Remove pwsh

.devcontainer/Dockerfile

@@ -1,50 +1,26 @@
 ARG VARIANT=3.10
 FROM python:${VARIANT}-buster
 
-RUN apt-get update && export DEBIAN_FRONTEND=noninteractive \
-    && apt-get -y install --no-install-recommends apt-transport-https \
-    ca-certificates \
-    curl \
-    git \
-    gnupg \
-    libssl-dev \
-    lsb-release \
-    python3-sphinx \
-    sudo
-
 # Set package versions
-ARG AZURE_CLI_VERSION="2.58.0"
-ARG PWSH_VERSION="7.4.1"
+ARG AZURE_CLI_VERSION="2.42.0"
+ARG PULUMI_VERSION="3.80.0"
 
-# Install Azure-CLI 
-# Get Microsoft signing key
-RUN sudo mkdir -p /etc/apt/keyrings \
-  && curl -sLS https://packages.microsoft.com/keys/microsoft.asc | \
-      gpg --dearmor | \
-      sudo tee /etc/apt/keyrings/microsoft.gpg > /dev/null \
-  && sudo chmod go+r /etc/apt/keyrings/microsoft.gpg \
-  && AZ_DIST=$(lsb_release -cs) \
-  && echo "deb [arch=`dpkg --print-architecture` signed-by=/etc/apt/keyrings/microsoft.gpg] https://packages.microsoft.com/repos/azure-cli/ $AZ_DIST main" | \
-      sudo tee /etc/apt/sources.list.d/azure-cli.list \
-  && sudo apt-get update \
-  && sudo apt-get install azure-cli=$AZURE_CLI_VERSION-1~$AZ_DIST
+RUN apt-get update \
+    && export DEBIAN_FRONTEND=noninteractive \
+    && apt-get -y install --no-install-recommends \
+      git \
+      libssl-dev \
+      python3-sphinx
 
-# Install Powershell
-# Pull different binaries from Github depending on system architecture
-# The standard APT method currently only works for `amd64`
-# Set up TARGETARCH variable to use to pull the right binaries for the current architecture.
+# Set up TARGETARCH variable to use to pull the right binaries
+# for the current architecture.
 ARG TARGETARCH
-RUN if [ "${TARGETARCH}" = "arm64" ]; \
-  then \
-    DEBARCH="arm64"; \
-  else \
-    DEBARCH="x86"; \
-  fi; \
-  curl -L -o /tmp/powershell.tar.gz https://github.com/PowerShell/PowerShell/releases/download/v${PWSH_VERSION}/powershell-${PWSH_VERSION}-linux-$DEBARCH.tar.gz \
-  && mkdir -p /opt/microsoft/powershell/7 \
-  && tar zxf /tmp/powershell.tar.gz -C /opt/microsoft/powershell/7 \
-  && chmod +x /opt/microsoft/powershell/7/pwsh \
-  && ln -s /opt/microsoft/powershell/7/pwsh /usr/bin/pwsh
+
+# Install Azure-CLI
+# Standard install method currently does not support ARM64
+# Use pip instead - https://github.com/Azure/azure-cli/issues/22875
+RUN pip3 install azure-cli==${AZURE_CLI_VERSION}
+RUN pip3 install hatch
 
 # Create non-root user and give them sudo access
 ARG USERNAME=deploydsh
@@ -64,9 +40,5 @@ USER $USERNAME
 COPY ./docs/requirements.txt /build/requirements.txt
 RUN pip3 install -r /build/requirements.txt
 
-# Install/check needed powershell modules
-COPY ./deployment/CheckRequirements.ps1 /build/CheckRequirements.ps1
-COPY ./deployment/common/Logging.psm1 /build/common/Logging.psm1
-RUN pwsh -Command "& {Set-PSRepository -Name PSGallery -InstallationPolicy Trusted}" \
-  && pwsh -File /build/CheckRequirements.ps1 -InstallMissing  -IncludeDev\
-  && sudo rm -rf /build/
+# Set PATH for pulumi - pulumi installed as feature to work round installing as root
+ENV PATH=$PATH:/home/${USERNAME}/.pulumi/bin

.devcontainer/devcontainer.json

@@ -1,21 +1,25 @@
-// Development container for the Data Safe Haven project
+// Development container for the Data Safe Haven project pulumi
 {
-	"name": "Turing Data Safe Haven",
-	"build": {
-		"context": "..",
-		"dockerfile": "Dockerfile"
-	},
-	"customizations": {
-		"vscode": {
-			"settings": {
-				"terminal.integrated.defaultProfile.linux": "bash"
-			},
-			"extensions": [
-				"github.vscode-pull-request-github",
-				"ms-vscode.powershell",
-				"ms-vscode.azure-account"
-			]
-		}
-	},
-	"remoteUser": "deploydsh"
+    "name": "Turing Data Safe Haven - Pulumi",
+    "build": {
+        "context": "../..",
+        "dockerfile": "Dockerfile"
+    },
+    "settings": {
+        "terminal.integrated.defaultProfile.linux": "bash"
+    },
+    "extensions": [
+        "github.vscode-pull-request-github",
+        "ms-vscode.powershell",
+        "ms-vscode.azure-account",
+        "ms-python.python",
+        "christian-kohler.path-intellisense"
+    ],
+    "remoteUser": "deploydsh",
+    "features": {
+        "ghcr.io/devcontainers-contrib/features/pulumi:1": {
+            "version": "3.80.0",
+            "bashCompletion": false
+        }
+    }
 }

.github/ISSUE_TEMPLATE/release_checklist.md

@@ -23,6 +23,7 @@ Refer to the [Deployment](https://data-safe-haven.readthedocs.io/en/latest/deplo
     - [ ] Save the transcript of your tier 2 SRE deployment
     - [ ] Save the transcript of your tier 3 SRE deployment
 - [ ] Complete the [Security evaluation checklist](https://data-safe-haven.readthedocs.io/en/latest/deployment/security_checklist.html) from the deployment documentation
+- [ ] Update [SECURITY.md](../../SECURITY.md) and [VERSIONING.md](../../VERSIONING.md)
 
 ### For major releases
 

.github/pull_request_template.md

@@ -11,7 +11,6 @@ Replace the empty checkboxes [ ] below with checked ones [x] accordingly.
 - [ ] You are targeting the appropriate branch. If you're not certain which one this is, it should be **`develop`**.
 - [ ] Your branch is up-to-date with the **target branch** (it probably was when you started, but it may have changed since then).
 - [ ] You have marked this pull request as a **draft** and added `'[WIP]'` to the title if needed (if you're not yet ready to merge).
-- [ ] You have formatted your code using appropriate automated tools (for example `./tests/AutoFormat_Powershell.ps1 -TargetPath <path to file or directory>` for Powershell).
 
 ### :arrow_heading_up: Summary
 

.github/scripts/update_docker_versions.py

@@ -67,7 +67,7 @@ def annotate(
     return annotated
 
 
-for filename in (pathlib.Path("data_safe_haven") / "pulumi").glob("**/*.py"):
+for filename in (pathlib.Path("data_safe_haven") / "infrastructure").glob("**/*.py"):
     needs_replacement = False
     lines = []
     with open(filename) as f_pulumi:
@@ -87,6 +87,8 @@ def annotate(
                     print(f"Updating {image} from {v_current} to {v_latest} in {filename}")  # noqa: T201
                     needs_replacement = True
                     output = line.replace(v_current, v_latest)
+                else:
+                    print(f"Leaving {image} at {v_current} (latest version) in {filename}")  # noqa: T201
             lines += output
 
     if needs_replacement:

.github/workflows/update_docker_versions.yaml

@@ -1,12 +1,9 @@
 ---
 name: Update Pulumi Docker image versions
 
-# Run workflow on pushes to matching branches
 on:  # yamllint disable-line rule:truthy
-  push:
-    branches: [python-migration]
   schedule:
-    - cron: "0 0 */7 * *"  # run once per week
+    - cron: "0 3 * * 1"  # run at 3:00 every Monday
   workflow_dispatch:  # allow this workflow to be manually triggered
 
 # checkout needs 'contents:read'