From faf279292ad20783775d909b96815f7ca2843b85 Mon Sep 17 00:00:00 2001
From: Tom Alexander <tom@fizz.buzz>
Date: Fri, 17 Jul 2026 19:42:21 -0400
Subject: [PATCH] Update build pipeline.

---
 .dockerignore                             |  1 +
 .webhook_bridge/pipeline-build-hash.yaml  |  8 ++++++--
 .webhook_bridge/pipeline-format.yaml      |  6 ++++--
 .webhook_bridge/pipeline-rust-clippy.yaml |  6 ++++--
 .webhook_bridge/pipeline-rust-test.yaml   |  6 ++++--
 docker/natter/Dockerfile                  | 18 ++++++++++++------
 6 files changed, 31 insertions(+), 14 deletions(-)

diff --git a/.dockerignore b/.dockerignore
index 87d468d..25f07c9 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -2,3 +2,4 @@
 target/
 org_test_documents/
 docker/
+/.webhook_bridge
diff --git a/.webhook_bridge/pipeline-build-hash.yaml b/.webhook_bridge/pipeline-build-hash.yaml
index 4a09b96..4e36e55 100644
--- a/.webhook_bridge/pipeline-build-hash.yaml
+++ b/.webhook_bridge/pipeline-build-hash.yaml
@@ -2,6 +2,8 @@ apiVersion: tekton.dev/v1
 kind: PipelineRun
 metadata:
   name: build
+  labels:
+    pdb: protect
 spec:
   timeouts:
     pipeline: "2h0m0s"
@@ -62,7 +64,7 @@ spec:
             - name: url
               value: https://code.fizz.buzz/talexander/personal_tekton_catalog.git
             - name: revision
-              value: "31376f29c6332ea8c378152d5ccda1ba9dbcd7bb"
+              value: "dda7b690195b43e8b9859d1caf5dcbf48588ade1"
             - name: pathInRepo
               value: task/git-clone/0.1/git-clone.yaml
           resolver: git
@@ -101,7 +103,7 @@ spec:
             - name: url
               value: https://code.fizz.buzz/talexander/personal_tekton_catalog.git
             - name: revision
-              value: 31376f29c6332ea8c378152d5ccda1ba9dbcd7bb
+              value: dda7b690195b43e8b9859d1caf5dcbf48588ade1
             - name: pathInRepo
               value: task/buildkit-rootless-daemonless/0.1/buildkit-rootless-daemonless.yaml
         params:
@@ -122,6 +124,8 @@ spec:
               - "type=registry,ref=$(params.image-name):buildcache,mode=max,compression=zstd,compression-level=22,rewrite-timestamp=true,image-manifest=true,oci-mediatypes=true"
               - --opt
               - build-arg:SOURCE_DATE_EPOCH=$(tasks.get-git-commit-time.results.unix-time)
+              - --opt
+              - "build-arg:NIX_SUBSTITUTERS=http://ncps.nix-pull-through-cache.svc.cluster.local:80 https://cache.nixos.org"
           - name: BUILDKITD_TOML
             value: |
               debug = true
diff --git a/.webhook_bridge/pipeline-format.yaml b/.webhook_bridge/pipeline-format.yaml
index 41fded5..0f0ba54 100644
--- a/.webhook_bridge/pipeline-format.yaml
+++ b/.webhook_bridge/pipeline-format.yaml
@@ -2,6 +2,8 @@ apiVersion: tekton.dev/v1
 kind: PipelineRun
 metadata:
   name: rust-format
+  labels:
+    pdb: protect
 spec:
   timeouts:
     pipeline: "2h0m0s"
@@ -62,7 +64,7 @@ spec:
             - name: url
               value: https://code.fizz.buzz/talexander/personal_tekton_catalog.git
             - name: revision
-              value: "31376f29c6332ea8c378152d5ccda1ba9dbcd7bb"
+              value: "dda7b690195b43e8b9859d1caf5dcbf48588ade1"
             - name: pathInRepo
               value: task/git-clone/0.1/git-clone.yaml
           resolver: git
@@ -101,7 +103,7 @@ spec:
             - name: url
               value: https://code.fizz.buzz/talexander/personal_tekton_catalog.git
             - name: revision
-              value: 31376f29c6332ea8c378152d5ccda1ba9dbcd7bb
+              value: dda7b690195b43e8b9859d1caf5dcbf48588ade1
             - name: pathInRepo
               value: task/buildkit-rootless-daemonless/0.1/buildkit-rootless-daemonless.yaml
         params:
diff --git a/.webhook_bridge/pipeline-rust-clippy.yaml b/.webhook_bridge/pipeline-rust-clippy.yaml
index e09f431..a13460f 100644
--- a/.webhook_bridge/pipeline-rust-clippy.yaml
+++ b/.webhook_bridge/pipeline-rust-clippy.yaml
@@ -2,6 +2,8 @@ apiVersion: tekton.dev/v1
 kind: PipelineRun
 metadata:
   name: rust-clippy
+  labels:
+    pdb: protect
 spec:
   taskRunTemplate:
     serviceAccountName: build-bot
@@ -62,7 +64,7 @@ spec:
             - name: url
               value: https://code.fizz.buzz/talexander/personal_tekton_catalog.git
             - name: revision
-              value: "31376f29c6332ea8c378152d5ccda1ba9dbcd7bb"
+              value: "dda7b690195b43e8b9859d1caf5dcbf48588ade1"
             - name: pathInRepo
               value: task/git-clone/0.1/git-clone.yaml
           resolver: git
@@ -101,7 +103,7 @@ spec:
             - name: url
               value: https://code.fizz.buzz/talexander/personal_tekton_catalog.git
             - name: revision
-              value: 31376f29c6332ea8c378152d5ccda1ba9dbcd7bb
+              value: dda7b690195b43e8b9859d1caf5dcbf48588ade1
             - name: pathInRepo
               value: task/buildkit-rootless-daemonless/0.1/buildkit-rootless-daemonless.yaml
         params:
diff --git a/.webhook_bridge/pipeline-rust-test.yaml b/.webhook_bridge/pipeline-rust-test.yaml
index 6abce78..7c0303c 100644
--- a/.webhook_bridge/pipeline-rust-test.yaml
+++ b/.webhook_bridge/pipeline-rust-test.yaml
@@ -2,6 +2,8 @@ apiVersion: tekton.dev/v1
 kind: PipelineRun
 metadata:
   name: rust-test
+  labels:
+    pdb: protect
 spec:
   timeouts:
     pipeline: "2h0m0s"
@@ -62,7 +64,7 @@ spec:
             - name: url
               value: https://code.fizz.buzz/talexander/personal_tekton_catalog.git
             - name: revision
-              value: "31376f29c6332ea8c378152d5ccda1ba9dbcd7bb"
+              value: "dda7b690195b43e8b9859d1caf5dcbf48588ade1"
             - name: pathInRepo
               value: task/git-clone/0.1/git-clone.yaml
           resolver: git
@@ -101,7 +103,7 @@ spec:
             - name: url
               value: https://code.fizz.buzz/talexander/personal_tekton_catalog.git
             - name: revision
-              value: 31376f29c6332ea8c378152d5ccda1ba9dbcd7bb
+              value: dda7b690195b43e8b9859d1caf5dcbf48588ade1
             - name: pathInRepo
               value: task/buildkit-rootless-daemonless/0.1/buildkit-rootless-daemonless.yaml
         params:
diff --git a/docker/natter/Dockerfile b/docker/natter/Dockerfile
index 9c266d2..62af093 100644
--- a/docker/natter/Dockerfile
+++ b/docker/natter/Dockerfile
@@ -1,18 +1,24 @@
+# syntax=docker/dockerfile:1
 #
 # Builder
 #
+ARG NIX_SUBSTITUTERS=https://cache.nixos.org
 
 FROM nixos/nix:2.31.3 AS builder
 
-RUN cp "$(nix --extra-experimental-features "nix-command flakes" --option filter-syscalls false build nixpkgs#cacert --print-out-paths)/etc/ssl/certs/ca-bundle.crt" /tmp/ca-bundle.crt
+ARG NIX_SUBSTITUTERS
+RUN tee -a /etc/nix/nix.conf <<EOF
+extra-experimental-features = nix-command flakes
+filter-syscalls = false
+substituters = $NIX_SUBSTITUTERS
+EOF
+
+RUN cp "$(nix build nixpkgs#cacert --print-out-paths)/etc/ssl/certs/ca-bundle.crt" /tmp/ca-bundle.crt
 
 COPY . /tmp/build
 WORKDIR /tmp/build
 
-RUN nix \
-    --extra-experimental-features "nix-command flakes" \
-    --option filter-syscalls false \
-    build '.#docker_env'
+RUN --mount=type=ssh GIT_SSH_COMMAND="ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null" nix build '.#docker_env'
 
 # Export the built closure to a folder
 RUN mkdir /tmp/nix-store-closure
@@ -36,5 +42,5 @@ COPY --from=builder /tmp/ca-bundle.crt /etc/ssl/certs/ca-bundle.crt
 
 COPY --from=builder /tmp/nix-store-closure /nix/store
 COPY --from=builder /tmp/build/result /app
-EXPOSE 8080
+
 CMD ["/app/bin/natter"]