CI: autofix rust code.

.dockerignore

@@ -1,5 +1,3 @@
 **/.git
 target/
 org_test_documents/
-docker/
-/.webhook_bridge

.gitignore

@@ -1,2 +1 @@
 /target
-/result

.webhook_bridge/pipeline-build-hash.yaml

@@ -2,8 +2,6 @@ apiVersion: tekton.dev/v1
 kind: PipelineRun
 metadata:
   name: build
-  labels:
-    pdb: protect
 spec:
   timeouts:
     pipeline: "2h0m0s"
@@ -52,6 +50,18 @@ spec:
           - name: TARGET_URL
             value: "https://tekton.fizz.buzz/#/namespaces/$(context.pipelineRun.namespace)/pipelineruns/$(context.pipelineRun.name)"
       - name: fetch-repository
+        taskRef:
+          resolver: git
+          params:
+            - name: url
+              value: https://code.fizz.buzz/mirror/catalog.git # mirror of https://github.com/tektoncd/catalog.git
+            - name: revision
+              value: df36b3853a5657fd883015cdbf07ad6466918acf
+            - name: pathInRepo
+              value: task/git-clone/0.9/git-clone.yaml
+        workspaces:
+          - name: output
+            workspace: git-source
         params:
           - name: url
             value: $(params.REPO_URL)
@@ -59,18 +69,6 @@ spec:
             value: $(params.PULL_BASE_SHA)
           - name: deleteExisting
             value: "true"
-        taskRef:
-          params:
-            - name: url
-              value: https://code.fizz.buzz/talexander/personal_tekton_catalog.git
-            - name: revision
-              value: "dda7b690195b43e8b9859d1caf5dcbf48588ade1"
-            - name: pathInRepo
-              value: task/git-clone/0.1/git-clone.yaml
-          resolver: git
-        workspaces:
-          - name: output
-            workspace: git-source
       - name: get-git-commit-time
         taskSpec:
           metadata: {}
@@ -103,7 +101,7 @@ spec:
             - name: url
               value: https://code.fizz.buzz/talexander/personal_tekton_catalog.git
             - name: revision
-              value: dda7b690195b43e8b9859d1caf5dcbf48588ade1
+              value: 7ee31a185243ee6da13dcd26a592c585b64c80e5
             - name: pathInRepo
               value: task/buildkit-rootless-daemonless/0.1/buildkit-rootless-daemonless.yaml
         params:
@@ -124,8 +122,6 @@ spec:
               - "type=registry,ref=$(params.image-name):buildcache,mode=max,compression=zstd,compression-level=22,rewrite-timestamp=true,image-manifest=true,oci-mediatypes=true"
               - --opt
               - build-arg:SOURCE_DATE_EPOCH=$(tasks.get-git-commit-time.results.unix-time)
-              - --opt
-              - "build-arg:NIX_SUBSTITUTERS=http://ncps.nix-pull-through-cache.svc.cluster.local:80 https://cache.nixos.org"
           - name: BUILDKITD_TOML
             value: |
               debug = true

.webhook_bridge/pipeline-format.yaml

@@ -2,8 +2,6 @@ apiVersion: tekton.dev/v1
 kind: PipelineRun
 metadata:
   name: rust-format
-  labels:
-    pdb: protect
 spec:
   timeouts:
     pipeline: "2h0m0s"
@@ -52,6 +50,18 @@ spec:
           - name: TARGET_URL
             value: "https://tekton.fizz.buzz/#/namespaces/$(context.pipelineRun.namespace)/pipelineruns/$(context.pipelineRun.name)"
       - name: fetch-repository
+        taskRef:
+          resolver: git
+          params:
+            - name: url
+              value: https://code.fizz.buzz/mirror/catalog.git # mirror of https://github.com/tektoncd/catalog.git
+            - name: revision
+              value: df36b3853a5657fd883015cdbf07ad6466918acf
+            - name: pathInRepo
+              value: task/git-clone/0.9/git-clone.yaml
+        workspaces:
+          - name: output
+            workspace: git-source
         params:
           - name: url
             value: $(params.REPO_URL)
@@ -59,18 +69,6 @@ spec:
             value: $(params.PULL_BASE_SHA)
           - name: deleteExisting
             value: "true"
-        taskRef:
-          params:
-            - name: url
-              value: https://code.fizz.buzz/talexander/personal_tekton_catalog.git
-            - name: revision
-              value: "dda7b690195b43e8b9859d1caf5dcbf48588ade1"
-            - name: pathInRepo
-              value: task/git-clone/0.1/git-clone.yaml
-          resolver: git
-        workspaces:
-          - name: output
-            workspace: git-source
       - name: get-git-commit-time
         taskSpec:
           metadata: {}
@@ -103,7 +101,7 @@ spec:
             - name: url
               value: https://code.fizz.buzz/talexander/personal_tekton_catalog.git
             - name: revision
-              value: dda7b690195b43e8b9859d1caf5dcbf48588ade1
+              value: 7ee31a185243ee6da13dcd26a592c585b64c80e5
             - name: pathInRepo
               value: task/buildkit-rootless-daemonless/0.1/buildkit-rootless-daemonless.yaml
         params:
@@ -169,8 +167,6 @@ spec:
               env:
                 - name: CARGO_TARGET_DIR
                   value: /target
-                - name: RUSTUP_PERMIT_COPY_RENAME
-                  value: "true"
         workspaces:
           - name: source
             workspace: git-source
@@ -216,34 +212,31 @@ spec:
           - name: docker-image
             value: "$(tasks.build-image.results.IMAGE_URL[1])"
       - name: commit-changes
-        taskSpec:
-          metadata: {}
-          stepTemplate:
-            image: alpine:3.20
-            computeResources:
-              requests:
-                cpu: 10m
-                memory: 600Mi
-            workingDir: "$(workspaces.source.path)"
-          steps:
-            - image: alpine/git:v2.34.2
-              name: commit-changes-step
-              script: |
-                #!/usr/bin/env sh
-                set -euo pipefail
-                git config --global user.email "fluxcdbot@users.noreply.github.com"
-                git config --global user.name "fluxcdbot"
-                git config --global --add safe.directory /workspace/source
-                git_status=$(git status --porcelain)
-                if [ -n "$git_status" ]; then
-                  git commit -a -m "CI: autofix rust code."
-                  git push origin HEAD:$(params.PULL_BASE_REF)
-                else
-                  echo "No changes to commit."
-                fi
-              env:
-                - name: "GIT_SSH_COMMAND"
-                  value: "ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null"
+        taskRef:
+          resolver: git
+          params:
+            - name: url
+              value: https://code.fizz.buzz/mirror/catalog.git # mirror of https://github.com/tektoncd/catalog.git
+            - name: revision
+              value: df36b3853a5657fd883015cdbf07ad6466918acf
+            - name: pathInRepo
+              value: task/git-cli/0.4/git-cli.yaml
+        params:
+          - name: GIT_USER_NAME
+            value: fluxcdbot
+          - name: GIT_USER_EMAIL
+            value: "fluxcdbot@users.noreply.github.com"
+          - name: GIT_SCRIPT
+            value: |
+              pwd
+              git config --global --add safe.directory /workspace/source
+              git_status=$(git status --porcelain)
+              if [ -n "$git_status" ]; then
+                git commit -a -m "CI: autofix rust code."
+                git push origin HEAD:$(params.PULL_BASE_REF)
+              else
+                echo "No changes to commit."
+              fi
         workspaces:
           - name: source
             workspace: git-source
@@ -336,9 +329,6 @@ spec:
               workingDir: "$(workspaces.source.path)"
               command: [cargo, cache, --autoclean]
               args: []
-              env:
-                - name: RUSTUP_PERMIT_COPY_RENAME
-                  value: "true"
         workspaces:
           - name: source
             workspace: git-source

.webhook_bridge/pipeline-rust-clippy.yaml

@@ -2,8 +2,6 @@ apiVersion: tekton.dev/v1
 kind: PipelineRun
 metadata:
   name: rust-clippy
-  labels:
-    pdb: protect
 spec:
   taskRunTemplate:
     serviceAccountName: build-bot
@@ -52,6 +50,18 @@ spec:
           - name: TARGET_URL
             value: "https://tekton.fizz.buzz/#/namespaces/$(context.pipelineRun.namespace)/pipelineruns/$(context.pipelineRun.name)"
       - name: fetch-repository
+        taskRef:
+          resolver: git
+          params:
+            - name: url
+              value: https://code.fizz.buzz/mirror/catalog.git # mirror of https://github.com/tektoncd/catalog.git
+            - name: revision
+              value: df36b3853a5657fd883015cdbf07ad6466918acf
+            - name: pathInRepo
+              value: task/git-clone/0.9/git-clone.yaml
+        workspaces:
+          - name: output
+            workspace: git-source
         params:
           - name: url
             value: $(params.REPO_URL)
@@ -59,18 +69,6 @@ spec:
             value: $(params.PULL_BASE_SHA)
           - name: deleteExisting
             value: "true"
-        taskRef:
-          params:
-            - name: url
-              value: https://code.fizz.buzz/talexander/personal_tekton_catalog.git
-            - name: revision
-              value: "dda7b690195b43e8b9859d1caf5dcbf48588ade1"
-            - name: pathInRepo
-              value: task/git-clone/0.1/git-clone.yaml
-          resolver: git
-        workspaces:
-          - name: output
-            workspace: git-source
       - name: get-git-commit-time
         taskSpec:
           metadata: {}
@@ -103,7 +101,7 @@ spec:
             - name: url
               value: https://code.fizz.buzz/talexander/personal_tekton_catalog.git
             - name: revision
-              value: dda7b690195b43e8b9859d1caf5dcbf48588ade1
+              value: 7ee31a185243ee6da13dcd26a592c585b64c80e5
             - name: pathInRepo
               value: task/buildkit-rootless-daemonless/0.1/buildkit-rootless-daemonless.yaml
         params:
@@ -179,8 +177,6 @@ spec:
               env:
                 - name: CARGO_TARGET_DIR
                   value: /target
-                - name: RUSTUP_PERMIT_COPY_RENAME
-                  value: "true"
         workspaces:
           - name: source
             workspace: git-source
@@ -277,9 +273,6 @@ spec:
               workingDir: "$(workspaces.source.path)"
               command: [cargo, cache, --autoclean]
               args: []
-              env:
-                - name: RUSTUP_PERMIT_COPY_RENAME
-                  value: "true"
         workspaces:
           - name: source
             workspace: git-source

.webhook_bridge/pipeline-rust-test.yaml

@@ -2,8 +2,6 @@ apiVersion: tekton.dev/v1
 kind: PipelineRun
 metadata:
   name: rust-test
-  labels:
-    pdb: protect
 spec:
   timeouts:
     pipeline: "2h0m0s"
@@ -52,6 +50,18 @@ spec:
           - name: TARGET_URL
             value: "https://tekton.fizz.buzz/#/namespaces/$(context.pipelineRun.namespace)/pipelineruns/$(context.pipelineRun.name)"
       - name: fetch-repository
+        taskRef:
+          resolver: git
+          params:
+            - name: url
+              value: https://code.fizz.buzz/mirror/catalog.git # mirror of https://github.com/tektoncd/catalog.git
+            - name: revision
+              value: df36b3853a5657fd883015cdbf07ad6466918acf
+            - name: pathInRepo
+              value: task/git-clone/0.9/git-clone.yaml
+        workspaces:
+          - name: output
+            workspace: git-source
         params:
           - name: url
             value: $(params.REPO_URL)
@@ -59,18 +69,6 @@ spec:
             value: $(params.PULL_BASE_SHA)
           - name: deleteExisting
             value: "true"
-        taskRef:
-          params:
-            - name: url
-              value: https://code.fizz.buzz/talexander/personal_tekton_catalog.git
-            - name: revision
-              value: "dda7b690195b43e8b9859d1caf5dcbf48588ade1"
-            - name: pathInRepo
-              value: task/git-clone/0.1/git-clone.yaml
-          resolver: git
-        workspaces:
-          - name: output
-            workspace: git-source
       - name: get-git-commit-time
         taskSpec:
           metadata: {}
@@ -103,7 +101,7 @@ spec:
             - name: url
               value: https://code.fizz.buzz/talexander/personal_tekton_catalog.git
             - name: revision
-              value: dda7b690195b43e8b9859d1caf5dcbf48588ade1
+              value: 7ee31a185243ee6da13dcd26a592c585b64c80e5
             - name: pathInRepo
               value: task/buildkit-rootless-daemonless/0.1/buildkit-rootless-daemonless.yaml
         params:
@@ -164,13 +162,11 @@ spec:
             - name: run
               image: $(params.docker-image)
               workingDir: "$(workspaces.source.path)"
-              command: [cargo, test]
-              args: [--no-fail-fast]
+              command: [cargo, test, --no-fail-fast]
+              args: []
               env:
                 - name: CARGO_TARGET_DIR
                   value: /target
-                - name: RUSTUP_PERMIT_COPY_RENAME
-                  value: "true"
         workspaces:
           - name: source
             workspace: git-source
@@ -267,9 +263,6 @@ spec:
               workingDir: "$(workspaces.source.path)"
               command: [cargo, cache, --autoclean]
               args: []
-              env:
-                - name: RUSTUP_PERMIT_COPY_RENAME
-                  value: "true"
         workspaces:
           - name: source
             workspace: git-source

Cargo.toml

@@ -48,7 +48,7 @@ default = ["tracing"]
 tracing = ["dep:opentelemetry", "dep:opentelemetry-otlp", "dep:opentelemetry-semantic-conventions", "dep:tracing", "dep:tracing-opentelemetry", "dep:tracing-subscriber"]
 
 # Optimized build for any sort of release.
-[profile.lto]
+[profile.release-lto]
 inherits = "release"
 lto = true
 strip = "symbols"

default_environment/templates/html/main.dust

@@ -1,5 +1,5 @@
 <!DOCTYPE html>
-<html lang="en">
+<html>
   <head>
     <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
     <meta name="viewport" content="width=device-width,initial-scale=1" />

docker/natter/Dockerfile

@@ -1,46 +1,16 @@
 # syntax=docker/dockerfile:1
-#
-# Builder
-#
-ARG NIX_SUBSTITUTERS=https://cache.nixos.org
+ARG ALPINE_VERSION="3.20"
 
-FROM nixos/nix:2.31.3 AS builder
+FROM rustlang/rust:nightly-alpine$ALPINE_VERSION AS builder
 
-ARG NIX_SUBSTITUTERS
-RUN tee -a /etc/nix/nix.conf <<EOF
-extra-experimental-features = nix-command flakes
-filter-syscalls = false
-substituters = $NIX_SUBSTITUTERS
-EOF
+RUN apk add --no-cache musl-dev
 
-RUN cp "$(nix build nixpkgs#cacert --print-out-paths)/etc/ssl/certs/ca-bundle.crt" /tmp/ca-bundle.crt
+RUN mkdir /root/natter
+WORKDIR /root/natter
+COPY --link . .
+# TODO: Add static build, which currently errors due to proc_macro. RUSTFLAGS="-C target-feature=+crt-static"
+RUN --mount=type=tmpfs,target=/tmp --mount=type=cache,target=/usr/local/cargo/registry,sharing=locked CARGO_TARGET_DIR=/target cargo build --profile release-lto
 
-COPY . /tmp/build
-WORKDIR /tmp/build
+FROM alpine:$ALPINE_VERSION AS runner
 
-RUN --mount=type=ssh GIT_SSH_COMMAND="ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null" nix build '.#docker_env'
-
-# Export the built closure to a folder
-RUN mkdir /tmp/nix-store-closure
-RUN cp -R $(nix-store -qR result/) /tmp/nix-store-closure
-
-
-
-#
-# Runner
-#
-
-FROM scratch
-
-WORKDIR /app
-
-ENV PATH="$PATH:/app/bin"
-
-ENV SSL_CERT_FILE=/etc/ssl/certs/ca-bundle.crt
-ENV NIX_SSL_CERT_FILE=/etc/ssl/certs/ca-bundle.crt
-COPY --from=builder /tmp/ca-bundle.crt /etc/ssl/certs/ca-bundle.crt
-
-COPY --from=builder /tmp/nix-store-closure /nix/store
-COPY --from=builder /tmp/build/result /app
-
-CMD ["/app/bin/natter"]
+COPY --link --from=builder /target/release-lto/natter /usr/bin/

flake.lock

@@ -1,48 +0,0 @@
-{
-  "nodes": {
-    "nixpkgs": {
-      "locked": {
-        "lastModified": 1780749050,
-        "narHash": "sha256-3av0pIjlOWQ6rDbNOmpUSvbNnJkGORQKKjb4LtCZsIY=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "a799d3e3886da994fa307f817a6bc705ae538eeb",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "ref": "nixos-unstable",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "root": {
-      "inputs": {
-        "nixpkgs": "nixpkgs",
-        "rust-overlay": "rust-overlay"
-      }
-    },
-    "rust-overlay": {
-      "inputs": {
-        "nixpkgs": [
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1781407245,
-        "narHash": "sha256-VzJq4MmD0uyNDAceudSe1hHqcQMe9Tau0U4S+5iRGh0=",
-        "owner": "oxalica",
-        "repo": "rust-overlay",
-        "rev": "d5f483210eb016d66102eef22baa128b3b3233fc",
-        "type": "github"
-      },
-      "original": {
-        "owner": "oxalica",
-        "repo": "rust-overlay",
-        "type": "github"
-      }
-    }
-  },
-  "root": "root",
-  "version": 7
-}

flake.nix

@@ -1,83 +0,0 @@
-{
-  description = "Natter static site generator";
-
-  inputs = {
-    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
-    rust-overlay = {
-      url = "github:oxalica/rust-overlay";
-      inputs = {
-        nixpkgs.follows = "nixpkgs";
-      };
-    };
-  };
-
-  outputs =
-    {
-      self,
-      nixpkgs,
-      rust-overlay,
-    }:
-    let
-      forAllSystems =
-        func:
-        builtins.listToAttrs (
-          map (system: {
-            name = system;
-            value = func system;
-          }) nixpkgs.lib.systems.flakeExposed
-        );
-    in
-    {
-      devShells = forAllSystems (
-        system:
-        let
-          overlays = [ (import rust-overlay) ];
-          pkgs = import nixpkgs {
-            inherit system overlays;
-          };
-          rustToolchain = (pkgs.rust-bin.fromRustupToolchainFile ./rust-toolchain.toml);
-        in
-        {
-          default = pkgs.mkShell {
-            nativeBuildInputs = [
-              rustToolchain
-            ];
-            buildInputs = with pkgs; [
-            ];
-          };
-        }
-      );
-      packages = forAllSystems (
-        system:
-        let
-          overlays = [ (import rust-overlay) ];
-          pkgs = import nixpkgs {
-            inherit system overlays;
-          };
-          appliedOverlay = self.overlays.default pkgs pkgs;
-        in
-        rec {
-          default = release;
-          inherit (appliedOverlay.natter)
-            release
-            ;
-          docker_env = pkgs.buildEnv {
-            name = "natter";
-            paths = with pkgs; [
-              appliedOverlay.natter.release
-            ];
-          };
-        }
-      );
-      overlays.default = final: prev: {
-        natter = final.lib.makeScope final.newScope (natterScope: {
-          release = (
-            natterScope.callPackage ./nix/package.nix {
-              inherit rust-overlay;
-              buildType = "lto";
-            }
-          );
-        });
-      };
-    };
-}

nix/package.nix

@@ -1,82 +0,0 @@
-{
-  hello,
-  lib,
-  pkgs,
-  rust-overlay,
-
-  targetBins ? [ ],
-  features ? [ ],
-  cargoBuildTarget ? null,
-  buildType ? null,
-  buildLib ? false,
-}:
-let
-  cargoToml = (lib.importTOML ../Cargo.toml);
-  rustPlatformFor =
-    pkgs:
-    let
-      rust-bin = rust-overlay.lib.mkRustBin { } pkgs;
-      rustToolchain = (rust-bin.fromRustupToolchainFile ../rust-toolchain.toml).override (
-        if cargoBuildTarget != null then
-          {
-            targets = [ cargoBuildTarget ];
-          }
-        else
-          { }
-      );
-      baseRustPlatform = (
-        pkgs.makeRustPlatform {
-          cargo = rustToolchain;
-          rustc = rustToolchain;
-        }
-      );
-      rustPlatform =
-        if cargoBuildTarget != null then
-          baseRustPlatform.overrideScope (
-            final: prev: {
-              cargoBuildHook = prev.cargoBuildHook.overrideDerivation (_: {
-                rustcTargetSpec = cargoBuildTarget;
-              });
-              cargoInstallHook = hello;
-            }
-          )
-        else
-          baseRustPlatform;
-    in
-    rustPlatform;
-in
-(rustPlatformFor pkgs).buildRustPackage (
-  # rustPlatform.buildRustPackage (
-  {
-    pname = "natter";
-    version = cargoToml.package.version;
-    src = lib.cleanSource ../.;
-
-    cargoLock.lockFile = ../Cargo.lock;
-
-    cargoBuildFlags = builtins.concatLists [
-      (builtins.concatMap (targetBin: [
-        "--bin"
-        targetBin
-      ]) targetBins)
-      (if buildLib then [ "--lib" ] else [ ])
-      (
-        if features != [ ] then
-          [
-            "--features"
-            (builtins.concatStringsSep " " features)
-          ]
-        else
-          [ ]
-      )
-    ];
-  }
-  // (
-    if buildType != null then
-      {
-        buildType = buildType;
-      }
-    else
-      { }
-  )
-)

rust-toolchain.toml

@@ -1,4 +1,4 @@
 [toolchain]
-channel = "nightly-2026-05-23"
+channel = "nightly"
 profile = "default"
 components = ["clippy", "rustfmt"]