Add positron server and bump earthaccess to 0.18

[ateucher]

This installs positron server on the image, for which we have an education license. The license file has been mounted on the hub as a kubernetes secret.

I've also bumped earthaccess to v0.18 which has a critical bug fix for streaming in-region (earthaccess-dev/earthaccess#1331).

Tested on the hub with custom image using: openscapes/python:3c5ecb1.

[github-actions]

conda-lock.yml has been updated. To build and test a Docker image from this branch, trigger the Build and push Docker image workflow manually and select this branch.

[github-actions]

conda-lock.yml has been updated. To build and test a Docker image from this branch, trigger the Build and push Docker image workflow manually and select this branch.

[Copilot]

Pull request overview

This PR updates the Docker image build to include Positron Server (activated only when a license file is present on the hub) and bumps earthaccess to >=0.18.0 to pick up a critical streaming fix.

Changes:

• Add a CI install script and Dockerfile steps to download/extract Positron Server into /opt/positron-server.
• Update the conda environment and lockfile to bump earthaccess to 0.18.x (and refresh the lock).
• Add jupyter-positron-server (pip) and ignore *.lic files to avoid accidentally committing the license.

Reviewed changes

Copilot reviewed 4 out of 5 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
ci/install-positron.sh	New script to download and install Positron Server into the image.
ci/environment.yml	Bumps earthaccess to >=0.18.0 and adds jupyter-positron-server to pip deps.
ci/Dockerfile	Runs Positron install during image build; adjusts how VS Code extensions install assets are copied.
ci/conda-lock.yml	Regenerated lockfile reflecting dependency updates (incl. earthaccess).
.gitignore	Ignores .lic files to prevent committing the Positron license.

Comments suppressed due to low confidence (1)

ci/install-positron.sh:12

• Installing Positron Server by downloading and extracting an unauthenticated tarball introduces supply-chain risk. To make builds reproducible and safer, verify the download with a pinned SHA256 (or signature) before extracting.

curl -L "https://cdn.posit.co/positron/releases/server/x86_64/positron-server-linux-x64-2026.05.0-179.tar.gz" -o /tmp/positron-server.tar.gz

# Create directory
mkdir -p /opt/positron-server

# Unpack Positron Server into newly created directory
tar -xzf /tmp/positron-server.tar.gz -C /opt/positron-server --strip-components=1

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[github-actions]

conda-lock.yml has been updated. To build and test a Docker image from this branch, trigger the Build and push Docker image workflow manually and select this branch.