Fix tekton pipelines.

.dockerignore

@@ -1,3 +1,4 @@
 **/.git
 target/
 org_test_documents/
+docker/

.webhook_bridge/pipeline-build-hash.yaml

@@ -50,18 +50,6 @@ spec:
           - name: TARGET_URL
             value: "https://tekton.fizz.buzz/#/namespaces/$(context.pipelineRun.namespace)/pipelineruns/$(context.pipelineRun.name)"
       - name: fetch-repository
-        taskRef:
-          resolver: git
-          params:
-            - name: url
-              value: https://code.fizz.buzz/mirror/catalog.git # mirror of https://github.com/tektoncd/catalog.git
-            - name: revision
-              value: df36b3853a5657fd883015cdbf07ad6466918acf
-            - name: pathInRepo
-              value: task/git-clone/0.9/git-clone.yaml
-        workspaces:
-          - name: output
-            workspace: git-source
         params:
           - name: url
             value: $(params.REPO_URL)
@@ -69,6 +57,18 @@ spec:
             value: $(params.PULL_BASE_SHA)
           - name: deleteExisting
             value: "true"
+        taskRef:
+          params:
+            - name: url
+              value: https://code.fizz.buzz/talexander/personal_tekton_catalog.git
+            - name: revision
+              value: "31376f29c6332ea8c378152d5ccda1ba9dbcd7bb"
+            - name: pathInRepo
+              value: task/git-clone/0.1/git-clone.yaml
+          resolver: git
+        workspaces:
+          - name: output
+            workspace: git-source
       - name: get-git-commit-time
         taskSpec:
           metadata: {}
@@ -101,7 +101,7 @@ spec:
             - name: url
               value: https://code.fizz.buzz/talexander/personal_tekton_catalog.git
             - name: revision
-              value: 7ee31a185243ee6da13dcd26a592c585b64c80e5
+              value: 31376f29c6332ea8c378152d5ccda1ba9dbcd7bb
             - name: pathInRepo
               value: task/buildkit-rootless-daemonless/0.1/buildkit-rootless-daemonless.yaml
         params:

.webhook_bridge/pipeline-format.yaml

@@ -50,18 +50,6 @@ spec:
           - name: TARGET_URL
             value: "https://tekton.fizz.buzz/#/namespaces/$(context.pipelineRun.namespace)/pipelineruns/$(context.pipelineRun.name)"
       - name: fetch-repository
-        taskRef:
-          resolver: git
-          params:
-            - name: url
-              value: https://code.fizz.buzz/mirror/catalog.git # mirror of https://github.com/tektoncd/catalog.git
-            - name: revision
-              value: df36b3853a5657fd883015cdbf07ad6466918acf
-            - name: pathInRepo
-              value: task/git-clone/0.9/git-clone.yaml
-        workspaces:
-          - name: output
-            workspace: git-source
         params:
           - name: url
             value: $(params.REPO_URL)
@@ -69,6 +57,18 @@ spec:
             value: $(params.PULL_BASE_SHA)
           - name: deleteExisting
             value: "true"
+        taskRef:
+          params:
+            - name: url
+              value: https://code.fizz.buzz/talexander/personal_tekton_catalog.git
+            - name: revision
+              value: "31376f29c6332ea8c378152d5ccda1ba9dbcd7bb"
+            - name: pathInRepo
+              value: task/git-clone/0.1/git-clone.yaml
+          resolver: git
+        workspaces:
+          - name: output
+            workspace: git-source
       - name: get-git-commit-time
         taskSpec:
           metadata: {}
@@ -101,7 +101,7 @@ spec:
             - name: url
               value: https://code.fizz.buzz/talexander/personal_tekton_catalog.git
             - name: revision
-              value: 7ee31a185243ee6da13dcd26a592c585b64c80e5
+              value: 31376f29c6332ea8c378152d5ccda1ba9dbcd7bb
             - name: pathInRepo
               value: task/buildkit-rootless-daemonless/0.1/buildkit-rootless-daemonless.yaml
         params:
@@ -167,6 +167,8 @@ spec:
               env:
                 - name: CARGO_TARGET_DIR
                   value: /target
+                - name: RUSTUP_PERMIT_COPY_RENAME
+                  value: "true"
         workspaces:
           - name: source
             workspace: git-source
@@ -233,6 +235,7 @@ spec:
               git_status=$(git status --porcelain)
               if [ -n "$git_status" ]; then
                 git commit -a -m "CI: autofix rust code."
+                ln -s /tekton/home/.ssh /root/.ssh
                 git push origin HEAD:$(params.PULL_BASE_REF)
               else
                 echo "No changes to commit."
@@ -329,6 +332,9 @@ spec:
               workingDir: "$(workspaces.source.path)"
               command: [cargo, cache, --autoclean]
               args: []
+              env:
+                - name: RUSTUP_PERMIT_COPY_RENAME
+                  value: "true"
         workspaces:
           - name: source
             workspace: git-source

.webhook_bridge/pipeline-rust-clippy.yaml

@@ -50,18 +50,6 @@ spec:
           - name: TARGET_URL
             value: "https://tekton.fizz.buzz/#/namespaces/$(context.pipelineRun.namespace)/pipelineruns/$(context.pipelineRun.name)"
       - name: fetch-repository
-        taskRef:
-          resolver: git
-          params:
-            - name: url
-              value: https://code.fizz.buzz/mirror/catalog.git # mirror of https://github.com/tektoncd/catalog.git
-            - name: revision
-              value: df36b3853a5657fd883015cdbf07ad6466918acf
-            - name: pathInRepo
-              value: task/git-clone/0.9/git-clone.yaml
-        workspaces:
-          - name: output
-            workspace: git-source
         params:
           - name: url
             value: $(params.REPO_URL)
@@ -69,6 +57,18 @@ spec:
             value: $(params.PULL_BASE_SHA)
           - name: deleteExisting
             value: "true"
+        taskRef:
+          params:
+            - name: url
+              value: https://code.fizz.buzz/talexander/personal_tekton_catalog.git
+            - name: revision
+              value: "31376f29c6332ea8c378152d5ccda1ba9dbcd7bb"
+            - name: pathInRepo
+              value: task/git-clone/0.1/git-clone.yaml
+          resolver: git
+        workspaces:
+          - name: output
+            workspace: git-source
       - name: get-git-commit-time
         taskSpec:
           metadata: {}
@@ -101,7 +101,7 @@ spec:
             - name: url
               value: https://code.fizz.buzz/talexander/personal_tekton_catalog.git
             - name: revision
-              value: 7ee31a185243ee6da13dcd26a592c585b64c80e5
+              value: 31376f29c6332ea8c378152d5ccda1ba9dbcd7bb
             - name: pathInRepo
               value: task/buildkit-rootless-daemonless/0.1/buildkit-rootless-daemonless.yaml
         params:
@@ -177,6 +177,8 @@ spec:
               env:
                 - name: CARGO_TARGET_DIR
                   value: /target
+                - name: RUSTUP_PERMIT_COPY_RENAME
+                  value: "true"
         workspaces:
           - name: source
             workspace: git-source
@@ -273,6 +275,9 @@ spec:
               workingDir: "$(workspaces.source.path)"
               command: [cargo, cache, --autoclean]
               args: []
+              env:
+                - name: RUSTUP_PERMIT_COPY_RENAME
+                  value: "true"
         workspaces:
           - name: source
             workspace: git-source

.webhook_bridge/pipeline-rust-test.yaml

@@ -50,18 +50,6 @@ spec:
           - name: TARGET_URL
             value: "https://tekton.fizz.buzz/#/namespaces/$(context.pipelineRun.namespace)/pipelineruns/$(context.pipelineRun.name)"
       - name: fetch-repository
-        taskRef:
-          resolver: git
-          params:
-            - name: url
-              value: https://code.fizz.buzz/mirror/catalog.git # mirror of https://github.com/tektoncd/catalog.git
-            - name: revision
-              value: df36b3853a5657fd883015cdbf07ad6466918acf
-            - name: pathInRepo
-              value: task/git-clone/0.9/git-clone.yaml
-        workspaces:
-          - name: output
-            workspace: git-source
         params:
           - name: url
             value: $(params.REPO_URL)
@@ -69,6 +57,18 @@ spec:
             value: $(params.PULL_BASE_SHA)
           - name: deleteExisting
             value: "true"
+        taskRef:
+          params:
+            - name: url
+              value: https://code.fizz.buzz/talexander/personal_tekton_catalog.git
+            - name: revision
+              value: "31376f29c6332ea8c378152d5ccda1ba9dbcd7bb"
+            - name: pathInRepo
+              value: task/git-clone/0.1/git-clone.yaml
+          resolver: git
+        workspaces:
+          - name: output
+            workspace: git-source
       - name: get-git-commit-time
         taskSpec:
           metadata: {}
@@ -101,7 +101,7 @@ spec:
             - name: url
               value: https://code.fizz.buzz/talexander/personal_tekton_catalog.git
             - name: revision
-              value: 7ee31a185243ee6da13dcd26a592c585b64c80e5
+              value: 31376f29c6332ea8c378152d5ccda1ba9dbcd7bb
             - name: pathInRepo
               value: task/buildkit-rootless-daemonless/0.1/buildkit-rootless-daemonless.yaml
         params:
@@ -162,11 +162,13 @@ spec:
             - name: run
               image: $(params.docker-image)
               workingDir: "$(workspaces.source.path)"
-              command: [cargo, test, --no-fail-fast]
+              command: [cargo, test]
-              args: []
+              args: [--no-fail-fast]
               env:
                 - name: CARGO_TARGET_DIR
                   value: /target
+                - name: RUSTUP_PERMIT_COPY_RENAME
+                  value: "true"
         workspaces:
           - name: source
             workspace: git-source
@@ -263,6 +265,9 @@ spec:
               workingDir: "$(workspaces.source.path)"
               command: [cargo, cache, --autoclean]
               args: []
+              env:
+                - name: RUSTUP_PERMIT_COPY_RENAME
+                  value: "true"
         workspaces:
           - name: source
             workspace: git-source

docker/natter/Dockerfile

@@ -1,16 +1,40 @@
-# syntax=docker/dockerfile:1
+#
-ARG ALPINE_VERSION="3.20"
+# Builder
+#
 
-FROM rustlang/rust:nightly-alpine$ALPINE_VERSION AS builder
+FROM nixos/nix:2.31.3 AS builder
 
-RUN apk add --no-cache musl-dev
+RUN cp "$(nix --extra-experimental-features "nix-command flakes" --option filter-syscalls false build nixpkgs#cacert --print-out-paths)/etc/ssl/certs/ca-bundle.crt" /tmp/ca-bundle.crt
 
-RUN mkdir /root/natter
+COPY . /tmp/build
-WORKDIR /root/natter
+WORKDIR /tmp/build
-COPY --link . .
-# TODO: Add static build, which currently errors due to proc_macro. RUSTFLAGS="-C target-feature=+crt-static"
-RUN --mount=type=tmpfs,target=/tmp --mount=type=cache,target=/usr/local/cargo/registry,sharing=locked CARGO_TARGET_DIR=/target cargo build --profile release-lto
 
-FROM alpine:$ALPINE_VERSION AS runner
+RUN nix \
+    --extra-experimental-features "nix-command flakes" \
+    --option filter-syscalls false \
+    build '.#docker_env'
 
-COPY --link --from=builder /target/release-lto/natter /usr/bin/
+# Export the built closure to a folder
+RUN mkdir /tmp/nix-store-closure
+RUN cp -R $(nix-store -qR result/) /tmp/nix-store-closure
+
+
+
+#
+# Runner
+#
+
+FROM scratch
+
+WORKDIR /app
+
+ENV PATH="$PATH:/app/bin"
+
+ENV SSL_CERT_FILE=/etc/ssl/certs/ca-bundle.crt
+ENV NIX_SSL_CERT_FILE=/etc/ssl/certs/ca-bundle.crt
+COPY --from=builder /tmp/ca-bundle.crt /etc/ssl/certs/ca-bundle.crt
+
+COPY --from=builder /tmp/nix-store-closure /nix/store
+COPY --from=builder /tmp/build/result /app
+EXPOSE 8080
+CMD ["/app/bin/natter"]

flake.nix

@@ -65,9 +65,6 @@
             name = "natter";
             paths = with pkgs; [
               appliedOverlay.natter.release
-              bash
-              uutils-coreutils-noprefix
-              # toybox # Smaller than uutils-coreutils?
             ];
           };
         }

rust-toolchain.toml

@@ -1,4 +1,4 @@
 [toolchain]
-channel = "nightly"
+channel = "nightly-2026-05-23"
 profile = "default"
 components = ["clippy", "rustfmt"]