gh",
+            "target": "/home/vscode/.config/gh",
+            "type": "bind",
+            "readonly": false
+        }
+    ],
+
+    "remoteUser": "vscode",
+    // workspaceFolder defaults to /workspaces/${localWorkspaceFolderBasename},
+    // which makes the devcontainer config portable: when this template is
+    // forked into a repo with a different folder name, the mount path tracks
+    // the host folder name automatically.
+
+    // The bind-mount on macOS hosts surfaces /home/vscode/.ssh as root-owned;
+    // chown it back so writes from inside the container (known_hosts updates
+    // by gh / git) land cleanly. Idempotent on Linux/WSL2.
+    "onCreateCommand": "sudo install -d -m 700 -o vscode -g vscode /home/vscode/.ssh",
+
+    // Install uv for the Python sibling project, restore .NET local tools,
+    // and install the husky git hooks. uv is installed under $HOME/.local/bin
+    // and added to PATH by uv's install script.
+    "postCreateCommand": ".devcontainer/post-create.sh",
+
+    "customizations": {
+        "vscode": {
+            // Mirror of `recommendations` in ProjectTemplate.code-workspace.
+            // Pyright type checking is provided by Pylance, which the
+            // ms-python.python extension auto-installs — no separate pyright
+            // extension needed (and the standalone one is in maintenance mode).
+            "extensions": [
+                "csharpier.csharpier-vscode",
+                "davidanson.vscode-markdownlint",
+                "editorconfig.editorconfig",
+                "github.vscode-github-actions",
+                "gruntfuggly.todo-tree",
+                "ms-azuretools.vscode-docker",
+                "ms-dotnettools.csdevkit",
+                "streetsidesoftware.code-spell-checker",
+                "yzhang.markdown-all-in-one",
+                "ms-python.python",
+                "charliermarsh.ruff"
+            ]
+        }
+    }
+}

.devcontainer/post-create.sh

@@ -0,0 +1,55 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Install uv (Astral) for the Python sibling project. Idempotent — re-running
+# overwrites in place. The installer drops the binary in $HOME/.local/bin and
+# updates user shell init to add it to PATH for new shells; we add it to the
+# current PATH explicitly so the rest of this script can invoke `uv` without a
+# hard-coded path.
+#
+# uv is pinned to a specific version (via the version-prefixed install URL,
+# https://astral.sh/uv/<version>/install.sh) so a compromised or broken
+# upstream `latest` script cannot silently change what runs on contributors'
+# machines and CI runners. Bump UV_VERSION when you've reviewed release notes.
+#
+# We re-install when uv is missing OR when the installed version doesn't
+# match the pin. The latter handles the case where a contributor (or a
+# previous run with a different pin) left a different uv version on PATH —
+# the pin is what's reproducible and what the lockfile is generated against.
+UV_VERSION="0.11.8"
+installed_uv_version=""
+if command -v uv >/dev/null 2>&1; then
+    installed_uv_version="$(uv --version | awk '{print $2}')"
+fi
+if [[ "$installed_uv_version" != "$UV_VERSION" ]]; then
+    # Download the pinned installer to a temp file first instead of piping
+    # `curl … | sh`. This produces a logged sha256 of exactly the bytes we
+    # ran, so a compromised installer leaves a forensic trail; it also lets
+    # a future change pin a known-good checksum (set EXPECTED_SHA below).
+    installer=$(mktemp -t uv-install.XXXXXX.sh)
+    trap 'rm -f "$installer"' EXIT
+    curl -LsSf "https://astral.sh/uv/${UV_VERSION}/install.sh" -o "$installer"
+    actual_sha=$(sha256sum "$installer" | awk '{print $1}')
+    echo "uv installer (v${UV_VERSION}) sha256: ${actual_sha}" >&2
+    # EXPECTED_SHA="<paste-from-trusted-source>"  # set to enforce
+    if [[ -n "${EXPECTED_SHA:-}" && "${actual_sha}" != "${EXPECTED_SHA}" ]]; then
+        echo "uv installer sha256 mismatch — refusing to run" >&2
+        exit 1
+    fi
+    sh "$installer"
+    export PATH="$HOME/.local/bin:$PATH"
+fi
+
+# Restore the .NET local-tool manifest (CSharpier, Husky.Net, dotnet-outdated).
+dotnet tool restore
+
+# Install Husky.Net git hooks so commits run pre-commit checks. Failures here
+# (e.g. missing .git directory, broken tool restore) should surface — the
+# devcontainer setup is not "successful" if hook installation fails silently.
+dotnet husky install
+
+# Pre-warm uv environment for PyPiLibrary if it exists. Guarded so this script
+# is safe before PyPiLibrary lands in the repo.
+if [[ -f PyPiLibrary/pyproject.toml ]]; then
+    (cd PyPiLibrary && uv sync)
+fi