fix(ci): wait for postCreateCommand before running the command

[skevetter]

Summary

devsy ci could run the user command before the container was fully provisioned. It executed the command immediately after RunHeadless returned, but with the devcontainer default waitFor=updateContentCommand, postCreateCommand runs in a detached, unawaited background process — so the command raced that process. Symptom: a postCreateCommand that writes state (e.g. injecting a secret from --secrets-file) hadn't run yet, so the command saw missing files/data.

Fix

ci now floors the effective waitFor at postCreateCommand, so provisioning hooks run synchronously before the run command. Since ci is a batch operation with no interactive attach, there's no reason to defer hooks (deferral exists to make devsy up attach fast).

Key details:

• Spec-compliant floor, not a replacement. The override raises the effective phase but never lowers a later waitFor a user explicitly configured (e.g. postStartCommand/postAttachCommand), mirroring the existing promoteDotfilesWaitFor behavior.
• postCreateCommand, not postStartCommand — postStartCommand stays deferred so a long-running/blocking start command can't hang ci.
• up is unchanged — the override is empty for up, so its fast-attach deferral behavior is preserved.
• Collapsed RunPreAttachHooks's parameters into a PreAttachOptions struct (also brings it back under revive's argument-limit) and uses the typed LifecyclePhase end-to-end.

Tests

Existing lifecycle-hook tests updated for the new signature; added TestResolveWaitForFloor covering floor semantics (raise, never lower; initializeCommand promoted to postCreate; empty/invalid floor ignored). Builds on Linux + Windows; go vet and golangci-lint clean.

Summary by CodeRabbit

• New Features

  • Added support for configuring the lifecycle phase that CI and container setup should wait for.
  • Workspace configuration can now specify a waitFor phase.
  • Improved lifecycle handling to honor configured minimum wait phases.

• Refactor

  • Streamlined pre-attach setup configuration while preserving existing hook, secrets, dotfiles, and prebuild behavior.

• Tests

  • Updated lifecycle hook coverage for wait-phase defaults, validation, and minimum-phase behavior.

[netlify]

✅ Deploy Preview for images-devsy-sh canceled.

Name	Link
🔨 Latest commit	5c36b3e
🔍 Latest deploy log	https://app.netlify.com/projects/images-devsy-sh/deploys/6a66e5f916b56c00082741ff

[netlify]

✅ Deploy Preview for devsydev canceled.

Name	Link
🔨 Latest commit	5c36b3e
🔍 Latest deploy log	https://app.netlify.com/projects/devsydev/deploys/6a66e5f99d8dc40008bcb955

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 607a8dfa-9cf9-4423-a1fa-67a6c5a46235

📥 Commits

Reviewing files that changed from the base of the PR and between f53b1d7 and 5c36b3e.

📒 Files selected for processing (7)

• cmd/ci/ci.go
• cmd/internal/agentcontainer/deferred_hooks.go
• cmd/internal/agentcontainer/setup.go
• pkg/devcontainer/setup/lifecyclehooks.go
• pkg/devcontainer/setup/lifecyclehooks_test.go
• pkg/devcontainer/setup/setup.go
• pkg/provider/workspace.go

---

📝 Walkthrough

Walkthrough

The change adds waitFor to workspace and container setup configuration, propagates it through pre-attach lifecycle hooks, enforces a minimum wait phase, refactors hook inputs into PreAttachOptions, and updates CI, deferred hooks, and tests.

Changes

Lifecycle wait phase propagation

Layer / File(s)	Summary
Configuration propagation pkg/provider/workspace.go, pkg/devcontainer/setup/setup.go, cmd/internal/agentcontainer/setup.go	Workspace waitFor configuration is carried through ContainerSetupConfig into PreAttachOptions.
Floor-aware hook execution pkg/devcontainer/setup/lifecyclehooks.go	RunPreAttachHooks accepts named options, and resolveWaitFor enforces the configured minimum lifecycle phase while preserving prebuild handling.
Integration and validation cmd/internal/agentcontainer/deferred_hooks.go, cmd/ci/ci.go, pkg/devcontainer/setup/lifecyclehooks_test.go	Deferred hooks use the options struct, CI waits for post-create, and tests cover the new signatures and wait-phase floor behavior.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

• devsy-org/devsy#87: Modifies lifecycle wait-phase computation and deferred hook execution.
• devsy-org/devsy#98: Changes waitFor handling in the same lifecycle hook flow.
• devsy-org/devsy#112: Refactors RunPreAttachHooks invocation and dotfiles-related lifecycle behavior.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: CI now waits through postCreateCommand before running the command.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}