ci(devcontainer): avoid Docker Hub buildkit bootstrap timeout by using GHCR image

[DevSecNinja]

Summary

The Prebuild Devcontainer workflow intermittently fails at the Set up Docker Buildx step before the build logic runs.

Failure observed in job:

• Workflow: .github/workflows/devcontainer-prebuild.yaml
• Job: Build (amd64/arm64) and potentially merge
• Error (from logs): timeout/read failure while pulling BuildKit image from Docker Hub:
  • registry-1.docker.io/v2/moby/buildkit/manifests/buildx-stable-1
  • auth.docker.io/token ... read tcp ...

Root Cause

docker/setup-buildx-action bootstraps BuildKit using Docker Hub (moby/buildkit:buildx-stable-1) by default.
Transient Docker Hub/auth connectivity causes setup failure and aborts the workflow early.

Proposed Fix

Update .github/workflows/devcontainer-prebuild.yaml to:

1. Log in to GHCR before Buildx setup.
2. Configure Buildx to use a GHCR-hosted BuildKit image:
   • driver-opts: image=ghcr.io/devcontainers/buildkit:stable
3. Apply this in both prebuild and merge jobs.

Expected Outcome

• Buildx bootstrap no longer depends on Docker Hub availability for BuildKit image pull.
• Fewer transient CI failures in devcontainer prebuild pipeline.
• More stable weekly/scheduled and main/tag image publishing.

Implementation Notes

In both jobs:

• Reorder steps so docker/login-action (GHCR) happens before docker/setup-buildx-action.
• Add:

  with:
    driver-opts: |
      image=ghcr.io/devcontainers/buildkit:stable