Update build pipeline.

.dockerignore

@@ -1,3 +1,5 @@
 **/.git
 target/
 org_test_documents/
+docker/
+/.webhook_bridge

.gitignore

@@ -1 +1,2 @@
 /target
+/result

.webhook_bridge/pipeline-build-hash.yaml

@@ -2,6 +2,8 @@ apiVersion: tekton.dev/v1
 kind: PipelineRun
 metadata:
   name: build
+  labels:
+    pdb: protect
 spec:
   timeouts:
     pipeline: "2h0m0s"
@@ -50,18 +52,6 @@ spec:
           - name: TARGET_URL
             value: "https://tekton.fizz.buzz/#/namespaces/$(context.pipelineRun.namespace)/pipelineruns/$(context.pipelineRun.name)"
       - name: fetch-repository
-        taskRef:
-          resolver: git
-          params:
-            - name: url
-              value: https://code.fizz.buzz/mirror/catalog.git # mirror of https://github.com/tektoncd/catalog.git
-            - name: revision
-              value: df36b3853a5657fd883015cdbf07ad6466918acf
-            - name: pathInRepo
-              value: task/git-clone/0.9/git-clone.yaml
-        workspaces:
-          - name: output
-            workspace: git-source
         params:
           - name: url
             value: $(params.REPO_URL)
@@ -69,6 +59,18 @@ spec:
             value: $(params.PULL_BASE_SHA)
           - name: deleteExisting
             value: "true"
+        taskRef:
+          params:
+            - name: url
+              value: https://code.fizz.buzz/talexander/personal_tekton_catalog.git
+            - name: revision
+              value: "dda7b690195b43e8b9859d1caf5dcbf48588ade1"
+            - name: pathInRepo
+              value: task/git-clone/0.1/git-clone.yaml
+          resolver: git
+        workspaces:
+          - name: output
+            workspace: git-source
       - name: get-git-commit-time
         taskSpec:
           metadata: {}
@@ -101,7 +103,7 @@ spec:
             - name: url
               value: https://code.fizz.buzz/talexander/personal_tekton_catalog.git
             - name: revision
-              value: 7ee31a185243ee6da13dcd26a592c585b64c80e5
+              value: dda7b690195b43e8b9859d1caf5dcbf48588ade1
             - name: pathInRepo
               value: task/buildkit-rootless-daemonless/0.1/buildkit-rootless-daemonless.yaml
         params:
@@ -122,6 +124,8 @@ spec:
               - "type=registry,ref=$(params.image-name):buildcache,mode=max,compression=zstd,compression-level=22,rewrite-timestamp=true,image-manifest=true,oci-mediatypes=true"
               - --opt
               - build-arg:SOURCE_DATE_EPOCH=$(tasks.get-git-commit-time.results.unix-time)
+              - --opt
+              - "build-arg:NIX_SUBSTITUTERS=http://ncps.nix-pull-through-cache.svc.cluster.local:80 https://cache.nixos.org"
           - name: BUILDKITD_TOML
             value: |
               debug = true

.webhook_bridge/pipeline-format.yaml

@@ -2,6 +2,8 @@ apiVersion: tekton.dev/v1
 kind: PipelineRun
 metadata:
   name: rust-format
+  labels:
+    pdb: protect
 spec:
   timeouts:
     pipeline: "2h0m0s"
@@ -50,18 +52,6 @@ spec:
           - name: TARGET_URL
             value: "https://tekton.fizz.buzz/#/namespaces/$(context.pipelineRun.namespace)/pipelineruns/$(context.pipelineRun.name)"
       - name: fetch-repository
-        taskRef:
-          resolver: git
-          params:
-            - name: url
-              value: https://code.fizz.buzz/mirror/catalog.git # mirror of https://github.com/tektoncd/catalog.git
-            - name: revision
-              value: df36b3853a5657fd883015cdbf07ad6466918acf
-            - name: pathInRepo
-              value: task/git-clone/0.9/git-clone.yaml
-        workspaces:
-          - name: output
-            workspace: git-source
         params:
           - name: url
             value: $(params.REPO_URL)
@@ -69,6 +59,18 @@ spec:
             value: $(params.PULL_BASE_SHA)
           - name: deleteExisting
             value: "true"
+        taskRef:
+          params:
+            - name: url
+              value: https://code.fizz.buzz/talexander/personal_tekton_catalog.git
+            - name: revision
+              value: "dda7b690195b43e8b9859d1caf5dcbf48588ade1"
+            - name: pathInRepo
+              value: task/git-clone/0.1/git-clone.yaml
+          resolver: git
+        workspaces:
+          - name: output
+            workspace: git-source
       - name: get-git-commit-time
         taskSpec:
           metadata: {}
@@ -101,7 +103,7 @@ spec:
             - name: url
               value: https://code.fizz.buzz/talexander/personal_tekton_catalog.git
             - name: revision
-              value: 7ee31a185243ee6da13dcd26a592c585b64c80e5
+              value: dda7b690195b43e8b9859d1caf5dcbf48588ade1
             - name: pathInRepo
               value: task/buildkit-rootless-daemonless/0.1/buildkit-rootless-daemonless.yaml
         params:
@@ -167,6 +169,8 @@ spec:
               env:
                 - name: CARGO_TARGET_DIR
                   value: /target
+                - name: RUSTUP_PERMIT_COPY_RENAME
+                  value: "true"
         workspaces:
           - name: source
             workspace: git-source
@@ -212,31 +216,34 @@ spec:
           - name: docker-image
             value: "$(tasks.build-image.results.IMAGE_URL[1])"
       - name: commit-changes
-        taskRef:
-          resolver: git
-          params:
-            - name: url
-              value: https://code.fizz.buzz/mirror/catalog.git # mirror of https://github.com/tektoncd/catalog.git
-            - name: revision
-              value: df36b3853a5657fd883015cdbf07ad6466918acf
-            - name: pathInRepo
-              value: task/git-cli/0.4/git-cli.yaml
-        params:
-          - name: GIT_USER_NAME
-            value: fluxcdbot
-          - name: GIT_USER_EMAIL
-            value: "fluxcdbot@users.noreply.github.com"
-          - name: GIT_SCRIPT
-            value: |
-              pwd
-              git config --global --add safe.directory /workspace/source
-              git_status=$(git status --porcelain)
-              if [ -n "$git_status" ]; then
-                git commit -a -m "CI: autofix rust code."
-                git push origin HEAD:$(params.PULL_BASE_REF)
-              else
-                echo "No changes to commit."
-              fi
+        taskSpec:
+          metadata: {}
+          stepTemplate:
+            image: alpine:3.20
+            computeResources:
+              requests:
+                cpu: 10m
+                memory: 600Mi
+            workingDir: "$(workspaces.source.path)"
+          steps:
+            - image: alpine/git:v2.34.2
+              name: commit-changes-step
+              script: |
+                #!/usr/bin/env sh
+                set -euo pipefail
+                git config --global user.email "fluxcdbot@users.noreply.github.com"
+                git config --global user.name "fluxcdbot"
+                git config --global --add safe.directory /workspace/source
+                git_status=$(git status --porcelain)
+                if [ -n "$git_status" ]; then
+                  git commit -a -m "CI: autofix rust code."
+                  git push origin HEAD:$(params.PULL_BASE_REF)
+                else
+                  echo "No changes to commit."
+                fi
+              env:
+                - name: "GIT_SSH_COMMAND"
+                  value: "ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null"
         workspaces:
           - name: source
             workspace: git-source
@@ -329,6 +336,9 @@ spec:
               workingDir: "$(workspaces.source.path)"
               command: [cargo, cache, --autoclean]
               args: []
+              env:
+                - name: RUSTUP_PERMIT_COPY_RENAME
+                  value: "true"
         workspaces:
           - name: source
             workspace: git-source

.webhook_bridge/pipeline-rust-clippy.yaml

@@ -2,6 +2,8 @@ apiVersion: tekton.dev/v1
 kind: PipelineRun
 metadata:
   name: rust-clippy
+  labels:
+    pdb: protect
 spec:
   taskRunTemplate:
     serviceAccountName: build-bot
@@ -50,18 +52,6 @@ spec:
           - name: TARGET_URL
             value: "https://tekton.fizz.buzz/#/namespaces/$(context.pipelineRun.namespace)/pipelineruns/$(context.pipelineRun.name)"
       - name: fetch-repository
-        taskRef:
-          resolver: git
-          params:
-            - name: url
-              value: https://code.fizz.buzz/mirror/catalog.git # mirror of https://github.com/tektoncd/catalog.git
-            - name: revision
-              value: df36b3853a5657fd883015cdbf07ad6466918acf
-            - name: pathInRepo
-              value: task/git-clone/0.9/git-clone.yaml
-        workspaces:
-          - name: output
-            workspace: git-source
         params:
           - name: url
             value: $(params.REPO_URL)
@@ -69,6 +59,18 @@ spec:
             value: $(params.PULL_BASE_SHA)
           - name: deleteExisting
             value: "true"
+        taskRef:
+          params:
+            - name: url
+              value: https://code.fizz.buzz/talexander/personal_tekton_catalog.git
+            - name: revision
+              value: "dda7b690195b43e8b9859d1caf5dcbf48588ade1"
+            - name: pathInRepo
+              value: task/git-clone/0.1/git-clone.yaml
+          resolver: git
+        workspaces:
+          - name: output
+            workspace: git-source
       - name: get-git-commit-time
         taskSpec:
           metadata: {}
@@ -101,7 +103,7 @@ spec:
             - name: url
               value: https://code.fizz.buzz/talexander/personal_tekton_catalog.git
             - name: revision
-              value: 7ee31a185243ee6da13dcd26a592c585b64c80e5
+              value: dda7b690195b43e8b9859d1caf5dcbf48588ade1
             - name: pathInRepo
               value: task/buildkit-rootless-daemonless/0.1/buildkit-rootless-daemonless.yaml
         params:
@@ -177,6 +179,8 @@ spec:
               env:
                 - name: CARGO_TARGET_DIR
                   value: /target
+                - name: RUSTUP_PERMIT_COPY_RENAME
+                  value: "true"
         workspaces:
           - name: source
             workspace: git-source
@@ -273,6 +277,9 @@ spec:
               workingDir: "$(workspaces.source.path)"
               command: [cargo, cache, --autoclean]
               args: []
+              env:
+                - name: RUSTUP_PERMIT_COPY_RENAME
+                  value: "true"
         workspaces:
           - name: source
             workspace: git-source

.webhook_bridge/pipeline-rust-test.yaml

@@ -2,6 +2,8 @@ apiVersion: tekton.dev/v1
 kind: PipelineRun
 metadata:
   name: rust-test
+  labels:
+    pdb: protect
 spec:
   timeouts:
     pipeline: "2h0m0s"
@@ -50,18 +52,6 @@ spec:
           - name: TARGET_URL
             value: "https://tekton.fizz.buzz/#/namespaces/$(context.pipelineRun.namespace)/pipelineruns/$(context.pipelineRun.name)"
       - name: fetch-repository
-        taskRef:
-          resolver: git
-          params:
-            - name: url
-              value: https://code.fizz.buzz/mirror/catalog.git # mirror of https://github.com/tektoncd/catalog.git
-            - name: revision
-              value: df36b3853a5657fd883015cdbf07ad6466918acf
-            - name: pathInRepo
-              value: task/git-clone/0.9/git-clone.yaml
-        workspaces:
-          - name: output
-            workspace: git-source
         params:
           - name: url
             value: $(params.REPO_URL)
@@ -69,6 +59,18 @@ spec:
             value: $(params.PULL_BASE_SHA)
           - name: deleteExisting
             value: "true"
+        taskRef:
+          params:
+            - name: url
+              value: https://code.fizz.buzz/talexander/personal_tekton_catalog.git
+            - name: revision
+              value: "dda7b690195b43e8b9859d1caf5dcbf48588ade1"
+            - name: pathInRepo
+              value: task/git-clone/0.1/git-clone.yaml
+          resolver: git
+        workspaces:
+          - name: output
+            workspace: git-source
       - name: get-git-commit-time
         taskSpec:
           metadata: {}
@@ -101,7 +103,7 @@ spec:
             - name: url
               value: https://code.fizz.buzz/talexander/personal_tekton_catalog.git
             - name: revision
-              value: 7ee31a185243ee6da13dcd26a592c585b64c80e5
+              value: dda7b690195b43e8b9859d1caf5dcbf48588ade1
             - name: pathInRepo
               value: task/buildkit-rootless-daemonless/0.1/buildkit-rootless-daemonless.yaml
         params:
@@ -162,11 +164,13 @@ spec:
             - name: run
               image: $(params.docker-image)
               workingDir: "$(workspaces.source.path)"
-              command: [cargo, test, --no-fail-fast]
-              args: []
+              command: [cargo, test]
+              args: [--no-fail-fast]
               env:
                 - name: CARGO_TARGET_DIR
                   value: /target
+                - name: RUSTUP_PERMIT_COPY_RENAME
+                  value: "true"
         workspaces:
           - name: source
             workspace: git-source
@@ -263,6 +267,9 @@ spec:
               workingDir: "$(workspaces.source.path)"
               command: [cargo, cache, --autoclean]
               args: []
+              env:
+                - name: RUSTUP_PERMIT_COPY_RENAME
+                  value: "true"
         workspaces:
           - name: source
             workspace: git-source

Cargo.toml

@@ -48,7 +48,7 @@ default = ["tracing"]
 tracing = ["dep:opentelemetry", "dep:opentelemetry-otlp", "dep:opentelemetry-semantic-conventions", "dep:tracing", "dep:tracing-opentelemetry", "dep:tracing-subscriber"]
 
 # Optimized build for any sort of release.
-[profile.release-lto]
+[profile.lto]
 inherits = "release"
 lto = true
 strip = "symbols"

default_environment/templates/html/main.dust

@@ -1,5 +1,5 @@
 <!DOCTYPE html>
-<html>
+<html lang="en">
   <head>
     <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
     <meta name="viewport" content="width=device-width,initial-scale=1" />

docker/natter/Dockerfile

@@ -1,16 +1,46 @@
 # syntax=docker/dockerfile:1
-ARG ALPINE_VERSION="3.20"
+#
+# Builder
+#
+ARG NIX_SUBSTITUTERS=https://cache.nixos.org
 
-FROM rustlang/rust:nightly-alpine$ALPINE_VERSION AS builder
+FROM nixos/nix:2.31.3 AS builder
 
-RUN apk add --no-cache musl-dev
+ARG NIX_SUBSTITUTERS
+RUN tee -a /etc/nix/nix.conf <<EOF
+extra-experimental-features = nix-command flakes
+filter-syscalls = false
+substituters = $NIX_SUBSTITUTERS
+EOF
 
-RUN mkdir /root/natter
-WORKDIR /root/natter
-COPY --link . .
-# TODO: Add static build, which currently errors due to proc_macro. RUSTFLAGS="-C target-feature=+crt-static"
-RUN --mount=type=tmpfs,target=/tmp --mount=type=cache,target=/usr/local/cargo/registry,sharing=locked CARGO_TARGET_DIR=/target cargo build --profile release-lto
+RUN cp "$(nix build nixpkgs#cacert --print-out-paths)/etc/ssl/certs/ca-bundle.crt" /tmp/ca-bundle.crt
 
-FROM alpine:$ALPINE_VERSION AS runner
+COPY . /tmp/build
+WORKDIR /tmp/build
 
-COPY --link --from=builder /target/release-lto/natter /usr/bin/
+RUN --mount=type=ssh GIT_SSH_COMMAND="ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null" nix build '.#docker_env'
+
+# Export the built closure to a folder
+RUN mkdir /tmp/nix-store-closure
+RUN cp -R $(nix-store -qR result/) /tmp/nix-store-closure
+
+
+
+#
+# Runner
+#
+
+FROM scratch
+
+WORKDIR /app
+
+ENV PATH="$PATH:/app/bin"
+
+ENV SSL_CERT_FILE=/etc/ssl/certs/ca-bundle.crt
+ENV NIX_SSL_CERT_FILE=/etc/ssl/certs/ca-bundle.crt
+COPY --from=builder /tmp/ca-bundle.crt /etc/ssl/certs/ca-bundle.crt
+
+COPY --from=builder /tmp/nix-store-closure /nix/store
+COPY --from=builder /tmp/build/result /app
+
+CMD ["/app/bin/natter"]

flake.lock

@@ -0,0 +1,48 @@
+{
+  "nodes": {
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1780749050,
+        "narHash": "sha256-3av0pIjlOWQ6rDbNOmpUSvbNnJkGORQKKjb4LtCZsIY=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "a799d3e3886da994fa307f817a6bc705ae538eeb",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "root": {
+      "inputs": {
+        "nixpkgs": "nixpkgs",
+        "rust-overlay": "rust-overlay"
+      }
+    },
+    "rust-overlay": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1781407245,
+        "narHash": "sha256-VzJq4MmD0uyNDAceudSe1hHqcQMe9Tau0U4S+5iRGh0=",
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "rev": "d5f483210eb016d66102eef22baa128b3b3233fc",
+        "type": "github"
+      },
+      "original": {
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "type": "github"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}

flake.nix

@@ -0,0 +1,83 @@
+{
+  description = "Natter static site generator";
+
+  inputs = {
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
+    rust-overlay = {
+      url = "github:oxalica/rust-overlay";
+      inputs = {
+        nixpkgs.follows = "nixpkgs";
+      };
+    };
+  };
+
+  outputs =
+    {
+      self,
+      nixpkgs,
+      rust-overlay,
+    }:
+    let
+      forAllSystems =
+        func:
+        builtins.listToAttrs (
+          map (system: {
+            name = system;
+            value = func system;
+          }) nixpkgs.lib.systems.flakeExposed
+        );
+    in
+    {
+      devShells = forAllSystems (
+        system:
+        let
+          overlays = [ (import rust-overlay) ];
+          pkgs = import nixpkgs {
+            inherit system overlays;
+          };
+          rustToolchain = (pkgs.rust-bin.fromRustupToolchainFile ./rust-toolchain.toml);
+        in
+        {
+          default = pkgs.mkShell {
+            nativeBuildInputs = [
+              rustToolchain
+            ];
+            buildInputs = with pkgs; [
+            ];
+          };
+        }
+      );
+      packages = forAllSystems (
+        system:
+        let
+          overlays = [ (import rust-overlay) ];
+          pkgs = import nixpkgs {
+            inherit system overlays;
+          };
+          appliedOverlay = self.overlays.default pkgs pkgs;
+        in
+        rec {
+          default = release;
+          inherit (appliedOverlay.natter)
+            release
+            ;
+          docker_env = pkgs.buildEnv {
+            name = "natter";
+            paths = with pkgs; [
+              appliedOverlay.natter.release
+            ];
+          };
+        }
+      );
+      overlays.default = final: prev: {
+        natter = final.lib.makeScope final.newScope (natterScope: {
+          release = (
+            natterScope.callPackage ./nix/package.nix {
+              inherit rust-overlay;
+              buildType = "lto";
+            }
+          );
+        });
+      };
+    };
+}

nix/package.nix

@@ -0,0 +1,82 @@
+{
+  hello,
+  lib,
+  pkgs,
+  rust-overlay,
+
+  targetBins ? [ ],
+  features ? [ ],
+  cargoBuildTarget ? null,
+  buildType ? null,
+  buildLib ? false,
+}:
+let
+  cargoToml = (lib.importTOML ../Cargo.toml);
+  rustPlatformFor =
+    pkgs:
+    let
+      rust-bin = rust-overlay.lib.mkRustBin { } pkgs;
+      rustToolchain = (rust-bin.fromRustupToolchainFile ../rust-toolchain.toml).override (
+        if cargoBuildTarget != null then
+          {
+            targets = [ cargoBuildTarget ];
+          }
+        else
+          { }
+      );
+      baseRustPlatform = (
+        pkgs.makeRustPlatform {
+          cargo = rustToolchain;
+          rustc = rustToolchain;
+        }
+      );
+      rustPlatform =
+        if cargoBuildTarget != null then
+          baseRustPlatform.overrideScope (
+            final: prev: {
+              cargoBuildHook = prev.cargoBuildHook.overrideDerivation (_: {
+                rustcTargetSpec = cargoBuildTarget;
+              });
+              cargoInstallHook = hello;
+            }
+          )
+        else
+          baseRustPlatform;
+    in
+    rustPlatform;
+in
+(rustPlatformFor pkgs).buildRustPackage (
+  # rustPlatform.buildRustPackage (
+  {
+    pname = "natter";
+    version = cargoToml.package.version;
+    src = lib.cleanSource ../.;
+
+    cargoLock.lockFile = ../Cargo.lock;
+
+    cargoBuildFlags = builtins.concatLists [
+      (builtins.concatMap (targetBin: [
+        "--bin"
+        targetBin
+      ]) targetBins)
+      (if buildLib then [ "--lib" ] else [ ])
+      (
+        if features != [ ] then
+          [
+            "--features"
+            (builtins.concatStringsSep " " features)
+          ]
+        else
+          [ ]
+      )
+    ];
+  }
+  // (
+    if buildType != null then
+      {
+        buildType = buildType;
+      }
+    else
+      { }
+  )
+)

rust-toolchain.toml

@@ -1,4 +1,4 @@
 [toolchain]
-channel = "nightly"
+channel = "nightly-2026-05-23"
 profile = "default"
 components = ["clippy", "rustfmt"]