From 24df677b12f9f6fc5ba7853b1297aaf52324959c Mon Sep 17 00:00:00 2001
From: Tom Alexander <tom@fizz.buzz>
Date: Fri, 17 Jul 2026 19:42:21 -0400
Subject: [PATCH] Update build pipeline.

---
 .webhook_bridge/pipeline-build-hash.yaml  |  4 ++--
 .webhook_bridge/pipeline-format.yaml      |  4 ++--
 .webhook_bridge/pipeline-rust-clippy.yaml |  4 ++--
 .webhook_bridge/pipeline-rust-test.yaml   |  4 ++--
 docker/natter/Dockerfile                  | 18 ++++++++++++------
 5 files changed, 20 insertions(+), 14 deletions(-)

diff --git a/.webhook_bridge/pipeline-build-hash.yaml b/.webhook_bridge/pipeline-build-hash.yaml
index 4a09b96..fa86b8b 100644
--- a/.webhook_bridge/pipeline-build-hash.yaml
+++ b/.webhook_bridge/pipeline-build-hash.yaml
@@ -62,7 +62,7 @@ spec:
             - name: url
               value: https://code.fizz.buzz/talexander/personal_tekton_catalog.git
             - name: revision
-              value: "31376f29c6332ea8c378152d5ccda1ba9dbcd7bb"
+              value: "dda7b690195b43e8b9859d1caf5dcbf48588ade1"
             - name: pathInRepo
               value: task/git-clone/0.1/git-clone.yaml
           resolver: git
@@ -101,7 +101,7 @@ spec:
             - name: url
               value: https://code.fizz.buzz/talexander/personal_tekton_catalog.git
             - name: revision
-              value: 31376f29c6332ea8c378152d5ccda1ba9dbcd7bb
+              value: dda7b690195b43e8b9859d1caf5dcbf48588ade1
             - name: pathInRepo
               value: task/buildkit-rootless-daemonless/0.1/buildkit-rootless-daemonless.yaml
         params:
diff --git a/.webhook_bridge/pipeline-format.yaml b/.webhook_bridge/pipeline-format.yaml
index 41fded5..98200c6 100644
--- a/.webhook_bridge/pipeline-format.yaml
+++ b/.webhook_bridge/pipeline-format.yaml
@@ -62,7 +62,7 @@ spec:
             - name: url
               value: https://code.fizz.buzz/talexander/personal_tekton_catalog.git
             - name: revision
-              value: "31376f29c6332ea8c378152d5ccda1ba9dbcd7bb"
+              value: "dda7b690195b43e8b9859d1caf5dcbf48588ade1"
             - name: pathInRepo
               value: task/git-clone/0.1/git-clone.yaml
           resolver: git
@@ -101,7 +101,7 @@ spec:
             - name: url
               value: https://code.fizz.buzz/talexander/personal_tekton_catalog.git
             - name: revision
-              value: 31376f29c6332ea8c378152d5ccda1ba9dbcd7bb
+              value: dda7b690195b43e8b9859d1caf5dcbf48588ade1
             - name: pathInRepo
               value: task/buildkit-rootless-daemonless/0.1/buildkit-rootless-daemonless.yaml
         params:
diff --git a/.webhook_bridge/pipeline-rust-clippy.yaml b/.webhook_bridge/pipeline-rust-clippy.yaml
index e09f431..71e3c4a 100644
--- a/.webhook_bridge/pipeline-rust-clippy.yaml
+++ b/.webhook_bridge/pipeline-rust-clippy.yaml
@@ -62,7 +62,7 @@ spec:
             - name: url
               value: https://code.fizz.buzz/talexander/personal_tekton_catalog.git
             - name: revision
-              value: "31376f29c6332ea8c378152d5ccda1ba9dbcd7bb"
+              value: "dda7b690195b43e8b9859d1caf5dcbf48588ade1"
             - name: pathInRepo
               value: task/git-clone/0.1/git-clone.yaml
           resolver: git
@@ -101,7 +101,7 @@ spec:
             - name: url
               value: https://code.fizz.buzz/talexander/personal_tekton_catalog.git
             - name: revision
-              value: 31376f29c6332ea8c378152d5ccda1ba9dbcd7bb
+              value: dda7b690195b43e8b9859d1caf5dcbf48588ade1
             - name: pathInRepo
               value: task/buildkit-rootless-daemonless/0.1/buildkit-rootless-daemonless.yaml
         params:
diff --git a/.webhook_bridge/pipeline-rust-test.yaml b/.webhook_bridge/pipeline-rust-test.yaml
index 6abce78..15e4924 100644
--- a/.webhook_bridge/pipeline-rust-test.yaml
+++ b/.webhook_bridge/pipeline-rust-test.yaml
@@ -62,7 +62,7 @@ spec:
             - name: url
               value: https://code.fizz.buzz/talexander/personal_tekton_catalog.git
             - name: revision
-              value: "31376f29c6332ea8c378152d5ccda1ba9dbcd7bb"
+              value: "dda7b690195b43e8b9859d1caf5dcbf48588ade1"
             - name: pathInRepo
               value: task/git-clone/0.1/git-clone.yaml
           resolver: git
@@ -101,7 +101,7 @@ spec:
             - name: url
               value: https://code.fizz.buzz/talexander/personal_tekton_catalog.git
             - name: revision
-              value: 31376f29c6332ea8c378152d5ccda1ba9dbcd7bb
+              value: dda7b690195b43e8b9859d1caf5dcbf48588ade1
             - name: pathInRepo
               value: task/buildkit-rootless-daemonless/0.1/buildkit-rootless-daemonless.yaml
         params:
diff --git a/docker/natter/Dockerfile b/docker/natter/Dockerfile
index 9c266d2..62af093 100644
--- a/docker/natter/Dockerfile
+++ b/docker/natter/Dockerfile
@@ -1,18 +1,24 @@
+# syntax=docker/dockerfile:1
 #
 # Builder
 #
+ARG NIX_SUBSTITUTERS=https://cache.nixos.org
 
 FROM nixos/nix:2.31.3 AS builder
 
-RUN cp "$(nix --extra-experimental-features "nix-command flakes" --option filter-syscalls false build nixpkgs#cacert --print-out-paths)/etc/ssl/certs/ca-bundle.crt" /tmp/ca-bundle.crt
+ARG NIX_SUBSTITUTERS
+RUN tee -a /etc/nix/nix.conf <<EOF
+extra-experimental-features = nix-command flakes
+filter-syscalls = false
+substituters = $NIX_SUBSTITUTERS
+EOF
+
+RUN cp "$(nix build nixpkgs#cacert --print-out-paths)/etc/ssl/certs/ca-bundle.crt" /tmp/ca-bundle.crt
 
 COPY . /tmp/build
 WORKDIR /tmp/build
 
-RUN nix \
-    --extra-experimental-features "nix-command flakes" \
-    --option filter-syscalls false \
-    build '.#docker_env'
+RUN --mount=type=ssh GIT_SSH_COMMAND="ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null" nix build '.#docker_env'
 
 # Export the built closure to a folder
 RUN mkdir /tmp/nix-store-closure
@@ -36,5 +42,5 @@ COPY --from=builder /tmp/ca-bundle.crt /etc/ssl/certs/ca-bundle.crt
 
 COPY --from=builder /tmp/nix-store-closure /nix/store
 COPY --from=builder /tmp/build/result /app
-EXPOSE 8080
+
 CMD ["/app/bin/natter"]